syzbot


KASAN: use-after-free Read in free_netdev (2)
Status: internal: reported C repro on 2020/03/06 20:00
Reported-by: syzbot+@syzkaller.appspotmail.com
Fix commit: f123cffdd8fe net: netlink: af_netlink: Prevent empty skb by adding a check on len.
Patched on: [ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-leak ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce ci-upstream-kmsan-gce-386 ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu2-riscv64]
First crash: 689d, last: 55d

Cause bisection: introduced by (bisect log) :
commit d835b63cc4ee67e59eed9d1957f729c0a30b7331
Author: Allen Pais <allen.lkml@gmail.com>
Date: Mon Sep 25 07:30:05 2017 +0000

  net: nfc: llcp_core: use setup_timer() helper.

Crash: general protection fault in batadv_iv_ogm_queue_add (log)
Repro: C syz .config

Fix bisection: fixed by (bisect log) :
commit f123cffdd8fe8ea6c7fded4b88516a42798797d0
Author: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com>
Date: Mon Nov 29 17:53:27 2021 +0000

  net: netlink: af_netlink: Prevent empty skb by adding a check on len.

similar bugs (4):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 KASAN: use-after-free Read in free_netdev C error 134 498d 688d 0/1 upstream: reported C repro on 2020/03/07 10:14
android-54 KASAN: use-after-free Read in free_netdev C 417 489d 689d 0/1 upstream: reported C repro on 2020/03/06 20:14
upstream KASAN: use-after-free Read in free_netdev C 42 1536d 1559d 3/22 fixed on 2017/11/28 03:36
upstream general protection fault in free_netdev (2) 1 216d 216d 0/22 auto-closed as invalid on 2021/09/20 23:14

Sample crash report:

Crashes (1715):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-root 2020/08/17 05:53 upstream 2cc3c4b3c2e9 424dd8e7 .config log report syz C
ci-upstream-kasan-gce-root 2020/06/10 12:15 upstream 7ae77150d94d 860c4de9 .config log report syz C
ci-upstream-kasan-gce-smack-root 2020/05/17 09:09 upstream 3d1c1e5931ce 37bccd4e .config log report syz C
ci-upstream-net-this-kasan-gce 2020/06/10 09:01 net 4d3da2d8d91f 860c4de9 .config log report syz C
ci-upstream-net-this-kasan-gce 2020/03/08 04:08 net aeaa925bff84 2e9971bb .config log report syz C
ci-upstream-kasan-gce-selinux-root 2020/08/16 07:27 upstream d84835b118ed 424dd8e7 .config log report syz
ci-upstream-kasan-gce-smack-root 2020/08/15 21:29 upstream c9c9735c46f5 424dd8e7 .config log report syz
ci-upstream-kasan-gce-selinux-root 2020/07/05 02:26 upstream 7cc2a8ea1048 51095195 .config log report syz
ci-upstream-kasan-gce-root 2020/07/04 22:26 upstream 7cc2a8ea1048 51095195 .config log report syz
ci-upstream-kasan-gce-smack-root 2020/07/04 14:27 upstream 7cc2a8ea1048 51095195 .config log report syz
ci-upstream-kasan-gce-root 2020/06/18 04:43 upstream 7ae77150d94d b9f3810b .config log report syz
ci-upstream-kasan-gce-smack-root 2020/06/10 08:51 upstream 7ae77150d94d 860c4de9 .config log report syz
ci-upstream-kasan-gce-selinux-root 2020/05/04 05:54 upstream 262f7a6b8317 58ae5e18 .config log report syz
ci-upstream-kasan-gce-smack-root 2020/04/08 05:22 upstream 763dede1b248 db9bcd4b .config log report syz
ci-upstream-kasan-gce-selinux-root 2020/04/07 12:49 upstream 7e63420847ae 99a96044 .config log report syz
ci-upstream-kasan-gce-root 2020/04/02 13:24 upstream 919dce24701f a34e2c33 .config log report syz
ci-upstream-kasan-gce-selinux-root 2020/03/23 23:42 upstream 16fbf79b0f83 84f999d6 .config log report syz
ci-upstream-kasan-gce-selinux-root 2020/03/22 05:43 upstream b74b991fb8b9 78267cec .config log report syz
ci-upstream-kasan-gce-selinux-root 2020/03/20 23:19 upstream 6c90b86a745a 2c31c529 .config log report syz
ci-upstream-kasan-gce-selinux-root 2020/03/17 04:59 upstream fb33c6510d55 749688d2 .config log report syz
ci-upstream-kasan-gce-root 2020/03/16 20:10 upstream fb33c6510d55 749688d2 .config log report syz
ci-qemu-upstream-386 2020/06/10 22:08 upstream 435faf5c218a b4eca550 .config log report syz
ci-upstream-net-this-kasan-gce 2020/07/04 20:50 net 1ca0fafd73c5 51095195 .config log report syz
ci-upstream-net-this-kasan-gce 2020/03/12 19:31 net e1f550dc44a4 d850e9d0 .config log report syz
ci-upstream-net-kasan-gce 2020/07/04 19:49 net-next e44f65fd666c 51095195 .config log report syz
ci-upstream-net-kasan-gce 2020/06/18 01:38 net-next cb8e59cc8720 b9f3810b .config log report syz
ci-upstream-net-kasan-gce 2020/03/10 07:25 net-next 34a568a244be 35f53e45 .config log report syz
ci-upstream-net-kasan-gce 2020/03/07 01:41 net-next 68e2c37690b0 fd2a5f28 .config log report syz
ci-upstream-linux-next-kasan-gce-root 2020/07/04 19:14 linux-next 9e50b94b3eb0 51095195 .config log report syz
ci-upstream-linux-next-kasan-gce-root 2020/04/07 17:50 linux-next 5fab54423a0a 99a96044 .config log report syz
ci-upstream-linux-next-kasan-gce-root 2020/04/03 07:11 linux-next 770fbb32d34e a34e2c33 .config log report syz
ci-upstream-linux-next-kasan-gce-root 2020/04/02 17:42 linux-next 770fbb32d34e a34e2c33 .config log report syz
ci-upstream-linux-next-kasan-gce-root 2020/04/02 10:59 linux-next 770fbb32d34e a34e2c33 .config log report syz
ci-upstream-linux-next-kasan-gce-root 2020/04/01 12:37 linux-next 770fbb32d34e a34e2c33 .config log report syz
ci-upstream-linux-next-kasan-gce-root 2020/03/29 12:30 linux-next 770fbb32d34e 05736b29 .config log report syz
ci-upstream-linux-next-kasan-gce-root 2020/03/28 08:39 linux-next 770fbb32d34e 831e9a81 .config log report syz
ci-upstream-linux-next-kasan-gce-root 2020/03/27 22:35 linux-next 770fbb32d34e 831e9a81 .config log report syz
ci-upstream-linux-next-kasan-gce-root 2020/03/27 12:22 linux-next 770fbb32d34e 7d95711b .config log report syz
ci-upstream-linux-next-kasan-gce-root 2020/03/27 03:47 linux-next 770fbb32d34e 6d25c5a0 .config log report syz
ci-upstream-linux-next-kasan-gce-root 2020/03/26 10:13 linux-next 770fbb32d34e e8e6c7d2 .config log report syz
ci-upstream-linux-next-kasan-gce-root 2020/03/25 22:38 linux-next 770fbb32d34e 41f049cc .config log report syz
ci-upstream-linux-next-kasan-gce-root 2020/03/25 18:03 linux-next 770fbb32d34e 41f049cc .config log report syz
ci-upstream-linux-next-kasan-gce-root 2020/03/25 10:20 linux-next 770fbb32d34e 41f049cc .config log report syz
ci-upstream-bpf-next-kasan-gce 2021/10/31 13:47 bpf-next f48ad69097fe 098b5d53 .config log report info KASAN: use-after-free Read in free_netdev
ci-upstream-bpf-next-kasan-gce 2021/10/09 01:05 bpf-next e52a8b96c5ad efe0f24d .config log report info KASAN: use-after-free Read in free_netdev
ci-upstream-kasan-gce-root 2020/09/21 06:21 upstream ba4f184e126b 9564d2e9 .config log report info
ci-upstream-kasan-gce-smack-root 2020/09/19 03:03 upstream 92ab97adeefc 53ce8104 .config log report info
ci-upstream-kasan-gce-smack-root 2020/09/18 13:42 upstream 10b82d517648 38962c8b .config log report info
ci-upstream-kasan-gce-smack-root 2020/09/18 10:58 upstream 10b82d517648 38962c8b .config log report info
ci-upstream-kasan-gce-smack-root 2020/09/18 05:16 upstream 10b82d517648 8247808b .config log report info
ci-upstream-kasan-gce-smack-root 2020/09/17 10:54 upstream 5925fa68fe82 8247808b .config log report info
ci-upstream-kasan-gce-smack-root 2020/09/16 19:48 upstream fc4f28bb3daf 18d7d030 .config log report info
ci-upstream-kasan-gce-smack-root 2020/09/14 06:42 upstream e4c26faa426c 2d3cdd63 .config log report
ci-upstream-kasan-gce-root 2020/09/14 02:45 upstream e4c26faa426c 2d3cdd63 .config log report
ci-upstream-kasan-gce-root 2020/09/14 01:26 upstream e4c26faa426c 2d3cdd63 .config log report
ci-upstream-kasan-gce-selinux-root 2020/09/10 15:30 upstream 7fe10096c150 409809d8 .config log report
ci-qemu-upstream 2020/06/16 11:31 upstream 435faf5c218a 4ea9d964 .config log report
ci-upstream-net-this-kasan-gce 2020/09/21 09:58 net e1b81391421b 9564d2e9 .config log report info
ci-upstream-net-this-kasan-gce 2020/09/20 16:39 net f13d783a184e 9564d2e9 .config log report info
ci-upstream-net-this-kasan-gce 2020/09/19 05:58 net fc25fa97976b 53ce8104 .config log report info
ci-upstream-net-this-kasan-gce 2020/09/18 11:39 net 5f6857e808a8 38962c8b .config log report info
ci-upstream-net-this-kasan-gce 2020/09/18 08:26 net 5f6857e808a8 38962c8b .config log report info
ci-upstream-net-this-kasan-gce 2020/09/17 21:22 net fd944dc24336 8247808b .config log report info
ci-upstream-net-this-kasan-gce 2020/09/17 02:03 net d5d325eae782 8247808b .config log report info
ci-upstream-net-this-kasan-gce 2020/09/16 09:47 net 2e5117ba9f58 18d7d030 .config log report info
ci-upstream-net-this-kasan-gce 2020/09/16 02:53 net 8e1b3ac47866 6989d6f6 .config log report info
ci-upstream-net-this-kasan-gce 2020/09/15 16:09 net 8e1b3ac47866 6989d6f6 .config log report info
ci-upstream-net-this-kasan-gce 2020/09/15 13:34 net 8e1b3ac47866 6989d6f6 .config log report info
ci-upstream-net-this-kasan-gce 2020/09/15 08:19 net 8e1b3ac47866 6989d6f6 .config log report info
ci-upstream-net-this-kasan-gce 2020/09/14 11:42 net 5760d9acbe95 2d3cdd63 .config log report
ci-upstream-net-this-kasan-gce 2020/09/14 10:39 net 5760d9acbe95 2d3cdd63 .config log report
ci-upstream-net-this-kasan-gce 2020/09/14 09:34 net 5760d9acbe95 2d3cdd63 .config log report
ci-upstream-net-this-kasan-gce 2020/09/13 23:23 net 5760d9acbe95 2d3cdd63 .config log report
ci-upstream-net-this-kasan-gce 2020/09/13 22:16 net 5760d9acbe95 2d3cdd63 .config log report
ci-upstream-net-this-kasan-gce 2020/09/13 20:25 net 5760d9acbe95 2d3cdd63 .config log report
ci-upstream-net-this-kasan-gce 2020/09/12 01:38 net cdb0e6dccc1f 79fb24e2 .config log report
ci-upstream-net-this-kasan-gce 2020/09/12 00:16 net ee460417d254 79fb24e2 .config log report
ci-upstream-net-kasan-gce 2020/09/22 09:27 net-next b696db590f5d 9e1fa68e .config log report info
ci-upstream-net-kasan-gce 2020/09/22 04:26 net-next b696db590f5d 9e1fa68e .config log report info
ci-upstream-net-kasan-gce 2020/09/15 17:15 net-next ed6d9b022813 6989d6f6 .config log report info
ci-upstream-net-kasan-gce 2020/09/15 10:05 net-next ed6d9b022813 6989d6f6 .config log report info
ci-upstream-net-kasan-gce 2020/09/12 23:45 net-next 5a6bd84f8154 ce441f06 .config log report
ci-upstream-net-kasan-gce 2020/09/12 14:45 net-next 5a6bd84f8154 ce441f06 .config log report
ci-upstream-net-kasan-gce 2020/09/12 11:16 net-next 12913f745934 79fb24e2 .config log report
ci-upstream-net-kasan-gce 2020/09/12 10:01 net-next 12913f745934 79fb24e2 .config log report
ci-upstream-net-kasan-gce 2020/09/12 09:53 net-next 12913f745934 79fb24e2 .config log report
ci-upstream-net-kasan-gce 2020/09/12 07:51 net-next 12913f745934 79fb24e2 .config log report
ci-upstream-net-kasan-gce 2020/09/12 06:42 net-next 12913f745934 79fb24e2 .config log report
ci-upstream-net-kasan-gce 2020/09/11 16:04 net-next 9984c0bb22dc adfb8b4e .config log report
ci-upstream-net-kasan-gce 2020/09/11 06:50 net-next 4f6a5caf187f 409809d8 .config log report
ci-upstream-net-kasan-gce 2020/09/11 05:47 net-next 4f6a5caf187f 409809d8 .config log report
ci-upstream-net-kasan-gce 2020/03/06 19:59 net-next 3b3e808cd883 c88c7b75 .config log report
ci-upstream-linux-next-kasan-gce-root 2020/09/14 04:55 linux-next d5b2251d63b5 2d3cdd63 .config log report