syzbot |
sign-in | mailing list | source | docs |
🐞 Open [708] 🐞 Fixed [181] 🐞 Invalid [624] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes |
Kernel | Title | Repro | Cause bisect | Fix bisect | Count | Last | Reported | Patched | Status |
---|---|---|---|---|---|---|---|---|---|
linux-4.19 | KASAN: use-after-free Write in release_tty | C | done | 148 | 1045d | 1162d | 1/1 | fixed on 2020/04/28 10:48 | |
upstream | KASAN: use-after-free Write in release_tty | C | done | 591 | 1039d | 1161d | 17/24 | fixed on 2020/05/10 10:41 |
audit: type=1400 audit(1585471473.165:36): avc: denied { map } for pid=7442 comm="syz-executor729" path="/root/syz-executor729721826" dev="sda1" ino=16484 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:object_r:user_home_t:s0 tclass=file permissive=1 ================================================================== BUG: KASAN: use-after-free in con_shutdown+0x7f/0x90 drivers/tty/vt/vt.c:2928 Write of size 8 at addr ffff888093e03748 by task syz-executor729/7450 CPU: 1 PID: 7450 Comm: syz-executor729 Not tainted 4.14.174-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x13e/0x194 lib/dump_stack.c:58 print_address_description.cold+0x7c/0x1e2 mm/kasan/report.c:252 kasan_report_error mm/kasan/report.c:351 [inline] kasan_report mm/kasan/report.c:409 [inline] kasan_report.cold+0xa9/0x2ae mm/kasan/report.c:393 con_shutdown+0x7f/0x90 drivers/tty/vt/vt.c:2928 release_tty+0xb6/0x7a0 drivers/tty/tty_io.c:1501 tty_release_struct+0x37/0x50 drivers/tty/tty_io.c:1616 tty_release+0xaa6/0xd60 drivers/tty/tty_io.c:1776 __fput+0x25f/0x790 fs/file_table.c:210 task_work_run+0x113/0x190 kernel/task_work.c:113 exit_task_work include/linux/task_work.h:22 [inline] do_exit+0x9f2/0x2b00 kernel/exit.c:858 do_group_exit+0x100/0x310 kernel/exit.c:955 SYSC_exit_group kernel/exit.c:966 [inline] SyS_exit_group+0x19/0x20 kernel/exit.c:964 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x43ff38 RSP: 002b:00007ffc6b69a188 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000043ff38 RDX: 0000000000000000 RSI: 000000000000003c RDI: 0000000000000000 RBP: 00000000004bf950 R08: 00000000000000e7 R09: ffffffffffffffd0 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00000000006d2180 R14: 0000000000000000 R15: 0000000000000000 Allocated by task 7450: save_stack+0x32/0xa0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc mm/kasan/kasan.c:551 [inline] kasan_kmalloc+0xbf/0xe0 mm/kasan/kasan.c:529 kmem_cache_alloc_trace+0x14d/0x7b0 mm/slab.c:3618 kmalloc include/linux/slab.h:488 [inline] kzalloc include/linux/slab.h:661 [inline] vc_allocate drivers/tty/vt/vt.c:772 [inline] vc_allocate+0x142/0x550 drivers/tty/vt/vt.c:753 con_install+0x4f/0x3e0 drivers/tty/vt/vt.c:2879 tty_driver_install_tty drivers/tty/tty_io.c:1225 [inline] tty_init_dev drivers/tty/tty_io.c:1338 [inline] tty_init_dev+0xe1/0x3a0 drivers/tty/tty_io.c:1315 tty_open_by_driver drivers/tty/tty_io.c:1973 [inline] tty_open+0x410/0x9c0 drivers/tty/tty_io.c:2021 chrdev_open+0x1fc/0x540 fs/char_dev.c:423 do_dentry_open+0x732/0xe90 fs/open.c:777 vfs_open+0x105/0x220 fs/open.c:888 do_last fs/namei.c:3428 [inline] path_openat+0x8ca/0x3c50 fs/namei.c:3569 do_filp_open+0x18e/0x250 fs/namei.c:3603 do_sys_open+0x29d/0x3f0 fs/open.c:1081 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 Freed by task 7451: save_stack+0x32/0xa0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_slab_free+0x75/0xc0 mm/kasan/kasan.c:524 __cache_free mm/slab.c:3496 [inline] kfree+0xcb/0x260 mm/slab.c:3815 vt_disallocate_all+0x25c/0x340 drivers/tty/vt/vt_ioctl.c:323 vt_ioctl+0x6e3/0x1f00 drivers/tty/vt/vt_ioctl.c:816 tty_ioctl+0x6c5/0x1220 drivers/tty/tty_io.c:2661 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:500 [inline] do_vfs_ioctl+0x75a/0xfe0 fs/ioctl.c:684 SYSC_ioctl fs/ioctl.c:701 [inline] SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 The buggy address belongs to the object at ffff888093e03640 which belongs to the cache kmalloc-2048 of size 2048 The buggy address is located 264 bytes inside of 2048-byte region [ffff888093e03640, ffff888093e03e40) The buggy address belongs to the page: page:ffffea00024f8080 count:1 mapcount:0 mapping:ffff888093e02540 index:0x0 compound_mapcount: 0 flags: 0xfffe0000008100(slab|head) raw: 00fffe0000008100 ffff888093e02540 0000000000000000 0000000100000003 raw: ffffea00024b44a0 ffffea00024f1a20 ffff88812fe56c40 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888093e03600: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb ffff888093e03680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888093e03700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888093e03780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888093e03800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================
Manager | Time | Kernel | Commit | Syzkaller | Config | Log | Report | Syz repro | C repro | VM info | Assets | Title |
---|---|---|---|---|---|---|---|---|---|---|---|---|
ci2-linux-4-14 | 2020/03/29 08:46 | linux-4.14.y | 01364dad1d45 | 05736b29 | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2020/03/24 08:29 | linux-4.14.y | 01364dad1d45 | 33e14df3 | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2020/03/24 06:58 | linux-4.14.y | 01364dad1d45 | 33e14df3 | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2020/03/22 19:08 | linux-4.14.y | 01364dad1d45 | 78267cec | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2020/03/21 11:14 | linux-4.14.y | 01364dad1d45 | aa6c6a55 | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2020/03/20 21:55 | linux-4.14.y | 01364dad1d45 | 2c31c529 | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2020/03/20 15:36 | linux-4.14.y | 01364dad1d45 | 2c31c529 | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2020/03/18 13:55 | linux-4.14.y | 12cd844a39ed | 0a96a13c | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2020/03/14 23:47 | linux-4.14.y | 12cd844a39ed | 749688d2 | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2020/03/11 06:45 | linux-4.14.y | 78d697fc93f9 | 35f53e45 | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2020/03/10 17:40 | linux-4.14.y | 78d697fc93f9 | 35f53e45 | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2020/03/10 17:00 | linux-4.14.y | 78d697fc93f9 | 35f53e45 | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2020/03/10 12:54 | linux-4.14.y | 78d697fc93f9 | 35f53e45 | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2020/03/09 22:04 | linux-4.14.y | 78d697fc93f9 | 35f53e45 | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2020/03/08 05:50 | linux-4.14.y | 78d697fc93f9 | 2e9971bb | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2020/03/08 04:28 | linux-4.14.y | 78d697fc93f9 | 2e9971bb | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2020/03/04 14:25 | linux-4.14.y | 78d697fc93f9 | 712198ac | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2020/03/02 06:52 | linux-4.14.y | 78d697fc93f9 | 4a4e0509 | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2020/02/29 23:38 | linux-4.14.y | 78d697fc93f9 | c88c7b75 | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2020/02/29 18:03 | linux-4.14.y | 78d697fc93f9 | c88c7b75 | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2020/02/28 20:23 | linux-4.14.y | 78d697fc93f9 | c88c7b75 | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2020/02/26 07:51 | linux-4.14.y | 98db2bf27b9e | 4f588111 | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2020/02/25 09:46 | linux-4.14.y | 98db2bf27b9e | 59b57593 | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2020/02/22 06:53 | linux-4.14.y | 98db2bf27b9e | 2ffa6679 | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2020/02/22 05:51 | linux-4.14.y | 98db2bf27b9e | 2ffa6679 | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2020/02/21 08:05 | linux-4.14.y | 98db2bf27b9e | bd2a74a3 | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2020/02/18 12:16 | linux-4.14.y | 98db2bf27b9e | 1ce142dc | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2020/02/17 17:52 | linux-4.14.y | 98db2bf27b9e | 72bfa6f2 | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2020/02/15 11:35 | linux-4.14.y | 98db2bf27b9e | 5d7b90f1 | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2020/02/14 16:13 | linux-4.14.y | e0f8b8a65a47 | 5d7b90f1 | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2020/02/11 05:28 | linux-4.14.y | e0f8b8a65a47 | d9e55b05 | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2020/02/10 12:03 | linux-4.14.y | e0f8b8a65a47 | 35f5e45e | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2020/02/10 01:50 | linux-4.14.y | e0f8b8a65a47 | 35f5e45e | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2020/02/09 13:45 | linux-4.14.y | e0f8b8a65a47 | 6ece2ea5 | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2020/02/08 05:41 | linux-4.14.y | e0f8b8a65a47 | 06150bf1 | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2020/02/03 22:01 | linux-4.14.y | 9fa690a2a016 | 93e5e335 | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2020/02/02 16:56 | linux-4.14.y | 9fa690a2a016 | 93e5e335 | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2020/01/25 08:41 | linux-4.14.y | 8bac50406cca | 2e95ab33 | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2020/01/24 12:10 | linux-4.14.y | 8bac50406cca | 2e95ab33 | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2020/01/23 04:19 | linux-4.14.y | c1141b3aab36 | 3334d684 | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2020/01/23 00:46 | linux-4.14.y | c1141b3aab36 | 3334d684 | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2019/12/04 05:15 | linux-4.14.y | fbc5fe7a54d0 | 0ecb9746 | .config | console log | report | syz | C | |||
ci2-linux-4-14 | 2020/04/01 11:25 | linux-4.14.y | 01364dad1d45 | a34e2c33 | .config | console log | report | |||||
ci2-linux-4-14 | 2020/03/27 11:07 | linux-4.14.y | 01364dad1d45 | 9af8b4b3 | .config | console log | report | |||||
ci2-linux-4-14 | 2020/03/26 16:51 | linux-4.14.y | 01364dad1d45 | 6d25c5a0 | .config | console log | report | |||||
ci2-linux-4-14 | 2020/03/26 16:35 | linux-4.14.y | 01364dad1d45 | 6d25c5a0 | .config | console log | report | |||||
ci2-linux-4-14 | 2020/03/26 14:32 | linux-4.14.y | 01364dad1d45 | 6d25c5a0 | .config | console log | report | |||||
ci2-linux-4-14 | 2020/03/24 19:39 | linux-4.14.y | 01364dad1d45 | 68660b21 | .config | console log | report | |||||
ci2-linux-4-14 | 2020/03/21 18:26 | linux-4.14.y | 01364dad1d45 | 78267cec | .config | console log | report | |||||
ci2-linux-4-14 | 2020/03/08 14:01 | linux-4.14.y | 78d697fc93f9 | 2e9971bb | .config | console log | report | |||||
ci2-linux-4-14 | 2020/03/03 15:30 | linux-4.14.y | 78d697fc93f9 | 350a7a26 | .config | console log | report | |||||
ci2-linux-4-14 | 2020/02/26 05:13 | linux-4.14.y | 98db2bf27b9e | 4f588111 | .config | console log | report | |||||
ci2-linux-4-14 | 2020/02/25 02:19 | linux-4.14.y | 98db2bf27b9e | 59b57593 | .config | console log | report | |||||
ci2-linux-4-14 | 2020/02/19 05:50 | linux-4.14.y | 98db2bf27b9e | 135c18aa | .config | console log | report | |||||
ci2-linux-4-14 | 2020/02/12 08:59 | linux-4.14.y | e0f8b8a65a47 | a75b198c | .config | console log | report | |||||
ci2-linux-4-14 | 2020/02/10 10:45 | linux-4.14.y | e0f8b8a65a47 | 35f5e45e | .config | console log | report | |||||
ci2-linux-4-14 | 2020/02/06 22:07 | linux-4.14.y | e0f8b8a65a47 | 5be3a391 | .config | console log | report | |||||
ci2-linux-4-14 | 2020/02/06 14:27 | linux-4.14.y | e0f8b8a65a47 | 5be3a391 | .config | console log | report | |||||
ci2-linux-4-14 | 2020/02/02 03:00 | linux-4.14.y | 9fa690a2a016 | 2274ad39 | .config | console log | report | |||||
ci2-linux-4-14 | 2020/01/31 20:50 | linux-4.14.y | 9fa690a2a016 | 0eb59c27 | .config | console log | report | |||||
ci2-linux-4-14 | 2020/01/15 02:39 | linux-4.14.y | c04fc6fa5c96 | fa12bd3c | .config | console log | report | |||||
ci2-linux-4-14 | 2020/01/13 18:21 | linux-4.14.y | 6d0c334a400d | 99565c1a | .config | console log | report | |||||
ci2-linux-4-14 | 2020/01/13 00:41 | linux-4.14.y | 6d0c334a400d | 53faa9fe | .config | console log | report | |||||
ci2-linux-4-14 | 2020/01/07 11:10 | linux-4.14.y | 84f5ad468100 | 1bcd407e | .config | console log | report | |||||
ci2-linux-4-14 | 2019/12/31 22:24 | linux-4.14.y | 4c5bf01e16a7 | 25a0186e | .config | console log | report | |||||
ci2-linux-4-14 | 2019/12/31 13:18 | linux-4.14.y | 4c5bf01e16a7 | 7f117e28 | .config | console log | report | |||||
ci2-linux-4-14 | 2019/12/28 20:47 | linux-4.14.y | e1f7d50ae3a3 | af6b8ef8 | .config | console log | report | |||||
ci2-linux-4-14 | 2019/12/19 03:47 | linux-4.14.y | bfb9e5c03076 | 79b211f7 | .config | console log | report | |||||
ci2-linux-4-14 | 2019/12/15 00:08 | linux-4.14.y | a844dc4c5442 | eef6e580 | .config | console log | report | |||||
ci2-linux-4-14 | 2019/12/09 17:47 | linux-4.14.y | a844dc4c5442 | b31eda3d | .config | console log | report | |||||
ci2-linux-4-14 | 2019/12/07 21:55 | linux-4.14.y | a844dc4c5442 | 1508f453 | .config | console log | report | |||||
ci2-linux-4-14 | 2019/12/06 23:43 | linux-4.14.y | a844dc4c5442 | 85f26751 | .config | console log | report | |||||
ci2-linux-4-14 | 2019/12/06 04:41 | linux-4.14.y | a844dc4c5442 | 98b4ef2d | .config | console log | report | |||||
ci2-linux-4-14 | 2019/12/04 17:38 | linux-4.14.y | fbc5fe7a54d0 | b2088328 | .config | console log | report | |||||
ci2-linux-4-14 | 2019/12/04 16:40 | linux-4.14.y | fbc5fe7a54d0 | b2088328 | .config | console log | report | |||||
ci2-linux-4-14 | 2019/12/04 04:54 | linux-4.14.y | fbc5fe7a54d0 | 0ecb9746 | .config | console log | report |