syzbot


KASAN: use-after-free Read in rdma_listen (2)
Status: fixed on 2020/05/10 10:42
Reported-by: syzbot+adb15cf8c2798e4e0db4@syzkaller.appspotmail.com
Fix commit: 7c11910783a1 RDMA/ucma: Put a lock around every call to the rdma_cm layer
First crash: 985d, last: 616d

Cause bisection: the issue happens on the oldest tested release (bisect log)
Crash: KASAN: use-after-free Read in rdma_listen (log)
Repro: syz .config
duplicates (4):
Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
BUG: corrupted list in _cma_attach_to_dev C 5 616d 647d 0/22 closed as dup on 2020/03/09 23:03
KASAN: use-after-free Read in iwcm_deref_id 15 614d 651d 20/22 closed as dup on 2020/02/28 16:21
INFO: task hung in rdma_destroy_id 6 617d 646d 0/22 closed as dup on 2020/03/09 17:21
BUG: corrupted list in cma_listen_on_dev C done 1 645d 644d 0/22 closed as dup on 2020/03/09 17:20
similar bugs (5):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream BUG: corrupted list in rdma_listen (2) 2 26d 4d19h 0/22 upstream: reported on 2021/12/04 09:54
upstream KASAN: use-after-free Read in rdma_listen (3) 1 229d 221d 0/22 auto-closed as invalid on 2021/08/21 07:04
linux-4.14 KASAN: use-after-free Read in rdma_listen C 916 2d08h 913d 0/1 upstream: reported C repro on 2019/06/10 00:44
upstream KASAN: use-after-free Read in rdma_listen C 1548 987d 1346d 12/22 fixed on 2019/03/28 12:00
linux-4.19 KASAN: use-after-free Read in rdma_listen syz done 143 605d 917d 1/1 fixed on 2020/05/13 09:53
Patch testing requests:
Created Duration User Patch Repo Result
2020/02/18 21:04 19m jgg@mellanox.com patch git://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git for-rc OK

Sample crash report:

Crashes (354):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-linux-next-kasan-gce-root 2020/02/17 23:32 linux-next c25a951c50dc 2b411596 .config log report syz C
ci-upstream-kasan-gce 2020/04/01 22:54 upstream 1a323ea5356e a34e2c33 .config log report syz
ci-upstream-kasan-gce 2020/03/30 13:43 upstream 7111951b8d49 c8d1cc20 .config log report syz
ci-upstream-kasan-gce 2020/03/30 02:09 upstream e595dd94515e 05736b29 .config log report syz
ci-upstream-kasan-gce 2020/03/29 19:52 upstream e595dd94515e 05736b29 .config log report syz
ci-upstream-kasan-gce 2020/03/28 20:23 upstream 69c5eea3128e f1ebdfba .config log report syz
ci-upstream-kasan-gce 2020/03/28 05:07 upstream 527630fbf4f1 831e9a81 .config log report syz
ci-upstream-kasan-gce 2020/03/28 04:22 upstream 527630fbf4f1 831e9a81 .config log report syz
ci-upstream-kasan-gce 2020/03/27 13:35 upstream f3e69428b5e2 7d95711b .config log report syz
ci-upstream-kasan-gce 2020/03/25 02:29 upstream 76ccd234269b 68660b21 .config log report syz
ci-upstream-kasan-gce 2020/03/25 00:40 upstream 76ccd234269b 68660b21 .config log report syz
ci-upstream-kasan-gce 2020/03/24 20:34 upstream 76ccd234269b 68660b21 .config log report syz
ci-upstream-kasan-gce 2020/03/23 10:17 upstream 67d584e33e54 78267cec .config log report syz
ci-upstream-kasan-gce 2020/03/21 21:46 upstream 5ad0ec0b8652 4288d95e .config log report syz
ci-upstream-kasan-gce 2020/03/20 23:38 upstream 6c90b86a745a 2c31c529 .config log report syz
ci-upstream-kasan-gce 2020/03/19 12:02 upstream 5076190daded 2c31c529 .config log report syz
ci-upstream-kasan-gce 2020/03/18 13:39 upstream ac309e7744be 97bc55ce .config log report syz
ci-upstream-kasan-gce-selinux-root 2020/03/11 07:33 upstream f35111a94654 35f53e45 .config log report syz
ci-upstream-kasan-gce-root 2020/03/09 13:22 upstream 2c523b344dfa 2e9971bb .config log report syz
ci-upstream-kasan-gce-root 2020/03/08 15:13 upstream c20037652700 2e9971bb .config log report syz
ci-upstream-kasan-gce-smack-root 2020/03/06 05:52 upstream 63623fd44972 c88c7b75 .config log report syz
ci-upstream-kasan-gce-smack-root 2020/03/05 18:51 upstream 63623fd44972 c88c7b75 .config log report syz
ci-upstream-kasan-gce 2020/03/04 16:15 upstream 63623fd44972 c88c7b75 .config log report syz
ci-upstream-kasan-gce 2020/03/04 01:12 upstream 63623fd44972 c88c7b75 .config log report syz
ci-upstream-kasan-gce-smack-root 2019/03/29 10:55 upstream 9936328b41ce 98c1bf1c .config log report syz
ci-upstream-kasan-gce-386 2020/04/02 04:42 upstream 1a323ea5356e a34e2c33 .config log report syz
ci-upstream-kasan-gce-386 2020/04/02 01:17 upstream 1a323ea5356e a34e2c33 .config log report syz
ci-upstream-kasan-gce-386 2020/04/02 00:04 upstream 1a323ea5356e a34e2c33 .config log report syz
ci-upstream-kasan-gce-386 2020/04/01 09:27 upstream 56a451b78067 a34e2c33 .config log report syz
ci-upstream-kasan-gce-386 2020/04/01 08:18 upstream 56a451b78067 a34e2c33 .config log report syz
ci-upstream-kasan-gce-386 2020/03/31 00:06 upstream 7111951b8d49 c8d1cc20 .config log report syz
ci-upstream-kasan-gce-386 2020/03/30 23:41 upstream 7111951b8d49 c8d1cc20 .config log report syz
ci-upstream-kasan-gce-386 2020/03/30 07:18 upstream e595dd94515e 05736b29 .config log report syz
ci-upstream-kasan-gce-386 2020/03/29 13:35 upstream 906c40438bb6 05736b29 .config log report syz
ci-upstream-kasan-gce-386 2020/03/26 00:19 upstream e2cf67f6689a 41f049cc .config log report syz
ci-upstream-kasan-gce-386 2020/03/21 09:15 upstream 5ad0ec0b8652 2c31c529 .config log report syz
ci-upstream-kasan-gce-386 2020/03/19 15:37 upstream 5076190daded 2c31c529 .config log report syz
ci-upstream-kasan-gce-386 2020/03/04 14:54 upstream 63623fd44972 c88c7b75 .config log report syz
ci-upstream-kasan-gce-386 2020/03/04 01:17 upstream 63623fd44972 c88c7b75 .config log report syz
ci-upstream-linux-next-kasan-gce-root 2020/03/22 12:21 linux-next 770fbb32d34e 78267cec .config log report syz
ci-upstream-linux-next-kasan-gce-root 2020/03/13 09:16 linux-next 770fbb32d34e d850e9d0 .config log report syz
ci-upstream-linux-next-kasan-gce-root 2020/03/13 07:53 linux-next 770fbb32d34e d850e9d0 .config log report syz
ci-upstream-linux-next-kasan-gce-root 2020/03/12 19:28 linux-next 770fbb32d34e d850e9d0 .config log report syz
ci-upstream-linux-next-kasan-gce-root 2020/03/12 12:34 linux-next 770fbb32d34e d850e9d0 .config log report syz
ci-upstream-linux-next-kasan-gce-root 2020/03/10 18:01 linux-next 770fbb32d34e 35f53e45 .config log report syz
ci-upstream-linux-next-kasan-gce-root 2020/03/10 14:42 linux-next 770fbb32d34e 35f53e45 .config log report syz
ci-upstream-linux-next-kasan-gce-root 2020/03/10 00:44 linux-next 770fbb32d34e 35f53e45 .config log report syz
ci-upstream-linux-next-kasan-gce-root 2020/03/09 12:15 linux-next 770fbb32d34e 2e9971bb .config log report syz
ci-upstream-linux-next-kasan-gce-root 2020/03/09 04:04 linux-next 770fbb32d34e 2e9971bb .config log report syz
ci-upstream-linux-next-kasan-gce-root 2020/03/08 16:44 linux-next 770fbb32d34e 2e9971bb .config log report syz
ci-upstream-linux-next-kasan-gce-root 2020/03/04 14:30 linux-next c99b17ac0399 c88c7b75 .config log report syz
ci-upstream-kasan-gce-selinux-root 2020/03/09 17:55 upstream 2c523b344dfa 2e9971bb .config log report
ci-upstream-kasan-gce 2020/03/05 09:27 upstream 63623fd44972 c88c7b75 .config log report
ci-upstream-kasan-gce-root 2020/03/05 03:23 upstream 63623fd44972 c88c7b75 .config log report
ci-upstream-kasan-gce 2020/03/04 10:28 upstream 63623fd44972 c88c7b75 .config log report
ci-upstream-kasan-gce 2020/02/22 16:59 upstream 54dedb5b571d 2c36e7a7 .config log report
ci-upstream-kasan-gce-smack-root 2020/02/12 07:26 upstream 359c92c02bfa a75b198c .config log report
ci-upstream-kasan-gce 2020/02/11 22:22 upstream 0a679e13ea30 4d1ab643 .config log report
ci-upstream-kasan-gce-root 2020/02/08 11:44 upstream f757165705e9 06150bf1 .config log report
ci-upstream-kasan-gce-smack-root 2020/02/07 16:24 upstream 90568ecf5615 06150bf1 .config log report
ci-upstream-kasan-gce 2020/02/06 09:41 upstream 4c7d00ccf40d 662cf49a .config log report
ci-upstream-kasan-gce-smack-root 2020/02/05 09:26 upstream 33b40134e5cf 93e5e335 .config log report
ci-upstream-kasan-gce-root 2020/02/03 18:06 upstream 754beeec1d90 93e5e335 .config log report
ci-upstream-kasan-gce-smack-root 2020/02/02 11:38 upstream 94f2630b1897 2274ad39 .config log report
ci-upstream-kasan-gce-root 2020/01/31 10:59 upstream 9f68e3655aae 5ed23f9a .config log report
ci-upstream-kasan-gce 2020/01/19 12:35 upstream 244dc2689085 bc8bc756 .config log report
ci-upstream-kasan-gce 2020/01/18 21:27 upstream 25e73aadf297 3de7aabb .config log report
ci-upstream-kasan-gce-root 2020/01/16 20:11 upstream f5ae2ea6347a 3de7aabb .config log report
ci-upstream-kasan-gce-smack-root 2020/01/15 21:31 upstream 51d69817519f f9b69507 .config log report
ci-upstream-kasan-gce 2020/01/15 14:39 upstream 95e20af9fb9c fa12bd3c .config log report
ci-upstream-kasan-gce-selinux-root 2020/01/12 19:40 upstream 6327edceb62b 31290a45 .config log report
ci-upstream-kasan-gce-selinux-root 2020/01/12 15:48 upstream 6327edceb62b 31290a45 .config log report
ci-upstream-kasan-gce 2019/12/13 17:05 upstream ae4b064e2a61 08003f64 .config log report
ci-qemu-upstream 2019/12/08 07:22 upstream 9455d25f4e3b 1508f453 .config log report
ci-qemu-upstream 2019/12/05 09:24 upstream 2f13437b8917 9fd5a512 .config log report
ci-upstream-kasan-gce-selinux-root 2019/11/28 18:14 upstream a6ed68d6468b 46869e3e .config log report
ci-upstream-kasan-gce 2019/11/24 03:29 upstream 6b8a79467876 598ca6c8 .config log report
ci-upstream-kasan-gce 2019/11/23 18:57 upstream 2027cabe6afe 598ca6c8 .config log report
ci-upstream-kasan-gce-root 2019/11/17 12:17 upstream fe30021c36fb d5696d51 .config log report
ci-upstream-kasan-gce-selinux-root 2019/11/16 17:44 upstream 6c9594bdd474 d5696d51 .config log report
ci-upstream-kasan-gce-selinux-root 2019/11/10 08:22 upstream 00aff6836241 dc438b91 .config log report
ci-upstream-kasan-gce-smack-root 2019/11/08 16:49 upstream 847120f859cc 1e35461e .config log report
ci-upstream-kasan-gce 2019/11/07 21:43 upstream 4dd58158254c f39aff9e .config log report
ci-upstream-kasan-gce-smack-root 2019/11/01 00:57 upstream e472c64aa4fa a41ca8fa .config log report
ci-upstream-kasan-gce-smack-root 2019/10/31 23:35 upstream e472c64aa4fa a41ca8fa .config log report
ci-upstream-kasan-gce-selinux-root 2019/10/31 04:00 upstream 320000e72ec0 a41ca8fa .config log report
ci-upstream-kasan-gce-smack-root 2019/03/29 09:36 upstream 9936328b41ce 98c1bf1c .config log report
ci-upstream-kasan-gce-386 2020/03/27 07:09 upstream f3e69428b5e2 7d95711b .config log report
ci-qemu-upstream-386 2020/03/27 05:37 upstream 9efcc4a12936 7d95711b .config log report
ci-qemu-upstream-386 2020/01/12 22:28 upstream 040a3c33623b 53faa9fe .config log report
ci-upstream-kasan-gce-386 2019/11/24 13:29 upstream 6b8a79467876 598ca6c8 .config log report
ci-upstream-kasan-gce-386 2019/11/01 06:39 upstream e472c64aa4fa a41ca8fa .config log report
ci-upstream-kasan-gce-386 2019/10/31 19:58 upstream e472c64aa4fa a41ca8fa .config log report
ci-upstream-linux-next-kasan-gce-root 2020/02/23 18:25 linux-next bee46b309a13 2c36e7a7 .config log report