syzbot


KASAN: use-after-free Read in vgem_gem_dumb_create
Status: upstream: reported C repro on 2020/01/31 22:28
Reported-by: syzbot+0dc4444774d419e916c8@syzkaller.appspotmail.com
Fix commit: 4b848f20 drm/vgem: Close use-after-free race in vgem_gem_create
Patched on: [ci-upstream-bpf-next-kasan-gce ci-upstream-gce-leak ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce], missing on: [ci-qemu-upstream ci-qemu-upstream-386 ci-upstream-bpf-kasan-gce ci-upstream-kmsan-gce ci2-upstream-kcsan-gce ci2-upstream-usb]
First crash: 17d, last: 4d15h

Cause bisection: introduced by (bisect log):

commit 7611750784664db46d0db95631e322aeb263dde7
Author: Alex Deucher <alexander.deucher@amd.com>
Date: Wed Jun 21 16:31:41 2017 +0000

  drm/amdgpu: use kernel is_power_of_2 rather than local version

Crash: BUG: sleeping function called from invalid context in tap_get_minor (log)
Repro: syz .config
similar bugs (2):
Kernel Title Repro Bisected Count Last Reported Patched Status
linux-4.14 KASAN: use-after-free Read in vgem_gem_dumb_create syz 7 5d07h 16d 0/1 upstream: reported syz repro on 2020/01/31 14:46
linux-4.19 KASAN: use-after-free Read in vgem_gem_dumb_create syz 7 6d04h 16d 0/1 upstream: reported syz repro on 2020/01/31 21:57

Sample crash report:

Crashes (15):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro Maintainers
ci-upstream-kasan-gce-root 2020/02/02 04:37 upstream 94f2630b 2274ad39 .config log report syz C airlied@linux.ie, chris@chris-wilson.co.uk, daniel@ffwll.ch, dri-devel@lists.freedesktop.org, emil.velikov@collabora.com, eric@anholt.net, linaro-mm-sig@lists.linaro.org, linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, robdclark@chromium.org, seanpaul@chromium.org, sumit.semwal@linaro.org
ci-upstream-kasan-gce-root 2020/02/12 10:19 upstream 359c92c0 a75b198c .config log report syz airlied@linux.ie, chris@chris-wilson.co.uk, daniel@ffwll.ch, dri-devel@lists.freedesktop.org, emil.velikov@collabora.com, linaro-mm-sig@lists.linaro.org, linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, mripard@kernel.org, robdclark@chromium.org, seanpaul@chromium.org, sumit.semwal@linaro.org
ci-upstream-kasan-gce-smack-root 2020/02/11 07:22 upstream 0a679e13 084454ae .config log report syz airlied@linux.ie, chris@chris-wilson.co.uk, daniel@ffwll.ch, dri-devel@lists.freedesktop.org, emil.velikov@collabora.com, eric@anholt.net, linaro-mm-sig@lists.linaro.org, linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, robdclark@chromium.org, seanpaul@chromium.org, sumit.semwal@linaro.org
ci-upstream-kasan-gce-root 2020/02/10 08:39 upstream d1ea35f4 35f5e45e .config log report syz airlied@linux.ie, chris@chris-wilson.co.uk, daniel@ffwll.ch, dri-devel@lists.freedesktop.org, emil.velikov@collabora.com, linaro-mm-sig@lists.linaro.org, linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, mripard@kernel.org, robdclark@chromium.org, seanpaul@chromium.org, sumit.semwal@linaro.org
ci-upstream-kasan-gce-smack-root 2020/02/08 21:24 upstream f7571657 06150bf1 .config log report syz airlied@linux.ie, chris@chris-wilson.co.uk, daniel@ffwll.ch, dri-devel@lists.freedesktop.org, emil.velikov@collabora.com, linaro-mm-sig@lists.linaro.org, linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, mripard@kernel.org, robdclark@chromium.org, seanpaul@chromium.org, sumit.semwal@linaro.org
ci-upstream-kasan-gce-smack-root 2020/02/08 04:27 upstream 41dcd67e 06150bf1 .config log report syz airlied@linux.ie, chris@chris-wilson.co.uk, daniel@ffwll.ch, dri-devel@lists.freedesktop.org, emil.velikov@collabora.com, eric@anholt.net, linaro-mm-sig@lists.linaro.org, linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, robdclark@chromium.org, seanpaul@chromium.org, sumit.semwal@linaro.org
ci-upstream-kasan-gce-root 2020/02/07 13:42 upstream 90568ecf 06150bf1 .config log report syz airlied@linux.ie, chris@chris-wilson.co.uk, daniel@ffwll.ch, dri-devel@lists.freedesktop.org, emil.velikov@collabora.com, linaro-mm-sig@lists.linaro.org, linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, mripard@kernel.org, robdclark@chromium.org, seanpaul@chromium.org, sumit.semwal@linaro.org
ci-upstream-kasan-gce-smack-root 2020/02/06 03:25 upstream 6992ca0d 662cf49a .config log report syz airlied@linux.ie, chris@chris-wilson.co.uk, daniel@ffwll.ch, dri-devel@lists.freedesktop.org, emil.velikov@collabora.com, eric@anholt.net, linaro-mm-sig@lists.linaro.org, linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, robdclark@chromium.org, seanpaul@chromium.org, sumit.semwal@linaro.org
ci-upstream-kasan-gce-root 2020/02/04 00:12 upstream 754beeec 93e5e335 .config log report syz airlied@linux.ie, chris@chris-wilson.co.uk, daniel@ffwll.ch, dri-devel@lists.freedesktop.org, emil.velikov@collabora.com, eric@anholt.net, linaro-mm-sig@lists.linaro.org, linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, robdclark@chromium.org, seanpaul@chromium.org, sumit.semwal@linaro.org
ci-upstream-kasan-gce-selinux-root 2020/02/03 06:43 upstream 46d6b7be 93e5e335 .config log report syz airlied@linux.ie, chris@chris-wilson.co.uk, daniel@ffwll.ch, dri-devel@lists.freedesktop.org, emil.velikov@collabora.com, linaro-mm-sig@lists.linaro.org, linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, mripard@kernel.org, robdclark@chromium.org, seanpaul@chromium.org, sumit.semwal@linaro.org
ci-upstream-kasan-gce-selinux-root 2020/02/02 11:36 upstream 94f2630b 2274ad39 .config log report syz airlied@linux.ie, chris@chris-wilson.co.uk, daniel@ffwll.ch, dri-devel@lists.freedesktop.org, emil.velikov@collabora.com, linaro-mm-sig@lists.linaro.org, linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, mripard@kernel.org, robdclark@chromium.org, seanpaul@chromium.org, sumit.semwal@linaro.org
ci-upstream-kasan-gce-smack-root 2020/02/01 00:35 upstream ccaaaf6f c30117b2 .config log report syz airlied@linux.ie, chris@chris-wilson.co.uk, daniel@ffwll.ch, dri-devel@lists.freedesktop.org, emil.velikov@collabora.com, linaro-mm-sig@lists.linaro.org, linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, mripard@kernel.org, robdclark@chromium.org, seanpaul@chromium.org, sumit.semwal@linaro.org
ci-upstream-kasan-gce 2020/01/30 17:45 upstream 39bed42d 5ed23f9a .config log report syz airlied@linux.ie, chris@chris-wilson.co.uk, daniel@ffwll.ch, dri-devel@lists.freedesktop.org, emil.velikov@collabora.com, eric@anholt.net, linaro-mm-sig@lists.linaro.org, linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, robdclark@chromium.org, seanpaul@chromium.org, sumit.semwal@linaro.org
ci-upstream-kasan-gce-smack-root 2020/02/12 18:41 upstream 359c92c0 84f4fc8a .config log report airlied@linux.ie, chris@chris-wilson.co.uk, daniel@ffwll.ch, dri-devel@lists.freedesktop.org, emil.velikov@collabora.com, eric@anholt.net, linaro-mm-sig@lists.linaro.org, linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, robdclark@chromium.org, seanpaul@chromium.org, sumit.semwal@linaro.org
ci-upstream-kasan-gce 2020/01/30 17:13 upstream 39bed42d 5ed23f9a .config log report airlied@linux.ie, chris@chris-wilson.co.uk, daniel@ffwll.ch, dri-devel@lists.freedesktop.org, emil.velikov@collabora.com, eric@anholt.net, linaro-mm-sig@lists.linaro.org, linux-kernel@vger.kernel.org, linux-media@vger.kernel.org, robdclark@chromium.org, seanpaul@chromium.org, sumit.semwal@linaro.org