syzbot |
sign-in | mailing list | source | docs |
🐞 Open [1162] 🐞 Fixed [4308] 🐞 Invalid [9648] 📈 Kernel Health 📈 Bug Lifetimes 📈 Fuzzing 📈 Crashes |
Kernel | Title | Repro | Cause bisect | Fix bisect | Count | Last | Reported | Patched | Status |
---|---|---|---|---|---|---|---|---|---|
android-5-10 | KASAN: use-after-free Read in free_netdev | C | error | 2 | 195d | 227d | 2/2 | upstream: reported C repro on 2022/06/18 00:20 | |
linux-4.19 | KASAN: use-after-free Read in free_netdev | C | error | 142 | 13d | 1059d | 0/1 | upstream: reported C repro on 2020/03/07 10:14 | |
upstream | KASAN: use-after-free Read in free_netdev (2) | C | done | done | 1715 | 426d | 1060d | 22/24 | fixed on 2022/03/08 16:11 |
android-54 | KASAN: use-after-free Read in free_netdev | C | 427 | 159d | 1060d | 0/2 | upstream: reported C repro on 2020/03/06 20:14 | ||
upstream | KASAN: use-after-free Read in free_netdev (3) | C | inconclusive | 130 | 67d | 223d | 23/24 | upstream: reported C repro on 2022/06/22 01:01 |
BUG: KASAN: use-after-free in free_netdev+0x31a/0x360 net/core/dev.c:8192 Read of size 8 at addr ffff88006d36eba0 by task syzkaller968337/2975 CPU: 2 PID: 2975 Comm: syzkaller968337 Not tainted 4.14.0-rc5-next-20171018+ #8 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:16 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:52 print_address_description+0x73/0x250 mm/kasan/report.c:252 kasan_report_error mm/kasan/report.c:351 [inline] kasan_report+0x25b/0x340 mm/kasan/report.c:409 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:430 free_netdev+0x31a/0x360 net/core/dev.c:8192 netdev_run_todo+0x736/0xae0 net/core/dev.c:7940 rtnl_unlock+0xe/0x10 net/core/rtnetlink.c:106 tun_detach drivers/net/tun.c:665 [inline] tun_chr_close+0x49/0x60 drivers/net/tun.c:2835 __fput+0x327/0x7e0 fs/file_table.c:210 ____fput+0x15/0x20 fs/file_table.c:244 task_work_run+0x199/0x270 kernel/task_work.c:112 exit_task_work include/linux/task_work.h:21 [inline] do_exit+0x9b5/0x1ad0 kernel/exit.c:869 do_group_exit+0x149/0x400 kernel/exit.c:972 SYSC_exit_group kernel/exit.c:983 [inline] SyS_exit_group+0x1d/0x20 kernel/exit.c:981 entry_SYSCALL_64_fastpath+0x1f/0xbe RIP: 0033:0x437c39 RSP: 002b:00007fff30390848 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000437c39 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000082 R08: 000000000000003c R09: 00000000000000e7 R10: ffffffffffffffc0 R11: 0000000000000246 R12: 74656e2f7665642f R13: 0000000000401cf0 R14: 0000000000401d80 R15: 0000000000000000 Allocated by task 2975: save_stack+0x43/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551 __do_kmalloc mm/slab.c:3712 [inline] __kmalloc+0x162/0x760 mm/slab.c:3721 kmalloc include/linux/slab.h:507 [inline] sk_prot_alloc+0x101/0x2a0 net/core/sock.c:1469 sk_alloc+0x89/0x700 net/core/sock.c:1523 tun_chr_open+0xec/0x490 drivers/net/tun.c:2804 misc_open+0x382/0x500 drivers/char/misc.c:153 chrdev_open+0x257/0x730 fs/char_dev.c:416 do_dentry_open+0x664/0xd40 fs/open.c:752 vfs_open+0x107/0x220 fs/open.c:866 do_last fs/namei.c:3387 [inline] path_openat+0x1151/0x3520 fs/namei.c:3527 do_filp_open+0x25b/0x3b0 fs/namei.c:3562 do_sys_open+0x502/0x6d0 fs/open.c:1059 SYSC_open fs/open.c:1077 [inline] SyS_open+0x2d/0x40 fs/open.c:1072 entry_SYSCALL_64_fastpath+0x1f/0xbe Freed by task 2975: save_stack+0x43/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524 __cache_free mm/slab.c:3492 [inline] kfree+0xca/0x250 mm/slab.c:3807 sk_prot_free net/core/sock.c:1506 [inline] __sk_destruct+0x74a/0x910 net/core/sock.c:1585 sk_destruct+0x47/0x80 net/core/sock.c:1593 __sk_free+0x57/0x230 net/core/sock.c:1601 sk_free+0x2a/0x40 net/core/sock.c:1612 sock_put include/net/sock.h:1651 [inline] __tun_detach+0x75b/0x1570 drivers/net/tun.c:657 tun_detach drivers/net/tun.c:664 [inline] tun_chr_close+0x44/0x60 drivers/net/tun.c:2835 __fput+0x327/0x7e0 fs/file_table.c:210 ____fput+0x15/0x20 fs/file_table.c:244 task_work_run+0x199/0x270 kernel/task_work.c:112 exit_task_work include/linux/task_work.h:21 [inline] do_exit+0x9b5/0x1ad0 kernel/exit.c:869 do_group_exit+0x149/0x400 kernel/exit.c:972 SYSC_exit_group kernel/exit.c:983 [inline] SyS_exit_group+0x1d/0x20 kernel/exit.c:981 entry_SYSCALL_64_fastpath+0x1f/0xbe The buggy address belongs to the object at ffff88006d36e600 which belongs to the cache kmalloc-2048 of size 2048 The buggy address is located 1440 bytes inside of 2048-byte region [ffff88006d36e600, ffff88006d36ee00) The buggy address belongs to the page: page:ffffea0001b4db80 count:1 mapcount:0 mapping:ffff88006d36e600 index:0x0 compound_mapcount: 0 flags: 0x500000000008100(slab|head) raw: 0500000000008100 ffff88006d36e600 0000000000000000 0000000100000003 raw: ffffea0001b32420 ffffea0001a173a0 ffff88003e800c40 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88006d36ea80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88006d36eb00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88006d36eb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88006d36ec00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88006d36ec80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================
Manager | Time | Kernel | Commit | Syzkaller | Config | Log | Report | Syz repro | C repro | VM info | Assets | Title |
---|---|---|---|---|---|---|---|---|---|---|---|---|
ci-upstream-next-kasan-gce | 2017/10/26 01:21 | linux-next | 36ef71cae353 | e511d9f8 | .config | console log | report | syz | C | |||
ci-upstream-next-kasan-gce | 2017/09/29 00:01 | linux-next | 00d47fc93ae9 | c26ea367 | .config | console log | report | syz | C | |||
ci-upstream-mmots-kasan-gce | 2017/11/10 19:05 | mmots | 0f611fb6dcc0 | e0a2b195 | .config | console log | report | |||||
ci-upstream-mmots-kasan-gce | 2017/11/10 13:23 | mmots | 0f611fb6dcc0 | e0a2b195 | .config | console log | report | |||||
ci-upstream-mmots-kasan-gce | 2017/11/08 20:46 | mmots | 0f611fb6dcc0 | e0a2b195 | .config | console log | report | |||||
ci-upstream-mmots-kasan-gce | 2017/11/07 11:16 | mmots | 0f611fb6dcc0 | e0a2b195 | .config | console log | report | |||||
ci-upstream-mmots-kasan-gce | 2017/11/06 20:28 | mmots | 0f611fb6dcc0 | e0a2b195 | .config | console log | report | |||||
ci-upstream-mmots-kasan-gce | 2017/11/04 13:58 | mmots | 0f611fb6dcc0 | e0a2b195 | .config | console log | report | |||||
ci-upstream-next-kasan-gce | 2017/11/02 02:11 | linux-next | 36ef71cae353 | e511d9f8 | .config | console log | report | |||||
ci-upstream-next-kasan-gce | 2017/11/01 07:49 | linux-next | 36ef71cae353 | e511d9f8 | .config | console log | report | |||||
ci-upstream-next-kasan-gce | 2017/10/31 14:18 | linux-next | 36ef71cae353 | e511d9f8 | .config | console log | report | |||||
ci-upstream-next-kasan-gce | 2017/10/30 11:44 | linux-next | 36ef71cae353 | e511d9f8 | .config | console log | report | |||||
ci-upstream-next-kasan-gce | 2017/10/29 13:07 | linux-next | 36ef71cae353 | e511d9f8 | .config | console log | report | |||||
ci-upstream-next-kasan-gce | 2017/10/26 11:05 | linux-next | 36ef71cae353 | e511d9f8 | .config | console log | report | |||||
ci-upstream-next-kasan-gce | 2017/10/26 02:28 | linux-next | 36ef71cae353 | e511d9f8 | .config | console log | report | |||||
ci-upstream-mmots-kasan-gce | 2017/10/26 00:24 | mmots | 0f611fb6dcc0 | e0a2b195 | .config | console log | report | |||||
ci-upstream-next-kasan-gce | 2017/10/26 00:23 | linux-next | 36ef71cae353 | e511d9f8 | .config | console log | report | |||||
ci-upstream-mmots-kasan-gce | 2017/10/24 12:06 | mmots | 0f611fb6dcc0 | e0a2b195 | .config | console log | report | |||||
ci-upstream-mmots-kasan-gce | 2017/10/21 16:45 | mmots | 0f611fb6dcc0 | e0a2b195 | .config | console log | report | |||||
ci-upstream-next-kasan-gce | 2017/10/21 14:49 | linux-next | 36ef71cae353 | e511d9f8 | .config | console log | report | |||||
ci-upstream-mmots-kasan-gce | 2017/10/16 09:45 | mmots | 4eb4a4191fe5 | 441d64d9 | .config | console log | report | |||||
ci-upstream-mmots-kasan-gce | 2017/10/08 16:45 | mmots | fb686cb13e51 | c26ea367 | .config | console log | report |