syzbot


kernel: protection fault trap, code=0 (5)
Status: fixed on 2019/09/05 13:34
Reported-by: syzbot+af7d510593d74c825960@syzkaller.appspotmail.com
Fix commit: a4205624 Fix a route use after free in IPv6 multicast route. Move the mrt6_mcast6_del() out of the rtable_walk(). This avoids recursion to prevent stack overflow. Also it allows freeing the route outside of the walk. Now mrt6_mcast_del() frees the route only when it is deleted from the routing table. If that fails, it must not be freed. After the route is returned by mf6c_find(), it is reference counted. Then we need a rtfree(), but not in the other case. Name mrt6_mcast_add() and mrt6_mcast_del() consistently. Move rt_timer_remove_all() into mrt6_mcast_del(). Reported-by: syzbot+af7d510593d74c825960@syzkaller.appspotmail.com OK mpi@
First crash: 216d, last: 142d
similar bugs (6):
Kernel Title Repro Bisected Count Last Reported Patched Status
openbsd kernel: protection fault trap, code=0 (6) C 55024 51d 135d 3/3 fixed on 2019/12/05 05:48
openbsd kernel: protection fault trap, code=0 (4) C 759 217d 330d 3/3 fixed on 2019/06/22 17:44
openbsd kernel: protection fault trap, code=0 C 16 416d 421d 1/3 fixed on 2018/12/04 18:27
openbsd kernel: protection fault trap, code=0 (3) C 3 363d 363d 3/3 fixed on 2019/01/27 23:19
openbsd kernel: protection fault trap, code=0 (7) syz 159594 now 51d 0/3 upstream: reported syz repro on 2019/12/05 05:52
openbsd kernel: protection fault trap, code=0 (2) syz 109 368d 392d 3/3 fixed on 2019/01/22 07:18

Sample crash report:

Crashes (607):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro
ci-openbsd-main 2019/06/23 07:20 openbsd e9959c3e 34bf9440 .config log report syz C
ci-openbsd-multicore 2019/08/20 00:11 openbsd 85b8fad3 ae348fb7 .config log report syz
ci-openbsd-main 2019/06/22 20:53 openbsd f1eb72fa 34bf9440 .config log report syz
ci-openbsd-main 2019/09/04 22:56 openbsd 40f2a8ec d994512d .config log report
ci-openbsd-main 2019/09/04 21:25 openbsd 40f2a8ec d994512d .config log report
ci-openbsd-main 2019/09/04 20:06 openbsd 40f2a8ec d994512d .config log report
ci-openbsd-main 2019/09/04 17:53 openbsd 40f2a8ec d994512d .config log report
ci-openbsd-main 2019/09/04 14:13 openbsd 40f2a8ec d994512d .config log report
ci-openbsd-main 2019/09/04 11:37 openbsd 9b0b1e37 526709ff .config log report
ci-openbsd-main 2019/09/04 10:11 openbsd 9b0b1e37 526709ff .config log report
ci-openbsd-main 2019/09/04 07:29 openbsd 9b0b1e37 526709ff .config log report
ci-openbsd-main 2019/09/04 04:33 openbsd 9b0b1e37 526709ff .config log report
ci-openbsd-main 2019/09/04 02:28 openbsd 9b0b1e37 526709ff .config log report
ci-openbsd-main 2019/09/03 17:25 openbsd 196a4743 48448e71 .config log report
ci-openbsd-main 2019/09/03 13:40 openbsd 196a4743 48448e71 .config log report
ci-openbsd-main 2019/09/03 12:06 openbsd 196a4743 48448e71 .config log report
ci-openbsd-main 2019/09/03 05:33 openbsd d599800f 14544a56 .config log report
ci-openbsd-main 2019/09/03 02:27 openbsd d599800f 14544a56 .config log report
ci-openbsd-main 2019/09/02 19:38 openbsd d599800f 14544a56 .config log report
ci-openbsd-main 2019/09/02 12:42 openbsd 0c2868d6 db7c31ca .config log report
ci-openbsd-main 2019/09/02 10:46 openbsd 0c2868d6 db7c31ca .config log report
ci-openbsd-main 2019/09/02 01:13 openbsd 5e9543b6 bad3cce2 .config log report
ci-openbsd-main 2019/09/01 19:59 openbsd 5e9543b6 bad3cce2 .config log report
ci-openbsd-main 2019/09/01 16:29 openbsd 5e9543b6 bad3cce2 .config log report
ci-openbsd-main 2019/09/01 08:56 openbsd 7c095818 bad3cce2 .config log report
ci-openbsd-main 2019/09/01 05:13 openbsd 7c095818 bad3cce2 .config log report
ci-openbsd-main 2019/09/01 03:52 openbsd 7c095818 bad3cce2 .config log report
ci-openbsd-main 2019/08/31 21:52 openbsd d9ff79be bad3cce2 .config log report
ci-openbsd-main 2019/08/31 20:43 openbsd d9ff79be bad3cce2 .config log report
ci-openbsd-main 2019/08/31 18:03 openbsd d9ff79be bad3cce2 .config log report
ci-openbsd-main 2019/08/31 15:01 openbsd d9ff79be bad3cce2 .config log report
ci-openbsd-main 2019/08/31 12:31 openbsd 2ff3873d bcd7bcc2 .config log report
ci-openbsd-main 2019/08/31 11:12 openbsd 2ff3873d bcd7bcc2 .config log report
ci-openbsd-main 2019/08/31 07:16 openbsd 2ff3873d bcd7bcc2 .config log report
ci-openbsd-main 2019/08/31 02:55 openbsd 2ff3873d bcd7bcc2 .config log report
ci-openbsd-main 2019/08/31 01:53 openbsd 2ff3873d bcd7bcc2 .config log report
ci-openbsd-main 2019/08/30 23:54 openbsd a17e5ccf 9adfa876 .config log report
ci-openbsd-main 2019/08/30 17:58 openbsd a17e5ccf 9adfa876 .config log report
ci-openbsd-main 2019/08/30 13:33 openbsd a17e5ccf 9adfa876 .config log report
ci-openbsd-main 2019/08/30 11:08 openbsd c7ed2108 cd626f3b .config log report
ci-openbsd-main 2019/08/30 09:49 openbsd c7ed2108 cd626f3b .config log report
ci-openbsd-main 2019/08/30 08:39 openbsd c7ed2108 cd626f3b .config log report
ci-openbsd-main 2019/08/30 05:25 openbsd c7ed2108 cd626f3b .config log report
ci-openbsd-main 2019/08/29 19:07 openbsd 5bbf7567 cd626f3b .config log report
ci-openbsd-main 2019/08/29 17:15 openbsd 5bbf7567 cd626f3b .config log report
ci-openbsd-main 2019/08/29 15:31 openbsd 5bbf7567 cd626f3b .config log report
ci-openbsd-main 2019/08/29 14:15 openbsd 5bbf7567 cd626f3b .config log report
ci-openbsd-main 2019/08/29 11:13 openbsd 5bbf7567 cd626f3b .config log report
ci-openbsd-main 2019/06/22 20:26 openbsd f1eb72fa 34bf9440 .config log report