syzbot


kernel: protection fault trap, code=0 (5)
Status: fixed on 2019/09/05 13:34
Reported-by: syzbot+af7d510593d74c825960@syzkaller.appspotmail.com
Fix commit: a42056240bd9 Fix a route use after free in IPv6 multicast route. Move the mrt6_mcast6_del() out of the rtable_walk(). This avoids recursion to prevent stack overflow. Also it allows freeing the route outside of the walk. Now mrt6_mcast_del() frees the route only when it is deleted from the routing table. If that fails, it must not be freed. After the route is returned by mf6c_find(), it is reference counted. Then we need a rtfree(), but not in the other case. Name mrt6_mcast_add() and mrt6_mcast_del() consistently. Move rt_timer_remove_all() into mrt6_mcast_del(). Reported-by: syzbot+af7d510593d74c825960@syzkaller.appspotmail.com OK mpi@
First crash: 775d, last: 700d
similar bugs (7):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
openbsd kernel: protection fault trap, code=0 (6) C 55024 609d 694d 3/3 fixed on 2019/12/05 05:48
openbsd kernel: protection fault trap, code=0 (4) C 759 776d 888d 3/3 fixed on 2019/06/22 17:44
openbsd kernel: protection fault trap, code=0 (8) syz 1348 176d 365d 3/3 fixed on 2021/02/10 20:48
openbsd kernel: protection fault trap, code=0 C 16 975d 979d 1/3 fixed on 2018/12/04 18:27
openbsd kernel: protection fault trap, code=0 (3) C 3 921d 921d 3/3 fixed on 2019/01/27 23:19
openbsd kernel: protection fault trap, code=0 (7) syz 774692 365d 609d 3/3 fixed on 2020/08/05 06:16
openbsd kernel: protection fault trap, code=0 (2) syz 109 926d 950d 3/3 fixed on 2019/01/22 07:18

Sample crash report:

Crashes (607):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-openbsd-main 2019/06/23 07:20 openbsd e9959c3eed29 34bf9440 .config log report syz C
ci-openbsd-multicore 2019/08/20 00:11 openbsd 85b8fad3ba84 ae348fb7 .config log report syz
ci-openbsd-main 2019/06/22 20:53 openbsd f1eb72fadbac 34bf9440 .config log report syz
ci-openbsd-main 2019/09/04 22:56 openbsd 40f2a8ecbf52 d994512d .config log report
ci-openbsd-main 2019/09/04 21:25 openbsd 40f2a8ecbf52 d994512d .config log report
ci-openbsd-main 2019/09/04 20:06 openbsd 40f2a8ecbf52 d994512d .config log report
ci-openbsd-main 2019/09/04 17:53 openbsd 40f2a8ecbf52 d994512d .config log report
ci-openbsd-main 2019/09/04 14:13 openbsd 40f2a8ecbf52 d994512d .config log report
ci-openbsd-main 2019/09/04 11:37 openbsd 9b0b1e37334d 526709ff .config log report
ci-openbsd-main 2019/09/04 10:11 openbsd 9b0b1e37334d 526709ff .config log report
ci-openbsd-main 2019/09/04 07:29 openbsd 9b0b1e37334d 526709ff .config log report
ci-openbsd-main 2019/09/04 04:33 openbsd 9b0b1e37334d 526709ff .config log report
ci-openbsd-main 2019/09/04 02:28 openbsd 9b0b1e37334d 526709ff .config log report
ci-openbsd-main 2019/09/03 17:25 openbsd 196a4743c6fd 48448e71 .config log report
ci-openbsd-main 2019/09/03 13:40 openbsd 196a4743c6fd 48448e71 .config log report
ci-openbsd-main 2019/09/03 12:06 openbsd 196a4743c6fd 48448e71 .config log report
ci-openbsd-main 2019/09/03 05:33 openbsd d599800f4f20 14544a56 .config log report
ci-openbsd-main 2019/09/03 02:27 openbsd d599800f4f20 14544a56 .config log report
ci-openbsd-main 2019/09/02 19:38 openbsd d599800f4f20 14544a56 .config log report
ci-openbsd-main 2019/09/02 12:42 openbsd 0c2868d616e1 db7c31ca .config log report
ci-openbsd-main 2019/09/02 10:46 openbsd 0c2868d616e1 db7c31ca .config log report
ci-openbsd-main 2019/09/02 01:13 openbsd 5e9543b67bd9 bad3cce2 .config log report
ci-openbsd-main 2019/09/01 19:59 openbsd 5e9543b67bd9 bad3cce2 .config log report
ci-openbsd-main 2019/09/01 16:29 openbsd 5e9543b67bd9 bad3cce2 .config log report
ci-openbsd-main 2019/09/01 08:56 openbsd 7c0958186614 bad3cce2 .config log report
ci-openbsd-main 2019/09/01 05:13 openbsd 7c0958186614 bad3cce2 .config log report
ci-openbsd-main 2019/09/01 03:52 openbsd 7c0958186614 bad3cce2 .config log report
ci-openbsd-main 2019/08/31 21:52 openbsd d9ff79beba61 bad3cce2 .config log report
ci-openbsd-main 2019/08/31 20:43 openbsd d9ff79beba61 bad3cce2 .config log report
ci-openbsd-main 2019/08/31 18:03 openbsd d9ff79beba61 bad3cce2 .config log report
ci-openbsd-main 2019/08/31 15:01 openbsd d9ff79beba61 bad3cce2 .config log report
ci-openbsd-main 2019/08/31 12:31 openbsd 2ff3873d0ce9 bcd7bcc2 .config log report
ci-openbsd-main 2019/08/31 11:12 openbsd 2ff3873d0ce9 bcd7bcc2 .config log report
ci-openbsd-main 2019/08/31 07:16 openbsd 2ff3873d0ce9 bcd7bcc2 .config log report
ci-openbsd-main 2019/08/31 02:55 openbsd 2ff3873d0ce9 bcd7bcc2 .config log report
ci-openbsd-main 2019/08/31 01:53 openbsd 2ff3873d0ce9 bcd7bcc2 .config log report
ci-openbsd-main 2019/08/30 23:54 openbsd a17e5ccf1a9a 9adfa876 .config log report
ci-openbsd-main 2019/08/30 17:58 openbsd a17e5ccf1a9a 9adfa876 .config log report
ci-openbsd-main 2019/08/30 13:33 openbsd a17e5ccf1a9a 9adfa876 .config log report
ci-openbsd-main 2019/08/30 11:08 openbsd c7ed210895cd cd626f3b .config log report
ci-openbsd-main 2019/08/30 09:49 openbsd c7ed210895cd cd626f3b .config log report
ci-openbsd-main 2019/08/30 08:39 openbsd c7ed210895cd cd626f3b .config log report
ci-openbsd-main 2019/08/30 05:25 openbsd c7ed210895cd cd626f3b .config log report
ci-openbsd-main 2019/08/29 19:07 openbsd 5bbf75670cd8 cd626f3b .config log report
ci-openbsd-main 2019/08/29 17:15 openbsd 5bbf75670cd8 cd626f3b .config log report
ci-openbsd-main 2019/08/29 15:31 openbsd 5bbf75670cd8 cd626f3b .config log report
ci-openbsd-main 2019/08/29 14:15 openbsd 5bbf75670cd8 cd626f3b .config log report
ci-openbsd-main 2019/08/29 11:13 openbsd 5bbf75670cd8 cd626f3b .config log report
ci-openbsd-main 2019/06/22 20:26 openbsd f1eb72fadbac 34bf9440 .config log report