syzbot


KASAN: use-after-free Read in search_by_entry_key
Status: fixed on 2021/03/10 01:49
Reported-by: syzbot+83b6f7cf9922cae5c4d7@syzkaller.appspotmail.com
Fix commit: d24396c5290b reiserfs: add check for an invalid ih_entry_count
First crash: 425d, last: 421d

Cause bisection: the issue happens on the oldest tested release (bisect log)
Crash: WARNING in sysfs_warn_dup (log)
Repro: C syz .config
similar bugs (4):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 KASAN: use-after-free Read in search_by_entry_key (2) C 1 25d 235d 0/1 upstream: reported C repro on 2021/04/16 06:17
linux-4.14 KASAN: use-after-free Read in search_by_entry_key C done 3 335d 441d 1/1 fixed on 2021/02/21 17:18
linux-4.19 KASAN: use-after-free Read in search_by_entry_key C done 1 337d 427d 1/1 fixed on 2021/02/20 09:47
linux-4.19 KASAN: use-after-free Read in search_by_entry_key (2) C done 2 118d 268d 1/1 fixed on 2021/09/10 21:17
Patch testing requests:
Created Duration User Patch Repo Result
2020/11/01 07:35 18m rkovhaev@gmail.com patch upstream OK
2020/10/31 21:54 19m rkovhaev@gmail.com patch upstream OK
2020/10/20 12:07 11m anmol.karan123@gmail.com patch upstream report log
2020/10/11 16:15 10m rkovhaev@gmail.com upstream report log

Sample crash report:

Crashes (3):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-root 2020/10/12 06:59 upstream 3dd0130f2430 4a77ae0b .config log report syz C
ci-upstream-kasan-gce-selinux-root 2020/10/11 10:09 upstream da690031a5d6 4a77ae0b .config log report syz C
ci-upstream-kasan-gce-smack-root 2020/10/08 09:26 upstream c85fb28b6f99 1880b4a9 .config log report syz C