syzbot |
sign-in | mailing list | source | docs |
| Kernel | Title | Repro | Cause bisect | Fix bisect | Count | Last | Reported | Patched | Status |
|---|---|---|---|---|---|---|---|---|---|
| linux-4.19 | KASAN: use-after-free Read in l2cap_chan_close | C | done | 8 | 1569d | 1751d | 1/1 | fixed on 2020/09/09 05:22 | |
| upstream | KASAN: use-after-free Read in l2cap_chan_close | C | done | 37 | 1570d | 1750d | 15/28 | fixed on 2020/09/16 22:51 |
| Created | Duration | User | Patch | Repo | Result |
|---|---|---|---|---|---|
| 2023/01/30 06:32 | 13m | retest repro | linux-4.14.y | report log | |
| 2023/01/30 05:32 | 10m | retest repro | linux-4.14.y | report log | |
| 2023/01/30 04:32 | 10m | retest repro | linux-4.14.y | report log | |
| 2023/01/30 03:32 | 10m | retest repro | linux-4.14.y | report log | |
| 2023/01/30 02:32 | 11m | retest repro | linux-4.14.y | report log | |
| 2023/01/30 01:32 | 9m | retest repro | linux-4.14.y | report log | |
| 2023/01/30 00:32 | 15m | retest repro | linux-4.14.y | report log | |
| 2023/01/29 23:32 | 9m | retest repro | linux-4.14.y | report log | |
| 2023/01/29 22:32 | 15m | retest repro | linux-4.14.y | report log | |
| 2023/01/29 21:32 | 13m | retest repro | linux-4.14.y | report log |
| Created | Duration | User | Patch | Repo | Result |
|---|---|---|---|---|---|
| 2020/07/17 04:55 | 33m | bisect fix | linux-4.14.y | OK (2) job log | |
| 2020/06/17 04:21 | 31m | bisect fix | linux-4.14.y | OK (0) job log log | |
| 2020/04/08 04:01 | 37m | bisect fix | linux-4.14.y | OK (0) job log log | |
| 2020/03/09 03:23 | 38m | bisect fix | linux-4.14.y | OK (0) job log log |
audit: type=1400 audit(1596913669.871:8): avc: denied { execmem } for pid=6358 comm="syz-executor973" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=process permissive=1
==================================================================
BUG: KASAN: use-after-free in l2cap_chan_close+0x4fb/0x770 net/bluetooth/l2cap_core.c:727
Read of size 1 at addr ffff8880976a24e0 by task kworker/1:2/3653
CPU: 1 PID: 3653 Comm: kworker/1:2 Not tainted 4.14.193-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events do_enable_set
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x1b2/0x283 lib/dump_stack.c:58
print_address_description.cold+0x54/0x1d3 mm/kasan/report.c:252
kasan_report_error.cold+0x8a/0x194 mm/kasan/report.c:351
kasan_report mm/kasan/report.c:409 [inline]
__asan_report_load1_noabort+0x68/0x70 mm/kasan/report.c:427
l2cap_chan_close+0x4fb/0x770 net/bluetooth/l2cap_core.c:727
do_enable_set+0x473/0x8a0 net/bluetooth/6lowpan.c:1086
process_one_work+0x793/0x14a0 kernel/workqueue.c:2116
worker_thread+0x5cc/0xff0 kernel/workqueue.c:2250
kthread+0x30d/0x420 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
Allocated by task 24:
save_stack mm/kasan/kasan.c:447 [inline]
set_track mm/kasan/kasan.c:459 [inline]
kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:551
kmem_cache_alloc_trace+0x131/0x3d0 mm/slab.c:3618
kmalloc include/linux/slab.h:488 [inline]
kzalloc include/linux/slab.h:661 [inline]
l2cap_chan_create+0x3e/0x3c0 net/bluetooth/l2cap_core.c:441
chan_create net/bluetooth/6lowpan.c:652 [inline]
bt_6lowpan_listen net/bluetooth/6lowpan.c:971 [inline]
do_enable_set+0x4ac/0x8a0 net/bluetooth/6lowpan.c:1090
process_one_work+0x793/0x14a0 kernel/workqueue.c:2116
worker_thread+0x5cc/0xff0 kernel/workqueue.c:2250
kthread+0x30d/0x420 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
Freed by task 24:
save_stack mm/kasan/kasan.c:447 [inline]
set_track mm/kasan/kasan.c:459 [inline]
kasan_slab_free+0xc3/0x1a0 mm/kasan/kasan.c:524
__cache_free mm/slab.c:3496 [inline]
kfree+0xc9/0x250 mm/slab.c:3815
l2cap_chan_destroy net/bluetooth/l2cap_core.c:479 [inline]
kref_put include/linux/kref.h:70 [inline]
l2cap_chan_put+0x152/0x1b0 net/bluetooth/l2cap_core.c:493
do_enable_set+0x47f/0x8a0 net/bluetooth/6lowpan.c:1087
process_one_work+0x793/0x14a0 kernel/workqueue.c:2116
worker_thread+0x5cc/0xff0 kernel/workqueue.c:2250
kthread+0x30d/0x420 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
The buggy address belongs to the object at ffff8880976a24c0
which belongs to the cache kmalloc-2048 of size 2048
The buggy address is located 32 bytes inside of
2048-byte region [ffff8880976a24c0, ffff8880976a2cc0)
The buggy address belongs to the page:
page:ffffea00025da880 count:1 mapcount:0 mapping:ffff8880976a24c0 index:0x0 compound_mapcount: 0
flags: 0xfffe0000008100(slab|head)
raw: 00fffe0000008100 ffff8880976a24c0 0000000000000000 0000000100000003
raw: ffffea00025d3ca0 ffffea00025c0720 ffff88812fe52c40 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8880976a2380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8880976a2400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8880976a2480: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
^
ffff8880976a2500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880976a2580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================