syzbot


KASAN: use-after-free Read in slip_open
Status: fixed on 2019/12/13 00:31
Reported-by: syzbot+4d5170758f3762109542@syzkaller.appspotmail.com
Fix commit: e58c19124189 slip: Fix use-after-free Read in slip_open
First crash: 746d, last: 741d

Cause bisection: the cause commit could be any of (bisect log):
  6ef35398e827 rtc: Add Amlogic Virtual Wake RTC
  1d74f0992991 dt-bindings: rtc: add bindings for FlexTimer Module
  ed16239637f6 dt-bindings: rtc: new binding for Amlogic VRTC
  7b0b551dbc1e rtc: fsl-ftm-alarm: add FTM alarm driver
  a6f26606ddd0 rtc: rv3029: revert error handling patch to rv3029_eeprom_write()
  80ba93639b5d rtc: ds1672: remove unnecessary check
  903e259f9caf dt-bindings: rtc: sun6i: Add compatible for H6 RTC
  44c638ce4ec6 rtc: remove superfluous error message
  b60ff2cfb598 rtc: sun6i: Add support for H6 RTC
  924068e50a6c rtc: class: add debug message when registration fails
  e788771cacaf rtc: pcf2127: convert to devm_rtc_allocate_device
  bbfe3a7a1d41 rtc: pcf2127: cleanup register and bit defines
  cb36cf803f3f rtc: pcf2123: add proper compatible string
  7f43020e3bdb rtc: pcf2127: bugfix: read rtc disables watchdog
  d5b626e13503 rtc: pcf2123: let the core handle range offsetting
  0e735eaae165 rtc: pcf2127: add watchdog feature support
  935a7f459790 rtc: pcf2123: convert to devm_rtc_allocate_device
  03623b4b041c rtc: pcf2127: add tamper detection support
  9a5aeaad73ec rtc: pcf2123: remove useless error path goto
  28abbba36a5a rtc: pcf2127: bugfix: watchdog build dependency
  9126a2b16b67 rtc: pcf2123: rename struct and variables
  6fd4fe9b496d rtc: snvs: fix possible race condition
  d3bad6026f0b rtc: pcf2123: stop using dev.platform_data
  577f648207e0 rtc: pcf2123: implement .alarm_irq_enable
  79610340cac8 rtc: snvs: set range
  c59a9fc7272e rtc: snvs: switch to rtc_time64_to_tm/rtc_tm_to_time64
  d0ce6ef71466 rtc; pcf2123: fix possible alarm race condition
  5bdf40dab622 rtc: pcf2123: don't use weekday alarm
  7ef66122bdb3 rtc: pcf85363/pcf85263: fix regmap error in set_time
  59a7f24fceb3 rtc: max77686: convert to devm_i2c_new_dummy_device()
  faac910201e9 rtc: Remove dev_err() usage after platform_get_irq()
  4053e74996b8 rtc: s35390a: convert to devm_i2c_new_dummy_device()
  b0a3fa44659c rtc: mxc: use spin_lock_irqsave instead of spin_lock_irq in IRQ context
  41a8e19f47df rtc: bd70528: fix driver dependencies
  cd646ec003c5 rtc: pcf8563: add Epson RTC8564 compatible
  cb3cab06142e rtc: remove w90x900/nuc900 driver
  deaa3ff4984f rtc: pcf8563: add Microcrystal RV8564 compatible
  8d3f805e6896 rtc: pcf8563: convert to devm_rtc_allocate_device
  aae364d2a888 rtc: s5m: convert to i2c_new_dummy_device
  c7d5f6dbd9f9 rtc: pcf8563: remove useless indirection
  ca83542cdb5c rtc: s35390a: convert to i2c_new_dummy_device
  7150710f3084 rtc: max77686: convert to i2c_new_dummy_device
  f648d40b99ba rtc: pcf8563: let the core handle range offsetting
  46eabee1f6e6 rtc: isl12026: convert to i2c_new_dummy_device
  d76a81d0c262 rtc: sun6i: Allow using as wakeup source from suspend
  4a9eb8154ffd dt-bindings: rtc: ds1307: add rx8130 compatible
  564225415e77 dt-bindings: rtc: Remove the PCF8563 from the trivial RTCs
  e02e3ddac772 rtc: sc27xx: Remove clearing SPRD_RTC_POWEROFF_ALM_FLAG flag
  f7234a9813b7 rtc: imxdi: use devm_platform_ioremap_resource() to simplify code
  874532cdeefe rtc: mxc_v2: use devm_platform_ioremap_resource() to simplify code
  b99a3120f9a3 rtc: meson: mark PM functions as __maybe_unused
  9dbd83f66529 Merge tag 'rtc-5.4' of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux
similar bugs (2):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 KASAN: use-after-free Read in slip_open C done done 7 732d 744d 1/1 fixed on 2020/01/03 09:37
linux-4.14 KASAN: use-after-free Read in slip_open C done done 2 740d 740d 1/1 fixed on 2019/12/28 10:32

Sample crash report:

Crashes (3):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-root 2019/11/19 04:57 upstream af42d3466bdc 5bc70212 .config log report syz C
ci-upstream-kasan-gce-root 2019/11/24 16:14 upstream 6b8a79467876 598ca6c8 .config log report
ci-upstream-kasan-gce-root 2019/11/19 04:35 upstream af42d3466bdc 5bc70212 .config log report