syzbot


KASAN: use-after-free Read in hci_send_acl
Status: upstream: reported C repro on 2020/08/02 20:46
Reported-by: syzbot+98228e7407314d2d4ba2@syzkaller.appspotmail.com
Fix commit: 5c4c8c954409 Bluetooth: verify AMP hci_chan before amp_destroy
Patched on: [ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-leak ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce ci-upstream-kmsan-gce-386 ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu2-arm32]
First crash: 365d, last: 154d

Cause bisection: introduced by (bisect log) :
commit 4ffcd582301bd020b1f9d00c55473af305ec19b5
Author: Michael Chan <michael.chan@broadcom.com>
Date: Mon Sep 19 07:58:07 2016 +0000

  bnxt_en: Pad TX packets below 52 bytes.

Crash: KASAN: use-after-free Read in batadv_iv_ogm_queue_add (log)
Repro: C syz .config
similar bugs (2):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 KASAN: use-after-free Read in hci_send_acl C done 3 73d 365d 1/1 fixed on 2021/06/23 17:43
linux-4.14 KASAN: use-after-free Read in hci_send_acl C 4 9d03h 365d 0/1 upstream: reported C repro on 2020/08/02 14:47

Sample crash report:

Fix bisection attempts:
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-selinux-root 2021/03/01 07:30 upstream fe07bfda2fb9 63a73341 .config log report syz C
ci-upstream-kasan-gce-selinux-root 2021/01/07 16:02 upstream 71c061d24438 63a73341 .config log report syz C
ci-upstream-kasan-gce-selinux-root 2020/12/07 15:25 upstream 0477e9288185 63a73341 .config log report syz C
ci-upstream-kasan-gce-selinux-root 2020/11/07 06:59 upstream 659caaf65dc9 63a73341 .config log report syz C
ci-upstream-kasan-gce-selinux-root 2020/10/08 05:00 upstream c85fb28b6f99 63a73341 .config log report syz C
ci-upstream-kasan-gce-selinux-root 2020/09/02 16:04 upstream 9c7d619be5a0 63a73341 .config log report syz C
Crashes (2):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-selinux-root 2020/08/02 19:29 upstream ac3a0c847296 63a73341 .config log report syz C
ci-upstream-kasan-gce-smack-root 2020/08/02 13:37 upstream ac3a0c847296 63a73341 .config log report syz C