syzbot


KASAN: use-after-free Read in __queue_work
Status: fixed on 2021/09/10 09:12
Reported-by: syzbot+cc2c0bfd39eb9c4f3998@syzkaller.appspotmail.com
Fix commit: 3719acc161d5 Bluetooth: defer cleanup of resources in hci_unregister_dev()
First crash: 417d, last: 45d

Fix bisection: fixed by (bisect log) :
commit 3719acc161d5c1ce09912cc1c9eddc2c5faa3c66
Author: Tetsuo Handa <penguin-kernel@i-love.sakura.ne.jp>
Date: Wed Aug 4 10:26:56 2021 +0000

  Bluetooth: defer cleanup of resources in hci_unregister_dev()

similar bugs (6):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-49 KASAN: use-after-free Read in __queue_work C 19 1133d 895d 0/3 public: reported C repro on 2019/04/13 00:00
linux-4.14 KASAN: use-after-free Read in __queue_work syz 4 14d 417d 0/1 upstream: reported syz repro on 2020/08/03 15:06
upstream KASAN: use-after-free Read in __queue_work syz 2 1464d 1428d 0/22 closed as invalid on 2017/10/27 09:34
upstream KASAN: use-after-free Read in __queue_work (3) syz done done 3 164d 411d 0/22 upstream: reported syz repro on 2020/08/08 21:27
upstream KASAN: use-after-free Read in __queue_work (2) C done done 577 819d 1173d 16/22 fixed on 2020/01/08 01:07
upstream general protection fault in __queue_work (2) C done 7041 29d 566d 0/22 upstream: reported C repro on 2020/03/07 03:55

Sample crash report:

Crashes (5):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-linux-4-19 2021/02/11 01:48 linux-4.19.y 811218eceeaa a52ee10a .config log report syz KASAN: use-after-free Read in __queue_work
ci2-linux-4-19 2020/08/05 06:46 linux-4.19.y 13af6c74b14a 02034dac .config log report syz
ci2-linux-4-19 2020/08/03 04:15 linux-4.19.y 13af6c74b14a 96dd3623 .config log report syz
ci2-linux-4-19 2021/01/04 15:49 linux-4.19.y 3207316b3bee 79264ae3 .config log report info
ci2-linux-4-19 2020/08/22 03:25 linux-4.19.y d18b78abc0c6 6436ce4b .config log report