syzbot


KASAN: use-after-free Read in ath9k_hif_usb_rx_cb (2)
Status: upstream: reported C repro on 2020/11/16 17:09
Reported-by: syzbot+03110230a11411024147@syzkaller.appspotmail.com
First crash: 111d, last: 4h07m

Cause bisection: introduced by (bisect log) :
commit dcd479e10a0510522a5d88b29b8f79ea3467d501
Author: Johannes Berg <johannes.berg@intel.com>
Date: Fri Oct 9 12:17:11 2020 +0000

  mac80211: always wind down STA state

Crash: BUG: sleeping function called from invalid context in sta_info_move_state (log)
Repro: C syz .config
duplicates (1):
Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
KASAN: slab-out-of-bounds Read in ath9k_hif_usb_rx_cb (2) C error 80 1d10h 220d 0/21 closed as dup on 2021/01/13 11:30
similar bugs (4):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: use-after-free Read in ath9k_hif_usb_rx_cb C 2849 111d 346d 17/21 fixed on 2020/11/16 12:12
upstream KASAN: out-of-bounds Read in ath9k_hif_usb_rx_cb (3) 2 5d08h 61d 0/21 upstream: reported on 2021/01/05 16:03
upstream KASAN: slab-out-of-bounds Read in ath9k_hif_usb_rx_cb (2) C error 80 1d10h 220d 0/21 closed as dup on 2021/01/13 11:30
upstream general protection fault in ath9k_hif_usb_rx_cb (2) C 305 1d18h 233d 0/21 upstream: reported C repro on 2020/07/17 18:56

Sample crash report:

Crashes (1481):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-root 2021/03/05 10:27 upstream cee407c5 9d751681 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-smack-root 2021/02/24 13:16 upstream c03c21ba fcc6d71b .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-root 2021/02/20 23:18 upstream f40ddce8 3e5ed8b4 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-smack-root 2021/02/20 18:05 upstream f40ddce8 3e5ed8b4 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-smack-root 2021/02/20 01:10 upstream f40ddce8 f689d40a .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-root 2021/02/19 23:55 upstream f40ddce8 f689d40a .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-smack-root 2021/02/19 00:29 upstream f40ddce8 14052202 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-smack-root 2021/02/17 02:51 upstream f40ddce8 98682e5e .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-root 2021/02/16 12:05 upstream f40ddce8 98682e5e .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-root 2021/02/16 00:02 upstream f40ddce8 98682e5e .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-root 2021/02/14 12:31 upstream ac30d8ce 98682e5e .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2021/02/14 07:52 upstream ac30d8ce 98682e5e .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-smack-root 2021/02/14 02:58 upstream ac30d8ce 98682e5e .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2021/02/12 03:59 upstream 291009f6 a5f86b15 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-root 2021/02/12 02:25 upstream 291009f6 a5f86b15 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2021/02/12 00:38 upstream 291009f6 a5f86b15 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-root 2021/02/11 16:25 upstream 291009f6 a52ee10a .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-root 2021/02/11 09:28 upstream 291009f6 a52ee10a .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2021/02/08 18:02 upstream 92bf2261 2ce644fc .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-root 2021/02/07 05:00 upstream 964d069f 0655e081 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2021/02/06 01:19 upstream dd86e7fa 23a562df .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-smack-root 2021/02/01 04:42 upstream 6642d600 fc9fd31e .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2021/01/28 04:41 upstream 76c057c8 eefc07f2 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2020/12/03 14:17 upstream 34816d20 e6b0d314 .config log report syz C
ci-upstream-kasan-gce 2020/12/02 10:11 upstream 509a1542 c42a35e9 .config log report syz C
ci-upstream-kasan-gce 2020/12/01 17:59 upstream b6505459 07bfe8a5 .config log report syz C
ci-upstream-kasan-gce 2020/11/29 05:48 upstream 45e885c4 a0092f9d .config log report syz C
ci-upstream-kasan-gce 2020/11/28 20:03 upstream c84e1efa 76b4dcc7 .config log report syz C
ci-upstream-kasan-gce 2020/11/26 03:53 upstream fa02fcd9 2f1cec62 .config log report syz C
ci-upstream-kasan-gce-386 2020/11/30 03:04 upstream aae5ab85 a0092f9d .config log report syz C
ci-upstream-kasan-gce-386 2020/11/18 16:30 upstream 0fa8ee0d 09323409 .config log report syz C
ci2-upstream-usb 2021/01/11 08:35 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 841081d8 2c1f2513 .config log report syz C
ci2-upstream-usb 2020/12/25 12:56 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 3644e2d2 b982b3ea .config log report syz C
ci2-upstream-usb 2020/12/25 11:29 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 3644e2d2 b982b3ea .config log report syz C
ci2-upstream-usb 2020/12/25 08:23 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 3644e2d2 c2c1d1dd .config log report syz C
ci2-upstream-usb 2020/12/23 06:19 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 3644e2d2 04201c06 .config log report syz C
ci2-upstream-usb 2020/12/21 08:24 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 3644e2d2 04201c06 .config log report syz C
ci2-upstream-usb 2020/12/13 08:23 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing a256e240 bca53db9 .config log report syz C
ci2-upstream-usb 2020/12/12 01:52 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing a256e240 bca53db9 .config log report syz C
ci2-upstream-usb 2020/12/10 15:35 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing d2a968dd 2a55c22b .config log report syz C
ci2-upstream-usb 2020/12/09 01:49 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing b175d273 40cc414d .config log report syz C
ci2-upstream-usb 2020/12/08 23:56 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing b175d273 40cc414d .config log report syz C
ci2-upstream-usb 2020/11/16 16:45 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 0fb2c41f 1bf9a662 .config log report syz C
ci2-upstream-usb 2020/12/26 15:32 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 3644e2d2 821e0b09 .config log report syz
ci-upstream-kasan-gce 2021/03/01 12:25 upstream cd278456 4c37c133 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-smack-root 2021/02/27 18:11 upstream 3fb6d0e0 4c37c133 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-386 2021/02/19 01:47 upstream f40ddce8 14052202 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/07 17:51 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e17812c c599ed12 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/07 14:57 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e17812c c599ed12 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/07 06:10 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e17812c e4b4d570 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/07 00:40 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e17812c e4b4d570 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/06 22:05 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e17812c e4b4d570 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/06 20:50 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e17812c e4b4d570 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/06 17:19 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e17812c e4b4d570 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/06 13:14 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e17812c e4b4d570 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/06 11:41 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e17812c e4b4d570 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/06 10:16 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e17812c e4b4d570 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/06 07:53 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e17812c e4b4d570 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/06 04:21 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e17812c 4a024a9b .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/06 01:05 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e17812c 4a024a9b .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/05 21:23 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e17812c 4a024a9b .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/05 19:03 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e17812c 4a024a9b .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/05 15:32 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e17812c 9d751681 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/05 09:20 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e17812c 9d751681 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/05 07:58 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e17812c 9d751681 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/05 06:53 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e17812c 9d751681 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/05 05:40 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e17812c 9d751681 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/05 03:54 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e17812c f89ed068 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/05 01:40 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e17812c f89ed068 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/04 22:04 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e17812c f89ed068 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/04 19:19 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e17812c f89ed068 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/04 18:01 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e17812c f89ed068 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/04 16:21 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e17812c d7e4e604 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/04 13:02 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e17812c d7e4e604 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/04 02:49 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e17812c 06ed56cd .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/04 01:07 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e17812c 06ed56cd .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/03 23:39 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e17812c 06ed56cd .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/03 21:59 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e17812c 06ed56cd .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/03 14:36 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e17812c 06ed56cd .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/03 10:50 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5e17812c e5b64d68 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/03 09:59 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5bb9cdb3 e5b64d68 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/03 08:31 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5bb9cdb3 e5b64d68 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/03 07:29 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5bb9cdb3 e5b64d68 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/03 05:46 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5bb9cdb3 e5b64d68 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/03 01:33 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5bb9cdb3 e5b64d68 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/02 21:02 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5bb9cdb3 e5b64d68 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/02 19:08 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5bb9cdb3 92ead296 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/02 17:29 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5bb9cdb3 92ead296 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2021/03/02 14:43 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 5bb9cdb3 92ead296 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-selinux-root 2020/12/18 21:26 upstream a409ed15 04201c06 .config log report info
ci2-upstream-usb 2020/11/16 16:17 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 0fb2c41f 1bf9a662 .config log report info