syzbot


KASAN: use-after-free Read in ath9k_hif_usb_rx_cb (2)

Status: upstream: reported C repro on 2020/11/16 17:09
Reported-by: syzbot+03110230a11411024147@syzkaller.appspotmail.com
Fix commit: 0ac4827f78c7 ath9k: fix use-after-free in ath9k_hif_usb_rx_cb
Patched on: [ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm32 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-arm64 ci-upstream-gce-leak ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce ci-upstream-kmsan-gce-386 ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-fs ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu2-riscv64]
First crash: 744d, last: 111d

Cause bisection: introduced by (bisect log) :
commit dcd479e10a0510522a5d88b29b8f79ea3467d501
Author: Johannes Berg <johannes.berg@intel.com>
Date: Fri Oct 9 12:17:11 2020 +0000

  mac80211: always wind down STA state

Crash: BUG: sleeping function called from invalid context in sta_info_move_state (log)
Repro: C syz .config
duplicates (1):
Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
KASAN: slab-out-of-bounds Read in ath9k_hif_usb_rx_cb (2) C error 4233 112d 853d 0/24 closed as dup on 2021/01/13 11:30
similar bugs (4):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: use-after-free Read in ath9k_hif_usb_rx_cb C 2849 744d 979d 17/24 fixed on 2020/11/16 12:12
upstream KASAN: out-of-bounds Read in ath9k_hif_usb_rx_cb (3) C unreliable done 7 290d 694d 22/24 fixed on 2022/03/16 16:10
upstream KASAN: slab-out-of-bounds Read in ath9k_hif_usb_rx_cb (2) C error 4233 112d 853d 0/24 closed as dup on 2021/01/13 11:30
upstream general protection fault in ath9k_hif_usb_rx_cb (2) C error 1678 112d 866d 23/24 upstream: reported C repro on 2020/07/17 18:56
Patch testing requests:
Created Duration User Patch Repo Result
2022/04/29 10:51 15m penguin-kernel@i-love.sakura.ne.jp patch upstream OK
2021/08/04 18:57 18m paskripkin@gmail.com patch upstream OK
2021/06/17 21:59 14m fuzzybritches0@gmail.com patch https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 009c9aa5be652675a06d5211e1640e02bbb1c33d report log
2021/06/17 17:38 16m fuzzybritches0@gmail.com patch https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 009c9aa5be652675a06d5211e1640e02bbb1c33d report log
2021/06/17 12:27 12m fuzzybritches0@gmail.com patch https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git 009c9aa5be652675a06d5211e1640e02bbb1c33d report log
2021/03/12 08:39 9m mail@anirudhrb.com linux-next report log

Sample crash report:
==================================================================
BUG: KASAN: use-after-free in ath9k_hif_usb_rx_stream drivers/net/wireless/ath/ath9k/hif_usb.c:588 [inline]
BUG: KASAN: use-after-free in ath9k_hif_usb_rx_cb+0xd17/0x10d0 drivers/net/wireless/ath/ath9k/hif_usb.c:686
Read of size 4 at addr ffff88806d6a42f4 by task swapper/1/0

CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.19.0-syzkaller-02972-g200e340f2196 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 print_address_description.constprop.0.cold+0xeb/0x467 mm/kasan/report.c:313
 print_report mm/kasan/report.c:429 [inline]
 kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491
 ath9k_hif_usb_rx_stream drivers/net/wireless/ath/ath9k/hif_usb.c:588 [inline]
 ath9k_hif_usb_rx_cb+0xd17/0x10d0 drivers/net/wireless/ath/ath9k/hif_usb.c:686
 __usb_hcd_giveback_urb+0x2b0/0x5c0 drivers/usb/core/hcd.c:1670
 usb_hcd_giveback_urb+0x367/0x410 drivers/usb/core/hcd.c:1747
 dummy_timer+0x11f9/0x32b0 drivers/usb/gadget/udc/dummy_hcd.c:1988
 call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1474
 expire_timers kernel/time/timer.c:1519 [inline]
 __run_timers.part.0+0x679/0xa80 kernel/time/timer.c:1790
 __run_timers kernel/time/timer.c:1768 [inline]
 run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1803
 __do_softirq+0x29b/0x9c2 kernel/softirq.c:571
 invoke_softirq kernel/softirq.c:445 [inline]
 __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:662
 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1106
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:29 [inline]
RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:70 [inline]
RIP: 0010:arch_irqs_disabled arch/x86/include/asm/irqflags.h:130 [inline]
RIP: 0010:acpi_safe_halt drivers/acpi/processor_idle.c:113 [inline]
RIP: 0010:acpi_idle_do_entry+0x1c9/0x240 drivers/acpi/processor_idle.c:555
Code: 89 de e8 aa 43 ff f7 84 db 75 98 e8 a1 47 ff f7 e8 5c 97 05 f8 66 90 e8 95 47 ff f7 0f 00 2d ce 40 b9 00 e8 89 47 ff f7 fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 d4 43 ff f7 48 85 db
RSP: 0018:ffffc9000038fd20 EFLAGS: 00000293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: ffff88801206c200 RSI: ffffffff897ac377 RDI: 0000000000000000
RBP: ffff888017656064 R08: 0000000000000001 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000001
R13: ffff888017656000 R14: ffff888017656064 R15: ffff888146a97804
 acpi_idle_enter+0x369/0x510 drivers/acpi/processor_idle.c:692
 cpuidle_enter_state+0x1b1/0xc80 drivers/cpuidle/cpuidle.c:238
 cpuidle_enter+0x4a/0xa0 drivers/cpuidle/cpuidle.c:352
 call_cpuidle kernel/sched/idle.c:155 [inline]
 cpuidle_idle_call kernel/sched/idle.c:236 [inline]
 do_idle+0x3e8/0x590 kernel/sched/idle.c:303
 cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:400
 start_secondary+0x21d/0x2b0 arch/x86/kernel/smpboot.c:266
 secondary_startup_64_no_verify+0xce/0xdb
 </TASK>

Allocated by task 26:
 kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
 kasan_set_track mm/kasan/common.c:45 [inline]
 set_alloc_info mm/kasan/common.c:437 [inline]
 ____kasan_kmalloc mm/kasan/common.c:516 [inline]
 ____kasan_kmalloc mm/kasan/common.c:475 [inline]
 __kasan_kmalloc+0xa6/0xd0 mm/kasan/common.c:525
 kasan_kmalloc include/linux/kasan.h:234 [inline]
 __do_kmalloc mm/slab.c:3696 [inline]
 __kmalloc+0x209/0x4e0 mm/slab.c:3705
 kmalloc include/linux/slab.h:605 [inline]
 kzalloc include/linux/slab.h:733 [inline]
 wiphy_new_nm+0x6f0/0x2080 net/wireless/core.c:440
 ieee80211_alloc_hw_nm+0x373/0x2270 net/mac80211/main.c:585
 ieee80211_alloc_hw include/net/mac80211.h:4412 [inline]
 ath9k_htc_probe_device+0x97/0x1f30 drivers/net/wireless/ath/ath9k/htc_drv_init.c:939
 ath9k_htc_hw_init+0x31/0x60 drivers/net/wireless/ath/ath9k/htc_hst.c:508
 ath9k_hif_usb_firmware_cb+0x274/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1245
 request_firmware_work_func+0x12c/0x230 drivers/base/firmware_loader/main.c:1107
 process_one_work+0x996/0x1610 kernel/workqueue.c:2289
 worker_thread+0x665/0x1080 kernel/workqueue.c:2436
 kthread+0x2e9/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306

Freed by task 26:
 kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
 kasan_set_track+0x21/0x30 mm/kasan/common.c:45
 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370
 ____kasan_slab_free mm/kasan/common.c:367 [inline]
 ____kasan_slab_free+0x13d/0x180 mm/kasan/common.c:329
 kasan_slab_free include/linux/kasan.h:200 [inline]
 __cache_free mm/slab.c:3426 [inline]
 kfree+0x173/0x390 mm/slab.c:3796
 device_release+0x9f/0x240 drivers/base/core.c:2241
 kobject_cleanup lib/kobject.c:673 [inline]
 kobject_release lib/kobject.c:704 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x1c8/0x540 lib/kobject.c:721
 put_device+0x1b/0x30 drivers/base/core.c:3535
 ath9k_htc_probe_device+0x1c7/0x1f30 drivers/net/wireless/ath/ath9k/htc_drv_init.c:976
 ath9k_htc_hw_init+0x31/0x60 drivers/net/wireless/ath/ath9k/htc_hst.c:508
 ath9k_hif_usb_firmware_cb+0x274/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1245
 request_firmware_work_func+0x12c/0x230 drivers/base/firmware_loader/main.c:1107
 process_one_work+0x996/0x1610 kernel/workqueue.c:2289
 worker_thread+0x665/0x1080 kernel/workqueue.c:2436
 kthread+0x2e9/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306

The buggy address belongs to the object at ffff88806d6a0000
 which belongs to the cache kmalloc-32k of size 32768
The buggy address is located 17140 bytes inside of
 32768-byte region [ffff88806d6a0000, ffff88806d6a8000)

The buggy address belongs to the physical page:
page:ffffea0001b5a800 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6d6a0
head:ffffea0001b5a800 order:4 compound_mapcount:0 compound_pincount:0
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 ffffea0001b5a408 ffff888011841d50 ffff888011840c00
raw: 0000000000000000 ffff88806d6a0000 0000000100000001 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 4, migratetype Unmovable, gfp_mask 0x2420c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_COMP|__GFP_THISNODE), pid 26, tgid 26 (kworker/1:1), ts 52221308230, free_ts 12389396757
 prep_new_page mm/page_alloc.c:2457 [inline]
 get_page_from_freelist+0x1298/0x3b80 mm/page_alloc.c:4203
 __alloc_pages+0x1c7/0x510 mm/page_alloc.c:5431
 __alloc_pages_node include/linux/gfp.h:587 [inline]
 kmem_getpages mm/slab.c:1363 [inline]
 cache_grow_begin+0x75/0x350 mm/slab.c:2569
 cache_alloc_refill+0x27f/0x380 mm/slab.c:2942
 ____cache_alloc mm/slab.c:3024 [inline]
 ____cache_alloc mm/slab.c:3007 [inline]
 __do_cache_alloc mm/slab.c:3253 [inline]
 slab_alloc mm/slab.c:3295 [inline]
 __do_kmalloc mm/slab.c:3694 [inline]
 __kmalloc+0x3ba/0x4e0 mm/slab.c:3705
 kmalloc include/linux/slab.h:605 [inline]
 kzalloc include/linux/slab.h:733 [inline]
 wiphy_new_nm+0x6f0/0x2080 net/wireless/core.c:440
 ieee80211_alloc_hw_nm+0x373/0x2270 net/mac80211/main.c:585
 ieee80211_alloc_hw include/net/mac80211.h:4412 [inline]
 ath9k_htc_probe_device+0x97/0x1f30 drivers/net/wireless/ath/ath9k/htc_drv_init.c:939
 ath9k_htc_hw_init+0x31/0x60 drivers/net/wireless/ath/ath9k/htc_hst.c:508
 ath9k_hif_usb_firmware_cb+0x274/0x530 drivers/net/wireless/ath/ath9k/hif_usb.c:1245
 request_firmware_work_func+0x12c/0x230 drivers/base/firmware_loader/main.c:1107
 process_one_work+0x996/0x1610 kernel/workqueue.c:2289
 worker_thread+0x665/0x1080 kernel/workqueue.c:2436
 kthread+0x2e9/0x3a0 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1371 [inline]
 free_pcp_prepare+0x549/0xd20 mm/page_alloc.c:1421
 free_unref_page_prepare mm/page_alloc.c:3344 [inline]
 free_unref_page+0x19/0x6a0 mm/page_alloc.c:3439
 free_contig_range+0xb1/0x180 mm/page_alloc.c:9319
 destroy_args+0xa8/0x646 mm/debug_vm_pgtable.c:1031
 debug_vm_pgtable+0x2a03/0x2a94 mm/debug_vm_pgtable.c:1354
 do_one_initcall+0x103/0x650 init/main.c:1296
 do_initcall_level init/main.c:1369 [inline]
 do_initcalls init/main.c:1385 [inline]
 do_basic_setup init/main.c:1404 [inline]
 kernel_init_freeable+0x6b1/0x73a init/main.c:1611
 kernel_init+0x1a/0x1d0 init/main.c:1500
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306

Memory state around the buggy address:
 ffff88806d6a4180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88806d6a4200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88806d6a4280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                             ^
 ffff88806d6a4300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88806d6a4380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess):
   0:	89 de                	mov    %ebx,%esi
   2:	e8 aa 43 ff f7       	callq  0xf7ff43b1
   7:	84 db                	test   %bl,%bl
   9:	75 98                	jne    0xffffffa3
   b:	e8 a1 47 ff f7       	callq  0xf7ff47b1
  10:	e8 5c 97 05 f8       	callq  0xf8059771
  15:	66 90                	xchg   %ax,%ax
  17:	e8 95 47 ff f7       	callq  0xf7ff47b1
  1c:	0f 00 2d ce 40 b9 00 	verw   0xb940ce(%rip)        # 0xb940f1
  23:	e8 89 47 ff f7       	callq  0xf7ff47b1
  28:	fb                   	sti
  29:	f4                   	hlt
* 2a:	9c                   	pushfq <-- trapping instruction
  2b:	5b                   	pop    %rbx
  2c:	81 e3 00 02 00 00    	and    $0x200,%ebx
  32:	fa                   	cli
  33:	31 ff                	xor    %edi,%edi
  35:	48 89 de             	mov    %rbx,%rsi
  38:	e8 d4 43 ff f7       	callq  0xf7ff4411
  3d:	48 85 db             	test   %rbx,%rbx

Crashes (48810):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-selinux-root 2022/08/10 21:57 upstream 200e340f2196 a6201f11 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-selinux-root 2022/08/09 13:35 upstream 200e340f2196 da700653 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-selinux-root 2022/08/08 11:38 upstream 200e340f2196 88e3a122 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-selinux-root 2022/08/07 13:13 upstream 200e340f2196 88e3a122 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-root 2022/08/06 01:18 upstream 200e340f2196 e853abd9 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-root 2022/08/06 00:43 upstream 200e340f2196 e853abd9 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-selinux-root 2022/08/04 22:08 upstream 200e340f2196 1c9013ac .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2022/08/04 20:41 upstream 200e340f2196 1c9013ac .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-root 2022/08/03 15:42 upstream e2b542100719 1c9013ac .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2022/08/01 02:54 upstream 334c0ef6429f fef302b1 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-smack-root 2022/07/23 04:51 upstream 4ba1329cbb94 22343af4 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2022/07/18 05:36 upstream ff6992735ade 95cb00d1 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2022/07/17 02:02 upstream c658cabbfd32 95cb00d1 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-root 2022/07/16 06:41 upstream 9b59ec8d50a1 95cb00d1 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-selinux-root 2022/07/15 09:05 upstream 9bd572ec7a66 5d921b08 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-selinux-root 2022/07/14 17:50 upstream 4a57a8400075 5d921b08 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-selinux-root 2022/07/14 17:06 upstream 4a57a8400075 5d921b08 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-smack-root 2022/07/14 15:43 upstream 4a57a8400075 5d921b08 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-selinux-root 2022/07/13 03:03 upstream 72a8e05d4f66 d91dd8ea .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-smack-root 2022/07/13 01:18 upstream 72a8e05d4f66 d91dd8ea .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-selinux-root 2022/07/11 16:36 upstream 32346491ddf2 da3d6955 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-smack-root 2022/07/09 15:27 upstream e5524c2a1fc4 b5765a15 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-selinux-root 2022/07/08 05:29 upstream e8a4e1c1bb69 bff65f44 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-root 2022/07/07 09:17 upstream 9f09069cde34 bff65f44 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-smack-root 2022/07/05 16:52 upstream c1084b6c5620 bff65f44 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-selinux-root 2022/07/05 16:24 upstream c1084b6c5620 bff65f44 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2022/07/05 12:15 upstream c1084b6c5620 bff65f44 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2022/07/05 09:50 upstream c1084b6c5620 bff65f44 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-selinux-root 2022/07/05 06:13 upstream c1084b6c5620 bff65f44 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-selinux-root 2022/07/04 01:12 upstream 69cb6c6556ad 1434eec0 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-qemu-upstream 2022/05/30 04:13 upstream c3a9a3c5f559 a46af346 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-smack-root 2022/04/27 16:27 upstream 46cf2c613f4b 1fa34c1b .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-selinux-root 2021/08/04 06:26 upstream d5ad8ec3cfb5 6c236867 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-root 2021/06/17 11:49 upstream 6b00bc639f1f aba2b2fb .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-root 2021/03/05 10:27 upstream cee407c5cc42 9d751681 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2022/08/04 19:25 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 8288c99fc263 1c9013ac .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2022/08/01 02:24 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 8288c99fc263 fef302b1 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-linux-next-kasan-gce-root 2022/07/31 09:38 linux-next cb71b93c2dc3 fef302b1 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-linux-next-kasan-gce-root 2022/07/31 02:47 linux-next cb71b93c2dc3 fef302b1 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2022/07/18 03:52 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing c76d09da77d6 95cb00d1 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-linux-next-kasan-gce-root 2022/07/15 02:21 linux-next cb71b93c2dc3 5d921b08 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-linux-next-kasan-gce-root 2022/07/08 12:51 linux-next cb71b93c2dc3 bff65f44 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-linux-next-kasan-gce-root 2022/07/07 13:40 linux-next cb71b93c2dc3 bff65f44 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-linux-next-kasan-gce-root 2022/07/06 20:35 linux-next cb71b93c2dc3 bff65f44 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-linux-next-kasan-gce-root 2022/07/05 15:09 linux-next cb71b93c2dc3 bff65f44 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2022/07/05 09:30 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 90557fa89d3e bff65f44 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-linux-next-kasan-gce-root 2022/07/02 20:55 linux-next cb71b93c2dc3 1434eec0 .config log report syz C KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-386 2020/11/18 16:30 upstream 0fa8ee0d9ab9 09323409 .config log report syz C
ci2-upstream-usb 2021/01/11 08:35 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 841081d89d5a 2c1f2513 .config log report syz C
ci2-upstream-usb 2020/11/16 16:45 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 0fb2c41f992c 1bf9a662 .config log report syz C
ci-upstream-kasan-gce 2022/08/11 21:47 upstream 200e340f2196 787ed7e0 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-selinux-root 2022/08/11 20:06 upstream 200e340f2196 787ed7e0 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2022/08/11 17:02 upstream 200e340f2196 787ed7e0 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2022/08/11 10:06 upstream 200e340f2196 a6201f11 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2022/08/11 08:39 upstream 200e340f2196 a6201f11 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-root 2022/08/11 07:28 upstream 200e340f2196 a6201f11 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-smack-root 2022/08/11 02:45 upstream 200e340f2196 a6201f11 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2022/08/11 00:57 upstream 200e340f2196 a6201f11 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2022/08/10 23:21 upstream 200e340f2196 a6201f11 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-selinux-root 2022/08/10 20:19 upstream 200e340f2196 a6201f11 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2022/08/10 09:31 upstream 200e340f2196 c2a623d6 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2022/08/10 08:31 upstream 200e340f2196 c2a623d6 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2022/08/10 07:20 upstream 200e340f2196 c2a623d6 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2022/08/09 22:58 upstream 200e340f2196 c2a623d6 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2022/08/09 13:19 upstream 200e340f2196 da700653 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-root 2022/08/09 11:40 upstream 200e340f2196 da700653 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2022/08/09 06:30 upstream 200e340f2196 da700653 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2022/08/08 22:56 upstream 200e340f2196 88e3a122 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-root 2022/08/08 20:49 upstream 200e340f2196 88e3a122 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-selinux-root 2022/08/08 18:47 upstream 200e340f2196 88e3a122 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2022/08/08 15:37 upstream 200e340f2196 88e3a122 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2022/08/08 14:12 upstream 200e340f2196 88e3a122 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2022/08/08 12:40 upstream 200e340f2196 88e3a122 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2022/08/08 11:20 upstream 200e340f2196 88e3a122 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2022/08/08 10:36 upstream 200e340f2196 88e3a122 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2022/08/08 08:28 upstream 200e340f2196 88e3a122 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2022/08/08 07:05 upstream 200e340f2196 88e3a122 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2022/08/08 04:09 upstream 200e340f2196 88e3a122 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2022/08/08 02:10 upstream 200e340f2196 88e3a122 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2022/08/08 00:51 upstream 200e340f2196 88e3a122 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2022/08/08 00:27 upstream 200e340f2196 88e3a122 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-root 2022/08/07 20:36 upstream 200e340f2196 88e3a122 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2022/08/07 19:31 upstream 200e340f2196 88e3a122 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2022/08/07 17:25 upstream 200e340f2196 88e3a122 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-root 2022/08/07 16:13 upstream 200e340f2196 88e3a122 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2022/08/07 14:41 upstream 200e340f2196 88e3a122 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2022/08/07 11:48 upstream 200e340f2196 88e3a122 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2022/08/07 09:10 upstream 200e340f2196 88e3a122 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-smack-root 2022/08/07 08:07 upstream 200e340f2196 88e3a122 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-root 2022/08/06 20:38 upstream 200e340f2196 88e3a122 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2022/08/06 19:13 upstream 200e340f2196 88e3a122 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce 2022/08/06 13:19 upstream 200e340f2196 e853abd9 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-386 2022/08/11 05:30 upstream 200e340f2196 a6201f11 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-386 2022/08/10 18:24 upstream 200e340f2196 a6201f11 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-386 2022/08/09 09:34 upstream 200e340f2196 da700653 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-386 2022/08/09 01:30 upstream 200e340f2196 da700653 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-386 2022/08/08 16:41 upstream 200e340f2196 88e3a122 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-386 2022/08/08 09:32 upstream 200e340f2196 88e3a122 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-386 2022/08/08 05:41 upstream 200e340f2196 88e3a122 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-386 2022/08/07 06:22 upstream 200e340f2196 88e3a122 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-upstream-kasan-gce-386 2022/08/06 12:01 upstream 200e340f2196 e853abd9 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci-qemu-upstream-386 2022/08/05 17:41 upstream 200e340f2196 a65a7ce9 .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2022/08/05 06:10 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 8288c99fc263 1c9013ac .config log report info KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
ci2-upstream-usb 2020/11/16 16:17 https://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb.git usb-testing 0fb2c41f992c 1bf9a662 .config log report info
* Struck through repros no longer work on HEAD.