syzbot


KASAN: use-after-free Read in remove_wait_queue
Status: fixed on 2018/03/05 12:02
Reported-by: syzbot+@syzkaller.appspotmail.com
Fix commit: b6c6212514fe ANDROID: binder: synchronize_rcu() when using POLLFREE.
First crash: 1262d, last: 1252d
similar bugs (4):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 KASAN: use-after-free Read in remove_wait_queue (2) C error 6 436d 477d 0/1 upstream: reported C repro on 2020/04/07 06:03
upstream KASAN: use-after-free Read in remove_wait_queue (2) C 4 1235d 1245d 6/22 fixed on 2018/06/07 13:52
linux-4.14 KASAN: use-after-free Read in remove_wait_queue 1 701d 701d 0/1 auto-closed as invalid on 2019/12/24 15:10
upstream KASAN: use-after-free Read in remove_wait_queue C 7 1251d 1261d 4/22 fixed on 2018/02/26 20:04

Sample crash report:

Crashes (6):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-android-49-kasan-gce 2018/02/21 14:24 https://android.googlesource.com/kernel/common android-4.9 cdfc8df1d262 04cbdbd1 .config log report syz C
ci-android-49-kasan-gce-386 2018/02/21 14:39 https://android.googlesource.com/kernel/common android-4.9 cdfc8df1d262 04cbdbd1 .config log report syz
ci-android-49-kasan-gce 2018/02/21 14:01 https://android.googlesource.com/kernel/common android-4.9 cdfc8df1d262 04cbdbd1 .config log report
ci-android-49-kasan-gce 2018/02/18 07:14 https://android.googlesource.com/kernel/common android-4.9 cdfc8df1d262 833f78c7 .config log report
ci-android-49-kasan-gce 2018/02/14 18:19 https://android.googlesource.com/kernel/common android-4.9 1a938310b8af 17061fc0 .config log report
ci-android-49-kasan-gce 2018/02/11 16:56 https://android.googlesource.com/kernel/common android-4.9 8a174b4749d3 4e9b726d .config log report