syzbot


KASAN: use-after-free Read in bcm_rx_handler
Status: upstream: reported syz repro on 2021/05/12 09:40
Reported-by: syzbot+0f7e7e5e2f4f40fa89c0@syzkaller.appspotmail.com
Fix commit: d5f9023fa61e can: bcm: delay release of struct bcm_op after synchronize_rcu()
Patched on: [ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-leak ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu2-arm32 ci-upstream-kmsan-gce ci-upstream-kmsan-gce-386]
First crash: 79d, last: 49d

Cause bisection: introduced by (bisect log) :
commit e057dd3fc20ffb3d7f150af46542a51b59b90127
Author: Oliver Hartkopp <socketcan@hartkopp.net>
Date: Mon Sep 28 20:04:04 2020 +0000

  can: add ISO 15765-2:2016 transport protocol

Crash: KASAN: use-after-free Read in bcm_rx_handler (log)
Repro: syz .config
Patch testing requests:
Created Duration User Patch Repo Result
2021/06/14 13:43 17m phind.uet@gmail.com linux-next error

Sample crash report:

Fix bisection attempts:
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-net-kasan-gce 2021/06/11 07:07 net-next 76cf404c40ae b3c3bb8e .config log report syz
Crashes (2):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-net-kasan-gce 2021/05/12 06:04 net-next 009fc857c5f6 b3c3bb8e .config log report syz KASAN: use-after-free Read in bcm_rx_handler
ci-upstream-net-kasan-gce 2021/05/12 04:18 net-next 009fc857c5f6 b3c3bb8e .config log report info KASAN: use-after-free Read in bcm_rx_handler