syzbot


KASAN: use-after-free Read in __queue_work (3)
Status: upstream: reported syz repro on 2020/08/08 21:27
Reported-by: syzbot+77e5e02c6c81136cdaff@syzkaller.appspotmail.com
First crash: 357d, last: 106d

Cause bisection: the issue happens on the oldest tested release (bisect log)
Crash: WARNING in sysfs_warn_dup (log)
Repro: syz .config

Fix bisection: fixed by (bisect log) :
commit e2cb6b891ad2b8caa9131e3be70f45243df82a80
Author: Lin Ma <linma@zju.edu.cn>
Date: Mon Apr 12 11:17:57 2021 +0000

  bluetooth: eliminate the potential race condition when removing the HCI controller

similar bugs (5):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-49 KASAN: use-after-free Read in __queue_work C 19 1075d 837d 0/3 public: reported C repro on 2019/04/13 00:00
linux-4.19 KASAN: use-after-free Read in __queue_work syz 5 17d 359d 0/1 upstream: reported syz repro on 2020/08/03 04:16
linux-4.14 KASAN: use-after-free Read in __queue_work syz 4 16d 358d 0/1 upstream: reported syz repro on 2020/08/03 15:06
upstream KASAN: use-after-free Read in __queue_work syz 2 1406d 1370d 0/22 closed as invalid on 2017/10/27 09:34
upstream KASAN: use-after-free Read in __queue_work (2) C done done 577 761d 1115d 16/22 fixed on 2020/01/08 01:07
Patch testing requests:
Created Duration User Patch Repo Result
2020/09/02 05:15 16m anant.thazhemadam@gmail.com https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master report log

Sample crash report:

Crashes (3):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-root 2020/08/04 21:23 upstream c0842fbc1b18 80a06902 .config log report syz
ci-upstream-linux-next-kasan-gce-root 2020/08/10 16:15 linux-next f80535b9aa10 70301872 .config log report syz
ci-upstream-kasan-gce-selinux-root 2020/11/14 20:47 upstream f01c30de86f1 1bf9a662 .config log report info