syzbot


KASAN: use-after-free Read in __queue_work (3)
Status: upstream: reported syz repro on 2020/08/08 21:27
Reported-by: syzbot+77e5e02c6c81136cdaff@syzkaller.appspotmail.com
First crash: 440d, last: 188d

Cause bisection: the issue happens on the oldest tested release (bisect log)
Crash: WARNING in sysfs_warn_dup (log)
Repro: syz .config

Fix bisection: fixed by (bisect log) :
commit e2cb6b891ad2b8caa9131e3be70f45243df82a80
Author: Lin Ma <linma@zju.edu.cn>
Date: Mon Apr 12 11:17:57 2021 +0000

  bluetooth: eliminate the potential race condition when removing the HCI controller

similar bugs (5):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-49 KASAN: use-after-free Read in __queue_work C 19 1157d 920d 0/3 public: reported C repro on 2019/04/13 00:00
linux-4.19 KASAN: use-after-free Read in __queue_work syz done 5 69d 441d 1/1 fixed on 2021/09/10 09:12
linux-4.14 KASAN: use-after-free Read in __queue_work syz 4 8d08h 441d 0/1 upstream: reported syz repro on 2020/08/03 15:06
upstream KASAN: use-after-free Read in __queue_work syz 2 1488d 1452d 0/22 closed as invalid on 2017/10/27 09:34
upstream KASAN: use-after-free Read in __queue_work (2) C done done 577 844d 1197d 16/22 fixed on 2020/01/08 01:07
Patch testing requests:
Created Duration User Patch Repo Result
2021/08/14 15:42 15m phind.uet@gmail.com linux-next OK
2020/09/02 05:15 16m anant.thazhemadam@gmail.com https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master report log

Sample crash report:

Crashes (3):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-root 2020/08/04 21:23 upstream c0842fbc1b18 80a06902 .config log report syz
ci-upstream-linux-next-kasan-gce-root 2020/08/10 16:15 linux-next f80535b9aa10 70301872 .config log report syz
ci-upstream-kasan-gce-selinux-root 2020/11/14 20:47 upstream f01c30de86f1 1bf9a662 .config log report info