syzbot


KASAN: use-after-free Read in skb_dequeue (2)
Status: fixed on 2021/10/15 14:38
Reported-by: syzbot+0be1a2e39756cde33649@syzkaller.appspotmail.com
Fix commit: f7bffefa322a tty: Fix data race between tiocsti() and flush_to_ldisc()
First crash: 163d, last: 133d

Fix bisection: fixed by (bisect log) :
commit f7bffefa322a3d5a292c0b7a9b93302b392928f6
Author: Nguyen Dinh Phi <phind.uet@gmail.com>
Date: Mon Aug 23 00:06:41 2021 +0000

  tty: Fix data race between tiocsti() and flush_to_ldisc()

similar bugs (5):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-54 KASAN: use-after-free Read in skb_dequeue syz 1 162d 162d 0/1 upstream: reported syz repro on 2021/08/16 16:14
android-49 KASAN: use-after-free Read in skb_dequeue (2) 8 1273d 1438d 0/3 auto-closed as invalid on 2019/02/22 12:37
upstream KASAN: use-after-free Read in skb_dequeue C 4 1315d 1315d 9/22 fixed on 2018/07/09 18:05
linux-4.19 KASAN: use-after-free Read in skb_dequeue syz done 1 335d 540d 1/1 fixed on 2021/03/29 19:17
android-44 KASAN: use-after-free Read in skb_dequeue 1 1245d 1245d 0/2 auto-closed as invalid on 2019/02/25 16:09

Sample crash report:

Crashes (2):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-linux-4-19 2021/08/16 06:05 linux-4.19.y 59456c9cc40c 2489ab88 .config log report syz C KASAN: use-after-free Read in skb_dequeue
ci2-linux-4-19 2021/08/16 06:21 linux-4.19.y 59456c9cc40c 2489ab88 .config log report syz KASAN: use-after-free Read in skb_dequeue