syzbot


KASAN: use-after-free Write in qdisc_class_hash_insert (2)
Status: internal: reported on 2021/06/19 13:08
Reported-by: syzbot+@syzkaller.appspotmail.com
Fix commit: 0cd58e5c53ba pkt_sched: sch_qfq: fix qfq_change_class() error path
Patched on: [ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-leak ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce ci-upstream-kmsan-gce-386 ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu2-arm32]
First crash: 100d, last: 100d
similar bugs (4):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 KASAN: use-after-free Write in qdisc_class_hash_insert 1 676d 676d 0/1 auto-closed as invalid on 2020/03/20 06:18
linux-4.14 KASAN: use-after-free Write in qdisc_class_hash_insert C error 12 137d 680d 0/1 upstream: reported C repro on 2019/11/17 01:10
upstream KASAN: use-after-free Write in qdisc_class_hash_insert C done error 8 427d 671d 0/22 closed as invalid on 2020/09/28 07:57
linux-4.19 KASAN: use-after-free Write in qdisc_class_hash_insert (2) 1 472d 472d 0/1 auto-closed as invalid on 2020/10/10 02:06

Sample crash report:

Crashes (1):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce-root 2021/06/19 13:07 upstream b1edae0d5f2e aba2b2fb .config log report info KASAN: use-after-free Write in qdisc_class_hash_insert