syzbot


KASAN: use-after-free Read in hci_chan_del
Status: fixed on 2021/08/15 11:28
Reported-by: syzbot+2bb1968c6e2f8782c289@syzkaller.appspotmail.com
Fix commit: 35113c4c9fa7 bluetooth: eliminate the potential race condition when removing the HCI controller
First crash: 491d, last: 146d

Fix bisection: fixed by (bisect log) :
commit 35113c4c9fa7c970ff456982e381dc9e9594154a
Author: Lin Ma <linma@zju.edu.cn>
Date: Mon Apr 12 11:17:57 2021 +0000

  bluetooth: eliminate the potential race condition when removing the HCI controller

similar bugs (2):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.14 KASAN: use-after-free Read in hci_chan_del C 21 27d 491d 0/1 upstream: reported C repro on 2020/08/03 13:37
upstream KASAN: use-after-free Read in hci_chan_del C done done 87 213d 492d 0/22 upstream: reported C repro on 2020/08/02 20:45

Sample crash report:

Crashes (24):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci2-linux-4-19 2020/08/08 12:47 linux-4.19.y 961f830af065 01975a06 .config log report syz C
ci2-linux-4-19 2020/08/07 18:48 linux-4.19.y 961f830af065 28ac5c9e .config log report syz C
ci2-linux-4-19 2020/08/06 18:35 linux-4.19.y c076c79e03c6 4ca1c0ea .config log report syz C
ci2-linux-4-19 2020/08/06 01:57 linux-4.19.y c076c79e03c6 0487ea6f .config log report syz C
ci2-linux-4-19 2020/08/05 14:27 linux-4.19.y c076c79e03c6 b7129355 .config log report syz C
ci2-linux-4-19 2020/08/05 04:34 linux-4.19.y 13af6c74b14a 02034dac .config log report syz C
ci2-linux-4-19 2020/08/05 13:24 linux-4.19.y c076c79e03c6 b7129355 .config log report syz
ci2-linux-4-19 2020/08/05 11:53 linux-4.19.y c076c79e03c6 b7129355 .config log report syz
ci2-linux-4-19 2020/08/05 08:35 linux-4.19.y 13af6c74b14a 02034dac .config log report syz
ci2-linux-4-19 2020/08/03 19:38 linux-4.19.y 13af6c74b14a 96dd3623 .config log report syz
ci2-linux-4-19 2020/08/03 12:29 linux-4.19.y 13af6c74b14a 96dd3623 .config log report syz
ci2-linux-4-19 2020/08/03 07:57 linux-4.19.y 13af6c74b14a 96dd3623 .config log report syz
ci2-linux-4-19 2020/08/03 02:40 linux-4.19.y 13af6c74b14a 96dd3623 .config log report syz
ci2-linux-4-19 2021/05/15 17:08 linux-4.19.y 3c8c23092588 93f844de .config log report info KASAN: use-after-free Read in hci_chan_del
ci2-linux-4-19 2021/05/11 19:01 linux-4.19.y 3c8c23092588 b3c3bb8e .config log report info KASAN: use-after-free Read in hci_chan_del
ci2-linux-4-19 2021/05/10 00:55 linux-4.19.y 3c8c23092588 bc5434be .config log report info KASAN: use-after-free Read in hci_chan_del
ci2-linux-4-19 2021/05/08 15:46 linux-4.19.y 3c8c23092588 bc5434be .config log report info KASAN: use-after-free Read in hci_chan_del
ci2-linux-4-19 2021/05/05 20:40 linux-4.19.y 97a8651cadce 06c27ff5 .config log report info KASAN: use-after-free Read in hci_chan_del
ci2-linux-4-19 2021/04/19 10:40 linux-4.19.y 2965db2e004c 50f523d7 .config log report info KASAN: use-after-free Read in hci_chan_del
ci2-linux-4-19 2021/03/07 02:54 linux-4.19.y dfb571610ba3 e4b4d570 .config log report info KASAN: use-after-free Read in hci_chan_del
ci2-linux-4-19 2021/02/19 00:13 linux-4.19.y 811218eceeaa 14052202 .config log report info KASAN: use-after-free Read in hci_chan_del
ci2-linux-4-19 2021/01/20 19:48 linux-4.19.y 43d555d83c3f d4f4eca5 .config log report info KASAN: use-after-free Read in hci_chan_del
ci2-linux-4-19 2020/12/06 04:42 linux-4.19.y daefdc9eb24b 50503117 .config log report info
ci2-linux-4-19 2020/09/22 08:01 linux-4.19.y 015e94d0e37b 9e1fa68e .config log report info