syzbot


KASAN: use-after-free Read in snd_seq_timer_interrupt (2)
Status: upstream: reported C repro on 2021/06/07 15:55
Reported-by: syzbot+ddc1260a83ed1cbf6fb5@syzkaller.appspotmail.com
Fix commit: 83e197a8414c ALSA: seq: Fix race of snd_seq_timer_open()
Patched on: [ci-qemu-upstream ci-qemu-upstream-386 ci-qemu2-arm64 ci-qemu2-arm64-compat ci-qemu2-arm64-mte ci-qemu2-riscv64 ci-upstream-bpf-kasan-gce ci-upstream-bpf-next-kasan-gce ci-upstream-gce-leak ci-upstream-kasan-gce ci-upstream-kasan-gce-386 ci-upstream-kasan-gce-root ci-upstream-kasan-gce-selinux-root ci-upstream-kasan-gce-smack-root ci-upstream-kmsan-gce ci-upstream-kmsan-gce-386 ci-upstream-linux-next-kasan-gce-root ci-upstream-net-kasan-gce ci-upstream-net-this-kasan-gce ci2-upstream-kcsan-gce ci2-upstream-usb], missing on: [ci-qemu2-arm32]
First crash: 54d, last: 54d

Cause bisection: the issue happens on the oldest tested release (bisect log)
Crash: KASAN: use-after-free Read in snd_seq_timer_interrupt (log)
Repro: C syz .config
similar bugs (3):
Kernel Title Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-4.19 KASAN: use-after-free Read in snd_seq_timer_interrupt C 1 6d18h 36d 0/1 upstream: reported C repro on 2021/06/23 11:22
upstream KASAN: use-after-free Read in snd_seq_timer_interrupt 1 1009d 1009d 13/22 fixed on 2019/06/14 18:22
linux-4.14 KASAN: use-after-free Read in snd_seq_timer_interrupt C error 1 433d 493d 0/1 upstream: reported C repro on 2020/03/23 11:55

Sample crash report:

Crashes (2):
Manager Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Title
ci-upstream-kasan-gce 2021/06/05 23:14 upstream e5220dd16778 500c2339 .config log report syz C KASAN: use-after-free Read in snd_seq_timer_interrupt
ci-upstream-kasan-gce 2021/06/05 19:20 upstream e5220dd16778 500c2339 .config log report info KASAN: use-after-free Read in snd_seq_timer_interrupt