syzbot


fixed (112):
Title Repro Bisected Count Last Reported Closed Patch
general protection fault in fbcon_switch 1 59d 59d 15d b139f8b0 fbcon: fix null-ptr-deref in fbcon_switch
WARNING: ODEBUG bug in prism2sta_disconnect_usb 1 64d 63d 15d a1f165a6 staging: wlan-ng: fix ODEBUG bug in prism2sta_disconnect_usb
KASAN: slab-out-of-bounds Read in edge_interrupt_callback C 1 64d 63d 15d 57aa9f29 USB: serial: io_edgeport: fix slab-out-of-bounds read in edge_interrupt_callback
KASAN: slab-out-of-bounds Read in hfa384x_usbin_callback C 1 66d 65d 15d 1165dd73 staging: wlan-ng: fix use-after-free Read in hfa384x_usbin_callback
BUG: soft lockup in sys_exit_group C 6 65d 88d 40d d683469b ALSA: line6: Fix endless MIDI read loop
KASAN: use-after-free Write in hiddev_disconnect 20 67d 132d 40d 5c02c447 HID: hiddev: Fix race in in hiddev_disconnect()
WARNING in _chaoskey_fill/usb_submit_urb C 15 192d 245d 74d 92aa5986 USB: chaoskey: fix error case of a timeout
WARNING in flexcop_usb_probe/usb_submit_urb C 4 240d 278d 74d 1b976fc6 media: b2c2-flexcop-usb: add sanity checking
KASAN: use-after-free Read in rsi_rx_done_handler 8 136d 265d 97d e93cd351 rsi: fix use-after-free on failed probe and unbind
general protection fault in timer_is_static_object C 2 181d 178d 97d cb222aed Input: add safety guards to input_set_keycode()
BUG: spinlock already unlocked in input_set_keycode C 2 190d 189d 97d cb222aed Input: add safety guards to input_set_keycode()
WARNING: refcount bug in cdev_get C cause 105 138d 278d 97d 68faa679 chardev: Avoid potential use-after-free in 'chrdev_open()'
WARNING in dln2_start_rx_urbs/usb_submit_urb C 44 112d 201d 97d 2b8bd606 mfd: dln2: More sanity checking for endpoints
KASAN: slab-out-of-bounds Read in hid_field_extract C 6 137d 171d 97d 8ec321e9 HID: Fix slab-out-of-bounds read in hid_field_extract
WARNING: ODEBUG bug in rsi_probe C 10487 111d 406d 97d 92aafe77 rsi: fix use-after-free on probe errors
WARNING in uvc_scan_chain_forward C 6 136d 161d 97d 68035c80 media: uvcvideo: Avoid cyclic entity chains due to malformed USB descriptors
general protection fault in gigaset_probe C 6 186d 305d 101d 53f35a39 staging: gigaset: fix general protection fault on probe
KASAN: slab-out-of-bounds Read in build_audio_procunit (2) C 1 200d 200d 122d 976a68f0 ALSA: usb-audio: Fix incorrect size check for processing/extension units
KASAN: global-out-of-bounds Write in kbd_event C 6 178d 201d 164d b2b2dd71 tty: vt: keyboard: reject invalid keycodes
general protection fault in flexcop_usb_probe C 403 178d 409d 164d 1b976fc6 media: b2c2-flexcop-usb: add sanity checking
kernel BUG at kernel/time/timer.c:LINE! (4) syz 1 234d 231d 164d f3f5ba42 media: imon: invalid dereference in imon_touch_event
KASAN: use-after-free Read in appledisplay_bl_get_brightness C 1 247d 245d 164d 91feb015 appledisplay: fix error handling in the scheduled work
INFO: trying to register non-static key in ida_destroy C 4272 178d 301d 164d 8c279e93 media: uvcvideo: Fix error path in control parsing failure
general protection fault in snd_usb_create_mixer C 1 187d 186d 164d 9435f2bb ALSA: usb-audio: Fix NULL dereference at parsing BADD
general protection fault in usb_set_interface C 3 249d 252d 164d c7a19146 media: usbvision: Fix invalid accesses after device disconnect
WARNING in port100_send_cmd_async/usb_submit_urb C 83 179d 320d 166d 5f9f0b11 nfc: port100: handle command failure cleanly
WARNING: ODEBUG bug in input_ff_destroy C 6 186d 194d 178d fa3a5a18 Input: ff-memless - kill timer in destroy()
KASAN: use-after-free Read in mcba_usb_disconnect C 2 205d 237d 178d 4d663649 can: mcba_usb: fix use-after-free on disconnect
KASAN: invalid-free in rsi_91x_deinit C 109 251d 398d 178d 8b51dc72 rsi: fix a double free bug in rsi_91x_deinit()
divide error in dummy_timer C 3 208d 214d 184d 54f83b8c USB: gadget: Reject endpoints with 0 maxpacket value
INFO: task hung in ld_usb_write C 831 203d 216d 184d 52403cfb USB: ldusb: fix control-message timeout
KASAN: use-after-free Read in iowarrior_disconnect C 3056 224d 280d 186d edc4746f USB: iowarrior: fix use-after-free on disconnect
divide error in usbtmc_generic_read C 2 285d 285d 186d de7b9aa6 usbtmc: more sanity checking for packet size
KASAN: slab-out-of-bounds Read in ld_usb_read (3) C 74 210d 221d 201d 7a6f22d7 USB: ldusb: fix read info leaks
KASAN: slab-out-of-bounds Read in build_audio_procunit C 6 207d 216d 201d ba8bf096 ALSA: usb-audio: Fix copy&paste error in the validator
KASAN: slab-out-of-bounds Write in ga_probe C 5 230d 252d 201d d9d4b1e4 HID: Fix assumption that devices have inputs
KASAN: use-after-free Read in usb_autopm_put_interface C 2373 210d 223d 201d 7a759197 USB: usblp: fix use-after-free on disconnect
KASAN: use-after-free Read in pn533_send_complete C 4 210d 231d 203d 6af3aa57 NFC: pn533: fix use-after-free and memleaks
possible deadlock in usb_deregister_dev (2) C 956 224d 252d 210d 33a78132 USB: legousbtower: fix deadlock on disconnect
WARNING in mark_lock (2) 14 217d 244d 210d 8e00c4e9 writeback: fix use-after-free in finish_writeback_work()
BUG: bad usercopy in read_rio 2 225d 229d 210d 015664d1 USB: rio500: Remove Rio 500 kernel driver
general protection fault in open_rio 2 243d 244d 210d 015664d1 USB: rio500: Remove Rio 500 kernel driver
KASAN: use-after-free Read in adu_disconnect C 5304 224d 294d 210d 44efc269 USB: adutux: fix use-after-free on disconnect
INFO: rcu detected stall in dummy_timer C 16 225d 290d 210d 32a0721c USB: yurex: Don't retry on unexpected errors
KASAN: invalid-free in disconnect_rio (2) C 51 227d 249d 210d 015664d1 USB: rio500: Remove Rio 500 kernel driver
WARNING in em28xx_usb_disconnect C 8 257d 290d 222d 46e4a266 media: em28xx: modules workqueue not inited for 2nd device
KASAN: use-after-free Read in si470x_int_in_callback C 25 232d 321d 222d 0d616f2a media: radio/si470x: kill urb on error
general protection fault in ath6kl_usb_alloc_urb_from_pipe C 1160 249d 409d 222d 39d170b3 ath6kl: fix a NULL-ptr-deref bug in ath6kl_usb_alloc_urb_from_pipe()
KASAN: use-after-free Read in atusb_disconnect C 112 224d 265d 222d 7fd25e6f ieee802154: atusb: fix use-after-free at disconnect
KASAN: slab-out-of-bounds Read in hdpvr_probe C 10 259d 334d 222d 8b8900b7 media: hdpvr: add terminating 0 at end of string
KASAN: global-out-of-bounds Read in load_next_firmware_from_table C 5 271d 321d 222d 764f3f1e libertas: Add missing sentinel at end of if_usb.c fw_table
divide error in usbnet_update_max_qlen C 17 239d 252d 222d 280ceaed usbnet: sanity checking of packet sizes and device mtu
KASAN: slab-out-of-bounds Read in technisat_usb2_rc_query C 2236 268d 406d 222d 0c4df39e media: technisat-usb2: break out of loop at end of buffer
KASAN: global-out-of-bounds Read in dvb_pll_attach C 2 260d 320d 222d c268e7ad media: dvb-frontends: use ida for pll number
general protection fault in pk_probe C 2 269d 265d 222d 98375b86 HID: prodikeys: Fix general protection fault during probe
KASAN: global-out-of-bounds Read in hdpvr_probe C 15 275d 389d 222d d4a6a953 media: hdpvr: Add device num check and handling
WARNING: ODEBUG bug in usbhid_disconnect (2) C 48 243d 265d 222d 2bcdacb7 HID: sony: Fix memory corruption issue on cleanup.
KASAN: slab-out-of-bounds Read in usb_reset_and_verify_device syz 1 273d 265d 222d 3dd550a2 USB: usbcore: Fix slab-out-of-bounds bug during device reset
BUG: MAX_STACK_TRACE_ENTRIES too low! (2) C cause 5045 254d 423d 222d 12593b74 locking/lockdep: Reduce space occupied by stack traces
possible deadlock in open_rio (3) C 169 249d 251d 222d 9472aff1 USB: rio500: Fix lockdep violation
WARNING in zd_mac_clear C 13194 249d 409d 222d 7a2eb736 zd1211rw: remove false assertion from zd_mac_clear()
WARNING in iguanair_probe/usb_submit_urb C 3 253d 304d 222d ab1cbdf1 media: iguanair: add sanity checks
general protection fault in __pm_runtime_resume C 197 243d 306d 222d 5f924277 HID: logitech: Fix general protection fault caused by Logitech driver
divide error in cdc_ncm_update_rxtx_max C 5 238d 252d 222d 3fe4b335 cdc_ncm: fix divide-by-zero caused by invalid wMaxPacketSize
KASAN: slab-out-of-bounds Read in hidraw_ioctl C 104 249d 300d 222d 416dacb8 HID: hidraw: Fix invalid read in hidraw_ioctl
possible deadlock in open_rio 1107 261d 298d 261d 2ca359f4 Revert "USB: rio500: simplify locking"
possible deadlock in usb_deregister_dev C 82 287d 294d 261d c468a8aa usb: iowarrior: fix deadlock on disconnect
WARNING in __iforce_usb_xmit/usb_submit_urb C 3 290d 294d 261d 849f5ae3 Input: iforce - add sanity checks
WARNING in kbtab_open/usb_submit_urb C 5 289d 307d 261d c88090df Input: kbtab - sanity check for endpoint type
WARNING in usbtouch_open C 768 287d 301d 261d b55d996f Input: usbtouchscreen - initialize PM mutex before using it
KASAN: use-after-free Read in usb_free_coherent 310 287d 298d 261d fc05481b usb: yurex: Fix use-after-free in yurex_delete
KASAN: use-after-free Read in ld_usb_release C 14 280d 290d 261d 303911cf USB: core: Fix races in character device registration and deregistraion
KASAN: slab-out-of-bounds Read in usbnet_generic_cdc_bind C 2 285d 287d 261d 54364278 USB: CDC: fix sanity checks in CDC union parser
KASAN: use-after-free Read in device_release_driver_internal C 5 283d 307d 261d c52873e5 usb: cdc-acm: make sure a refcount is taken early enough
WARNING in wdm_write/usb_submit_urb C 15 265d 280d 261d 1426bd2c USB: cdc-wdm: fix race between write and disconnect due to flag abuse
WARNING in mark_lock syz cause 2 280d 335d 272d 95fa1454 bpf: sockmap/tls, close can race with map free
general protection fault in holtek_kbd_input_event C 67 292d 305d 272d 01ec0a5f HID: holtek: test for sanity of intfdata
KASAN: use-after-free Read in hiddev_release C 11 282d 298d 272d 9c09b214 HID: hiddev: avoid opening a disconnected device 6d4472d7 HID: hiddev: do cleanup in failure of opening a device
WARNING in gpio_to_desc C 3 289d 320d 272d c3953a3c NFC: nfcmrvl: fix gpio-handling regression
usb-fuzzer boot error: general protection fault in dma_direct_max_mapping_size 21 303d 307d 285d 1b5d9a6e scsi: core: fix the dma_max_mapping_size call
general protection fault in snd_usb_pipe_sanity_check C 72 287d 301d 285d 5d78e1c2 ALSA: usb-audio: Fix gpf in snd_usb_pipe_sanity_check
KASAN: stack-out-of-bounds Read in hfcsusb_probe C 634 301d 406d 285d f384e62a ISDN: hfcsusb: checking idx of ep configuration
kernel BUG at drivers/usb/wusbcore/wusbhc.c:LINE! C 1 307d 307d 285d f90bf1ec usb: wusbcore: fix unbalanced get/put cluster_id
WARNING: Support for this device (Terratec Grabster AV400) is experimental. C 371 301d 391d 294d 1753c7c4 media: pvrusb2: use a different format for warnings
KASAN: use-after-free Read in cpia2_usb_disconnect C 3 320d 405d 294d eff73de2 media: cpia2_usb: first wake up, then free in disconnect
WARNING in __flush_work (3) C 1251 296d 406d 294d 11a087f4 media: uvcvideo: Fix access to uninitialized fields on probe error
KASAN: use-after-free Read in dvb_usb_device_exit C 825 294d 409d 294d 6cf97230 media: dvb: usb: fix use after free in dvb_usb_device_exit
KASAN: slab-out-of-bounds Read in au0828_rc_unregister (2) 11 365d 376d 294d 6d0d1ff9 media: au0828: fix null dereference in error path
INFO: trying to register non-static key in rtl_c2hcmd_launcher C 48950 301d 409d 294d 6c0ed66f rtlwifi: rtl8192cu: fix error handle when usb probe failed
KASAN: null-ptr-deref Read in zr364xx_vidioc_querycap C 76 301d 392d 294d 5d2e73a5 media: usb:zr364xx:Fix KASAN:null-ptr-deref Read in zr364xx_vidioc_querycap
WARNING: ath10k USB support is incomplete, don't expect anything to work! C 347 302d 382d 294d 265df32e ath10k: Change the warning message string
KASAN: use-after-free Read in v4l2_release C 275 302d 406d 294d c666355e media: radio-raremono: change devm_k*alloc to k*alloc
WARNING: Detected a wedged cx25840 chip; the device will not work. C 62 302d 391d 294d 1753c7c4 media: pvrusb2: use a different format for warnings
WARNING in snd_usb_motu_microbookii_communicate/usb_submit_urb C 3 311d 349d 294d 801ebf10 ALSA: usb-audio: Sanity checks for each pipe and EP types
KASAN: use-after-free Read in p54u_load_firmware_cb syz 40 301d 385d 294d 6e41e225 p54usb: Fix race between disconnect and firmware loading
KASAN: global-out-of-bounds Read in qmi_wwan_probe C 2 324d 336d 301d 904d88d7 qmi_wwan: Fix out-of-bounds read
KASAN: null-ptr-deref Write in submit_audio_out_urb (2) C 3423 301d 333d 301d 34501219 ALSA: line6: Fix write on zero-sized buffer
WARNING: proc registration bug in snd_info_card_register C 453 365d 409d 335d 0b074ab7 ALSA: line6: Assure canceling delayed work at disconnection
general protection fault in sisusb_probe C 3 379d 382d 340d 9a5729f6 USB: sisusbvga: fix oops in error path of sisusb_probe
KASAN: slab-out-of-bounds Write in usb_get_bos_descriptor syz 3 368d 380d 340d a03ff544 USB: Fix slab-out-of-bounds write in usb_get_bos_descriptor
KASAN: invalid-free in disconnect_rio C 180 364d 409d 340d 3864d339 USB: rio500: refuse more than one device at a time
general protection fault in smsusb_init_device C 23 364d 403d 340d 31e0456d media: usb: siano: Fix general protection fault in smsusb
KASAN: null-ptr-deref Write in submit_audio_out_urb C 185 348d 364d 342d 0b074ab7 ALSA: line6: Assure canceling delayed work at disconnection
INFO: task hung in usb_kill_urb C 1515 403d 409d 346d 50896c41 USB: dummy-hcd: Fix failure to give back unlinked URBs USB: dummy-hcd: Fix failure to give back unlinked URBs
BUG: sleeping function called from invalid context in line6_pcm_acquire 119 364d 383d 346d 7f84ff68 ALSA: line6: toneport: Fix broken usage of timer for delayed execution
general protection fault in __dev_printk C 300 390d 404d 364d ef61eb43 USB: yurex: Fix protection fault after device removal
INFO: trying to register non-static key in vmk80xx_detach C 1528 364d 409d 364d 08b7c2f9 staging: comedi: vmk80xx: Fix use of uninitialized semaphore
INFO: trying to register non-static key in ni6501_detach C 127 364d 406d 364d 660cf4ce staging: comedi: ni_usb6501: Fix use of uninitialized mutex
KASAN: use-after-free Read in snd_info_free_entry C 47 376d 406d 364d 2a3f7221 ALSA: core: Fix card races between register and disconnect 8c2f8708 ALSA: info: Fix racy addition/deletion of nodes
KASAN: slab-out-of-bounds Read in ds_probe C 5 366d 404d 364d c114944d USB: w1 ds2490: Fix bug caused by improper use of altsetting array
KASAN: stack-out-of-bounds Read in string C 46 397d 409d 375d c01c348e USB: core: Fix unterminated string returned by usb_string()
WARNING in usb_submit_urb (4) syz cause 46 377d 565d 375d c2b71462 USB: core: Fix bug caused by duplicate interface PM usage counter