Groups
Groups
Sign in
Groups
Groups
syzkaller-bugs
Conversations
About
Send feedback
Help
Sort By Relevance
Sort By Date
1–30 of many
syzbot
2
Aug 15
[syzbot] [input?] [usb?] KASAN: slab-use-after-free Read in report_descriptor_read
BUG:
KASAN
: slab-
use
-
after
-
free
in report_descriptor_read+0xbb/0x100 drivers/hid/hid-core.c:2272 Read of size 24 at addr ffff888120aa1480 by task fido_id/6160 CPU: 1 UID
unread,
[syzbot] [input?] [usb?] KASAN: slab-use-after-free Read in report_descriptor_read
BUG:
KASAN
: slab-
use
-
after
-
free
in report_descriptor_read+0xbb/0x100 drivers/hid/hid-core.c:2272 Read of size 24 at addr ffff888120aa1480 by task fido_id/6160 CPU: 1 UID
Aug 15
syzbot
Aug 12
[syzbot] [jffs2?] KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode
BUG:
KASAN
: slab-
use
-
after
-
free
in jffs2_xattr_delete_inode+0x2c8/0x2d0 fs/jffs2/xattr.c:602 Read of size 4 at addr ffff888029725ee8 by task syz.8.1428/17657 CPU: 0 UID:
unread,
[syzbot] [jffs2?] KASAN: slab-use-after-free Read in jffs2_xattr_delete_inode
BUG:
KASAN
: slab-
use
-
after
-
free
in jffs2_xattr_delete_inode+0x2c8/0x2d0 fs/jffs2/xattr.c:602 Read of size 4 at addr ffff888029725ee8 by task syz.8.1428/17657 CPU: 0 UID:
Aug 12
syzbot
2
Aug 13
[syzbot] [serial?] KASAN: slab-use-after-free Write in release_tty
BUG:
KASAN
: slab-
use
-
after
-
free
in release_tty+0x5a8/0x5f0 drivers/tty/tty_io.c:1584 Write of size 8 at addr ffff88803487f128 by task syz.4.4594/23193 CPU: 0 UID: 0 PID: 23193
unread,
[syzbot] [serial?] KASAN: slab-use-after-free Write in release_tty
BUG:
KASAN
: slab-
use
-
after
-
free
in release_tty+0x5a8/0x5f0 drivers/tty/tty_io.c:1584 Write of size 8 at addr ffff88803487f128 by task syz.4.4594/23193 CPU: 0 UID: 0 PID: 23193
Aug 13
syzbot
2
Aug 10
[syzbot] [net?] [afs?] KASAN: slab-use-after-free Read in rxrpc_destroy_all_peers
BUG:
KASAN
: slab-
use
-
after
-
free
in rxrpc_destroy_all_peers+0x1ce/0x1d0 net/rxrpc/peer_object.c:461 Read of size 8 at addr ffff888054f70c20 by task kworker/u8:3/48 CPU:
unread,
[syzbot] [net?] [afs?] KASAN: slab-use-after-free Read in rxrpc_destroy_all_peers
BUG:
KASAN
: slab-
use
-
after
-
free
in rxrpc_destroy_all_peers+0x1ce/0x1d0 net/rxrpc/peer_object.c:461 Read of size 8 at addr ffff888054f70c20 by task kworker/u8:3/48 CPU:
Aug 10
syzbot
2
Aug 5
[syzbot] [usb?] KASAN: slab-use-after-free Write in gadgetfs_kill_sb
BUG:
KASAN
: slab-
use
-
after
-
free
in instrument_atomic_read_write include/linux/instrumented.h:112 [inline] BUG:
KASAN
: slab-
use
-
after
-
free
in atomic_fetch_sub_release
unread,
[syzbot] [usb?] KASAN: slab-use-after-free Write in gadgetfs_kill_sb
BUG:
KASAN
: slab-
use
-
after
-
free
in instrument_atomic_read_write include/linux/instrumented.h:112 [inline] BUG:
KASAN
: slab-
use
-
after
-
free
in atomic_fetch_sub_release
Aug 5
syzbot
,
Hillf Danton
4
Aug 14
[syzbot] [sound?] KASAN: use-after-free Read in release_card_device
BUG:
KASAN
:
use
-
after
-
free
in snd_card_do_free sound/core/init.c:604 [inline] BUG:
KASAN
:
use
-
after
-
free
in release_card_device+0x17d/0x1a0 sound/core/init.c:153 Read
unread,
[syzbot] [sound?] KASAN: use-after-free Read in release_card_device
BUG:
KASAN
:
use
-
after
-
free
in snd_card_do_free sound/core/init.c:604 [inline] BUG:
KASAN
:
use
-
after
-
free
in release_card_device+0x17d/0x1a0 sound/core/init.c:153 Read
Aug 14
syzbot
2
Aug 1
[syzbot] [usb?] WARNING in dummy_free_request (2)
:540
task_work_run
+0x1cc/0x25c kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry
unread,
[syzbot] [usb?] WARNING in dummy_free_request (2)
:540
task_work_run
+0x1cc/0x25c kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry
Aug 1
syzbot
7
Aug 4
[syzbot] [usb?] KASAN: slab-use-after-free Write in put_dev
BUG:
KASAN
: slab-
use
-
after
-
free
in instrument_atomic_read_write include/linux/instrumented.h:112 [inline] BUG:
KASAN
: slab-
use
-
after
-
free
in atomic_fetch_sub_release
unread,
[syzbot] [usb?] KASAN: slab-use-after-free Write in put_dev
BUG:
KASAN
: slab-
use
-
after
-
free
in instrument_atomic_read_write include/linux/instrumented.h:112 [inline] BUG:
KASAN
: slab-
use
-
after
-
free
in atomic_fetch_sub_release
Aug 4
syzbot
Jul 31
[syzbot] [fs?] KASAN: slab-use-after-free Read in filp_flush
BUG:
KASAN
: slab-
use
-
after
-
free
in instrument_atomic_read include/linux/instrumented.h:82 [inline] BUG:
KASAN
: slab-
use
-
after
-
free
in atomic_long_read include/linux
unread,
[syzbot] [fs?] KASAN: slab-use-after-free Read in filp_flush
BUG:
KASAN
: slab-
use
-
after
-
free
in instrument_atomic_read include/linux/instrumented.h:82 [inline] BUG:
KASAN
: slab-
use
-
after
-
free
in atomic_long_read include/linux
Jul 31
syzbot
9
Jul 31
[syzbot] [usb?] KASAN: slab-use-after-free Read in ep_open
issue:
KASAN
: slab-
use
-
after
-
free
Write in ep_open ================================================================== BUG:
KASAN
: slab-
use
-
after
-
free
in instrument_atomic_read_write
unread,
[syzbot] [usb?] KASAN: slab-use-after-free Read in ep_open
issue:
KASAN
: slab-
use
-
after
-
free
Write in ep_open ================================================================== BUG:
KASAN
: slab-
use
-
after
-
free
in instrument_atomic_read_write
Jul 31
syzbot
3
Aug 3
[syzbot] [usb?] KASAN: slab-use-after-free Read in gadget_dev_open
BUG:
KASAN
: slab-
use
-
after
-
free
in __raw_spin_lock_irq include/linux/spinlock_api_smp.h:142 [inline] BUG:
KASAN
: slab-
use
-
after
-
free
in _raw_spin_lock_irq+0x58/0x70
unread,
[syzbot] [usb?] KASAN: slab-use-after-free Read in gadget_dev_open
BUG:
KASAN
: slab-
use
-
after
-
free
in __raw_spin_lock_irq include/linux/spinlock_api_smp.h:142 [inline] BUG:
KASAN
: slab-
use
-
after
-
free
in _raw_spin_lock_irq+0x58/0x70
Aug 3
syzbot
Jul 28
[syzbot] [fs?] [usb?] KASAN: slab-use-after-free Read in lockref_get (2)
BUG:
KASAN
: slab-
use
-
after
-
free
in __raw_spin_lock include/linux/spinlock_api_smp.h:158 [inline] BUG:
KASAN
: slab-
use
-
after
-
free
in _raw_spin_lock+0x2e/0x40 kernel
unread,
[syzbot] [fs?] [usb?] KASAN: slab-use-after-free Read in lockref_get (2)
BUG:
KASAN
: slab-
use
-
after
-
free
in __raw_spin_lock include/linux/spinlock_api_smp.h:158 [inline] BUG:
KASAN
: slab-
use
-
after
-
free
in _raw_spin_lock+0x2e/0x40 kernel
Jul 28
syzbot ci
Jul 6
[syzbot ci] Re: DEPT(DEPendency Tracker)
hotplug:
use
a weaker annotation in AP thread * [PATCH v19 27/40] dept: assign dept map to mmu notifier invalidation synchronization * [PATCH v19 28/40] dept: assign unique dept_key
unread,
[syzbot ci] Re: DEPT(DEPendency Tracker)
hotplug:
use
a weaker annotation in AP thread * [PATCH v19 27/40] dept: assign dept map to mmu notifier invalidation synchronization * [PATCH v19 28/40] dept: assign unique dept_key
Jul 6
syzbot
,
Jie Wang
3
Jun 25
[syzbot] [jfs?] KASAN: slab-use-after-free Write in lmLogSync
BUG:
KASAN
: slab-
use
-
after
-
free
in lmLogSync+0x9a5/0xa40 fs/jfs/jfs_logmgr.c:1003 Write of size 4 at addr ffff888078b39a18 by task jfsCommit/119 CPU: 1 UID: 0 PID: 119 Comm:
unread,
[syzbot] [jfs?] KASAN: slab-use-after-free Write in lmLogSync
BUG:
KASAN
: slab-
use
-
after
-
free
in lmLogSync+0x9a5/0xa40 fs/jfs/jfs_logmgr.c:1003 Write of size 4 at addr ffff888078b39a18 by task jfsCommit/119 CPU: 1 UID: 0 PID: 119 Comm:
Jun 25
syzbot
,
Hillf Danton
2
Jun 20
[syzbot] [bluetooth?] KASAN: slab-use-after-free Write in bt_accept_dequeue
BUG:
KASAN
: slab-
use
-
after
-
free
in instrument_atomic_read_write include/linux/instrumented.h:112 [inline] > BUG:
KASAN
: slab-
use
-
after
-
free
in atomic_fetch_add_relaxed
unread,
[syzbot] [bluetooth?] KASAN: slab-use-after-free Write in bt_accept_dequeue
BUG:
KASAN
: slab-
use
-
after
-
free
in instrument_atomic_read_write include/linux/instrumented.h:112 [inline] > BUG:
KASAN
: slab-
use
-
after
-
free
in atomic_fetch_add_relaxed
Jun 20
syzbot
, …
Jeff Layton
13
Jun 20
[syzbot] [fs?] KASAN: slab-use-after-free Read in shrink_dcache_tree
lock implementation
after
spin_unlock()/completion_done() releases the lock.". Neither of these explicitly guarantees that the RCU read-side critical section (and the
unread,
[syzbot] [fs?] KASAN: slab-use-after-free Read in shrink_dcache_tree
lock implementation
after
spin_unlock()/completion_done() releases the lock.". Neither of these explicitly guarantees that the RCU read-side critical section (and the
Jun 20
syzbot
Jun 2
[syzbot] [btrfs?] KASAN: slab-use-after-free Write in btrfs_put_root
BUG:
KASAN
: slab-
use
-
after
-
free
in instrument_atomic_read_write include/linux/instrumented.h:112 [inline] BUG:
KASAN
: slab-
use
-
after
-
free
in atomic_fetch_sub_release
unread,
[syzbot] [btrfs?] KASAN: slab-use-after-free Write in btrfs_put_root
BUG:
KASAN
: slab-
use
-
after
-
free
in instrument_atomic_read_write include/linux/instrumented.h:112 [inline] BUG:
KASAN
: slab-
use
-
after
-
free
in atomic_fetch_sub_release
Jun 2
syzbot
Jun 1
[syzbot] [serial?] KASAN: slab-use-after-free Read in stop_tty
BUG:
KASAN
: slab-
use
-
after
-
free
in stop_t[ 93.746644][ T5837] BUG:
KASAN
: slab-
use
-
after
-
free
in __stop_tty drivers/tty/tty_io.c:742 [inline] BUG:
KASAN
: slab-
use
-
after
unread,
[syzbot] [serial?] KASAN: slab-use-after-free Read in stop_tty
BUG:
KASAN
: slab-
use
-
after
-
free
in stop_t[ 93.746644][ T5837] BUG:
KASAN
: slab-
use
-
after
-
free
in __stop_tty drivers/tty/tty_io.c:742 [inline] BUG:
KASAN
: slab-
use
-
after
Jun 1
syzbot
,
Hillf Danton
5
2:43 AM
[syzbot] [net?] KASAN: use-after-free Read in filemap_map_pages
BUG:
KASAN
:
use
-
after
-
free
in ptep_get include/linux/pgtable.h:461 [inline] BUG:
KASAN
:
use
-
after
-
free
in filemap_map_order0_folio mm/filemap.c:3856 [inline] BUG:
KASAN
unread,
[syzbot] [net?] KASAN: use-after-free Read in filemap_map_pages
BUG:
KASAN
:
use
-
after
-
free
in ptep_get include/linux/pgtable.h:461 [inline] BUG:
KASAN
:
use
-
after
-
free
in filemap_map_order0_folio mm/filemap.c:3856 [inline] BUG:
KASAN
2:43 AM
syzbot ci
May 28
[syzbot ci] Re: netlink: fix skb refcount leak when dump start fails
: *
KASAN
: slab-
use
-
after
-
free
Read in nl80211_prepare_wdev_dump *
KASAN
: slab-
use
-
after
-
free
Read in xfrm_dump_sa_done *
KASAN
: slab-
use
-
after
-
free
Write in sk_skb_reason_drop
unread,
[syzbot ci] Re: netlink: fix skb refcount leak when dump start fails
: *
KASAN
: slab-
use
-
after
-
free
Read in nl80211_prepare_wdev_dump *
KASAN
: slab-
use
-
after
-
free
Read in xfrm_dump_sa_done *
KASAN
: slab-
use
-
after
-
free
Write in sk_skb_reason_drop
May 28
syzbot
2
Aug 6
[syzbot] [jfs?] KASAN: slab-use-after-free Read in txLazyUnlock (3)
BUG:
KASAN
: slab-
use
-
after
-
free
in JFS_SBI fs/jfs/jfs_incore.h:217 [inline] BUG:
KASAN
: slab-
use
-
after
-
free
in txLazyUnlock+0xf6/0x190 fs/jfs/jfs_txnmgr.c:2786 Read
unread,
[syzbot] [jfs?] KASAN: slab-use-after-free Read in txLazyUnlock (3)
BUG:
KASAN
: slab-
use
-
after
-
free
in JFS_SBI fs/jfs/jfs_incore.h:217 [inline] BUG:
KASAN
: slab-
use
-
after
-
free
in txLazyUnlock+0xf6/0x190 fs/jfs/jfs_txnmgr.c:2786 Read
Aug 6
syzbot
, …
Christian Brauner
12
Jun 4
[syzbot] [fs?] KASAN: slab-use-after-free Read in reverse_path_check_proc
BUG:
KASAN
: slab-
use
-
after
-
free
in reverse_path_check_proc+0x5b/0x240 fs/eventpoll.c:1663 Read of size 8 at addr ffff88803777f7e0 by task syz.3.20/6001 CPU: 0 UID: 0 PID: 6001
unread,
[syzbot] [fs?] KASAN: slab-use-after-free Read in reverse_path_check_proc
BUG:
KASAN
: slab-
use
-
after
-
free
in reverse_path_check_proc+0x5b/0x240 fs/eventpoll.c:1663 Read of size 8 at addr ffff88803777f7e0 by task syz.3.20/6001 CPU: 0 UID: 0 PID: 6001
Jun 4
syzbot
May 22
[syzbot] [sound?] KASAN: slab-use-after-free Read in snd_pcm_oss_look_for_setup (2)
BUG:
KASAN
: slab-
use
-
after
-
free
in snd_pcm_oss_look_for_setup+0x2d3/0x370 sound/core/oss/pcm_oss.c:2355 Read of size 8 at addr ffff888022f56d00 by task syz.1.988/10837
unread,
[syzbot] [sound?] KASAN: slab-use-after-free Read in snd_pcm_oss_look_for_setup (2)
BUG:
KASAN
: slab-
use
-
after
-
free
in snd_pcm_oss_look_for_setup+0x2d3/0x370 sound/core/oss/pcm_oss.c:2355 Read of size 8 at addr ffff888022f56d00 by task syz.1.988/10837
May 22
syzbot
,
Philipp Weber
4
May 20
[syzbot] [bluetooth?] KASAN: slab-use-after-free Read in skb_dequeue (2)
BUG:
KASAN
: slab-
use
-
after
-
free
in __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:132 [inline] BUG:
KASAN
: slab-
use
-
after
-
free
in _raw_spin_lock_irqsave
unread,
[syzbot] [bluetooth?] KASAN: slab-use-after-free Read in skb_dequeue (2)
BUG:
KASAN
: slab-
use
-
after
-
free
in __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:132 [inline] BUG:
KASAN
: slab-
use
-
after
-
free
in _raw_spin_lock_irqsave
May 20
syzbot
, …
Dave Kleikamp
13
Aug 3
[syzbot] KASAN: use-after-free Read in jfs_lazycommit
?]
KASAN
:
use
-
after
-
free
Read in jfs_lazycommit Author: kapoorarnav43@gmail.com #syz fix From 7e1a0b91e9efa8bec40fc5397ba6c4e683d72df0 Mon Sep 17 00:00:00 2001 From: ArnavKapoor
unread,
[syzbot] KASAN: use-after-free Read in jfs_lazycommit
?]
KASAN
:
use
-
after
-
free
Read in jfs_lazycommit Author: kapoorarnav43@gmail.com #syz fix From 7e1a0b91e9efa8bec40fc5397ba6c4e683d72df0 Mon Sep 17 00:00:00 2001 From: ArnavKapoor
Aug 3
syzbot
4
May 6
Re: [syzbot] [jfs?] KASAN: use-after-free Read in jfs_lazycommit
issue:
KASAN
: slab-
use
-
after
-
free
Read in blk_update_request ================================================================== BUG:
KASAN
: slab-
use
-
after
-
free
in
unread,
Re: [syzbot] [jfs?] KASAN: use-after-free Read in jfs_lazycommit
issue:
KASAN
: slab-
use
-
after
-
free
Read in blk_update_request ================================================================== BUG:
KASAN
: slab-
use
-
after
-
free
in
May 6
syzbot
15
Jun 9
[syzbot] [mm?] KASAN: use-after-free Read in copy_folio_from_iter_atomic (2)
issue:
KASAN
: slab-
use
-
after
-
free
Read in blk_update_request ================================================================== BUG:
KASAN
: slab-
use
-
after
-
free
in
unread,
[syzbot] [mm?] KASAN: use-after-free Read in copy_folio_from_iter_atomic (2)
issue:
KASAN
: slab-
use
-
after
-
free
Read in blk_update_request ================================================================== BUG:
KASAN
: slab-
use
-
after
-
free
in
Jun 9
syzbot ci
Apr 24
[syzbot ci] Re: netlink: clean up failed initial dump-start state
: *
KASAN
: slab-
use
-
after
-
free
Read in inet_diag_dump_done *
KASAN
: slab-
use
-
after
-
free
Read in netlink_dump_done *
KASAN
: slab-
use
-
after
-
free
Read in netlink_rcv_skb *
KASAN
unread,
[syzbot ci] Re: netlink: clean up failed initial dump-start state
: *
KASAN
: slab-
use
-
after
-
free
Read in inet_diag_dump_done *
KASAN
: slab-
use
-
after
-
free
Read in netlink_dump_done *
KASAN
: slab-
use
-
after
-
free
Read in netlink_rcv_skb *
KASAN
Apr 24
syzbot ci
,
Jan Kara
2
Apr 23
[syzbot ci] Re: fs: Handle multiply claimed blocks more gracefully with mmb
: >
KASAN
: slab-
use
-
after
-
free
Read in remove_assoc_queue > > Full report is available here: > https://ci.syzbot.org/series/3ac1baf5-8cbb-4927-a4b1-c051f76ce076
unread,
[syzbot ci] Re: fs: Handle multiply claimed blocks more gracefully with mmb
: >
KASAN
: slab-
use
-
after
-
free
Read in remove_assoc_queue > > Full report is available here: > https://ci.syzbot.org/series/3ac1baf5-8cbb-4927-a4b1-c051f76ce076
Apr 23
syzbot
Apr 22
[syzbot] [bluetooth] KASAN: slab-use-after-free Read in process_one_work (2)
BUG:
KASAN
: slab-
use
-
after
-
free
in __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:132 [inline] BUG:
KASAN
: slab-
use
-
after
-
free
in _raw_spin_lock_irqsave
unread,
[syzbot] [bluetooth] KASAN: slab-use-after-free Read in process_one_work (2)
BUG:
KASAN
: slab-
use
-
after
-
free
in __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:132 [inline] BUG:
KASAN
: slab-
use
-
after
-
free
in _raw_spin_lock_irqsave
Apr 22
