Messages in this thread | | | From | Dmitry Vyukov <> | Date | Wed, 16 Mar 2022 08:45:28 +0100 | Subject | Re: [syzbot] KASAN: out-of-bounds Read in ath9k_hif_usb_rx_cb (3) |
| |
On Tue, 15 Mar 2022 at 18:08, Linus Torvalds <torvalds@linux-foundation.org> wrote: > > On Tue, Mar 15, 2022 at 2:36 AM syzbot > <syzbot+3f1ca6a6fec34d601788@syzkaller.appspotmail.com> wrote: > > > > syzbot suspects this issue was fixed by commit > > 09688c0166e7 ("Linux 5.17-rc8") > > No, I'm afraid that means that the bisection is broken: > > > bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=140283ad700000 > > and yeah, looking at that log it looks like every single run has > > testing commit [...] > run #0: crashed: KASAN: use-after-free Read in ath9k_hif_usb_rx_cb > ... > # git bisect good [...] > > and you never saw a "bad" commit that didn't have the issue, so the > top-of-tree gets marked "good" (and I suspect you intentionally mark > the broken case "good" in order to find where it got fixed, so you're > using "git bisect" in a reverse way). > > I didn't look closer, but it does seem to not reproduce very reliably, > maybe that is what confused the bot originally.
Hi Linus,
Thanks for taking a look. Yes, it's a "reverse" bisection that tries to find the fix. And your conclusion re flakiness looks right, there were few runs with only 1/20 crashes. But the bug looks to be fixed by something anyway. git log on the file pretty clearly points to:
#syz fix: ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream
| |