Re: [syzbot] [usb?] [media?] KASAN: use-after-free Read in em28xx_init_extension (2)

Alan Stern
2025-05-13T15:11:20Z

On Tue, May 13, 2025 at 08:02:01AM -0700, syzbot wrote:
> syzbot has bisected this issue to:
>
> commit a368ecde8a5055b627749b09c6218ef793043e47
> Author: Alan Stern <stern@rowland.harvard.edu>
> Date: Thu Jun 27 19:56:18 2024 +0000
>
> USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor
>
> bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=12cf6cd4580000
> start commit: cd802e7e5f1e Merge tag 'for-linus' of git://git.kernel.org..
> git tree: upstream
> final oops: https://syzkaller.appspot.com/x/report.txt?x=11cf6cd4580000
> console output: https://syzkaller.appspot.com/x/log.txt?x=16cf6cd4580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=91c351a0f6229e67
> dashboard link: https://syzkaller.appspot.com/bug?extid=99d6c66dbbc484f50e1c
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=143a7768580000
>
> Reported-by: syzbot+99d6c66dbbc484f50e1c@syzkaller.appspotmail.com
> Fixes: a368ecde8a50 ("USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor")
>
> For information about bisection process see: https://goo.gl/tpsmEJ#bisection

Clearly a ridiculous claim. Maybe the bug fixed by that commit covered
up the actual cause of this problem.

Alan Stern