Re: [syzbot] [bluetooth?] KASAN: null-ptr-deref Read in ida_free (4)

Re: [syzbot] [bluetooth?] KASAN: null-ptr-deref Read in ida_free (4)

[syzbot]

syzbot has bisected this issue to:

commit 181a42edddf51d5d9697ecdf365d72ebeab5afb0
Author: Ziyang Xuan <william.xuanziyang@huawei.com>
Date:   Wed Oct 11 09:57:31 2023 +0000

    Bluetooth: Make handle of hci_conn be unique

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=1345177ce80000
start commit:   8c9660f65153 Add linux-next specific files for 20231124
git tree:       linux-next
final oops:     https://syzkaller.appspot.com/x/report.txt?x=10c5177ce80000
console output: https://syzkaller.appspot.com/x/log.txt?x=1745177ce80000
kernel config:  https://syzkaller.appspot.com/x/.config?x=ca1e8655505e280
dashboard link: https://syzkaller.appspot.com/bug?extid=51baee846ddab52d5230
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=10d54c08e80000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=160ef1a4e80000

Reported-by: syzbot+51baee846ddab52d5230@syzkaller.appspotmail.com
Fixes: 181a42edddf5 ("Bluetooth: Make handle of hci_conn be unique")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

Re: [syzbot] [bluetooth?] KASAN: null-ptr-deref Read in ida_free (4)

[syzbot]

syzbot suspects this issue was fixed by commit:

commit af73483f4e8b6f5c68c9aa63257bdd929a9c194a
Author: Matthew Wilcox (Oracle) <willy@infradead.org>
Date:   Thu Dec 21 16:53:57 2023 +0000

    ida: Fix crash in ida_free when the bitmap is empty

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=12fc6ba2180000
start commit:   b46ae77f6787 Merge tag 'xfs-6.7-fixes-3' of git://git.kern..
git tree:       upstream
kernel config:  https://syzkaller.appspot.com/x/.config?x=6ae1a4ee971a7305
dashboard link: https://syzkaller.appspot.com/bug?extid=51baee846ddab52d5230
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=127837cce80000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=12779dc8e80000

If the result looks correct, please mark the issue as fixed by replying with:

#syz fix: ida: Fix crash in ida_free when the bitmap is empty

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

Re: [syzbot] [bluetooth?] KASAN: null-ptr-deref Read in ida_free (4)

[Aleksandr Nogikh]

Looks reasonable, judging by the commit title.

#syz fix: ida: Fix crash in ida_free when the bitmap is empty


On Sun, Feb 11, 2024 at 10:55 AM syzbot
<syzbot+51baee846ddab52d5230@syzkaller.appspotmail.com> wrote:
>
> syzbot suspects this issue was fixed by commit:
>
> commit af73483f4e8b6f5c68c9aa63257bdd929a9c194a
> Author: Matthew Wilcox (Oracle) <willy@infradead.org>
> Date:   Thu Dec 21 16:53:57 2023 +0000
>
>     ida: Fix crash in ida_free when the bitmap is empty
>
> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=12fc6ba2180000
> start commit:   b46ae77f6787 Merge tag 'xfs-6.7-fixes-3' of git://git.kern..
> git tree:       upstream
> kernel config:  https://syzkaller.appspot.com/x/.config?x=6ae1a4ee971a7305
> dashboard link: https://syzkaller.appspot.com/bug?extid=51baee846ddab52d5230
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=127837cce80000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=12779dc8e80000
>
> If the result looks correct, please mark the issue as fixed by replying with:
>
> #syz fix: ida: Fix crash in ida_free when the bitmap is empty
>
> For information about bisection process see: https://goo.gl/tpsmEJ#bisection
>
> --
> You received this message because you are subscribed to the Google Groups "syzkaller-bugs" group.
> To unsubscribe from this group and stop receiving emails from it, send an email to syzkaller-bugs+unsubscribe@googlegroups.com.
> To view this discussion on the web visit https://groups.google.com/d/msgid/syzkaller-bugs/000000000000d4a29506111827e7%40google.com.