linux-kernel - Re: [syzbot] [usb?] [media?] KASAN: use-after-free Read in em28xx_init

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <68235ee9.050a0220.f2294.09fc.GAE@google.com>
Date: Tue, 13 May 2025 08:02:01 -0700
From: syzbot <syzbot+99d6c66dbbc484f50e1c@...kaller.appspotmail.com>
To: gregkh@...uxfoundation.org, hdanton@...a.com, linux-kernel@...r.kernel.org, 
	linux-media@...r.kernel.org, linux-usb@...r.kernel.org, mchehab@...nel.org, 
	paskripkin@...il.com, stern@...land.harvard.edu, 
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [usb?] [media?] KASAN: use-after-free Read in
 em28xx_init_extension (2)

syzbot has bisected this issue to:

commit a368ecde8a5055b627749b09c6218ef793043e47
Author: Alan Stern <stern@...land.harvard.edu>
Date:   Thu Jun 27 19:56:18 2024 +0000

    USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=12cf6cd4580000
start commit:   cd802e7e5f1e Merge tag 'for-linus' of git://git.kernel.org..
git tree:       upstream
final oops:     https://syzkaller.appspot.com/x/report.txt?x=11cf6cd4580000
console output: https://syzkaller.appspot.com/x/log.txt?x=16cf6cd4580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=91c351a0f6229e67
dashboard link: https://syzkaller.appspot.com/bug?extid=99d6c66dbbc484f50e1c
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=143a7768580000

Reported-by: syzbot+99d6c66dbbc484f50e1c@...kaller.appspotmail.com
Fixes: a368ecde8a50 ("USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection