Re: KASAN: use-after-free Read in ep_scan_ready_list

From: syzbot
Date: Fri Nov 08 2019 - 14:24:14 EST


syzbot suspects this bug was fixed by commit:

commit 430ac66eb4c5b5c4eb846b78ebf65747510b30f1
Author: Tomas Bortoli <tomasbortoli@xxxxxxxxx>
Date: Fri Jul 20 09:27:30 2018 +0000

net/9p/trans_fd.c: fix race-condition by flushing workqueue before the kfree()

bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=167fa19ae00000
start commit: 1e09177a Merge tag 'mips_fixes_4.18_3' of git://git.kernel..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=25856fac4e580aa7
dashboard link: https://syzkaller.appspot.com/bug?extid=78b902c73c69102cb767
userspace arch: i386
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=135660c8400000

If the result looks correct, please mark the bug fixed by replying with:

#syz fix: net/9p/trans_fd.c: fix race-condition by flushing workqueue before the kfree()

For information about bisection process see: https://goo.gl/tpsmEJ#bisection