Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Thu, 28 Jul 2022 08:52:26 +0200
From:   Greg KH <gregkh@linuxfoundation.org>
To:     Dipanjan Das <mail.dipanjan.das@gmail.com>
Cc:     dhowells@redhat.com, sashal@kernel.org, fmdefrancesco@gmail.com,
        edumazet@google.com, linux-kernel@vger.kernel.org,
        syzkaller@googlegroups.com, fleischermarius@googlemail.com,
        its.priyanka.bose@gmail.com
Subject: Re: KASAN: use-after-free Read in post_one_notification
Message-ID: <YuIyKjvQ0vOeRWhl@kroah.com>
References: <CANX2M5bHye2ZEEhEV6PUj1kYL2KdWYeJtgXw8KZRzwrNpLYz+A@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CANX2M5bHye2ZEEhEV6PUj1kYL2KdWYeJtgXw8KZRzwrNpLYz+A@mail.gmail.com>
Precedence: bulk

On Wed, Jul 27, 2022 at 02:28:45PM -0700, Dipanjan Das wrote:
> Hi,
> 
> We would like to report the following bug which has been found by our
> modified version of syzkaller.
> 
> ======================================================
> description: KASAN: use-after-free Read in post_one_notification
> affected file: kernel/watch_queue.c
> kernel version: 5.10.131
> kernel commit: 8f95261a006489c828f1d909355669875649668b
> git tree: upstream
> kernel config: https://syzkaller.appspot.com/x/.config?x=e49433cfed49b7d9
> crash reproducer: attached
> patch: This bug was previously reported by syzkaller for kernel
> version 5.17. The same patch works for kernel version 5.10 as well,
> i.e., we tested that the repro can no longer triggers the reported
> crash with this patch:
> https://syzkaller.appspot.com/text?tag=Patch&x=13b8c83c080000

I'm sorry, I do not understand.  So this is fixed in Linus's tree?  But
not in 5.10.y?  Or it is not fixed everywhere?

If it is fixed, what is the git commit id of the patch in Linus's tree
that fixes this that should be backported to 5.10.y?

confused,

greg k-h