Re: KASAN: use-after-free Write in hci_sock_release

On Fri, Mar 22, 2019 at 5:19 AM Dmitry Vyukov [off-list ref] wrote:

On Fri, Mar 22, 2019 at 1:04 PM syzbot
[off-list ref] wrote:

quoted

syzbot has bisected this bug to:

commit c470abd4fde40ea6a0846a2beab642a578c0b8cd
Author: Linus Torvalds [off-list ref]
Date:   Sun Feb 19 22:34:00 2017 +0000

     Linux 4.10

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=1664c6df200000
start commit:   c470abd4 Linux 4.10
git tree:       upstream
kernel config:  https://syzkaller.appspot.com/x/.config?x=7308e68273924137
dashboard link: https://syzkaller.appspot.com/bug?extid=b364ed862aa07c74bc62
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=152532bb400000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=13f73320c00000

Reported-by: syzbot+b364ed862aa07c74bc62@syzkaller.appspotmail.com
Fixes: c470abd4fde4 ("Linux 4.10")

For information about bisection process see: https://goo.gl/tpsmEJ#bisection

The same story of HCI being broken before v4.10, so this is bisected
to the release.

Does syzbot test the latest upstream? Isn't this supposed to be fixed by

commit e20a2e9c42c9e4002d9e338d74e7819e88d77162
Author: Myungho Jung [off-list ref]
Date:   Sat Feb 2 16:56:36 2019 -0800

    Bluetooth: Fix decrementing reference count twice in releasing socket

?