Re: [syzbot] KASAN: use-after-free Read in __crypto_xor

On Thu, Sep 02, 2021 at 04:36:25PM -0700, syzbot wrote:

Hello,

syzbot found the following issue on:

HEAD commit:    3e12361b6d23 bcm63xx_enet: delete a redundant assignment
git tree:       net-next
console output: https://syzkaller.appspot.com/x/log.txt?x=160cec72300000
kernel config:  https://syzkaller.appspot.com/x/.config?x=63a23a80f42a8989
dashboard link: https://syzkaller.appspot.com/bug?extid=b187b77c8474f9648fae
compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.1
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=144d07b6300000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=171b7fca300000

The issue was bisected to:

commit 4611ce22468895acd61fee9ac1da810d60617d9a
Author: Daniel Jordan [off-list ref]
Date:   Wed Jun 3 22:59:39 2020 +0000

    padata: allocate work structures for parallel jobs from a pool

bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=118dccae300000
console output: https://syzkaller.appspot.com/x/log.txt?x=158dccae300000

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b187b77c8474f9648fae@syzkaller.appspotmail.com
Fixes: 4611ce224688 ("padata: allocate work structures for parallel jobs from a pool")

==================================================================
BUG: KASAN: use-after-free in __crypto_xor+0x376/0x410 crypto/algapi.c:1001
Read of size 8 at addr ffff88803691a000 by task kworker/u4:1/10

The reproducer hasn't tripped over this yet, but I'll keep trying.