On Wed, Mar 16, 2022 at 12:45 AM Dmitry Vyukov <dvyukov@xxxxxxxxxx> wrote:
>
> But the bug looks to be fixed by something anyway. git log on the file
> pretty clearly points to:
>
> #syz fix: ath9k: Fix out-of-bound memcpy in ath9k_hif_usb_rx_stream
Yeah, that commit 6ce708f54cc8 looks a lot more likely to have any
effect on this than my version bump that the syzbot bisection pointed
to.
But kernels containing that commit still have that
run #0: crashed: KASAN: use-after-free Read in ath9k_hif_usb_rx_cb
so apparently it isn't actually fully fixed. ;(
Linus
