Re: [syzbot] [mmc?] KASAN: slab-use-after-free Write in ms_read_bytes

[syzbot <syzbot+ccffdf05833ebdaeae70@syzkaller.appspotmail.com>]

> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git

This crash does not have a reproducer. I cannot test it.

> master
>
> diff --git a/drivers/memstick/core/memstick.c b/drivers/memstick/core/memstick.c
> index 7f3f47db4c98..1a2b3c4d5e6f 100644
> --- a/drivers/memstick/core/memstick.c
> +++ b/drivers/memstick/core/memstick.c
> @@ -378,9 +378,7 @@ int memstick_set_rw_addr(struct memstick_dev *card)
>  {
>   card->next_request = h_memstick_set_rw_addr;
>   memstick_new_req(card->host);
> - if (!wait_for_completion_timeout(&card->mrq_complete,
> - msecs_to_jiffies(500)))
> - card->current_mrq.error = -ETIMEDOUT;
> + wait_for_completion(&card->mrq_complete);
>
>   return card->current_mrq.error;
>  }
> @@ -413,9 +411,7 @@ static struct memstick_dev
> *memstick_alloc_card(struct memstick_host *host)
>   goto err_out;
>
>   card->next_request = h_memstick_read_dev_id;
>   memstick_new_req(host);
> - if (!wait_for_completion_timeout(&card->mrq_complete,
> - msecs_to_jiffies(500)))
> - card->current_mrq.error = -ETIMEDOUT;
> + wait_for_completion(&card->mrq_complete);
>
>   if (card->current_mrq.error)
>   goto err_out;