From: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
To: Jaroslav Kysela <perex@perex.cz>, Takashi Iwai <tiwai@suse.com>
Cc: Shuangpeng Bai <shuangpeng.kernel@gmail.com>,
Kees Cook <kees@kernel.org>,
linux-sound@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [BUG] ALSA: usb: 6fire: KASAN slab-use-after-free in dummy_timer
Date: Thu, 23 Jul 2026 23:07:50 -0400 [thread overview]
Message-ID: <20260724030900.1984491-1-shuangpeng.kernel@gmail.com> (raw)
Hi Kernel Maintainers,
I hit the following report while testing current upstream kernel:
KASAN: slab-use-after-free in dummy_timer
on commit: fce2dfa773ced15f27dd27cd0b482a7473cdcf2a (2026-07-16)
The reproducer and .config files are here.
https://gist.github.com/shuangpengbai/a410bc05b4f22d1ba4ce7ef059043fea
I'm happy to test debug patches or provide additional information.
Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
[ 400.891255][ C0] BUG: KASAN: slab-use-after-free in dummy_timer (drivers/usb/common/usb-otg-fsm.c:393)
[ 400.891273][ C0] Read of size 4 at addr ffff8881789bc20c by task kworker/0:2/773
[ 400.891276][ C0]
[ 400.891291][ C0] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 400.891294][ C0] Workqueue: usb_hub_wq hub_event
[ 400.891299][ C0] Call Trace:
[ 400.891301][ C0] <IRQ>
[ 400.891302][ C0] dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
[ 400.891306][ C0] print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
[ 400.891322][ C0] kasan_report (mm/kasan/report.c:595)
[ 400.891330][ C0] dummy_timer (drivers/usb/common/usb-otg-fsm.c:393)
[ 400.891397][ C0] __hrtimer_run_queues (kernel/time/hrtimer.c:2032 kernel/time/hrtimer.c:2096)
[ 400.891403][ C0] hrtimer_run_softirq (kernel/time/hrtimer.c:2113)
[ 400.891414][ C0] handle_softirqs (kernel/softirq.c:622)
[ 400.891420][ C0] __irq_exit_rcu (kernel/softirq.c:656 kernel/softirq.c:496 kernel/softirq.c:735)
[ 400.891423][ C0] sysvec_apic_timer_interrupt (arch/x86/kernel/apic/apic.c:1062 arch/x86/kernel/apic/apic.c:1062)
[ 400.891427][ C0] </IRQ>
[ 400.891428][ C0] <TASK>
[ 400.891579][ C0] really_probe (drivers/base/dd.c:644 drivers/base/dd.c:706)
[ 400.891582][ C0] __driver_probe_device (drivers/base/dd.c:868)
[ 400.891585][ C0] driver_probe_device (drivers/base/dd.c:898)
[ 400.891588][ C0] __device_attach_driver (drivers/base/dd.c:1026)
[ 400.891593][ C0] bus_for_each_drv (drivers/base/bus.c:500)
[ 400.891615][ C0] __device_attach (drivers/base/dd.c:1098)
[ 400.891631][ C0] device_initial_probe (drivers/base/dd.c:1153)
[ 400.891634][ C0] bus_probe_device (drivers/base/bus.c:620)
[ 400.891637][ C0] device_add (drivers/base/core.c:3772)
[ 400.891641][ C0] usb_set_configuration (drivers/usb/core/message.c:2268)
[ 400.891647][ C0] usb_generic_driver_probe (drivers/usb/core/generic.c:250)
[ 400.891651][ C0] usb_probe_device (drivers/usb/core/driver.c:291)
[ 400.891653][ C0] really_probe (drivers/base/dd.c:? drivers/base/dd.c:706)
[ 400.891656][ C0] __driver_probe_device (drivers/base/dd.c:868)
[ 400.891663][ C0] driver_probe_device (drivers/base/dd.c:898)
[ 400.891665][ C0] __device_attach_driver (drivers/base/dd.c:1026)
[ 400.891671][ C0] bus_for_each_drv (drivers/base/bus.c:500)
[ 400.891685][ C0] __device_attach (drivers/base/dd.c:1098)
[ 400.891704][ C0] device_initial_probe (drivers/base/dd.c:1153)
[ 400.891707][ C0] bus_probe_device (drivers/base/bus.c:620)
[ 400.891710][ C0] device_add (drivers/base/core.c:3772)
[ 400.891714][ C0] usb_new_device (drivers/usb/core/hub.c:2695)
[ 400.891726][ C0] hub_event (drivers/usb/core/hub.c:5567 drivers/usb/core/hub.c:5707 drivers/usb/core/hub.c:5871 drivers/usb/core/hub.c:5953)
[ 400.891743][ C0] process_scheduled_works (kernel/workqueue.c:3322 kernel/workqueue.c:3405)
[ 400.891748][ C0] worker_thread (kernel/workqueue.c:3486)
[ 400.891756][ C0] kthread (kernel/kthread.c:436)
[ 400.891764][ C0] ret_from_fork (arch/x86/kernel/process.c:158)
[ 400.891790][ C0] ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
[ 400.891795][ C0] </TASK>
[ 400.891797][ C0] Freed by task 773 on cpu 0 at 400.890164s:
[ 400.891805][ C0] kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78)
[ 400.891813][ C0] kasan_save_free_info (mm/kasan/generic.c:584)
[ 400.891821][ C0] __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)
[ 400.891824][ C0] kfree (./include/linux/kasan.h:235 mm/slub.c:2705 mm/slub.c:6405 mm/slub.c:6720)
[ 400.891827][ C0] usb6fire_comm_destroy (sound/usb/6fire/comm.c:197)
[ 400.891830][ C0] usb6fire_card_free (sound/usb/6fire/chip.c:65)
[ 400.891832][ C0] release_card_device (sound/core/init.c:594 sound/core/init.c:153)
[ 400.891852][ C0] kobject_put (lib/kobject.c:689 lib/kobject.c:720 ./include/linux/kref.h:65 lib/kobject.c:737)
[ 400.891855][ C0] snd_card_free (sound/core/init.c:626 sound/core/init.c:658)
[ 400.891858][ C0] usb6fire_chip_probe (sound/usb/6fire/chip.c:153)
[ 400.891860][ C0] usb_probe_interface (drivers/usb/core/driver.c:396)
Best,
Shuangpeng
next reply other threads:[~2026-07-24 3:09 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-24 3:07 Shuangpeng Bai [this message]
2026-07-24 7:45 ` [BUG] ALSA: usb: 6fire: KASAN slab-use-after-free in dummy_timer Takashi Iwai
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260724030900.1984491-1-shuangpeng.kernel@gmail.com \
--to=shuangpeng.kernel@gmail.com \
--cc=kees@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-sound@vger.kernel.org \
--cc=perex@perex.cz \
--cc=tiwai@suse.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.