[BUG] nvmet-fc: KASAN: slab-use-after-free in nvmet_fc_handle_ls_rqst_work

[BUG] nvmet-fc: KASAN: slab-use-after-free in nvmet_fc_handle_ls_rqst_work

[Shuangpeng Bai]

Hi Kernel Maintainers,

I hit the following report while testing current upstream kernel:

KASAN: slab-use-after-free in nvmet_fc_handle_ls_rqst_work

on commit: 0d6269a4f6059d185d9f7e3efe7b58f8c0d9faf3 (2026-07-27)

To help trigger the bug more reliably, we applied a minimal diagnostic patch
that only adds a delay and a printk.

The reproducer and .config files are here.
https://gist.github.com/shuangpengbai/47cf6fb1b80e28f3c30a372333d1151e

I'm happy to test debug patches or provide additional information.

Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>

[  405.999314][ T1167] BUG: KASAN: slab-use-after-free in nvmet_fc_handle_ls_rqst_work (drivers/nvme/target/fc.c:193 drivers/nvme/target/fc.c:1841 drivers/nvme/target/fc.c:1995 drivers/nvme/target/fc.c:2021)
[  406.000605][ T1167] Read of size 8 at addr ffff888179f1b000 by task kworker/u9:2/1167
[  406.001734][ T1167]
[  406.002128][ T1167] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  406.002134][ T1167] Workqueue: nvmet-wq nvmet_fc_handle_ls_rqst_work
[  406.002165][ T1167] Call Trace:
[  406.002182][ T1167]  <TASK>
[  406.002187][ T1167]  dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
[  406.002201][ T1167]  print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
[  406.002220][ T1167]  kasan_report (mm/kasan/report.c:595)
[  406.002232][ T1167]  nvmet_fc_handle_ls_rqst_work (drivers/nvme/target/fc.c:193 drivers/nvme/target/fc.c:1841 drivers/nvme/target/fc.c:1995 drivers/nvme/target/fc.c:2021)
[  406.002238][ T1167]  process_scheduled_works (kernel/workqueue.c:3322 kernel/workqueue.c:3405)
[  406.002250][ T1167]  worker_thread (kernel/workqueue.c:3486)
[  406.002280][ T1167]  kthread (kernel/kthread.c:436)
[  406.002296][ T1167]  ret_from_fork (archkernel/process.c:158)
[  406.002320][ T1167]  ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
[  406.002328][ T1167]  </TASK>
[  406.002330][ T1167]
[  406.020787][ T1167] Freed by task 1167 on cpu 0 at 405.998150s:
[  406.021660][ T1167]  kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78)
[  406.022343][ T1167]  kasan_save_free_info (mm/kasan/generic.c:584)
[  406.023069][ T1167]  __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)
[  406.023749][ T1167]  kfree (include/linux/kasan.h:235 mm/slub.c:2705 mm/slub.c:6405 mm/slub.c:6720)
[  406.024312][ T1167]  nvmet_fc_handle_ls_rqst_work (drivers/nvme/target/fc.c:1808 drivers/nvme/target/fc.c:1995 drivers/nvme/target/fc.c:2021)
[  406.025172][ T1167]  process_scheduled_works (kernel/workqueue.c:3322 kernel/workqueue.c:3405)
[  406.025972][ T1167]  worker_thread (kernel/workqueue.c:3486)
[  406.026653][ T1167]  kthread (kernel/kthread.c:436)
[  406.027248][ T1167]  ret_from_fork (archkernel/process.c:158)
[  406.027931][ T1167]  ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
[  406.028638][ T1167]
[  406.028989][ T1167] The buggy address belongs to the object at ffff888179f1b000
[  406.028989][ T1167]  which belongs to the cache kmalloc-2k of size 2048
[  406.031005][ T1167] The buggy address is located 0 bytes inside of
[  406.031005][ T1167]  freed 2048-byte region [ffff888179f1b000, ffff888179f1b800)


Best,
Shuangpeng