From: sanan.hasanou@gmail.com
To: mchehab@kernel.org, hverkuil+cisco@kernel.org,
laurent.pinchart+renesas@ideasonboard.com, kees@kernel.org,
linux-media@vger.kernel.org, linux-kernel@vger.kernel.org
Cc: syzkaller@googlegroups.com, contact@pgazz.com
Subject: KASAN: slab-use-after-free Read in v4l2_fh_open
Date: Thu, 18 Jun 2026 15:26:59 -0700 (PDT) [thread overview]
Message-ID: <6a3470b3.01a98498.2c3fd5.dec7@mx.google.com> (raw)
Good day, dear maintainers,
We found a bug using a modified version of syzkaller.
Kernel Branch: 7.0-rc1
Kernel Config: <https://drive.google.com/open?id=173DLEAEPKPhhR1TcqofdnkLpdoK7PMFl>
Reproducer: <https://drive.google.com/open?id=1R8QMlaB0Uwrt1BIzqQvRrMo6VYbmX3qK>
Thank you!
Best regards,
Sanan Hasanov
==================================================================
BUG: KASAN: slab-use-after-free in v4l2_fh_init drivers/media/v4l2-core/v4l2-fh.c:25 [inline]
BUG: KASAN: slab-use-after-free in v4l2_fh_open+0x144/0x550 drivers/media/v4l2-core/v4l2-fh.c:64
Read of size 8 at addr ffff8880570245b8 by task v4l_id/31950
CPU: 0 UID: 0 PID: 31950 Comm: v4l_id Not tainted 7.0.0-rc1 #1 PREEMPT(full)
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xcb/0x240 mm/kasan/report.c:482
kasan_report+0x118/0x150 mm/kasan/report.c:595
v4l2_fh_init drivers/media/v4l2-core/v4l2-fh.c:25 [inline]
v4l2_fh_open+0x144/0x550 drivers/media/v4l2-core/v4l2-fh.c:64
em28xx_v4l2_open+0x15a/0x990 drivers/media/usb/em28xx/em28xx-video.c:2153
v4l2_open+0x1bc/0x390 drivers/media/v4l2-core/v4l2-dev.c:433
chrdev_open+0x4cd/0x5e0 fs/char_dev.c:411
do_dentry_open+0x777/0x14d0 fs/open.c:949
vfs_open+0x3d/0x340 fs/open.c:1081
do_open fs/namei.c:4671 [inline]
path_openat+0x2d8a/0x37e0 fs/namei.c:4830
do_file_open+0x208/0x440 fs/namei.c:4859
do_sys_openat2+0x10a/0x1e0 fs/open.c:1366
do_sys_open fs/open.c:1372 [inline]
__do_sys_openat fs/open.c:1388 [inline]
__se_sys_openat fs/open.c:1383 [inline]
__x64_sys_openat+0x13d/0x170 fs/open.c:1383
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x19a/0x7b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x4b/0x53
RIP: 0033:0x7fdfdd774127
Code: 25 00 00 41 00 3d 00 00 41 00 74 47 64 8b 04 25 18 00 00 00 85 c0 75 6b 44 89 e2 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 95 00 00 00 48 8b 4c 24 28 64 48 2b 0c 25
RSP: 002b:00007ffd4df65430 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007ffd4df65628 RCX: 00007fdfdd774127
RDX: 0000000000000000 RSI: 00007ffd4df65f19 RDI: 00000000ffffff9c
RBP: 00007ffd4df65f19 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
</TASK>
Allocated by task 12368:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x70 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0x93/0xa0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__kmalloc_cache_noprof+0x27b/0x3e0 mm/slub.c:5339
kmalloc_noprof include/linux/slab.h:962 [inline]
kzalloc_noprof include/linux/slab.h:1200 [inline]
em28xx_v4l2_init+0x16b/0x2ef0 drivers/media/usb/em28xx/em28xx-video.c:2532
em28xx_init_extension+0x11f/0x1c0 drivers/media/usb/em28xx/em28xx-core.c:1117
process_one_work kernel/workqueue.c:3275 [inline]
process_scheduled_works+0x811/0xf10 kernel/workqueue.c:3358
worker_thread+0x9c1/0xeb0 kernel/workqueue.c:3439
kthread+0x3c1/0x4d0 kernel/kthread.c:467
ret_from_fork+0x608/0xc40 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:245
Freed by task 12368:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x70 mm/kasan/common.c:78
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2687 [inline]
slab_free mm/slub.c:6124 [inline]
kfree+0x1f8/0x4f0 mm/slub.c:6442
em28xx_free_v4l2 drivers/media/usb/em28xx/em28xx-video.c:2118 [inline]
kref_put include/linux/kref.h:65 [inline]
em28xx_v4l2_init+0x16d4/0x2ef0 drivers/media/usb/em28xx/em28xx-video.c:2901
em28xx_init_extension+0x11f/0x1c0 drivers/media/usb/em28xx/em28xx-core.c:1117
process_one_work kernel/workqueue.c:3275 [inline]
process_scheduled_works+0x811/0xf10 kernel/workqueue.c:3358
worker_thread+0x9c1/0xeb0 kernel/workqueue.c:3439
kthread+0x3c1/0x4d0 kernel/kthread.c:467
ret_from_fork+0x608/0xc40 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:245
The buggy address belongs to the object at ffff888057024000
which belongs to the cache kmalloc-8k of size 8192
The buggy address is located 1464 bytes inside of
freed 8192-byte region [ffff888057024000, ffff888057026000)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x57020
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff888057022011
flags: 0x2000000000000040(head|zone=1)
page_type: f5(slab)
raw: 2000000000000040 ffff888012c42280 dead000000000100 dead000000000122
raw: 0000000000000000 0000400000020002 00000000f5000000 ffff888057022011
head: 2000000000000040 ffff888012c42280 dead000000000100 dead000000000122
head: 0000000000000000 0000400000020002 00000000f5000000 ffff888057022011
head: 2000000000000003 ffffea00015c0801 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 12836, tgid 12836 (kworker/1:8), ts 148781064900, free_ts 148779833020
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x253/0x480 mm/page_alloc.c:1889
prep_new_page mm/page_alloc.c:1897 [inline]
get_page_from_freelist+0x2240/0x2330 mm/page_alloc.c:3962
__alloc_frozen_pages_noprof+0x20e/0x3d0 mm/page_alloc.c:5250
alloc_slab_page+0x5e/0x120 mm/slub.c:-1
allocate_slab+0x77/0x540 mm/slub.c:3444
new_slab mm/slub.c:3502 [inline]
refill_objects+0x229/0x680 mm/slub.c:7134
refill_sheaf mm/slub.c:2804 [inline]
__pcs_replace_empty_main+0x1cf/0x430 mm/slub.c:4578
alloc_from_pcs mm/slub.c:4681 [inline]
slab_alloc_node mm/slub.c:4815 [inline]
__kmalloc_cache_noprof+0x377/0x3e0 mm/slub.c:5334
kmalloc_noprof include/linux/slab.h:962 [inline]
kzalloc_noprof include/linux/slab.h:1200 [inline]
snd_mixer_oss_notify_handler+0x1bc/0x1150 sound/core/oss/mixer_oss.c:1318
snd_card_register+0x5df/0x750 sound/core/init.c:923
try_to_register_card+0x2a1/0x330 sound/usb/card.c:-1
usb_audio_probe+0x145d/0x1e80 sound/usb/card.c:1045
usb_probe_interface+0x6c8/0xcf0 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x46f/0xbb0 drivers/base/dd.c:661
__driver_probe_device+0x1ad/0x330 drivers/base/dd.c:803
driver_probe_device+0x54/0x240 drivers/base/dd.c:833
page last free pid 12836 tgid 12836 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1433 [inline]
__free_frozen_pages+0xb5e/0x1200 mm/page_alloc.c:2978
__slab_free+0x2d2/0x2e0 mm/slub.c:5532
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x9e/0x100 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x14a/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4501 [inline]
slab_alloc_node mm/slub.c:4830 [inline]
kmem_cache_alloc_noprof+0x223/0x3d0 mm/slub.c:4837
__kernfs_new_node+0x15c/0x7a0 fs/kernfs/dir.c:637
kernfs_new_node+0x158/0x270 fs/kernfs/dir.c:718
__kernfs_create_file+0x50/0x270 fs/kernfs/file.c:1057
sysfs_add_file_mode_ns+0x1bd/0x250 fs/sysfs/file.c:313
sysfs_merge_group+0x17c/0x310 fs/sysfs/group.c:382
dpm_sysfs_add+0xd7/0x270 drivers/base/power/sysfs.c:704
device_add+0x548/0xba0 drivers/base/core.c:3649
snd_register_device+0x3db/0x560 sound/core/sound.c:278
snd_ctl_dev_register+0x79/0x180 sound/core/control.c:2296
__snd_device_register sound/core/device.c:149 [inline]
snd_device_register_all+0xd1/0x1a0 sound/core/device.c:197
Memory state around the buggy address:
ffff888057024480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888057024500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888057024580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888057024600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888057024680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
<<<<<<<<<<<<<<< tail report >>>>>>>>>>>>>>>
reply other threads:[~2026-06-18 22:27 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6a3470b3.01a98498.2c3fd5.dec7@mx.google.com \
--to=sanan.hasanou@gmail.com \
--cc=contact@pgazz.com \
--cc=hverkuil+cisco@kernel.org \
--cc=kees@kernel.org \
--cc=laurent.pinchart+renesas@ideasonboard.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-media@vger.kernel.org \
--cc=mchehab@kernel.org \
--cc=syzkaller@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.