From: syzbot <syzbot+5725792ce6a9938d1b24@syzkaller.appspotmail.com>
To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com,
tao1.yu@intel.com
Subject: Re: [syzbot] [acpica?] KASAN: use-after-free Read in acpi_ns_get_attached_object
Date: Tue, 28 Jul 2026 22:52:02 -0700 [thread overview]
Message-ID: <6a699502.e3659fcc.2a40b8.0031.GAE@google.com> (raw)
In-Reply-To: <a9c47b19-08a0-4a8c-a9d7-30eb971e83ebn@googlegroups.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in acpi_ns_get_attached_object
usb usb1: USB disconnect, device number 1
ehci-pci 0000:00:1d.7: USB bus 1 deregistered
==================================================================
BUG: KASAN: slab-use-after-free in acpi_ns_get_attached_object+0x148/0x1b0 drivers/acpi/acpica/nsobject.c:264
Read of size 1 at addr ffff888022753480 by task syz.0.18/6260
CPU: 1 UID: 0 PID: 6260 Comm: syz.0.18 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x13d/0x4b0 mm/kasan/report.c:482
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
acpi_ns_get_attached_object+0x148/0x1b0 drivers/acpi/acpica/nsobject.c:264
acpi_ex_resolve_node_to_value+0xb7/0x9a0 drivers/acpi/acpica/exresnte.c:61
acpi_ex_resolve_to_value+0x3da/0xcd0 drivers/acpi/acpica/exresolv.c:76
acpi_ds_evaluate_name_path+0x30d/0x4a0 drivers/acpi/acpica/dsutils.c:790
acpi_ds_exec_end_op+0xb78/0x1e60 drivers/acpi/acpica/dswexec.c:374
acpi_ps_parse_loop+0x5e1/0x26e0 drivers/acpi/acpica/psloop.c:553
acpi_ps_parse_aml+0x81e/0x1120 drivers/acpi/acpica/psparse.c:489
acpi_ps_execute_method+0x5c4/0xe90 drivers/acpi/acpica/psxface.c:190
acpi_ns_evaluate+0x640/0x1670 drivers/acpi/acpica/nseval.c:205
acpi_ut_evaluate_object+0xf7/0x610 drivers/acpi/acpica/uteval.c:60
acpi_rs_get_prt_method_data+0xa0/0x150 drivers/acpi/acpica/rsutils.c:446
acpi_get_irq_routing_table+0xb8/0x140 drivers/acpi/acpica/rsxface.c:137
acpi_pci_irq_find_prt_entry+0x179/0xdd0 drivers/acpi/pci_irq.c:215
acpi_pci_irq_lookup+0x8e/0x6b0 drivers/acpi/pci_irq.c:299
acpi_pci_irq_disable+0x1a8/0x360 drivers/acpi/pci_irq.c:499
pcibios_disable_device arch/x86/pci/common.c:706 [inline]
pcibios_disable_device+0x89/0xb0 arch/x86/pci/common.c:703
do_pci_disable_device+0x9f/0x100 drivers/pci/pci.c:2170
pci_disable_device+0x130/0x270 drivers/pci/pci.c:2206
usb_hcd_pci_remove+0x1ed/0x300 drivers/usb/core/hcd-pci.c:351
pci_device_remove+0xb2/0x1d0 drivers/pci/pci-driver.c:512
device_remove+0xcb/0x180 drivers/base/dd.c:616
__device_release_driver drivers/base/dd.c:1349 [inline]
device_release_driver_internal+0x44e/0x620 drivers/base/dd.c:1372
unbind_store+0xf8/0x110 drivers/base/bus.c:244
drv_attr_store+0x74/0xb0 drivers/base/bus.c:125
sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x6ac/0x1050 fs/read_write.c:687
ksys_write+0x12a/0x250 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7faf72b9de99
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007faf73aaa028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007faf72e25fa0 RCX: 00007faf72b9de99
RDX: 000000000000000c RSI: 0000200000000240 RDI: 0000000000000003
RBP: 00007faf72c33eaf R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007faf72e26038 R14: 00007faf72e25fa0 R15: 00007ffcff270148
</TASK>
Allocated by task 1:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
unpoison_slab_object mm/kasan/common.c:340 [inline]
__kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:366
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4584 [inline]
slab_alloc_node mm/slub.c:4917 [inline]
kmem_cache_alloc_noprof+0x26b/0x6a0 mm/slub.c:4931
acpi_ut_allocate_object_desc_dbg+0x86/0x240 drivers/acpi/acpica/utobject.c:359
acpi_ut_create_internal_object_dbg+0x51/0x260 drivers/acpi/acpica/utobject.c:69
acpi_ds_build_internal_object+0x173/0x790 drivers/acpi/acpica/dsobject.c:94
acpi_ds_create_node+0xe3/0x280 drivers/acpi/acpica/dsobject.c:281
acpi_ds_exec_end_op+0x10cf/0x1e60 drivers/acpi/acpica/dswexec.c:594
acpi_ps_parse_loop+0x5e1/0x26e0 drivers/acpi/acpica/psloop.c:553
acpi_ps_parse_aml+0x81e/0x1120 drivers/acpi/acpica/psparse.c:489
acpi_ps_execute_table+0x393/0x500 drivers/acpi/acpica/psxface.c:295
acpi_ns_execute_table+0x596/0x970 drivers/acpi/acpica/nsparse.c:116
acpi_ns_parse_table+0xcb/0x160 drivers/acpi/acpica/nsparse.c:268
acpi_ns_load_table+0xc9/0x490 drivers/acpi/acpica/nsload.c:71
acpi_tb_load_namespace+0x2b0/0x8f0 drivers/acpi/acpica/tbxfload.c:158
acpi_load_tables+0x89/0x160 drivers/acpi/acpica/tbxfload.c:59
acpi_bus_init drivers/acpi/bus.c:1479 [inline]
acpi_init+0x146/0x840 drivers/acpi/bus.c:1592
do_one_initcall+0x11d/0x700 init/main.c:1347
do_initcall_level init/main.c:1409 [inline]
do_initcalls init/main.c:1425 [inline]
do_basic_setup init/main.c:1445 [inline]
kernel_init_freeable+0x6ea/0x7b0 init/main.c:1658
kernel_init+0x1f/0x1e0 init/main.c:1548
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Freed by task 6252:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2677 [inline]
slab_free mm/slub.c:6377 [inline]
kmem_cache_free+0x127/0x6b0 mm/slub.c:6504
acpi_os_release_object+0x1c/0x30 drivers/acpi/osl.c:1661
acpi_ut_delete_object_desc+0xea/0x130 drivers/acpi/acpica/utobject.c:402
acpi_ut_delete_internal_obj drivers/acpi/acpica/utdelete.c:316 [inline]
acpi_ut_update_ref_count.part.0+0x510/0x2250 drivers/acpi/acpica/utdelete.c:436
acpi_ut_update_ref_count drivers/acpi/acpica/utdelete.c:374 [inline]
acpi_ut_update_object_reference+0x5f9/0x800 drivers/acpi/acpica/utdelete.c:632
acpi_ut_remove_reference drivers/acpi/acpica/utdelete.c:740 [inline]
acpi_ut_remove_reference+0x192/0x1d0 drivers/acpi/acpica/utdelete.c:710
acpi_rs_get_prt_method_data+0xcd/0x150 drivers/acpi/acpica/rsutils.c:460
acpi_get_irq_routing_table+0xb8/0x140 drivers/acpi/acpica/rsxface.c:137
acpi_pci_irq_find_prt_entry+0x179/0xdd0 drivers/acpi/pci_irq.c:215
acpi_pci_irq_lookup+0x8e/0x6b0 drivers/acpi/pci_irq.c:299
acpi_pci_irq_enable+0x1f5/0x6f0 drivers/acpi/pci_irq.c:414
pcibios_enable_device+0xb6/0xe0 arch/x86/pci/common.c:699
do_pci_enable_device+0x21f/0x4a0 drivers/pci/pci.c:1998
pci_enable_device_flags+0x27c/0x370 drivers/pci/pci.c:2089
usb_hcd_pci_probe+0x56/0xcb0 drivers/usb/core/hcd-pci.c:184
ehci_pci_probe+0x35/0x50 drivers/usb/host/ehci-pci.c:385
local_pci_probe+0xdd/0x1b0 drivers/pci/pci-driver.c:332
pci_call_probe+0x176/0x800 drivers/pci/pci-driver.c:394
__pci_device_probe drivers/pci/pci-driver.c:455 [inline]
pci_device_probe+0x1cd/0x370 drivers/pci/pci-driver.c:489
call_driver_probe drivers/base/dd.c:628 [inline]
really_probe+0x241/0xa60 drivers/base/dd.c:706
__driver_probe_device+0x20e/0x450 drivers/base/dd.c:868
device_driver_attach+0xd1/0x220 drivers/base/dd.c:1203
bind_store+0xf4/0x190 drivers/base/bus.c:267
drv_attr_store+0x74/0xb0 drivers/base/bus.c:125
sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x6ac/0x1050 fs/read_write.c:687
ksys_write+0x12a/0x250 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff888022753478
which belongs to the cache Acpi-Operand of size 72
The buggy address is located 8 bytes inside of
freed 72-byte region [ffff888022753478, ffff8880227534c0)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880227532d8 pfn:0x22753
flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000200 ffff88801bc4da40 ffffea0000898f10 ffffea000089e950
raw: ffff8880227532d8 000000080027001e 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 2646274022, free_ts 0
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304
alloc_slab_page mm/slub.c:3266 [inline]
allocate_slab mm/slub.c:3380 [inline]
new_slab+0xa2/0x640 mm/slub.c:3426
refill_objects+0xe3/0x410 mm/slub.c:7310
refill_sheaf mm/slub.c:2804 [inline]
__pcs_replace_empty_main+0x376/0x680 mm/slub.c:4675
alloc_from_pcs mm/slub.c:4773 [inline]
slab_alloc_node mm/slub.c:4905 [inline]
kmem_cache_alloc_noprof+0x46e/0x6a0 mm/slub.c:4931
acpi_ut_allocate_object_desc_dbg+0x86/0x240 drivers/acpi/acpica/utobject.c:359
acpi_ut_create_internal_object_dbg+0x51/0x260 drivers/acpi/acpica/utobject.c:69
acpi_ds_create_operand+0x6be/0xc20 drivers/acpi/acpica/dsutils.c:617
acpi_ds_eval_data_object_operands+0x125/0x640 drivers/acpi/acpica/dsopcode.c:596
acpi_ds_exec_end_op+0xe41/0x1e60 drivers/acpi/acpica/dswexec.c:617
acpi_ps_parse_loop+0x5e1/0x26e0 drivers/acpi/acpica/psloop.c:553
acpi_ps_parse_aml+0x81e/0x1120 drivers/acpi/acpica/psparse.c:489
acpi_ps_execute_table+0x393/0x500 drivers/acpi/acpica/psxface.c:295
acpi_ns_execute_table+0x596/0x970 drivers/acpi/acpica/nsparse.c:116
page_owner free stack trace missing
Memory state around the buggy address:
ffff888022753380: 00 fc fc fc fc fa fb fb fb fb fb fb fb fb fc fc
ffff888022753400: fc fc fa fb fb fb fb fb fb fb fb fc fc fc fc fa
>ffff888022753480: fb fb fb fb fb fb fb fb fc fc fc fc 00 00 00 00
^
ffff888022753500: 00 00 00 00 00 fc fc fc fc 00 00 00 00 00 00 00
ffff888022753580: 00 00 fc fc fc fc 00 00 00 00 00 00 00 00 00 fc
==================================================================
Tested on:
commit: 92141375 ACPICA: Add a reference for reused package el..
git tree: https://github.com/yutao-intel/linux.git fix-acpica
console output: https://syzkaller.appspot.com/x/log.txt?x=11d33f51580000
kernel config: https://syzkaller.appspot.com/x/.config?x=145fa60d73086782
dashboard link: https://syzkaller.appspot.com/bug?extid=5725792ce6a9938d1b24
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
Note: no patches were applied.
next parent reply other threads:[~2026-07-29 5:52 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <a9c47b19-08a0-4a8c-a9d7-30eb971e83ebn@googlegroups.com>
2026-07-29 5:52 ` syzbot [this message]
[not found] <6c5210d5-3bc9-4ac9-b811-9fe3421f1747n@googlegroups.com>
2026-07-29 3:53 ` [syzbot] [acpica?] KASAN: use-after-free Read in acpi_ns_get_attached_object syzbot
2026-07-28 4:11 syzbot
2026-07-29 1:08 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6a699502.e3659fcc.2a40b8.0031.GAE@google.com \
--to=syzbot+5725792ce6a9938d1b24@syzkaller.appspotmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=tao1.yu@intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.