From: syzbot <syzbot+df9e891bf8ea586f846b@syzkaller.appspotmail.com>
To: kartikey406@gmail.com, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [usb?] KASAN: slab-use-after-free Read in ep_open
Date: Thu, 30 Jul 2026 23:59:02 -0700 [thread overview]
Message-ID: <6a6c47b6.1b55b669.19788.0019.GAE@google.com> (raw)
In-Reply-To: <20260731044451.10817-1-kartikey406@gmail.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Write in ep_open
==================================================================
BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
BUG: KASAN: slab-use-after-free in atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:252 [inline]
BUG: KASAN: slab-use-after-free in __refcount_add include/linux/refcount.h:283 [inline]
BUG: KASAN: slab-use-after-free in __refcount_inc include/linux/refcount.h:366 [inline]
BUG: KASAN: slab-use-after-free in refcount_inc include/linux/refcount.h:383 [inline]
BUG: KASAN: slab-use-after-free in get_ep drivers/usb/gadget/legacy/inode.c:214 [inline]
BUG: KASAN: slab-use-after-free in ep_open+0xb8/0x2bc drivers/usb/gadget/legacy/inode.c:831
Write of size 4 at addr ffff0000d322748c by task syz-executor/5557
CPU: 1 UID: 0 PID: 5557 Comm: syz-executor Not tainted syzkaller #0 PREEMPT
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
Call trace:
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
__dump_stack+0x30/0x40 lib/dump_stack.c:94
dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
print_address_description+0xb0/0x238 mm/kasan/report.c:378
print_report+0x68/0x84 mm/kasan/report.c:482
kasan_report+0x8c/0xc4 mm/kasan/report.c:595
check_region_inline mm/kasan/generic.c:-1 [inline]
kasan_check_range+0x17c/0x1ac mm/kasan/generic.c:200
__kasan_check_write+0x20/0x30 mm/kasan/shadow.c:37
instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:252 [inline]
__refcount_add include/linux/refcount.h:283 [inline]
__refcount_inc include/linux/refcount.h:366 [inline]
refcount_inc include/linux/refcount.h:383 [inline]
get_ep drivers/usb/gadget/legacy/inode.c:214 [inline]
ep_open+0xb8/0x2bc drivers/usb/gadget/legacy/inode.c:831
do_dentry_open+0x5c4/0xfc0 fs/open.c:947
vfs_open+0x44/0x2dc fs/open.c:1052
do_open fs/namei.c:4700 [inline]
path_openat+0x21fc/0x2a60 fs/namei.c:4863
do_file_open+0x1c8/0x2e8 fs/namei.c:4892
do_sys_openat2+0x114/0x1e8 fs/open.c:1368
do_sys_open+0xb0/0xe0 fs/open.c:1374
__do_sys_openat fs/open.c:1390 [inline]
__se_sys_openat fs/open.c:1385 [inline]
__arm64_sys_openat+0xa0/0xbc fs/open.c:1385
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:736
el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:755
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594
Allocated by task 5798:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x40/0x78 mm/kasan/common.c:78
kasan_save_alloc_info+0x44/0x54 mm/kasan/generic.c:570
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0x9c/0xb4 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__kmalloc_cache_noprof+0x2e8/0x5ec mm/slub.c:5515
_kmalloc_noprof include/linux/slab.h:969 [inline]
_kzalloc_noprof include/linux/slab.h:1290 [inline]
activate_ep_files drivers/usb/gadget/legacy/inode.c:1616 [inline]
gadgetfs_bind+0x204/0x7a0 drivers/usb/gadget/legacy/inode.c:1708
gadget_bind_driver+0x274/0x834 drivers/usb/gadget/udc/core.c:1662
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x29c/0x800 drivers/base/dd.c:706
__driver_probe_device+0x1e0/0x350 drivers/base/dd.c:868
driver_probe_device+0x6c/0x19c drivers/base/dd.c:898
__driver_attach+0x168/0x384 drivers/base/dd.c:1292
bus_for_each_dev+0x128/0x1b4 drivers/base/bus.c:383
driver_attach+0x50/0x60 drivers/base/dd.c:1310
bus_add_driver+0x208/0x500 drivers/base/bus.c:763
driver_register+0x220/0x310 drivers/base/driver.c:174
usb_gadget_register_driver_owner+0xf0/0x25c drivers/usb/gadget/udc/core.c:1752
dev_config+0x91c/0xcc0 drivers/usb/gadget/legacy/inode.c:1899
vfs_write+0x2a4/0xa0c fs/read_write.c:685
ksys_write+0x12c/0x228 fs/read_write.c:739
__do_sys_write fs/read_write.c:750 [inline]
__se_sys_write fs/read_write.c:747 [inline]
__arm64_sys_write+0x7c/0x90 fs/read_write.c:747
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:736
el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:755
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594
Freed by task 5799:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x40/0x78 mm/kasan/common.c:78
kasan_save_free_info+0x58/0x70 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x74/0xa4 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2705 [inline]
slab_free mm/slub.c:6405 [inline]
kfree+0x188/0x690 mm/slub.c:6720
put_ep+0xd0/0x144 drivers/usb/gadget/legacy/inode.c:225
destroy_ep_files+0x244/0x2dc drivers/usb/gadget/legacy/inode.c:1597
gadgetfs_unbind+0x114/0x1f0 drivers/usb/gadget/legacy/inode.c:1673
gadget_unbind_driver+0x188/0x790 drivers/usb/gadget/udc/core.c:1724
device_remove+0xc4/0x134 drivers/base/dd.c:616
__device_release_driver drivers/base/dd.c:1349 [inline]
device_release_driver_internal+0x124/0x20c drivers/base/dd.c:1372
driver_detach+0x124/0x1b4 drivers/base/dd.c:1435
bus_remove_driver+0x124/0x22c drivers/base/bus.c:832
driver_unregister+0x78/0xac drivers/base/driver.c:202
usb_gadget_unregister_driver+0x50/0x78 drivers/usb/gadget/udc/core.c:1784
dev_release+0x8c/0x15c drivers/usb/gadget/legacy/inode.c:1213
__fput+0x338/0x74c fs/file_table.c:512
____fput+0x20/0x30 fs/file_table.c:540
task_work_run+0x1cc/0x25c kernel/task_work.c:233
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0x58c/0x1a74 kernel/exit.c:1009
__do_sys_exit kernel/exit.c:1119 [inline]
__se_sys_exit kernel/exit.c:1117 [inline]
do_group_exit+0x0/0x238 kernel/exit.c:1117
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:736
el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:755
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594
The buggy address belongs to the object at ffff0000d3227400
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 140 bytes inside of
freed 512-byte region [ffff0000d3227400, ffff0000d3227600)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113224
head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 05ffc00000000040 ffff0000c0001c80 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
head: 05ffc00000000040 ffff0000c0001c80 dead000000000100 dead000000000122
head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
head: 05ffc00000000002 fffffdffc34c8901 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff0000d3227380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff0000d3227400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff0000d3227480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff0000d3227500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff0000d3227580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x134/0x1f8 lib/refcount.c:25, CPU#1: syz-executor/5557
Modules linked in:
CPU: 1 UID: 0 PID: 5557 Comm: syz-executor Tainted: G B syzkaller #0 PREEMPT
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
pstate: 634000c5 (nZCv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--)
pc : refcount_warn_saturate+0x134/0x1f8 lib/refcount.c:25
lr : refcount_warn_saturate+0x134/0x1f8 lib/refcount.c:25
sp : ffff800094a97740
x29: ffff800094a97740 x28: dfff800000000000 x27: 1fffe00019788600
x26: ffff0000cbc43008 x25: 1fffe0001aebd509 x24: ffff0000d75ea848
x23: dfff800000000000 x22: 0000000000000000 x21: ffff0000cbc42fc0
x20: ffff0000d322748c x19: ffff80008a158000 x18: 0000000000000000
x17: 3d3d3d3d3d3d3d3d x16: 3d3d3d3d3d3d3d3d x15: 3d3d3d3d3d3d3d3d
x14: 3d3d3d3d3d3d3d3d x13: 0000000000000001 x12: 0000000000000000
x11: 0000000000000000 x10: 0000000000000003 x9 : 360a90020a0ce000
x8 : 360a90020a0ce000 x7 : 0000000000000001 x6 : ffff80008048de94
x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f8054
x2 : 0000000100000001 x1 : ffff0000c2a03a80 x0 : 0000000000000000
Call trace:
refcount_warn_saturate+0x134/0x1f8 lib/refcount.c:25 (P)
__refcount_add include/linux/refcount.h:-1 [inline]
__refcount_inc include/linux/refcount.h:366 [inline]
refcount_inc include/linux/refcount.h:383 [inline]
get_ep drivers/usb/gadget/legacy/inode.c:214 [inline]
ep_open+0x238/0x2bc drivers/usb/gadget/legacy/inode.c:831
do_dentry_open+0x5c4/0xfc0 fs/open.c:947
vfs_open+0x44/0x2dc fs/open.c:1052
do_open fs/namei.c:4700 [inline]
path_openat+0x21fc/0x2a60 fs/namei.c:4863
do_file_open+0x1c8/0x2e8 fs/namei.c:4892
do_sys_openat2+0x114/0x1e8 fs/open.c:1368
do_sys_open+0xb0/0xe0 fs/open.c:1374
__do_sys_openat fs/open.c:1390 [inline]
__se_sys_openat fs/open.c:1385 [inline]
__arm64_sys_openat+0xa0/0xbc fs/open.c:1385
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:736
el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:755
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594
irq event stamp: 217440
hardirqs last enabled at (217439): [<ffff800080b9d9d8>] kasan_quarantine_put+0xb4/0x1c4 mm/kasan/quarantine.c:234
hardirqs last disabled at (217440): [<ffff8000869050fc>] __raw_spin_lock_irq include/linux/spinlock_api_smp.h:140 [inline]
hardirqs last disabled at (217440): [<ffff8000869050fc>] _raw_spin_lock_irq+0x28/0x70 kernel/locking/spinlock.c:174
softirqs last enabled at (213442): [<ffff80008013c0b4>] local_bh_enable include/linux/bottom_half.h:33 [inline]
softirqs last enabled at (213442): [<ffff80008013c0b4>] put_cpu_fpsimd_context arch/arm64/kernel/fpsimd.c:251 [inline]
softirqs last enabled at (213442): [<ffff80008013c0b4>] fpsimd_restore_current_state+0x39c/0x9c8 arch/arm64/kernel/fpsimd.c:1797
softirqs last disabled at (213440): [<ffff80008013bd5c>] local_bh_disable include/linux/bottom_half.h:20 [inline]
softirqs last disabled at (213440): [<ffff80008013bd5c>] get_cpu_fpsimd_context arch/arm64/kernel/fpsimd.c:234 [inline]
softirqs last disabled at (213440): [<ffff80008013bd5c>] fpsimd_restore_current_state+0x44/0x9c8 arch/arm64/kernel/fpsimd.c:1790
---[ end trace 0000000000000000 ]---
Tested on:
commit: 365f9c7a Merge branches 'for-next/core' and 'for-next/..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=114978c6580000
kernel config: https://syzkaller.appspot.com/x/.config?x=72c97575381cec47
dashboard link: https://syzkaller.appspot.com/bug?extid=df9e891bf8ea586f846b
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64
patch: https://syzkaller.appspot.com/x/patch.diff?x=12b475b9580000
next parent reply other threads:[~2026-07-31 6:59 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20260731044451.10817-1-kartikey406@gmail.com>
2026-07-31 6:59 ` syzbot [this message]
[not found] <20260731114022.18295-1-kartikey406@gmail.com>
2026-07-31 16:21 ` [syzbot] [usb?] KASAN: slab-use-after-free Read in ep_open syzbot
[not found] <20260731080941.13394-1-kartikey406@gmail.com>
2026-07-31 9:08 ` syzbot
[not found] <20260731042637.9137-1-kartikey406@gmail.com>
2026-07-31 5:42 ` syzbot
2026-07-31 1:28 syzbot
2026-08-17 13:42 ` syzbot
2026-08-17 15:04 ` Jens Axboe
2026-08-17 15:45 ` Alan Stern
2026-08-17 16:38 ` syzbot
2026-08-17 18:14 ` Alan Stern
2026-08-18 7:42 ` Greg KH
2026-08-18 15:37 ` Alan Stern
2026-08-19 12:26 ` Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6a6c47b6.1b55b669.19788.0019.GAE@google.com \
--to=syzbot+df9e891bf8ea586f846b@syzkaller.appspotmail.com \
--cc=kartikey406@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.