From: syzbot <syzbot+ecbb1750082f7528b507@syzkaller.appspotmail.com>
To: hdanton@sina.com, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] KASAN: slab-use-after-free Read in vhci_send_cmd_submit
Date: Thu, 20 Aug 2026 22:11:01 -0700 [thread overview]
Message-ID: <6a87dde5.dbb3a75c.13dd47.0003.GAE@google.com> (raw)
In-Reply-To: <20260821045537.1349-1-hdanton@sina.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in vhci_send_cmd_submit
==================================================================
BUG: KASAN: slab-use-after-free in vhci_send_cmd_submit+0xed2/0x10c0 drivers/usb/usbip/vhci_tx.c:91
Read of size 4 at addr ffff88802ae62784 by task vhci_tx/6047
CPU: 0 UID: 0 PID: 6047 Comm: vhci_tx Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x13d/0x4b0 mm/kasan/report.c:482
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
vhci_send_cmd_submit+0xed2/0x10c0 drivers/usb/usbip/vhci_tx.c:91
vhci_tx_loop+0xff/0x460 drivers/usb/usbip/vhci_tx.c:241
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Allocated by task 6032:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__do_kmalloc_node mm/slub.c:5337 [inline]
__kmalloc_noprof+0x324/0x820 mm/slub.c:5362
_kmalloc_noprof include/linux/slab.h:992 [inline]
usb_alloc_urb+0x66/0xa0 drivers/usb/core/urb.c:75
alloc_async drivers/usb/core/devio.c:408 [inline]
proc_do_submiturb+0x741/0x3820 drivers/usb/core/devio.c:1781
proc_submiturb drivers/usb/core/devio.c:2003 [inline]
usbdev_do_ioctl drivers/usb/core/devio.c:2703 [inline]
usbdev_ioctl+0x2ae7/0x3a90 drivers/usb/core/devio.c:2827
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 6032:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2678 [inline]
slab_free mm/slub.c:6372 [inline]
kfree+0x22b/0x6c0 mm/slub.c:6687
urb_destroy drivers/usb/core/urb.c:27 [inline]
kref_put include/linux/kref.h:65 [inline]
usb_free_urb.part.0+0xa5/0x110 drivers/usb/core/urb.c:96
usb_free_urb+0x1f/0x30 drivers/usb/core/urb.c:95
free_async+0x37d/0x570 drivers/usb/core/devio.c:436
proc_reapurbnonblock drivers/usb/core/devio.c:2130 [inline]
usbdev_do_ioctl drivers/usb/core/devio.c:2622 [inline]
usbdev_ioctl+0x2e7/0x3a90 drivers/usb/core/devio.c:2827
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff88802ae62700
which belongs to the cache kmalloc-192 of size 192
The buggy address is located 132 bytes inside of
freed 192-byte region [ffff88802ae62700, ffff88802ae627c0)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2ae62
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000000 ffff88801c0423c0 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 9072505480
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1871
prep_new_page mm/page_alloc.c:1879 [inline]
get_page_from_freelist+0x110d/0x35b0 mm/page_alloc.c:3943
__alloc_frozen_pages_noprof+0x2eb/0x3300 mm/page_alloc.c:5436
alloc_slab_page mm/slub.c:3267 [inline]
allocate_slab mm/slub.c:3382 [inline]
new_slab+0xa5/0x640 mm/slub.c:3428
refill_objects+0xe3/0x410 mm/slub.c:7305
refill_sheaf mm/slub.c:2805 [inline]
__pcs_replace_empty_main+0x372/0x680 mm/slub.c:4677
alloc_from_pcs mm/slub.c:4775 [inline]
slab_alloc_node mm/slub.c:4907 [inline]
__do_kmalloc_node mm/slub.c:5336 [inline]
__kmalloc_noprof+0x66b/0x820 mm/slub.c:5362
_kmalloc_noprof include/linux/slab.h:992 [inline]
_kzalloc_noprof include/linux/slab.h:1309 [inline]
new_dir fs/proc/proc_sysctl.c:965 [inline]
get_subdir fs/proc/proc_sysctl.c:1009 [inline]
sysctl_mkdir_p fs/proc/proc_sysctl.c:1319 [inline]
__register_sysctl_table+0xbe4/0x1650 fs/proc/proc_sysctl.c:1394
register_net_sysctl_sz+0x325/0x420 net/sysctl_net.c:172
neigh_sysctl_register+0x326/0x660 net/core/neighbour.c:3915
devinet_sysctl_register+0xb6/0x210 net/ipv4/devinet.c:2781
inetdev_init+0x2b8/0x570 net/ipv4/devinet.c:291
inetdev_event+0x827/0x17f0 net/ipv4/devinet.c:1590
notifier_call_chain+0x99/0x3f0 kernel/notifier.c:85
call_netdevice_notifiers_info+0xbe/0x110 net/core/dev.c:2275
call_netdevice_notifiers_extack net/core/dev.c:2313 [inline]
call_netdevice_notifiers net/core/dev.c:2327 [inline]
register_netdevice+0x1998/0x25a0 net/core/dev.c:11541
page_owner free stack trace missing
Memory state around the buggy address:
ffff88802ae62680: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff88802ae62700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88802ae62780: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
^
ffff88802ae62800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88802ae62880: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
==================================================================
Tested on:
commit: 818bebeb drm/xe: Don't hand out the flat CCS storage a..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=148c0179580000
kernel config: https://syzkaller.appspot.com/x/.config?x=ccca94d2c01b9e78
dashboard link: https://syzkaller.appspot.com/bug?extid=ecbb1750082f7528b507
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
patch: https://syzkaller.appspot.com/x/patch.diff?x=16c30415580000
next prev parent reply other threads:[~2026-08-21 5:11 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-20 14:58 [syzbot] KASAN: slab-use-after-free Read in vhci_send_cmd_submit syzbot
2026-08-21 3:13 ` Edward Adam Davis
2026-08-21 3:29 ` syzbot
2026-08-21 4:55 ` Hillf Danton
2026-08-21 5:11 ` syzbot [this message]
2026-08-21 13:08 ` [PATCH] usbip: prevent the use of unavailable urb and hcpriv in tx Edward Adam Davis
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6a87dde5.dbb3a75c.13dd47.0003.GAE@google.com \
--to=syzbot+ecbb1750082f7528b507@syzkaller.appspotmail.com \
--cc=hdanton@sina.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.