All of lore.kernel.org
 help / color / mirror / Atom feed
* [syzbot] [usb?] KASAN: slab-use-after-free Read in stub_rx_loop
@ 2026-07-28 14:25 syzbot
  2026-08-26 16:49 ` syzbot
  0 siblings, 1 reply; 19+ messages in thread
From: syzbot @ 2026-07-28 14:25 UTC (permalink / raw)
  To: gregkh, i, linux-kernel, linux-usb, shuah, syzkaller-bugs,
	valentina.manea.m

Hello,

syzbot found the following issue on:

HEAD commit:    48a5a7ab8d6a Merge tag 'v7.2-rc4-smb3-client-fixes' of git..
git tree:       upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=113c32ea580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=20c9876b0f77b546
dashboard link: https://syzkaller.appspot.com/bug?extid=06fa667a0931a3430026
compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-48a5a7ab.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/cca5551ec121/vmlinux-48a5a7ab.xz
kernel image: https://storage.googleapis.com/syzbot-assets/30b6e710a3ae/bzImage-48a5a7ab.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+06fa667a0931a3430026@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: slab-use-after-free in stub_recv_cmd_submit drivers/usb/usbip/stub_rx.c:609 [inline]
BUG: KASAN: slab-use-after-free in stub_rx_pdu drivers/usb/usbip/stub_rx.c:688 [inline]
BUG: KASAN: slab-use-after-free in stub_rx_loop+0x2965/0x2ee0 drivers/usb/usbip/stub_rx.c:707
Read of size 4 at addr ffff888012cacdb0 by task stub_rx/5324

CPU: 0 UID: 0 PID: 5324 Comm: stub_rx Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_address_description+0x55/0x1e0 mm/kasan/report.c:378
 print_report+0x58/0x70 mm/kasan/report.c:482
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 stub_recv_cmd_submit drivers/usb/usbip/stub_rx.c:609 [inline]
 stub_rx_pdu drivers/usb/usbip/stub_rx.c:688 [inline]
 stub_rx_loop+0x2965/0x2ee0 drivers/usb/usbip/stub_rx.c:707
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Allocated by task 5324:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 unpoison_slab_object mm/kasan/common.c:340 [inline]
 __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4612 [inline]
 slab_alloc_node mm/slub.c:4945 [inline]
 kmem_cache_alloc_noprof+0x2a0/0x5f0 mm/slub.c:4959
 stub_priv_alloc drivers/usb/usbip/stub_rx.c:314 [inline]
 stub_recv_cmd_submit drivers/usb/usbip/stub_rx.c:490 [inline]
 stub_rx_pdu drivers/usb/usbip/stub_rx.c:688 [inline]
 stub_rx_loop+0xad9/0x2ee0 drivers/usb/usbip/stub_rx.c:707
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Freed by task 5325:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2705 [inline]
 slab_free mm/slub.c:6405 [inline]
 kmem_cache_free+0x182/0x650 mm/slub.c:6532
 stub_send_ret_submit drivers/usb/usbip/stub_tx.c:333 [inline]
 stub_tx_loop+0x1b16/0x2800 drivers/usb/usbip/stub_tx.c:437
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

The buggy address belongs to the object at ffff888012cacd80
 which belongs to the cache stub_priv of size 64
The buggy address is located 48 bytes inside of
 freed 64-byte region [ffff888012cacd80, ffff888012cacdc0)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888012cace00 pfn:0x12cac
flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000200 ffff888033fd4280 ffff8880340e27c8 ffff8880340e27c8
raw: ffff888012cace00 000000080020001c 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5324, tgid 5324 (stub_rx), ts 94362120884, free_ts 93984048542
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
 prep_new_page mm/page_alloc.c:1867 [inline]
 get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
 __alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
 alloc_slab_page mm/slub.c:3294 [inline]
 allocate_slab+0x79/0x5e0 mm/slub.c:3408
 new_slab mm/slub.c:3454 [inline]
 refill_objects+0x2d5/0x350 mm/slub.c:7338
 refill_sheaf mm/slub.c:2832 [inline]
 __pcs_replace_empty_main+0x2bf/0x6b0 mm/slub.c:4703
 alloc_from_pcs mm/slub.c:4801 [inline]
 slab_alloc_node mm/slub.c:4933 [inline]
 kmem_cache_alloc_noprof+0x382/0x5f0 mm/slub.c:4959
 stub_priv_alloc drivers/usb/usbip/stub_rx.c:314 [inline]
 stub_recv_cmd_submit drivers/usb/usbip/stub_rx.c:490 [inline]
 stub_rx_pdu drivers/usb/usbip/stub_rx.c:688 [inline]
 stub_rx_loop+0xad9/0x2ee0 drivers/usb/usbip/stub_rx.c:707
 kthread+0x388/0x470 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
page last free pid 4993 tgid 4993 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1406 [inline]
 __free_frozen_pages+0xc1e/0xd10 mm/page_alloc.c:2950
 __slab_free+0x274/0x2c0 mm/slub.c:5767
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4612 [inline]
 slab_alloc_node mm/slub.c:4945 [inline]
 kmem_cache_alloc_node_noprof+0x355/0x610 mm/slub.c:5017
 __alloc_skb+0x1d7/0x7a0 net/core/skbuff.c:704
 alloc_skb include/linux/skbuff.h:1384 [inline]
 alloc_skb_with_frags+0xc6/0x760 net/core/skbuff.c:6769
 sock_alloc_send_pskb+0x878/0x990 net/core/sock.c:3013
 unix_dgram_sendmsg+0x4fe/0x1870 net/unix/af_unix.c:2136
 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:775
 __sock_sendmsg net/socket.c:790 [inline]
 sock_write_iter+0x2de/0x3e0 net/socket.c:1241
 do_iter_readv_writev+0x612/0x8c0 fs/read_write.c:-1
 vfs_writev+0x343/0x990 fs/read_write.c:1058
 do_writev+0x154/0x2e0 fs/read_write.c:1104
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94

Memory state around the buggy address:
 ffff888012cacc80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888012cacd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888012cacd80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
                                     ^
 ffff888012cace00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888012cace80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

^ permalink raw reply	[flat|nested] 19+ messages in thread
* Re: [syzbot] [ntfs3?] general protection fault in al_destroy
@ 2026-08-27  5:32 syzbot
  2026-08-27  7:03 ` [syzbot] [usb?] KASAN: slab-use-after-free Read in stub_rx_loop Edward Adam Davis
  0 siblings, 1 reply; 19+ messages in thread
From: syzbot @ 2026-08-27  5:32 UTC (permalink / raw)
  To: almaz.alexandrovich, linux-kernel, ntfs3, syzkaller-bugs

syzbot has found a reproducer for the following issue on:

HEAD commit:    502d45774af0 Merge tag 'clk-for-linus' of git://git.kernel..
git tree:       upstream
console+strace: https://syzkaller.appspot.com/x/log.txt?x=13166d49580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=dfd8ec781284be4e
dashboard link: https://syzkaller.appspot.com/bug?extid=04cf7b83f6dd2c3a54c8
compiler:       Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=17d04579580000
C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=127e5625580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/fb0ebb231418/disk-502d4577.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/82fe4e8c3ba9/vmlinux-502d4577.xz
kernel image: https://storage.googleapis.com/syzbot-assets/40eb9f92a77c/bzImage-502d4577.xz
mounted in repro: https://storage.googleapis.com/syzbot-assets/63d316385c91/mount_0.gz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+04cf7b83f6dd2c3a54c8@syzkaller.appspotmail.com

         option from the mount to silence this warning.
=======================================================
ntfs3(loop0): Different NTFS sector size (1024) and media sector size (512).
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000042: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000210-0x0000000000000217]
CPU: 0 UID: 0 PID: 5627 Comm: syz-executor424 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
RIP: 0010:run_close fs/ntfs3/ntfs_fs.h:1034 [inline]
RIP: 0010:al_destroy+0x49/0xc0 fs/ntfs3/attrlist.c:33
Code: 02 00 00 48 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 88 e5 06 ff 48 8b 1b 4c 8d b3 10 02 00 00 4c 89 f0 48 c1 e8 03 <42> 80 3c 38 00 74 08 4c 89 f7 e8 68 e5 06 ff 48 8b bb 10 02 00 00
RSP: 0018:ffffc9000387f960 EFLAGS: 00010216
RAX: 0000000000000042 RBX: 0000000000000000 RCX: ffff888075ce5dc0
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff888070090e20
RBP: 0000000000000001 R08: ffffffff907a0d7f R09: 1ffffffff20f41af
R10: dffffc0000000000 R11: fffffbfff20f41b0 R12: ffff888070091070
R13: dffffc0000000000 R14: 0000000000000210 R15: dffffc0000000000
FS:  0000555571c6a400(0000) GS:ffff888124ce3000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0e9a7a2000 CR3: 00000000217c4000 CR4: 0000000000350ef0
Call Trace:
 <TASK>
 ni_clear+0x5d/0x630 fs/ntfs3/frecord.c:110
 evict+0x624/0xb50 fs/inode.c:822
 ntfs_new_inode+0x8c/0x120 fs/ntfs3/fsntfs.c:1719
 ntfs_create_inode+0x6e7/0x3420 fs/ntfs3/inode.c:1520
 ntfs_mkdir+0x37/0x50 fs/ntfs3/namei.c:234
 vfs_mkdir+0x40c/0x620 fs/namei.c:5410
 filename_mkdirat+0x285/0x510 fs/namei.c:5443
 __do_sys_mkdirat fs/namei.c:5464 [inline]
 __se_sys_mkdirat+0x35/0x150 fs/namei.c:5461
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f82637ada69
Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffcfa0d5d78 EFLAGS: 00000246 ORIG_RAX: 0000000000000102
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f82637ada69
RDX: 00000000000001ff RSI: 0000200000000040 RDI: 00000000ffffff9c
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000555571c6b570
R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffcfa0d5da0
R13: 0000000000000002 R14: 431bde82d7b634db R15: 00007f826380d04b
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:run_close fs/ntfs3/ntfs_fs.h:1034 [inline]
RIP: 0010:al_destroy+0x49/0xc0 fs/ntfs3/attrlist.c:33
Code: 02 00 00 48 89 d8 48 c1 e8 03 42 80 3c 38 00 74 08 48 89 df e8 88 e5 06 ff 48 8b 1b 4c 8d b3 10 02 00 00 4c 89 f0 48 c1 e8 03 <42> 80 3c 38 00 74 08 4c 89 f7 e8 68 e5 06 ff 48 8b bb 10 02 00 00
RSP: 0018:ffffc9000387f960 EFLAGS: 00010216
RAX: 0000000000000042 RBX: 0000000000000000 RCX: ffff888075ce5dc0
RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffff888070090e20
RBP: 0000000000000001 R08: ffffffff907a0d7f R09: 1ffffffff20f41af
R10: dffffc0000000000 R11: fffffbfff20f41b0 R12: ffff888070091070
R13: dffffc0000000000 R14: 0000000000000210 R15: dffffc0000000000
FS:  0000555571c6a400(0000) GS:ffff888124ce3000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f0e9a7a2000 CR3: 00000000217c4000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess):
   0:	02 00                	add    (%rax),%al
   2:	00 48 89             	add    %cl,-0x77(%rax)
   5:	d8 48 c1             	fmuls  -0x3f(%rax)
   8:	e8 03 42 80 3c       	call   0x3c804210
   d:	38 00                	cmp    %al,(%rax)
   f:	74 08                	je     0x19
  11:	48 89 df             	mov    %rbx,%rdi
  14:	e8 88 e5 06 ff       	call   0xff06e5a1
  19:	48 8b 1b             	mov    (%rbx),%rbx
  1c:	4c 8d b3 10 02 00 00 	lea    0x210(%rbx),%r14
  23:	4c 89 f0             	mov    %r14,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	42 80 3c 38 00       	cmpb   $0x0,(%rax,%r15,1) <-- trapping instruction
  2f:	74 08                	je     0x39
  31:	4c 89 f7             	mov    %r14,%rdi
  34:	e8 68 e5 06 ff       	call   0xff06e5a1
  39:	48 8b bb 10 02 00 00 	mov    0x210(%rbx),%rdi


---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

^ permalink raw reply	[flat|nested] 19+ messages in thread
end of thread, other threads:[~2026-09-23 13:25 UTC | newest]

Thread overview: 19+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-28 14:25 [syzbot] [usb?] KASAN: slab-use-after-free Read in stub_rx_loop syzbot
2026-08-26 16:49 ` syzbot
2026-08-26 23:32   ` Hillf Danton
2026-08-26 23:33     ` syzbot
2026-08-26 23:46   ` Hillf Danton
2026-08-26 23:46     ` syzbot
2026-08-27  0:06   ` Hillf Danton
2026-08-27  0:06     ` syzbot
2026-08-27  0:17   ` Hillf Danton
2026-08-27  0:18     ` syzbot
2026-08-27  0:20   ` Hillf Danton
2026-08-27  0:21     ` syzbot
2026-08-27  0:25   ` Hillf Danton
2026-08-27  2:12     ` syzbot
2026-08-27  0:46   ` Edward Adam Davis
2026-08-27  2:31     ` syzbot
2026-08-27  1:21   ` [PATCH] usbip: prevent priv from uaf in cmd submit Edward Adam Davis
2026-09-23 13:25     ` Shuah Khan
  -- strict thread matches above, loose matches on Subject: below --
2026-08-27  5:32 [syzbot] [ntfs3?] general protection fault in al_destroy syzbot
2026-08-27  7:03 ` [syzbot] [usb?] KASAN: slab-use-after-free Read in stub_rx_loop Edward Adam Davis

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.