* Re: [syzbot] [usb?] KASAN: slab-use-after-free Read in ep_open [not found] <6a6bfa43.1b55b669.19788.0016.GAE@google.com> @ 2026-08-17 13:42 ` syzbot 2026-08-17 15:04 ` Jens Axboe 0 siblings, 1 reply; 6+ messages in thread From: syzbot @ 2026-08-17 13:42 UTC (permalink / raw) To: asml.silence, axboe, brauner, gregkh, io-uring, jack, kartikey406, kees, linux-kernel, linux-usb, mjguzik, nogikh, stern, syzbot, syzbot, syzkaller-bugs, syzkaller-upstream-moderation, torvalds, viro syzbot has bisected this issue to: commit aa00f67adc2c0d6439f81b5a81ff181377c47a7e Author: Jens Axboe <axboe@kernel.dk> Date: Tue Oct 22 19:47:00 2024 +0000 io_uring: add support for fixed wait regions bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=10e60679580000 start commit: 9a143525f62b Merge tag 'ata-7.2-rc7' of git://git.kernel.o.. git tree: upstream final oops: https://syzkaller.appspot.com/x/report.txt?x=12e60679580000 console output: https://syzkaller.appspot.com/x/log.txt?x=14e60679580000 kernel config: https://syzkaller.appspot.com/x/.config?x=c44651ea7dd2f307 dashboard link: https://syzkaller.appspot.com/bug?extid=df9e891bf8ea586f846b syz repro: https://syzkaller.appspot.com/x/repro.syz?x=120defb9580000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16323fb9580000 Reported-by: syzbot+df9e891bf8ea586f846b@syzkaller.appspotmail.com Fixes: aa00f67adc2c ("io_uring: add support for fixed wait regions") For information about bisection process see: https://goo.gl/tpsmEJ#bisection ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [syzbot] [usb?] KASAN: slab-use-after-free Read in ep_open 2026-08-17 13:42 ` [syzbot] [usb?] KASAN: slab-use-after-free Read in ep_open syzbot @ 2026-08-17 15:04 ` Jens Axboe 2026-08-17 15:45 ` Alan Stern 0 siblings, 1 reply; 6+ messages in thread From: Jens Axboe @ 2026-08-17 15:04 UTC (permalink / raw) To: syzbot, asml.silence, brauner, gregkh, io-uring, jack, kartikey406, kees, linux-kernel, linux-usb, mjguzik, nogikh, stern, syzbot, syzbot, syzkaller-bugs, syzkaller-upstream-moderation, torvalds, viro On 8/17/26 7:42 AM, syzbot wrote: > syzbot has bisected this issue to: > > commit aa00f67adc2c0d6439f81b5a81ff181377c47a7e > Author: Jens Axboe <axboe@kernel.dk> > Date: Tue Oct 22 19:47:00 2024 +0000 > > io_uring: add support for fixed wait regions > > bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=10e60679580000 > start commit: 9a143525f62b Merge tag 'ata-7.2-rc7' of git://git.kernel.o.. > git tree: upstream > final oops: https://syzkaller.appspot.com/x/report.txt?x=12e60679580000 > console output: https://syzkaller.appspot.com/x/log.txt?x=14e60679580000 > kernel config: https://syzkaller.appspot.com/x/.config?x=c44651ea7dd2f307 > dashboard link: https://syzkaller.appspot.com/bug?extid=df9e891bf8ea586f846b > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=120defb9580000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16323fb9580000 > > Reported-by: syzbot+df9e891bf8ea586f846b@syzkaller.appspotmail.com > Fixes: aa00f67adc2c ("io_uring: add support for fixed wait regions") That looks like nonsense, I strongly suspect it's a race and hence your bisection ends up being mostly useless as it sends you in random directions. -- Jens Axboe ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [syzbot] [usb?] KASAN: slab-use-after-free Read in ep_open 2026-08-17 15:04 ` Jens Axboe @ 2026-08-17 15:45 ` Alan Stern 2026-08-17 16:38 ` syzbot 0 siblings, 1 reply; 6+ messages in thread From: Alan Stern @ 2026-08-17 15:45 UTC (permalink / raw) To: Jens Axboe Cc: syzbot, asml.silence, brauner, gregkh, io-uring, jack, kartikey406, kees, linux-kernel, linux-usb, mjguzik, nogikh, syzbot, syzbot, syzkaller-bugs, syzkaller-upstream-moderation, torvalds, viro On Mon, Aug 17, 2026 at 09:04:06AM -0600, Jens Axboe wrote: > On 8/17/26 7:42 AM, syzbot wrote: > > syzbot has bisected this issue to: > > > > commit aa00f67adc2c0d6439f81b5a81ff181377c47a7e > > Author: Jens Axboe <axboe@kernel.dk> > > Date: Tue Oct 22 19:47:00 2024 +0000 > > > > io_uring: add support for fixed wait regions > > > > bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=10e60679580000 > > start commit: 9a143525f62b Merge tag 'ata-7.2-rc7' of git://git.kernel.o.. > > git tree: upstream > > final oops: https://syzkaller.appspot.com/x/report.txt?x=12e60679580000 > > console output: https://syzkaller.appspot.com/x/log.txt?x=14e60679580000 > > kernel config: https://syzkaller.appspot.com/x/.config?x=c44651ea7dd2f307 > > dashboard link: https://syzkaller.appspot.com/bug?extid=df9e891bf8ea586f846b > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=120defb9580000 > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16323fb9580000 > > > > Reported-by: syzbot+df9e891bf8ea586f846b@syzkaller.appspotmail.com > > Fixes: aa00f67adc2c ("io_uring: add support for fixed wait regions") > > That looks like nonsense, I strongly suspect it's a race and hence your > bisection ends up being mostly useless as it sends you in random directions. Agreed. The patch below has already been sent to the USB mailing list. Has syzbot tested it? Alan Stern #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ v7.2 From: Aleksandr Nogikh <nogikh@google.com> A race condition exists between opening a gadgetfs endpoint file and the destruction of the endpoint files, leading to a use-after-free of the ep_data object. When an endpoint file is opened, the VFS looks up the dentry and calls ep_open(). ep_open() retrieves the ep_data pointer from inode->i_private and attempts to lock its mutex. Concurrently, if the gadget is unbound, destroy_ep_files() iterates over the endpoints, unhashes their dentries, and immediately calls put_ep(). This drops the initial reference to the ep_data object, freeing it. If another thread is already in the process of opening the file, it holds a reference to the dentry and the inode. The inode remains alive, and its i_private pointer still points to the now-freed ep_data. When ep_open() proceeds to lock data->lock, it accesses freed memory. BUG: KASAN: slab-use-after-free in __mutex_lock_common kernel/locking/mutex.c:625 [inline] BUG: KASAN: slab-use-after-free in __mutex_lock+0x130/0xf14 kernel/locking/mutex.c:821 Read of size 8 at addr ffff0000f43acc58 by task syz-executor/5900 Call trace: __mutex_lock_common kernel/locking/mutex.c:625 [inline] __mutex_lock+0x130/0xf14 kernel/locking/mutex.c:821 mutex_lock_interruptible_nested+0x24/0x30 kernel/locking/mutex.c:899 ep_open+0x58/0x25c drivers/usb/gadget/legacy/inode.c:823 do_dentry_open+0x5c4/0xfc0 fs/open.c:947 vfs_open+0x44/0x2dc fs/open.c:1052 Freed by task 6138: kfree+0x188/0x690 mm/slub.c:6692 put_ep+0xd0/0x144 drivers/usb/gadget/legacy/inode.c:225 destroy_ep_files+0x244/0x2dc drivers/usb/gadget/legacy/inode.c:1582 gadgetfs_unbind+0x114/0x1f0 drivers/usb/gadget/legacy/inode.c:1655 gadget_unbind_driver+0x188/0x790 drivers/usb/gadget/udc/core.c:1724 To fix this, tie the base reference of ep_data to the lifetime of the inode rather than manually dropping it in destroy_ep_files(). Add an .evict_inode callback to gadget_fs_operations that drops the reference when the inode is finally destroyed. Remove the premature put_ep() call from destroy_ep_files(). Additionally, to prevent a double-free in the error path of activate_ep_files(), clear inode->i_private in gadgetfs_create_file() before calling iput() if simple_start_creating() fails. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Assisted-by: Gemini:gemini-3.5-flash Gemini:gemini-3.1-pro-preview syzbot Reported-by: syzbot+df9e891bf8ea586f846b@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=df9e891bf8ea586f846b Link: https://syzkaller.appspot.com/ai_job?id=ae49a838-5eb9-4227-93a3-56ad2313483a Signed-off-by: Aleksandr Nogikh <nogikh@google.com> --- diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c index d87a8ab51..a03062986 100644 --- a/drivers/usb/gadget/legacy/inode.c +++ b/drivers/usb/gadget/legacy/inode.c @@ -1579,8 +1579,6 @@ static void destroy_ep_files (struct dev_data *dev) /* break link to dcache */ simple_remove_by_name(dev->sb->s_root, ep->name, NULL); - put_ep (ep); - spin_lock_irq (&dev->lock); } spin_unlock_irq (&dev->lock); @@ -1996,6 +1994,7 @@ static int gadgetfs_create_file (struct super_block *sb, char const *name, dentry = simple_start_creating(sb->s_root, name); if (IS_ERR(dentry)) { + inode->i_private = NULL; iput(inode); return PTR_ERR(dentry); } @@ -2006,9 +2005,18 @@ static int gadgetfs_create_file (struct super_block *sb, char const *name, return 0; } +static void gadgetfs_evict_inode(struct inode *inode) +{ + truncate_inode_pages_final(&inode->i_data); + clear_inode(inode); + if (inode->i_private && inode->i_fop == &ep_io_operations) + put_ep(inode->i_private); +} + static const struct super_operations gadget_fs_operations = { .statfs = simple_statfs, .drop_inode = inode_just_drop, + .evict_inode = gadgetfs_evict_inode, }; static int base-commit: f5098b6bae761e346ebcd9da7f95622c04733cff -- See https://goo.gle/syzbot-ai-patches for information about AI-generated patches. You can comment on the patch as usual, syzbot will try to address the comments and send a new version of the patch if necessary. syzbot engineers can be reached at syzkaller@googlegroups.com. ^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [syzbot] [usb?] KASAN: slab-use-after-free Read in ep_open 2026-08-17 15:45 ` Alan Stern @ 2026-08-17 16:38 ` syzbot 2026-08-17 18:14 ` Alan Stern 0 siblings, 1 reply; 6+ messages in thread From: syzbot @ 2026-08-17 16:38 UTC (permalink / raw) To: asml.silence, axboe, brauner, gregkh, io-uring, jack, kartikey406, kees, linux-kernel, linux-usb, mjguzik, nogikh, stern, syzbot, syzbot, syzkaller-bugs, syzkaller-upstream-moderation, torvalds, viro Hello, syzbot has tested the proposed patch and the reproducer did not trigger any issue: Reported-by: syzbot+df9e891bf8ea586f846b@syzkaller.appspotmail.com Tested-by: syzbot+df9e891bf8ea586f846b@syzkaller.appspotmail.com Tested on: commit: 8d3ae592 Linux 7.2 git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ v7.2 console output: https://syzkaller.appspot.com/x/log.txt?x=16a91a25580000 kernel config: https://syzkaller.appspot.com/x/.config?x=c44651ea7dd2f307 dashboard link: https://syzkaller.appspot.com/bug?extid=df9e891bf8ea586f846b compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 patch: https://syzkaller.appspot.com/x/patch.diff?x=15790679580000 Note: testing is done by a robot and is best-effort only. ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [syzbot] [usb?] KASAN: slab-use-after-free Read in ep_open 2026-08-17 16:38 ` syzbot @ 2026-08-17 18:14 ` Alan Stern 2026-08-18 7:42 ` Greg KH 0 siblings, 1 reply; 6+ messages in thread From: Alan Stern @ 2026-08-17 18:14 UTC (permalink / raw) To: Greg KH Cc: syzbot, asml.silence, axboe, brauner, io-uring, jack, kartikey406, kees, linux-kernel, linux-usb, mjguzik, nogikh, syzbot, syzbot, syzkaller-bugs, syzkaller-upstream-moderation, torvalds, viro On Mon, Aug 17, 2026 at 09:38:02AM -0700, syzbot wrote: > Hello, > > syzbot has tested the proposed patch and the reproducer did not trigger any issue: > > Reported-by: syzbot+df9e891bf8ea586f846b@syzkaller.appspotmail.com > Tested-by: syzbot+df9e891bf8ea586f846b@syzkaller.appspotmail.com > > Tested on: > > commit: 8d3ae592 Linux 7.2 > git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ v7.2 > console output: https://syzkaller.appspot.com/x/log.txt?x=16a91a25580000 > kernel config: https://syzkaller.appspot.com/x/.config?x=c44651ea7dd2f307 > dashboard link: https://syzkaller.appspot.com/bug?extid=df9e891bf8ea586f846b > compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 > patch: https://syzkaller.appspot.com/x/patch.diff?x=15790679580000 > > Note: testing is done by a robot and is best-effort only. Greg: Has this patch ever been queued? https://lore.kernel.org/linux-usb/ee41fbfd-f368-4a06-95d6-ae9b4267fd82@mail.kernel.org/ Looks like you can add syzbot's Tested-by: tag, as well as my Acked-by:. Note that a different patch to fix the same problem was submitted here: https://lore.kernel.org/linux-usb/20260731230603.4637-1-kartikey406@gmail.com/ IMO the first patch above is superior. Alan Stern ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [syzbot] [usb?] KASAN: slab-use-after-free Read in ep_open 2026-08-17 18:14 ` Alan Stern @ 2026-08-18 7:42 ` Greg KH 0 siblings, 0 replies; 6+ messages in thread From: Greg KH @ 2026-08-18 7:42 UTC (permalink / raw) To: Alan Stern Cc: syzbot, asml.silence, axboe, brauner, io-uring, jack, kartikey406, kees, linux-kernel, linux-usb, mjguzik, nogikh, syzbot, syzbot, syzkaller-bugs, syzkaller-upstream-moderation, torvalds, viro On Mon, Aug 17, 2026 at 02:14:17PM -0400, Alan Stern wrote: > On Mon, Aug 17, 2026 at 09:38:02AM -0700, syzbot wrote: > > Hello, > > > > syzbot has tested the proposed patch and the reproducer did not trigger any issue: > > > > Reported-by: syzbot+df9e891bf8ea586f846b@syzkaller.appspotmail.com > > Tested-by: syzbot+df9e891bf8ea586f846b@syzkaller.appspotmail.com > > > > Tested on: > > > > commit: 8d3ae592 Linux 7.2 > > git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ v7.2 > > console output: https://syzkaller.appspot.com/x/log.txt?x=16a91a25580000 > > kernel config: https://syzkaller.appspot.com/x/.config?x=c44651ea7dd2f307 > > dashboard link: https://syzkaller.appspot.com/bug?extid=df9e891bf8ea586f846b > > compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 > > patch: https://syzkaller.appspot.com/x/patch.diff?x=15790679580000 > > > > Note: testing is done by a robot and is best-effort only. > > Greg: > > Has this patch ever been queued? > > https://lore.kernel.org/linux-usb/ee41fbfd-f368-4a06-95d6-ae9b4267fd82@mail.kernel.org/ No because it looks like there are competing patches here as you point out. > Looks like you can add syzbot's Tested-by: tag, as well as my Acked-by:. > > Note that a different patch to fix the same problem was submitted here: > > https://lore.kernel.org/linux-usb/20260731230603.4637-1-kartikey406@gmail.com/ > > IMO the first patch above is superior. So Aleksandr's patch should be applied and not Deepanshu's? thanks, greg k-h ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-08-18 7:42 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <6a6bfa43.1b55b669.19788.0016.GAE@google.com>
2026-08-17 13:42 ` [syzbot] [usb?] KASAN: slab-use-after-free Read in ep_open syzbot
2026-08-17 15:04 ` Jens Axboe
2026-08-17 15:45 ` Alan Stern
2026-08-17 16:38 ` syzbot
2026-08-17 18:14 ` Alan Stern
2026-08-18 7:42 ` Greg KH
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).