* [PATCH i2c-fixes v1] i2c: core: Fix use-after-free during i2c device removal
@ 2026-08-22 6:26 Rafael Alejandro Diaz Cruz
2026-08-22 8:51 ` Hillf Danton
0 siblings, 1 reply; 10+ messages in thread
From: Rafael Alejandro Diaz Cruz @ 2026-08-22 6:26 UTC (permalink / raw)
To: Andi Shyti, linux-i2c, linux-kernel
Cc: Rafael Alejandro Diaz Cruz, syzbot+227dbc9afd022922d624
A race condition between a process calling i2c_device_probe()
and removal of a USB device by another process leading to both
processes calling debugfs_remove() opens up the possibility of
UAF.
Fix it by adding atomic xchg() and replacing &client->debugfs
with null before calling debugfs_remove() such that the
following statement: "if (IS_ERR_OR_NULL(dentry)) return;"
inside of debugfs_remove() executes properly.
Fixes: d06905d68610 ("i2c: add core-managed per-client directory in debugfs")
Reported-by: syzbot+227dbc9afd022922d624@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=227dbc9afd022922d624
Signed-off-by: Rafael Alejandro Diaz Cruz <rafad900@gmail.com>
---
drivers/i2c/i2c-core-base.c | 23 ++++++++++++++++++-----
1 file changed, 18 insertions(+), 5 deletions(-)
diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
index fb25704219c7..6fe11232f5ee 100644
--- a/drivers/i2c/i2c-core-base.c
+++ b/drivers/i2c/i2c-core-base.c
@@ -586,8 +586,14 @@ static int i2c_device_probe(struct device *dev)
goto err_clear_wakeup_irq;
}
- client->debugfs = debugfs_create_dir(dev_name(&client->dev),
- client->adapter->debugfs);
+ struct dentry *parent = READ_ONCE(client->adapter->debugfs);
+
+ if (!parent) {
+ status = -ENODEV;
+ goto err_clear_wakeup_irq;
+ }
+
+ client->debugfs = debugfs_create_dir(dev_name(&client->dev), parent);
if (driver->probe)
status = driver->probe(client);
@@ -608,7 +614,10 @@ static int i2c_device_probe(struct device *dev)
return 0;
err_release_driver_resources:
- debugfs_remove_recursive(client->debugfs);
+ // debugfs_remove_recursive(client->debugfs);
+ struct dentry *dir = xchg(&client->debugfs, NULL);
+
+ debugfs_remove_recursive(dir);
devres_release_group(&client->dev, client->devres_group_id);
err_clear_wakeup_irq:
dev_pm_clear_wake_irq(&client->dev);
@@ -632,7 +641,9 @@ static void i2c_device_remove(struct device *dev)
driver->remove(client);
}
- debugfs_remove_recursive(client->debugfs);
+ struct dentry *dir = xchg(&client->debugfs, NULL);
+
+ debugfs_remove_recursive(dir);
devres_release_group(&client->dev, client->devres_group_id);
@@ -1818,6 +1829,8 @@ void i2c_del_adapter(struct i2c_adapter *adap)
i2c_acpi_remove_space_handler(adap);
+ struct dentry *dir = xchg(&adap->debugfs, NULL);
+
i2c_deregister_clients(adap);
/* device name is gone after device_unregister */
@@ -1827,7 +1840,7 @@ void i2c_del_adapter(struct i2c_adapter *adap)
i2c_host_notify_irq_teardown(adap);
- debugfs_remove_recursive(adap->debugfs);
+ debugfs_remove_recursive(dir);
/* wait until all references to the device are gone
*
--
2.43.0
^ permalink raw reply related [flat|nested] 10+ messages in thread* Re: [PATCH i2c-fixes v1] i2c: core: Fix use-after-free during i2c device removal 2026-08-22 6:26 [PATCH i2c-fixes v1] i2c: core: Fix use-after-free during i2c device removal Rafael Alejandro Diaz Cruz @ 2026-08-22 8:51 ` Hillf Danton 2026-08-22 9:25 ` [syzbot] [fs?] [usb?] KASAN: slab-use-after-free Read in lockref_get (2) syzbot [not found] ` <CALp66yH7QzvGmo+N7BWykYjoaGT-yAezwRv0Pc_ir6qDRTsKvw@mail.gmail.com> 0 siblings, 2 replies; 10+ messages in thread From: Hillf Danton @ 2026-08-22 8:51 UTC (permalink / raw) To: syzbot+227dbc9afd022922d624 Cc: Rafael Alejandro Diaz Cruz, Andi Shyti, syzkaller-bugs, linux-i2c, linux-kernel #syz test A race condition between a process calling i2c_device_probe() and removal of a USB device by another process leading to both processes calling debugfs_remove() opens up the possibility of UAF. Fix it by adding atomic xchg() and replacing &client->debugfs with null before calling debugfs_remove() such that the following statement: "if (IS_ERR_OR_NULL(dentry)) return;" inside of debugfs_remove() executes properly. Fixes: d06905d68610 ("i2c: add core-managed per-client directory in debugfs") Reported-by: syzbot+227dbc9afd022922d624@syzkaller.appspotmail.com Link: https://syzkaller.appspot.com/bug?extid=227dbc9afd022922d624 Signed-off-by: Rafael Alejandro Diaz Cruz <rafad900@gmail.com> --- drivers/i2c/i2c-core-base.c | 23 ++++++++++++++++++----- 1 file changed, 18 insertions(+), 5 deletions(-) diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c index fb25704219c7..6fe11232f5ee 100644 --- a/drivers/i2c/i2c-core-base.c +++ b/drivers/i2c/i2c-core-base.c @@ -586,8 +586,14 @@ static int i2c_device_probe(struct device *dev) goto err_clear_wakeup_irq; } - client->debugfs = debugfs_create_dir(dev_name(&client->dev), - client->adapter->debugfs); + struct dentry *parent = READ_ONCE(client->adapter->debugfs); + + if (!parent) { + status = -ENODEV; + goto err_clear_wakeup_irq; + } + + client->debugfs = debugfs_create_dir(dev_name(&client->dev), parent); if (driver->probe) status = driver->probe(client); @@ -608,7 +614,10 @@ static int i2c_device_probe(struct device *dev) return 0; err_release_driver_resources: - debugfs_remove_recursive(client->debugfs); + // debugfs_remove_recursive(client->debugfs); + struct dentry *dir = xchg(&client->debugfs, NULL); + + debugfs_remove_recursive(dir); devres_release_group(&client->dev, client->devres_group_id); err_clear_wakeup_irq: dev_pm_clear_wake_irq(&client->dev); @@ -632,7 +641,9 @@ static void i2c_device_remove(struct device *dev) driver->remove(client); } - debugfs_remove_recursive(client->debugfs); + struct dentry *dir = xchg(&client->debugfs, NULL); + + debugfs_remove_recursive(dir); devres_release_group(&client->dev, client->devres_group_id); @@ -1818,6 +1829,8 @@ void i2c_del_adapter(struct i2c_adapter *adap) i2c_acpi_remove_space_handler(adap); + struct dentry *dir = xchg(&adap->debugfs, NULL); + i2c_deregister_clients(adap); /* device name is gone after device_unregister */ @@ -1827,7 +1840,7 @@ void i2c_del_adapter(struct i2c_adapter *adap) i2c_host_notify_irq_teardown(adap); - debugfs_remove_recursive(adap->debugfs); + debugfs_remove_recursive(dir); /* wait until all references to the device are gone * -- 2.43.0 ^ permalink raw reply related [flat|nested] 10+ messages in thread
* Re: [syzbot] [fs?] [usb?] KASAN: slab-use-after-free Read in lockref_get (2) 2026-08-22 8:51 ` Hillf Danton @ 2026-08-22 9:25 ` syzbot [not found] ` <CALp66yH7QzvGmo+N7BWykYjoaGT-yAezwRv0Pc_ir6qDRTsKvw@mail.gmail.com> 1 sibling, 0 replies; 10+ messages in thread From: syzbot @ 2026-08-22 9:25 UTC (permalink / raw) To: andi.shyti, hdanton, linux-i2c, linux-kernel, rafad900, syzkaller-bugs Hello, syzbot tried to test the proposed patch but the build/boot failed: pm: mask: 0xffffff max_cycles: 0xffffff, max_idle_ns: 2085701024 ns [ 3.320347][ T1] NET: Registered PF_INET protocol family [ 3.322856][ T1] IP idents hash table entries: 131072 (order: 8, 1048576 bytes, vmalloc) [ 3.336708][ T1] tcp_listen_portaddr_hash hash table entries: 4096 (order: 7, 294912 bytes, vmalloc) [ 3.339060][ T1] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, vmalloc) [ 3.341172][ T1] TCP established hash table entries: 65536 (order: 7, 524288 bytes, vmalloc) [ 3.352671][ T1] TCP bind hash table entries: 65536 (order: 12, 9437184 bytes, vmalloc hugepage) [ 3.359566][ T1] TCP: Hash tables configured (established 65536 bind 65536) [ 3.362810][ T1] MPTCP token hash table entries: 8192 (order: 8, 720896 bytes, vmalloc) [ 3.365711][ T1] UDP hash table entries: 4096 (order: 8, 1048576 bytes, vmalloc) [ 3.368753][ T1] NET: Registered PF_UNIX/PF_LOCAL protocol family [ 3.393847][ T1] RPC: Registered named UNIX socket transport module. [ 3.395099][ T1] RPC: Registered udp transport module. [ 3.395874][ T1] RPC: Registered tcp transport module. [ 3.396658][ T1] RPC: Registered tcp-with-tls transport module. [ 3.397537][ T1] RPC: Registered tcp NFSv4.1 backchannel transport module. [ 3.413324][ T1] NET: Registered PF_XDP protocol family [ 3.414554][ T1] pci_bus 0000:00: resource 4 [io 0x0000-0x0cf7 window] [ 3.415698][ T1] pci_bus 0000:00: resource 5 [io 0x0d00-0x0fff window] [ 3.416687][ T1] pci_bus 0000:00: resource 6 [io 0xc000-0xffff window] [ 3.417767][ T1] pci_bus 0000:00: resource 7 [io 0xa000-0xbfff window] [ 3.418871][ T1] pci_bus 0000:00: resource 8 [mem 0x000a0000-0x000bffff window] [ 3.419953][ T1] pci_bus 0000:00: resource 9 [mem 0xc0000000-0xfebfefff window] [ 3.422539][ T1] pci 0000:00:00.0: Limiting direct PCI/PCI transfers [ 3.423826][ T1] PCI: CLS 0 bytes, default 64 [ 3.426230][ T1] PCI-DMA: Using software bounce buffering for IO (SWIOTLB) [ 3.427263][ T1] software IO TLB: mapped [mem 0x00000000b4400000-0x00000000b8400000] (64MB) [ 3.435273][ T1] ACPI: bus type thunderbolt registered [ 3.443694][ T1] RAPL PMU: API unit is 2^-32 Joules, 0 fixed counters, 10737418240 ms ovfl timer [ 3.447762][ T59] kworker/u8:1 (59) used greatest stack depth: 29032 bytes left [ 3.450226][ T58] kworker/u8:1 (58) used greatest stack depth: 27864 bytes left [ 3.469069][ T1] kvm_amd: CPU 1 isn't AMD or Hygon [ 3.469872][ T1] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x285cff649df, max_idle_ns: 440795263193 ns [ 3.471672][ T1] clocksource: Switched to clocksource tsc [ 3.481565][ T66] kworker/u8:3 (66) used greatest stack depth: 25768 bytes left [ 3.500131][ T1] Initialise system trusted keyrings [ 3.502858][ T1] workingset: timestamp_bits=40 (anon: 35) max_order=21 bucket_order=0 (anon: 0) [ 3.512501][ T1] DLM installed [ 3.517800][ T1] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 3.536175][ T1] NFS: Registering the id_resolver key type [ 3.537128][ T1] Key type id_resolver registered [ 3.538012][ T1] Key type id_legacy registered [ 3.539140][ T1] nfs4filelayout_init: NFSv4 File Layout Driver Registering... [ 3.540371][ T1] nfs4flexfilelayout_init: NFSv4 Flexfile Layout Driver Registering... [ 3.547553][ T1] smbdirect: subsystem loading... [ 3.564900][ T1] smbdirect: subsystem loaded [ 3.598084][ T1] Key type cifs.spnego registered [ 3.599281][ T1] Key type cifs.idmap registered [ 3.603336][ T1] ntfs3: Enabled Linux POSIX ACLs support [ 3.604159][ T1] ntfs3: Read-only LZX/Xpress compression included [ 3.605869][ T1] jffs2: version 2.2. (NAND) (SUMMARY) © 2001-2006 Red Hat, Inc. [ 3.609511][ T1] romfs: ROMFS MTD (C) 2007 Red Hat, Inc. [ 3.610587][ T1] QNX4 filesystem 0.2.3 registered. [ 3.611550][ T1] qnx6: QNX6 filesystem 1.0.0 registered. [ 3.613253][ T1] fuse: init (API version 7.45) [ 3.616782][ T1] orangefs_debugfs_init: called with debug mask: :none: :0: [ 3.619251][ T1] orangefs_init: module version upstream loaded [ 3.621005][ T1] JFS: nTxBlock = 8192, nTxLock = 65536 [ 3.633589][ T1] SGI XFS with ACLs, security attributes, realtime, scrub, repair, quota, no debug enabled [ 3.643027][ T1] 9p: Installing v9fs 9p2000 file system support [ 3.645565][ T1] NILFS version 2 loaded [ 3.646261][ T1] befs: version: 0.9.3 [ 3.647689][ T1] ocfs2: Registered cluster interface o2cb [ 3.650626][ T1] ocfs2: Registered cluster interface user [ 3.652098][ T1] OCFS2 User DLM kernel interface loaded [ 3.674039][ T1] gfs2: GFS2 installed [ 3.688972][ T1] ceph: loaded (mds proto 32) [ 3.702507][ T1] NET: Registered PF_ALG protocol family [ 3.703631][ T1] async_tx: api initialized (async) [ 3.704425][ T1] Key type asymmetric registered [ 3.705357][ T1] Asymmetric key parser 'x509' registered [ 3.706303][ T1] Asymmetric key parser 'pkcs8' registered [ 3.707095][ T1] Key type pkcs7_test registered [ 3.708694][ T1] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 239) [ 3.711217][ T1] io scheduler mq-deadline registered [ 3.712022][ T1] io scheduler kyber registered [ 3.713500][ T1] io scheduler bfq registered [ 3.733250][ T1] input: Power Button as /devices/platform/LNXPWRBN:00/input/input0 [ 3.737243][ T1] ACPI: button: Power Button [PWRF] [ 3.740294][ T1] input: Sleep Button as /devices/platform/LNXSLPBN:00/input/input1 [ 3.743488][ T1] ACPI: button: Sleep Button [SLPF] [ 3.760851][ T1] ioatdma: Intel(R) QuickData Technology Driver 5.00 [ 3.795590][ T122] ACPI: \_SB_.LNKC: Enabled at IRQ 11 [ 3.796719][ T122] virtio-pci 0000:00:03.0: virtio_pci: leaving for legacy driver [ 3.828286][ T122] ACPI: \_SB_.LNKD: Enabled at IRQ 10 [ 3.829202][ T122] virtio-pci 0000:00:04.0: virtio_pci: leaving for legacy driver [ 3.859623][ T122] ACPI: \_SB_.LNKB: Enabled at IRQ 10 [ 3.860539][ T122] virtio-pci 0000:00:06.0: virtio_pci: leaving for legacy driver [ 4.463278][ T1] N_HDLC line discipline registered with maxframe=4096 [ 4.467787][ T1] Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled [ 4.476224][ T1] 00:02: ttyS0 at I/O 0x3f8 (irq = 4, base_baud = 115200) is a 16550A [ 4.493361][ T1] 00:03: ttyS1 at I/O 0x2f8 (irq = 3, base_baud = 115200) is a 16550A [ 4.509251][ T1] 00:04: ttyS2 at I/O 0x3e8 (irq = 6, base_baud = 115200) is a 16550A [ 4.526430][ T1] 00:05: ttyS3 at I/O 0x2e8 (irq = 7, base_baud = 115200) is a 16550A [ 4.559677][ T1] Non-volatile memory driver v1.3 [ 4.580110][ T1] usbcore: registered new interface driver xillyusb [ 4.585483][ T1] ACPI: bus type drm_connector registered [ 4.594378][ T1] [drm] Initialized vgem 1.0.0 for vgem on minor 0 [ 4.603925][ T1] ------------[ cut here ]------------ [ 4.605301][ T1] [PLANE:35:plane-0] pixel format with alpha exposed but blend mode not setup [ 4.605324][ T1] WARNING: drivers/gpu/drm/drm_mode_config.c:872 at drm_mode_config_validate+0xfb4/0x1be0, CPU#1: swapper/0/1 [ 4.608698][ T1] Modules linked in: [ 4.609287][ T1] CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full) [ 4.610609][ T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 4.612083][ T1] RIP: 0010:drm_mode_config_validate+0xfbb/0x1be0 [ 4.613020][ T1] Code: 00 49 8b 57 18 48 89 f8 48 c1 e8 03 0f b6 04 28 84 c0 74 08 3c 03 0f 8e 00 0b 00 00 48 8d 3d bc 2b 81 0b 41 8b b7 c8 00 00 00 <67> 48 0f b9 3a e9 fa fd ff ff 48 8b 5c 24 20 e8 c1 ab 3c fc 48 8d [ 4.616410][ T1] RSP: 0000:ffffc90000067c18 EFLAGS: 00010246 [ 4.617338][ T1] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 4.618540][ T1] RDX: ffff88801dffdb00 RSI: 0000000000000023 RDI: ffffffff914f9390 [ 4.619686][ T1] RBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000000 [ 4.620824][ T1] R10: 0000000000000001 R11: 0000000000000000 R12: ffffed1004f76023 [ 4.621960][ T1] R13: ffffed1004f76024 R14: 0000000000000001 R15: ffff888027bb0028 [ 4.623049][ T1] FS: 0000000000000000(0000) GS:ffff888123c83000(0000) knlGS:0000000000000000 [ 4.624304][ T1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 4.625982][ T1] CR2: 0000000000000000 CR3: 000000000eb94000 CR4: 00000000003526f0 [ 4.627366][ T1] Call Trace: [ 4.628060][ T1] <TASK> [ 4.628536][ T1] drm_dev_register+0x56e/0x7b0 [ 4.629278][ T1] vkms_create+0x491/0x5b0 [ 4.630003][ T1] ? __pfx_vkms_init+0x10/0x10 [ 4.630947][ T1] vkms_init+0x98/0xe0 [ 4.631562][ T1] do_one_initcall+0x11c/0x6f0 [ 4.632307][ T1] ? __pfx_do_one_initcall+0x10/0x10 [ 4.633099][ T1] ? kasan_unpoison+0x27/0x60 [ 4.633765][ T1] ? kernel_init_freeable+0x4ca/0x7b0 [ 4.634537][ T1] kernel_init_freeable+0x6ea/0x7b0 [ 4.635547][ T1] ? __pfx_kernel_init+0x10/0x10 [ 4.636310][ T1] kernel_init+0x21/0x1e0 [ 4.637019][ T1] ? __pfx_kernel_init+0x10/0x10 [ 4.637931][ T1] ret_from_fork+0x730/0xd60 [ 4.638635][ T1] ? __pfx_ret_from_fork+0x10/0x10 [ 4.639447][ T1] ? __switch_to+0x800/0x10f0 [ 4.640129][ T1] ? __pfx_kernel_init+0x10/0x10 [ 4.640843][ T1] ret_from_fork_asm+0x1a/0x30 [ 4.641540][ T1] </TASK> [ 4.641984][ T1] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 4.642965][ T1] CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full) [ 4.644186][ T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 4.645282][ T1] Call Trace: [ 4.645282][ T1] <TASK> [ 4.645282][ T1] dump_stack_lvl+0x100/0x190 [ 4.645282][ T1] vpanic+0x553/0x970 [ 4.645282][ T1] ? __pfx_vpanic+0x10/0x10 [ 4.645282][ T1] panic+0xd1/0xe0 [ 4.645282][ T1] ? __pfx_panic+0x10/0x10 [ 4.645282][ T1] check_panic_on_warn.cold+0x19/0x34 [ 4.645282][ T1] ? drm_mode_config_validate+0xfb4/0x1be0 [ 4.645282][ T1] __warn.cold+0x191/0x318 [ 4.645282][ T1] __report_bug+0x30f/0x440 [ 4.645282][ T1] ? drm_mode_config_validate+0xfb4/0x1be0 [ 4.645282][ T1] ? __pfx___report_bug+0x10/0x10 [ 4.645282][ T1] ? __lock_acquire+0x4c5/0x1ec0 [ 4.654883][ T1] report_bug_entry+0xe2/0x290 [ 4.654883][ T1] ? drm_mode_config_validate+0xfbb/0x1be0 [ 4.654883][ T1] handle_bug+0x1cd/0x2a0 [ 4.654883][ T1] exc_invalid_op+0x17/0x50 [ 4.654883][ T1] asm_exc_invalid_op+0x1a/0x20 [ 4.654883][ T1] RIP: 0010:drm_mode_config_validate+0xfbb/0x1be0 [ 4.654883][ T1] Code: 00 49 8b 57 18 48 89 f8 48 c1 e8 03 0f b6 04 28 84 c0 74 08 3c 03 0f 8e 00 0b 00 00 48 8d 3d bc 2b 81 0b 41 8b b7 c8 00 00 00 <67> 48 0f b9 3a e9 fa fd ff ff 48 8b 5c 24 20 e8 c1 ab 3c fc 48 8d [ 4.654883][ T1] RSP: 0000:ffffc90000067c18 EFLAGS: 00010246 [ 4.654883][ T1] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 4.654883][ T1] RDX: ffff88801dffdb00 RSI: 0000000000000023 RDI: ffffffff914f9390 [ 4.654883][ T1] RBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000000 [ 4.654883][ T1] R10: 0000000000000001 R11: 0000000000000000 R12: ffffed1004f76023 [ 4.654883][ T1] R13: ffffed1004f76024 R14: 0000000000000001 R15: ffff888027bb0028 [ 4.654883][ T1] ? drm_mode_config_validate+0xf76/0x1be0 [ 4.654883][ T1] drm_dev_register+0x56e/0x7b0 [ 4.654883][ T1] vkms_create+0x491/0x5b0 [ 4.654883][ T1] ? __pfx_vkms_init+0x10/0x10 [ 4.654883][ T1] vkms_init+0x98/0xe0 [ 4.654883][ T1] do_one_initcall+0x11c/0x6f0 [ 4.654883][ T1] ? __pfx_do_one_initcall+0x10/0x10 [ 4.654883][ T1] ? kasan_unpoison+0x27/0x60 [ 4.654883][ T1] ? kernel_init_freeable+0x4ca/0x7b0 [ 4.654883][ T1] kernel_init_freeable+0x6ea/0x7b0 [ 4.654883][ T1] ? __pfx_kernel_init+0x10/0x10 [ 4.654883][ T1] kernel_init+0x21/0x1e0 [ 4.654883][ T1] ? __pfx_kernel_init+0x10/0x10 [ 4.654883][ T1] ret_from_fork+0x730/0xd60 [ 4.654883][ T1] ? __pfx_ret_from_fork+0x10/0x10 [ 4.654883][ T1] ? __switch_to+0x800/0x10f0 [ 4.654883][ T1] ? __pfx_kernel_init+0x10/0x10 [ 4.654883][ T1] ret_from_fork_asm+0x1a/0x30 [ 4.654883][ T1] </TASK> [ 4.654883][ T1] Kernel Offset: disabled [ 4.654883][ T1] Rebooting in 86400 seconds.. syzkaller build log: go env (err=<nil>) AR='ar' CC='gcc' CGO_CFLAGS='-O2 -g' CGO_CPPFLAGS='' CGO_CXXFLAGS='-O2 -g' CGO_ENABLED='1' CGO_FFLAGS='-O2 -g' CGO_LDFLAGS='-O2 -g' CXX='g++' GCCGO='gccgo' GO111MODULE='auto' GOAMD64='v1' GOARCH='amd64' GOAUTH='netrc' GOBIN='' GOCACHE='/syzkaller/.cache/go-build' GOCACHEPROG='' GODEBUG='' GOENV='/syzkaller/.config/go/env' GOEXE='' GOEXPERIMENT='' GOFIPS140='off' GOFLAGS='' GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build3894593634=/tmp/go-build -gno-record-gcc-switches' GOHOSTARCH='amd64' GOHOSTOS='linux' GOINSECURE='' GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod' GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod' GONOPROXY='' GONOSUMDB='' GOOS='linux' GOPATH='/syzkaller/jobs-2/linux/gopath' GOPRIVATE='' GOPROXY='https://proxy.golang.org,direct' GOROOT='/usr/local/go' GOSUMDB='sum.golang.org' GOTELEMETRY='local' GOTELEMETRYDIR='/syzkaller/.config/go/telemetry' GOTMPDIR='' GOTOOLCHAIN='auto' GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64' GOVCS='' GOVERSION='go1.26.0' GOWORK='' PKG_CONFIG='pkg-config' git status (err=<nil>) HEAD detached at 05b26a281c0 nothing to commit, working tree clean tput: No value for $TERM and no -T specified tput: No value for $TERM and no -T specified Makefile:31: run command via tools/syz-env for best compatibility, see: Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=05b26a281c072cc34dcad83a283fd2aeeff18ad1 -X github.com/google/syzkaller/prog.gitRevisionDate=20260724-140511" ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=05b26a281c072cc34dcad83a283fd2aeeff18ad1 -X github.com/google/syzkaller/prog.gitRevisionDate=20260724-140511" ./sys/syz-sysgen make .descriptions tput: No value for $TERM and no -T specified tput: No value for $TERM and no -T specified Makefile:31: run command via tools/syz-env for best compatibility, see: Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env bin/syz-sysgen touch .descriptions GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=05b26a281c072cc34dcad83a283fd2aeeff18ad1 -X github.com/google/syzkaller/prog.gitRevisionDate=20260724-140511" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog mkdir -p ./bin/linux_amd64 g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \ -m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_amd64=1 \ -DHOSTGOOS_linux=1 -DGIT_REVISION=\"05b26a281c072cc34dcad83a283fd2aeeff18ad1\" /usr/bin/ld: /tmp/cchHMbJf.o: in function `Connection::Connect(char const*, char const*)': executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x386): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking ./tools/check-syzos.sh 2>/dev/null Error text is too large and was truncated, full error text is at: https://syzkaller.appspot.com/x/error.txt?x=11570625580000 Tested on: commit: 26260251 Merge tag 'livepatching-for-7.3' of git://git.. git tree: upstream kernel config: https://syzkaller.appspot.com/x/.config?x=49d6006e566a6d95 dashboard link: https://syzkaller.appspot.com/bug?extid=227dbc9afd022922d624 compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 patch: https://syzkaller.appspot.com/x/patch.diff?x=14789549580000 ^ permalink raw reply [flat|nested] 10+ messages in thread
[parent not found: <CALp66yH7QzvGmo+N7BWykYjoaGT-yAezwRv0Pc_ir6qDRTsKvw@mail.gmail.com>]
[parent not found: <CALp66yFrutQ2h8SNyBZn04+LMPMnSEtWxW_Dr0vzfoHvEahSsQ@mail.gmail.com>]
* Re: [syzbot] [fs?] [usb?] KASAN: slab-use-after-free Read in lockref_get (2) [not found] ` <CALp66yFrutQ2h8SNyBZn04+LMPMnSEtWxW_Dr0vzfoHvEahSsQ@mail.gmail.com> @ 2026-08-22 19:11 ` syzbot 2026-08-22 19:37 ` [PATCH i2c-fixes v1] i2c: core: Fix use-after-free during i2c device removal Rafael Alejandro Díaz Cruz 1 sibling, 0 replies; 10+ messages in thread From: syzbot @ 2026-08-22 19:11 UTC (permalink / raw) To: andi.shyti, hdanton, linux-i2c, linux-kernel, rafad900, syzkaller-bugs Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: general protection fault in start_dirop Oops: general protection fault, probably for non-canonical address 0xdffffc0000000028: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000140-0x0000000000000147] CPU: 0 UID: 0 PID: 6528 Comm: syz.3.20 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 RIP: 0010:kasan_byte_accessible+0x15/0x30 mm/kasan/generic.c:210 Code: 00 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 b8 00 00 00 00 00 fc ff df 48 c1 ef 03 48 01 c7 <0f> b6 07 3c 07 0f 96 c0 e9 0e 33 43 09 66 66 2e 0f 1f 84 00 00 00 RSP: 0018:ffffc90003abf4b0 EFLAGS: 00010286 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff81e53a84 RDI: dffffc0000000028 RBP: 0000000000000140 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff81e53a84 R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000000 FS: 00007f2d04fb66c0(0000) GS:ffff888123dde000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2fa63fff CR3: 000000005762d000 CR4: 00000000003526f0 Call Trace: <TASK> __kasan_check_byte+0x13/0x50 mm/kasan/common.c:573 kasan_check_byte include/linux/kasan.h:402 [inline] lock_acquire kernel/locking/lockdep.c:5842 [inline] lock_acquire+0x132/0x370 kernel/locking/lockdep.c:5825 down_write_nested+0x94/0x200 kernel/locking/rwsem.c:1757 inode_lock_nested include/linux/fs.h:1069 [inline] __start_dirop fs/namei.c:2918 [inline] start_dirop+0x4b/0xb0 fs/namei.c:2942 simple_start_creating+0xf9/0x110 fs/libfs.c:2305 debugfs_start_creating.part.0+0x82/0x170 fs/debugfs/inode.c:394 debugfs_start_creating fs/debugfs/inode.c:371 [inline] debugfs_create_dir+0x72/0x440 fs/debugfs/inode.c:572 i2c_device_probe+0x5f5/0xd10 drivers/i2c/i2c-core-base.c:588 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x64/0x160 drivers/base/bus.c:620 device_add+0x121d/0x1970 drivers/base/core.c:3772 i2c_new_client_device+0x660/0xd30 drivers/i2c/i2c-core-base.c:1019 new_device_store+0x20f/0x420 drivers/i2c/i2c-core-base.c:1307 dev_attr_store+0x58/0x80 drivers/base/core.c:2505 sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145 kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2d0419de99 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f2d04fb6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f2d04425fa0 RCX: 00007f2d0419de99 RDX: 000000000000000f RSI: 0000200000000700 RDI: 0000000000000004 RBP: 00007f2d04233eaf R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f2d04426038 R14: 00007f2d04425fa0 R15: 00007fff6712ff78 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:kasan_byte_accessible+0x15/0x30 mm/kasan/generic.c:210 Code: 00 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 b8 00 00 00 00 00 fc ff df 48 c1 ef 03 48 01 c7 <0f> b6 07 3c 07 0f 96 c0 e9 0e 33 43 09 66 66 2e 0f 1f 84 00 00 00 RSP: 0018:ffffc90003abf4b0 EFLAGS: 00010286 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff81e53a84 RDI: dffffc0000000028 RBP: 0000000000000140 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff81e53a84 R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000000 FS: 00007f2d04fb66c0(0000) GS:ffff888123ede000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f28e453f1d7 CR3: 000000005762d000 CR4: 00000000003526f0 ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: 0f 1f 00 nopl (%rax) 5: 90 nop 6: 90 nop 7: 90 nop 8: 90 nop 9: 90 nop a: 90 nop b: 90 nop c: 90 nop d: 90 nop e: 90 nop f: 90 nop 10: 90 nop 11: 90 nop 12: 90 nop 13: 90 nop 14: 90 nop 15: 0f 1f 40 d6 nopl -0x2a(%rax) 19: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 20: fc ff df 23: 48 c1 ef 03 shr $0x3,%rdi 27: 48 01 c7 add %rax,%rdi * 2a: 0f b6 07 movzbl (%rdi),%eax <-- trapping instruction 2d: 3c 07 cmp $0x7,%al 2f: 0f 96 c0 setbe %al 32: e9 0e 33 43 09 jmp 0x9433345 37: 66 data16 38: 66 data16 39: 2e cs 3a: 0f .byte 0xf 3b: 1f (bad) 3c: 84 00 test %al,(%rax) Tested on: commit: 48a5a7ab Merge tag 'v7.2-rc4-smb3-client-fixes' of git.. git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git console output: https://syzkaller.appspot.com/x/log.txt?x=17679549580000 kernel config: https://syzkaller.appspot.com/x/.config?x=145fa60d73086782 dashboard link: https://syzkaller.appspot.com/bug?extid=227dbc9afd022922d624 compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 Note: no patches were applied. ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH i2c-fixes v1] i2c: core: Fix use-after-free during i2c device removal [not found] ` <CALp66yFrutQ2h8SNyBZn04+LMPMnSEtWxW_Dr0vzfoHvEahSsQ@mail.gmail.com> 2026-08-22 19:11 ` syzbot @ 2026-08-22 19:37 ` Rafael Alejandro Díaz Cruz 2026-08-22 21:03 ` [syzbot] [fs?] [usb?] KASAN: slab-use-after-free Read in lockref_get (2) syzbot 2026-08-22 23:16 ` [PATCH i2c-fixes v1] i2c: core: Fix use-after-free during i2c device removal Rafael Alejandro Díaz Cruz 1 sibling, 2 replies; 10+ messages in thread From: Rafael Alejandro Díaz Cruz @ 2026-08-22 19:37 UTC (permalink / raw) To: Hillf Danton Cc: syzbot+227dbc9afd022922d624, Andi Shyti, syzkaller-bugs, linux-i2c, linux-kernel #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 48a5a7ab8d6ab7090564339e039c421f315de912 On Sat, Aug 22, 2026 at 11:26 AM Rafael Alejandro Díaz Cruz <rafad900@gmail.com> wrote: > > #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 48a5a7ab8d6ab7090564339e039c421f315de912 > > On Sat, Aug 22, 2026 at 11:13 AM Rafael Alejandro Díaz Cruz <rafad900@gmail.com> wrote: >> >> I see syzkaller failed to test the patch due to some VKMS/DRM >> issue. It's unrelated to my patch. >> >> I have tested on my own local x86 QEMU instance with proper >> .config and C reproducer. The error does not persist after my >> patch. ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] [fs?] [usb?] KASAN: slab-use-after-free Read in lockref_get (2) 2026-08-22 19:37 ` [PATCH i2c-fixes v1] i2c: core: Fix use-after-free during i2c device removal Rafael Alejandro Díaz Cruz @ 2026-08-22 21:03 ` syzbot 2026-08-22 23:16 ` [PATCH i2c-fixes v1] i2c: core: Fix use-after-free during i2c device removal Rafael Alejandro Díaz Cruz 1 sibling, 0 replies; 10+ messages in thread From: syzbot @ 2026-08-22 21:03 UTC (permalink / raw) To: andi.shyti, hdanton, linux-i2c, linux-kernel, rafad900, syzkaller-bugs Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: KASAN: slab-use-after-free Read in lockref_get dvb-usb: bulk message failed: -22 (6/0) dvb-usb: bulk message failed: -22 (5/0) ucsi_ccg 1-0008: ucsi_ccg_init failed - -110 ================================================================== BUG: KASAN: slab-use-after-free in __raw_spin_lock include/linux/spinlock_api_smp.h:158 [inline] BUG: KASAN: slab-use-after-free in _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:158 Read of size 1 at addr ffff88803699f270 by task syz.4.58/6822 CPU: 0 UID: 0 PID: 6822 Comm: syz.4.58 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x13d/0x4b0 mm/kasan/report.c:482 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595 __kasan_check_byte+0x36/0x50 mm/kasan/common.c:574 kasan_check_byte include/linux/kasan.h:402 [inline] lock_acquire kernel/locking/lockdep.c:5842 [inline] lock_acquire+0x132/0x370 kernel/locking/lockdep.c:5825 __raw_spin_lock include/linux/spinlock_api_smp.h:158 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:158 spin_lock include/linux/spinlock.h:342 [inline] lockref_get+0x15/0x50 lib/lockref.c:50 dget include/linux/dcache.h:364 [inline] __simple_recursive_removal+0x3d/0x5c0 fs/libfs.c:601 debugfs_remove+0x5d/0x80 fs/debugfs/inode.c:781 i2c_device_probe+0x6e2/0xd10 drivers/i2c/i2c-core-base.c:610 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x64/0x160 drivers/base/bus.c:620 device_add+0x121d/0x1970 drivers/base/core.c:3772 i2c_new_client_device+0x660/0xd30 drivers/i2c/i2c-core-base.c:1019 new_device_store+0x20f/0x420 drivers/i2c/i2c-core-base.c:1307 dev_attr_store+0x58/0x80 drivers/base/core.c:2505 sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145 kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fe00579de99 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fe006690028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007fe005a25fa0 RCX: 00007fe00579de99 RDX: 000000000000000f RSI: 0000200000000700 RDI: 0000000000000004 RBP: 00007fe005833eaf R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fe005a26038 R14: 00007fe005a25fa0 R15: 00007fffd311f6c8 </TASK> Allocated by task 6822: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 unpoison_slab_object mm/kasan/common.c:340 [inline] __kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:366 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4612 [inline] slab_alloc_node mm/slub.c:4945 [inline] kmem_cache_alloc_lru_noprof+0x267/0x6a0 mm/slub.c:4978 __d_alloc+0x35/0xa50 fs/dcache.c:1902 d_alloc+0x4a/0x1e0 fs/dcache.c:1981 lookup_one_qstr_excl+0x171/0x250 fs/namei.c:1806 __start_dirop fs/namei.c:2920 [inline] start_dirop+0x59/0xb0 fs/namei.c:2942 simple_start_creating+0xf9/0x110 fs/libfs.c:2305 debugfs_start_creating.part.0+0x82/0x170 fs/debugfs/inode.c:394 debugfs_start_creating fs/debugfs/inode.c:371 [inline] debugfs_create_dir+0x72/0x440 fs/debugfs/inode.c:572 i2c_device_probe+0x5f5/0xd10 drivers/i2c/i2c-core-base.c:588 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x64/0x160 drivers/base/bus.c:620 device_add+0x121d/0x1970 drivers/base/core.c:3772 i2c_new_client_device+0x660/0xd30 drivers/i2c/i2c-core-base.c:1019 new_device_store+0x20f/0x420 drivers/i2c/i2c-core-base.c:1307 dev_attr_store+0x58/0x80 drivers/base/core.c:2505 sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145 kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6ac/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 15: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2705 [inline] slab_free mm/slub.c:6405 [inline] kmem_cache_free+0x127/0x6b0 mm/slub.c:6532 rcu_do_batch kernel/rcu/tree.c:2645 [inline] rcu_core+0x5a2/0x10d0 kernel/rcu/tree.c:2897 handle_softirqs+0x1ea/0x9b0 kernel/softirq.c:622 run_ksoftirqd kernel/softirq.c:1076 [inline] run_ksoftirqd+0x38/0x60 kernel/softirq.c:1068 smpboot_thread_fn+0x3d3/0xaa0 kernel/smpboot.c:160 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Last potentially related work creation: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_record_aux_stack+0xa7/0xc0 mm/kasan/generic.c:556 __call_rcu_common.constprop.0+0xa5/0x9b0 kernel/rcu/tree.c:3159 dentry_free+0x145/0x2b0 fs/dcache.c:450 dentry_kill+0x5e8/0xc20 fs/dcache.c:845 finish_dput fs/dcache.c:1001 [inline] dput.part.0+0xd7/0x240 fs/dcache.c:1042 dput+0x1f/0x30 fs/dcache.c:1037 find_next_child+0x18f/0x280 fs/libfs.c:592 __simple_recursive_removal+0x2ab/0x5c0 fs/libfs.c:609 debugfs_remove+0x5d/0x80 fs/debugfs/inode.c:781 i2c_del_adapter+0x17f/0x2d0 drivers/i2c/i2c-core-base.c:1829 dvb_usb_i2c_exit+0x9f/0xf0 drivers/media/usb/dvb-usb/dvb-usb-i2c.c:46 dvb_usb_exit drivers/media/usb/dvb-usb/dvb-usb-init.c:144 [inline] dvb_usb_device_exit+0x313/0x520 drivers/media/usb/dvb-usb/dvb-usb-init.c:338 usb_unbind_interface+0x1dd/0x9e0 drivers/usb/core/driver.c:458 device_remove drivers/base/dd.c:618 [inline] device_remove+0x12a/0x180 drivers/base/dd.c:610 __device_release_driver drivers/base/dd.c:1349 [inline] device_release_driver_internal+0x44e/0x620 drivers/base/dd.c:1372 bus_remove_device+0x2bc/0x560 drivers/base/bus.c:664 device_del+0x376/0x9b0 drivers/base/core.c:3961 usb_disable_device+0x367/0x810 drivers/usb/core/message.c:1478 usb_disconnect+0x2e2/0x9a0 drivers/usb/core/hub.c:2345 hub_port_connect drivers/usb/core/hub.c:5407 [inline] hub_port_connect_change drivers/usb/core/hub.c:5707 [inline] port_event drivers/usb/core/hub.c:5871 [inline] hub_event+0x1c4f/0x4a60 drivers/usb/core/hub.c:5953 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322 process_scheduled_works kernel/workqueue.c:3405 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486 kthread+0x370/0x450 kernel/kthread.c:436 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 The buggy address belongs to the object at ffff88803699f1a0 which belongs to the cache dentry of size 312 The buggy address is located 208 bytes inside of freed 312-byte region [ffff88803699f1a0, ffff88803699f2d8) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3699e head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 memcg:ffff88807ab3d501 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801d2dc140 dead000000000100 dead000000000122 raw: 0000000000000000 0000000800150015 00000000f5000000 ffff88807ab3d501 head: 00fff00000000040 ffff88801d2dc140 dead000000000100 dead000000000122 head: 0000000000000000 0000000800150015 00000000f5000000 ffff88807ab3d501 head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 1, migratetype Reclaimable, gfp_mask 0xd20d0(__GFP_RECLAIMABLE|__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4985, tgid 4985 (udevd), ts 39556920182, free_ts 0 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304 alloc_slab_page mm/slub.c:3294 [inline] allocate_slab mm/slub.c:3408 [inline] new_slab+0xa2/0x650 mm/slub.c:3454 refill_objects+0xe3/0x410 mm/slub.c:7338 refill_sheaf mm/slub.c:2832 [inline] __pcs_replace_empty_main+0x376/0x680 mm/slub.c:4703 alloc_from_pcs mm/slub.c:4801 [inline] slab_alloc_node mm/slub.c:4933 [inline] kmem_cache_alloc_lru_noprof+0x46a/0x6a0 mm/slub.c:4978 __d_alloc+0x35/0xa50 fs/dcache.c:1902 d_alloc+0x4a/0x1e0 fs/dcache.c:1981 lookup_one_qstr_excl+0x171/0x250 fs/namei.c:1806 __start_renaming+0x1c9/0x520 fs/namei.c:3888 filename_renameat2+0x538/0xa60 fs/namei.c:6167 __do_sys_rename fs/namei.c:6236 [inline] __se_sys_rename fs/namei.c:6232 [inline] __x64_sys_rename+0x81/0xb0 fs/namei.c:6232 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f page_owner free stack trace missing Memory state around the buggy address: ffff88803699f100: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc ffff88803699f180: fc fc fc fc fa fb fb fb fb fb fb fb fb fb fb fb >ffff88803699f200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88803699f280: fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc ffff88803699f300: fc fc fc 00 00 00 00 00 00 00 00 00 00 00 00 00 ================================================================== Tested on: commit: 48a5a7ab Merge tag 'v7.2-rc4-smb3-client-fixes' of git.. git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git console output: https://syzkaller.appspot.com/x/log.txt?x=108ef179580000 kernel config: https://syzkaller.appspot.com/x/.config?x=145fa60d73086782 dashboard link: https://syzkaller.appspot.com/bug?extid=227dbc9afd022922d624 compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 Note: no patches were applied. ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH i2c-fixes v1] i2c: core: Fix use-after-free during i2c device removal 2026-08-22 19:37 ` [PATCH i2c-fixes v1] i2c: core: Fix use-after-free during i2c device removal Rafael Alejandro Díaz Cruz 2026-08-22 21:03 ` [syzbot] [fs?] [usb?] KASAN: slab-use-after-free Read in lockref_get (2) syzbot @ 2026-08-22 23:16 ` Rafael Alejandro Díaz Cruz 2026-08-22 23:57 ` [syzbot] [fs?] [usb?] KASAN: slab-use-after-free Read in lockref_get (2) syzbot 2026-08-23 1:12 ` [PATCH i2c-fixes v1] i2c: core: Fix use-after-free during i2c device removal Rafael Alejandro Díaz Cruz 1 sibling, 2 replies; 10+ messages in thread From: Rafael Alejandro Díaz Cruz @ 2026-08-22 23:16 UTC (permalink / raw) To: Hillf Danton Cc: syzbot+227dbc9afd022922d624, Andi Shyti, syzkaller-bugs, linux-i2c, linux-kernel #syz test On Sat, Aug 22, 2026 at 12:37 PM Rafael Alejandro Díaz Cruz <rafad900@gmail.com> wrote: > > #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git > 48a5a7ab8d6ab7090564339e039c421f315de912 > > > On Sat, Aug 22, 2026 at 11:26 AM Rafael Alejandro Díaz Cruz > <rafad900@gmail.com> wrote: > > > > #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 48a5a7ab8d6ab7090564339e039c421f315de912 > > > > On Sat, Aug 22, 2026 at 11:13 AM Rafael Alejandro Díaz Cruz <rafad900@gmail.com> wrote: > >> > >> I see syzkaller failed to test the patch due to some VKMS/DRM > >> issue. It's unrelated to my patch. > >> > >> I have tested on my own local x86 QEMU instance with proper > >> .config and C reproducer. The error does not persist after my > >> patch. ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] [fs?] [usb?] KASAN: slab-use-after-free Read in lockref_get (2) 2026-08-22 23:16 ` [PATCH i2c-fixes v1] i2c: core: Fix use-after-free during i2c device removal Rafael Alejandro Díaz Cruz @ 2026-08-22 23:57 ` syzbot 2026-08-23 1:12 ` [PATCH i2c-fixes v1] i2c: core: Fix use-after-free during i2c device removal Rafael Alejandro Díaz Cruz 1 sibling, 0 replies; 10+ messages in thread From: syzbot @ 2026-08-22 23:57 UTC (permalink / raw) To: andi.shyti, hdanton, linux-i2c, linux-kernel, rafad900, syzkaller-bugs Hello, syzbot tried to test the proposed patch but the build/boot failed: m: mask: 0xffffff max_cycles: 0xffffff, max_idle_ns: 2085701024 ns [ 3.244305][ T1] NET: Registered PF_INET protocol family [ 3.247499][ T1] IP idents hash table entries: 131072 (order: 8, 1048576 bytes, vmalloc) [ 3.259218][ T1] tcp_listen_portaddr_hash hash table entries: 4096 (order: 7, 294912 bytes, vmalloc) [ 3.261261][ T1] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, vmalloc) [ 3.263274][ T1] TCP established hash table entries: 65536 (order: 7, 524288 bytes, vmalloc) [ 3.274524][ T1] TCP bind hash table entries: 65536 (order: 12, 9437184 bytes, vmalloc hugepage) [ 3.281391][ T1] TCP: Hash tables configured (established 65536 bind 65536) [ 3.284940][ T1] MPTCP token hash table entries: 8192 (order: 8, 720896 bytes, vmalloc) [ 3.288577][ T1] UDP hash table entries: 4096 (order: 8, 1048576 bytes, vmalloc) [ 3.291550][ T1] NET: Registered PF_UNIX/PF_LOCAL protocol family [ 3.306684][ T1] RPC: Registered named UNIX socket transport module. [ 3.307718][ T1] RPC: Registered udp transport module. [ 3.308513][ T1] RPC: Registered tcp transport module. [ 3.309357][ T1] RPC: Registered tcp-with-tls transport module. [ 3.310392][ T1] RPC: Registered tcp NFSv4.1 backchannel transport module. [ 3.316342][ T1] NET: Registered PF_XDP protocol family [ 3.317480][ T1] pci_bus 0000:00: resource 4 [io 0x0000-0x0cf7 window] [ 3.318551][ T1] pci_bus 0000:00: resource 5 [io 0x0d00-0x0fff window] [ 3.319885][ T1] pci_bus 0000:00: resource 6 [io 0xc000-0xffff window] [ 3.321388][ T1] pci_bus 0000:00: resource 7 [io 0xa000-0xbfff window] [ 3.322459][ T1] pci_bus 0000:00: resource 8 [mem 0x000a0000-0x000bffff window] [ 3.323839][ T1] pci_bus 0000:00: resource 9 [mem 0xc0000000-0xfebfefff window] [ 3.326592][ T1] pci 0000:00:00.0: Limiting direct PCI/PCI transfers [ 3.328327][ T1] PCI: CLS 0 bytes, default 64 [ 3.329389][ T1] PCI-DMA: Using software bounce buffering for IO (SWIOTLB) [ 3.330474][ T1] software IO TLB: mapped [mem 0x00000000b4400000-0x00000000b8400000] (64MB) [ 3.333143][ T1] ACPI: bus type thunderbolt registered [ 3.341226][ T1] RAPL PMU: API unit is 2^-32 Joules, 0 fixed counters, 10737418240 ms ovfl timer [ 3.346936][ T59] kworker/u8:1 (59) used greatest stack depth: 27864 bytes left [ 3.364118][ T1] kvm_amd: CPU 1 isn't AMD or Hygon [ 3.365204][ T1] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x285d48fab19, max_idle_ns: 440795208084 ns [ 3.367725][ T1] clocksource: Switched to clocksource tsc [ 3.403452][ T1] Initialise system trusted keyrings [ 3.404162][ T84] kworker/u8:4 (84) used greatest stack depth: 27160 bytes left [ 3.407742][ T1] workingset: timestamp_bits=40 (anon: 35) max_order=21 bucket_order=0 (anon: 0) [ 3.415933][ T1] DLM installed [ 3.421490][ T1] squashfs: version 4.0 (2009/01/31) Phillip Lougher [ 3.429626][ T1] NFS: Registering the id_resolver key type [ 3.430824][ T1] Key type id_resolver registered [ 3.431584][ T1] Key type id_legacy registered [ 3.432928][ T1] nfs4filelayout_init: NFSv4 File Layout Driver Registering... [ 3.434314][ T1] nfs4flexfilelayout_init: NFSv4 Flexfile Layout Driver Registering... [ 3.441599][ T1] smbdirect: subsystem loading... [ 3.448154][ T1] smbdirect: subsystem loaded [ 3.471719][ T1] Key type cifs.spnego registered [ 3.472760][ T1] Key type cifs.idmap registered [ 3.476921][ T1] ntfs3: Enabled Linux POSIX ACLs support [ 3.477738][ T1] ntfs3: Read-only LZX/Xpress compression included [ 3.478987][ T1] jffs2: version 2.2. (NAND) (SUMMARY) © 2001-2006 Red Hat, Inc. [ 3.482637][ T1] romfs: ROMFS MTD (C) 2007 Red Hat, Inc. [ 3.483593][ T1] QNX4 filesystem 0.2.3 registered. [ 3.484738][ T1] qnx6: QNX6 filesystem 1.0.0 registered. [ 3.486442][ T1] fuse: init (API version 7.45) [ 3.489877][ T1] orangefs_debugfs_init: called with debug mask: :none: :0: [ 3.492401][ T1] orangefs_init: module version upstream loaded [ 3.494199][ T1] JFS: nTxBlock = 8192, nTxLock = 65536 [ 3.507409][ T1] SGI XFS with ACLs, security attributes, realtime, scrub, repair, quota, no debug enabled [ 3.514958][ T1] 9p: Installing v9fs 9p2000 file system support [ 3.516652][ T1] NILFS version 2 loaded [ 3.517609][ T1] befs: version: 0.9.3 [ 3.519354][ T1] ocfs2: Registered cluster interface o2cb [ 3.521201][ T1] ocfs2: Registered cluster interface user [ 3.523024][ T1] OCFS2 User DLM kernel interface loaded [ 3.545147][ T1] gfs2: GFS2 installed [ 3.560183][ T1] ceph: loaded (mds proto 32) [ 3.573563][ T1] NET: Registered PF_ALG protocol family [ 3.574709][ T1] async_tx: api initialized (async) [ 3.575970][ T1] Key type asymmetric registered [ 3.576921][ T1] Asymmetric key parser 'x509' registered [ 3.577745][ T1] Asymmetric key parser 'pkcs8' registered [ 3.578604][ T1] Key type pkcs7_test registered [ 3.579842][ T1] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 239) [ 3.583698][ T1] io scheduler mq-deadline registered [ 3.584626][ T1] io scheduler kyber registered [ 3.586119][ T1] io scheduler bfq registered [ 3.601298][ T1] input: Power Button as /devices/platform/LNXPWRBN:00/input/input0 [ 3.605629][ T1] ACPI: button: Power Button [PWRF] [ 3.609215][ T1] input: Sleep Button as /devices/platform/LNXSLPBN:00/input/input1 [ 3.611991][ T1] ACPI: button: Sleep Button [SLPF] [ 3.635978][ T1] ioatdma: Intel(R) QuickData Technology Driver 5.00 [ 3.662181][ T10] ACPI: \_SB_.LNKC: Enabled at IRQ 11 [ 3.663176][ T10] virtio-pci 0000:00:03.0: virtio_pci: leaving for legacy driver [ 3.694911][ T10] ACPI: \_SB_.LNKD: Enabled at IRQ 10 [ 3.696705][ T10] virtio-pci 0000:00:04.0: virtio_pci: leaving for legacy driver [ 3.724400][ T10] ACPI: \_SB_.LNKB: Enabled at IRQ 10 [ 3.725672][ T10] virtio-pci 0000:00:06.0: virtio_pci: leaving for legacy driver [ 4.062323][ T524] kworker/u8:7 (524) used greatest stack depth: 26904 bytes left [ 4.258630][ T1] N_HDLC line discipline registered with maxframe=4096 [ 4.261364][ T1] Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled [ 4.275999][ T1] 00:02: ttyS0 at I/O 0x3f8 (irq = 4, base_baud = 115200) is a 16550A [ 4.291450][ T1] 00:03: ttyS1 at I/O 0x2f8 (irq = 3, base_baud = 115200) is a 16550A [ 4.306966][ T1] 00:04: ttyS2 at I/O 0x3e8 (irq = 6, base_baud = 115200) is a 16550A [ 4.321856][ T1] 00:05: ttyS3 at I/O 0x2e8 (irq = 7, base_baud = 115200) is a 16550A [ 4.357497][ T1] Non-volatile memory driver v1.3 [ 4.382848][ T1] usbcore: registered new interface driver xillyusb [ 4.391825][ T1] ACPI: bus type drm_connector registered [ 4.402882][ T1] [drm] Initialized vgem 1.0.0 for vgem on minor 0 [ 4.408272][ T1] ------------[ cut here ]------------ [ 4.409057][ T1] [PLANE:35:plane-0] pixel format with alpha exposed but blend mode not setup [ 4.409076][ T1] WARNING: drivers/gpu/drm/drm_mode_config.c:872 at drm_mode_config_validate+0xfb4/0x1be0, CPU#0: swapper/0/1 [ 4.412353][ T1] Modules linked in: [ 4.412951][ T1] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full) [ 4.414327][ T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 4.415957][ T1] RIP: 0010:drm_mode_config_validate+0xfbb/0x1be0 [ 4.416871][ T1] Code: 00 49 8b 57 18 48 89 f8 48 c1 e8 03 0f b6 04 28 84 c0 74 08 3c 03 0f 8e 00 0b 00 00 48 8d 3d fc 1e 81 0b 41 8b b7 c8 00 00 00 <67> 48 0f b9 3a e9 fa fd ff ff 48 8b 5c 24 20 e8 41 9b 3c fc 48 8d [ 4.420277][ T1] RSP: 0000:ffffc90000067c18 EFLAGS: 00010246 [ 4.421416][ T1] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 4.422525][ T1] RDX: ffff8880270d17e0 RSI: 0000000000000023 RDI: ffffffff914f9750 [ 4.423790][ T1] RBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000000 [ 4.424912][ T1] R10: 0000000000000001 R11: 0000000000000000 R12: ffffed1004db7023 [ 4.426628][ T1] R13: ffffed1004db7024 R14: 0000000000000001 R15: ffff888026db8028 [ 4.427965][ T1] FS: 0000000000000000(0000) GS:ffff888123b83000(0000) knlGS:0000000000000000 [ 4.429922][ T1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 4.431232][ T1] CR2: ffff88823ffff000 CR3: 000000000eb94000 CR4: 00000000003526f0 [ 4.432829][ T1] Call Trace: [ 4.433578][ T1] <TASK> [ 4.434377][ T1] drm_dev_register+0x56e/0x7b0 [ 4.435116][ T1] vkms_create+0x491/0x5b0 [ 4.436303][ T1] ? __pfx_vkms_init+0x10/0x10 [ 4.437097][ T1] vkms_init+0x98/0xe0 [ 4.437725][ T1] do_one_initcall+0x11c/0x6f0 [ 4.438689][ T1] ? __pfx_do_one_initcall+0x10/0x10 [ 4.439912][ T1] ? kasan_unpoison+0x15/0x60 [ 4.440799][ T1] ? kernel_init_freeable+0x4ca/0x7b0 [ 4.441810][ T1] kernel_init_freeable+0x6ea/0x7b0 [ 4.442739][ T1] ? __pfx_kernel_init+0x10/0x10 [ 4.443755][ T1] kernel_init+0x21/0x1e0 [ 4.444481][ T1] ? __pfx_kernel_init+0x10/0x10 [ 4.445296][ T1] ret_from_fork+0x730/0xd60 [ 4.446009][ T1] ? __pfx_ret_from_fork+0x10/0x10 [ 4.446941][ T1] ? __switch_to+0x800/0x10f0 [ 4.448149][ T1] ? __pfx_kernel_init+0x10/0x10 [ 4.448847][ T1] ret_from_fork_asm+0x1a/0x30 [ 4.449585][ T1] </TASK> [ 4.450241][ T1] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 4.451670][ T1] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full) [ 4.453007][ T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 [ 4.454566][ T1] Call Trace: [ 4.455144][ T1] <TASK> [ 4.455713][ T1] dump_stack_lvl+0x100/0x190 [ 4.455982][ T1] vpanic+0x553/0x970 [ 4.455982][ T1] ? __pfx_vpanic+0x10/0x10 [ 4.455982][ T1] panic+0xd1/0xe0 [ 4.455982][ T1] ? __pfx_panic+0x10/0x10 [ 4.455982][ T1] check_panic_on_warn.cold+0x19/0x34 [ 4.455982][ T1] ? drm_mode_config_validate+0xfb4/0x1be0 [ 4.455982][ T1] __warn.cold+0x191/0x318 [ 4.455982][ T1] __report_bug+0x30f/0x440 [ 4.455982][ T1] ? drm_mode_config_validate+0xfb4/0x1be0 [ 4.455982][ T1] ? __pfx___report_bug+0x10/0x10 [ 4.455982][ T1] ? __lock_acquire+0x4c5/0x1ec0 [ 4.455982][ T1] report_bug_entry+0xe2/0x290 [ 4.455982][ T1] ? drm_mode_config_validate+0xfbb/0x1be0 [ 4.455982][ T1] handle_bug+0x1cd/0x2a0 [ 4.455982][ T1] exc_invalid_op+0x17/0x50 [ 4.455982][ T1] asm_exc_invalid_op+0x1a/0x20 [ 4.455982][ T1] RIP: 0010:drm_mode_config_validate+0xfbb/0x1be0 [ 4.455982][ T1] Code: 00 49 8b 57 18 48 89 f8 48 c1 e8 03 0f b6 04 28 84 c0 74 08 3c 03 0f 8e 00 0b 00 00 48 8d 3d fc 1e 81 0b 41 8b b7 c8 00 00 00 <67> 48 0f b9 3a e9 fa fd ff ff 48 8b 5c 24 20 e8 41 9b 3c fc 48 8d [ 4.455982][ T1] RSP: 0000:ffffc90000067c18 EFLAGS: 00010246 [ 4.455982][ T1] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 4.455982][ T1] RDX: ffff8880270d17e0 RSI: 0000000000000023 RDI: ffffffff914f9750 [ 4.455982][ T1] RBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000000 [ 4.455982][ T1] R10: 0000000000000001 R11: 0000000000000000 R12: ffffed1004db7023 [ 4.455982][ T1] R13: ffffed1004db7024 R14: 0000000000000001 R15: ffff888026db8028 [ 4.455982][ T1] ? drm_mode_config_validate+0xf76/0x1be0 [ 4.455982][ T1] drm_dev_register+0x56e/0x7b0 [ 4.455982][ T1] vkms_create+0x491/0x5b0 [ 4.455982][ T1] ? __pfx_vkms_init+0x10/0x10 [ 4.455982][ T1] vkms_init+0x98/0xe0 [ 4.455982][ T1] do_one_initcall+0x11c/0x6f0 [ 4.455982][ T1] ? __pfx_do_one_initcall+0x10/0x10 [ 4.455982][ T1] ? kasan_unpoison+0x15/0x60 [ 4.455982][ T1] ? kernel_init_freeable+0x4ca/0x7b0 [ 4.455982][ T1] kernel_init_freeable+0x6ea/0x7b0 [ 4.455982][ T1] ? __pfx_kernel_init+0x10/0x10 [ 4.455982][ T1] kernel_init+0x21/0x1e0 [ 4.455982][ T1] ? __pfx_kernel_init+0x10/0x10 [ 4.455982][ T1] ret_from_fork+0x730/0xd60 [ 4.455982][ T1] ? __pfx_ret_from_fork+0x10/0x10 [ 4.455982][ T1] ? __switch_to+0x800/0x10f0 [ 4.455982][ T1] ? __pfx_kernel_init+0x10/0x10 [ 4.455982][ T1] ret_from_fork_asm+0x1a/0x30 [ 4.455982][ T1] </TASK> [ 4.455982][ T1] Kernel Offset: disabled [ 4.455982][ T1] Rebooting in 86400 seconds.. syzkaller build log: go env (err=<nil>) AR='ar' CC='gcc' CGO_CFLAGS='-O2 -g' CGO_CPPFLAGS='' CGO_CXXFLAGS='-O2 -g' CGO_ENABLED='1' CGO_FFLAGS='-O2 -g' CGO_LDFLAGS='-O2 -g' CXX='g++' GCCGO='gccgo' GO111MODULE='auto' GOAMD64='v1' GOARCH='amd64' GOAUTH='netrc' GOBIN='' GOCACHE='/syzkaller/.cache/go-build' GOCACHEPROG='' GODEBUG='' GOENV='/syzkaller/.config/go/env' GOEXE='' GOEXPERIMENT='' GOFIPS140='off' GOFLAGS='' GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build1331161525=/tmp/go-build -gno-record-gcc-switches' GOHOSTARCH='amd64' GOHOSTOS='linux' GOINSECURE='' GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod' GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod' GONOPROXY='' GONOSUMDB='' GOOS='linux' GOPATH='/syzkaller/jobs-2/linux/gopath' GOPRIVATE='' GOPROXY='https://proxy.golang.org,direct' GOROOT='/usr/local/go' GOSUMDB='sum.golang.org' GOTELEMETRY='local' GOTELEMETRYDIR='/syzkaller/.config/go/telemetry' GOTMPDIR='' GOTOOLCHAIN='auto' GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64' GOVCS='' GOVERSION='go1.26.0' GOWORK='' PKG_CONFIG='pkg-config' git status (err=<nil>) HEAD detached at 05b26a281c0 nothing to commit, working tree clean tput: No value for $TERM and no -T specified tput: No value for $TERM and no -T specified Makefile:31: run command via tools/syz-env for best compatibility, see: Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=05b26a281c072cc34dcad83a283fd2aeeff18ad1 -X github.com/google/syzkaller/prog.gitRevisionDate=20260724-140511" ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=05b26a281c072cc34dcad83a283fd2aeeff18ad1 -X github.com/google/syzkaller/prog.gitRevisionDate=20260724-140511" ./sys/syz-sysgen make .descriptions tput: No value for $TERM and no -T specified tput: No value for $TERM and no -T specified Makefile:31: run command via tools/syz-env for best compatibility, see: Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env bin/syz-sysgen touch .descriptions GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=05b26a281c072cc34dcad83a283fd2aeeff18ad1 -X github.com/google/syzkaller/prog.gitRevisionDate=20260724-140511" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog mkdir -p ./bin/linux_amd64 g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \ -m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_amd64=1 \ -DHOSTGOOS_linux=1 -DGIT_REVISION=\"05b26a281c072cc34dcad83a283fd2aeeff18ad1\" /usr/bin/ld: /tmp/ccXjEkJ3.o: in function `Connection::Connect(char const*, char const*)': executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x386): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking ./tools/check-syzos.sh 2>/dev/null Error text is too large and was truncated, full error text is at: https://syzkaller.appspot.com/x/error.txt?x=11d04625580000 Tested on: commit: 66fb95a5 Merge tag 'caps-pr-20260820' of git://git.ker.. git tree: upstream kernel config: https://syzkaller.appspot.com/x/.config?x=49d6006e566a6d95 dashboard link: https://syzkaller.appspot.com/bug?extid=227dbc9afd022922d624 compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 Note: no patches were applied. ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH i2c-fixes v1] i2c: core: Fix use-after-free during i2c device removal 2026-08-22 23:16 ` [PATCH i2c-fixes v1] i2c: core: Fix use-after-free during i2c device removal Rafael Alejandro Díaz Cruz 2026-08-22 23:57 ` [syzbot] [fs?] [usb?] KASAN: slab-use-after-free Read in lockref_get (2) syzbot @ 2026-08-23 1:12 ` Rafael Alejandro Díaz Cruz 2026-08-23 3:48 ` [syzbot] [fs?] [usb?] KASAN: slab-use-after-free Read in lockref_get (2) syzbot 1 sibling, 1 reply; 10+ messages in thread From: Rafael Alejandro Díaz Cruz @ 2026-08-23 1:12 UTC (permalink / raw) To: Hillf Danton Cc: syzbot+227dbc9afd022922d624, Andi Shyti, syzkaller-bugs, linux-i2c, linux-kernel #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux.git i2c/i2c-fixes On Sat, Aug 22, 2026 at 4:16 PM Rafael Alejandro Díaz Cruz <rafad900@gmail.com> wrote: > > #syz test > > On Sat, Aug 22, 2026 at 12:37 PM Rafael Alejandro Díaz Cruz > <rafad900@gmail.com> wrote: > > > > #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git > > 48a5a7ab8d6ab7090564339e039c421f315de912 > > > > > > On Sat, Aug 22, 2026 at 11:26 AM Rafael Alejandro Díaz Cruz > > <rafad900@gmail.com> wrote: > > > > > > #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 48a5a7ab8d6ab7090564339e039c421f315de912 > > > > > > On Sat, Aug 22, 2026 at 11:13 AM Rafael Alejandro Díaz Cruz <rafad900@gmail.com> wrote: > > >> > > >> I see syzkaller failed to test the patch due to some VKMS/DRM > > >> issue. It's unrelated to my patch. > > >> > > >> I have tested on my own local x86 QEMU instance with proper > > >> .config and C reproducer. The error does not persist after my > > >> patch. ^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] [fs?] [usb?] KASAN: slab-use-after-free Read in lockref_get (2) 2026-08-23 1:12 ` [PATCH i2c-fixes v1] i2c: core: Fix use-after-free during i2c device removal Rafael Alejandro Díaz Cruz @ 2026-08-23 3:48 ` syzbot 0 siblings, 0 replies; 10+ messages in thread From: syzbot @ 2026-08-23 3:48 UTC (permalink / raw) To: andi.shyti, hdanton, linux-i2c, linux-kernel, rafad900, syzkaller-bugs Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: KASAN: slab-use-after-free Read in lockref_get dvb-usb: bulk message failed: -22 (5/0) ucsi_ccg 1-0008: ucsi_ccg_init failed - -110 ================================================================== BUG: KASAN: slab-use-after-free in __raw_spin_lock include/linux/spinlock_api_smp.h:190 [inline] BUG: KASAN: slab-use-after-free in _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:173 Read of size 1 at addr ffff88805cdc3cb8 by task syz.0.61/6625 CPU: 1 UID: 0 PID: 6625 Comm: syz.0.61 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026 Call Trace: <TASK> __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x13d/0x4b0 mm/kasan/report.c:482 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595 __kasan_check_byte+0x36/0x50 mm/kasan/common.c:574 kasan_check_byte include/linux/kasan.h:402 [inline] lock_acquire kernel/locking/lockdep.c:5860 [inline] lock_acquire+0x132/0x370 kernel/locking/lockdep.c:5843 __raw_spin_lock include/linux/spinlock_api_smp.h:190 [inline] _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:173 spin_lock include/linux/spinlock.h:347 [inline] lockref_get+0x15/0x50 lib/lockref.c:50 dget include/linux/dcache.h:364 [inline] __simple_recursive_removal+0x3d/0x5c0 fs/libfs.c:601 debugfs_remove+0x5d/0x80 fs/debugfs/inode.c:781 i2c_device_probe+0x6e2/0xd10 drivers/i2c/i2c-core-base.c:611 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x64/0x160 drivers/base/bus.c:620 device_add+0x121d/0x1970 drivers/base/core.c:3772 i2c_new_client_device+0x660/0xd30 drivers/i2c/i2c-core-base.c:1020 new_device_store+0x20f/0x420 drivers/i2c/i2c-core-base.c:1308 dev_attr_store+0x58/0x80 drivers/base/core.c:2505 sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145 kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6af/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f6dc559de99 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f6dc649b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f6dc5825fa0 RCX: 00007f6dc559de99 RDX: 000000000000000f RSI: 0000200000000700 RDI: 0000000000000004 RBP: 00007f6dc5633eaf R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f6dc5826038 R14: 00007f6dc5825fa0 R15: 00007ffdbbd8b238 </TASK> Allocated by task 6625: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 unpoison_slab_object mm/kasan/common.c:340 [inline] __kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:366 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4584 [inline] slab_alloc_node mm/slub.c:4917 [inline] kmem_cache_alloc_lru_noprof+0x267/0x6a0 mm/slub.c:4950 __d_alloc+0x35/0xa50 fs/dcache.c:1907 d_alloc+0x4a/0x1e0 fs/dcache.c:1986 lookup_one_qstr_excl+0x171/0x250 fs/namei.c:1806 __start_dirop fs/namei.c:2920 [inline] start_dirop+0x59/0xb0 fs/namei.c:2942 simple_start_creating+0xf9/0x110 fs/libfs.c:2308 debugfs_start_creating.part.0+0x82/0x170 fs/debugfs/inode.c:394 debugfs_start_creating fs/debugfs/inode.c:371 [inline] debugfs_create_dir+0x72/0x440 fs/debugfs/inode.c:572 i2c_device_probe+0x5f5/0xd10 drivers/i2c/i2c-core-base.c:589 call_driver_probe drivers/base/dd.c:628 [inline] really_probe+0x241/0xa60 drivers/base/dd.c:706 __driver_probe_device+0x20e/0x450 drivers/base/dd.c:868 driver_probe_device+0x4a/0x140 drivers/base/dd.c:898 __device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026 bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500 __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098 device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x64/0x160 drivers/base/bus.c:620 device_add+0x121d/0x1970 drivers/base/core.c:3772 i2c_new_client_device+0x660/0xd30 drivers/i2c/i2c-core-base.c:1020 new_device_store+0x20f/0x420 drivers/i2c/i2c-core-base.c:1308 dev_attr_store+0x58/0x80 drivers/base/core.c:2505 sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145 kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6af/0x1050 fs/read_write.c:687 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 23: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2677 [inline] slab_free mm/slub.c:6377 [inline] kmem_cache_free+0x127/0x6b0 mm/slub.c:6504 rcu_do_batch kernel/rcu/tree.c:2645 [inline] rcu_core+0x5a2/0x10e0 kernel/rcu/tree.c:2897 handle_softirqs+0x1e6/0x9d0 kernel/softirq.c:645 run_ksoftirqd kernel/softirq.c:1108 [inline] run_ksoftirqd+0x38/0x60 kernel/softirq.c:1100 smpboot_thread_fn+0x3d3/0xab0 kernel/smpboot.c:160 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Last potentially related work creation: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_record_aux_stack+0xa7/0xc0 mm/kasan/generic.c:556 __call_rcu_common.constprop.0+0xa5/0x9b0 kernel/rcu/tree.c:3159 dentry_free+0x152/0x2c0 fs/dcache.c:450 dentry_kill+0x5e8/0xc20 fs/dcache.c:845 finish_dput fs/dcache.c:1001 [inline] dput.part.0+0xd7/0x240 fs/dcache.c:1042 dput+0x1f/0x30 fs/dcache.c:1037 find_next_child+0x18f/0x280 fs/libfs.c:592 __simple_recursive_removal+0x2ab/0x5c0 fs/libfs.c:609 debugfs_remove+0x5d/0x80 fs/debugfs/inode.c:781 i2c_del_adapter+0x17f/0x2d0 drivers/i2c/i2c-core-base.c:1830 dvb_usb_i2c_exit+0x9f/0xf0 drivers/media/usb/dvb-usb/dvb-usb-i2c.c:46 dvb_usb_exit drivers/media/usb/dvb-usb/dvb-usb-init.c:144 [inline] dvb_usb_device_exit+0x313/0x520 drivers/media/usb/dvb-usb/dvb-usb-init.c:338 usb_unbind_interface+0x1dd/0x9e0 drivers/usb/core/driver.c:458 device_remove drivers/base/dd.c:618 [inline] device_remove+0x12a/0x180 drivers/base/dd.c:610 __device_release_driver drivers/base/dd.c:1349 [inline] device_release_driver_internal+0x44e/0x620 drivers/base/dd.c:1372 bus_remove_device+0x2bc/0x560 drivers/base/bus.c:664 device_del+0x376/0x9b0 drivers/base/core.c:3961 usb_disable_device+0x367/0x810 drivers/usb/core/message.c:1478 usb_disconnect+0x2e2/0x9a0 drivers/usb/core/hub.c:2345 hub_port_connect drivers/usb/core/hub.c:5415 [inline] hub_port_connect_change drivers/usb/core/hub.c:5715 [inline] port_event drivers/usb/core/hub.c:5879 [inline] hub_event+0x1bb1/0x4420 drivers/usb/core/hub.c:5961 process_one_work+0xa23/0x1940 kernel/workqueue.c:3322 process_scheduled_works kernel/workqueue.c:3405 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 The buggy address belongs to the object at ffff88805cdc3be8 which belongs to the cache dentry of size 312 The buggy address is located 208 bytes inside of freed 312-byte region [ffff88805cdc3be8, ffff88805cdc3d20) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88805cdc3318 pfn:0x5cdc2 head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 memcg:ffff88805cdc3ed9 flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000240 ffff88801da9b140 ffffea0001676490 ffffea0001736990 raw: ffff88805cdc3318 0000000800150013 00000000f5000000 ffff88805cdc3ed9 head: 00fff00000000240 ffff88801da9b140 ffffea0001676490 ffffea0001736990 head: ffff88805cdc3318 0000000800150013 00000000f5000000 ffff88805cdc3ed9 head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 1, migratetype Reclaimable, gfp_mask 0xd20d0(__GFP_RECLAIMABLE|__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 6132, tgid 6132 (syz-executor), ts 121956208589, free_ts 78469627650 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0xf46/0x3500 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304 alloc_slab_page mm/slub.c:3266 [inline] allocate_slab mm/slub.c:3380 [inline] new_slab+0xa2/0x660 mm/slub.c:3426 refill_objects+0xe3/0x410 mm/slub.c:7310 refill_sheaf mm/slub.c:2804 [inline] __pcs_replace_empty_main+0x372/0x680 mm/slub.c:4675 alloc_from_pcs mm/slub.c:4773 [inline] slab_alloc_node mm/slub.c:4905 [inline] kmem_cache_alloc_lru_noprof+0x46a/0x6a0 mm/slub.c:4950 __d_alloc+0x35/0xa50 fs/dcache.c:1907 d_alloc_pseudo+0x1c/0xc0 fs/dcache.c:2038 alloc_path_pseudo fs/file_table.c:407 [inline] alloc_file_pseudo+0x118/0x290 fs/file_table.c:423 sock_alloc_file+0x50/0x210 net/socket.c:557 sock_map_fd net/socket.c:587 [inline] __sys_socket+0x1c0/0x260 net/socket.c:1827 __do_sys_socket net/socket.c:1832 [inline] __se_sys_socket net/socket.c:1830 [inline] __x64_sys_socket+0x72/0xb0 net/socket.c:1830 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5665 tgid 5665 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1406 [inline] free_pages_prepare+0x586/0xd80 mm/page_alloc.c:1451 __free_contig_range_common+0x14f/0x250 mm/page_alloc.c:6897 __free_contig_range mm/page_alloc.c:6942 [inline] free_pages_bulk+0xbd/0x200 mm/page_alloc.c:5257 vm_area_free_pages+0xad/0x2b0 mm/vmalloc.c:3461 vfree mm/vmalloc.c:3510 [inline] vfree+0x108/0x730 mm/vmalloc.c:3484 kcov_put kernel/kcov.c:447 [inline] kcov_put kernel/kcov.c:443 [inline] kcov_close+0x34/0x60 kernel/kcov.c:554 __fput+0x3ff/0xb50 fs/file_table.c:512 task_work_run+0x150/0x240 kernel/task_work.c:233 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0x951/0x2ae0 kernel/exit.c:1009 do_group_exit+0xd5/0x2a0 kernel/exit.c:1152 get_signal+0x1ec7/0x21e0 kernel/signal.c:3046 arch_do_signal_or_restart+0x91/0x7e0 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline] exit_to_user_mode_loop+0x139/0x700 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:336 [inline] do_syscall_64+0x661/0x790 arch/x86/entry/syscall_64.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff88805cdc3b80: 00 00 00 00 00 fc fc fc fc fc fc fc fc fa fb fb ffff88805cdc3c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88805cdc3c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88805cdc3d00: fb fb fb fb fc fc fc fc fc fc fc fc 00 00 00 00 ffff88805cdc3d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ================================================================== Tested on: commit: abea5c34 Merge tag 'i2c-7.3-part1' of git://git.kernel.. git tree: git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux.git i2c/i2c-fixes console output: https://syzkaller.appspot.com/x/log.txt?x=15115549580000 kernel config: https://syzkaller.appspot.com/x/.config?x=17c15623c4feca72 dashboard link: https://syzkaller.appspot.com/bug?extid=227dbc9afd022922d624 compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 Note: no patches were applied. ^ permalink raw reply [flat|nested] 10+ messages in thread
end of thread, other threads:[~2026-08-23 3:48 UTC | newest]
Thread overview: 10+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-22 6:26 [PATCH i2c-fixes v1] i2c: core: Fix use-after-free during i2c device removal Rafael Alejandro Diaz Cruz
2026-08-22 8:51 ` Hillf Danton
2026-08-22 9:25 ` [syzbot] [fs?] [usb?] KASAN: slab-use-after-free Read in lockref_get (2) syzbot
[not found] ` <CALp66yH7QzvGmo+N7BWykYjoaGT-yAezwRv0Pc_ir6qDRTsKvw@mail.gmail.com>
[not found] ` <CALp66yFrutQ2h8SNyBZn04+LMPMnSEtWxW_Dr0vzfoHvEahSsQ@mail.gmail.com>
2026-08-22 19:11 ` syzbot
2026-08-22 19:37 ` [PATCH i2c-fixes v1] i2c: core: Fix use-after-free during i2c device removal Rafael Alejandro Díaz Cruz
2026-08-22 21:03 ` [syzbot] [fs?] [usb?] KASAN: slab-use-after-free Read in lockref_get (2) syzbot
2026-08-22 23:16 ` [PATCH i2c-fixes v1] i2c: core: Fix use-after-free during i2c device removal Rafael Alejandro Díaz Cruz
2026-08-22 23:57 ` [syzbot] [fs?] [usb?] KASAN: slab-use-after-free Read in lockref_get (2) syzbot
2026-08-23 1:12 ` [PATCH i2c-fixes v1] i2c: core: Fix use-after-free during i2c device removal Rafael Alejandro Díaz Cruz
2026-08-23 3:48 ` [syzbot] [fs?] [usb?] KASAN: slab-use-after-free Read in lockref_get (2) syzbot
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox