* [PATCH i2c-fixes v1] i2c: core: Fix use-after-free during i2c device removal
@ 2026-08-22 6:26 Rafael Alejandro Diaz Cruz
2026-08-22 8:51 ` Hillf Danton
0 siblings, 1 reply; 10+ messages in thread
From: Rafael Alejandro Diaz Cruz @ 2026-08-22 6:26 UTC (permalink / raw)
To: Andi Shyti, linux-i2c, linux-kernel
Cc: Rafael Alejandro Diaz Cruz, syzbot+227dbc9afd022922d624
A race condition between a process calling i2c_device_probe()
and removal of a USB device by another process leading to both
processes calling debugfs_remove() opens up the possibility of
UAF.
Fix it by adding atomic xchg() and replacing &client->debugfs
with null before calling debugfs_remove() such that the
following statement: "if (IS_ERR_OR_NULL(dentry)) return;"
inside of debugfs_remove() executes properly.
Fixes: d06905d68610 ("i2c: add core-managed per-client directory in debugfs")
Reported-by: syzbot+227dbc9afd022922d624@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=227dbc9afd022922d624
Signed-off-by: Rafael Alejandro Diaz Cruz <rafad900@gmail.com>
---
drivers/i2c/i2c-core-base.c | 23 ++++++++++++++++++-----
1 file changed, 18 insertions(+), 5 deletions(-)
diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
index fb25704219c7..6fe11232f5ee 100644
--- a/drivers/i2c/i2c-core-base.c
+++ b/drivers/i2c/i2c-core-base.c
@@ -586,8 +586,14 @@ static int i2c_device_probe(struct device *dev)
goto err_clear_wakeup_irq;
}
- client->debugfs = debugfs_create_dir(dev_name(&client->dev),
- client->adapter->debugfs);
+ struct dentry *parent = READ_ONCE(client->adapter->debugfs);
+
+ if (!parent) {
+ status = -ENODEV;
+ goto err_clear_wakeup_irq;
+ }
+
+ client->debugfs = debugfs_create_dir(dev_name(&client->dev), parent);
if (driver->probe)
status = driver->probe(client);
@@ -608,7 +614,10 @@ static int i2c_device_probe(struct device *dev)
return 0;
err_release_driver_resources:
- debugfs_remove_recursive(client->debugfs);
+ // debugfs_remove_recursive(client->debugfs);
+ struct dentry *dir = xchg(&client->debugfs, NULL);
+
+ debugfs_remove_recursive(dir);
devres_release_group(&client->dev, client->devres_group_id);
err_clear_wakeup_irq:
dev_pm_clear_wake_irq(&client->dev);
@@ -632,7 +641,9 @@ static void i2c_device_remove(struct device *dev)
driver->remove(client);
}
- debugfs_remove_recursive(client->debugfs);
+ struct dentry *dir = xchg(&client->debugfs, NULL);
+
+ debugfs_remove_recursive(dir);
devres_release_group(&client->dev, client->devres_group_id);
@@ -1818,6 +1829,8 @@ void i2c_del_adapter(struct i2c_adapter *adap)
i2c_acpi_remove_space_handler(adap);
+ struct dentry *dir = xchg(&adap->debugfs, NULL);
+
i2c_deregister_clients(adap);
/* device name is gone after device_unregister */
@@ -1827,7 +1840,7 @@ void i2c_del_adapter(struct i2c_adapter *adap)
i2c_host_notify_irq_teardown(adap);
- debugfs_remove_recursive(adap->debugfs);
+ debugfs_remove_recursive(dir);
/* wait until all references to the device are gone
*
--
2.43.0
^ permalink raw reply related [flat|nested] 10+ messages in thread
* Re: [PATCH i2c-fixes v1] i2c: core: Fix use-after-free during i2c device removal
2026-08-22 6:26 [PATCH i2c-fixes v1] i2c: core: Fix use-after-free during i2c device removal Rafael Alejandro Diaz Cruz
@ 2026-08-22 8:51 ` Hillf Danton
2026-08-22 9:25 ` [syzbot] [fs?] [usb?] KASAN: slab-use-after-free Read in lockref_get (2) syzbot
[not found] ` <CALp66yH7QzvGmo+N7BWykYjoaGT-yAezwRv0Pc_ir6qDRTsKvw@mail.gmail.com>
0 siblings, 2 replies; 10+ messages in thread
From: Hillf Danton @ 2026-08-22 8:51 UTC (permalink / raw)
To: syzbot+227dbc9afd022922d624
Cc: Rafael Alejandro Diaz Cruz, Andi Shyti, syzkaller-bugs, linux-i2c,
linux-kernel
#syz test
A race condition between a process calling i2c_device_probe()
and removal of a USB device by another process leading to both
processes calling debugfs_remove() opens up the possibility of
UAF.
Fix it by adding atomic xchg() and replacing &client->debugfs
with null before calling debugfs_remove() such that the
following statement: "if (IS_ERR_OR_NULL(dentry)) return;"
inside of debugfs_remove() executes properly.
Fixes: d06905d68610 ("i2c: add core-managed per-client directory in debugfs")
Reported-by: syzbot+227dbc9afd022922d624@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=227dbc9afd022922d624
Signed-off-by: Rafael Alejandro Diaz Cruz <rafad900@gmail.com>
---
drivers/i2c/i2c-core-base.c | 23 ++++++++++++++++++-----
1 file changed, 18 insertions(+), 5 deletions(-)
diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
index fb25704219c7..6fe11232f5ee 100644
--- a/drivers/i2c/i2c-core-base.c
+++ b/drivers/i2c/i2c-core-base.c
@@ -586,8 +586,14 @@ static int i2c_device_probe(struct device *dev)
goto err_clear_wakeup_irq;
}
- client->debugfs = debugfs_create_dir(dev_name(&client->dev),
- client->adapter->debugfs);
+ struct dentry *parent = READ_ONCE(client->adapter->debugfs);
+
+ if (!parent) {
+ status = -ENODEV;
+ goto err_clear_wakeup_irq;
+ }
+
+ client->debugfs = debugfs_create_dir(dev_name(&client->dev), parent);
if (driver->probe)
status = driver->probe(client);
@@ -608,7 +614,10 @@ static int i2c_device_probe(struct device *dev)
return 0;
err_release_driver_resources:
- debugfs_remove_recursive(client->debugfs);
+ // debugfs_remove_recursive(client->debugfs);
+ struct dentry *dir = xchg(&client->debugfs, NULL);
+
+ debugfs_remove_recursive(dir);
devres_release_group(&client->dev, client->devres_group_id);
err_clear_wakeup_irq:
dev_pm_clear_wake_irq(&client->dev);
@@ -632,7 +641,9 @@ static void i2c_device_remove(struct device *dev)
driver->remove(client);
}
- debugfs_remove_recursive(client->debugfs);
+ struct dentry *dir = xchg(&client->debugfs, NULL);
+
+ debugfs_remove_recursive(dir);
devres_release_group(&client->dev, client->devres_group_id);
@@ -1818,6 +1829,8 @@ void i2c_del_adapter(struct i2c_adapter *adap)
i2c_acpi_remove_space_handler(adap);
+ struct dentry *dir = xchg(&adap->debugfs, NULL);
+
i2c_deregister_clients(adap);
/* device name is gone after device_unregister */
@@ -1827,7 +1840,7 @@ void i2c_del_adapter(struct i2c_adapter *adap)
i2c_host_notify_irq_teardown(adap);
- debugfs_remove_recursive(adap->debugfs);
+ debugfs_remove_recursive(dir);
/* wait until all references to the device are gone
*
--
2.43.0
^ permalink raw reply related [flat|nested] 10+ messages in thread
* Re: [syzbot] [fs?] [usb?] KASAN: slab-use-after-free Read in lockref_get (2)
2026-08-22 8:51 ` Hillf Danton
@ 2026-08-22 9:25 ` syzbot
[not found] ` <CALp66yH7QzvGmo+N7BWykYjoaGT-yAezwRv0Pc_ir6qDRTsKvw@mail.gmail.com>
1 sibling, 0 replies; 10+ messages in thread
From: syzbot @ 2026-08-22 9:25 UTC (permalink / raw)
To: andi.shyti, hdanton, linux-i2c, linux-kernel, rafad900,
syzkaller-bugs
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
pm: mask: 0xffffff max_cycles: 0xffffff, max_idle_ns: 2085701024 ns
[ 3.320347][ T1] NET: Registered PF_INET protocol family
[ 3.322856][ T1] IP idents hash table entries: 131072 (order: 8, 1048576 bytes, vmalloc)
[ 3.336708][ T1] tcp_listen_portaddr_hash hash table entries: 4096 (order: 7, 294912 bytes, vmalloc)
[ 3.339060][ T1] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, vmalloc)
[ 3.341172][ T1] TCP established hash table entries: 65536 (order: 7, 524288 bytes, vmalloc)
[ 3.352671][ T1] TCP bind hash table entries: 65536 (order: 12, 9437184 bytes, vmalloc hugepage)
[ 3.359566][ T1] TCP: Hash tables configured (established 65536 bind 65536)
[ 3.362810][ T1] MPTCP token hash table entries: 8192 (order: 8, 720896 bytes, vmalloc)
[ 3.365711][ T1] UDP hash table entries: 4096 (order: 8, 1048576 bytes, vmalloc)
[ 3.368753][ T1] NET: Registered PF_UNIX/PF_LOCAL protocol family
[ 3.393847][ T1] RPC: Registered named UNIX socket transport module.
[ 3.395099][ T1] RPC: Registered udp transport module.
[ 3.395874][ T1] RPC: Registered tcp transport module.
[ 3.396658][ T1] RPC: Registered tcp-with-tls transport module.
[ 3.397537][ T1] RPC: Registered tcp NFSv4.1 backchannel transport module.
[ 3.413324][ T1] NET: Registered PF_XDP protocol family
[ 3.414554][ T1] pci_bus 0000:00: resource 4 [io 0x0000-0x0cf7 window]
[ 3.415698][ T1] pci_bus 0000:00: resource 5 [io 0x0d00-0x0fff window]
[ 3.416687][ T1] pci_bus 0000:00: resource 6 [io 0xc000-0xffff window]
[ 3.417767][ T1] pci_bus 0000:00: resource 7 [io 0xa000-0xbfff window]
[ 3.418871][ T1] pci_bus 0000:00: resource 8 [mem 0x000a0000-0x000bffff window]
[ 3.419953][ T1] pci_bus 0000:00: resource 9 [mem 0xc0000000-0xfebfefff window]
[ 3.422539][ T1] pci 0000:00:00.0: Limiting direct PCI/PCI transfers
[ 3.423826][ T1] PCI: CLS 0 bytes, default 64
[ 3.426230][ T1] PCI-DMA: Using software bounce buffering for IO (SWIOTLB)
[ 3.427263][ T1] software IO TLB: mapped [mem 0x00000000b4400000-0x00000000b8400000] (64MB)
[ 3.435273][ T1] ACPI: bus type thunderbolt registered
[ 3.443694][ T1] RAPL PMU: API unit is 2^-32 Joules, 0 fixed counters, 10737418240 ms ovfl timer
[ 3.447762][ T59] kworker/u8:1 (59) used greatest stack depth: 29032 bytes left
[ 3.450226][ T58] kworker/u8:1 (58) used greatest stack depth: 27864 bytes left
[ 3.469069][ T1] kvm_amd: CPU 1 isn't AMD or Hygon
[ 3.469872][ T1] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x285cff649df, max_idle_ns: 440795263193 ns
[ 3.471672][ T1] clocksource: Switched to clocksource tsc
[ 3.481565][ T66] kworker/u8:3 (66) used greatest stack depth: 25768 bytes left
[ 3.500131][ T1] Initialise system trusted keyrings
[ 3.502858][ T1] workingset: timestamp_bits=40 (anon: 35) max_order=21 bucket_order=0 (anon: 0)
[ 3.512501][ T1] DLM installed
[ 3.517800][ T1] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 3.536175][ T1] NFS: Registering the id_resolver key type
[ 3.537128][ T1] Key type id_resolver registered
[ 3.538012][ T1] Key type id_legacy registered
[ 3.539140][ T1] nfs4filelayout_init: NFSv4 File Layout Driver Registering...
[ 3.540371][ T1] nfs4flexfilelayout_init: NFSv4 Flexfile Layout Driver Registering...
[ 3.547553][ T1] smbdirect: subsystem loading...
[ 3.564900][ T1] smbdirect: subsystem loaded
[ 3.598084][ T1] Key type cifs.spnego registered
[ 3.599281][ T1] Key type cifs.idmap registered
[ 3.603336][ T1] ntfs3: Enabled Linux POSIX ACLs support
[ 3.604159][ T1] ntfs3: Read-only LZX/Xpress compression included
[ 3.605869][ T1] jffs2: version 2.2. (NAND) (SUMMARY) © 2001-2006 Red Hat, Inc.
[ 3.609511][ T1] romfs: ROMFS MTD (C) 2007 Red Hat, Inc.
[ 3.610587][ T1] QNX4 filesystem 0.2.3 registered.
[ 3.611550][ T1] qnx6: QNX6 filesystem 1.0.0 registered.
[ 3.613253][ T1] fuse: init (API version 7.45)
[ 3.616782][ T1] orangefs_debugfs_init: called with debug mask: :none: :0:
[ 3.619251][ T1] orangefs_init: module version upstream loaded
[ 3.621005][ T1] JFS: nTxBlock = 8192, nTxLock = 65536
[ 3.633589][ T1] SGI XFS with ACLs, security attributes, realtime, scrub, repair, quota, no debug enabled
[ 3.643027][ T1] 9p: Installing v9fs 9p2000 file system support
[ 3.645565][ T1] NILFS version 2 loaded
[ 3.646261][ T1] befs: version: 0.9.3
[ 3.647689][ T1] ocfs2: Registered cluster interface o2cb
[ 3.650626][ T1] ocfs2: Registered cluster interface user
[ 3.652098][ T1] OCFS2 User DLM kernel interface loaded
[ 3.674039][ T1] gfs2: GFS2 installed
[ 3.688972][ T1] ceph: loaded (mds proto 32)
[ 3.702507][ T1] NET: Registered PF_ALG protocol family
[ 3.703631][ T1] async_tx: api initialized (async)
[ 3.704425][ T1] Key type asymmetric registered
[ 3.705357][ T1] Asymmetric key parser 'x509' registered
[ 3.706303][ T1] Asymmetric key parser 'pkcs8' registered
[ 3.707095][ T1] Key type pkcs7_test registered
[ 3.708694][ T1] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 239)
[ 3.711217][ T1] io scheduler mq-deadline registered
[ 3.712022][ T1] io scheduler kyber registered
[ 3.713500][ T1] io scheduler bfq registered
[ 3.733250][ T1] input: Power Button as /devices/platform/LNXPWRBN:00/input/input0
[ 3.737243][ T1] ACPI: button: Power Button [PWRF]
[ 3.740294][ T1] input: Sleep Button as /devices/platform/LNXSLPBN:00/input/input1
[ 3.743488][ T1] ACPI: button: Sleep Button [SLPF]
[ 3.760851][ T1] ioatdma: Intel(R) QuickData Technology Driver 5.00
[ 3.795590][ T122] ACPI: \_SB_.LNKC: Enabled at IRQ 11
[ 3.796719][ T122] virtio-pci 0000:00:03.0: virtio_pci: leaving for legacy driver
[ 3.828286][ T122] ACPI: \_SB_.LNKD: Enabled at IRQ 10
[ 3.829202][ T122] virtio-pci 0000:00:04.0: virtio_pci: leaving for legacy driver
[ 3.859623][ T122] ACPI: \_SB_.LNKB: Enabled at IRQ 10
[ 3.860539][ T122] virtio-pci 0000:00:06.0: virtio_pci: leaving for legacy driver
[ 4.463278][ T1] N_HDLC line discipline registered with maxframe=4096
[ 4.467787][ T1] Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
[ 4.476224][ T1] 00:02: ttyS0 at I/O 0x3f8 (irq = 4, base_baud = 115200) is a 16550A
[ 4.493361][ T1] 00:03: ttyS1 at I/O 0x2f8 (irq = 3, base_baud = 115200) is a 16550A
[ 4.509251][ T1] 00:04: ttyS2 at I/O 0x3e8 (irq = 6, base_baud = 115200) is a 16550A
[ 4.526430][ T1] 00:05: ttyS3 at I/O 0x2e8 (irq = 7, base_baud = 115200) is a 16550A
[ 4.559677][ T1] Non-volatile memory driver v1.3
[ 4.580110][ T1] usbcore: registered new interface driver xillyusb
[ 4.585483][ T1] ACPI: bus type drm_connector registered
[ 4.594378][ T1] [drm] Initialized vgem 1.0.0 for vgem on minor 0
[ 4.603925][ T1] ------------[ cut here ]------------
[ 4.605301][ T1] [PLANE:35:plane-0] pixel format with alpha exposed but blend mode not setup
[ 4.605324][ T1] WARNING: drivers/gpu/drm/drm_mode_config.c:872 at drm_mode_config_validate+0xfb4/0x1be0, CPU#1: swapper/0/1
[ 4.608698][ T1] Modules linked in:
[ 4.609287][ T1] CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full)
[ 4.610609][ T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026
[ 4.612083][ T1] RIP: 0010:drm_mode_config_validate+0xfbb/0x1be0
[ 4.613020][ T1] Code: 00 49 8b 57 18 48 89 f8 48 c1 e8 03 0f b6 04 28 84 c0 74 08 3c 03 0f 8e 00 0b 00 00 48 8d 3d bc 2b 81 0b 41 8b b7 c8 00 00 00 <67> 48 0f b9 3a e9 fa fd ff ff 48 8b 5c 24 20 e8 c1 ab 3c fc 48 8d
[ 4.616410][ T1] RSP: 0000:ffffc90000067c18 EFLAGS: 00010246
[ 4.617338][ T1] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 4.618540][ T1] RDX: ffff88801dffdb00 RSI: 0000000000000023 RDI: ffffffff914f9390
[ 4.619686][ T1] RBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000000
[ 4.620824][ T1] R10: 0000000000000001 R11: 0000000000000000 R12: ffffed1004f76023
[ 4.621960][ T1] R13: ffffed1004f76024 R14: 0000000000000001 R15: ffff888027bb0028
[ 4.623049][ T1] FS: 0000000000000000(0000) GS:ffff888123c83000(0000) knlGS:0000000000000000
[ 4.624304][ T1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 4.625982][ T1] CR2: 0000000000000000 CR3: 000000000eb94000 CR4: 00000000003526f0
[ 4.627366][ T1] Call Trace:
[ 4.628060][ T1] <TASK>
[ 4.628536][ T1] drm_dev_register+0x56e/0x7b0
[ 4.629278][ T1] vkms_create+0x491/0x5b0
[ 4.630003][ T1] ? __pfx_vkms_init+0x10/0x10
[ 4.630947][ T1] vkms_init+0x98/0xe0
[ 4.631562][ T1] do_one_initcall+0x11c/0x6f0
[ 4.632307][ T1] ? __pfx_do_one_initcall+0x10/0x10
[ 4.633099][ T1] ? kasan_unpoison+0x27/0x60
[ 4.633765][ T1] ? kernel_init_freeable+0x4ca/0x7b0
[ 4.634537][ T1] kernel_init_freeable+0x6ea/0x7b0
[ 4.635547][ T1] ? __pfx_kernel_init+0x10/0x10
[ 4.636310][ T1] kernel_init+0x21/0x1e0
[ 4.637019][ T1] ? __pfx_kernel_init+0x10/0x10
[ 4.637931][ T1] ret_from_fork+0x730/0xd60
[ 4.638635][ T1] ? __pfx_ret_from_fork+0x10/0x10
[ 4.639447][ T1] ? __switch_to+0x800/0x10f0
[ 4.640129][ T1] ? __pfx_kernel_init+0x10/0x10
[ 4.640843][ T1] ret_from_fork_asm+0x1a/0x30
[ 4.641540][ T1] </TASK>
[ 4.641984][ T1] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 4.642965][ T1] CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full)
[ 4.644186][ T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026
[ 4.645282][ T1] Call Trace:
[ 4.645282][ T1] <TASK>
[ 4.645282][ T1] dump_stack_lvl+0x100/0x190
[ 4.645282][ T1] vpanic+0x553/0x970
[ 4.645282][ T1] ? __pfx_vpanic+0x10/0x10
[ 4.645282][ T1] panic+0xd1/0xe0
[ 4.645282][ T1] ? __pfx_panic+0x10/0x10
[ 4.645282][ T1] check_panic_on_warn.cold+0x19/0x34
[ 4.645282][ T1] ? drm_mode_config_validate+0xfb4/0x1be0
[ 4.645282][ T1] __warn.cold+0x191/0x318
[ 4.645282][ T1] __report_bug+0x30f/0x440
[ 4.645282][ T1] ? drm_mode_config_validate+0xfb4/0x1be0
[ 4.645282][ T1] ? __pfx___report_bug+0x10/0x10
[ 4.645282][ T1] ? __lock_acquire+0x4c5/0x1ec0
[ 4.654883][ T1] report_bug_entry+0xe2/0x290
[ 4.654883][ T1] ? drm_mode_config_validate+0xfbb/0x1be0
[ 4.654883][ T1] handle_bug+0x1cd/0x2a0
[ 4.654883][ T1] exc_invalid_op+0x17/0x50
[ 4.654883][ T1] asm_exc_invalid_op+0x1a/0x20
[ 4.654883][ T1] RIP: 0010:drm_mode_config_validate+0xfbb/0x1be0
[ 4.654883][ T1] Code: 00 49 8b 57 18 48 89 f8 48 c1 e8 03 0f b6 04 28 84 c0 74 08 3c 03 0f 8e 00 0b 00 00 48 8d 3d bc 2b 81 0b 41 8b b7 c8 00 00 00 <67> 48 0f b9 3a e9 fa fd ff ff 48 8b 5c 24 20 e8 c1 ab 3c fc 48 8d
[ 4.654883][ T1] RSP: 0000:ffffc90000067c18 EFLAGS: 00010246
[ 4.654883][ T1] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 4.654883][ T1] RDX: ffff88801dffdb00 RSI: 0000000000000023 RDI: ffffffff914f9390
[ 4.654883][ T1] RBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000000
[ 4.654883][ T1] R10: 0000000000000001 R11: 0000000000000000 R12: ffffed1004f76023
[ 4.654883][ T1] R13: ffffed1004f76024 R14: 0000000000000001 R15: ffff888027bb0028
[ 4.654883][ T1] ? drm_mode_config_validate+0xf76/0x1be0
[ 4.654883][ T1] drm_dev_register+0x56e/0x7b0
[ 4.654883][ T1] vkms_create+0x491/0x5b0
[ 4.654883][ T1] ? __pfx_vkms_init+0x10/0x10
[ 4.654883][ T1] vkms_init+0x98/0xe0
[ 4.654883][ T1] do_one_initcall+0x11c/0x6f0
[ 4.654883][ T1] ? __pfx_do_one_initcall+0x10/0x10
[ 4.654883][ T1] ? kasan_unpoison+0x27/0x60
[ 4.654883][ T1] ? kernel_init_freeable+0x4ca/0x7b0
[ 4.654883][ T1] kernel_init_freeable+0x6ea/0x7b0
[ 4.654883][ T1] ? __pfx_kernel_init+0x10/0x10
[ 4.654883][ T1] kernel_init+0x21/0x1e0
[ 4.654883][ T1] ? __pfx_kernel_init+0x10/0x10
[ 4.654883][ T1] ret_from_fork+0x730/0xd60
[ 4.654883][ T1] ? __pfx_ret_from_fork+0x10/0x10
[ 4.654883][ T1] ? __switch_to+0x800/0x10f0
[ 4.654883][ T1] ? __pfx_kernel_init+0x10/0x10
[ 4.654883][ T1] ret_from_fork_asm+0x1a/0x30
[ 4.654883][ T1] </TASK>
[ 4.654883][ T1] Kernel Offset: disabled
[ 4.654883][ T1] Rebooting in 86400 seconds..
syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build3894593634=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.26.0'
GOWORK=''
PKG_CONFIG='pkg-config'
git status (err=<nil>)
HEAD detached at 05b26a281c0
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=05b26a281c072cc34dcad83a283fd2aeeff18ad1 -X github.com/google/syzkaller/prog.gitRevisionDate=20260724-140511" ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=05b26a281c072cc34dcad83a283fd2aeeff18ad1 -X github.com/google/syzkaller/prog.gitRevisionDate=20260724-140511" ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=05b26a281c072cc34dcad83a283fd2aeeff18ad1 -X github.com/google/syzkaller/prog.gitRevisionDate=20260724-140511" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"05b26a281c072cc34dcad83a283fd2aeeff18ad1\"
/usr/bin/ld: /tmp/cchHMbJf.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x386): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null
Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=11570625580000
Tested on:
commit: 26260251 Merge tag 'livepatching-for-7.3' of git://git..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=49d6006e566a6d95
dashboard link: https://syzkaller.appspot.com/bug?extid=227dbc9afd022922d624
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
patch: https://syzkaller.appspot.com/x/patch.diff?x=14789549580000
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] [fs?] [usb?] KASAN: slab-use-after-free Read in lockref_get (2)
[not found] ` <CALp66yFrutQ2h8SNyBZn04+LMPMnSEtWxW_Dr0vzfoHvEahSsQ@mail.gmail.com>
@ 2026-08-22 19:11 ` syzbot
2026-08-22 19:37 ` [PATCH i2c-fixes v1] i2c: core: Fix use-after-free during i2c device removal Rafael Alejandro Díaz Cruz
1 sibling, 0 replies; 10+ messages in thread
From: syzbot @ 2026-08-22 19:11 UTC (permalink / raw)
To: andi.shyti, hdanton, linux-i2c, linux-kernel, rafad900,
syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
general protection fault in start_dirop
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000028: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000140-0x0000000000000147]
CPU: 0 UID: 0 PID: 6528 Comm: syz.3.20 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026
RIP: 0010:kasan_byte_accessible+0x15/0x30 mm/kasan/generic.c:210
Code: 00 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 b8 00 00 00 00 00 fc ff df 48 c1 ef 03 48 01 c7 <0f> b6 07 3c 07 0f 96 c0 e9 0e 33 43 09 66 66 2e 0f 1f 84 00 00 00
RSP: 0018:ffffc90003abf4b0 EFLAGS: 00010286
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff81e53a84 RDI: dffffc0000000028
RBP: 0000000000000140 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff81e53a84
R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000000
FS: 00007f2d04fb66c0(0000) GS:ffff888123dde000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2fa63fff CR3: 000000005762d000 CR4: 00000000003526f0
Call Trace:
<TASK>
__kasan_check_byte+0x13/0x50 mm/kasan/common.c:573
kasan_check_byte include/linux/kasan.h:402 [inline]
lock_acquire kernel/locking/lockdep.c:5842 [inline]
lock_acquire+0x132/0x370 kernel/locking/lockdep.c:5825
down_write_nested+0x94/0x200 kernel/locking/rwsem.c:1757
inode_lock_nested include/linux/fs.h:1069 [inline]
__start_dirop fs/namei.c:2918 [inline]
start_dirop+0x4b/0xb0 fs/namei.c:2942
simple_start_creating+0xf9/0x110 fs/libfs.c:2305
debugfs_start_creating.part.0+0x82/0x170 fs/debugfs/inode.c:394
debugfs_start_creating fs/debugfs/inode.c:371 [inline]
debugfs_create_dir+0x72/0x440 fs/debugfs/inode.c:572
i2c_device_probe+0x5f5/0xd10 drivers/i2c/i2c-core-base.c:588
call_driver_probe drivers/base/dd.c:628 [inline]
really_probe+0x241/0xa60 drivers/base/dd.c:706
__driver_probe_device+0x20e/0x450 drivers/base/dd.c:868
driver_probe_device+0x4a/0x140 drivers/base/dd.c:898
__device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026
bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
__device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098
device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153
bus_probe_device+0x64/0x160 drivers/base/bus.c:620
device_add+0x121d/0x1970 drivers/base/core.c:3772
i2c_new_client_device+0x660/0xd30 drivers/i2c/i2c-core-base.c:1019
new_device_store+0x20f/0x420 drivers/i2c/i2c-core-base.c:1307
dev_attr_store+0x58/0x80 drivers/base/core.c:2505
sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x6ac/0x1050 fs/read_write.c:687
ksys_write+0x12a/0x250 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f2d0419de99
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f2d04fb6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f2d04425fa0 RCX: 00007f2d0419de99
RDX: 000000000000000f RSI: 0000200000000700 RDI: 0000000000000004
RBP: 00007f2d04233eaf R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f2d04426038 R14: 00007f2d04425fa0 R15: 00007fff6712ff78
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:kasan_byte_accessible+0x15/0x30 mm/kasan/generic.c:210
Code: 00 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 0f 1f 40 d6 48 b8 00 00 00 00 00 fc ff df 48 c1 ef 03 48 01 c7 <0f> b6 07 3c 07 0f 96 c0 e9 0e 33 43 09 66 66 2e 0f 1f 84 00 00 00
RSP: 0018:ffffc90003abf4b0 EFLAGS: 00010286
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff81e53a84 RDI: dffffc0000000028
RBP: 0000000000000140 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff81e53a84
R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000000
FS: 00007f2d04fb66c0(0000) GS:ffff888123ede000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f28e453f1d7 CR3: 000000005762d000 CR4: 00000000003526f0
----------------
Code disassembly (best guess):
0: 00 00 add %al,(%rax)
2: 0f 1f 00 nopl (%rax)
5: 90 nop
6: 90 nop
7: 90 nop
8: 90 nop
9: 90 nop
a: 90 nop
b: 90 nop
c: 90 nop
d: 90 nop
e: 90 nop
f: 90 nop
10: 90 nop
11: 90 nop
12: 90 nop
13: 90 nop
14: 90 nop
15: 0f 1f 40 d6 nopl -0x2a(%rax)
19: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
20: fc ff df
23: 48 c1 ef 03 shr $0x3,%rdi
27: 48 01 c7 add %rax,%rdi
* 2a: 0f b6 07 movzbl (%rdi),%eax <-- trapping instruction
2d: 3c 07 cmp $0x7,%al
2f: 0f 96 c0 setbe %al
32: e9 0e 33 43 09 jmp 0x9433345
37: 66 data16
38: 66 data16
39: 2e cs
3a: 0f .byte 0xf
3b: 1f (bad)
3c: 84 00 test %al,(%rax)
Tested on:
commit: 48a5a7ab Merge tag 'v7.2-rc4-smb3-client-fixes' of git..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=17679549580000
kernel config: https://syzkaller.appspot.com/x/.config?x=145fa60d73086782
dashboard link: https://syzkaller.appspot.com/bug?extid=227dbc9afd022922d624
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
Note: no patches were applied.
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH i2c-fixes v1] i2c: core: Fix use-after-free during i2c device removal
[not found] ` <CALp66yFrutQ2h8SNyBZn04+LMPMnSEtWxW_Dr0vzfoHvEahSsQ@mail.gmail.com>
2026-08-22 19:11 ` syzbot
@ 2026-08-22 19:37 ` Rafael Alejandro Díaz Cruz
2026-08-22 21:03 ` [syzbot] [fs?] [usb?] KASAN: slab-use-after-free Read in lockref_get (2) syzbot
2026-08-22 23:16 ` [PATCH i2c-fixes v1] i2c: core: Fix use-after-free during i2c device removal Rafael Alejandro Díaz Cruz
1 sibling, 2 replies; 10+ messages in thread
From: Rafael Alejandro Díaz Cruz @ 2026-08-22 19:37 UTC (permalink / raw)
To: Hillf Danton
Cc: syzbot+227dbc9afd022922d624, Andi Shyti, syzkaller-bugs,
linux-i2c, linux-kernel
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
48a5a7ab8d6ab7090564339e039c421f315de912
On Sat, Aug 22, 2026 at 11:26 AM Rafael Alejandro Díaz Cruz
<rafad900@gmail.com> wrote:
>
> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 48a5a7ab8d6ab7090564339e039c421f315de912
>
> On Sat, Aug 22, 2026 at 11:13 AM Rafael Alejandro Díaz Cruz <rafad900@gmail.com> wrote:
>>
>> I see syzkaller failed to test the patch due to some VKMS/DRM
>> issue. It's unrelated to my patch.
>>
>> I have tested on my own local x86 QEMU instance with proper
>> .config and C reproducer. The error does not persist after my
>> patch.
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] [fs?] [usb?] KASAN: slab-use-after-free Read in lockref_get (2)
2026-08-22 19:37 ` [PATCH i2c-fixes v1] i2c: core: Fix use-after-free during i2c device removal Rafael Alejandro Díaz Cruz
@ 2026-08-22 21:03 ` syzbot
2026-08-22 23:16 ` [PATCH i2c-fixes v1] i2c: core: Fix use-after-free during i2c device removal Rafael Alejandro Díaz Cruz
1 sibling, 0 replies; 10+ messages in thread
From: syzbot @ 2026-08-22 21:03 UTC (permalink / raw)
To: andi.shyti, hdanton, linux-i2c, linux-kernel, rafad900,
syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in lockref_get
dvb-usb: bulk message failed: -22 (6/0)
dvb-usb: bulk message failed: -22 (5/0)
ucsi_ccg 1-0008: ucsi_ccg_init failed - -110
==================================================================
BUG: KASAN: slab-use-after-free in __raw_spin_lock include/linux/spinlock_api_smp.h:158 [inline]
BUG: KASAN: slab-use-after-free in _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:158
Read of size 1 at addr ffff88803699f270 by task syz.4.58/6822
CPU: 0 UID: 0 PID: 6822 Comm: syz.4.58 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x13d/0x4b0 mm/kasan/report.c:482
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
__kasan_check_byte+0x36/0x50 mm/kasan/common.c:574
kasan_check_byte include/linux/kasan.h:402 [inline]
lock_acquire kernel/locking/lockdep.c:5842 [inline]
lock_acquire+0x132/0x370 kernel/locking/lockdep.c:5825
__raw_spin_lock include/linux/spinlock_api_smp.h:158 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:158
spin_lock include/linux/spinlock.h:342 [inline]
lockref_get+0x15/0x50 lib/lockref.c:50
dget include/linux/dcache.h:364 [inline]
__simple_recursive_removal+0x3d/0x5c0 fs/libfs.c:601
debugfs_remove+0x5d/0x80 fs/debugfs/inode.c:781
i2c_device_probe+0x6e2/0xd10 drivers/i2c/i2c-core-base.c:610
call_driver_probe drivers/base/dd.c:628 [inline]
really_probe+0x241/0xa60 drivers/base/dd.c:706
__driver_probe_device+0x20e/0x450 drivers/base/dd.c:868
driver_probe_device+0x4a/0x140 drivers/base/dd.c:898
__device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026
bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
__device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098
device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153
bus_probe_device+0x64/0x160 drivers/base/bus.c:620
device_add+0x121d/0x1970 drivers/base/core.c:3772
i2c_new_client_device+0x660/0xd30 drivers/i2c/i2c-core-base.c:1019
new_device_store+0x20f/0x420 drivers/i2c/i2c-core-base.c:1307
dev_attr_store+0x58/0x80 drivers/base/core.c:2505
sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x6ac/0x1050 fs/read_write.c:687
ksys_write+0x12a/0x250 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fe00579de99
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fe006690028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fe005a25fa0 RCX: 00007fe00579de99
RDX: 000000000000000f RSI: 0000200000000700 RDI: 0000000000000004
RBP: 00007fe005833eaf R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fe005a26038 R14: 00007fe005a25fa0 R15: 00007fffd311f6c8
</TASK>
Allocated by task 6822:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
unpoison_slab_object mm/kasan/common.c:340 [inline]
__kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:366
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4612 [inline]
slab_alloc_node mm/slub.c:4945 [inline]
kmem_cache_alloc_lru_noprof+0x267/0x6a0 mm/slub.c:4978
__d_alloc+0x35/0xa50 fs/dcache.c:1902
d_alloc+0x4a/0x1e0 fs/dcache.c:1981
lookup_one_qstr_excl+0x171/0x250 fs/namei.c:1806
__start_dirop fs/namei.c:2920 [inline]
start_dirop+0x59/0xb0 fs/namei.c:2942
simple_start_creating+0xf9/0x110 fs/libfs.c:2305
debugfs_start_creating.part.0+0x82/0x170 fs/debugfs/inode.c:394
debugfs_start_creating fs/debugfs/inode.c:371 [inline]
debugfs_create_dir+0x72/0x440 fs/debugfs/inode.c:572
i2c_device_probe+0x5f5/0xd10 drivers/i2c/i2c-core-base.c:588
call_driver_probe drivers/base/dd.c:628 [inline]
really_probe+0x241/0xa60 drivers/base/dd.c:706
__driver_probe_device+0x20e/0x450 drivers/base/dd.c:868
driver_probe_device+0x4a/0x140 drivers/base/dd.c:898
__device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026
bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
__device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098
device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153
bus_probe_device+0x64/0x160 drivers/base/bus.c:620
device_add+0x121d/0x1970 drivers/base/core.c:3772
i2c_new_client_device+0x660/0xd30 drivers/i2c/i2c-core-base.c:1019
new_device_store+0x20f/0x420 drivers/i2c/i2c-core-base.c:1307
dev_attr_store+0x58/0x80 drivers/base/core.c:2505
sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x6ac/0x1050 fs/read_write.c:687
ksys_write+0x12a/0x250 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 15:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2705 [inline]
slab_free mm/slub.c:6405 [inline]
kmem_cache_free+0x127/0x6b0 mm/slub.c:6532
rcu_do_batch kernel/rcu/tree.c:2645 [inline]
rcu_core+0x5a2/0x10d0 kernel/rcu/tree.c:2897
handle_softirqs+0x1ea/0x9b0 kernel/softirq.c:622
run_ksoftirqd kernel/softirq.c:1076 [inline]
run_ksoftirqd+0x38/0x60 kernel/softirq.c:1068
smpboot_thread_fn+0x3d3/0xaa0 kernel/smpboot.c:160
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Last potentially related work creation:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_record_aux_stack+0xa7/0xc0 mm/kasan/generic.c:556
__call_rcu_common.constprop.0+0xa5/0x9b0 kernel/rcu/tree.c:3159
dentry_free+0x145/0x2b0 fs/dcache.c:450
dentry_kill+0x5e8/0xc20 fs/dcache.c:845
finish_dput fs/dcache.c:1001 [inline]
dput.part.0+0xd7/0x240 fs/dcache.c:1042
dput+0x1f/0x30 fs/dcache.c:1037
find_next_child+0x18f/0x280 fs/libfs.c:592
__simple_recursive_removal+0x2ab/0x5c0 fs/libfs.c:609
debugfs_remove+0x5d/0x80 fs/debugfs/inode.c:781
i2c_del_adapter+0x17f/0x2d0 drivers/i2c/i2c-core-base.c:1829
dvb_usb_i2c_exit+0x9f/0xf0 drivers/media/usb/dvb-usb/dvb-usb-i2c.c:46
dvb_usb_exit drivers/media/usb/dvb-usb/dvb-usb-init.c:144 [inline]
dvb_usb_device_exit+0x313/0x520 drivers/media/usb/dvb-usb/dvb-usb-init.c:338
usb_unbind_interface+0x1dd/0x9e0 drivers/usb/core/driver.c:458
device_remove drivers/base/dd.c:618 [inline]
device_remove+0x12a/0x180 drivers/base/dd.c:610
__device_release_driver drivers/base/dd.c:1349 [inline]
device_release_driver_internal+0x44e/0x620 drivers/base/dd.c:1372
bus_remove_device+0x2bc/0x560 drivers/base/bus.c:664
device_del+0x376/0x9b0 drivers/base/core.c:3961
usb_disable_device+0x367/0x810 drivers/usb/core/message.c:1478
usb_disconnect+0x2e2/0x9a0 drivers/usb/core/hub.c:2345
hub_port_connect drivers/usb/core/hub.c:5407 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
port_event drivers/usb/core/hub.c:5871 [inline]
hub_event+0x1c4f/0x4a60 drivers/usb/core/hub.c:5953
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
The buggy address belongs to the object at ffff88803699f1a0
which belongs to the cache dentry of size 312
The buggy address is located 208 bytes inside of
freed 312-byte region [ffff88803699f1a0, ffff88803699f2d8)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3699e
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff88807ab3d501
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801d2dc140 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800150015 00000000f5000000 ffff88807ab3d501
head: 00fff00000000040 ffff88801d2dc140 dead000000000100 dead000000000122
head: 0000000000000000 0000000800150015 00000000f5000000 ffff88807ab3d501
head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Reclaimable, gfp_mask 0xd20d0(__GFP_RECLAIMABLE|__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4985, tgid 4985 (udevd), ts 39556920182, free_ts 0
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304
alloc_slab_page mm/slub.c:3294 [inline]
allocate_slab mm/slub.c:3408 [inline]
new_slab+0xa2/0x650 mm/slub.c:3454
refill_objects+0xe3/0x410 mm/slub.c:7338
refill_sheaf mm/slub.c:2832 [inline]
__pcs_replace_empty_main+0x376/0x680 mm/slub.c:4703
alloc_from_pcs mm/slub.c:4801 [inline]
slab_alloc_node mm/slub.c:4933 [inline]
kmem_cache_alloc_lru_noprof+0x46a/0x6a0 mm/slub.c:4978
__d_alloc+0x35/0xa50 fs/dcache.c:1902
d_alloc+0x4a/0x1e0 fs/dcache.c:1981
lookup_one_qstr_excl+0x171/0x250 fs/namei.c:1806
__start_renaming+0x1c9/0x520 fs/namei.c:3888
filename_renameat2+0x538/0xa60 fs/namei.c:6167
__do_sys_rename fs/namei.c:6236 [inline]
__se_sys_rename fs/namei.c:6232 [inline]
__x64_sys_rename+0x81/0xb0 fs/namei.c:6232
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page_owner free stack trace missing
Memory state around the buggy address:
ffff88803699f100: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc
ffff88803699f180: fc fc fc fc fa fb fb fb fb fb fb fb fb fb fb fb
>ffff88803699f200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88803699f280: fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc
ffff88803699f300: fc fc fc 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
Tested on:
commit: 48a5a7ab Merge tag 'v7.2-rc4-smb3-client-fixes' of git..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=108ef179580000
kernel config: https://syzkaller.appspot.com/x/.config?x=145fa60d73086782
dashboard link: https://syzkaller.appspot.com/bug?extid=227dbc9afd022922d624
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
Note: no patches were applied.
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH i2c-fixes v1] i2c: core: Fix use-after-free during i2c device removal
2026-08-22 19:37 ` [PATCH i2c-fixes v1] i2c: core: Fix use-after-free during i2c device removal Rafael Alejandro Díaz Cruz
2026-08-22 21:03 ` [syzbot] [fs?] [usb?] KASAN: slab-use-after-free Read in lockref_get (2) syzbot
@ 2026-08-22 23:16 ` Rafael Alejandro Díaz Cruz
2026-08-22 23:57 ` [syzbot] [fs?] [usb?] KASAN: slab-use-after-free Read in lockref_get (2) syzbot
2026-08-23 1:12 ` [PATCH i2c-fixes v1] i2c: core: Fix use-after-free during i2c device removal Rafael Alejandro Díaz Cruz
1 sibling, 2 replies; 10+ messages in thread
From: Rafael Alejandro Díaz Cruz @ 2026-08-22 23:16 UTC (permalink / raw)
To: Hillf Danton
Cc: syzbot+227dbc9afd022922d624, Andi Shyti, syzkaller-bugs,
linux-i2c, linux-kernel
#syz test
On Sat, Aug 22, 2026 at 12:37 PM Rafael Alejandro Díaz Cruz
<rafad900@gmail.com> wrote:
>
> #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
> 48a5a7ab8d6ab7090564339e039c421f315de912
>
>
> On Sat, Aug 22, 2026 at 11:26 AM Rafael Alejandro Díaz Cruz
> <rafad900@gmail.com> wrote:
> >
> > #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 48a5a7ab8d6ab7090564339e039c421f315de912
> >
> > On Sat, Aug 22, 2026 at 11:13 AM Rafael Alejandro Díaz Cruz <rafad900@gmail.com> wrote:
> >>
> >> I see syzkaller failed to test the patch due to some VKMS/DRM
> >> issue. It's unrelated to my patch.
> >>
> >> I have tested on my own local x86 QEMU instance with proper
> >> .config and C reproducer. The error does not persist after my
> >> patch.
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] [fs?] [usb?] KASAN: slab-use-after-free Read in lockref_get (2)
2026-08-22 23:16 ` [PATCH i2c-fixes v1] i2c: core: Fix use-after-free during i2c device removal Rafael Alejandro Díaz Cruz
@ 2026-08-22 23:57 ` syzbot
2026-08-23 1:12 ` [PATCH i2c-fixes v1] i2c: core: Fix use-after-free during i2c device removal Rafael Alejandro Díaz Cruz
1 sibling, 0 replies; 10+ messages in thread
From: syzbot @ 2026-08-22 23:57 UTC (permalink / raw)
To: andi.shyti, hdanton, linux-i2c, linux-kernel, rafad900,
syzkaller-bugs
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
m: mask: 0xffffff max_cycles: 0xffffff, max_idle_ns: 2085701024 ns
[ 3.244305][ T1] NET: Registered PF_INET protocol family
[ 3.247499][ T1] IP idents hash table entries: 131072 (order: 8, 1048576 bytes, vmalloc)
[ 3.259218][ T1] tcp_listen_portaddr_hash hash table entries: 4096 (order: 7, 294912 bytes, vmalloc)
[ 3.261261][ T1] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, vmalloc)
[ 3.263274][ T1] TCP established hash table entries: 65536 (order: 7, 524288 bytes, vmalloc)
[ 3.274524][ T1] TCP bind hash table entries: 65536 (order: 12, 9437184 bytes, vmalloc hugepage)
[ 3.281391][ T1] TCP: Hash tables configured (established 65536 bind 65536)
[ 3.284940][ T1] MPTCP token hash table entries: 8192 (order: 8, 720896 bytes, vmalloc)
[ 3.288577][ T1] UDP hash table entries: 4096 (order: 8, 1048576 bytes, vmalloc)
[ 3.291550][ T1] NET: Registered PF_UNIX/PF_LOCAL protocol family
[ 3.306684][ T1] RPC: Registered named UNIX socket transport module.
[ 3.307718][ T1] RPC: Registered udp transport module.
[ 3.308513][ T1] RPC: Registered tcp transport module.
[ 3.309357][ T1] RPC: Registered tcp-with-tls transport module.
[ 3.310392][ T1] RPC: Registered tcp NFSv4.1 backchannel transport module.
[ 3.316342][ T1] NET: Registered PF_XDP protocol family
[ 3.317480][ T1] pci_bus 0000:00: resource 4 [io 0x0000-0x0cf7 window]
[ 3.318551][ T1] pci_bus 0000:00: resource 5 [io 0x0d00-0x0fff window]
[ 3.319885][ T1] pci_bus 0000:00: resource 6 [io 0xc000-0xffff window]
[ 3.321388][ T1] pci_bus 0000:00: resource 7 [io 0xa000-0xbfff window]
[ 3.322459][ T1] pci_bus 0000:00: resource 8 [mem 0x000a0000-0x000bffff window]
[ 3.323839][ T1] pci_bus 0000:00: resource 9 [mem 0xc0000000-0xfebfefff window]
[ 3.326592][ T1] pci 0000:00:00.0: Limiting direct PCI/PCI transfers
[ 3.328327][ T1] PCI: CLS 0 bytes, default 64
[ 3.329389][ T1] PCI-DMA: Using software bounce buffering for IO (SWIOTLB)
[ 3.330474][ T1] software IO TLB: mapped [mem 0x00000000b4400000-0x00000000b8400000] (64MB)
[ 3.333143][ T1] ACPI: bus type thunderbolt registered
[ 3.341226][ T1] RAPL PMU: API unit is 2^-32 Joules, 0 fixed counters, 10737418240 ms ovfl timer
[ 3.346936][ T59] kworker/u8:1 (59) used greatest stack depth: 27864 bytes left
[ 3.364118][ T1] kvm_amd: CPU 1 isn't AMD or Hygon
[ 3.365204][ T1] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x285d48fab19, max_idle_ns: 440795208084 ns
[ 3.367725][ T1] clocksource: Switched to clocksource tsc
[ 3.403452][ T1] Initialise system trusted keyrings
[ 3.404162][ T84] kworker/u8:4 (84) used greatest stack depth: 27160 bytes left
[ 3.407742][ T1] workingset: timestamp_bits=40 (anon: 35) max_order=21 bucket_order=0 (anon: 0)
[ 3.415933][ T1] DLM installed
[ 3.421490][ T1] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 3.429626][ T1] NFS: Registering the id_resolver key type
[ 3.430824][ T1] Key type id_resolver registered
[ 3.431584][ T1] Key type id_legacy registered
[ 3.432928][ T1] nfs4filelayout_init: NFSv4 File Layout Driver Registering...
[ 3.434314][ T1] nfs4flexfilelayout_init: NFSv4 Flexfile Layout Driver Registering...
[ 3.441599][ T1] smbdirect: subsystem loading...
[ 3.448154][ T1] smbdirect: subsystem loaded
[ 3.471719][ T1] Key type cifs.spnego registered
[ 3.472760][ T1] Key type cifs.idmap registered
[ 3.476921][ T1] ntfs3: Enabled Linux POSIX ACLs support
[ 3.477738][ T1] ntfs3: Read-only LZX/Xpress compression included
[ 3.478987][ T1] jffs2: version 2.2. (NAND) (SUMMARY) © 2001-2006 Red Hat, Inc.
[ 3.482637][ T1] romfs: ROMFS MTD (C) 2007 Red Hat, Inc.
[ 3.483593][ T1] QNX4 filesystem 0.2.3 registered.
[ 3.484738][ T1] qnx6: QNX6 filesystem 1.0.0 registered.
[ 3.486442][ T1] fuse: init (API version 7.45)
[ 3.489877][ T1] orangefs_debugfs_init: called with debug mask: :none: :0:
[ 3.492401][ T1] orangefs_init: module version upstream loaded
[ 3.494199][ T1] JFS: nTxBlock = 8192, nTxLock = 65536
[ 3.507409][ T1] SGI XFS with ACLs, security attributes, realtime, scrub, repair, quota, no debug enabled
[ 3.514958][ T1] 9p: Installing v9fs 9p2000 file system support
[ 3.516652][ T1] NILFS version 2 loaded
[ 3.517609][ T1] befs: version: 0.9.3
[ 3.519354][ T1] ocfs2: Registered cluster interface o2cb
[ 3.521201][ T1] ocfs2: Registered cluster interface user
[ 3.523024][ T1] OCFS2 User DLM kernel interface loaded
[ 3.545147][ T1] gfs2: GFS2 installed
[ 3.560183][ T1] ceph: loaded (mds proto 32)
[ 3.573563][ T1] NET: Registered PF_ALG protocol family
[ 3.574709][ T1] async_tx: api initialized (async)
[ 3.575970][ T1] Key type asymmetric registered
[ 3.576921][ T1] Asymmetric key parser 'x509' registered
[ 3.577745][ T1] Asymmetric key parser 'pkcs8' registered
[ 3.578604][ T1] Key type pkcs7_test registered
[ 3.579842][ T1] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 239)
[ 3.583698][ T1] io scheduler mq-deadline registered
[ 3.584626][ T1] io scheduler kyber registered
[ 3.586119][ T1] io scheduler bfq registered
[ 3.601298][ T1] input: Power Button as /devices/platform/LNXPWRBN:00/input/input0
[ 3.605629][ T1] ACPI: button: Power Button [PWRF]
[ 3.609215][ T1] input: Sleep Button as /devices/platform/LNXSLPBN:00/input/input1
[ 3.611991][ T1] ACPI: button: Sleep Button [SLPF]
[ 3.635978][ T1] ioatdma: Intel(R) QuickData Technology Driver 5.00
[ 3.662181][ T10] ACPI: \_SB_.LNKC: Enabled at IRQ 11
[ 3.663176][ T10] virtio-pci 0000:00:03.0: virtio_pci: leaving for legacy driver
[ 3.694911][ T10] ACPI: \_SB_.LNKD: Enabled at IRQ 10
[ 3.696705][ T10] virtio-pci 0000:00:04.0: virtio_pci: leaving for legacy driver
[ 3.724400][ T10] ACPI: \_SB_.LNKB: Enabled at IRQ 10
[ 3.725672][ T10] virtio-pci 0000:00:06.0: virtio_pci: leaving for legacy driver
[ 4.062323][ T524] kworker/u8:7 (524) used greatest stack depth: 26904 bytes left
[ 4.258630][ T1] N_HDLC line discipline registered with maxframe=4096
[ 4.261364][ T1] Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
[ 4.275999][ T1] 00:02: ttyS0 at I/O 0x3f8 (irq = 4, base_baud = 115200) is a 16550A
[ 4.291450][ T1] 00:03: ttyS1 at I/O 0x2f8 (irq = 3, base_baud = 115200) is a 16550A
[ 4.306966][ T1] 00:04: ttyS2 at I/O 0x3e8 (irq = 6, base_baud = 115200) is a 16550A
[ 4.321856][ T1] 00:05: ttyS3 at I/O 0x2e8 (irq = 7, base_baud = 115200) is a 16550A
[ 4.357497][ T1] Non-volatile memory driver v1.3
[ 4.382848][ T1] usbcore: registered new interface driver xillyusb
[ 4.391825][ T1] ACPI: bus type drm_connector registered
[ 4.402882][ T1] [drm] Initialized vgem 1.0.0 for vgem on minor 0
[ 4.408272][ T1] ------------[ cut here ]------------
[ 4.409057][ T1] [PLANE:35:plane-0] pixel format with alpha exposed but blend mode not setup
[ 4.409076][ T1] WARNING: drivers/gpu/drm/drm_mode_config.c:872 at drm_mode_config_validate+0xfb4/0x1be0, CPU#0: swapper/0/1
[ 4.412353][ T1] Modules linked in:
[ 4.412951][ T1] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full)
[ 4.414327][ T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026
[ 4.415957][ T1] RIP: 0010:drm_mode_config_validate+0xfbb/0x1be0
[ 4.416871][ T1] Code: 00 49 8b 57 18 48 89 f8 48 c1 e8 03 0f b6 04 28 84 c0 74 08 3c 03 0f 8e 00 0b 00 00 48 8d 3d fc 1e 81 0b 41 8b b7 c8 00 00 00 <67> 48 0f b9 3a e9 fa fd ff ff 48 8b 5c 24 20 e8 41 9b 3c fc 48 8d
[ 4.420277][ T1] RSP: 0000:ffffc90000067c18 EFLAGS: 00010246
[ 4.421416][ T1] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 4.422525][ T1] RDX: ffff8880270d17e0 RSI: 0000000000000023 RDI: ffffffff914f9750
[ 4.423790][ T1] RBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000000
[ 4.424912][ T1] R10: 0000000000000001 R11: 0000000000000000 R12: ffffed1004db7023
[ 4.426628][ T1] R13: ffffed1004db7024 R14: 0000000000000001 R15: ffff888026db8028
[ 4.427965][ T1] FS: 0000000000000000(0000) GS:ffff888123b83000(0000) knlGS:0000000000000000
[ 4.429922][ T1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 4.431232][ T1] CR2: ffff88823ffff000 CR3: 000000000eb94000 CR4: 00000000003526f0
[ 4.432829][ T1] Call Trace:
[ 4.433578][ T1] <TASK>
[ 4.434377][ T1] drm_dev_register+0x56e/0x7b0
[ 4.435116][ T1] vkms_create+0x491/0x5b0
[ 4.436303][ T1] ? __pfx_vkms_init+0x10/0x10
[ 4.437097][ T1] vkms_init+0x98/0xe0
[ 4.437725][ T1] do_one_initcall+0x11c/0x6f0
[ 4.438689][ T1] ? __pfx_do_one_initcall+0x10/0x10
[ 4.439912][ T1] ? kasan_unpoison+0x15/0x60
[ 4.440799][ T1] ? kernel_init_freeable+0x4ca/0x7b0
[ 4.441810][ T1] kernel_init_freeable+0x6ea/0x7b0
[ 4.442739][ T1] ? __pfx_kernel_init+0x10/0x10
[ 4.443755][ T1] kernel_init+0x21/0x1e0
[ 4.444481][ T1] ? __pfx_kernel_init+0x10/0x10
[ 4.445296][ T1] ret_from_fork+0x730/0xd60
[ 4.446009][ T1] ? __pfx_ret_from_fork+0x10/0x10
[ 4.446941][ T1] ? __switch_to+0x800/0x10f0
[ 4.448149][ T1] ? __pfx_kernel_init+0x10/0x10
[ 4.448847][ T1] ret_from_fork_asm+0x1a/0x30
[ 4.449585][ T1] </TASK>
[ 4.450241][ T1] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 4.451670][ T1] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full)
[ 4.453007][ T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026
[ 4.454566][ T1] Call Trace:
[ 4.455144][ T1] <TASK>
[ 4.455713][ T1] dump_stack_lvl+0x100/0x190
[ 4.455982][ T1] vpanic+0x553/0x970
[ 4.455982][ T1] ? __pfx_vpanic+0x10/0x10
[ 4.455982][ T1] panic+0xd1/0xe0
[ 4.455982][ T1] ? __pfx_panic+0x10/0x10
[ 4.455982][ T1] check_panic_on_warn.cold+0x19/0x34
[ 4.455982][ T1] ? drm_mode_config_validate+0xfb4/0x1be0
[ 4.455982][ T1] __warn.cold+0x191/0x318
[ 4.455982][ T1] __report_bug+0x30f/0x440
[ 4.455982][ T1] ? drm_mode_config_validate+0xfb4/0x1be0
[ 4.455982][ T1] ? __pfx___report_bug+0x10/0x10
[ 4.455982][ T1] ? __lock_acquire+0x4c5/0x1ec0
[ 4.455982][ T1] report_bug_entry+0xe2/0x290
[ 4.455982][ T1] ? drm_mode_config_validate+0xfbb/0x1be0
[ 4.455982][ T1] handle_bug+0x1cd/0x2a0
[ 4.455982][ T1] exc_invalid_op+0x17/0x50
[ 4.455982][ T1] asm_exc_invalid_op+0x1a/0x20
[ 4.455982][ T1] RIP: 0010:drm_mode_config_validate+0xfbb/0x1be0
[ 4.455982][ T1] Code: 00 49 8b 57 18 48 89 f8 48 c1 e8 03 0f b6 04 28 84 c0 74 08 3c 03 0f 8e 00 0b 00 00 48 8d 3d fc 1e 81 0b 41 8b b7 c8 00 00 00 <67> 48 0f b9 3a e9 fa fd ff ff 48 8b 5c 24 20 e8 41 9b 3c fc 48 8d
[ 4.455982][ T1] RSP: 0000:ffffc90000067c18 EFLAGS: 00010246
[ 4.455982][ T1] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000
[ 4.455982][ T1] RDX: ffff8880270d17e0 RSI: 0000000000000023 RDI: ffffffff914f9750
[ 4.455982][ T1] RBP: dffffc0000000000 R08: 0000000000000001 R09: 0000000000000000
[ 4.455982][ T1] R10: 0000000000000001 R11: 0000000000000000 R12: ffffed1004db7023
[ 4.455982][ T1] R13: ffffed1004db7024 R14: 0000000000000001 R15: ffff888026db8028
[ 4.455982][ T1] ? drm_mode_config_validate+0xf76/0x1be0
[ 4.455982][ T1] drm_dev_register+0x56e/0x7b0
[ 4.455982][ T1] vkms_create+0x491/0x5b0
[ 4.455982][ T1] ? __pfx_vkms_init+0x10/0x10
[ 4.455982][ T1] vkms_init+0x98/0xe0
[ 4.455982][ T1] do_one_initcall+0x11c/0x6f0
[ 4.455982][ T1] ? __pfx_do_one_initcall+0x10/0x10
[ 4.455982][ T1] ? kasan_unpoison+0x15/0x60
[ 4.455982][ T1] ? kernel_init_freeable+0x4ca/0x7b0
[ 4.455982][ T1] kernel_init_freeable+0x6ea/0x7b0
[ 4.455982][ T1] ? __pfx_kernel_init+0x10/0x10
[ 4.455982][ T1] kernel_init+0x21/0x1e0
[ 4.455982][ T1] ? __pfx_kernel_init+0x10/0x10
[ 4.455982][ T1] ret_from_fork+0x730/0xd60
[ 4.455982][ T1] ? __pfx_ret_from_fork+0x10/0x10
[ 4.455982][ T1] ? __switch_to+0x800/0x10f0
[ 4.455982][ T1] ? __pfx_kernel_init+0x10/0x10
[ 4.455982][ T1] ret_from_fork_asm+0x1a/0x30
[ 4.455982][ T1] </TASK>
[ 4.455982][ T1] Kernel Offset: disabled
[ 4.455982][ T1] Rebooting in 86400 seconds..
syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build1331161525=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.26.0'
GOWORK=''
PKG_CONFIG='pkg-config'
git status (err=<nil>)
HEAD detached at 05b26a281c0
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=05b26a281c072cc34dcad83a283fd2aeeff18ad1 -X github.com/google/syzkaller/prog.gitRevisionDate=20260724-140511" ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=05b26a281c072cc34dcad83a283fd2aeeff18ad1 -X github.com/google/syzkaller/prog.gitRevisionDate=20260724-140511" ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=05b26a281c072cc34dcad83a283fd2aeeff18ad1 -X github.com/google/syzkaller/prog.gitRevisionDate=20260724-140511" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"05b26a281c072cc34dcad83a283fd2aeeff18ad1\"
/usr/bin/ld: /tmp/ccXjEkJ3.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x386): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null
Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=11d04625580000
Tested on:
commit: 66fb95a5 Merge tag 'caps-pr-20260820' of git://git.ker..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=49d6006e566a6d95
dashboard link: https://syzkaller.appspot.com/bug?extid=227dbc9afd022922d624
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
Note: no patches were applied.
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [PATCH i2c-fixes v1] i2c: core: Fix use-after-free during i2c device removal
2026-08-22 23:16 ` [PATCH i2c-fixes v1] i2c: core: Fix use-after-free during i2c device removal Rafael Alejandro Díaz Cruz
2026-08-22 23:57 ` [syzbot] [fs?] [usb?] KASAN: slab-use-after-free Read in lockref_get (2) syzbot
@ 2026-08-23 1:12 ` Rafael Alejandro Díaz Cruz
2026-08-23 3:48 ` [syzbot] [fs?] [usb?] KASAN: slab-use-after-free Read in lockref_get (2) syzbot
1 sibling, 1 reply; 10+ messages in thread
From: Rafael Alejandro Díaz Cruz @ 2026-08-23 1:12 UTC (permalink / raw)
To: Hillf Danton
Cc: syzbot+227dbc9afd022922d624, Andi Shyti, syzkaller-bugs,
linux-i2c, linux-kernel
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux.git
i2c/i2c-fixes
On Sat, Aug 22, 2026 at 4:16 PM Rafael Alejandro Díaz Cruz
<rafad900@gmail.com> wrote:
>
> #syz test
>
> On Sat, Aug 22, 2026 at 12:37 PM Rafael Alejandro Díaz Cruz
> <rafad900@gmail.com> wrote:
> >
> > #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
> > 48a5a7ab8d6ab7090564339e039c421f315de912
> >
> >
> > On Sat, Aug 22, 2026 at 11:26 AM Rafael Alejandro Díaz Cruz
> > <rafad900@gmail.com> wrote:
> > >
> > > #syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 48a5a7ab8d6ab7090564339e039c421f315de912
> > >
> > > On Sat, Aug 22, 2026 at 11:13 AM Rafael Alejandro Díaz Cruz <rafad900@gmail.com> wrote:
> > >>
> > >> I see syzkaller failed to test the patch due to some VKMS/DRM
> > >> issue. It's unrelated to my patch.
> > >>
> > >> I have tested on my own local x86 QEMU instance with proper
> > >> .config and C reproducer. The error does not persist after my
> > >> patch.
^ permalink raw reply [flat|nested] 10+ messages in thread
* Re: [syzbot] [fs?] [usb?] KASAN: slab-use-after-free Read in lockref_get (2)
2026-08-23 1:12 ` [PATCH i2c-fixes v1] i2c: core: Fix use-after-free during i2c device removal Rafael Alejandro Díaz Cruz
@ 2026-08-23 3:48 ` syzbot
0 siblings, 0 replies; 10+ messages in thread
From: syzbot @ 2026-08-23 3:48 UTC (permalink / raw)
To: andi.shyti, hdanton, linux-i2c, linux-kernel, rafad900,
syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in lockref_get
dvb-usb: bulk message failed: -22 (5/0)
ucsi_ccg 1-0008: ucsi_ccg_init failed - -110
==================================================================
BUG: KASAN: slab-use-after-free in __raw_spin_lock include/linux/spinlock_api_smp.h:190 [inline]
BUG: KASAN: slab-use-after-free in _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:173
Read of size 1 at addr ffff88805cdc3cb8 by task syz.0.61/6625
CPU: 1 UID: 0 PID: 6625 Comm: syz.0.61 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/05/2026
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x13d/0x4b0 mm/kasan/report.c:482
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
__kasan_check_byte+0x36/0x50 mm/kasan/common.c:574
kasan_check_byte include/linux/kasan.h:402 [inline]
lock_acquire kernel/locking/lockdep.c:5860 [inline]
lock_acquire+0x132/0x370 kernel/locking/lockdep.c:5843
__raw_spin_lock include/linux/spinlock_api_smp.h:190 [inline]
_raw_spin_lock+0x2e/0x40 kernel/locking/spinlock.c:173
spin_lock include/linux/spinlock.h:347 [inline]
lockref_get+0x15/0x50 lib/lockref.c:50
dget include/linux/dcache.h:364 [inline]
__simple_recursive_removal+0x3d/0x5c0 fs/libfs.c:601
debugfs_remove+0x5d/0x80 fs/debugfs/inode.c:781
i2c_device_probe+0x6e2/0xd10 drivers/i2c/i2c-core-base.c:611
call_driver_probe drivers/base/dd.c:628 [inline]
really_probe+0x241/0xa60 drivers/base/dd.c:706
__driver_probe_device+0x20e/0x450 drivers/base/dd.c:868
driver_probe_device+0x4a/0x140 drivers/base/dd.c:898
__device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026
bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
__device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098
device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153
bus_probe_device+0x64/0x160 drivers/base/bus.c:620
device_add+0x121d/0x1970 drivers/base/core.c:3772
i2c_new_client_device+0x660/0xd30 drivers/i2c/i2c-core-base.c:1020
new_device_store+0x20f/0x420 drivers/i2c/i2c-core-base.c:1308
dev_attr_store+0x58/0x80 drivers/base/core.c:2505
sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x6af/0x1050 fs/read_write.c:687
ksys_write+0x12a/0x250 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f6dc559de99
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f6dc649b028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f6dc5825fa0 RCX: 00007f6dc559de99
RDX: 000000000000000f RSI: 0000200000000700 RDI: 0000000000000004
RBP: 00007f6dc5633eaf R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f6dc5826038 R14: 00007f6dc5825fa0 R15: 00007ffdbbd8b238
</TASK>
Allocated by task 6625:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
unpoison_slab_object mm/kasan/common.c:340 [inline]
__kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:366
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4584 [inline]
slab_alloc_node mm/slub.c:4917 [inline]
kmem_cache_alloc_lru_noprof+0x267/0x6a0 mm/slub.c:4950
__d_alloc+0x35/0xa50 fs/dcache.c:1907
d_alloc+0x4a/0x1e0 fs/dcache.c:1986
lookup_one_qstr_excl+0x171/0x250 fs/namei.c:1806
__start_dirop fs/namei.c:2920 [inline]
start_dirop+0x59/0xb0 fs/namei.c:2942
simple_start_creating+0xf9/0x110 fs/libfs.c:2308
debugfs_start_creating.part.0+0x82/0x170 fs/debugfs/inode.c:394
debugfs_start_creating fs/debugfs/inode.c:371 [inline]
debugfs_create_dir+0x72/0x440 fs/debugfs/inode.c:572
i2c_device_probe+0x5f5/0xd10 drivers/i2c/i2c-core-base.c:589
call_driver_probe drivers/base/dd.c:628 [inline]
really_probe+0x241/0xa60 drivers/base/dd.c:706
__driver_probe_device+0x20e/0x450 drivers/base/dd.c:868
driver_probe_device+0x4a/0x140 drivers/base/dd.c:898
__device_attach_driver+0x1df/0x320 drivers/base/dd.c:1026
bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
__device_attach+0x1e4/0x4d0 drivers/base/dd.c:1098
device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1153
bus_probe_device+0x64/0x160 drivers/base/bus.c:620
device_add+0x121d/0x1970 drivers/base/core.c:3772
i2c_new_client_device+0x660/0xd30 drivers/i2c/i2c-core-base.c:1020
new_device_store+0x20f/0x420 drivers/i2c/i2c-core-base.c:1308
dev_attr_store+0x58/0x80 drivers/base/core.c:2505
sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x6af/0x1050 fs/read_write.c:687
ksys_write+0x12a/0x250 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 23:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2677 [inline]
slab_free mm/slub.c:6377 [inline]
kmem_cache_free+0x127/0x6b0 mm/slub.c:6504
rcu_do_batch kernel/rcu/tree.c:2645 [inline]
rcu_core+0x5a2/0x10e0 kernel/rcu/tree.c:2897
handle_softirqs+0x1e6/0x9d0 kernel/softirq.c:645
run_ksoftirqd kernel/softirq.c:1108 [inline]
run_ksoftirqd+0x38/0x60 kernel/softirq.c:1100
smpboot_thread_fn+0x3d3/0xab0 kernel/smpboot.c:160
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Last potentially related work creation:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_record_aux_stack+0xa7/0xc0 mm/kasan/generic.c:556
__call_rcu_common.constprop.0+0xa5/0x9b0 kernel/rcu/tree.c:3159
dentry_free+0x152/0x2c0 fs/dcache.c:450
dentry_kill+0x5e8/0xc20 fs/dcache.c:845
finish_dput fs/dcache.c:1001 [inline]
dput.part.0+0xd7/0x240 fs/dcache.c:1042
dput+0x1f/0x30 fs/dcache.c:1037
find_next_child+0x18f/0x280 fs/libfs.c:592
__simple_recursive_removal+0x2ab/0x5c0 fs/libfs.c:609
debugfs_remove+0x5d/0x80 fs/debugfs/inode.c:781
i2c_del_adapter+0x17f/0x2d0 drivers/i2c/i2c-core-base.c:1830
dvb_usb_i2c_exit+0x9f/0xf0 drivers/media/usb/dvb-usb/dvb-usb-i2c.c:46
dvb_usb_exit drivers/media/usb/dvb-usb/dvb-usb-init.c:144 [inline]
dvb_usb_device_exit+0x313/0x520 drivers/media/usb/dvb-usb/dvb-usb-init.c:338
usb_unbind_interface+0x1dd/0x9e0 drivers/usb/core/driver.c:458
device_remove drivers/base/dd.c:618 [inline]
device_remove+0x12a/0x180 drivers/base/dd.c:610
__device_release_driver drivers/base/dd.c:1349 [inline]
device_release_driver_internal+0x44e/0x620 drivers/base/dd.c:1372
bus_remove_device+0x2bc/0x560 drivers/base/bus.c:664
device_del+0x376/0x9b0 drivers/base/core.c:3961
usb_disable_device+0x367/0x810 drivers/usb/core/message.c:1478
usb_disconnect+0x2e2/0x9a0 drivers/usb/core/hub.c:2345
hub_port_connect drivers/usb/core/hub.c:5415 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5715 [inline]
port_event drivers/usb/core/hub.c:5879 [inline]
hub_event+0x1bb1/0x4420 drivers/usb/core/hub.c:5961
process_one_work+0xa23/0x1940 kernel/workqueue.c:3322
process_scheduled_works kernel/workqueue.c:3405 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3486
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
The buggy address belongs to the object at ffff88805cdc3be8
which belongs to the cache dentry of size 312
The buggy address is located 208 bytes inside of
freed 312-byte region [ffff88805cdc3be8, ffff88805cdc3d20)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88805cdc3318 pfn:0x5cdc2
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff88805cdc3ed9
flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000240 ffff88801da9b140 ffffea0001676490 ffffea0001736990
raw: ffff88805cdc3318 0000000800150013 00000000f5000000 ffff88805cdc3ed9
head: 00fff00000000240 ffff88801da9b140 ffffea0001676490 ffffea0001736990
head: ffff88805cdc3318 0000000800150013 00000000f5000000 ffff88805cdc3ed9
head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Reclaimable, gfp_mask 0xd20d0(__GFP_RECLAIMABLE|__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 6132, tgid 6132 (syz-executor), ts 121956208589, free_ts 78469627650
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0xf46/0x3500 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304
alloc_slab_page mm/slub.c:3266 [inline]
allocate_slab mm/slub.c:3380 [inline]
new_slab+0xa2/0x660 mm/slub.c:3426
refill_objects+0xe3/0x410 mm/slub.c:7310
refill_sheaf mm/slub.c:2804 [inline]
__pcs_replace_empty_main+0x372/0x680 mm/slub.c:4675
alloc_from_pcs mm/slub.c:4773 [inline]
slab_alloc_node mm/slub.c:4905 [inline]
kmem_cache_alloc_lru_noprof+0x46a/0x6a0 mm/slub.c:4950
__d_alloc+0x35/0xa50 fs/dcache.c:1907
d_alloc_pseudo+0x1c/0xc0 fs/dcache.c:2038
alloc_path_pseudo fs/file_table.c:407 [inline]
alloc_file_pseudo+0x118/0x290 fs/file_table.c:423
sock_alloc_file+0x50/0x210 net/socket.c:557
sock_map_fd net/socket.c:587 [inline]
__sys_socket+0x1c0/0x260 net/socket.c:1827
__do_sys_socket net/socket.c:1832 [inline]
__se_sys_socket net/socket.c:1830 [inline]
__x64_sys_socket+0x72/0xb0 net/socket.c:1830
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5665 tgid 5665 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
free_pages_prepare+0x586/0xd80 mm/page_alloc.c:1451
__free_contig_range_common+0x14f/0x250 mm/page_alloc.c:6897
__free_contig_range mm/page_alloc.c:6942 [inline]
free_pages_bulk+0xbd/0x200 mm/page_alloc.c:5257
vm_area_free_pages+0xad/0x2b0 mm/vmalloc.c:3461
vfree mm/vmalloc.c:3510 [inline]
vfree+0x108/0x730 mm/vmalloc.c:3484
kcov_put kernel/kcov.c:447 [inline]
kcov_put kernel/kcov.c:443 [inline]
kcov_close+0x34/0x60 kernel/kcov.c:554
__fput+0x3ff/0xb50 fs/file_table.c:512
task_work_run+0x150/0x240 kernel/task_work.c:233
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0x951/0x2ae0 kernel/exit.c:1009
do_group_exit+0xd5/0x2a0 kernel/exit.c:1152
get_signal+0x1ec7/0x21e0 kernel/signal.c:3046
arch_do_signal_or_restart+0x91/0x7e0 arch/x86/kernel/signal.c:337
__exit_to_user_mode_loop kernel/entry/common.c:66 [inline]
exit_to_user_mode_loop+0x139/0x700 kernel/entry/common.c:101
__exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]
syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:336 [inline]
do_syscall_64+0x661/0x790 arch/x86/entry/syscall_64.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff88805cdc3b80: 00 00 00 00 00 fc fc fc fc fc fc fc fc fa fb fb
ffff88805cdc3c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88805cdc3c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88805cdc3d00: fb fb fb fb fc fc fc fc fc fc fc fc 00 00 00 00
ffff88805cdc3d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
Tested on:
commit: abea5c34 Merge tag 'i2c-7.3-part1' of git://git.kernel..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/andi.shyti/linux.git i2c/i2c-fixes
console output: https://syzkaller.appspot.com/x/log.txt?x=15115549580000
kernel config: https://syzkaller.appspot.com/x/.config?x=17c15623c4feca72
dashboard link: https://syzkaller.appspot.com/bug?extid=227dbc9afd022922d624
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
Note: no patches were applied.
^ permalink raw reply [flat|nested] 10+ messages in thread
end of thread, other threads:[~2026-08-23 3:48 UTC | newest]
Thread overview: 10+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-22 6:26 [PATCH i2c-fixes v1] i2c: core: Fix use-after-free during i2c device removal Rafael Alejandro Diaz Cruz
2026-08-22 8:51 ` Hillf Danton
2026-08-22 9:25 ` [syzbot] [fs?] [usb?] KASAN: slab-use-after-free Read in lockref_get (2) syzbot
[not found] ` <CALp66yH7QzvGmo+N7BWykYjoaGT-yAezwRv0Pc_ir6qDRTsKvw@mail.gmail.com>
[not found] ` <CALp66yFrutQ2h8SNyBZn04+LMPMnSEtWxW_Dr0vzfoHvEahSsQ@mail.gmail.com>
2026-08-22 19:11 ` syzbot
2026-08-22 19:37 ` [PATCH i2c-fixes v1] i2c: core: Fix use-after-free during i2c device removal Rafael Alejandro Díaz Cruz
2026-08-22 21:03 ` [syzbot] [fs?] [usb?] KASAN: slab-use-after-free Read in lockref_get (2) syzbot
2026-08-22 23:16 ` [PATCH i2c-fixes v1] i2c: core: Fix use-after-free during i2c device removal Rafael Alejandro Díaz Cruz
2026-08-22 23:57 ` [syzbot] [fs?] [usb?] KASAN: slab-use-after-free Read in lockref_get (2) syzbot
2026-08-23 1:12 ` [PATCH i2c-fixes v1] i2c: core: Fix use-after-free during i2c device removal Rafael Alejandro Díaz Cruz
2026-08-23 3:48 ` [syzbot] [fs?] [usb?] KASAN: slab-use-after-free Read in lockref_get (2) syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox