From: Maxwell Doose <m32285159@gmail.com>
To: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Cc: jikos@kernel.org, jic23@kernel.org,
srinivas.pandruvada@linux.intel.com, bentiss@kernel.org,
linux-input@vger.kernel.org, linux-iio@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: [BUG] KASAN: slab-use-after-free in _raw_spin_lock_irqsave from hid-sensor-custom
Date: Sun, 14 Jun 2026 16:02:13 -0500 [thread overview]
Message-ID: <20260614160213.085e1efc@linuxescape> (raw)
In-Reply-To: <178144969601.60470.12928355382146160896@gmail.com>
Hi Shuangpeng,
On Sun, 14 Jun 2026 15:19:21 -0400
Shuangpeng Bai <shuangpeng.kernel@gmail.com> wrote:
> I hit the following report while testing current upstream kernel:
>
> KASAN: slab-use-after-free in _raw_spin_lock_irqsave from
> hid-sensor-custom
>
> on commit: e8c2f9fdadee7cbc75134dc463c1e0d856d6e5c7 (May 25 2026)
>
Is this correct? It seems to point to changes in HPFS.
>
> The reproducer and .config files are here.
> https://gist.github.com/shuangpengbai/d82ac0d19fda016e81d7fa1ab028d967
>
> I'm happy to test debug patches or provide additional information.
>
> Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
>
This bug report also seems to have nothing to do with IIO after
investigating the call trace, seems more like for the HID/input folks
than iio. HID folks, seems like it was caused here:
[ 73.163547][ T8356] hid_sensor_custom_poll (include/linux/poll.h:45 drivers/hid/hid-sensor-custom.c:706)
before _raw_spin_lock_irqsave() gets called and KASAN triggers the slab-use-after-free.
--
best regards,
max
next prev parent reply other threads:[~2026-06-14 21:02 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-06-14 19:19 [BUG] KASAN: slab-use-after-free in _raw_spin_lock_irqsave from hid-sensor-custom Shuangpeng Bai
2026-06-14 21:02 ` Maxwell Doose [this message]
2026-06-14 21:24 ` Shuangpeng
2026-06-14 21:35 ` Maxwell Doose
2026-06-14 21:50 ` Shuangpeng
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260614160213.085e1efc@linuxescape \
--to=m32285159@gmail.com \
--cc=bentiss@kernel.org \
--cc=jic23@kernel.org \
--cc=jikos@kernel.org \
--cc=linux-iio@vger.kernel.org \
--cc=linux-input@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=shuangpeng.kernel@gmail.com \
--cc=srinivas.pandruvada@linux.intel.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox