* [syzbot] [media?] KASAN: slab-use-after-free Write in usb_free_urb
@ 2026-08-02 0:53 syzbot
2026-09-02 5:09 ` [syzbot] [usb?] " syzbot
0 siblings, 1 reply; 8+ messages in thread
From: syzbot @ 2026-08-02 0:53 UTC (permalink / raw)
To: linux-kernel, linux-media, mchehab, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 62cc90241548 Merge tag 'mm-hotfixes-stable-2026-07-27-14-1..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11e4249e580000
kernel config: https://syzkaller.appspot.com/x/.config?x=c05be6c9b0d36cb9
dashboard link: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-62cc9024.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/4f85523029b9/vmlinux-62cc9024.xz
kernel image: https://storage.googleapis.com/syzbot-assets/d37f4266b11c/bzImage-62cc9024.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 1
CPU: 0 UID: 0 PID: 5337 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
fail_dump lib/fault-inject.c:73 [inline]
should_fail_ex+0x40c/0x560 lib/fault-inject.c:174
should_failslab+0xa8/0x100 mm/failslab.c:46
slab_pre_alloc_hook mm/slub.c:4539 [inline]
slab_alloc_node mm/slub.c:4897 [inline]
__do_kmalloc_node mm/slub.c:5333 [inline]
__kmalloc_noprof+0xfe/0x720 mm/slub.c:5359
_kmalloc_noprof include/linux/slab.h:992 [inline]
usb_alloc_urb+0x46/0x150 drivers/usb/core/urb.c:75
hackrf_alloc_urbs drivers/media/usb/hackrf/hackrf.c:683 [inline]
hackrf_start_streaming+0x722/0x1350 drivers/media/usb/hackrf/hackrf.c:827
vb2_start_streaming+0x11e/0x450 drivers/media/common/videobuf2/videobuf2-core.c:1783
vb2_core_streamon+0x2c0/0x4d0 drivers/media/common/videobuf2/videobuf2-core.c:2336
__video_do_ioctl+0x8af/0xc70 drivers/media/v4l2-core/v4l2-ioctl.c:3133
video_usercopy+0x860/0x1430 drivers/media/v4l2-core/v4l2-ioctl.c:3475
v4l2_ioctl+0x18d/0x1e0 drivers/media/v4l2-core/v4l2-dev.c:366
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1b1359de99
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f1b1450bfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f1b13826180 RCX: 00007f1b1359de99
RDX: 0000200000000600 RSI: 0000000040045612 RDI: 0000000000000005
RBP: 00007f1b1450c050 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
R13: 00007f1b13826218 R14: 00007f1b13826180 R15: 00007fffe6212058
</TASK>
==================================================================
BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
BUG: KASAN: slab-use-after-free in atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:400 [inline]
BUG: KASAN: slab-use-after-free in __refcount_sub_and_test include/linux/refcount.h:389 [inline]
BUG: KASAN: slab-use-after-free in __refcount_dec_and_test include/linux/refcount.h:432 [inline]
BUG: KASAN: slab-use-after-free in refcount_dec_and_test include/linux/refcount.h:450 [inline]
BUG: KASAN: slab-use-after-free in kref_put include/linux/kref.h:64 [inline]
BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
Write of size 4 at addr ffff88801d3b6800 by task syz.0.0/5337
CPU: 0 UID: 0 PID: 5337 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
check_region_inline mm/kasan/generic.c:-1 [inline]
kasan_check_range+0x264/0x2c0 mm/kasan/generic.c:200
instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:400 [inline]
__refcount_sub_and_test include/linux/refcount.h:389 [inline]
__refcount_dec_and_test include/linux/refcount.h:432 [inline]
refcount_dec_and_test include/linux/refcount.h:450 [inline]
kref_put include/linux/kref.h:64 [inline]
usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96
hackrf_free_urbs+0x22b/0x3b0 drivers/media/usb/hackrf/hackrf.c:658
hackrf_start_streaming+0xe12/0x1350 drivers/media/usb/hackrf/hackrf.c:849
vb2_start_streaming+0x11e/0x450 drivers/media/common/videobuf2/videobuf2-core.c:1783
vb2_core_streamon+0x2c0/0x4d0 drivers/media/common/videobuf2/videobuf2-core.c:2336
__video_do_ioctl+0x8af/0xc70 drivers/media/v4l2-core/v4l2-ioctl.c:3133
video_usercopy+0x860/0x1430 drivers/media/v4l2-core/v4l2-ioctl.c:3475
v4l2_ioctl+0x18d/0x1e0 drivers/media/v4l2-core/v4l2-dev.c:366
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f1b1359de99
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f1b1450bfe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f1b13826180 RCX: 00007f1b1359de99
RDX: 0000200000000600 RSI: 0000000040045612 RDI: 0000000000000005
RBP: 00007f1b1450c050 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
R13: 00007f1b13826218 R14: 00007f1b13826180 R15: 00007fffe6212058
</TASK>
Allocated by task 5337:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__do_kmalloc_node mm/slub.c:5334 [inline]
__kmalloc_noprof+0x375/0x720 mm/slub.c:5359
_kmalloc_noprof include/linux/slab.h:992 [inline]
usb_alloc_urb+0x46/0x150 drivers/usb/core/urb.c:75
hackrf_alloc_urbs drivers/media/usb/hackrf/hackrf.c:683 [inline]
hackrf_start_streaming+0x722/0x1350 drivers/media/usb/hackrf/hackrf.c:827
vb2_start_streaming+0x11e/0x450 drivers/media/common/videobuf2/videobuf2-core.c:1783
vb2_core_streamon+0x2c0/0x4d0 drivers/media/common/videobuf2/videobuf2-core.c:2336
__video_do_ioctl+0x8af/0xc70 drivers/media/v4l2-core/v4l2-ioctl.c:3133
video_usercopy+0x860/0x1430 drivers/media/v4l2-core/v4l2-ioctl.c:3475
v4l2_ioctl+0x18d/0x1e0 drivers/media/v4l2-core/v4l2-dev.c:366
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 5337:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2677 [inline]
slab_free mm/slub.c:6377 [inline]
kfree+0x1c5/0x640 mm/slub.c:6692
hackrf_alloc_urbs drivers/media/usb/hackrf/hackrf.c:686 [inline]
hackrf_start_streaming+0xa55/0x1350 drivers/media/usb/hackrf/hackrf.c:827
vb2_start_streaming+0x11e/0x450 drivers/media/common/videobuf2/videobuf2-core.c:1783
vb2_core_streamon+0x2c0/0x4d0 drivers/media/common/videobuf2/videobuf2-core.c:2336
__video_do_ioctl+0x8af/0xc70 drivers/media/v4l2-core/v4l2-ioctl.c:3133
video_usercopy+0x860/0x1430 drivers/media/v4l2-core/v4l2-ioctl.c:3475
v4l2_ioctl+0x18d/0x1e0 drivers/media/v4l2-core/v4l2-dev.c:366
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff88801d3b6800
which belongs to the cache kmalloc-192 of size 192
The buggy address is located 0 bytes inside of
freed 192-byte region [ffff88801d3b6800, ffff88801d3b68c0)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1d3b6
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000000 ffff88801b0413c0 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x252800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_THISNODE), pid 1, tgid 1 (swapper/0), ts 12217348821, free_ts 11554810146
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_pages_slowpath+0x383/0xcc0 mm/page_alloc.c:4821
__alloc_frozen_pages_noprof+0x31f/0x380 mm/page_alloc.c:5317
alloc_slab_page mm/slub.c:3266 [inline]
allocate_slab+0x79/0x5e0 mm/slub.c:3380
new_slab mm/slub.c:3426 [inline]
___slab_alloc+0x16a/0x950 mm/slub.c:4463
slab_alloc_node mm/slub.c:4908 [inline]
__do_kmalloc_node mm/slub.c:5333 [inline]
__kvmalloc_node_noprof+0x341/0x860 mm/slub.c:6905
sbitmap_init_node+0x2bc/0x630 lib/sbitmap.c:132
blk_mq_alloc_hctx block/blk-mq.c:4055 [inline]
blk_mq_alloc_and_init_hctx+0x4f3/0xc50 block/blk-mq.c:4524
__blk_mq_realloc_hw_ctxs+0x2b2/0x660 block/blk-mq.c:4575
blk_mq_realloc_hw_ctxs block/blk-mq.c:4612 [inline]
blk_mq_init_allocated_queue+0x357/0x13c0 block/blk-mq.c:4642
blk_mq_alloc_queue block/blk-mq.c:4424 [inline]
__blk_mq_alloc_disk+0x1d2/0x390 block/blk-mq.c:4467
nbd_dev_add+0x494/0xb60 drivers/block/nbd.c:1991
nbd_init+0x15f/0x1e0 drivers/block/nbd.c:2729
do_one_initcall+0x250/0x870 init/main.c:1347
do_initcall_level+0x10a/0x1a0 init/main.c:1409
page last free pid 41 tgid 41 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xc1e/0xd10 mm/page_alloc.c:2950
__slab_free+0x274/0x2c0 mm/slub.c:5741
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4584 [inline]
slab_alloc_node mm/slub.c:4917 [inline]
kmem_cache_alloc_node_noprof+0x355/0x610 mm/slub.c:4989
alloc_task_struct_node kernel/fork.c:188 [inline]
dup_task_struct+0x52/0x8e0 kernel/fork.c:921
copy_process+0x820/0x4390 kernel/fork.c:2115
kernel_clone+0x2d7/0x940 kernel/fork.c:2748
user_mode_thread+0x110/0x180 kernel/fork.c:2824
call_usermodehelper_exec_work+0x5c/0x230 kernel/umh.c:171
process_one_work kernel/workqueue.c:3322 [inline]
process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Memory state around the buggy address:
ffff88801d3b6700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88801d3b6780: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88801d3b6800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88801d3b6880: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff88801d3b6900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 8+ messages in thread* Re: [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb 2026-08-02 0:53 [syzbot] [media?] KASAN: slab-use-after-free Write in usb_free_urb syzbot @ 2026-09-02 5:09 ` syzbot 2026-09-03 9:24 ` Michal Pecio 0 siblings, 1 reply; 8+ messages in thread From: syzbot @ 2026-09-02 5:09 UTC (permalink / raw) To: bolewara, devnull, gregkh, linux-kernel, linux-media, linux-usb, mchehab, syzkaller-bugs syzbot has found a reproducer for the following issue on: HEAD commit: 786262be6048 Merge tag 'edac_updates_for_v7.3_rc2' of git:.. git tree: upstream console+strace: https://syzkaller.appspot.com/x/log.txt?x=12a28125580000 kernel config: https://syzkaller.appspot.com/x/.config?x=b454dc6b1b7acd30 dashboard link: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1735af79580000 C reproducer: https://syzkaller.appspot.com/x/repro.c?x=135b7f79580000 Downloadable assets: disk image: https://storage.googleapis.com/syzbot-assets/c3e528ebf709/disk-786262be.raw.xz vmlinux: https://storage.googleapis.com/syzbot-assets/46f3418d2828/vmlinux-786262be.xz kernel image: https://storage.googleapis.com/syzbot-assets/60ab8a27c4f7/bzImage-786262be.xz IMPORTANT: if you fix the issue, please add the following tag to the commit: Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com usb 1-1: received EP1 urb->status = -2 ================================================================== BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline] BUG: KASAN: slab-use-after-free in atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:400 [inline] BUG: KASAN: slab-use-after-free in __refcount_sub_and_test include/linux/refcount.h:389 [inline] BUG: KASAN: slab-use-after-free in __refcount_dec_and_test include/linux/refcount.h:432 [inline] BUG: KASAN: slab-use-after-free in refcount_dec_and_test include/linux/refcount.h:450 [inline] BUG: KASAN: slab-use-after-free in kref_put include/linux/kref.h:64 [inline] BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96 Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29 CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: <TASK> dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description+0x55/0x1e0 mm/kasan/report.c:378 print_report+0x58/0x70 mm/kasan/report.c:482 kasan_report+0x117/0x150 mm/kasan/report.c:595 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x264/0x2c0 mm/kasan/generic.c:200 instrument_atomic_read_write include/linux/instrumented.h:112 [inline] atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:400 [inline] __refcount_sub_and_test include/linux/refcount.h:389 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] kref_put include/linux/kref.h:64 [inline] usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96 dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019 __run_hrtimer kernel/time/hrtimer.c:2067 [inline] __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124 hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141 handle_softirqs+0x1da/0x6d0 kernel/softirq.c:645 __do_softirq kernel/softirq.c:679 [inline] run_ktimerd+0x6a/0x100 kernel/softirq.c:1183 smpboot_thread_fn+0x565/0xa70 kernel/smpboot.c:160 kthread+0x38b/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 </TASK> Allocated by task 36: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5414 [inline] __kmalloc_noprof+0x41d/0x790 mm/slub.c:5439 _kmalloc_noprof include/linux/slab.h:995 [inline] _kzalloc_noprof include/linux/slab.h:1312 [inline] snd_card_new+0x7b/0x110 sound/core/init.c:184 create_card sound/usb/caiaq/device.c:429 [inline] snd_probe+0x236/0x1af0 sound/usb/caiaq/device.c:544 usb_probe_interface+0x788/0xe50 drivers/usb/core/driver.c:399 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c7/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12d/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_set_configuration+0x1ad8/0x2180 drivers/usb/core/message.c:2268 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c7/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12d/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_new_device+0x99a/0x1680 drivers/usb/core/hub.c:2708 hub_port_connect drivers/usb/core/hub.c:5580 [inline] hub_port_connect_change drivers/usb/core/hub.c:5720 [inline] port_event drivers/usb/core/hub.c:5884 [inline] hub_event+0x28cf/0x4cf0 drivers/usb/core/hub.c:5966 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Freed by task 36: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2748 [inline] slab_free mm/slub.c:6499 [inline] kfree+0x1c5/0x6d0 mm/slub.c:6792 device_release+0xc4/0x1f0 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x222/0x550 lib/kobject.c:737 snd_card_free_when_closed sound/core/init.c:630 [inline] snd_card_free+0x138/0x1d0 sound/core/init.c:662 snd_probe+0x162b/0x1af0 sound/usb/caiaq/device.c:553 usb_probe_interface+0x788/0xe50 drivers/usb/core/driver.c:399 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c7/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12d/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_set_configuration+0x1ad8/0x2180 drivers/usb/core/message.c:2268 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250 usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:293 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x254/0xae0 drivers/base/dd.c:706 __driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868 driver_probe_device+0x4f/0x240 drivers/base/dd.c:898 __device_attach_driver+0x270/0x410 drivers/base/dd.c:1026 bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c7/0x450 drivers/base/dd.c:1098 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153 bus_probe_device+0x12d/0x220 drivers/base/bus.c:620 device_add+0x7d7/0xb80 drivers/base/core.c:3776 usb_new_device+0x99a/0x1680 drivers/usb/core/hub.c:2708 hub_port_connect drivers/usb/core/hub.c:5580 [inline] hub_port_connect_change drivers/usb/core/hub.c:5720 [inline] port_event drivers/usb/core/hub.c:5884 [inline] hub_event+0x28cf/0x4cf0 drivers/usb/core/hub.c:5966 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 The buggy address belongs to the object at ffff88803cee0000 which belongs to the cache kmalloc-8k of size 8192 The buggy address is located 4176 bytes inside of freed 8192-byte region [ffff88803cee0000, ffff88803cee2000) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3cee0 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x80000000000040(head|node=0|zone=1) page_type: f5(slab) raw: 0080000000000040 ffff88813ff00280 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 head: 0080000000000040 ffff88813ff00280 dead000000000122 0000000000000000 head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000 head: 0080000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2000(__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5616, tgid 5616 (syz-executor411), ts 97458631629 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1871 prep_new_page mm/page_alloc.c:1879 [inline] get_page_from_freelist+0x2591/0x2600 mm/page_alloc.c:3943 __alloc_frozen_pages_noprof+0x230/0x5c0 mm/page_alloc.c:5436 alloc_slab_page mm/slub.c:3347 [inline] allocate_slab+0x7d/0x620 mm/slub.c:3462 new_slab mm/slub.c:3513 [inline] refill_objects+0x2d8/0x350 mm/slub.c:7410 refill_sheaf mm/slub.c:2885 [inline] __pcs_replace_empty_main+0x339/0x690 mm/slub.c:4774 alloc_from_pcs mm/slub.c:4850 [inline] slab_alloc_node mm/slub.c:4984 [inline] __kmalloc_cache_noprof+0x46f/0x680 mm/slub.c:5559 _kmalloc_noprof include/linux/slab.h:991 [inline] usb_device_dump+0xd0/0x2200 drivers/usb/core/devices.c:412 usb_device_read+0x1b4/0x2c0 drivers/usb/core/devices.c:530 full_proxy_read+0x127/0x1f0 fs/debugfs/file.c:379 vfs_read+0x219/0xa90 fs/read_write.c:572 ksys_read+0x156/0x270 fs/read_write.c:716 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 5598 tgid 5598 ts 96447293579 stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] __free_pages_prepare mm/page_alloc.c:1418 [inline] __free_frozen_pages+0xf8e/0x1070 mm/page_alloc.c:2962 __slab_free+0x250/0x2a0 mm/slub.c:5815 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4683 [inline] slab_alloc_node mm/slub.c:4996 [inline] __kmalloc_cache_noprof+0x353/0x680 mm/slub.c:5559 _kmalloc_noprof include/linux/slab.h:991 [inline] _kzalloc_noprof include/linux/slab.h:1312 [inline] kernfs_fop_open+0x3a7/0xcf0 fs/kernfs/file.c:634 do_dentry_open+0x849/0x1420 fs/open.c:996 vfs_open+0x3b/0x350 fs/open.c:1101 do_open fs/namei.c:4837 [inline] path_openat+0x1448/0x1d60 fs/namei.c:5000 do_file_open+0x23e/0x4a0 fs/namei.c:5029 do_sys_openat2+0x115/0x200 fs/open.c:1417 do_sys_open fs/open.c:1423 [inline] __do_sys_openat fs/open.c:1439 [inline] __se_sys_openat fs/open.c:1434 [inline] __x64_sys_openat+0x138/0x170 fs/open.c:1434 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff88803cee0f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88803cee0f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88803cee1000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88803cee1080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88803cee1100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== --- If you want syzbot to run the reproducer, reply with: #syz test: git://repo/address.git branch-or-commit-hash If you attach or paste a git patch, syzbot will apply it before testing. ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb 2026-09-02 5:09 ` [syzbot] [usb?] " syzbot @ 2026-09-03 9:24 ` Michal Pecio 2026-09-03 9:44 ` Takashi Iwai ` (2 more replies) 0 siblings, 3 replies; 8+ messages in thread From: Michal Pecio @ 2026-09-03 9:24 UTC (permalink / raw) To: syzbot Cc: bolewara, devnull, gregkh, linux-kernel, linux-media, linux-usb, mchehab, syzkaller-bugs, Daniel Mack, Takashi Iwai, linux-sound On Tue, 01 Sep 2026 22:09:33 -0700, syzbot wrote: > syzbot has found a reproducer for the following issue on: > > HEAD commit: 786262be6048 Merge tag 'edac_updates_for_v7.3_rc2' of git:.. > git tree: upstream > console+strace: https://syzkaller.appspot.com/x/log.txt?x=12a28125580000 > kernel config: https://syzkaller.appspot.com/x/.config?x=b454dc6b1b7acd30 > dashboard link: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d > compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1735af79580000 > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=135b7f79580000 > > Downloadable assets: > disk image: https://storage.googleapis.com/syzbot-assets/c3e528ebf709/disk-786262be.raw.xz > vmlinux: https://storage.googleapis.com/syzbot-assets/46f3418d2828/vmlinux-786262be.xz > kernel image: https://storage.googleapis.com/syzbot-assets/60ab8a27c4f7/bzImage-786262be.xz > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com > > usb 1-1: received EP1 urb->status = -2 > ================================================================== > BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline] > BUG: KASAN: slab-use-after-free in atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:400 [inline] > BUG: KASAN: slab-use-after-free in __refcount_sub_and_test include/linux/refcount.h:389 [inline] > BUG: KASAN: slab-use-after-free in __refcount_dec_and_test include/linux/refcount.h:432 [inline] > BUG: KASAN: slab-use-after-free in refcount_dec_and_test include/linux/refcount.h:450 [inline] > BUG: KASAN: slab-use-after-free in kref_put include/linux/kref.h:64 [inline] > BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96 > Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29 > > CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 > Call Trace: > <TASK> > dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 > print_address_description+0x55/0x1e0 mm/kasan/report.c:378 > print_report+0x58/0x70 mm/kasan/report.c:482 > kasan_report+0x117/0x150 mm/kasan/report.c:595 > check_region_inline mm/kasan/generic.c:-1 [inline] > kasan_check_range+0x264/0x2c0 mm/kasan/generic.c:200 > instrument_atomic_read_write include/linux/instrumented.h:112 [inline] > atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:400 [inline] > __refcount_sub_and_test include/linux/refcount.h:389 [inline] > __refcount_dec_and_test include/linux/refcount.h:432 [inline] > refcount_dec_and_test include/linux/refcount.h:450 [inline] > kref_put include/linux/kref.h:64 [inline] > usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96 > dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019 > __run_hrtimer kernel/time/hrtimer.c:2067 [inline] > __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124 > hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141 > handle_softirqs+0x1da/0x6d0 kernel/softirq.c:645 > __do_softirq kernel/softirq.c:679 [inline] > run_ktimerd+0x6a/0x100 kernel/softirq.c:1183 > smpboot_thread_fn+0x565/0xa70 kernel/smpboot.c:160 > kthread+0x38b/0x470 kernel/kthread.c:436 > ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 > </TASK> [Adding sound people] So what happens here is that USB core continues to use a URB after completion to implement things like usb_kill_urb(), so URBs are reference counted. Then core decrements the count - one more use. If a driver waits for completion or even usb_kill_urb() to return and then proceeds to free the URB's storage, this becomes a UAF. This driver embeds 2 URBs in its priv and does just that. A URB can only exist as an independent allocation, core will free it if upon finding zero reference count in such case. This is a mechanical conversion, untested. I don't have the HW. #syz test diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c index a16e59248480..3587794207d4 100644 --- a/sound/usb/caiaq/device.c +++ b/sound/usb/caiaq/device.c @@ -192,8 +192,7 @@ static void usb_ep1_command_reply_dispatch (struct urb* urb) break; } - cdev->ep1_in_urb.actual_length = 0; - ret = usb_submit_urb(&cdev->ep1_in_urb, GFP_ATOMIC); + ret = usb_submit_urb(cdev->ep1_in_urb, GFP_ATOMIC); if (ret < 0) dev_err(dev, "unable to submit urb. OOM!?\n"); } @@ -403,6 +402,8 @@ static void card_free(struct snd_card *card) { struct snd_usb_caiaqdev *cdev = caiaqdev(card); + usb_free_urb(cdev->ep1_in_urb); + usb_free_urb(cdev->midi_out_urb); #ifdef CONFIG_SND_USB_CAIAQ_INPUT snd_usb_caiaq_input_free(cdev); #endif @@ -457,22 +458,24 @@ static int init_card(struct snd_usb_caiaqdev *cdev) return -EIO; } - usb_init_urb(&cdev->ep1_in_urb); - usb_init_urb(&cdev->midi_out_urb); + cdev->ep1_in_urb = usb_alloc_urb(0, GFP_KERNEL); + cdev->midi_out_urb = usb_alloc_urb(0, GFP_KERNEL); + if (!cdev->ep1_in_urb || !cdev->midi_out_urb) + return -ENOMEM; - usb_fill_bulk_urb(&cdev->ep1_in_urb, usb_dev, + usb_fill_bulk_urb(cdev->ep1_in_urb, usb_dev, usb_rcvbulkpipe(usb_dev, 0x1), cdev->ep1_in_buf, EP1_BUFSIZE, usb_ep1_command_reply_dispatch, cdev); - usb_fill_bulk_urb(&cdev->midi_out_urb, usb_dev, + usb_fill_bulk_urb(cdev->midi_out_urb, usb_dev, usb_sndbulkpipe(usb_dev, 0x1), cdev->midi_out_buf, EP1_BUFSIZE, snd_usb_caiaq_midi_output_done, cdev); /* sanity checks of EPs before actually submitting */ - if (usb_urb_ep_type_check(&cdev->ep1_in_urb) || - usb_urb_ep_type_check(&cdev->midi_out_urb)) { + if (usb_urb_ep_type_check(cdev->ep1_in_urb) || + usb_urb_ep_type_check(cdev->midi_out_urb)) { dev_err(dev, "invalid EPs\n"); return -EINVAL; } @@ -480,7 +483,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev) init_waitqueue_head(&cdev->ep1_wait_queue); init_waitqueue_head(&cdev->prepare_wait_queue); - if (usb_submit_urb(&cdev->ep1_in_urb, GFP_KERNEL) != 0) + if (usb_submit_urb(cdev->ep1_in_urb, GFP_KERNEL) != 0) return -EIO; err = snd_usb_caiaq_send_command(cdev, EP1_CMD_GET_DEVICE_INFO, NULL, 0); @@ -530,7 +533,7 @@ static int init_card(struct snd_usb_caiaqdev *cdev) return 0; err_kill_urb: - usb_kill_urb(&cdev->ep1_in_urb); + usb_kill_urb(cdev->ep1_in_urb); return err; } @@ -576,8 +579,8 @@ static void snd_disconnect(struct usb_interface *intf) #endif snd_usb_caiaq_audio_disconnect(cdev); - usb_kill_urb(&cdev->ep1_in_urb); - usb_kill_urb(&cdev->midi_out_urb); + usb_kill_urb(cdev->ep1_in_urb); + usb_kill_urb(cdev->midi_out_urb); snd_card_free_when_closed(card); } diff --git a/sound/usb/caiaq/device.h b/sound/usb/caiaq/device.h index 743eb0387b5f..1c6f34693fa8 100644 --- a/sound/usb/caiaq/device.h +++ b/sound/usb/caiaq/device.h @@ -60,8 +60,8 @@ struct snd_usb_caiaq_cb_info; struct snd_usb_caiaqdev { struct snd_usb_audio chip; - struct urb ep1_in_urb; - struct urb midi_out_urb; + struct urb *ep1_in_urb; + struct urb *midi_out_urb; struct urb **data_urbs_in; struct urb **data_urbs_out; struct snd_usb_caiaq_cb_info *data_cb_info; diff --git a/sound/usb/caiaq/midi.c b/sound/usb/caiaq/midi.c index c656d0162432..18529484c8dc 100644 --- a/sound/usb/caiaq/midi.c +++ b/sound/usb/caiaq/midi.c @@ -43,7 +43,7 @@ static int snd_usb_caiaq_midi_output_close(struct snd_rawmidi_substream *substre { struct snd_usb_caiaqdev *cdev = substream->rmidi->private_data; if (cdev->midi_out_active) { - usb_kill_urb(&cdev->midi_out_urb); + usb_kill_urb(cdev->midi_out_urb); cdev->midi_out_active = 0; } return 0; @@ -64,9 +64,9 @@ static void snd_usb_caiaq_midi_send(struct snd_usb_caiaqdev *cdev, return; cdev->midi_out_buf[2] = len; - cdev->midi_out_urb.transfer_buffer_length = len+3; + cdev->midi_out_urb->transfer_buffer_length = len+3; - ret = usb_submit_urb(&cdev->midi_out_urb, GFP_ATOMIC); + ret = usb_submit_urb(cdev->midi_out_urb, GFP_ATOMIC); if (ret < 0) dev_err(dev, "snd_usb_caiaq_midi_send(%p): usb_submit_urb() failed," ^ permalink raw reply related [flat|nested] 8+ messages in thread
* Re: [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb 2026-09-03 9:24 ` Michal Pecio @ 2026-09-03 9:44 ` Takashi Iwai 2026-09-03 11:07 ` DIY allocation or embedding of URBs in larger structures Michal Pecio 2026-09-03 9:55 ` [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb Hillf Danton 2026-09-03 10:01 ` syzbot 2 siblings, 1 reply; 8+ messages in thread From: Takashi Iwai @ 2026-09-03 9:44 UTC (permalink / raw) To: Michal Pecio Cc: syzbot, bolewara, devnull, gregkh, linux-kernel, linux-media, linux-usb, mchehab, syzkaller-bugs, Daniel Mack, Takashi Iwai, linux-sound On Thu, 03 Sep 2026 11:24:17 +0200, Michal Pecio wrote: > > On Tue, 01 Sep 2026 22:09:33 -0700, syzbot wrote: > > syzbot has found a reproducer for the following issue on: > > > > HEAD commit: 786262be6048 Merge tag 'edac_updates_for_v7.3_rc2' of git:.. > > git tree: upstream > > console+strace: https://syzkaller.appspot.com/x/log.txt?x=12a28125580000 > > kernel config: https://syzkaller.appspot.com/x/.config?x=b454dc6b1b7acd30 > > dashboard link: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d > > compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1735af79580000 > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=135b7f79580000 > > > > Downloadable assets: > > disk image: https://storage.googleapis.com/syzbot-assets/c3e528ebf709/disk-786262be.raw.xz > > vmlinux: https://storage.googleapis.com/syzbot-assets/46f3418d2828/vmlinux-786262be.xz > > kernel image: https://storage.googleapis.com/syzbot-assets/60ab8a27c4f7/bzImage-786262be.xz > > > > IMPORTANT: if you fix the issue, please add the following tag to the commit: > > Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com > > > > usb 1-1: received EP1 urb->status = -2 > > ================================================================== > > BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline] > > BUG: KASAN: slab-use-after-free in atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:400 [inline] > > BUG: KASAN: slab-use-after-free in __refcount_sub_and_test include/linux/refcount.h:389 [inline] > > BUG: KASAN: slab-use-after-free in __refcount_dec_and_test include/linux/refcount.h:432 [inline] > > BUG: KASAN: slab-use-after-free in refcount_dec_and_test include/linux/refcount.h:450 [inline] > > BUG: KASAN: slab-use-after-free in kref_put include/linux/kref.h:64 [inline] > > BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96 > > Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29 > > > > CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 > > Call Trace: > > <TASK> > > dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 > > print_address_description+0x55/0x1e0 mm/kasan/report.c:378 > > print_report+0x58/0x70 mm/kasan/report.c:482 > > kasan_report+0x117/0x150 mm/kasan/report.c:595 > > check_region_inline mm/kasan/generic.c:-1 [inline] > > kasan_check_range+0x264/0x2c0 mm/kasan/generic.c:200 > > instrument_atomic_read_write include/linux/instrumented.h:112 [inline] > > atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:400 [inline] > > __refcount_sub_and_test include/linux/refcount.h:389 [inline] > > __refcount_dec_and_test include/linux/refcount.h:432 [inline] > > refcount_dec_and_test include/linux/refcount.h:450 [inline] > > kref_put include/linux/kref.h:64 [inline] > > usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96 > > dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019 > > __run_hrtimer kernel/time/hrtimer.c:2067 [inline] > > __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124 > > hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141 > > handle_softirqs+0x1da/0x6d0 kernel/softirq.c:645 > > __do_softirq kernel/softirq.c:679 [inline] > > run_ktimerd+0x6a/0x100 kernel/softirq.c:1183 > > smpboot_thread_fn+0x565/0xa70 kernel/smpboot.c:160 > > kthread+0x38b/0x470 kernel/kthread.c:436 > > ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 > > ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 > > </TASK> > > [Adding sound people] > > So what happens here is that USB core continues to use a URB after > completion to implement things like usb_kill_urb(), so URBs are > reference counted. Then core decrements the count - one more use. > > If a driver waits for completion or even usb_kill_urb() to return > and then proceeds to free the URB's storage, this becomes a UAF. > This driver embeds 2 URBs in its priv and does just that. > > A URB can only exist as an independent allocation, core will free > it if upon finding zero reference count in such case. > > This is a mechanical conversion, untested. I don't have the HW. This should work, and we've received another similar patch submission already. So, IIUC, now the URB *must* be always allocated via usb_alloc_urb() and an embedded URB isn't allowed? If so, we'd need to address other drivers, too. thanks, Takashi ^ permalink raw reply [flat|nested] 8+ messages in thread
* DIY allocation or embedding of URBs in larger structures 2026-09-03 9:44 ` Takashi Iwai @ 2026-09-03 11:07 ` Michal Pecio 2026-09-03 14:37 ` Takashi Iwai 0 siblings, 1 reply; 8+ messages in thread From: Michal Pecio @ 2026-09-03 11:07 UTC (permalink / raw) To: Takashi Iwai Cc: syzbot, bolewara, devnull, gregkh, linux-kernel, linux-media, linux-usb, mchehab, syzkaller-bugs, Daniel Mack, Takashi Iwai, linux-sound On Thu, 03 Sep 2026 11:44:45 +0200, Takashi Iwai wrote: > On Thu, 03 Sep 2026 11:24:17 +0200, > Michal Pecio wrote: > > So what happens here is that USB core continues to use a URB after > > completion to implement things like usb_kill_urb(), so URBs are > > reference counted. Then core decrements the count - one more use. > > > > If a driver waits for completion or even usb_kill_urb() to return > > and then proceeds to free the URB's storage, this becomes a UAF. > > This driver embeds 2 URBs in its priv and does just that. > > > > A URB can only exist as an independent allocation, core will free > > it if upon finding zero reference count in such case. > > So, IIUC, now the URB *must* be always allocated via usb_alloc_urb() > and an embedded URB isn't allowed? If so, we'd need to address other > drivers, too. Yes, that's basically the case and actually has been for a long time. The only thing that works is for both USB and the driver to call usb_free_urb() and whoever does last will actually free the storage. This means URB can't share storage with anything else. Some drivers got away with making URB the first member of a struct which is freed together with it. AFAIK this pattern doesn't crash, but it's deprecated too because it puts a flexible member (in the URB) in the middle of (the outer) struct. This pattern here in caiaq has always been one race away from UAF. Maybe it wasn't very likely to happen, but stuff like PREEMPT_RT and hypervisors can insert unexpected delays anywhere these days. Greg KH puts it thusly: https://lore.kernel.org/linux-usb/2025120716-sway-hypnotic-8cb6@gregkh/ Reragds, Michal ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: DIY allocation or embedding of URBs in larger structures 2026-09-03 11:07 ` DIY allocation or embedding of URBs in larger structures Michal Pecio @ 2026-09-03 14:37 ` Takashi Iwai 0 siblings, 0 replies; 8+ messages in thread From: Takashi Iwai @ 2026-09-03 14:37 UTC (permalink / raw) To: Michal Pecio Cc: Takashi Iwai, syzbot, bolewara, devnull, gregkh, linux-kernel, linux-media, linux-usb, mchehab, syzkaller-bugs, Daniel Mack, Takashi Iwai, linux-sound On Thu, 03 Sep 2026 13:07:57 +0200, Michal Pecio wrote: > > On Thu, 03 Sep 2026 11:44:45 +0200, Takashi Iwai wrote: > > On Thu, 03 Sep 2026 11:24:17 +0200, > > Michal Pecio wrote: > > > So what happens here is that USB core continues to use a URB after > > > completion to implement things like usb_kill_urb(), so URBs are > > > reference counted. Then core decrements the count - one more use. > > > > > > If a driver waits for completion or even usb_kill_urb() to return > > > and then proceeds to free the URB's storage, this becomes a UAF. > > > This driver embeds 2 URBs in its priv and does just that. > > > > > > A URB can only exist as an independent allocation, core will free > > > it if upon finding zero reference count in such case. > > > > So, IIUC, now the URB *must* be always allocated via usb_alloc_urb() > > and an embedded URB isn't allowed? If so, we'd need to address other > > drivers, too. > > Yes, that's basically the case and actually has been for a long time. > > The only thing that works is for both USB and the driver to call > usb_free_urb() and whoever does last will actually free the storage. > This means URB can't share storage with anything else. > > Some drivers got away with making URB the first member of a struct > which is freed together with it. AFAIK this pattern doesn't crash, but > it's deprecated too because it puts a flexible member (in the URB) in > the middle of (the outer) struct. > > This pattern here in caiaq has always been one race away from UAF. > Maybe it wasn't very likely to happen, but stuff like PREEMPT_RT and > hypervisors can insert unexpected delays anywhere these days. > > Greg KH puts it thusly: > https://lore.kernel.org/linux-usb/2025120716-sway-hypnotic-8cb6@gregkh/ OK, I'll send the fix patches for the rest of sound drivers. thanks, Takashi ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb 2026-09-03 9:24 ` Michal Pecio 2026-09-03 9:44 ` Takashi Iwai @ 2026-09-03 9:55 ` Hillf Danton 2026-09-03 10:01 ` syzbot 2 siblings, 0 replies; 8+ messages in thread From: Hillf Danton @ 2026-09-03 9:55 UTC (permalink / raw) To: Michal Pecio Cc: syzbot, linux-media, linux-usb, mchehab, syzkaller-bugs, Daniel Mack, Takashi Iwai, linux-sound On Thu, 3 Sep 2026 11:24:17 +0200 Michal Pecio wrote: >On Tue, 01 Sep 2026 22:09:33 -0700, syzbot wrote: >> syzbot has found a reproducer for the following issue on: >> >> HEAD commit: 786262be6048 Merge tag 'edac_updates_for_v7.3_rc2' of git:.. >> git tree: upstream >> console+strace: https://syzkaller.appspot.com/x/log.txt?x=12a28125580000 >> kernel config: https://syzkaller.appspot.com/x/.config?x=b454dc6b1b7acd30 >> dashboard link: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d >> compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 >> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1735af79580000 >> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=135b7f79580000 >> >> Downloadable assets: >> disk image: https://storage.googleapis.com/syzbot-assets/c3e528ebf709/disk-786262be.raw.xz >> vmlinux: https://storage.googleapis.com/syzbot-assets/46f3418d2828/vmlinux-786262be.xz >> kernel image: https://storage.googleapis.com/syzbot-assets/60ab8a27c4f7/bzImage-786262be.xz >> >> IMPORTANT: if you fix the issue, please add the following tag to the commit: >> Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com >> >> usb 1-1: received EP1 urb->status = -2 >> ================================================================== >> BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline] >> BUG: KASAN: slab-use-after-free in atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:400 [inline] >> BUG: KASAN: slab-use-after-free in __refcount_sub_and_test include/linux/refcount.h:389 [inline] >> BUG: KASAN: slab-use-after-free in __refcount_dec_and_test include/linux/refcount.h:432 [inline] >> BUG: KASAN: slab-use-after-free in refcount_dec_and_test include/linux/refcount.h:450 [inline] >> BUG: KASAN: slab-use-after-free in kref_put include/linux/kref.h:64 [inline] >> BUG: KASAN: slab-use-after-free in usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96 >> Write of size 4 at addr ffff88803cee1050 by task ktimers/1/29 >> >> CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} >> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 >> Call Trace: >> <TASK> >> dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 >> print_address_description+0x55/0x1e0 mm/kasan/report.c:378 >> print_report+0x58/0x70 mm/kasan/report.c:482 >> kasan_report+0x117/0x150 mm/kasan/report.c:595 >> check_region_inline mm/kasan/generic.c:-1 [inline] >> kasan_check_range+0x264/0x2c0 mm/kasan/generic.c:200 >> instrument_atomic_read_write include/linux/instrumented.h:112 [inline] >> atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:400 [inline] >> __refcount_sub_and_test include/linux/refcount.h:389 [inline] >> __refcount_dec_and_test include/linux/refcount.h:432 [inline] >> refcount_dec_and_test include/linux/refcount.h:450 [inline] >> kref_put include/linux/kref.h:64 [inline] >> usb_free_urb+0x24/0x120 drivers/usb/core/urb.c:96 >> dummy_timer+0xaac/0x4d50 drivers/usb/gadget/udc/dummy_hcd.c:2019 >> __run_hrtimer kernel/time/hrtimer.c:2067 [inline] >> __hrtimer_run_queues+0x3eb/0xaf0 kernel/time/hrtimer.c:2124 >> hrtimer_run_softirq+0x1e1/0x2e0 kernel/time/hrtimer.c:2141 >> handle_softirqs+0x1da/0x6d0 kernel/softirq.c:645 >> __do_softirq kernel/softirq.c:679 [inline] >> run_ktimerd+0x6a/0x100 kernel/softirq.c:1183 >> smpboot_thread_fn+0x565/0xa70 kernel/smpboot.c:160 >> kthread+0x38b/0x470 kernel/kthread.c:436 >> ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 >> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 >> </TASK> > >[Adding sound people] > > So what happens here is that USB core continues to use a URB after > completion to implement things like usb_kill_urb(), so URBs are > reference counted. Then core decrements the count - one more use. > > If a driver waits for completion or even usb_kill_urb() to return > and then proceeds to free the URB's storage, this becomes a UAF. > This driver embeds 2 URBs in its priv and does just that. > Given dummy_urb_dequeue(), the dequeued urb should be tagged not to be handled again in the dummy_timer callback instead, just my $0.02 ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb 2026-09-03 9:24 ` Michal Pecio 2026-09-03 9:44 ` Takashi Iwai 2026-09-03 9:55 ` [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb Hillf Danton @ 2026-09-03 10:01 ` syzbot 2 siblings, 0 replies; 8+ messages in thread From: syzbot @ 2026-09-03 10:01 UTC (permalink / raw) To: bolewara, devnull, gregkh, linux-kernel, linux-media, linux-sound, linux-usb, mchehab, michal.pecio, syzkaller-bugs, tiwai, zonque Hello, syzbot has tested the proposed patch and the reproducer did not trigger any issue: Reported-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com Tested-by: syzbot+832ce9fa3face1b7d44d@syzkaller.appspotmail.com Tested on: commit: 940de590 Merge tag 'hardening-v7.3-rc2' of git://git.k.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=13da7c15580000 kernel config: https://syzkaller.appspot.com/x/.config?x=b454dc6b1b7acd30 dashboard link: https://syzkaller.appspot.com/bug?extid=832ce9fa3face1b7d44d compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 patch: https://syzkaller.appspot.com/x/patch.diff?x=15527c15580000 Note: testing is done by a robot and is best-effort only. ^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2026-09-03 14:38 UTC | newest] Thread overview: 8+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2026-08-02 0:53 [syzbot] [media?] KASAN: slab-use-after-free Write in usb_free_urb syzbot 2026-09-02 5:09 ` [syzbot] [usb?] " syzbot 2026-09-03 9:24 ` Michal Pecio 2026-09-03 9:44 ` Takashi Iwai 2026-09-03 11:07 ` DIY allocation or embedding of URBs in larger structures Michal Pecio 2026-09-03 14:37 ` Takashi Iwai 2026-09-03 9:55 ` [syzbot] [usb?] KASAN: slab-use-after-free Write in usb_free_urb Hillf Danton 2026-09-03 10:01 ` syzbot
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox