From: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
To: Kees Cook <kees@kernel.org>, David Hildenbrand <david@kernel.org>,
Oscar Salvador <osalvador@suse.de>,
Andrew Morton <akpm@linux-foundation.org>
Cc: Shuangpeng Bai <shuangpeng.kernel@gmail.com>,
linux-mm@kvack.org, linux-cxl@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: [BUG] firmware: memmap: slab-use-after-free in firmware_map_add_hotplug
Date: Fri, 14 Aug 2026 12:30:56 -0400 [thread overview]
Message-ID: <20260814163117.3390709-1-shuangpeng.kernel@gmail.com> (raw)
Hi Kernel Maintainers,
I hit the following report while testing current upstream kernel:
KASAN: slab-use-after-free in firmware_map_add_hotplug
on commit: 3aa1dcaa4f6f5ae08936491e08bd456f331f2d40 (2026-08-13)
The reproducer and .config files are here.
https://gist.github.com/shuangpengbai/6d12f2eba2f06179a20ffcafe69fcc59
I'm happy to test debug patches or provide additional information.
Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
[ 68.640158][ T8381] BUG: KASAN: slab-use-after-free in firmware_map_add_hotplug (drivers/firmware/memmap.c:225 drivers/firmware/memmap.c:248 drivers/firmware/memmap.c:286)
[ 68.640950][ T8381] Read of size 8 at addr ffff88811a4b0800 by task sh/8381
[ 68.641868][ T8381] dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
[ 68.641873][ T8381] print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
[ 68.641886][ T8381] kasan_report (mm/kasan/report.c:595)
[ 68.641894][ T8381] firmware_map_add_hotplug (drivers/firmware/memmap.c:225 drivers/firmware/memmap.c:248 drivers/firmware/memmap.c:286)
[ 68.641903][ T8381] add_memory_resource (mm/memory_hotplug.c:1571)
[ 68.641933][ T8381] __add_memory (mm/memory_hotplug.c:1611)
[ 68.641936][ T8381] probe_store (drivers/base/memory.c:582)
[ 68.641949][ T8381] kernfs_fop_write_iter (fs/kernfs/file.c:345)
[ 68.641952][ T8381] vfs_write (fs/read_write.c:595 fs/read_write.c:687)
[ 68.641973][ T8381] ksys_write (fs/read_write.c:739)
[ 68.641986][ T8381] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
[ 68.641991][ T8381] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
[ 68.669009][ T8381] Freed by task 8381 on cpu 0 at 68.618788s:
[ 68.669579][ T8381] kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78)
[ 68.670025][ T8381] kasan_save_free_info (mm/kasan/generic.c:584)
[ 68.670507][ T8381] __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)
[ 68.670960][ T8381] kfree (include/linux/kasan.h:235 mm/slub.c:2677 mm/slub.c:6377 mm/slub.c:6692)
[ 68.671337][ T8381] kobject_put (lib/kobject.c:689 lib/kobject.c:720 include/linux/kref.h:65 lib/kobject.c:737)
[ 68.671762][ T8381] firmware_map_add_hotplug (drivers/firmware/memmap.c:192 drivers/firmware/memmap.c:306)
[ 68.672289][ T8381] add_memory_resource (mm/memory_hotplug.c:1571)
[ 68.672772][ T8381] __add_memory (mm/memory_hotplug.c:1611)
[ 68.673186][ T8381] probe_store (drivers/base/memory.c:582)
[ 68.673595][ T8381] kernfs_fop_write_iter (fs/kernfs/file.c:345)
[ 68.674099][ T8381] vfs_write (fs/read_write.c:595 fs/read_write.c:687)
[ 68.674501][ T8381] ksys_write (fs/read_write.c:739)
[ 68.674902][ T8381] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
[ 68.675335][ T8381] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
Best,
Shuangpeng
reply other threads:[~2026-08-14 16:31 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260814163117.3390709-1-shuangpeng.kernel@gmail.com \
--to=shuangpeng.kernel@gmail.com \
--cc=akpm@linux-foundation.org \
--cc=david@kernel.org \
--cc=kees@kernel.org \
--cc=linux-cxl@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-mm@kvack.org \
--cc=osalvador@suse.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox