[BUG] firmware: memmap: slab-use-after-free in firmware_map_add_hotplug

[BUG] firmware: memmap: slab-use-after-free in firmware_map_add_hotplug

[Shuangpeng Bai]

Hi Kernel Maintainers,

I hit the following report while testing current upstream kernel:

KASAN: slab-use-after-free in firmware_map_add_hotplug

on commit: 3aa1dcaa4f6f5ae08936491e08bd456f331f2d40 (2026-08-13)

The reproducer and .config files are here.
https://gist.github.com/shuangpengbai/6d12f2eba2f06179a20ffcafe69fcc59

I'm happy to test debug patches or provide additional information.

Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>

[   68.640158][ T8381] BUG: KASAN: slab-use-after-free in firmware_map_add_hotplug (drivers/firmware/memmap.c:225 drivers/firmware/memmap.c:248 drivers/firmware/memmap.c:286)
[   68.640950][ T8381] Read of size 8 at addr ffff88811a4b0800 by task sh/8381
[   68.641868][ T8381]  dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
[   68.641873][ T8381]  print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
[   68.641886][ T8381]  kasan_report (mm/kasan/report.c:595)
[   68.641894][ T8381]  firmware_map_add_hotplug (drivers/firmware/memmap.c:225 drivers/firmware/memmap.c:248 drivers/firmware/memmap.c:286)
[   68.641903][ T8381]  add_memory_resource (mm/memory_hotplug.c:1571)
[   68.641933][ T8381]  __add_memory (mm/memory_hotplug.c:1611)
[   68.641936][ T8381]  probe_store (drivers/base/memory.c:582)
[   68.641949][ T8381]  kernfs_fop_write_iter (fs/kernfs/file.c:345)
[   68.641952][ T8381]  vfs_write (fs/read_write.c:595 fs/read_write.c:687)
[   68.641973][ T8381]  ksys_write (fs/read_write.c:739)
[   68.641986][ T8381]  do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
[   68.641991][ T8381]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)

[   68.669009][ T8381] Freed by task 8381 on cpu 0 at 68.618788s:
[   68.669579][ T8381]  kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78)
[   68.670025][ T8381]  kasan_save_free_info (mm/kasan/generic.c:584)
[   68.670507][ T8381]  __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)
[   68.670960][ T8381]  kfree (include/linux/kasan.h:235 mm/slub.c:2677 mm/slub.c:6377 mm/slub.c:6692)
[   68.671337][ T8381]  kobject_put (lib/kobject.c:689 lib/kobject.c:720 include/linux/kref.h:65 lib/kobject.c:737)
[   68.671762][ T8381]  firmware_map_add_hotplug (drivers/firmware/memmap.c:192 drivers/firmware/memmap.c:306)
[   68.672289][ T8381]  add_memory_resource (mm/memory_hotplug.c:1571)
[   68.672772][ T8381]  __add_memory (mm/memory_hotplug.c:1611)
[   68.673186][ T8381]  probe_store (drivers/base/memory.c:582)
[   68.673595][ T8381]  kernfs_fop_write_iter (fs/kernfs/file.c:345)
[   68.674099][ T8381]  vfs_write (fs/read_write.c:595 fs/read_write.c:687)
[   68.674501][ T8381]  ksys_write (fs/read_write.c:739)
[   68.674902][ T8381]  do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
[   68.675335][ T8381]  entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)


Best,
Shuangpeng