From: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
To: Justin Tee <justin.tee@broadcom.com>,
Naresh Gottumukkala <nareshgottumukkala83@gmail.com>,
Paul Ely <paul.ely@broadcom.com>, Christoph Hellwig <hch@lst.de>,
Sagi Grimberg <sagi@grimberg.me>,
Chaitanya Kulkarni <kch@nvidia.com>
Cc: Shuangpeng Bai <shuangpeng.kernel@gmail.com>,
linux-nvme@lists.infradead.org, linux-kernel@vger.kernel.org
Subject: [BUG] nvmet-fc: KASAN: slab-use-after-free in nvmet_fc_handle_ls_rqst_work
Date: Fri, 31 Jul 2026 16:44:47 -0400 [thread overview]
Message-ID: <20260731204504.2396434-1-shuangpeng.kernel@gmail.com> (raw)
Hi Kernel Maintainers,
I hit the following report while testing current upstream kernel:
KASAN: slab-use-after-free in nvmet_fc_handle_ls_rqst_work
on commit: 0d6269a4f6059d185d9f7e3efe7b58f8c0d9faf3 (2026-07-27)
To help trigger the bug more reliably, we applied a minimal diagnostic patch
that only adds a delay and a printk.
The reproducer and .config files are here.
https://gist.github.com/shuangpengbai/47cf6fb1b80e28f3c30a372333d1151e
I'm happy to test debug patches or provide additional information.
Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
[ 405.999314][ T1167] BUG: KASAN: slab-use-after-free in nvmet_fc_handle_ls_rqst_work (drivers/nvme/target/fc.c:193 drivers/nvme/target/fc.c:1841 drivers/nvme/target/fc.c:1995 drivers/nvme/target/fc.c:2021)
[ 406.000605][ T1167] Read of size 8 at addr ffff888179f1b000 by task kworker/u9:2/1167
[ 406.001734][ T1167]
[ 406.002128][ T1167] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 406.002134][ T1167] Workqueue: nvmet-wq nvmet_fc_handle_ls_rqst_work
[ 406.002165][ T1167] Call Trace:
[ 406.002182][ T1167] <TASK>
[ 406.002187][ T1167] dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
[ 406.002201][ T1167] print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
[ 406.002220][ T1167] kasan_report (mm/kasan/report.c:595)
[ 406.002232][ T1167] nvmet_fc_handle_ls_rqst_work (drivers/nvme/target/fc.c:193 drivers/nvme/target/fc.c:1841 drivers/nvme/target/fc.c:1995 drivers/nvme/target/fc.c:2021)
[ 406.002238][ T1167] process_scheduled_works (kernel/workqueue.c:3322 kernel/workqueue.c:3405)
[ 406.002250][ T1167] worker_thread (kernel/workqueue.c:3486)
[ 406.002280][ T1167] kthread (kernel/kthread.c:436)
[ 406.002296][ T1167] ret_from_fork (archkernel/process.c:158)
[ 406.002320][ T1167] ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
[ 406.002328][ T1167] </TASK>
[ 406.002330][ T1167]
[ 406.020787][ T1167] Freed by task 1167 on cpu 0 at 405.998150s:
[ 406.021660][ T1167] kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78)
[ 406.022343][ T1167] kasan_save_free_info (mm/kasan/generic.c:584)
[ 406.023069][ T1167] __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)
[ 406.023749][ T1167] kfree (include/linux/kasan.h:235 mm/slub.c:2705 mm/slub.c:6405 mm/slub.c:6720)
[ 406.024312][ T1167] nvmet_fc_handle_ls_rqst_work (drivers/nvme/target/fc.c:1808 drivers/nvme/target/fc.c:1995 drivers/nvme/target/fc.c:2021)
[ 406.025172][ T1167] process_scheduled_works (kernel/workqueue.c:3322 kernel/workqueue.c:3405)
[ 406.025972][ T1167] worker_thread (kernel/workqueue.c:3486)
[ 406.026653][ T1167] kthread (kernel/kthread.c:436)
[ 406.027248][ T1167] ret_from_fork (archkernel/process.c:158)
[ 406.027931][ T1167] ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
[ 406.028638][ T1167]
[ 406.028989][ T1167] The buggy address belongs to the object at ffff888179f1b000
[ 406.028989][ T1167] which belongs to the cache kmalloc-2k of size 2048
[ 406.031005][ T1167] The buggy address is located 0 bytes inside of
[ 406.031005][ T1167] freed 2048-byte region [ffff888179f1b000, ffff888179f1b800)
Best,
Shuangpeng
reply other threads:[~2026-07-31 20:45 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260731204504.2396434-1-shuangpeng.kernel@gmail.com \
--to=shuangpeng.kernel@gmail.com \
--cc=hch@lst.de \
--cc=justin.tee@broadcom.com \
--cc=kch@nvidia.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-nvme@lists.infradead.org \
--cc=nareshgottumukkala83@gmail.com \
--cc=paul.ely@broadcom.com \
--cc=sagi@grimberg.me \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox