* [syzbot] [usb?] KASAN: slab-use-after-free Write in iowarrior_write_callback (2)
@ 2026-05-19 22:26 syzbot
2026-05-22 20:38 ` Joseph Bursey
0 siblings, 1 reply; 3+ messages in thread
From: syzbot @ 2026-05-19 22:26 UTC (permalink / raw)
To: gregkh, linux-kernel, linux-usb, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: fcee7d82f27d Merge tag 'net-7.1-rc3' of git://git.kernel.o..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=15792ad2580000
kernel config: https://syzkaller.appspot.com/x/.config?x=59da38148f3a3d24
dashboard link: https://syzkaller.appspot.com/bug?extid=ad2aac2febc3bedf0962
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-fcee7d82.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a5dee9aef2ac/vmlinux-fcee7d82.xz
kernel image: https://storage.googleapis.com/syzbot-assets/7b1a8dd09a15/bzImage-fcee7d82.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+ad2aac2febc3bedf0962@syzkaller.appspotmail.com
iowarrior 10-1:0.186: iowarrior_callback - usb_submit_urb failed with result -1
==================================================================
BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
BUG: KASAN: slab-use-after-free in atomic_dec include/linux/atomic/atomic-instrumented.h:592 [inline]
BUG: KASAN: slab-use-after-free in iowarrior_write_callback+0xdc/0x190 drivers/usb/misc/iowarrior.c:236
Write of size 4 at addr ffff888050f49168 by task kworker/u32:13/17990
CPU: 0 UID: 0 PID: 17990 Comm: kworker/u32:13 Tainted: G L syzkaller #0 PREEMPT(full)
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x13d/0x4b0 mm/kasan/report.c:482
kasan_report+0xdf/0x1d0 mm/kasan/report.c:595
check_region_inline mm/kasan/generic.c:186 [inline]
kasan_check_range+0x10f/0x1e0 mm/kasan/generic.c:200
instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
atomic_dec include/linux/atomic/atomic-instrumented.h:592 [inline]
iowarrior_write_callback+0xdc/0x190 drivers/usb/misc/iowarrior.c:236
__usb_hcd_giveback_urb+0x38d/0x610 drivers/usb/core/hcd.c:1657
usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741
dummy_timer+0xda1/0x36c0 drivers/usb/gadget/udc/dummy_hcd.c:2005
__run_hrtimer kernel/time/hrtimer.c:1930 [inline]
__hrtimer_run_queues+0x470/0xa00 kernel/time/hrtimer.c:1994
hrtimer_run_softirq+0x17d/0x2c0 kernel/time/hrtimer.c:2011
handle_softirqs+0x1ea/0xa00 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x162/0x210 kernel/softirq.c:735
irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1061 [inline]
sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1061
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
RIP: 0010:stackdepot_memcmp lib/stackdepot.c:585 [inline]
RIP: 0010:find_stack lib/stackdepot.c:618 [inline]
RIP: 0010:stack_depot_save_flags+0x1b5/0x9d0 lib/stackdepot.c:676
Code: 00 45 39 4e 10 75 ee 45 3b 6e 14 75 e8 31 c0 66 66 2e 0f 1f 84 00 00 00 00 00 66 66 2e 0f 1f 84 00 00 00 00 00 49 8b 7c c6 20 <49> 39 3c c4 75 c5 48 83 c0 01 48 39 c2 75 ec f6 c3 02 74 26 41 8b
RSP: 0018:ffffc90006dc7870 EFLAGS: 00000202
RAX: 0000000000000004 RBX: 0000000000000001 RCX: 000000007b9bc970
RDX: 000000000000000b RSI: 00000000b68975a0 RDI: ffffffff895a9470
RBP: 0000000000000820 R08: 0000000000d001a0 R09: 00000000decd001a
R10: 0000000000000200 R11: 000000000000756b R12: ffffc90006dc78c8
R13: 000000000000000b R14: ffff88802bfe14c0 R15: ffff88816d7001a0
kasan_save_stack+0x3f/0x50 mm/kasan/common.c:58
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
unpoison_slab_object mm/kasan/common.c:340 [inline]
__kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:366
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4569 [inline]
slab_alloc_node mm/slub.c:4898 [inline]
kmem_cache_alloc_noprof+0x241/0x6e0 mm/slub.c:4905
skb_clone+0x190/0x400 net/core/skbuff.c:2107
batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:386 [inline]
batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:419 [inline]
batadv_iv_send_outstanding_bat_ogm_packet+0x5e5/0x860 net/batman-adv/bat_iv_ogm.c:1700
process_one_work+0xa0e/0x1980 kernel/workqueue.c:3302
process_scheduled_works kernel/workqueue.c:3385 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3466
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Allocated by task 5926:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415
kmalloc_noprof include/linux/slab.h:950 [inline]
kzalloc_noprof include/linux/slab.h:1188 [inline]
iowarrior_probe+0x85/0x1220 drivers/usb/misc/iowarrior.c:766
usb_probe_interface+0x303/0x8f0 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:631 [inline]
really_probe+0x241/0xa60 drivers/base/dd.c:709
__driver_probe_device+0x22e/0x480 drivers/base/dd.c:871
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:901
__device_attach_driver+0x1df/0x340 drivers/base/dd.c:1029
bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
__device_attach+0x1e4/0x4d0 drivers/base/dd.c:1101
device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1156
bus_probe_device+0x64/0x160 drivers/base/bus.c:613
device_add+0x1210/0x1950 drivers/base/core.c:3706
usb_set_configuration+0xd97/0x1c60 drivers/usb/core/message.c:2268
usb_generic_driver_probe+0xa1/0xe0 drivers/usb/core/generic.c:250
usb_probe_device+0xef/0x400 drivers/usb/core/driver.c:291
call_driver_probe drivers/base/dd.c:631 [inline]
really_probe+0x241/0xa60 drivers/base/dd.c:709
__driver_probe_device+0x22e/0x480 drivers/base/dd.c:871
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:901
__device_attach_driver+0x1df/0x340 drivers/base/dd.c:1029
bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
__device_attach+0x1e4/0x4d0 drivers/base/dd.c:1101
device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1156
bus_probe_device+0x64/0x160 drivers/base/bus.c:613
device_add+0x1210/0x1950 drivers/base/core.c:3706
usb_new_device.cold+0x685/0x115c drivers/usb/core/hub.c:2695
hub_port_connect drivers/usb/core/hub.c:5567 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
port_event drivers/usb/core/hub.c:5871 [inline]
hub_event+0x314d/0x4af0 drivers/usb/core/hub.c:5953
process_one_work+0xa0e/0x1980 kernel/workqueue.c:3302
process_scheduled_works kernel/workqueue.c:3385 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3466
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Freed by task 39:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2689 [inline]
slab_free mm/slub.c:6250 [inline]
kfree+0x223/0x6c0 mm/slub.c:6565
iowarrior_delete drivers/usb/misc/iowarrior.c:249 [inline]
iowarrior_disconnect+0x212/0x270 drivers/usb/misc/iowarrior.c:921
usb_unbind_interface+0x1dd/0x9e0 drivers/usb/core/driver.c:458
device_remove drivers/base/dd.c:621 [inline]
device_remove+0x12a/0x180 drivers/base/dd.c:613
__device_release_driver drivers/base/dd.c:1352 [inline]
device_release_driver_internal+0x44e/0x620 drivers/base/dd.c:1375
bus_remove_device+0x2bc/0x560 drivers/base/bus.c:657
device_del+0x376/0x9b0 drivers/base/core.c:3895
usb_disable_device+0x367/0x810 drivers/usb/core/message.c:1478
usb_disconnect+0x2e2/0x9a0 drivers/usb/core/hub.c:2345
hub_port_connect drivers/usb/core/hub.c:5407 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
port_event drivers/usb/core/hub.c:5871 [inline]
hub_event+0x1d0c/0x4af0 drivers/usb/core/hub.c:5953
process_one_work+0xa0e/0x1980 kernel/workqueue.c:3302
process_scheduled_works kernel/workqueue.c:3385 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3466
kthread+0x370/0x450 kernel/kthread.c:436
ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
The buggy address belongs to the object at ffff888050f49000
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 360 bytes inside of
freed 1024-byte region [ffff888050f49000, ffff888050f49400)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888050f4a800 pfn:0x50f48
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000240 ffff88801b842dc0 ffffea00015f2410 ffffea0000d13c10
raw: ffff888050f4a800 000000080010000d 00000000f5000000 0000000000000000
head: 00fff00000000240 ffff88801b842dc0 ffffea00015f2410 ffffea0000d13c10
head: ffff888050f4a800 000000080010000d 00000000f5000000 0000000000000000
head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5753, tgid 5753 (udevd), ts 316157882281, free_ts 314951708929
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x153/0x170 mm/page_alloc.c:1858
prep_new_page mm/page_alloc.c:1866 [inline]
get_page_from_freelist+0x11a6/0x33b0 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x27c/0x2bc0 mm/page_alloc.c:5226
alloc_slab_page mm/slub.c:3278 [inline]
allocate_slab mm/slub.c:3467 [inline]
new_slab+0xa6/0x6c0 mm/slub.c:3525
refill_objects+0x277/0x420 mm/slub.c:7255
refill_sheaf mm/slub.c:2816 [inline]
__pcs_replace_empty_main+0x375/0x650 mm/slub.c:4651
alloc_from_pcs mm/slub.c:4749 [inline]
slab_alloc_node mm/slub.c:4883 [inline]
__do_kmalloc_node mm/slub.c:5294 [inline]
__kvmalloc_node_noprof+0x7da/0xa00 mm/slub.c:6832
bucket_table_alloc.isra.0+0x88/0x460 lib/rhashtable.c:186
rhashtable_init_noprof+0x43b/0x890 lib/rhashtable.c:1100
simple_xattrs_init fs/xattr.c:1618 [inline]
simple_xattrs_alloc+0x5c/0xd0 fs/xattr.c:1641
class_simple_xattrs_constructor include/linux/xattr.h:165 [inline]
shmem_initxattrs+0x7d/0x6c0 mm/shmem.c:4237
security_inode_init_security+0x242/0x370 security/security.c:1370
shmem_mknod+0x2ce/0x480 mm/shmem.c:3868
lookup_open.isra.0+0xc47/0x11b0 fs/namei.c:4511
open_last_lookups fs/namei.c:4611 [inline]
path_openat+0x2291/0x31a0 fs/namei.c:4855
do_file_open+0x20e/0x430 fs/namei.c:4887
page last free pid 8872 tgid 8872 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1402 [inline]
__free_frozen_pages+0x747/0x1040 mm/page_alloc.c:2943
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4569 [inline]
slab_alloc_node mm/slub.c:4898 [inline]
kmem_cache_alloc_noprof+0x241/0x6e0 mm/slub.c:4905
locks_alloc_lock fs/locks.c:285 [inline]
flock_lock_inode+0xcdc/0x11c0 fs/locks.c:1150
flock_lock_inode_wait fs/locks.c:2163 [inline]
locks_lock_inode_wait+0x119/0x490 fs/locks.c:2190
locks_lock_file_wait include/linux/filelock.h:455 [inline]
__do_sys_flock+0x462/0x4d0 fs/locks.c:2258
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x10b/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888050f49000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888050f49080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888050f49100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888050f49180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888050f49200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess):
0: 00 45 39 add %al,0x39(%rbp)
3: 4e 10 75 ee rex.WRX adc %r14b,-0x12(%rbp)
7: 45 3b 6e 14 cmp 0x14(%r14),%r13d
b: 75 e8 jne 0xfffffff5
d: 31 c0 xor %eax,%eax
f: 66 66 2e 0f 1f 84 00 data16 cs nopw 0x0(%rax,%rax,1)
16: 00 00 00 00
1a: 66 66 2e 0f 1f 84 00 data16 cs nopw 0x0(%rax,%rax,1)
21: 00 00 00 00
25: 49 8b 7c c6 20 mov 0x20(%r14,%rax,8),%rdi
* 2a: 49 39 3c c4 cmp %rdi,(%r12,%rax,8) <-- trapping instruction
2e: 75 c5 jne 0xfffffff5
30: 48 83 c0 01 add $0x1,%rax
34: 48 39 c2 cmp %rax,%rdx
37: 75 ec jne 0x25
39: f6 c3 02 test $0x2,%bl
3c: 74 26 je 0x64
3e: 41 rex.B
3f: 8b .byte 0x8b
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [syzbot] [usb?] KASAN: slab-use-after-free Write in iowarrior_write_callback (2)
2026-05-19 22:26 [syzbot] [usb?] KASAN: slab-use-after-free Write in iowarrior_write_callback (2) syzbot
@ 2026-05-22 20:38 ` Joseph Bursey
2026-05-23 4:19 ` Greg KH
0 siblings, 1 reply; 3+ messages in thread
From: Joseph Bursey @ 2026-05-22 20:38 UTC (permalink / raw)
To: syzbot, gregkh, linux-kernel, linux-usb, syzkaller-bugs
Hello, I believe I have a reproducer for this bug using a combination
of syz-execprog and eBPF programs. There are three artifacts used to
reproduce the bug: prog.syz loader.c and func.bpf.c, which can be
compiled as follows:
bpftool btf dump file linux/vmlinux format c > vmlinux.h
gcc loader.c -o loader -lbpf -lelf -lz -static -lzstd
clang -O2 -g -target bpf -c func.bpf.c -o func.bpf.o
And then run using syz-execprog:
./loader & ./syz-execprog -executor=./syz-executor -enable=usb,close_fds
-repeat=0 -procs=4 -threaded -collide -slowdown=1 ./prog.syz
The following configs were added to what Syzkaller used:
CONFIG_KPROBES=y
CONFIG_KPROBE_EVENTS=y
CONFIG_FTRACE_SYSCALLS=y
CONFIG_DEBUG_INFO_BTF=y
CONFIG_DEBUG_INFO_BTF_MODULES=y
CONFIG_FUNCTION_TRACER=y
CONFIG_KPROBE_EVENTS_ON_NOTRACE=y
I am interested to know if eBPF based reproducers are helpful during
the debugging process.
Please note, this reproducer was generated primarily using an LLM,
but was confirmed and cleaned up by myself.
prog.syz:
r0 = syz_usb_connect(0x5, 0x46,
&(0x7f0000000780)=ANY=[@ANYBLOB="12010000e75fcc08c0070515c5b8010203010902340001000080000904ba00038e4ee2000905000000041a06010905010300021207c109050c04400006030f07059acbf5"],
0x0)
syz_usb_control_io$cdc_ncm(r0, &(0x7f0000000100)={0x14, 0x0,
&(0x7f00000000c0)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0)
r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0)
write$char_usb(r1, &(0x7f0000000000)="93", 0xf5)
loader.c:
#include <stdio.h>
#include <bpf/libbpf.h>
int main(void)
{
const char *path = "func.bpf.o";
struct bpf_object *obj;
struct bpf_program *prog;
struct bpf_link *link;
obj = bpf_object__open_file(path, NULL);
if (libbpf_get_error(obj)) return 1;
if (bpf_object__load(obj)) return 1;
prog = bpf_object__next_program(obj, NULL);
if (!prog) return 1;
link = bpf_program__attach(prog);
if (libbpf_get_error(link)) return 1;
printf("loaded"); fflush(stdout);
while(1);
return 0;
}
func.bpf.c:
#include "vmlinux.h"
#include <bpf/bpf_helpers.h>
char LICENSE[] SEC("license") = "GPL";
#define DELAY_NS 20000000ULL
#define DELAY_LOOPS 500000
static long spin_until(__u32 i, void *data)
{
__u64 *start = data;
return bpf_ktime_get_ns() - *start >= DELAY_NS;
}
SEC("kprobe/iowarrior_write_callback")
int delay_iowarrior_write_callback(void *ctx)
{
__u64 start = bpf_ktime_get_ns();
bpf_loop(DELAY_LOOPS, spin_until, &start, 0);
return 0;
}
On 5/19/26 15:26, syzbot wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: fcee7d82f27d Merge tag 'net-7.1-rc3' of git://git.kernel.o..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=15792ad2580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=59da38148f3a3d24
> dashboard link: https://syzkaller.appspot.com/bug?extid=ad2aac2febc3bedf0962
> compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
>
> Unfortunately, I don't have any reproducer for this issue yet.
>
> Downloadable assets:
> disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-fcee7d82.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/a5dee9aef2ac/vmlinux-fcee7d82.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/7b1a8dd09a15/bzImage-fcee7d82.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+ad2aac2febc3bedf0962@syzkaller.appspotmail.com
>
> iowarrior 10-1:0.186: iowarrior_callback - usb_submit_urb failed with result -1
> ==================================================================
> BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
> BUG: KASAN: slab-use-after-free in atomic_dec include/linux/atomic/atomic-instrumented.h:592 [inline]
> BUG: KASAN: slab-use-after-free in iowarrior_write_callback+0xdc/0x190 drivers/usb/misc/iowarrior.c:236
> Write of size 4 at addr ffff888050f49168 by task kworker/u32:13/17990
>
> CPU: 0 UID: 0 PID: 17990 Comm: kworker/u32:13 Tainted: G L syzkaller #0 PREEMPT(full)
> Tainted: [L]=SOFTLOCKUP
> Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
> Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet
> Call Trace:
> <IRQ>
> __dump_stack lib/dump_stack.c:94 [inline]
> dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
> print_address_description mm/kasan/report.c:378 [inline]
> print_report+0x13d/0x4b0 mm/kasan/report.c:482
> kasan_report+0xdf/0x1d0 mm/kasan/report.c:595
> check_region_inline mm/kasan/generic.c:186 [inline]
> kasan_check_range+0x10f/0x1e0 mm/kasan/generic.c:200
> instrument_atomic_read_write include/linux/instrumented.h:112 [inline]
> atomic_dec include/linux/atomic/atomic-instrumented.h:592 [inline]
> iowarrior_write_callback+0xdc/0x190 drivers/usb/misc/iowarrior.c:236
> __usb_hcd_giveback_urb+0x38d/0x610 drivers/usb/core/hcd.c:1657
> usb_hcd_giveback_urb+0x3ca/0x4a0 drivers/usb/core/hcd.c:1741
> dummy_timer+0xda1/0x36c0 drivers/usb/gadget/udc/dummy_hcd.c:2005
> __run_hrtimer kernel/time/hrtimer.c:1930 [inline]
> __hrtimer_run_queues+0x470/0xa00 kernel/time/hrtimer.c:1994
> hrtimer_run_softirq+0x17d/0x2c0 kernel/time/hrtimer.c:2011
> handle_softirqs+0x1ea/0xa00 kernel/softirq.c:622
> __do_softirq kernel/softirq.c:656 [inline]
> invoke_softirq kernel/softirq.c:496 [inline]
> __irq_exit_rcu+0x162/0x210 kernel/softirq.c:735
> irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
> instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1061 [inline]
> sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1061
> </IRQ>
> <TASK>
> asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697
> RIP: 0010:stackdepot_memcmp lib/stackdepot.c:585 [inline]
> RIP: 0010:find_stack lib/stackdepot.c:618 [inline]
> RIP: 0010:stack_depot_save_flags+0x1b5/0x9d0 lib/stackdepot.c:676
> Code: 00 45 39 4e 10 75 ee 45 3b 6e 14 75 e8 31 c0 66 66 2e 0f 1f 84 00 00 00 00 00 66 66 2e 0f 1f 84 00 00 00 00 00 49 8b 7c c6 20 <49> 39 3c c4 75 c5 48 83 c0 01 48 39 c2 75 ec f6 c3 02 74 26 41 8b
> RSP: 0018:ffffc90006dc7870 EFLAGS: 00000202
> RAX: 0000000000000004 RBX: 0000000000000001 RCX: 000000007b9bc970
> RDX: 000000000000000b RSI: 00000000b68975a0 RDI: ffffffff895a9470
> RBP: 0000000000000820 R08: 0000000000d001a0 R09: 00000000decd001a
> R10: 0000000000000200 R11: 000000000000756b R12: ffffc90006dc78c8
> R13: 000000000000000b R14: ffff88802bfe14c0 R15: ffff88816d7001a0
> kasan_save_stack+0x3f/0x50 mm/kasan/common.c:58
> kasan_save_track+0x14/0x30 mm/kasan/common.c:78
> unpoison_slab_object mm/kasan/common.c:340 [inline]
> __kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:366
> kasan_slab_alloc include/linux/kasan.h:253 [inline]
> slab_post_alloc_hook mm/slub.c:4569 [inline]
> slab_alloc_node mm/slub.c:4898 [inline]
> kmem_cache_alloc_noprof+0x241/0x6e0 mm/slub.c:4905
> skb_clone+0x190/0x400 net/core/skbuff.c:2107
> batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:386 [inline]
> batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:419 [inline]
> batadv_iv_send_outstanding_bat_ogm_packet+0x5e5/0x860 net/batman-adv/bat_iv_ogm.c:1700
> process_one_work+0xa0e/0x1980 kernel/workqueue.c:3302
> process_scheduled_works kernel/workqueue.c:3385 [inline]
> worker_thread+0x5ef/0xe50 kernel/workqueue.c:3466
> kthread+0x370/0x450 kernel/kthread.c:436
> ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
> </TASK>
>
> Allocated by task 5926:
> kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
> kasan_save_track+0x14/0x30 mm/kasan/common.c:78
> poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
> __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415
> kmalloc_noprof include/linux/slab.h:950 [inline]
> kzalloc_noprof include/linux/slab.h:1188 [inline]
> iowarrior_probe+0x85/0x1220 drivers/usb/misc/iowarrior.c:766
> usb_probe_interface+0x303/0x8f0 drivers/usb/core/driver.c:396
> call_driver_probe drivers/base/dd.c:631 [inline]
> really_probe+0x241/0xa60 drivers/base/dd.c:709
> __driver_probe_device+0x22e/0x480 drivers/base/dd.c:871
> driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:901
> __device_attach_driver+0x1df/0x340 drivers/base/dd.c:1029
> bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
> __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1101
> device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1156
> bus_probe_device+0x64/0x160 drivers/base/bus.c:613
> device_add+0x1210/0x1950 drivers/base/core.c:3706
> usb_set_configuration+0xd97/0x1c60 drivers/usb/core/message.c:2268
> usb_generic_driver_probe+0xa1/0xe0 drivers/usb/core/generic.c:250
> usb_probe_device+0xef/0x400 drivers/usb/core/driver.c:291
> call_driver_probe drivers/base/dd.c:631 [inline]
> really_probe+0x241/0xa60 drivers/base/dd.c:709
> __driver_probe_device+0x22e/0x480 drivers/base/dd.c:871
> driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:901
> __device_attach_driver+0x1df/0x340 drivers/base/dd.c:1029
> bus_for_each_drv+0x159/0x1e0 drivers/base/bus.c:500
> __device_attach+0x1e4/0x4d0 drivers/base/dd.c:1101
> device_initial_probe+0xaf/0xd0 drivers/base/dd.c:1156
> bus_probe_device+0x64/0x160 drivers/base/bus.c:613
> device_add+0x1210/0x1950 drivers/base/core.c:3706
> usb_new_device.cold+0x685/0x115c drivers/usb/core/hub.c:2695
> hub_port_connect drivers/usb/core/hub.c:5567 [inline]
> hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
> port_event drivers/usb/core/hub.c:5871 [inline]
> hub_event+0x314d/0x4af0 drivers/usb/core/hub.c:5953
> process_one_work+0xa0e/0x1980 kernel/workqueue.c:3302
> process_scheduled_works kernel/workqueue.c:3385 [inline]
> worker_thread+0x5ef/0xe50 kernel/workqueue.c:3466
> kthread+0x370/0x450 kernel/kthread.c:436
> ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
>
> Freed by task 39:
> kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
> kasan_save_track+0x14/0x30 mm/kasan/common.c:78
> kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
> poison_slab_object mm/kasan/common.c:253 [inline]
> __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285
> kasan_slab_free include/linux/kasan.h:235 [inline]
> slab_free_hook mm/slub.c:2689 [inline]
> slab_free mm/slub.c:6250 [inline]
> kfree+0x223/0x6c0 mm/slub.c:6565
> iowarrior_delete drivers/usb/misc/iowarrior.c:249 [inline]
> iowarrior_disconnect+0x212/0x270 drivers/usb/misc/iowarrior.c:921
> usb_unbind_interface+0x1dd/0x9e0 drivers/usb/core/driver.c:458
> device_remove drivers/base/dd.c:621 [inline]
> device_remove+0x12a/0x180 drivers/base/dd.c:613
> __device_release_driver drivers/base/dd.c:1352 [inline]
> device_release_driver_internal+0x44e/0x620 drivers/base/dd.c:1375
> bus_remove_device+0x2bc/0x560 drivers/base/bus.c:657
> device_del+0x376/0x9b0 drivers/base/core.c:3895
> usb_disable_device+0x367/0x810 drivers/usb/core/message.c:1478
> usb_disconnect+0x2e2/0x9a0 drivers/usb/core/hub.c:2345
> hub_port_connect drivers/usb/core/hub.c:5407 [inline]
> hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
> port_event drivers/usb/core/hub.c:5871 [inline]
> hub_event+0x1d0c/0x4af0 drivers/usb/core/hub.c:5953
> process_one_work+0xa0e/0x1980 kernel/workqueue.c:3302
> process_scheduled_works kernel/workqueue.c:3385 [inline]
> worker_thread+0x5ef/0xe50 kernel/workqueue.c:3466
> kthread+0x370/0x450 kernel/kthread.c:436
> ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
> ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
>
> The buggy address belongs to the object at ffff888050f49000
> which belongs to the cache kmalloc-1k of size 1024
> The buggy address is located 360 bytes inside of
> freed 1024-byte region [ffff888050f49000, ffff888050f49400)
>
> The buggy address belongs to the physical page:
> page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888050f4a800 pfn:0x50f48
> head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
> flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff)
> page_type: f5(slab)
> raw: 00fff00000000240 ffff88801b842dc0 ffffea00015f2410 ffffea0000d13c10
> raw: ffff888050f4a800 000000080010000d 00000000f5000000 0000000000000000
> head: 00fff00000000240 ffff88801b842dc0 ffffea00015f2410 ffffea0000d13c10
> head: ffff888050f4a800 000000080010000d 00000000f5000000 0000000000000000
> head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
> head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
> page dumped because: kasan: bad access detected
> page_owner tracks the page as allocated
> page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5753, tgid 5753 (udevd), ts 316157882281, free_ts 314951708929
> set_page_owner include/linux/page_owner.h:32 [inline]
> post_alloc_hook+0x153/0x170 mm/page_alloc.c:1858
> prep_new_page mm/page_alloc.c:1866 [inline]
> get_page_from_freelist+0x11a6/0x33b0 mm/page_alloc.c:3946
> __alloc_frozen_pages_noprof+0x27c/0x2bc0 mm/page_alloc.c:5226
> alloc_slab_page mm/slub.c:3278 [inline]
> allocate_slab mm/slub.c:3467 [inline]
> new_slab+0xa6/0x6c0 mm/slub.c:3525
> refill_objects+0x277/0x420 mm/slub.c:7255
> refill_sheaf mm/slub.c:2816 [inline]
> __pcs_replace_empty_main+0x375/0x650 mm/slub.c:4651
> alloc_from_pcs mm/slub.c:4749 [inline]
> slab_alloc_node mm/slub.c:4883 [inline]
> __do_kmalloc_node mm/slub.c:5294 [inline]
> __kvmalloc_node_noprof+0x7da/0xa00 mm/slub.c:6832
> bucket_table_alloc.isra.0+0x88/0x460 lib/rhashtable.c:186
> rhashtable_init_noprof+0x43b/0x890 lib/rhashtable.c:1100
> simple_xattrs_init fs/xattr.c:1618 [inline]
> simple_xattrs_alloc+0x5c/0xd0 fs/xattr.c:1641
> class_simple_xattrs_constructor include/linux/xattr.h:165 [inline]
> shmem_initxattrs+0x7d/0x6c0 mm/shmem.c:4237
> security_inode_init_security+0x242/0x370 security/security.c:1370
> shmem_mknod+0x2ce/0x480 mm/shmem.c:3868
> lookup_open.isra.0+0xc47/0x11b0 fs/namei.c:4511
> open_last_lookups fs/namei.c:4611 [inline]
> path_openat+0x2291/0x31a0 fs/namei.c:4855
> do_file_open+0x20e/0x430 fs/namei.c:4887
> page last free pid 8872 tgid 8872 stack trace:
> reset_page_owner include/linux/page_owner.h:25 [inline]
> __free_pages_prepare mm/page_alloc.c:1402 [inline]
> __free_frozen_pages+0x747/0x1040 mm/page_alloc.c:2943
> qlink_free mm/kasan/quarantine.c:163 [inline]
> qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179
> kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286
> __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350
> kasan_slab_alloc include/linux/kasan.h:253 [inline]
> slab_post_alloc_hook mm/slub.c:4569 [inline]
> slab_alloc_node mm/slub.c:4898 [inline]
> kmem_cache_alloc_noprof+0x241/0x6e0 mm/slub.c:4905
> locks_alloc_lock fs/locks.c:285 [inline]
> flock_lock_inode+0xcdc/0x11c0 fs/locks.c:1150
> flock_lock_inode_wait fs/locks.c:2163 [inline]
> locks_lock_inode_wait+0x119/0x490 fs/locks.c:2190
> locks_lock_file_wait include/linux/filelock.h:455 [inline]
> __do_sys_flock+0x462/0x4d0 fs/locks.c:2258
> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
> do_syscall_64+0x10b/0xf80 arch/x86/entry/syscall_64.c:94
> entry_SYSCALL_64_after_hwframe+0x77/0x7f
>
> Memory state around the buggy address:
> ffff888050f49000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff888050f49080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>> ffff888050f49100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ^
> ffff888050f49180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff888050f49200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ==================================================================
> ----------------
> Code disassembly (best guess):
> 0: 00 45 39 add %al,0x39(%rbp)
> 3: 4e 10 75 ee rex.WRX adc %r14b,-0x12(%rbp)
> 7: 45 3b 6e 14 cmp 0x14(%r14),%r13d
> b: 75 e8 jne 0xfffffff5
> d: 31 c0 xor %eax,%eax
> f: 66 66 2e 0f 1f 84 00 data16 cs nopw 0x0(%rax,%rax,1)
> 16: 00 00 00 00
> 1a: 66 66 2e 0f 1f 84 00 data16 cs nopw 0x0(%rax,%rax,1)
> 21: 00 00 00 00
> 25: 49 8b 7c c6 20 mov 0x20(%r14,%rax,8),%rdi
> * 2a: 49 39 3c c4 cmp %rdi,(%r12,%rax,8) <-- trapping instruction
> 2e: 75 c5 jne 0xfffffff5
> 30: 48 83 c0 01 add $0x1,%rax
> 34: 48 39 c2 cmp %rax,%rdx
> 37: 75 ec jne 0x25
> 39: f6 c3 02 test $0x2,%bl
> 3c: 74 26 je 0x64
> 3e: 41 rex.B
> 3f: 8b .byte 0x8b
>
>
> ---
> This report is generated by a bot. It may contain errors.
> See https://goo.gl/tpsmEJ for more information about syzbot.
> syzbot engineers can be reached at syzkaller@googlegroups.com.
>
> syzbot will keep track of this issue. See:
> https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
>
> If the report is already addressed, let syzbot know by replying with:
> #syz fix: exact-commit-title
>
> If you want to overwrite report's subsystems, reply with:
> #syz set subsystems: new-subsystem
> (See the list of subsystem names on the web dashboard)
>
> If the report is a duplicate of another one, reply with:
> #syz dup: exact-subject-of-another-report
>
> If you want to undo deduplication, reply with:
> #syz undup
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [syzbot] [usb?] KASAN: slab-use-after-free Write in iowarrior_write_callback (2)
2026-05-22 20:38 ` Joseph Bursey
@ 2026-05-23 4:19 ` Greg KH
0 siblings, 0 replies; 3+ messages in thread
From: Greg KH @ 2026-05-23 4:19 UTC (permalink / raw)
To: Joseph Bursey; +Cc: syzbot, linux-kernel, linux-usb, syzkaller-bugs
On Fri, May 22, 2026 at 01:38:40PM -0700, Joseph Bursey wrote:
> Hello, I believe I have a reproducer for this bug using a combination
> of syz-execprog and eBPF programs. There are three artifacts used to
> reproduce the bug: prog.syz loader.c and func.bpf.c, which can be
> compiled as follows:
>
> bpftool btf dump file linux/vmlinux format c > vmlinux.h
> gcc loader.c -o loader -lbpf -lelf -lz -static -lzstd
> clang -O2 -g -target bpf -c func.bpf.c -o func.bpf.o
>
> And then run using syz-execprog:
>
> ./loader & ./syz-execprog -executor=./syz-executor -enable=usb,close_fds
> -repeat=0 -procs=4 -threaded -collide -slowdown=1 ./prog.syz
>
> The following configs were added to what Syzkaller used:
> CONFIG_KPROBES=y
> CONFIG_KPROBE_EVENTS=y
> CONFIG_FTRACE_SYSCALLS=y
> CONFIG_DEBUG_INFO_BTF=y
> CONFIG_DEBUG_INFO_BTF_MODULES=y
> CONFIG_FUNCTION_TRACER=y
> CONFIG_KPROBE_EVENTS_ON_NOTRACE=y
>
> I am interested to know if eBPF based reproducers are helpful during
> the debugging process.
If you can use that to create a fix, great! Otherwise there's not much
we can do here with this :)
thanks,
greg k-h
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-05-23 4:19 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-05-19 22:26 [syzbot] [usb?] KASAN: slab-use-after-free Write in iowarrior_write_callback (2) syzbot
2026-05-22 20:38 ` Joseph Bursey
2026-05-23 4:19 ` Greg KH
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox