* [syzbot] [usb?] KASAN: slab-use-after-free Read in ep_open
@ 2026-07-31 1:28 syzbot
2026-08-17 13:42 ` syzbot
0 siblings, 1 reply; 6+ messages in thread
From: syzbot @ 2026-07-31 1:28 UTC (permalink / raw)
To: gregkh, linux-kernel, linux-usb, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 365f9c7a6b81 Merge branches 'for-next/core' and 'for-next/..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=13731632580000
kernel config: https://syzkaller.appspot.com/x/.config?x=72c97575381cec47
dashboard link: https://syzkaller.appspot.com/bug?extid=df9e891bf8ea586f846b
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=136d6499580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=138d6449580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/eafe0adb7386/disk-365f9c7a.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/29422d607579/vmlinux-365f9c7a.xz
kernel image: https://storage.googleapis.com/syzbot-assets/98ca955a8b54/Image-365f9c7a.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+df9e891bf8ea586f846b@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: slab-use-after-free in __mutex_lock_common kernel/locking/mutex.c:625 [inline]
BUG: KASAN: slab-use-after-free in __mutex_lock+0x130/0xf14 kernel/locking/mutex.c:821
Read of size 8 at addr ffff0000efe3d058 by task syz-executor/5909
CPU: 1 UID: 0 PID: 5909 Comm: syz-executor Not tainted syzkaller #0 PREEMPT
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026
Call trace:
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C)
__dump_stack+0x30/0x40 lib/dump_stack.c:94
dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
print_address_description+0xb0/0x238 mm/kasan/report.c:378
print_report+0x68/0x84 mm/kasan/report.c:482
kasan_report+0x8c/0xc4 mm/kasan/report.c:595
__asan_report_load8_noabort+0x20/0x2c mm/kasan/report_generic.c:381
__mutex_lock_common kernel/locking/mutex.c:625 [inline]
__mutex_lock+0x130/0xf14 kernel/locking/mutex.c:821
mutex_lock_interruptible_nested+0x24/0x30 kernel/locking/mutex.c:899
ep_open+0x58/0x25c drivers/usb/gadget/legacy/inode.c:823
do_dentry_open+0x5c4/0xfc0 fs/open.c:947
vfs_open+0x44/0x2dc fs/open.c:1052
do_open fs/namei.c:4700 [inline]
path_openat+0x21fc/0x2a60 fs/namei.c:4863
do_file_open+0x1c8/0x2e8 fs/namei.c:4892
do_sys_openat2+0x114/0x1e8 fs/open.c:1368
do_sys_open+0xb0/0xe0 fs/open.c:1374
__do_sys_openat fs/open.c:1390 [inline]
__se_sys_openat fs/open.c:1385 [inline]
__arm64_sys_openat+0xa0/0xbc fs/open.c:1385
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:736
el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:755
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594
Allocated by task 6282:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x40/0x78 mm/kasan/common.c:78
kasan_save_alloc_info+0x44/0x54 mm/kasan/generic.c:570
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0x9c/0xb4 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__kmalloc_cache_noprof+0x2e8/0x5ec mm/slub.c:5515
_kmalloc_noprof include/linux/slab.h:969 [inline]
_kzalloc_noprof include/linux/slab.h:1290 [inline]
activate_ep_files drivers/usb/gadget/legacy/inode.c:1601 [inline]
gadgetfs_bind+0x204/0x75c drivers/usb/gadget/legacy/inode.c:1692
gadget_bind_driver+0x274/0x834 drivers/usb/gadget/udc/core.c:1662
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x29c/0x800 drivers/base/dd.c:706
__driver_probe_device+0x1e0/0x350 drivers/base/dd.c:868
driver_probe_device+0x6c/0x19c drivers/base/dd.c:898
__driver_attach+0x168/0x384 drivers/base/dd.c:1292
bus_for_each_dev+0x128/0x1b4 drivers/base/bus.c:383
driver_attach+0x50/0x60 drivers/base/dd.c:1310
bus_add_driver+0x208/0x500 drivers/base/bus.c:763
driver_register+0x220/0x310 drivers/base/driver.c:174
usb_gadget_register_driver_owner+0xf0/0x25c drivers/usb/gadget/udc/core.c:1752
dev_config+0x91c/0xcc0 drivers/usb/gadget/legacy/inode.c:1883
vfs_write+0x2a4/0xa0c fs/read_write.c:685
ksys_write+0x12c/0x228 fs/read_write.c:739
__do_sys_write fs/read_write.c:750 [inline]
__se_sys_write fs/read_write.c:747 [inline]
__arm64_sys_write+0x7c/0x90 fs/read_write.c:747
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:736
el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:755
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594
Freed by task 6283:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x40/0x78 mm/kasan/common.c:78
kasan_save_free_info+0x58/0x70 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x74/0xa4 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2705 [inline]
slab_free mm/slub.c:6405 [inline]
kfree+0x188/0x690 mm/slub.c:6720
put_ep+0xd0/0x144 drivers/usb/gadget/legacy/inode.c:225
destroy_ep_files+0x244/0x2dc drivers/usb/gadget/legacy/inode.c:1582
gadgetfs_unbind+0x114/0x1f0 drivers/usb/gadget/legacy/inode.c:1655
gadget_unbind_driver+0x188/0x790 drivers/usb/gadget/udc/core.c:1724
device_remove+0xc4/0x134 drivers/base/dd.c:616
__device_release_driver drivers/base/dd.c:1349 [inline]
device_release_driver_internal+0x124/0x20c drivers/base/dd.c:1372
driver_detach+0x124/0x1b4 drivers/base/dd.c:1435
bus_remove_driver+0x124/0x22c drivers/base/bus.c:832
driver_unregister+0x78/0xac drivers/base/driver.c:202
usb_gadget_unregister_driver+0x50/0x78 drivers/usb/gadget/udc/core.c:1784
dev_release+0x8c/0x15c drivers/usb/gadget/legacy/inode.c:1198
__fput+0x338/0x74c fs/file_table.c:512
____fput+0x20/0x30 fs/file_table.c:540
task_work_run+0x1cc/0x25c kernel/task_work.c:233
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0x58c/0x1a74 kernel/exit.c:1009
__do_sys_exit kernel/exit.c:1119 [inline]
__se_sys_exit kernel/exit.c:1117 [inline]
do_group_exit+0x0/0x238 kernel/exit.c:1117
__invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49
el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121
do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140
el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:736
el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:755
el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594
The buggy address belongs to the object at ffff0000efe3d000
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 88 bytes inside of
freed 512-byte region [ffff0000efe3d000, ffff0000efe3d200)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff0000efe3dc00 pfn:0x12fe3c
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [syzbot] [usb?] KASAN: slab-use-after-free Read in ep_open
2026-07-31 1:28 [syzbot] [usb?] KASAN: slab-use-after-free Read in ep_open syzbot
@ 2026-08-17 13:42 ` syzbot
2026-08-17 15:04 ` Jens Axboe
0 siblings, 1 reply; 6+ messages in thread
From: syzbot @ 2026-08-17 13:42 UTC (permalink / raw)
To: asml.silence, axboe, brauner, gregkh, io-uring, jack, kartikey406,
kees, linux-kernel, linux-usb, mjguzik, nogikh, stern, syzbot,
syzbot, syzkaller-bugs, syzkaller-upstream-moderation, torvalds,
viro
syzbot has bisected this issue to:
commit aa00f67adc2c0d6439f81b5a81ff181377c47a7e
Author: Jens Axboe <axboe@kernel.dk>
Date: Tue Oct 22 19:47:00 2024 +0000
io_uring: add support for fixed wait regions
bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=10e60679580000
start commit: 9a143525f62b Merge tag 'ata-7.2-rc7' of git://git.kernel.o..
git tree: upstream
final oops: https://syzkaller.appspot.com/x/report.txt?x=12e60679580000
console output: https://syzkaller.appspot.com/x/log.txt?x=14e60679580000
kernel config: https://syzkaller.appspot.com/x/.config?x=c44651ea7dd2f307
dashboard link: https://syzkaller.appspot.com/bug?extid=df9e891bf8ea586f846b
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=120defb9580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16323fb9580000
Reported-by: syzbot+df9e891bf8ea586f846b@syzkaller.appspotmail.com
Fixes: aa00f67adc2c ("io_uring: add support for fixed wait regions")
For information about bisection process see: https://goo.gl/tpsmEJ#bisection
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [syzbot] [usb?] KASAN: slab-use-after-free Read in ep_open
2026-08-17 13:42 ` syzbot
@ 2026-08-17 15:04 ` Jens Axboe
2026-08-17 15:45 ` Alan Stern
0 siblings, 1 reply; 6+ messages in thread
From: Jens Axboe @ 2026-08-17 15:04 UTC (permalink / raw)
To: syzbot, asml.silence, brauner, gregkh, io-uring, jack,
kartikey406, kees, linux-kernel, linux-usb, mjguzik, nogikh,
stern, syzbot, syzbot, syzkaller-bugs,
syzkaller-upstream-moderation, torvalds, viro
On 8/17/26 7:42 AM, syzbot wrote:
> syzbot has bisected this issue to:
>
> commit aa00f67adc2c0d6439f81b5a81ff181377c47a7e
> Author: Jens Axboe <axboe@kernel.dk>
> Date: Tue Oct 22 19:47:00 2024 +0000
>
> io_uring: add support for fixed wait regions
>
> bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=10e60679580000
> start commit: 9a143525f62b Merge tag 'ata-7.2-rc7' of git://git.kernel.o..
> git tree: upstream
> final oops: https://syzkaller.appspot.com/x/report.txt?x=12e60679580000
> console output: https://syzkaller.appspot.com/x/log.txt?x=14e60679580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=c44651ea7dd2f307
> dashboard link: https://syzkaller.appspot.com/bug?extid=df9e891bf8ea586f846b
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=120defb9580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16323fb9580000
>
> Reported-by: syzbot+df9e891bf8ea586f846b@syzkaller.appspotmail.com
> Fixes: aa00f67adc2c ("io_uring: add support for fixed wait regions")
That looks like nonsense, I strongly suspect it's a race and hence your
bisection ends up being mostly useless as it sends you in random directions.
--
Jens Axboe
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [syzbot] [usb?] KASAN: slab-use-after-free Read in ep_open
2026-08-17 15:04 ` Jens Axboe
@ 2026-08-17 15:45 ` Alan Stern
2026-08-17 16:38 ` syzbot
0 siblings, 1 reply; 6+ messages in thread
From: Alan Stern @ 2026-08-17 15:45 UTC (permalink / raw)
To: Jens Axboe
Cc: syzbot, asml.silence, brauner, gregkh, io-uring, jack,
kartikey406, kees, linux-kernel, linux-usb, mjguzik, nogikh,
syzbot, syzbot, syzkaller-bugs, syzkaller-upstream-moderation,
torvalds, viro
On Mon, Aug 17, 2026 at 09:04:06AM -0600, Jens Axboe wrote:
> On 8/17/26 7:42 AM, syzbot wrote:
> > syzbot has bisected this issue to:
> >
> > commit aa00f67adc2c0d6439f81b5a81ff181377c47a7e
> > Author: Jens Axboe <axboe@kernel.dk>
> > Date: Tue Oct 22 19:47:00 2024 +0000
> >
> > io_uring: add support for fixed wait regions
> >
> > bisection log: https://syzkaller.appspot.com/x/bisect.txt?x=10e60679580000
> > start commit: 9a143525f62b Merge tag 'ata-7.2-rc7' of git://git.kernel.o..
> > git tree: upstream
> > final oops: https://syzkaller.appspot.com/x/report.txt?x=12e60679580000
> > console output: https://syzkaller.appspot.com/x/log.txt?x=14e60679580000
> > kernel config: https://syzkaller.appspot.com/x/.config?x=c44651ea7dd2f307
> > dashboard link: https://syzkaller.appspot.com/bug?extid=df9e891bf8ea586f846b
> > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=120defb9580000
> > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=16323fb9580000
> >
> > Reported-by: syzbot+df9e891bf8ea586f846b@syzkaller.appspotmail.com
> > Fixes: aa00f67adc2c ("io_uring: add support for fixed wait regions")
>
> That looks like nonsense, I strongly suspect it's a race and hence your
> bisection ends up being mostly useless as it sends you in random directions.
Agreed.
The patch below has already been sent to the USB mailing list. Has
syzbot tested it?
Alan Stern
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ v7.2
From: Aleksandr Nogikh <nogikh@google.com>
A race condition exists between opening a gadgetfs endpoint file and the
destruction of the endpoint files, leading to a use-after-free of the
ep_data object.
When an endpoint file is opened, the VFS looks up the dentry and calls
ep_open(). ep_open() retrieves the ep_data pointer from inode->i_private
and attempts to lock its mutex. Concurrently, if the gadget is unbound,
destroy_ep_files() iterates over the endpoints, unhashes their dentries,
and immediately calls put_ep(). This drops the initial reference to the
ep_data object, freeing it. If another thread is already in the process of
opening the file, it holds a reference to the dentry and the inode. The
inode remains alive, and its i_private pointer still points to the
now-freed ep_data. When ep_open() proceeds to lock data->lock, it accesses
freed memory.
BUG: KASAN: slab-use-after-free in __mutex_lock_common
kernel/locking/mutex.c:625 [inline]
BUG: KASAN: slab-use-after-free in __mutex_lock+0x130/0xf14
kernel/locking/mutex.c:821
Read of size 8 at addr ffff0000f43acc58 by task syz-executor/5900
Call trace:
__mutex_lock_common kernel/locking/mutex.c:625 [inline]
__mutex_lock+0x130/0xf14 kernel/locking/mutex.c:821
mutex_lock_interruptible_nested+0x24/0x30 kernel/locking/mutex.c:899
ep_open+0x58/0x25c drivers/usb/gadget/legacy/inode.c:823
do_dentry_open+0x5c4/0xfc0 fs/open.c:947
vfs_open+0x44/0x2dc fs/open.c:1052
Freed by task 6138:
kfree+0x188/0x690 mm/slub.c:6692
put_ep+0xd0/0x144 drivers/usb/gadget/legacy/inode.c:225
destroy_ep_files+0x244/0x2dc drivers/usb/gadget/legacy/inode.c:1582
gadgetfs_unbind+0x114/0x1f0 drivers/usb/gadget/legacy/inode.c:1655
gadget_unbind_driver+0x188/0x790 drivers/usb/gadget/udc/core.c:1724
To fix this, tie the base reference of ep_data to the lifetime of the inode
rather than manually dropping it in destroy_ep_files(). Add an .evict_inode
callback to gadget_fs_operations that drops the reference when the inode is
finally destroyed. Remove the premature put_ep() call from
destroy_ep_files(). Additionally, to prevent a double-free in the error
path of activate_ep_files(), clear inode->i_private in
gadgetfs_create_file() before calling iput() if simple_start_creating()
fails.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Assisted-by: Gemini:gemini-3.5-flash Gemini:gemini-3.1-pro-preview syzbot
Reported-by: syzbot+df9e891bf8ea586f846b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=df9e891bf8ea586f846b
Link: https://syzkaller.appspot.com/ai_job?id=ae49a838-5eb9-4227-93a3-56ad2313483a
Signed-off-by: Aleksandr Nogikh <nogikh@google.com>
---
diff --git a/drivers/usb/gadget/legacy/inode.c b/drivers/usb/gadget/legacy/inode.c
index d87a8ab51..a03062986 100644
--- a/drivers/usb/gadget/legacy/inode.c
+++ b/drivers/usb/gadget/legacy/inode.c
@@ -1579,8 +1579,6 @@ static void destroy_ep_files (struct dev_data *dev)
/* break link to dcache */
simple_remove_by_name(dev->sb->s_root, ep->name, NULL);
- put_ep (ep);
-
spin_lock_irq (&dev->lock);
}
spin_unlock_irq (&dev->lock);
@@ -1996,6 +1994,7 @@ static int gadgetfs_create_file (struct super_block *sb, char const *name,
dentry = simple_start_creating(sb->s_root, name);
if (IS_ERR(dentry)) {
+ inode->i_private = NULL;
iput(inode);
return PTR_ERR(dentry);
}
@@ -2006,9 +2005,18 @@ static int gadgetfs_create_file (struct super_block *sb, char const *name,
return 0;
}
+static void gadgetfs_evict_inode(struct inode *inode)
+{
+ truncate_inode_pages_final(&inode->i_data);
+ clear_inode(inode);
+ if (inode->i_private && inode->i_fop == &ep_io_operations)
+ put_ep(inode->i_private);
+}
+
static const struct super_operations gadget_fs_operations = {
.statfs = simple_statfs,
.drop_inode = inode_just_drop,
+ .evict_inode = gadgetfs_evict_inode,
};
static int
base-commit: f5098b6bae761e346ebcd9da7f95622c04733cff
--
See https://goo.gle/syzbot-ai-patches for information about AI-generated patches.
You can comment on the patch as usual, syzbot will try to address
the comments and send a new version of the patch if necessary.
syzbot engineers can be reached at syzkaller@googlegroups.com.
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [syzbot] [usb?] KASAN: slab-use-after-free Read in ep_open
2026-08-17 15:45 ` Alan Stern
@ 2026-08-17 16:38 ` syzbot
2026-08-17 18:14 ` Alan Stern
0 siblings, 1 reply; 6+ messages in thread
From: syzbot @ 2026-08-17 16:38 UTC (permalink / raw)
To: asml.silence, axboe, brauner, gregkh, io-uring, jack, kartikey406,
kees, linux-kernel, linux-usb, mjguzik, nogikh, stern, syzbot,
syzbot, syzkaller-bugs, syzkaller-upstream-moderation, torvalds,
viro
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+df9e891bf8ea586f846b@syzkaller.appspotmail.com
Tested-by: syzbot+df9e891bf8ea586f846b@syzkaller.appspotmail.com
Tested on:
commit: 8d3ae592 Linux 7.2
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ v7.2
console output: https://syzkaller.appspot.com/x/log.txt?x=16a91a25580000
kernel config: https://syzkaller.appspot.com/x/.config?x=c44651ea7dd2f307
dashboard link: https://syzkaller.appspot.com/bug?extid=df9e891bf8ea586f846b
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
patch: https://syzkaller.appspot.com/x/patch.diff?x=15790679580000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [syzbot] [usb?] KASAN: slab-use-after-free Read in ep_open
2026-08-17 16:38 ` syzbot
@ 2026-08-17 18:14 ` Alan Stern
0 siblings, 0 replies; 6+ messages in thread
From: Alan Stern @ 2026-08-17 18:14 UTC (permalink / raw)
To: Greg KH
Cc: syzbot, asml.silence, axboe, brauner, io-uring, jack, kartikey406,
kees, linux-kernel, linux-usb, mjguzik, nogikh, syzbot, syzbot,
syzkaller-bugs, syzkaller-upstream-moderation, torvalds, viro
On Mon, Aug 17, 2026 at 09:38:02AM -0700, syzbot wrote:
> Hello,
>
> syzbot has tested the proposed patch and the reproducer did not trigger any issue:
>
> Reported-by: syzbot+df9e891bf8ea586f846b@syzkaller.appspotmail.com
> Tested-by: syzbot+df9e891bf8ea586f846b@syzkaller.appspotmail.com
>
> Tested on:
>
> commit: 8d3ae592 Linux 7.2
> git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/ v7.2
> console output: https://syzkaller.appspot.com/x/log.txt?x=16a91a25580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=c44651ea7dd2f307
> dashboard link: https://syzkaller.appspot.com/bug?extid=df9e891bf8ea586f846b
> compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> patch: https://syzkaller.appspot.com/x/patch.diff?x=15790679580000
>
> Note: testing is done by a robot and is best-effort only.
Greg:
Has this patch ever been queued?
https://lore.kernel.org/linux-usb/ee41fbfd-f368-4a06-95d6-ae9b4267fd82@mail.kernel.org/
Looks like you can add syzbot's Tested-by: tag, as well as my Acked-by:.
Note that a different patch to fix the same problem was submitted here:
https://lore.kernel.org/linux-usb/20260731230603.4637-1-kartikey406@gmail.com/
IMO the first patch above is superior.
Alan Stern
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-08-17 18:14 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-31 1:28 [syzbot] [usb?] KASAN: slab-use-after-free Read in ep_open syzbot
2026-08-17 13:42 ` syzbot
2026-08-17 15:04 ` Jens Axboe
2026-08-17 15:45 ` Alan Stern
2026-08-17 16:38 ` syzbot
2026-08-17 18:14 ` Alan Stern
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox