From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: Jaeyoung Chung <jjy600901@snu.ac.kr>
Cc: Valentina Manea <valentina.manea.m@gmail.com>,
Shuah Khan <shuah@kernel.org>, Hongren Zheng <i@zenithal.me>,
linux-usb@vger.kernel.org, linux-kernel@vger.kernel.org,
Eulgyu Kim <eulgyukim@snu.ac.kr>
Subject: Re: [BUG] KASAN: slab-use-after-free Read in vhci_tx_loop
Date: Sun, 12 Jul 2026 11:43:56 +0200 [thread overview]
Message-ID: <2026071210-defacing-evacuate-d27d@gregkh> (raw)
In-Reply-To: <20260712094037.1560970-1-jjy600901@snu.ac.kr>
On Sun, Jul 12, 2026 at 06:40:37PM +0900, Jaeyoung Chung wrote:
> Hello,
>
> We found a slab-use-after-free Read in vhci_tx_loop on Linux v7.2-rc2
> (8cdeaa50eae8dad34885515f62559ee83e7e8dda).
>
> The report below was produced on an x86_64 QEMU guest with KASAN. The kernel
> configuration is the same as the syzbot configuration.
>
> Required kernel config for reproducing the issue:
> CONFIG_USBIP_CORE=y
> CONFIG_USBIP_VHCI_HCD=y
> CONFIG_USBIP_VHCI_HC_PORTS=8
> CONFIG_USBIP_VHCI_NR_HCS=16
> CONFIG_KASAN=y
> CONFIG_KASAN_GENERIC=y
> CONFIG_KASAN_INLINE=y
>
> To make the race reliably reproducible, I applied the testing-only delay
> patch below. I then built and ran the reproducer as root:
>
> gcc repro.c -o repro -static -lpthread
> ./repro
>
> I do not have a proposed fix for this issue. Please let me know if any
> additional information or testing would be useful.
>
> Reported-by: Jaeyoung Chung <jjy600901@snu.ac.kr>
> Reported-by: Eulgyu Kim <eulgyukim@snu.ac.kr>
A proposed patch would be best as you have a way to reproduce the issue.
thanks,
greg k-h
prev parent reply other threads:[~2026-07-12 9:45 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-12 9:40 [BUG] KASAN: slab-use-after-free Read in vhci_tx_loop Jaeyoung Chung
2026-07-12 9:43 ` Greg Kroah-Hartman [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=2026071210-defacing-evacuate-d27d@gregkh \
--to=gregkh@linuxfoundation.org \
--cc=eulgyukim@snu.ac.kr \
--cc=i@zenithal.me \
--cc=jjy600901@snu.ac.kr \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=shuah@kernel.org \
--cc=valentina.manea.m@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox