Re: [syzbot] [fs?] KASAN: slab-use-after-free Read in lookup_noperm_common

[Hillf Danton <hdanton@sina.com>]

> Date: Wed, 29 Jul 2026 18:43:20 -0700	[thread overview]
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    cc2b5f627e8c Add linux-next specific files for 20260714
> git tree:       linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=13a8649e580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=2290ccbf984c524f
> dashboard link: https://syzkaller.appspot.com/bug?extid=23ad911c819b923238b7
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=141917b1580000

#syz test

--- x/drivers/i2c/i2c-core-base.c
+++ y/drivers/i2c/i2c-core-base.c
@@ -1826,8 +1826,6 @@ void i2c_del_adapter(struct i2c_adapter
 
 	i2c_host_notify_irq_teardown(adap);
 
-	debugfs_remove_recursive(adap->debugfs);
-
 	/* wait until all references to the device are gone
 	 *
 	 * FIXME: This is old code and should ideally be replaced by an
@@ -1844,6 +1842,8 @@ void i2c_del_adapter(struct i2c_adapter
 	idr_remove(&i2c_adapter_idr, adap->nr);
 	mutex_unlock(&core_lock);
 
+	debugfs_remove_recursive(adap->debugfs);
+
 	/* Clear the device structure in case this adapter is ever going to be
 	   added again */
 	memset(&adap->dev, 0, sizeof(adap->dev));
--