From: syzbot <syzbot+9b95da55ba5146a60734@syzkaller.appspotmail.com>
To: kartikey406@gmail.com, linux-kernel@vger.kernel.org,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [kernel?] INFO: rcu detected stall in kill
Date: Sat, 04 Apr 2026 19:37:01 -0700 [thread overview]
Message-ID: <69d1cacd.050a0220.2dbe29.0023.GAE@google.com> (raw)
In-Reply-To: <20260405021945.371546-1-kartikey406@gmail.com>
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Write in ath9k_hif_usb_reg_in_resubmit
==================================================================
BUG: KASAN: slab-use-after-free in ath9k_hif_usb_reg_in_resubmit+0x143/0x170 drivers/net/wireless/ath/ath9k/hif_usb.c:759
Write of size 8 at addr ffff8880282609b0 by task kworker/0:4/5926
CPU: 0 UID: 0 PID: 5926 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026
Workqueue: events ath9k_hif_usb_reg_in_resubmit
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xba/0x230 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
ath9k_hif_usb_reg_in_resubmit+0x143/0x170 drivers/net/wireless/ath/ath9k/hif_usb.c:759
process_one_work kernel/workqueue.c:3276 [inline]
process_scheduled_works+0xb6e/0x18c0 kernel/workqueue.c:3359
worker_thread+0xa53/0xfc0 kernel/workqueue.c:3440
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Allocated by task 6436:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__do_kmalloc_node mm/slub.c:5260 [inline]
__kmalloc_noprof+0x35c/0x760 mm/slub.c:5272
kmalloc_noprof include/linux/slab.h:954 [inline]
usb_alloc_urb+0x46/0x150 drivers/usb/core/urb.c:75
ath9k_hif_usb_alloc_reg_in_urbs drivers/net/wireless/ath/ath9k/hif_usb.c:1019 [inline]
ath9k_hif_usb_alloc_urbs+0xb8c/0x1120 drivers/net/wireless/ath/ath9k/hif_usb.c:1085
ath9k_hif_usb_dev_init drivers/net/wireless/ath/ath9k/hif_usb.c:1171 [inline]
ath9k_hif_usb_firmware_cb+0x127/0x4c0 drivers/net/wireless/ath/ath9k/hif_usb.c:1304
request_firmware_work_func+0x105/0x1c0 drivers/base/firmware_loader/main.c:1152
process_one_work kernel/workqueue.c:3276 [inline]
process_scheduled_works+0xb6e/0x18c0 kernel/workqueue.c:3359
worker_thread+0xa53/0xfc0 kernel/workqueue.c:3440
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Freed by task 5926:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2685 [inline]
slab_free mm/slub.c:6165 [inline]
kfree+0x1c1/0x630 mm/slub.c:6483
urb_destroy drivers/usb/core/urb.c:27 [inline]
kref_put include/linux/kref.h:65 [inline]
usb_free_urb drivers/usb/core/urb.c:96 [inline]
__usb_unanchor_urb drivers/usb/core/urb.c:153 [inline]
usb_unanchor_urb+0x283/0x380 drivers/usb/core/urb.c:183
ath9k_hif_usb_reg_in_resubmit+0xf4/0x170 drivers/net/wireless/ath/ath9k/hif_usb.c:755
process_one_work kernel/workqueue.c:3276 [inline]
process_scheduled_works+0xb6e/0x18c0 kernel/workqueue.c:3359
worker_thread+0xa53/0xfc0 kernel/workqueue.c:3440
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
The buggy address belongs to the object at ffff888028260900
which belongs to the cache kmalloc-192 of size 192
The buggy address is located 176 bytes inside of
freed 192-byte region [ffff888028260900, ffff8880282609c0)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x28260
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000000 ffff88813fea63c0 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0xd2c00(GFP_NOIO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 24, tgid 24 (kworker/1:0), ts 10584606067, free_ts 6626023302
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x231/0x280 mm/page_alloc.c:1889
prep_new_page mm/page_alloc.c:1897 [inline]
get_page_from_freelist+0x24dc/0x2580 mm/page_alloc.c:3962
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5250
alloc_slab_page mm/slub.c:3292 [inline]
allocate_slab+0x77/0x660 mm/slub.c:3481
new_slab mm/slub.c:3539 [inline]
refill_objects+0x331/0x3c0 mm/slub.c:7175
refill_sheaf mm/slub.c:2812 [inline]
__pcs_replace_empty_main+0x2e6/0x730 mm/slub.c:4615
alloc_from_pcs mm/slub.c:4717 [inline]
slab_alloc_node mm/slub.c:4851 [inline]
__do_kmalloc_node mm/slub.c:5259 [inline]
__kmalloc_noprof+0x474/0x760 mm/slub.c:5272
kmalloc_noprof include/linux/slab.h:954 [inline]
usb_alloc_urb+0x46/0x150 drivers/usb/core/urb.c:75
usb_internal_control_msg drivers/usb/core/message.c:110 [inline]
usb_control_msg+0x118/0x3e0 drivers/usb/core/message.c:167
get_port_status drivers/usb/core/hub.c:607 [inline]
hub_ext_port_status+0x116/0x820 drivers/usb/core/hub.c:624
usb_hub_port_status drivers/usb/core/hub.c:674 [inline]
hub_activate+0x6eb/0x1a80 drivers/usb/core/hub.c:1185
process_one_work kernel/workqueue.c:3276 [inline]
process_scheduled_works+0xb6e/0x18c0 kernel/workqueue.c:3359
worker_thread+0xa53/0xfc0 kernel/workqueue.c:3440
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
page last free pid 24 tgid 24 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1433 [inline]
__free_frozen_pages+0xc2b/0xdb0 mm/page_alloc.c:2978
vfree+0x25a/0x400 mm/vmalloc.c:3479
delayed_vfree_work+0x55/0x80 mm/vmalloc.c:3398
process_one_work kernel/workqueue.c:3276 [inline]
process_scheduled_works+0xb6e/0x18c0 kernel/workqueue.c:3359
worker_thread+0xa53/0xfc0 kernel/workqueue.c:3440
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Memory state around the buggy address:
ffff888028260880: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff888028260900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888028260980: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
^
ffff888028260a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888028260a80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
==================================================================
Tested on:
commit: 3aae9383 Merge tag 'input-for-v7.0-rc6' of git://git.k..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11424e06580000
kernel config: https://syzkaller.appspot.com/x/.config?x=6754c86e8d9e4c91
dashboard link: https://syzkaller.appspot.com/bug?extid=9b95da55ba5146a60734
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=108bc1ca580000
next parent reply other threads:[~2026-04-05 2:37 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <20260405021945.371546-1-kartikey406@gmail.com>
2026-04-05 2:37 ` syzbot [this message]
[not found] <20260405051753.375869-1-kartikey406@gmail.com>
2026-04-05 5:36 ` [syzbot] [kernel?] INFO: rcu detected stall in kill syzbot
[not found] <20260405044137.374636-1-kartikey406@gmail.com>
2026-04-05 5:00 ` syzbot
[not found] <20260405012053.369470-1-kartikey406@gmail.com>
2026-04-05 1:39 ` syzbot
2026-04-03 17:50 syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=69d1cacd.050a0220.2dbe29.0023.GAE@google.com \
--to=syzbot+9b95da55ba5146a60734@syzkaller.appspotmail.com \
--cc=kartikey406@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox