From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-oo1-f78.google.com (mail-oo1-f78.google.com [209.85.161.78]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8F7CB39182F for ; Tue, 5 May 2026 15:21:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.161.78 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777994513; cv=none; b=VlSCSlJjNGW1ysje+RGPWWuBGDP5BHi0NV8YqknssCGR+IrFgT44tfg2ZxFwhRBQXrPKA6XR9IE+lD2nWsTFa2Jwy0StkmJC1gXWk394cIm+McFJiuNoz6o0AdCIin14kXLOFDyqx5Ueu9GlCGOtb5W6nnv21Iwp9Vr2FDQeYLE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777994513; c=relaxed/simple; bh=NMJ7ZSomgNnjAqqhC1GXSgo6tRZcoZHkHcTuxrZSyiI=; h=MIME-Version:Date:In-Reply-To:Message-ID:Subject:From:To: Content-Type; b=EGWZmNn8ihc0RE4XEhN3XEQy9gzG1WkZFrDIbJpOMPg0hnnU8bCosgq32KaY5j4LFTjnN4/3Ybj8M8B1sBJIEMjB4BO0zZzKDKRpQgJ8k+79NmNvv5aelwJaP5at0LVFT60p6CZkUFkcQvsUcFHMkFcHjr8dFuErTSSl4752Xyw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.161.78 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-oo1-f78.google.com with SMTP id 006d021491bc7-6948d83a5c0so14220839eaf.1 for ; Tue, 05 May 2026 08:21:51 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1777994510; x=1778599310; h=to:from:subject:message-id:in-reply-to:date:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=UdgD6/z9dlwTnNNkH8JRB6hodApry+Lqam5+1kmiBRU=; b=BjKkZm5ywE1NMCPN8NMSF8FzlFBDUvYZVKr1rotFoYkHpoMarKRDthUR8ecl1fp6/o O1FoiblJfY/NGrKEaTCOdgE4cqMOQghLe51300jB+3mw87axl1L8tRwHdb40N17SyMET 7qqNUXQasyRykXphEthYRFepHf66Tz6aZPM0ES9xnU5UUckgEkAB4xdSfug2FSnBOESB sjVC04qNAYWu2qK0bdGqpYDyjawF8Bzp5gSMEC8tySdKkqIdIn8m0xQzj6WU2GQgzriN fEuWwCmwxEEtbeMcghZ54ALFbf2fhcSzMux3y4MxeXT4/bB4QKGlGHw7gSwW4ZBQBt1F 78+A== X-Gm-Message-State: AOJu0YzbjaS156ChhY6l4WVBgJmQcrZ+70xyLNfG8OpArnS+qk/mad3V CYyI/WT+VQrzS4AqP7MUTUWwvMKC2P35TPhB1tpcvFbakkc6SaHAxDR1AoSvANIeYfYKobWhJQn z48SWMSmYOUObIzG8nwZxjw7kAx57Gjz6a2eHYZcDs5AnCNA7Jxt64P2IbrwU7w== Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a05:6820:629:b0:696:757d:1942 with SMTP id 006d021491bc7-69697c60c82mr6555903eaf.32.1777994510606; Tue, 05 May 2026 08:21:50 -0700 (PDT) Date: Tue, 05 May 2026 08:21:50 -0700 In-Reply-To: <00000000000034ae0f05e9f94c79@google.com> X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <69fa0b0e.170a0220.59368.0014.GAE@google.com> Subject: Forwarded: Private message regarding: Forwarded: Private message regarding: [syzbot] [jfs?] KASAN: use-after-free Read in jfs_lazycommit From: syzbot To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Content-Type: text/plain; charset="UTF-8" For archival purposes, forwarding an incoming command email to linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com. *** Subject: Private message regarding: Forwarded: Private message regarding: [syzbot] [jfs?] KASAN: use-after-free Read in jfs_lazycommit Author: kapoorarnav43@gmail.com #syz fix >From 7e1a0b91e9efa8bec40fc5397ba6c4e683d72df0 Mon Sep 17 00:00:00 2001 From: ArnavKapoor Date: Tue, 5 May 2026 20:22:56 +0530 Subject: [PATCH] jfs: Fix use-after-free in lbmIODone during log shutdown Fix a race condition where lbmIODone() can access freed memory from lbuf structures that have been deallocated by lbmLogShutdown() before pending I/O operations complete. The issue occurs when: 1. I/O operations are submitted with lbuf as bio private data 2. During filesystem unmount, lbmLogShutdown() is called which frees all lbuf structures 3. But the bio completion callback lbmIODone() is still pending 4. When lbmIODone() executes, it accesses the freed lbuf causing use-after-free Solution: - Add atomic counter to track pending I/O operations - Add wait queue to wait for pending I/O to complete - Increment counter in lbmStartIO() before submitting bio - Decrement counter in lbmIODone() after I/O completes - In lbmLogShutdown(), wait for all pending I/O to complete before freeing This prevents the use-after-free by ensuring all pending I/O operations complete before the lbuf structures are deallocated. Link: https://syzkaller.appspot.com/bug?extid=885a4f3281b8d99c48d8 Signed-off-by: ArnavKapoor --- fs/jfs/jfs_logmgr.c | 15 ++++++++++++++- fs/jfs/jfs_logmgr.h | 2 ++ 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c index 306165e61..eaeeaaa0c 100644 --- a/fs/jfs/jfs_logmgr.c +++ b/fs/jfs/jfs_logmgr.c @@ -1804,6 +1804,8 @@ static int lbmLogInit(struct jfs_log * log) * avoid deadlock here. */ init_waitqueue_head(&log->free_wait); + init_waitqueue_head(&log->ios_wait); + atomic_set(&log->ios_pending, 0); log->lbuf_free = NULL; @@ -1855,6 +1857,9 @@ static void lbmLogShutdown(struct jfs_log * log) jfs_info("lbmLogShutdown: log:0x%p", log); + /* Wait for all pending I/O operations to complete */ + wait_event(&log->ios_wait, atomic_read(&log->ios_pending) == 0); + lbuf = log->lbuf_free; while (lbuf) { struct lbuf *next = lbuf->l_freelist; @@ -2123,6 +2128,9 @@ static void lbmStartIO(struct lbuf * bp) bio->bi_end_io = lbmIODone; bio->bi_private = bp; + /* Increment pending I/O counter before submitting */ + atomic_inc(&log->ios_pending); + /* check if journaling to disk has been disabled */ if (log->no_integrity) { bio->bi_iter.bi_size = 0; @@ -2167,8 +2175,8 @@ static int lbmIOWait(struct lbuf * bp, int flag) static void lbmIODone(struct bio *bio) { struct lbuf *bp = bio->bi_private; + struct jfs_log *log = bp->l_log; struct lbuf *nextbp, *tail; - struct jfs_log *log; unsigned long flags; /* @@ -2298,6 +2306,11 @@ static void lbmIODone(struct bio *bio) out: bp->l_flag |= lbmDONE; + + /* Decrement pending I/O counter and wake up if waiting */ + if (atomic_dec_and_test(&log->ios_pending)) + wake_up(&log->ios_wait); + LCACHE_UNLOCK(flags); } diff --git a/fs/jfs/jfs_logmgr.h b/fs/jfs/jfs_logmgr.h index 09e0ef6ae..b89b198d4 100644 --- a/fs/jfs/jfs_logmgr.h +++ b/fs/jfs/jfs_logmgr.h @@ -400,6 +400,8 @@ struct jfs_log { uuid_t uuid; /* 16: 128-bit uuid of log device */ int no_integrity; /* 3: flag to disable journaling to disk */ + atomic_t ios_pending; /* 4: count of pending I/O operations */ + wait_queue_head_t ios_wait; /* 4: wait queue for I/O completion */ }; /* -- 2.43.0 On Tuesday, 5 May 2026 at 20:47:39 UTC+5:30 syzbot wrote: For archival purposes, forwarding an incoming command email to linux-...@vger.kernel.org, syzkall...@googlegroups.com. *** Subject: Private message regarding: [syzbot] [jfs?] KASAN: use-after-free Read in jfs_lazycommit Author: kapoor...@gmail.com #syz fix >From 7e1a0b91e9efa8bec40fc5397ba6c4e683d72df0 Mon Sep 17 00:00:00 2001 From: ArnavKapoor Date: Tue, 5 May 2026 20:22:56 +0530 Subject: [PATCH] jfs: Fix use-after-free in lbmIODone during log shutdown Fix a race condition where lbmIODone() can access freed memory from lbuf structures that have been deallocated by lbmLogShutdown() before pending I/O operations complete. The issue occurs when: 1. I/O operations are submitted with lbuf as bio private data 2. During filesystem unmount, lbmLogShutdown() is called which frees all lbuf structures 3. But the bio completion callback lbmIODone() is still pending 4. When lbmIODone() executes, it accesses the freed lbuf causing use-after-free Solution: - Add atomic counter to track pending I/O operations - Add wait queue to wait for pending I/O to complete - Increment counter in lbmStartIO() before submitting bio - Decrement counter in lbmIODone() after I/O completes - In lbmLogShutdown(), wait for all pending I/O to complete before freeing This prevents the use-after-free by ensuring all pending I/O operations complete before the lbuf structures are deallocated. Link: https://syzkaller.appspot.com/bug?extid=885a4f3281b8d99c48d8 Signed-off-by: ArnavKapoor --- fs/jfs/jfs_logmgr.c | 15 ++++++++++++++- fs/jfs/jfs_logmgr.h | 2 ++ 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c index 306165e61..eaeeaaa0c 100644 --- a/fs/jfs/jfs_logmgr.c +++ b/fs/jfs/jfs_logmgr.c @@ -1804,6 +1804,8 @@ static int lbmLogInit(struct jfs_log * log) * avoid deadlock here. */ init_waitqueue_head(&log->free_wait); + init_waitqueue_head(&log->ios_wait); + atomic_set(&log->ios_pending, 0); log->lbuf_free = NULL; @@ -1855,6 +1857,9 @@ static void lbmLogShutdown(struct jfs_log * log) jfs_info("lbmLogShutdown: log:0x%p", log); + /* Wait for all pending I/O operations to complete */ + wait_event(&log->ios_wait, atomic_read(&log->ios_pending) == 0); + lbuf = log->lbuf_free; while (lbuf) { struct lbuf *next = lbuf->l_freelist; @@ -2123,6 +2128,9 @@ static void lbmStartIO(struct lbuf * bp) bio->bi_end_io = lbmIODone; bio->bi_private = bp; + /* Increment pending I/O counter before submitting */ + atomic_inc(&log->ios_pending); + /* check if journaling to disk has been disabled */ if (log->no_integrity) { bio->bi_iter.bi_size = 0; @@ -2167,8 +2175,8 @@ static int lbmIOWait(struct lbuf * bp, int flag) static void lbmIODone(struct bio *bio) { struct lbuf *bp = bio->bi_private; + struct jfs_log *log = bp->l_log; struct lbuf *nextbp, *tail; - struct jfs_log *log; unsigned long flags; /* @@ -2298,6 +2306,11 @@ static void lbmIODone(struct bio *bio) out: bp->l_flag |= lbmDONE; + + /* Decrement pending I/O counter and wake up if waiting */ + if (atomic_dec_and_test(&log->ios_pending)) + wake_up(&log->ios_wait); + LCACHE_UNLOCK(flags); } diff --git a/fs/jfs/jfs_logmgr.h b/fs/jfs/jfs_logmgr.h index 09e0ef6ae..b89b198d4 100644 --- a/fs/jfs/jfs_logmgr.h +++ b/fs/jfs/jfs_logmgr.h @@ -400,6 +400,8 @@ struct jfs_log { uuid_t uuid; /* 16: 128-bit uuid of log device */ int no_integrity; /* 3: flag to disable journaling to disk */ + atomic_t ios_pending; /* 4: count of pending I/O operations */ + wait_queue_head_t ios_wait; /* 4: wait queue for I/O completion */ }; /* -- 2.43.0 On Tuesday, 5 May 2026 at 18:56:07 UTC+5:30 syzbot wrote: Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: KASAN: slab-use-after-free Read in blk_update_request ================================================================== BUG: KASAN: slab-use-after-free in __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:132 [inline] BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0x40/0x60 kernel/locking/spinlock.c:166 Read of size 1 at addr ffff88802a964100 by task kworker/u8:7/165 CPU: 0 UID: 0 PID: 165 Comm: kworker/u8:7 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 Workqueue: netns cleanup_net Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description+0x55/0x1e0 mm/kasan/report.c:378 print_report+0x58/0x70 mm/kasan/report.c:482 kasan_report+0x117/0x150 mm/kasan/report.c:595 __kasan_check_byte+0x2a/0x40 mm/kasan/common.c:574 kasan_check_byte include/linux/kasan.h:402 [inline] lock_acquire+0x84/0x350 kernel/locking/lockdep.c:5842 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:132 [inline] _raw_spin_lock_irqsave+0x40/0x60 kernel/locking/spinlock.c:166 rtlock_slowlock kernel/locking/rtmutex.c:1913 [inline] rtlock_lock kernel/locking/spinlock_rt.c:43 [inline] __rt_spin_lock kernel/locking/spinlock_rt.c:49 [inline] rt_spin_lock+0x157/0x400 kernel/locking/spinlock_rt.c:57 spin_lock include/linux/spinlock_rt.h:45 [inline] __wake_up_common_lock+0x2f/0x1e0 kernel/sched/wait.c:124 blk_update_request+0x57e/0xe60 block/blk-mq.c:1016 blk_mq_end_request+0x3e/0x70 block/blk-mq.c:1178 blk_complete_reqs block/blk-mq.c:1253 [inline] blk_done_softirq+0x10a/0x160 block/blk-mq.c:1258 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] __local_bh_enable_ip+0x170/0x2b0 kernel/softirq.c:302 local_bh_enable include/linux/bottom_half.h:33 [inline] spin_unlock_bh include/linux/spinlock_rt.h:116 [inline] __fib6_clean_all+0x4d1/0x610 net/ipv6/ip6_fib.c:2325 rt6_sync_down_dev net/ipv6/route.c:5018 [inline] rt6_disable_ip+0x11f/0x750 net/ipv6/route.c:5023 addrconf_ifdown+0x157/0x1aa0 net/ipv6/addrconf.c:3865 addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1 notifier_call_chain+0x1ad/0x3d0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2287 [inline] call_netdevice_notifiers net/core/dev.c:2301 [inline] netif_close_many+0x2ae/0x420 net/core/dev.c:1805 unregister_netdevice_many_notify+0xb50/0x22b0 net/core/dev.c:12388 unregister_netdevice_many net/core/dev.c:12481 [inline] default_device_exit_batch+0x981/0xa00 net/core/dev.c:13073 ops_exit_list net/core/net_namespace.c:205 [inline] ops_undo_list+0x52b/0x940 net/core/net_namespace.c:252 cleanup_net+0x56e/0x800 net/core/net_namespace.c:702 process_one_work kernel/workqueue.c:3302 [inline] process_scheduled_works+0xb5d/0x1860 kernel/workqueue.c:3385 worker_thread+0xa53/0xfc0 kernel/workqueue.c:3466 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Allocated by task 8907: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x3a6/0x690 mm/slub.c:5419 kmalloc_noprof include/linux/slab.h:950 [inline] kzalloc_noprof include/linux/slab.h:1188 [inline] open_inline_log fs/jfs/jfs_logmgr.c:1157 [inline] lmLogOpen+0x2d1/0xfa0 fs/jfs/jfs_logmgr.c:1067 jfs_mount_rw+0xee/0x670 fs/jfs/jfs_mount.c:257 jfs_fill_super+0x754/0xd80 fs/jfs/super.c:532 get_tree_bdev_flags+0x431/0x4f0 fs/super.c:1694 vfs_get_tree+0x92/0x2a0 fs/super.c:1754 fc_mount fs/namespace.c:1193 [inline] do_new_mount_fc fs/namespace.c:3758 [inline] do_new_mount+0x341/0xd30 fs/namespace.c:3834 do_mount fs/namespace.c:4167 [inline] __do_sys_mount fs/namespace.c:4383 [inline] __se_sys_mount+0x31d/0x420 fs/namespace.c:4360 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 8892: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2689 [inline] slab_free mm/slub.c:6250 [inline] kfree+0x1c5/0x6c0 mm/slub.c:6565 lmLogClose+0x297/0x520 fs/jfs/jfs_logmgr.c:-1 jfs_umount+0x304/0x3e0 fs/jfs/jfs_umount.c:131 jfs_put_super+0x8c/0x190 fs/jfs/super.c:194 generic_shutdown_super+0x13d/0x2d0 fs/super.c:646 kill_block_super+0x44/0x90 fs/super.c:1725 deactivate_locked_super+0xbc/0x130 fs/super.c:476 cleanup_mnt+0x437/0x4d0 fs/namespace.c:1312 task_work_run+0x1d9/0x270 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:67 [inline] exit_to_user_mode_loop+0xed/0x480 kernel/entry/common.c:98 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:238 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline] do_syscall_64+0x33e/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff88802a964000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 256 bytes inside of freed 2048-byte region [ffff88802a964000, ffff88802a964800) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff88802a961000 pfn:0x2a960 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x80000000000240(workingset|head|node=0|zone=1) page_type: f5(slab) raw: 0080000000000240 ffff88801a010000 ffffea0000ebf410 ffffea0001007a10 raw: ffff88802a961000 0000000800080007 00000000f5000000 0000000000000000 head: 0080000000000240 ffff88801a010000 ffffea0000ebf410 ffffea0001007a10 head: ffff88802a961000 0000000800080007 00000000f5000000 0000000000000000 head: 0080000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 11357773279, free_ts 0 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x231/0x280 mm/page_alloc.c:1858 prep_new_page mm/page_alloc.c:1866 [inline] get_page_from_freelist+0x27c8/0x2840 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5226 alloc_slab_page mm/slub.c:3278 [inline] allocate_slab+0x77/0x660 mm/slub.c:3467 new_slab mm/slub.c:3525 [inline] refill_objects+0x33c/0x3d0 mm/slub.c:7255 refill_sheaf mm/slub.c:2816 [inline] __pcs_replace_empty_main+0x373/0x720 mm/slub.c:4651 alloc_from_pcs mm/slub.c:4749 [inline] slab_alloc_node mm/slub.c:4883 [inline] __kmalloc_cache_noprof+0x44e/0x690 mm/slub.c:5414 kmalloc_noprof include/linux/slab.h:950 [inline] kzalloc_noprof include/linux/slab.h:1188 [inline] hub_probe+0x571/0x3c30 drivers/usb/core/hub.c:1961 usb_probe_interface+0x659/0xc70 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x267/0xaf0 drivers/base/dd.c:709 __driver_probe_device+0x1ef/0x380 drivers/base/dd.c:871 driver_probe_device+0x4f/0x240 drivers/base/dd.c:901 __device_attach_driver+0x279/0x430 drivers/base/dd.c:1029 bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c8/0x450 drivers/base/dd.c:1101 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1156 page_owner free stack trace missing Memory state around the buggy address: ffff88802a964000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88802a964080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88802a964100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88802a964180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88802a964200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Tested on: commit: a293ec25 Merge tag 'linux_kselftest-fixes-7.1-rc3' of .. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=146a4ad2580000 kernel config: https://syzkaller.appspot.com/x/.config?x=f2e8ebfec4636d32 dashboard link: https://syzkaller.appspot.com/bug?extid=885a4f3281b8d99c48d8 compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8 patch: https://syzkaller.appspot.com/x/patch.diff?x=171e59ce580000