Re: [syzbot] [kernel?] KASAN: slab-use-after-free Read in __release_resource

[syzbot <syzbot+ee1062851b628d722093@syzkaller.appspotmail.com>]

> On 1 August 2026 02:02:24 BST, syzbot
> <syzbot+ee1062851b628d722093@syzkaller.appspotmail.com> wrote:
>>> #syz test: From 9cd23575828ada0a338a2dd0019e97476c4f5d23 Mon Sep 17
>>
>>I've failed to parse your command.
>>Did you perhaps forget to provide the branch name, or added an extra ':'?
>>Please use one of the two supported formats:
>>1. #syz test
>>2. #syz test: repo branch-or-commit-hash
>>Note the lack of ':' in option 1.
>>
>>> 00:00:00 2001
>>> From: Bradley Morgan <include@grrlz.net>
>>> Date: Sat, 1 Aug 2026 00:58:20 +0000
>>> Subject: [PATCH] driver core: platform: use remove_resource() to
>>properly reparent children
>>>
>>> platform_device_add() inserts resources into the global iomem/ioport
>>> trees via insert_resource(), which may reparent existing resources as
>>> children of the newly inserted one.
>>>
>>> The teardown paths in platform_device_add() (error path) and
>>> platform_device_del() use release_resource() to remove these
>>> resources.  However, release_resource() calls __release_resource()
>>> with release_child=true, which simply unlinks the resource from its
>>> parent's child list without reparenting its children.  Any child
>>> resources that were moved under it by insert_resource() are left
>>> with dangling ->parent pointers.
>>>
>>> When the platform device's kmemdup'd resource array is subsequently
>>> freed by platform_device_release(), those children (e.g. a PCI BAR
>>> resource that was reparented under the platform device's resource)
>>> end up with ->parent pointing to freed memory.  A later
>>> release_resource() on such a child dereferences the stale pointer in
>>> __release_resource(), causing a slab-use-after-free.
>>>
>>> Fix it by using remove_resource() instead, which is the proper
>>> counterpart to insert_resource().  remove_resource() calls
>>> __release_resource() with release_child=false, which reparents
>>> children up to the removed resource's parent before unlinking it,
>>> keeping all ->parent pointers valid.
>>>
>>> Reported-by: syzbot+ee1062851b628d722093@syzkaller.appspotmail.com
>>> Closes:
>>https://lore.kernel.org/all/6a6d39e7.f794c993.27aeb.0009.GAE@google.com/
>>> Assisted-by: GLM:glm-5.2
>>> Signed-off-by: Bradley Morgan <include@grrlz.net>
>>> ---
>>>  drivers/base/platform.c | 4 ++--
>>>  1 file changed, 2 insertions(+), 2 deletions(-)
>>>
>>> diff --git a/drivers/base/platform.c b/drivers/base/platform.c
>>> index a71015f1d915..9a6932d50ee5 100644
>>> --- a/drivers/base/platform.c
>>> +++ b/drivers/base/platform.c
>>> @@ -830,7 +830,7 @@ int platform_device_add(struct platform_device
>>*pdev)
>>>         while (i--) {
>>>                 struct resource *r = &pdev->resource[i];
>>>                 if (r->parent)
>>> -                       release_resource(r);
>>> +                       remove_resource(r);
>>>         }
>>>
>>>         return ret;
>>> @@ -860,7 +860,7 @@ void platform_device_del(struct platform_device
>>*pdev)
>>>                 for (i = 0; i < pdev->num_resources; i++) {
>>>                         struct resource *r = &pdev->resource[i];
>>>                         if (r->parent)
>>> -                               release_resource(r);
>>> +                               remove_resource(r);
>>>                 }
>>>         }
>>>  }
>>> --
>>> 2.47.3
>>>
>>>
>>> Note: AI generated.
>>> Thanks!
>>
>
>
> #syz test

This crash does not have a reproducer. I cannot test it.

>
> diff --git a/drivers/base/platform.c b/drivers/base/platform.c
> --- a/drivers/base/platform.c
> +++ b/drivers/base/platform.c
> @@ -830,7 +830,7 @@ int platform_device_add(struct platform_device *pdev)
>         while (i--) {
>                 struct resource *r = &pdev->resource[i];
>                 if (r->parent)
> -                       release_resource(r);
> +                       remove_resource(r);
>         }
>
>         return ret;
> @@ -860,7 +860,7 @@ void platform_device_del(struct platform_device *pdev)
>                 for (i = 0; i < pdev->num_resources; i++) {
>                         struct resource *r = &pdev->resource[i];
>                         if (r->parent)
> -                               release_resource(r);
> +                               remove_resource(r);
>                 }
>         }
>  }
>
>
> this better work. for goodness sake.... :(
>
> Thanks!