* [syzbot] [fs?] KASAN: slab-use-after-free Read in lookup_noperm_common
@ 2026-07-30 1:43 syzbot
2026-07-30 7:49 ` Hillf Danton
2026-08-01 0:00 ` syzbot
0 siblings, 2 replies; 6+ messages in thread
From: syzbot @ 2026-07-30 1:43 UTC (permalink / raw)
To: dakr, driver-core, gregkh, linux-fsdevel, linux-kernel, rafael,
syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: cc2b5f627e8c Add linux-next specific files for 20260714
git tree: linux-next
console output: https://syzkaller.appspot.com/x/log.txt?x=13a8649e580000
kernel config: https://syzkaller.appspot.com/x/.config?x=2290ccbf984c524f
dashboard link: https://syzkaller.appspot.com/bug?extid=23ad911c819b923238b7
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=141917b1580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/6836f8efb1da/disk-cc2b5f62.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/0109d3477cc7/vmlinux-cc2b5f62.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c2e49e350bbf/bzImage-cc2b5f62.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+23ad911c819b923238b7@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: slab-use-after-free in lookup_noperm_common+0x407/0x430 fs/namei.c:3106
Read of size 4 at addr ffff88803ef87810 by task syz.0.61/6090
CPU: 0 UID: 0 PID: 6090 Comm: syz.0.61 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
lookup_noperm_common+0x407/0x430 fs/namei.c:3106
simple_start_creating+0x9c/0x110 fs/libfs.c:2302
debugfs_start_creating+0xdb/0x1a0 fs/debugfs/inode.c:394
debugfs_create_dir+0x24/0x350 fs/debugfs/inode.c:572
i2c_device_probe+0x814/0xbf0 drivers/i2c/i2c-core-base.c:588
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x254/0xae0 drivers/base/dd.c:706
__driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
__device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c7/0x450 drivers/base/dd.c:1098
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
bus_probe_device+0x12d/0x220 drivers/base/bus.c:620
device_add+0x7d7/0xb80 drivers/base/core.c:3772
i2c_new_client_device+0xa29/0x1130 drivers/i2c/i2c-core-base.c:1019
new_device_store+0x24b/0x530 drivers/i2c/i2c-core-base.c:1307
kernfs_fop_write_iter+0x3a5/0x540 fs/kernfs/file.c:345
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61e/0xbb0 fs/read_write.c:687
ksys_write+0x156/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x17b/0x530 arch/x86/entry/syscall_64.c:85
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f386433de99
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f386399e028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f38645c5fa0 RCX: 00007f386433de99
RDX: 0000000000000011 RSI: 0000200000000a00 RDI: 0000000000000004
RBP: 00007f38643d3eaf R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f38645c6038 R14: 00007f38645c5fa0 R15: 00007ffcb9098ee8
</TASK>
Allocated by task 4981:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
unpoison_slab_object mm/kasan/common.c:340 [inline]
__kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4608 [inline]
slab_alloc_node mm/slub.c:4921 [inline]
kmem_cache_alloc_lru_noprof+0x355/0x670 mm/slub.c:4954
__d_alloc+0x37/0x6f0 fs/dcache.c:1902
d_alloc+0x4b/0x190 fs/dcache.c:1981
lookup_one_qstr_excl+0xd8/0x360 fs/namei.c:1806
__start_dirop fs/namei.c:2920 [inline]
start_dirop+0x5c/0x90 fs/namei.c:2942
simple_start_creating+0xcc/0x110 fs/libfs.c:2305
debugfs_start_creating+0xdb/0x1a0 fs/debugfs/inode.c:394
debugfs_create_dir+0x24/0x350 fs/debugfs/inode.c:572
i2c_register_adapter+0xc14/0x1400 drivers/i2c/i2c-core-base.c:1609
i2c_tiny_usb_probe+0x461/0x5d0 drivers/i2c/busses/i2c-tiny-usb.c:265
usb_probe_interface+0x788/0xe50 drivers/usb/core/driver.c:399
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x254/0xae0 drivers/base/dd.c:706
__driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
__device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c7/0x450 drivers/base/dd.c:1098
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
bus_probe_device+0x12d/0x220 drivers/base/bus.c:620
device_add+0x7d7/0xb80 drivers/base/core.c:3772
usb_set_configuration+0x1ad8/0x2180 drivers/usb/core/message.c:2268
usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:293
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x254/0xae0 drivers/base/dd.c:706
__driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
__device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c7/0x450 drivers/base/dd.c:1098
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
bus_probe_device+0x12d/0x220 drivers/base/bus.c:620
device_add+0x7d7/0xb80 drivers/base/core.c:3772
usb_new_device+0x98d/0x1610 drivers/usb/core/hub.c:2695
hub_port_connect drivers/usb/core/hub.c:5567 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
port_event drivers/usb/core/hub.c:5871 [inline]
hub_event+0x28cf/0x4cf0 drivers/usb/core/hub.c:5953
process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
process_scheduled_works kernel/workqueue.c:3462 [inline]
worker_thread+0xb05/0x10d0 kernel/workqueue.c:3543
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Freed by task 21:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2706 [inline]
slab_free mm/slub.c:6388 [inline]
kmem_cache_free+0x187/0x6c0 mm/slub.c:6515
rcu_do_batch kernel/rcu/tree.c:2645 [inline]
rcu_core kernel/rcu/tree.c:2897 [inline]
rcu_cpu_kthread+0x950/0x1480 kernel/rcu/tree.c:2985
smpboot_thread_fn+0x57c/0xa80 kernel/smpboot.c:160
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Last potentially related work creation:
kasan_save_stack+0x3e/0x60 mm/kasan/common.c:57
kasan_record_aux_stack+0xbd/0xd0 mm/kasan/generic.c:556
__call_rcu_common kernel/rcu/tree.c:3159 [inline]
call_rcu+0xee/0x8b0 kernel/rcu/tree.c:3279
dentry_kill+0x4d3/0x880 fs/dcache.c:845
finish_dput+0x1a/0x260 fs/dcache.c:1001
debugfs_remove+0x5b/0x70 fs/debugfs/inode.c:781
i2c_del_adapter+0x229/0x430 drivers/i2c/i2c-core-base.c:1829
i2c_tiny_usb_disconnect+0x49/0xd0 drivers/i2c/busses/i2c-tiny-usb.c:282
usb_unbind_interface+0x295/0x9f0 drivers/usb/core/driver.c:461
device_remove drivers/base/dd.c:618 [inline]
__device_release_driver drivers/base/dd.c:1349 [inline]
device_release_driver_internal+0x4f5/0x880 drivers/base/dd.c:1372
bus_remove_device+0x449/0x560 drivers/base/bus.c:664
device_del+0x528/0x8f0 drivers/base/core.c:3961
usb_disable_device+0x3d4/0x8d0 drivers/usb/core/message.c:1478
usb_disconnect+0x32d/0x990 drivers/usb/core/hub.c:2345
hub_port_connect drivers/usb/core/hub.c:5407 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
port_event drivers/usb/core/hub.c:5871 [inline]
hub_event+0x1bb7/0x4cf0 drivers/usb/core/hub.c:5953
process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
process_scheduled_works kernel/workqueue.c:3462 [inline]
worker_thread+0xb3c/0x10d0 kernel/workqueue.c:3543
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
The buggy address belongs to the object at ffff88803ef87810
which belongs to the cache dentry of size 376
The buggy address is located 0 bytes inside of
freed 376-byte region [ffff88803ef87810, ffff88803ef87988)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3ef86
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x80000000000040(head|node=0|zone=1)
page_type: f5(slab)
raw: 0080000000000040 ffff88801c6af500 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800120012 00000000f5000000 0000000000000000
head: 0080000000000040 ffff88801c6af500 dead000000000100 dead000000000122
head: 0000000000000000 0000000800120012 00000000f5000000 0000000000000000
head: 0080000000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff
head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Reclaimable, gfp_mask 0xd20d0(__GFP_RECLAIMABLE|__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4972, tgid 4972 (udevd), ts 53075199244
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1871
prep_new_page mm/page_alloc.c:1879 [inline]
get_page_from_freelist+0x264c/0x26c0 mm/page_alloc.c:3955
__alloc_frozen_pages_noprof+0x222/0x5b0 mm/page_alloc.c:5394
alloc_slab_page mm/slub.c:3295 [inline]
allocate_slab+0x7c/0x5e0 mm/slub.c:3410
new_slab mm/slub.c:3456 [inline]
refill_objects+0x2d8/0x350 mm/slub.c:7321
refill_sheaf mm/slub.c:2833 [inline]
__pcs_replace_empty_main+0x330/0x690 mm/slub.c:4699
alloc_from_pcs mm/slub.c:4775 [inline]
slab_alloc_node mm/slub.c:4909 [inline]
kmem_cache_alloc_lru_noprof+0x44d/0x670 mm/slub.c:4954
__d_alloc+0x37/0x6f0 fs/dcache.c:1902
d_alloc_parallel+0xde/0x16c0 fs/dcache.c:2761
lookup_open fs/namei.c:4418 [inline]
open_last_lookups fs/namei.c:4602 [inline]
path_openat+0xbf0/0x3850 fs/namei.c:4854
do_file_open+0x23e/0x4a0 fs/namei.c:4886
do_sys_openat2+0x115/0x200 fs/open.c:1368
do_sys_open fs/open.c:1374 [inline]
__do_sys_openat fs/open.c:1390 [inline]
__se_sys_openat fs/open.c:1385 [inline]
__x64_sys_openat+0x138/0x170 fs/open.c:1385
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x17b/0x530 arch/x86/entry/syscall_64.c:85
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page_owner free stack trace missing
Memory state around the buggy address:
ffff88803ef87700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88803ef87780: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc
>ffff88803ef87800: fc fc fa fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88803ef87880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88803ef87900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [syzbot] [fs?] KASAN: slab-use-after-free Read in lookup_noperm_common
2026-07-30 1:43 syzbot
@ 2026-07-30 7:49 ` Hillf Danton
2026-07-30 9:33 ` syzbot
2026-08-01 0:00 ` syzbot
1 sibling, 1 reply; 6+ messages in thread
From: Hillf Danton @ 2026-07-30 7:49 UTC (permalink / raw)
To: syzbot; +Cc: linux-kernel, syzkaller-bugs
> Date: Wed, 29 Jul 2026 18:43:20 -0700 [thread overview]
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: cc2b5f627e8c Add linux-next specific files for 20260714
> git tree: linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=13a8649e580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=2290ccbf984c524f
> dashboard link: https://syzkaller.appspot.com/bug?extid=23ad911c819b923238b7
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=141917b1580000
#syz test
--- x/drivers/i2c/i2c-core-base.c
+++ y/drivers/i2c/i2c-core-base.c
@@ -1826,8 +1826,6 @@ void i2c_del_adapter(struct i2c_adapter
i2c_host_notify_irq_teardown(adap);
- debugfs_remove_recursive(adap->debugfs);
-
/* wait until all references to the device are gone
*
* FIXME: This is old code and should ideally be replaced by an
@@ -1844,6 +1842,8 @@ void i2c_del_adapter(struct i2c_adapter
idr_remove(&i2c_adapter_idr, adap->nr);
mutex_unlock(&core_lock);
+ debugfs_remove_recursive(adap->debugfs);
+
/* Clear the device structure in case this adapter is ever going to be
added again */
memset(&adap->dev, 0, sizeof(adap->dev));
--
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [syzbot] [fs?] KASAN: slab-use-after-free Read in lookup_noperm_common
2026-07-30 7:49 ` Hillf Danton
@ 2026-07-30 9:33 ` syzbot
0 siblings, 0 replies; 6+ messages in thread
From: syzbot @ 2026-07-30 9:33 UTC (permalink / raw)
To: hdanton, linux-kernel, syzkaller-bugs
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
[ 5.732350][ T1] PCI-DMA: Using software bounce buffering for IO (SWIOTLB)
[ 5.732431][ T1] software IO TLB: mapped [mem 0x00000000b4600000-0x00000000b8600000] (64MB)
[ 5.752193][ T1] ACPI: bus type thunderbolt registered
[ 5.772890][ T1] RAPL PMU: API unit is 2^-32 Joules, 0 fixed counters, 10737418240 ms ovfl timer
[ 5.790038][ T69] kworker/u8:4 (69) used greatest stack depth: 28424 bytes left
[ 5.791790][ T70] kworker/u8:4 (70) used greatest stack depth: 26568 bytes left
[ 5.839556][ T1] kvm_amd: CPU 1 isn't AMD or Hygon
[ 5.839594][ T1] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x1fb63109b96, max_idle_ns: 440795265316 ns
[ 5.840420][ T1] clocksource: Switched to clocksource tsc
[ 5.951079][ T1] Initialise system trusted keyrings
[ 5.957064][ T1] workingset: timestamp_bits=40 (anon: 35) max_order=21 bucket_order=0 (anon: 0)
[ 5.982234][ T1] DLM installed
[ 5.994295][ T1] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 6.015885][ T1] NFS: Registering the id_resolver key type
[ 6.016165][ T1] Key type id_resolver registered
[ 6.016181][ T1] Key type id_legacy registered
[ 6.016602][ T1] nfs4filelayout_init: NFSv4 File Layout Driver Registering...
[ 6.016835][ T1] nfs4flexfilelayout_init: NFSv4 Flexfile Layout Driver Registering...
[ 6.022936][ T1] smbdirect: subsystem loading...
[ 6.074501][ T1] smbdirect: subsystem loaded
[ 6.115421][ T1] Key type cifs.spnego registered
[ 6.115810][ T1] Key type cifs.idmap registered
[ 6.122543][ T1] ntfs3: Enabled Linux POSIX ACLs support
[ 6.122558][ T1] ntfs3: Read-only LZX/Xpress compression included
[ 6.123157][ T1] jffs2: version 2.2. (NAND) (SUMMARY) © 2001-2006 Red Hat, Inc.
[ 6.133153][ T1] romfs: ROMFS MTD (C) 2007 Red Hat, Inc.
[ 6.135119][ T1] QNX4 filesystem 0.2.3 registered.
[ 6.137491][ T1] qnx6: QNX6 filesystem 1.0.0 registered.
[ 6.145880][ T1] fuse: init (API version 7.45)
[ 6.171786][ T1] orangefs_debugfs_init: called with debug mask: :none: :0:
[ 6.178859][ T1] orangefs_init: module version upstream loaded
[ 6.183145][ T1] JFS: nTxBlock = 8192, nTxLock = 65536
[ 6.222021][ T1] SGI XFS with ACLs, security attributes, realtime, scrub, repair, quota, no debug enabled
[ 6.240797][ T1] 9p: Installing v9fs 9p2000 file system support
[ 6.241949][ T1] NILFS version 2 loaded
[ 6.241962][ T1] befs: version: 0.9.3
[ 6.243535][ T1] ocfs2: Registered cluster interface o2cb
[ 6.248029][ T1] ocfs2: Registered cluster interface user
[ 6.257098][ T1] OCFS2 User DLM kernel interface loaded
[ 6.315750][ T1] gfs2: GFS2 installed
[ 6.341989][ T1] ceph: loaded (mds proto 32)
[ 6.361174][ T1] NET: Registered PF_ALG protocol family
[ 6.361720][ T1] async_tx: api initialized (async)
[ 6.361785][ T1] Key type asymmetric registered
[ 6.361874][ T1] Asymmetric key parser 'x509' registered
[ 6.361891][ T1] Asymmetric key parser 'pkcs8' registered
[ 6.361907][ T1] Key type pkcs7_test registered
[ 6.363323][ T1] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 239)
[ 6.382957][ T1] io scheduler mq-deadline registered
[ 6.383009][ T1] io scheduler kyber registered
[ 6.384939][ T1] io scheduler bfq registered
[ 6.390095][ T1] raid6: skipped pq benchmark and selected avx2x4
[ 6.436166][ T142] kworker/u8:2 (142) used greatest stack depth: 26432 bytes left
[ 6.482050][ T1] input: Power Button as /devices/platform/LNXPWRBN:00/input/input0
[ 6.494178][ T1] ACPI: button: Power Button [PWRF]
[ 6.508253][ T1] input: Sleep Button as /devices/platform/LNXSLPBN:00/input/input1
[ 6.512601][ T1] ACPI: button: Sleep Button [SLPF]
[ 6.564085][ T1] ioatdma: Intel(R) QuickData Technology Driver 5.00
[ 6.620644][ T10] ACPI: \_SB_.LNKC: Enabled at IRQ 11
[ 6.621000][ T10] virtio-pci 0000:00:03.0: virtio_pci: leaving for legacy driver
[ 6.683103][ T10] ACPI: \_SB_.LNKD: Enabled at IRQ 10
[ 6.683331][ T10] virtio-pci 0000:00:04.0: virtio_pci: leaving for legacy driver
[ 6.748091][ T10] ACPI: \_SB_.LNKB: Enabled at IRQ 10
[ 6.748252][ T10] virtio-pci 0000:00:06.0: virtio_pci: leaving for legacy driver
[ 6.795198][ T10] virtio-pci 0000:00:07.0: virtio_pci: leaving for legacy driver
[ 8.005073][ T1] N_HDLC line discipline registered with maxframe=4096
[ 8.008071][ T1] Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
[ 8.038848][ T1] 00:02: ttyS0 I/O:0x3f8 (irq = 4, base_baud = 115200) is a 16550A
[ 8.078361][ T1] 00:03: ttyS1 I/O:0x2f8 (irq = 3, base_baud = 115200) is a 16550A
[ 8.112459][ T1] 00:04: ttyS2 I/O:0x3e8 (irq = 6, base_baud = 115200) is a 16550A
[ 8.147922][ T1] 00:05: ttyS3 I/O:0x2e8 (irq = 7, base_baud = 115200) is a 16550A
[ 8.215592][ T1] Non-volatile memory driver v1.3
[ 8.265200][ T1] usbcore: registered new interface driver xillyusb
[ 8.279638][ T1] ACPI: bus type drm_connector registered
[ 8.301506][ T1] [drm] Initialized vgem 1.0.0 for vgem on minor 0
[ 8.318886][ T1] ------------[ cut here ]------------
[ 8.318903][ T1] [PLANE:35:plane-0] pixel format with alpha exposed but blend mode not setup
[ 8.318927][ T1] WARNING: drivers/gpu/drm/drm_mode_config.c:873 at drm_mode_config_validate+0x1c6d/0x1e60, CPU#1: swapper/0/1
[ 8.319003][ T1] Modules linked in:
[ 8.319061][ T1] CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
[ 8.319088][ T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 8.319112][ T1] RIP: 0010:drm_mode_config_validate+0x1cae/0x1e60
[ 8.319151][ T1] Code: 0f 85 ae 00 00 00 4d 8d 77 10 8b 6d 00 4c 89 f0 48 c1 e8 03 80 3c 18 00 74 08 4c 89 f7 e8 7a d4 ac fc 49 8b 16 4c 89 ef 89 ee <67> 48 0f b9 3a eb 05 e8 86 05 40 fc 49 bd 00 00 00 00 00 fc ff df
[ 8.319177][ T1] RSP: 0000:ffffc90000067810 EFLAGS: 00010246
[ 8.319197][ T1] RAX: 1ffff11004cf3e08 RBX: dffffc0000000000 RCX: ffff88801c6f5dc0
[ 8.319215][ T1] RDX: ffff8880262defc0 RSI: 0000000000000023 RDI: ffffffff8fdc85b0
[ 8.319233][ T1] RBP: 0000000000000023 R08: 0000000000000000 R09: 0000000000000000
[ 8.319246][ T1] R10: dffffc0000000000 R11: fffffbfff1fa2790 R12: dffffc0000000000
[ 8.319263][ T1] R13: ffffffff8fdc85b0 R14: ffff88802679f040 R15: ffff88802679f030
[ 8.319283][ T1] FS: 0000000000000000(0000) GS:ffff888125ada000(0000) knlGS:0000000000000000
[ 8.319303][ T1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 8.319319][ T1] CR2: 0000000000000000 CR3: 000000000e1b0000 CR4: 00000000003526f0
[ 8.319344][ T1] Call Trace:
[ 8.319353][ T1] <TASK>
[ 8.319379][ T1] ? debugfs_create_file_full+0x3f/0x60
[ 8.319413][ T1] drm_dev_register+0x7f/0xd80
[ 8.319449][ T1] vkms_create+0x40d/0x4f0
[ 8.319473][ T1] ? __pfx_vkms_init+0x10/0x10
[ 8.319508][ T1] vkms_init+0x57/0x80
[ 8.319537][ T1] do_one_initcall+0x250/0x870
[ 8.319596][ T1] ? __pfx_vkms_init+0x10/0x10
[ 8.319626][ T1] ? __pfx_do_one_initcall+0x10/0x10
[ 8.319660][ T1] ? lapic_next_event+0x11/0x20
[ 8.319701][ T1] ? __pfx_clockevents_program_event+0x10/0x10
[ 8.319735][ T1] ? __pfx___schedule+0x10/0x10
[ 8.319795][ T1] ? irqentry_exit+0x218/0x8f0
[ 8.319827][ T1] ? lockdep_hardirqs_on+0x7a/0x110
[ 8.319858][ T1] ? irqentry_exit+0x218/0x8f0
[ 8.319886][ T1] ? trace_irq_disable+0x3b/0x140
[ 8.319930][ T1] ? next_arg+0x4a0/0x5e0
[ 8.319965][ T1] ? parameq+0x14d/0x170
[ 8.320005][ T1] ? parse_args+0x9c3/0xad0
[ 8.320059][ T1] ? trace_kmalloc+0x2a/0xf0
[ 8.320083][ T1] ? rcu_is_watching+0x15/0xb0
[ 8.320117][ T1] do_initcall_level+0x10a/0x1a0
[ 8.320154][ T1] ? kernel_init+0x22/0x1d0
[ 8.320191][ T1] do_initcalls+0x59/0xa0
[ 8.320227][ T1] kernel_init_freeable+0x29d/0x3e0
[ 8.320263][ T1] ? __pfx_kernel_init+0x10/0x10
[ 8.320302][ T1] kernel_init+0x22/0x1d0
[ 8.320344][ T1] ? __pfx_kernel_init+0x10/0x10
[ 8.320380][ T1] ret_from_fork+0x514/0xb70
[ 8.320418][ T1] ? __pfx_ret_from_fork+0x10/0x10
[ 8.320452][ T1] ? __switch_to+0xc89/0x1420
[ 8.320485][ T1] ? __pfx_kernel_init+0x10/0x10
[ 8.320525][ T1] ret_from_fork_asm+0x1a/0x30
[ 8.320577][ T1] </TASK>
[ 8.320595][ T1] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 8.320612][ T1] CPU: 1 UID: 0 PID: 1 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
[ 8.320637][ T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 8.320651][ T1] Call Trace:
[ 8.320660][ T1] <TASK>
[ 8.320669][ T1] vpanic+0x56c/0xa60
[ 8.320694][ T1] ? __pfx__printk+0x10/0x10
[ 8.320724][ T1] ? __pfx_vpanic+0x10/0x10
[ 8.320746][ T1] ? is_bpf_text_address+0x292/0x2b0
[ 8.320775][ T1] ? is_bpf_text_address+0x26/0x2b0
[ 8.320813][ T1] panic+0xc5/0xd0
[ 8.320837][ T1] ? __pfx_panic+0x10/0x10
[ 8.320872][ T1] ? ret_from_fork_asm+0x1a/0x30
[ 8.320911][ T1] __warn+0x315/0x4c0
[ 8.320934][ T1] ? drm_mode_config_validate+0x1c6d/0x1e60
[ 8.320970][ T1] ? drm_mode_config_validate+0x1c6d/0x1e60
[ 8.321002][ T1] __report_bug+0x276/0x570
[ 8.321038][ T1] ? drm_mode_config_validate+0x1c6d/0x1e60
[ 8.321073][ T1] ? __pfx___report_bug+0x10/0x10
[ 8.321112][ T1] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 8.321144][ T1] ? lockdep_hardirqs_on+0x7a/0x110
[ 8.321177][ T1] ? rt_mutex_slowunlock+0x4ee/0xa20
[ 8.321205][ T1] report_bug_entry+0x19a/0x290
[ 8.321246][ T1] ? drm_mode_config_validate+0x1cae/0x1e60
[ 8.321277][ T1] ? drm_mode_config_validate+0x1cb3/0x1e60
[ 8.321313][ T1] handle_bug+0xce/0x200
[ 8.321505][ T1] exc_invalid_op+0x1a/0x50
[ 8.321542][ T1] asm_exc_invalid_op+0x1a/0x20
[ 8.321565][ T1] RIP: 0010:drm_mode_config_validate+0x1cae/0x1e60
[ 8.321598][ T1] Code: 0f 85 ae 00 00 00 4d 8d 77 10 8b 6d 00 4c 89 f0 48 c1 e8 03 80 3c 18 00 74 08 4c 89 f7 e8 7a d4 ac fc 49 8b 16 4c 89 ef 89 ee <67> 48 0f b9 3a eb 05 e8 86 05 40 fc 49 bd 00 00 00 00 00 fc ff df
[ 8.321616][ T1] RSP: 0000:ffffc90000067810 EFLAGS: 00010246
[ 8.321634][ T1] RAX: 1ffff11004cf3e08 RBX: dffffc0000000000 RCX: ffff88801c6f5dc0
[ 8.321652][ T1] RDX: ffff8880262defc0 RSI: 0000000000000023 RDI: ffffffff8fdc85b0
[ 8.321667][ T1] RBP: 0000000000000023 R08: 0000000000000000 R09: 0000000000000000
[ 8.321680][ T1] R10: dffffc0000000000 R11: fffffbfff1fa2790 R12: dffffc0000000000
[ 8.321696][ T1] R13: ffffffff8fdc85b0 R14: ffff88802679f040 R15: ffff88802679f030
[ 8.321739][ T1] ? debugfs_create_file_full+0x3f/0x60
[ 8.321769][ T1] drm_dev_register+0x7f/0xd80
[ 8.321803][ T1] vkms_create+0x40d/0x4f0
[ 8.321826][ T1] ? __pfx_vkms_init+0x10/0x10
[ 8.321853][ T1] vkms_init+0x57/0x80
[ 8.321880][ T1] do_one_initcall+0x250/0x870
[ 8.321912][ T1] ? __pfx_vkms_init+0x10/0x10
[ 8.322067][ T1] ? __pfx_do_one_initcall+0x10/0x10
[ 8.322100][ T1] ? lapic_next_event+0x11/0x20
[ 8.322140][ T1] ? __pfx_clockevents_program_event+0x10/0x10
[ 8.322179][ T1] ? __pfx___schedule+0x10/0x10
[ 8.322219][ T1] ? irqentry_exit+0x218/0x8f0
[ 8.322248][ T1] ? lockdep_hardirqs_on+0x7a/0x110
[ 8.322278][ T1] ? irqentry_exit+0x218/0x8f0
[ 8.322306][ T1] ? trace_irq_disable+0x3b/0x140
[ 8.322379][ T1] ? next_arg+0x4a0/0x5e0
[ 8.322415][ T1] ? parameq+0x14d/0x170
[ 8.322452][ T1] ? parse_args+0x9c3/0xad0
[ 8.322503][ T1] ? trace_kmalloc+0x2a/0xf0
[ 8.322526][ T1] ? rcu_is_watching+0x15/0xb0
[ 8.322558][ T1] do_initcall_level+0x10a/0x1a0
[ 8.322594][ T1] ? kernel_init+0x22/0x1d0
[ 8.322629][ T1] do_initcalls+0x59/0xa0
[ 8.322664][ T1] kernel_init_freeable+0x29d/0x3e0
[ 8.322697][ T1] ? __pfx_kernel_init+0x10/0x10
[ 8.322736][ T1] kernel_init+0x22/0x1d0
[ 8.322776][ T1] ? __pfx_kernel_init+0x10/0x10
[ 8.322815][ T1] ret_from_fork+0x514/0xb70
[ 8.322850][ T1] ? __pfx_ret_from_fork+0x10/0x10
[ 8.322880][ T1] ? __switch_to+0xc89/0x1420
[ 8.322912][ T1] ? __pfx_kernel_init+0x10/0x10
[ 8.322957][ T1] ret_from_fork_asm+0x1a/0x30
[ 8.323005][ T1] </TASK>
[ 8.323640][ T1] Kernel Offset: disabled
syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build712057134=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.26.0'
GOWORK=''
PKG_CONFIG='pkg-config'
git status (err=<nil>)
HEAD detached at cb1587ea08
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=cb1587ea08e5a1a12acb4372efe923e2308effdb -X github.com/google/syzkaller/prog.gitRevisionDate=20260729-121857" ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=cb1587ea08e5a1a12acb4372efe923e2308effdb -X github.com/google/syzkaller/prog.gitRevisionDate=20260729-121857" ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=cb1587ea08e5a1a12acb4372efe923e2308effdb -X github.com/google/syzkaller/prog.gitRevisionDate=20260729-121857" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"cb1587ea08e5a1a12acb4372efe923e2308effdb\"
/usr/bin/ld: /tmp/ccASjCJk.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x386): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null
Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=1389b8c6580000
Tested on:
commit: 78bc8af4 Add linux-next specific files for 20260729
git tree: linux-next
kernel config: https://syzkaller.appspot.com/x/.config?x=9e610c4fe458e456
dashboard link: https://syzkaller.appspot.com/bug?extid=23ad911c819b923238b7
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=121025b9580000
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [syzbot] [fs?] KASAN: slab-use-after-free Read in lookup_noperm_common
2026-07-30 1:43 syzbot
2026-07-30 7:49 ` Hillf Danton
@ 2026-08-01 0:00 ` syzbot
1 sibling, 0 replies; 6+ messages in thread
From: syzbot @ 2026-08-01 0:00 UTC (permalink / raw)
To: andi.shyti, dakr, driver-core, gregkh, hdanton, johan,
linux-fsdevel, linux-i2c, linux-kernel, rafael, syzkaller-bugs,
vasilisalmpanis, wsa
syzbot has found a reproducer for the following issue on:
HEAD commit: cc2b5f627e8c Add linux-next specific files for 20260714
git tree: linux-next
console+strace: https://syzkaller.appspot.com/x/log.txt?x=10d94e32580000
kernel config: https://syzkaller.appspot.com/x/.config?x=2290ccbf984c524f
dashboard link: https://syzkaller.appspot.com/bug?extid=23ad911c819b923238b7
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12f3a5b9580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12ac4c9e580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/6836f8efb1da/disk-cc2b5f62.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/0109d3477cc7/vmlinux-cc2b5f62.xz
kernel image: https://storage.googleapis.com/syzbot-assets/c2e49e350bbf/bzImage-cc2b5f62.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+23ad911c819b923238b7@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: slab-use-after-free in lookup_noperm_common+0x407/0x430 fs/namei.c:3106
Read of size 4 at addr ffff888040cd8000 by task syz-executor329/6384
CPU: 0 UID: 0 PID: 6384 Comm: syz-executor329 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
lookup_noperm_common+0x407/0x430 fs/namei.c:3106
simple_start_creating+0x9c/0x110 fs/libfs.c:2302
debugfs_start_creating+0xdb/0x1a0 fs/debugfs/inode.c:394
debugfs_create_dir+0x24/0x350 fs/debugfs/inode.c:572
i2c_device_probe+0x814/0xbf0 drivers/i2c/i2c-core-base.c:588
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x254/0xae0 drivers/base/dd.c:706
__driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
__device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c7/0x450 drivers/base/dd.c:1098
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
bus_probe_device+0x12d/0x220 drivers/base/bus.c:620
device_add+0x7d7/0xb80 drivers/base/core.c:3772
i2c_new_client_device+0xa29/0x1130 drivers/i2c/i2c-core-base.c:1019
new_device_store+0x24b/0x530 drivers/i2c/i2c-core-base.c:1307
kernfs_fop_write_iter+0x3a5/0x540 fs/kernfs/file.c:345
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61e/0xbb0 fs/read_write.c:687
ksys_write+0x156/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x17b/0x530 arch/x86/entry/syscall_64.c:85
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8c042ca209
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f8c03a89128 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f8c04370908 RCX: 00007f8c042ca209
RDX: 000000000000000f RSI: 0000200000000700 RDI: 0000000000000004
RBP: 00007f8c04370900 R08: 00007f8c03a89cdc R09: 0000000000000000
R10: 00007f8c03a89cdc R11: 0000000000000246 R12: 00007f8c0437090c
R13: 000000000000000b R14: 00007ffca85726b0 R15: 00007ffca8572798
</TASK>
Allocated by task 44:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
unpoison_slab_object mm/kasan/common.c:340 [inline]
__kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4608 [inline]
slab_alloc_node mm/slub.c:4921 [inline]
kmem_cache_alloc_lru_noprof+0x355/0x670 mm/slub.c:4954
__d_alloc+0x37/0x6f0 fs/dcache.c:1902
d_alloc+0x4b/0x190 fs/dcache.c:1981
lookup_one_qstr_excl+0xd8/0x360 fs/namei.c:1806
__start_dirop fs/namei.c:2920 [inline]
start_dirop+0x5c/0x90 fs/namei.c:2942
simple_start_creating+0xcc/0x110 fs/libfs.c:2305
debugfs_start_creating+0xdb/0x1a0 fs/debugfs/inode.c:394
debugfs_create_dir+0x24/0x350 fs/debugfs/inode.c:572
i2c_register_adapter+0xc14/0x1400 drivers/i2c/i2c-core-base.c:1609
dvb_usb_i2c_init+0x1fc/0x2e0 drivers/media/usb/dvb-usb/dvb-usb-i2c.c:31
dvb_usb_init drivers/media/usb/dvb-usb/dvb-usb-init.c:183 [inline]
dvb_usb_device_init+0xf30/0x2570 drivers/media/usb/dvb-usb/dvb-usb-init.c:310
dibusb_probe+0xb7/0xf0 drivers/media/usb/dvb-usb/dibusb-mb.c:116
usb_probe_interface+0x788/0xe50 drivers/usb/core/driver.c:399
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x254/0xae0 drivers/base/dd.c:706
__driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
__device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c7/0x450 drivers/base/dd.c:1098
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
bus_probe_device+0x12d/0x220 drivers/base/bus.c:620
device_add+0x7d7/0xb80 drivers/base/core.c:3772
usb_set_configuration+0x1ad8/0x2180 drivers/usb/core/message.c:2268
usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250
usb_probe_device+0x1c3/0x3b0 drivers/usb/core/driver.c:293
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x254/0xae0 drivers/base/dd.c:706
__driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
__device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c7/0x450 drivers/base/dd.c:1098
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
bus_probe_device+0x12d/0x220 drivers/base/bus.c:620
device_add+0x7d7/0xb80 drivers/base/core.c:3772
usb_new_device+0x98d/0x1610 drivers/usb/core/hub.c:2695
hub_port_connect drivers/usb/core/hub.c:5567 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
port_event drivers/usb/core/hub.c:5871 [inline]
hub_event+0x28cf/0x4cf0 drivers/usb/core/hub.c:5953
process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
process_scheduled_works kernel/workqueue.c:3462 [inline]
worker_thread+0xb05/0x10d0 kernel/workqueue.c:3543
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Freed by task 29:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2706 [inline]
slab_free mm/slub.c:6388 [inline]
kmem_cache_free+0x187/0x6c0 mm/slub.c:6515
rcu_do_batch kernel/rcu/tree.c:2645 [inline]
rcu_core kernel/rcu/tree.c:2897 [inline]
rcu_cpu_kthread+0x950/0x1480 kernel/rcu/tree.c:2985
smpboot_thread_fn+0x57c/0xa80 kernel/smpboot.c:160
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Last potentially related work creation:
kasan_save_stack+0x3e/0x60 mm/kasan/common.c:57
kasan_record_aux_stack+0xbd/0xd0 mm/kasan/generic.c:556
__call_rcu_common kernel/rcu/tree.c:3159 [inline]
call_rcu+0xee/0x8b0 kernel/rcu/tree.c:3279
dentry_kill+0x4d3/0x880 fs/dcache.c:845
finish_dput+0x1a/0x260 fs/dcache.c:1001
debugfs_remove+0x5b/0x70 fs/debugfs/inode.c:781
i2c_del_adapter+0x229/0x430 drivers/i2c/i2c-core-base.c:1829
dvb_usb_i2c_exit+0x64/0xb0 drivers/media/usb/dvb-usb/dvb-usb-i2c.c:46
dvb_usb_exit drivers/media/usb/dvb-usb/dvb-usb-init.c:144 [inline]
dvb_usb_device_exit+0x1cb/0x350 drivers/media/usb/dvb-usb/dvb-usb-init.c:338
usb_unbind_interface+0x295/0x9f0 drivers/usb/core/driver.c:461
device_remove drivers/base/dd.c:618 [inline]
__device_release_driver drivers/base/dd.c:1349 [inline]
device_release_driver_internal+0x4f5/0x880 drivers/base/dd.c:1372
bus_remove_device+0x449/0x560 drivers/base/bus.c:664
device_del+0x528/0x8f0 drivers/base/core.c:3961
usb_disable_device+0x3d4/0x8d0 drivers/usb/core/message.c:1478
usb_disconnect+0x32d/0x990 drivers/usb/core/hub.c:2345
hub_port_connect drivers/usb/core/hub.c:5407 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5707 [inline]
port_event drivers/usb/core/hub.c:5871 [inline]
hub_event+0x1bb7/0x4cf0 drivers/usb/core/hub.c:5953
process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
process_scheduled_works kernel/workqueue.c:3462 [inline]
worker_thread+0xb05/0x10d0 kernel/workqueue.c:3543
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
The buggy address belongs to the object at ffff888040cd8000
which belongs to the cache dentry of size 376
The buggy address is located 0 bytes inside of
freed 376-byte region [ffff888040cd8000, ffff888040cd8178)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888040cd9b80 pfn:0x40cd8
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff8880276f0201
flags: 0x80000000000240(workingset|head|node=0|zone=1)
page_type: f5(slab)
raw: 0080000000000240 ffff88801c2f6500 ffffea00011add10 ffffea00013fbf10
raw: ffff888040cd9b80 0000000800120011 00000000f5000000 ffff8880276f0201
head: 0080000000000240 ffff88801c2f6500 ffffea00011add10 ffffea00013fbf10
head: ffff888040cd9b80 0000000800120011 00000000f5000000 ffff8880276f0201
head: 0080000000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff
head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Reclaimable, gfp_mask 0xd20d0(__GFP_RECLAIMABLE|__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4962, tgid 4962 (udevd), ts 59068459425
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1871
prep_new_page mm/page_alloc.c:1879 [inline]
get_page_from_freelist+0x264c/0x26c0 mm/page_alloc.c:3955
__alloc_frozen_pages_noprof+0x222/0x5b0 mm/page_alloc.c:5394
alloc_slab_page mm/slub.c:3295 [inline]
allocate_slab+0x7c/0x5e0 mm/slub.c:3410
new_slab mm/slub.c:3456 [inline]
refill_objects+0x2d8/0x350 mm/slub.c:7321
refill_sheaf mm/slub.c:2833 [inline]
__pcs_replace_empty_main+0x330/0x690 mm/slub.c:4699
alloc_from_pcs mm/slub.c:4775 [inline]
slab_alloc_node mm/slub.c:4909 [inline]
kmem_cache_alloc_lru_noprof+0x44d/0x670 mm/slub.c:4954
__d_alloc+0x37/0x6f0 fs/dcache.c:1902
d_alloc+0x4b/0x190 fs/dcache.c:1981
lookup_one_qstr_excl+0xd8/0x360 fs/namei.c:1806
__start_renaming+0x1da/0x410 fs/namei.c:3888
filename_renameat2+0x3a0/0x9b0 fs/namei.c:6161
__do_sys_rename fs/namei.c:6230 [inline]
__se_sys_rename+0x55/0x2c0 fs/namei.c:6226
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x17b/0x530 arch/x86/entry/syscall_64.c:85
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page_owner free stack trace missing
Memory state around the buggy address:
ffff888040cd7f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888040cd7f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888040cd8000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888040cd8080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888040cd8100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc
==================================================================
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [syzbot] [fs?] KASAN: slab-use-after-free Read in lookup_noperm_common
[not found] <20260801080314.978109-1-vasilisalmpanis@gmail.com>
@ 2026-08-01 9:41 ` syzbot
0 siblings, 0 replies; 6+ messages in thread
From: syzbot @ 2026-08-01 9:41 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs, vasilisalmpanis
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
error[E0308]: mismatched types
Tested on:
commit: 415606a7 Add linux-next specific files for 20260731
git tree: linux-next
kernel config: https://syzkaller.appspot.com/x/.config?x=2290ccbf984c524f
dashboard link: https://syzkaller.appspot.com/bug?extid=23ad911c819b923238b7
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=1021ce32580000
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [syzbot] [fs?] KASAN: slab-use-after-free Read in lookup_noperm_common
[not found] <20260801101512.989245-1-vasilisalmpanis@gmail.com>
@ 2026-08-01 10:52 ` syzbot
0 siblings, 0 replies; 6+ messages in thread
From: syzbot @ 2026-08-01 10:52 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs, vasilisalmpanis
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+23ad911c819b923238b7@syzkaller.appspotmail.com
Tested-by: syzbot+23ad911c819b923238b7@syzkaller.appspotmail.com
Tested on:
commit: 02dc699f Merge tag 'kbuild-fixes-7.2-1' of git://git.k..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=14c3ce32580000
kernel config: https://syzkaller.appspot.com/x/.config?x=abdd1c3924a3d690
dashboard link: https://syzkaller.appspot.com/bug?extid=23ad911c819b923238b7
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=13290649580000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-08-01 10:52 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20260801080314.978109-1-vasilisalmpanis@gmail.com>
2026-08-01 9:41 ` [syzbot] [fs?] KASAN: slab-use-after-free Read in lookup_noperm_common syzbot
[not found] <20260801101512.989245-1-vasilisalmpanis@gmail.com>
2026-08-01 10:52 ` syzbot
2026-07-30 1:43 syzbot
2026-07-30 7:49 ` Hillf Danton
2026-07-30 9:33 ` syzbot
2026-08-01 0:00 ` syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox