* [syzbot] [kernel?] KASAN: slab-use-after-free Write in bus_for_each_drv
@ 2026-08-10 0:22 syzbot
2026-08-10 22:39 ` syzbot
0 siblings, 1 reply; 5+ messages in thread
From: syzbot @ 2026-08-10 0:22 UTC (permalink / raw)
To: dakr, driver-core, gregkh, linux-kernel, rafael, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 848acc8ffe1b Merge tag 'fsverity-for-linus' of git://git.k..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=1109be32580000
kernel config: https://syzkaller.appspot.com/x/.config?x=cb17729fb04b1e3a
dashboard link: https://syzkaller.appspot.com/bug?extid=9cb1ac7fce4944ba9165
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/375d27e96ecb/disk-848acc8f.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/4ba19a656b9d/vmlinux-848acc8f.xz
kernel image: https://storage.googleapis.com/syzbot-assets/7c2a17aaee7c/bzImage-848acc8f.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+9cb1ac7fce4944ba9165@syzkaller.appspotmail.com
Need at least one configuration in g1.
udc pcspkr: failed to start g1: -22
configfs-gadget.g1 gadget.33: probe with driver configfs-gadget.g1 failed with error -22
==================================================================
BUG: KASAN: slab-use-after-free in knode_set_klist lib/klist.c:60 [inline]
BUG: KASAN: slab-use-after-free in klist_release lib/klist.c:201 [inline]
BUG: KASAN: slab-use-after-free in kref_put include/linux/kref.h:65 [inline]
BUG: KASAN: slab-use-after-free in klist_dec_and_del+0x386/0x3d0 lib/klist.c:206
Write of size 8 at addr ffff8880329628e0 by task syz.4.45/5977
CPU: 1 UID: 0 PID: 5977 Comm: syz.4.45 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
knode_set_klist lib/klist.c:60 [inline]
klist_release lib/klist.c:201 [inline]
kref_put include/linux/kref.h:65 [inline]
klist_dec_and_del+0x386/0x3d0 lib/klist.c:206
klist_next+0xc3/0x2f0 lib/klist.c:386
next_driver drivers/base/bus.c:457 [inline]
bus_for_each_drv+0x268/0x2f0 drivers/base/bus.c:499
__device_attach+0x2c7/0x450 drivers/base/dd.c:1098
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
bus_probe_device+0x12d/0x220 drivers/base/bus.c:620
device_add+0x7d7/0xb80 drivers/base/core.c:3772
usb_add_gadget+0x47d/0x700 drivers/usb/gadget/udc/core.c:1461
usb_add_gadget_udc_release+0x1a4/0x1f0 drivers/usb/gadget/udc/core.c:1517
vudc_probe+0x89f/0x9d0 drivers/usb/usbip/vudc_dev.c:613
platform_probe+0xf9/0x190 drivers/base/platform.c:1439
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x254/0xae0 drivers/base/dd.c:706
__driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
device_driver_attach+0xe0/0x1d0 drivers/base/dd.c:1203
bind_store+0x1d3/0x220 drivers/base/bus.c:267
kernfs_fop_write_iter+0x3a5/0x540 fs/kernfs/file.c:345
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61e/0xbb0 fs/read_write.c:687
ksys_write+0x156/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fabe65ee019
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fabe4846028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007fabe6875fa0 RCX: 00007fabe65ee019
RDX: 0000000000000006 RSI: 0000200000000140 RDI: 0000000000000004
RBP: 00007fabe668500c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fabe6876038 R14: 00007fabe6875fa0 R15: 00007ffeb7f127b8
</TASK>
Allocated by task 5978:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__kmalloc_cache_noprof+0x3d2/0x6b0 mm/slub.c:5489
_kmalloc_noprof include/linux/slab.h:988 [inline]
_kzalloc_noprof include/linux/slab.h:1309 [inline]
bus_add_driver+0x165/0x670 drivers/base/bus.c:747
driver_register+0x23a/0x320 drivers/base/driver.c:174
usb_gadget_register_driver_owner+0xf9/0x270 drivers/usb/gadget/udc/core.c:1752
gadget_dev_desc_UDC_store+0x1c9/0x2f0 drivers/usb/gadget/configfs.c:300
flush_write_buffer fs/configfs/file.c:207 [inline]
configfs_write_iter+0x33a/0x430 fs/configfs/file.c:229
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61e/0xbb0 fs/read_write.c:687
ksys_write+0x156/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 5978:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2677 [inline]
slab_free mm/slub.c:6377 [inline]
kfree+0x1c5/0x6c0 mm/slub.c:6692
kobject_cleanup lib/kobject.c:689 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x222/0x550 lib/kobject.c:737
bus_remove_driver+0x248/0x320 drivers/base/bus.c:834
usb_gadget_register_driver_owner+0x223/0x270 drivers/usb/gadget/udc/core.c:1774
gadget_dev_desc_UDC_store+0x1c9/0x2f0 drivers/usb/gadget/configfs.c:300
flush_write_buffer fs/configfs/file.c:207 [inline]
configfs_write_iter+0x33a/0x430 fs/configfs/file.c:229
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61e/0xbb0 fs/read_write.c:687
ksys_write+0x156/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff888032962800
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 224 bytes inside of
freed 512-byte region [ffff888032962800, ffff888032962a00)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x32960
head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x80000000000040(head|node=0|zone=1)
page_type: f5(slab)
raw: 0080000000000040 ffff88813ffb2c80 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
head: 0080000000000040 ffff88813ffb2c80 dead000000000100 dead000000000122
head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
head: 0080000000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff
head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000004
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5832, tgid 5822 (syz.0.1), ts 126620428538, free_ts 125246166491
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x262a/0x26a0 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
alloc_slab_page mm/slub.c:3266 [inline]
allocate_slab+0x79/0x5e0 mm/slub.c:3380
new_slab mm/slub.c:3426 [inline]
refill_objects+0x2d8/0x350 mm/slub.c:7310
refill_sheaf mm/slub.c:2804 [inline]
__pcs_replace_empty_main+0x330/0x690 mm/slub.c:4675
alloc_from_pcs mm/slub.c:4773 [inline]
slab_alloc_node mm/slub.c:4905 [inline]
__kmalloc_cache_noprof+0x468/0x6b0 mm/slub.c:5485
_kmalloc_noprof include/linux/slab.h:988 [inline]
_kzalloc_noprof include/linux/slab.h:1309 [inline]
userio_char_open+0x51/0x1b0 drivers/input/serio/userio.c:76
misc_open+0x2de/0x350 drivers/char/misc.c:163
chrdev_open+0x4dc/0x600 fs/char_dev.c:411
do_dentry_open+0x849/0x1420 fs/open.c:947
vfs_open+0x3b/0x350 fs/open.c:1052
do_open fs/namei.c:4700 [inline]
path_openat+0x2e60/0x3850 fs/namei.c:4863
do_file_open+0x23e/0x4a0 fs/namei.c:4892
do_sys_openat2+0x115/0x200 fs/open.c:1368
do_sys_open fs/open.c:1374 [inline]
__do_sys_openat fs/open.c:1390 [inline]
__se_sys_openat fs/open.c:1385 [inline]
__x64_sys_openat+0x138/0x170 fs/open.c:1385
page last free pid 4960 tgid 4960 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0x10e7/0x11c0 mm/page_alloc.c:2950
__slab_free+0x252/0x2a0 mm/slub.c:5741
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4584 [inline]
slab_alloc_node mm/slub.c:4917 [inline]
__do_kmalloc_node mm/slub.c:5333 [inline]
__kmalloc_noprof+0x3b6/0x780 mm/slub.c:5359
_kmalloc_noprof include/linux/slab.h:992 [inline]
tomoyo_realpath_from_path+0xef/0x640 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_check_open_permission+0x229/0x470 security/tomoyo/file.c:776
security_file_open+0xa9/0x240 security/security.c:2739
do_dentry_open+0x4be/0x1420 fs/open.c:924
vfs_open+0x3b/0x350 fs/open.c:1052
do_open fs/namei.c:4700 [inline]
path_openat+0x2e60/0x3850 fs/namei.c:4863
do_file_open+0x23e/0x4a0 fs/namei.c:4892
do_sys_openat2+0x115/0x200 fs/open.c:1368
do_sys_open fs/open.c:1374 [inline]
__do_sys_openat fs/open.c:1390 [inline]
__se_sys_openat fs/open.c:1385 [inline]
__x64_sys_openat+0x138/0x170 fs/open.c:1385
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
Memory state around the buggy address:
ffff888032962780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888032962800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888032962880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888032962900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888032962980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [syzbot] [kernel?] KASAN: slab-use-after-free Write in bus_for_each_drv
2026-08-10 0:22 syzbot
@ 2026-08-10 22:39 ` syzbot
0 siblings, 0 replies; 5+ messages in thread
From: syzbot @ 2026-08-10 22:39 UTC (permalink / raw)
To: dakr, driver-core, gregkh, linux-kernel, rafael, syzkaller-bugs
syzbot has found a reproducer for the following issue on:
HEAD commit: d58772d8520c Merge tag 'regmap-fix-v7.2-rc7' of git://git...
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=16e012c6580000
kernel config: https://syzkaller.appspot.com/x/.config?x=6ddb3079499f48cb
dashboard link: https://syzkaller.appspot.com/bug?extid=9cb1ac7fce4944ba9165
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1719d132580000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+9cb1ac7fce4944ba9165@syzkaller.appspotmail.com
Need at least one configuration in g3.
udc dummy_udc.0: failed to start g3: -22
configfs-gadget.g3 gadget.0: probe with driver configfs-gadget.g3 failed with error -22
==================================================================
BUG: KASAN: slab-use-after-free in knode_set_klist lib/klist.c:60 [inline]
BUG: KASAN: slab-use-after-free in klist_release lib/klist.c:201 [inline]
BUG: KASAN: slab-use-after-free in kref_put include/linux/kref.h:65 [inline]
BUG: KASAN: slab-use-after-free in klist_dec_and_del+0x386/0x3d0 lib/klist.c:206
Write of size 8 at addr ffff88803fe920e0 by task syz-executor321/5936
CPU: 1 UID: 0 PID: 5936 Comm: syz-executor321 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
knode_set_klist lib/klist.c:60 [inline]
klist_release lib/klist.c:201 [inline]
kref_put include/linux/kref.h:65 [inline]
klist_dec_and_del+0x386/0x3d0 lib/klist.c:206
klist_next+0xc3/0x2f0 lib/klist.c:386
next_driver drivers/base/bus.c:457 [inline]
bus_for_each_drv+0x268/0x2f0 drivers/base/bus.c:499
__device_attach+0x2c7/0x450 drivers/base/dd.c:1098
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
bus_probe_device+0x12d/0x220 drivers/base/bus.c:620
device_add+0x7d7/0xb80 drivers/base/core.c:3772
usb_add_gadget+0x47d/0x700 drivers/usb/gadget/udc/core.c:1461
usb_add_gadget_udc_release+0x1a4/0x1f0 drivers/usb/gadget/udc/core.c:1517
dummy_udc_probe+0x6e1/0x7e0 drivers/usb/gadget/udc/dummy_hcd.c:1121
platform_probe+0xf9/0x190 drivers/base/platform.c:1439
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x254/0xae0 drivers/base/dd.c:706
__driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
device_driver_attach+0xe0/0x1d0 drivers/base/dd.c:1203
bind_store+0x1d3/0x220 drivers/base/bus.c:267
kernfs_fop_write_iter+0x3a5/0x540 fs/kernfs/file.c:345
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61e/0xbb0 fs/read_write.c:687
ksys_write+0x156/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f453d1641de
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007f453d106f98 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f453d1076c0 RCX: 00007f453d1641de
RDX: 000000000000000b RSI: 00007f453d1ad1b9 RDI: 0000000000000003
RBP: 0000000000000005 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
R13: 0000000000000010 R14: 00007ffca4345660 R15: 00007ffca4345748
</TASK>
Allocated by task 5940:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__kmalloc_cache_noprof+0x3d2/0x6b0 mm/slub.c:5489
_kmalloc_noprof include/linux/slab.h:988 [inline]
_kzalloc_noprof include/linux/slab.h:1309 [inline]
bus_add_driver+0x165/0x670 drivers/base/bus.c:747
driver_register+0x23a/0x320 drivers/base/driver.c:174
usb_gadget_register_driver_owner+0xf9/0x270 drivers/usb/gadget/udc/core.c:1752
gadget_dev_desc_UDC_store+0x1c9/0x2f0 drivers/usb/gadget/configfs.c:300
flush_write_buffer fs/configfs/file.c:207 [inline]
configfs_write_iter+0x33a/0x430 fs/configfs/file.c:229
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61e/0xbb0 fs/read_write.c:687
ksys_write+0x156/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 5940:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2677 [inline]
slab_free mm/slub.c:6377 [inline]
kfree+0x1c5/0x6c0 mm/slub.c:6692
kobject_cleanup lib/kobject.c:689 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x222/0x550 lib/kobject.c:737
bus_remove_driver+0x248/0x320 drivers/base/bus.c:834
usb_gadget_register_driver_owner+0x223/0x270 drivers/usb/gadget/udc/core.c:1774
gadget_dev_desc_UDC_store+0x1c9/0x2f0 drivers/usb/gadget/configfs.c:300
flush_write_buffer fs/configfs/file.c:207 [inline]
configfs_write_iter+0x33a/0x430 fs/configfs/file.c:229
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61e/0xbb0 fs/read_write.c:687
ksys_write+0x156/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff88803fe92000
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 224 bytes inside of
freed 512-byte region [ffff88803fe92000, ffff88803fe92200)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3fe90
head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x80000000000040(head|node=0|zone=1)
page_type: f5(slab)
raw: 0080000000000040 ffff88813ffb3c80 dead000000000100 dead000000000122
raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
head: 0080000000000040 ffff88813ffb3c80 dead000000000100 dead000000000122
head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000
head: 0080000000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff
head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000004
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5633, tgid 5633 (syz-executor), ts 102640041714, free_ts 80262861649
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x262a/0x26a0 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
alloc_slab_page mm/slub.c:3266 [inline]
allocate_slab+0x79/0x5e0 mm/slub.c:3380
new_slab mm/slub.c:3426 [inline]
refill_objects+0x2d8/0x350 mm/slub.c:7310
refill_sheaf mm/slub.c:2804 [inline]
__pcs_replace_empty_main+0x330/0x690 mm/slub.c:4675
alloc_from_pcs mm/slub.c:4773 [inline]
slab_alloc_node mm/slub.c:4905 [inline]
__kmalloc_cache_noprof+0x468/0x6b0 mm/slub.c:5485
_kmalloc_noprof include/linux/slab.h:988 [inline]
_kzalloc_noprof include/linux/slab.h:1309 [inline]
mca_alloc net/ipv6/mcast.c:871 [inline]
__ipv6_dev_mc_inc+0x447/0xa40 net/ipv6/mcast.c:961
ipv6_add_dev+0xe83/0x1400 net/ipv6/addrconf.c:475
addrconf_notify+0x771/0x1050 net/ipv6/addrconf.c:3685
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2288 [inline]
call_netdevice_notifiers net/core/dev.c:2302 [inline]
register_netdevice+0x18c0/0x1ed0 net/core/dev.c:11484
__ip_tunnel_create+0x3e8/0x550 net/ipv4/ip_tunnel.c:268
ip_tunnel_init_net+0x2e5/0x820 net/ipv4/ip_tunnel.c:1150
ops_init+0x35d/0x5d0 net/core/net_namespace.c:137
setup_net+0x118/0x350 net/core/net_namespace.c:446
page last free pid 5564 tgid 5564 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0x10e7/0x11c0 mm/page_alloc.c:2950
__slab_free+0x252/0x2a0 mm/slub.c:5741
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4584 [inline]
slab_alloc_node mm/slub.c:4917 [inline]
__kmalloc_cache_noprof+0x351/0x6b0 mm/slub.c:5485
_kmalloc_noprof include/linux/slab.h:988 [inline]
single_open+0x5a/0x240 fs/seq_file.c:576
do_dentry_open+0x849/0x1420 fs/open.c:947
vfs_open+0x3b/0x350 fs/open.c:1052
do_open fs/namei.c:4700 [inline]
path_openat+0x2e60/0x3850 fs/namei.c:4863
do_file_open+0x23e/0x4a0 fs/namei.c:4892
do_sys_openat2+0x115/0x200 fs/open.c:1368
do_sys_open fs/open.c:1374 [inline]
__do_sys_openat fs/open.c:1390 [inline]
__se_sys_openat fs/open.c:1385 [inline]
__x64_sys_openat+0x138/0x170 fs/open.c:1385
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff88803fe91f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88803fe92000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88803fe92080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88803fe92100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88803fe92180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [syzbot] [kernel?] KASAN: slab-use-after-free Write in bus_for_each_drv
[not found] <20260823215407.20373-1-kmehltretter@gmail.com>
@ 2026-08-24 1:20 ` syzbot
0 siblings, 0 replies; 5+ messages in thread
From: syzbot @ 2026-08-24 1:20 UTC (permalink / raw)
To: kmehltretter, linux-kernel, syzkaller-bugs
Hello,
syzbot tried to test the proposed patch but the build/boot failed:
-0x00000000b8600000] (64MB)
[ 11.599912][ T1] ACPI: bus type thunderbolt registered
[ 11.742383][ T1] RAPL PMU: API unit is 2^-32 Joules, 0 fixed counters, 10737418240 ms ovfl timer
[ 11.808342][ T70] kworker/u8:3 (70) used greatest stack depth: 28424 bytes left
[ 11.808482][ T71] kworker/u8:5 (71) used greatest stack depth: 27728 bytes left
[ 11.908721][ T1] kvm_amd: CPU 1 isn't AMD or Hygon
[ 11.908764][ T1] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x1fb63109b96, max_idle_ns: 440795265316 ns
[ 11.909880][ T1] clocksource: Switched to clocksource tsc
[ 11.959472][ T73] kworker/u8:5 (73) used greatest stack depth: 27312 bytes left
[ 12.004111][ T75] kworker/u8:5 (75) used greatest stack depth: 26680 bytes left
[ 12.171591][ T1] Initialise system trusted keyrings
[ 12.188484][ T1] workingset: timestamp_bits=40 (anon: 35) max_order=21 bucket_order=0 (anon: 0)
[ 12.232071][ T1] DLM installed
[ 12.270720][ T1] squashfs: version 4.0 (2009/01/31) Phillip Lougher
[ 12.310924][ T1] NFS: Registering the id_resolver key type
[ 12.311151][ T1] Key type id_resolver registered
[ 12.311167][ T1] Key type id_legacy registered
[ 12.311698][ T1] nfs4filelayout_init: NFSv4 File Layout Driver Registering...
[ 12.311932][ T1] nfs4flexfilelayout_init: NFSv4 Flexfile Layout Driver Registering...
[ 12.349827][ T1] smbdirect: subsystem loading...
[ 12.473464][ T1] smbdirect: subsystem loaded
[ 12.556036][ T1] Key type cifs.spnego registered
[ 12.557192][ T1] Key type cifs.idmap registered
[ 12.612279][ T1] ntfs3: Enabled Linux POSIX ACLs support
[ 12.612296][ T1] ntfs3: Read-only LZX/Xpress compression included
[ 12.613918][ T1] jffs2: version 2.2. (NAND) (SUMMARY) © 2001-2006 Red Hat, Inc.
[ 12.707150][ T1] romfs: ROMFS MTD (C) 2007 Red Hat, Inc.
[ 12.710929][ T1] QNX4 filesystem 0.2.3 registered.
[ 12.728727][ T1] qnx6: QNX6 filesystem 1.0.0 registered.
[ 12.777345][ T1] fuse: init (API version 7.45)
[ 12.813692][ T1] orangefs_debugfs_init: called with debug mask: :none: :0:
[ 12.827109][ T1] orangefs_init: module version upstream loaded
[ 12.832698][ T1] JFS: nTxBlock = 8192, nTxLock = 65536
[ 12.902685][ T1] SGI XFS with ACLs, security attributes, realtime, scrub, repair, quota, no debug enabled
[ 12.939665][ T1] 9p: Installing v9fs 9p2000 file system support
[ 12.942832][ T1] NILFS version 2 loaded
[ 12.942854][ T1] befs: version: 0.9.3
[ 12.946918][ T1] ocfs2: Registered cluster interface o2cb
[ 12.958238][ T1] ocfs2: Registered cluster interface user
[ 12.979796][ T1] OCFS2 User DLM kernel interface loaded
[ 13.137006][ T1] gfs2: GFS2 installed
[ 13.186192][ T1] ceph: loaded (mds proto 32)
[ 13.239816][ T1] NET: Registered PF_ALG protocol family
[ 13.241279][ T1] async_tx: api initialized (async)
[ 13.241362][ T1] Key type asymmetric registered
[ 13.241613][ T1] Asymmetric key parser 'x509' registered
[ 13.241642][ T1] Asymmetric key parser 'pkcs8' registered
[ 13.241663][ T1] Key type pkcs7_test registered
[ 13.244006][ T1] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 239)
[ 13.247405][ T1] io scheduler mq-deadline registered
[ 13.247428][ T1] io scheduler kyber registered
[ 13.251382][ T1] io scheduler bfq registered
[ 13.274291][ T1] raid6: skipped pq benchmark and selected avx2x4
[ 13.482571][ T1] input: Power Button as /devices/platform/LNXPWRBN:00/input/input0
[ 13.514265][ T1] ACPI: button: Power Button [PWRF]
[ 13.537302][ T1] input: Sleep Button as /devices/platform/LNXSLPBN:00/input/input1
[ 13.568912][ T1] ACPI: button: Sleep Button [SLPF]
[ 13.662280][ T1] ioatdma: Intel(R) QuickData Technology Driver 5.00
[ 13.795622][ T10] ACPI: \_SB_.LNKC: Enabled at IRQ 11
[ 13.796273][ T10] virtio-pci 0000:00:03.0: virtio_pci: leaving for legacy driver
[ 13.911245][ T10] ACPI: \_SB_.LNKD: Enabled at IRQ 10
[ 13.911473][ T10] virtio-pci 0000:00:04.0: virtio_pci: leaving for legacy driver
[ 14.036923][ T10] ACPI: \_SB_.LNKB: Enabled at IRQ 10
[ 14.037334][ T10] virtio-pci 0000:00:06.0: virtio_pci: leaving for legacy driver
[ 14.134871][ T10] virtio-pci 0000:00:07.0: virtio_pci: leaving for legacy driver
[ 14.455961][ T276] kworker/u8:3 (276) used greatest stack depth: 26536 bytes left
[ 16.547826][ T1] N_HDLC line discipline registered with maxframe=4096
[ 16.550769][ T1] Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
[ 16.605843][ T1] 00:02: ttyS0 at I/O 0x3f8 (irq = 4, base_baud = 115200) is a 16550A
[ 16.671871][ T1] 00:03: ttyS1 at I/O 0x2f8 (irq = 3, base_baud = 115200) is a 16550A
[ 16.730076][ T1] 00:04: ttyS2 at I/O 0x3e8 (irq = 6, base_baud = 115200) is a 16550A
[ 16.805136][ T1] 00:05: ttyS3 at I/O 0x2e8 (irq = 7, base_baud = 115200) is a 16550A
[ 16.949551][ T1] Non-volatile memory driver v1.3
[ 17.132363][ T1] usbcore: registered new interface driver xillyusb
[ 17.183391][ T1] ACPI: bus type drm_connector registered
[ 17.243108][ T1] [drm] Initialized vgem 1.0.0 for vgem on minor 0
[ 17.314892][ T1] ------------[ cut here ]------------
[ 17.314909][ T1] [PLANE:35:plane-0] pixel format with alpha exposed but blend mode not setup
[ 17.314933][ T1] WARNING: drivers/gpu/drm/drm_mode_config.c:873 at drm_mode_config_validate+0x1c6d/0x1e60, CPU#0: swapper/0/1
[ 17.315009][ T1] Modules linked in:
[ 17.315074][ T1] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
[ 17.315098][ T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 17.315123][ T1] RIP: 0010:drm_mode_config_validate+0x1cae/0x1e60
[ 17.315929][ T1] Code: 0f 85 ae 00 00 00 4d 8d 77 10 8b 6d 00 4c 89 f0 48 c1 e8 03 80 3c 18 00 74 08 4c 89 f7 e8 5a d7 af fc 49 8b 16 4c 89 ef 89 ee <67> 48 0f b9 3a eb 05 e8 56 4a 44 fc 49 bd 00 00 00 00 00 fc ff df
[ 17.315949][ T1] RSP: 0000:ffffc90000067810 EFLAGS: 00010246
[ 17.315969][ T1] RAX: 1ffff11004bcd808 RBX: dffffc0000000000 RCX: ffff88801c6b5dc0
[ 17.315986][ T1] RDX: ffff888025a56980 RSI: 0000000000000023 RDI: ffffffff8fbcf300
[ 17.316002][ T1] RBP: 0000000000000023 R08: 0000000000000000 R09: 0000000000000000
[ 17.316015][ T1] R10: dffffc0000000000 R11: fffffbfff1f63828 R12: dffffc0000000000
[ 17.316031][ T1] R13: ffffffff8fbcf300 R14: ffff888025e6c040 R15: ffff888025e6c030
[ 17.316047][ T1] FS: 0000000000000000(0000) GS:ffff888125be6000(0000) knlGS:0000000000000000
[ 17.316065][ T1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 17.316079][ T1] CR2: ffff88823ffff000 CR3: 000000000dfb0000 CR4: 00000000003526f0
[ 17.316098][ T1] Call Trace:
[ 17.316108][ T1] <TASK>
[ 17.316128][ T1] ? debugfs_create_file_full+0x3f/0x60
[ 17.316273][ T1] drm_dev_register+0x7f/0xd80
[ 17.316310][ T1] vkms_create+0x40d/0x4f0
[ 17.316337][ T1] ? __pfx_vkms_init+0x10/0x10
[ 17.316373][ T1] vkms_init+0x57/0x80
[ 17.316402][ T1] do_one_initcall+0x250/0x870
[ 17.316445][ T1] ? __pfx_vkms_init+0x10/0x10
[ 17.316473][ T1] ? __pfx_do_one_initcall+0x10/0x10
[ 17.316511][ T1] ? kvm_clock_get_cycles+0x49/0x60
[ 17.316543][ T1] ? __pfx___schedule+0x10/0x10
[ 17.316576][ T1] ? clockevents_program_event+0x491/0x630
[ 17.316607][ T1] ? __hrtimer_rearm_deferred+0x99/0x4d0
[ 17.318440][ T1] ? irqentry_exit+0x218/0x910
[ 17.318510][ T1] ? lockdep_hardirqs_on+0x7b/0x110
[ 17.318545][ T1] ? irqentry_exit+0x218/0x910
[ 17.318575][ T1] ? trace_irq_disable+0x3b/0x140
[ 17.318624][ T1] ? next_arg+0x4a0/0x5e0
[ 17.318660][ T1] ? parameq+0x14d/0x170
[ 17.318690][ T1] ? parse_args+0x9c3/0xad0
[ 17.318747][ T1] ? rcu_is_watching+0x16/0xb0
[ 17.318786][ T1] do_initcall_level+0x10a/0x1a0
[ 17.318830][ T1] ? kernel_init+0x22/0x1d0
[ 17.318867][ T1] do_initcalls+0x59/0xa0
[ 17.318908][ T1] kernel_init_freeable+0x29d/0x3e0
[ 17.318947][ T1] ? __pfx_kernel_init+0x10/0x10
[ 17.318987][ T1] kernel_init+0x22/0x1d0
[ 17.319029][ T1] ? __pfx_kernel_init+0x10/0x10
[ 17.319065][ T1] ret_from_fork+0x514/0xb70
[ 17.319106][ T1] ? __pfx_ret_from_fork+0x10/0x10
[ 17.321040][ T1] ? __switch_to+0xc89/0x1420
[ 17.321120][ T1] ? __pfx_kernel_init+0x10/0x10
[ 17.321163][ T1] ret_from_fork_asm+0x1a/0x30
[ 17.321202][ T1] </TASK>
[ 17.321228][ T1] Kernel panic - not syncing: kernel: panic_on_warn set ...
[ 17.321250][ T1] CPU: 0 UID: 0 PID: 1 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
[ 17.321274][ T1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
[ 17.321288][ T1] Call Trace:
[ 17.321298][ T1] <TASK>
[ 17.321307][ T1] vpanic+0x56d/0xa60
[ 17.321329][ T1] ? __pfx__printk+0x10/0x10
[ 17.321354][ T1] ? __pfx_vpanic+0x10/0x10
[ 17.321372][ T1] ? is_bpf_text_address+0x292/0x2b0
[ 17.321401][ T1] ? is_bpf_text_address+0x26/0x2b0
[ 17.321437][ T1] panic+0xc5/0xd0
[ 17.321457][ T1] ? __pfx_panic+0x10/0x10
[ 17.321487][ T1] ? ret_from_fork_asm+0x1a/0x30
[ 17.321513][ T1] __warn+0x315/0x4c0
[ 17.321532][ T1] ? drm_mode_config_validate+0x1c6d/0x1e60
[ 17.321568][ T1] ? drm_mode_config_validate+0x1c6d/0x1e60
[ 17.321596][ T1] __report_bug+0x276/0x570
[ 17.321625][ T1] ? drm_mode_config_validate+0x1c6d/0x1e60
[ 17.321656][ T1] ? __pfx___report_bug+0x10/0x10
[ 17.322207][ T1] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 17.322248][ T1] ? rt_mutex_slowunlock+0x4ee/0xa30
[ 17.322275][ T1] report_bug_entry+0x19b/0x290
[ 17.322306][ T1] ? drm_mode_config_validate+0x1cae/0x1e60
[ 17.322338][ T1] ? drm_mode_config_validate+0x1cb3/0x1e60
[ 17.322982][ T1] handle_bug+0xce/0x200
[ 17.323038][ T1] exc_invalid_op+0x1a/0x50
[ 17.323075][ T1] asm_exc_invalid_op+0x1a/0x20
[ 17.323101][ T1] RIP: 0010:drm_mode_config_validate+0x1cae/0x1e60
[ 17.323142][ T1] Code: 0f 85 ae 00 00 00 4d 8d 77 10 8b 6d 00 4c 89 f0 48 c1 e8 03 80 3c 18 00 74 08 4c 89 f7 e8 5a d7 af fc 49 8b 16 4c 89 ef 89 ee <67> 48 0f b9 3a eb 05 e8 56 4a 44 fc 49 bd 00 00 00 00 00 fc ff df
[ 17.323163][ T1] RSP: 0000:ffffc90000067810 EFLAGS: 00010246
[ 17.323186][ T1] RAX: 1ffff11004bcd808 RBX: dffffc0000000000 RCX: ffff88801c6b5dc0
[ 17.323205][ T1] RDX: ffff888025a56980 RSI: 0000000000000023 RDI: ffffffff8fbcf300
[ 17.323222][ T1] RBP: 0000000000000023 R08: 0000000000000000 R09: 0000000000000000
[ 17.323237][ T1] R10: dffffc0000000000 R11: fffffbfff1f63828 R12: dffffc0000000000
[ 17.323388][ T1] R13: ffffffff8fbcf300 R14: ffff888025e6c040 R15: ffff888025e6c030
[ 17.323437][ T1] ? debugfs_create_file_full+0x3f/0x60
[ 17.323476][ T1] drm_dev_register+0x7f/0xd80
[ 17.323517][ T1] vkms_create+0x40d/0x4f0
[ 17.323548][ T1] ? __pfx_vkms_init+0x10/0x10
[ 17.323582][ T1] vkms_init+0x57/0x80
[ 17.323617][ T1] do_one_initcall+0x250/0x870
[ 17.323655][ T1] ? __pfx_vkms_init+0x10/0x10
[ 17.323687][ T1] ? __pfx_do_one_initcall+0x10/0x10
[ 17.323731][ T1] ? kvm_clock_get_cycles+0x49/0x60
[ 17.324961][ T1] ? __pfx___schedule+0x10/0x10
[ 17.325015][ T1] ? clockevents_program_event+0x491/0x630
[ 17.325058][ T1] ? __hrtimer_rearm_deferred+0x99/0x4d0
[ 17.325107][ T1] ? irqentry_exit+0x218/0x910
[ 17.325950][ T1] ? lockdep_hardirqs_on+0x7b/0x110
[ 17.325977][ T1] ? irqentry_exit+0x218/0x910
[ 17.325999][ T1] ? trace_irq_disable+0x3b/0x140
[ 17.326037][ T1] ? next_arg+0x4a0/0x5e0
[ 17.326399][ T1] ? parameq+0x14d/0x170
[ 17.326436][ T1] ? parse_args+0x9c3/0xad0
[ 17.326488][ T1] ? rcu_is_watching+0x16/0xb0
[ 17.326530][ T1] do_initcall_level+0x10a/0x1a0
[ 17.326576][ T1] ? kernel_init+0x22/0x1d0
[ 17.326615][ T1] do_initcalls+0x59/0xa0
[ 17.326656][ T1] kernel_init_freeable+0x29d/0x3e0
[ 17.326695][ T1] ? __pfx_kernel_init+0x10/0x10
[ 17.326972][ T1] kernel_init+0x22/0x1d0
[ 17.327019][ T1] ? __pfx_kernel_init+0x10/0x10
[ 17.327052][ T1] ret_from_fork+0x514/0xb70
[ 17.327090][ T1] ? __pfx_ret_from_fork+0x10/0x10
[ 17.327123][ T1] ? __switch_to+0xc89/0x1420
[ 17.327166][ T1] ? __pfx_kernel_init+0x10/0x10
[ 17.327206][ T1] ret_from_fork_asm+0x1a/0x30
[ 17.327246][ T1] </TASK>
[ 17.327972][ T1] Kernel Offset: disabled
syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build3418809368=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.26.0'
GOWORK=''
PKG_CONFIG='pkg-config'
git status (err=<nil>)
HEAD detached at d4abbeacd53
nothing to commit, working tree clean
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=d4abbeacd53add822a563e66a8ca9e64929b96ab -X github.com/google/syzkaller/prog.gitRevisionDate=20260804-103143" ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=d4abbeacd53add822a563e66a8ca9e64929b96ab -X github.com/google/syzkaller/prog.gitRevisionDate=20260804-103143" ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=d4abbeacd53add822a563e66a8ca9e64929b96ab -X github.com/google/syzkaller/prog.gitRevisionDate=20260804-103143" -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include -DGOOS_linux=1 -DGOARCH_amd64=1 \
-DHOSTGOOS_linux=1 -DGIT_REVISION=\"d4abbeacd53add822a563e66a8ca9e64929b96ab\"
/usr/bin/ld: /tmp/ccSFcTDt.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x386): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null
Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=12f43549580000
Tested on:
commit: 4352b8ae Merge tag 'i3c/for-7.3' of git://git.kernel.o..
git tree: upstream
kernel config: https://syzkaller.appspot.com/x/.config?x=c01bf1b5895f71b2
dashboard link: https://syzkaller.appspot.com/bug?extid=9cb1ac7fce4944ba9165
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=10c13179580000
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [syzbot] [kernel?] KASAN: slab-use-after-free Write in bus_for_each_drv
[not found] <20260824015334.56759-1-kmehltretter@gmail.com>
@ 2026-08-24 2:20 ` syzbot
0 siblings, 0 replies; 5+ messages in thread
From: syzbot @ 2026-08-24 2:20 UTC (permalink / raw)
To: kmehltretter, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch but the reproducer is still triggering an issue:
WARNING: refcount bug in usb_add_gadget
------------[ cut here ]------------
refcount_t: addition on 0; use-after-free.
WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x9f/0x110 lib/refcount.c:25, CPU#1: syz-executor381/5998
Modules linked in:
CPU: 1 UID: 0 PID: 5998 Comm: syz-executor381 Not tainted syzkaller #0 PREEMPT_{RT,(full)}
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:refcount_warn_saturate+0x9f/0x110 lib/refcount.c:25
Code: eb 66 85 db 74 3e 83 fb 01 75 4c e8 4b ae 02 fd 48 8d 3d f4 64 f7 0a 67 48 0f b9 3a eb 4a e8 38 ae 02 fd 48 8d 3d f1 64 f7 0a <67> 48 0f b9 3a eb 37 e8 25 ae 02 fd 48 8d 3d ee 64 f7 0a 67 48 0f
RSP: 0018:ffffc90003d87968 EFLAGS: 00010293
RAX: ffffffff84c329f8 RBX: 0000000000000002 RCX: ffff888031b29f00
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffffffff8fba8ef0
RBP: 0000000000000000 R08: ffff888031b29f00 R09: 0000000000000005
R10: 0000000000000100 R11: 0000000000000004 R12: ffff88803b7285d8
R13: 0000000000000000 R14: ffff888025decd90 R15: dffffc0000000000
FS: 00007f4ec54416c0(0000) GS:ffff888125d35000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f413f414140 CR3: 00000000400de000 CR4: 00000000003526f0
Call Trace:
<TASK>
__refcount_add include/linux/refcount.h:-1 [inline]
__refcount_inc include/linux/refcount.h:366 [inline]
refcount_inc include/linux/refcount.h:383 [inline]
kref_get include/linux/kref.h:45 [inline]
kobject_get+0xfa/0x120 lib/kobject.c:643
get_device drivers/base/core.c:3868 [inline]
device_add+0x24/0xb80 drivers/base/core.c:3648
usb_add_gadget+0x47d/0x700 drivers/usb/gadget/udc/core.c:1461
usb_add_gadget_udc_release+0x1a4/0x1f0 drivers/usb/gadget/udc/core.c:1517
dummy_udc_probe+0x6e1/0x7e0 drivers/usb/gadget/udc/dummy_hcd.c:1121
platform_probe+0xf9/0x190 drivers/base/platform.c:1439
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x254/0xae0 drivers/base/dd.c:706
__driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
device_driver_attach+0xe0/0x1d0 drivers/base/dd.c:1203
bind_store+0x1d3/0x220 drivers/base/bus.c:267
kernfs_fop_write_iter+0x3a5/0x540 fs/kernfs/file.c:345
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61e/0xbb0 fs/read_write.c:687
ksys_write+0x156/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f4ec549e1de
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007f4ec5440f98 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f4ec54416c0 RCX: 00007f4ec549e1de
RDX: 000000000000000b RSI: 00007f4ec54e71b9 RDI: 0000000000000003
RBP: 0000000000000004 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
R13: 0000000000000010 R14: 00007ffc9aa26bd0 R15: 00007ffc9aa26cb8
</TASK>
----------------
Code disassembly (best guess):
0: eb 66 jmp 0x68
2: 85 db test %ebx,%ebx
4: 74 3e je 0x44
6: 83 fb 01 cmp $0x1,%ebx
9: 75 4c jne 0x57
b: e8 4b ae 02 fd call 0xfd02ae5b
10: 48 8d 3d f4 64 f7 0a lea 0xaf764f4(%rip),%rdi # 0xaf7650b
17: 67 48 0f b9 3a ud1 (%edx),%rdi
1c: eb 4a jmp 0x68
1e: e8 38 ae 02 fd call 0xfd02ae5b
23: 48 8d 3d f1 64 f7 0a lea 0xaf764f1(%rip),%rdi # 0xaf7651b
* 2a: 67 48 0f b9 3a ud1 (%edx),%rdi <-- trapping instruction
2f: eb 37 jmp 0x68
31: e8 25 ae 02 fd call 0xfd02ae5b
36: 48 8d 3d ee 64 f7 0a lea 0xaf764ee(%rip),%rdi # 0xaf7652b
3d: 67 addr32
3e: 48 rex.W
3f: 0f .byte 0xf
Tested on:
commit: d58772d8 Merge tag 'regmap-fix-v7.2-rc7' of git://git...
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=164c1179580000
kernel config: https://syzkaller.appspot.com/x/.config?x=6ddb3079499f48cb
dashboard link: https://syzkaller.appspot.com/bug?extid=9cb1ac7fce4944ba9165
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=11b98979580000
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [syzbot] [kernel?] KASAN: slab-use-after-free Write in bus_for_each_drv
[not found] <20260824070042.33037-1-kmehltretter@gmail.com>
@ 2026-08-24 8:44 ` syzbot
0 siblings, 0 replies; 5+ messages in thread
From: syzbot @ 2026-08-24 8:44 UTC (permalink / raw)
To: kmehltretter, linux-kernel, syzkaller-bugs
Hello,
syzbot has tested the proposed patch and the reproducer did not trigger any issue:
Reported-by: syzbot+9cb1ac7fce4944ba9165@syzkaller.appspotmail.com
Tested-by: syzbot+9cb1ac7fce4944ba9165@syzkaller.appspotmail.com
Tested on:
commit: d58772d8 Merge tag 'regmap-fix-v7.2-rc7' of git://git...
git tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=124d1179580000
kernel config: https://syzkaller.appspot.com/x/.config?x=6ddb3079499f48cb
dashboard link: https://syzkaller.appspot.com/bug?extid=9cb1ac7fce4944ba9165
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
patch: https://syzkaller.appspot.com/x/patch.diff?x=10a66415580000
Note: testing is done by a robot and is best-effort only.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-08-24 8:44 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20260823215407.20373-1-kmehltretter@gmail.com>
2026-08-24 1:20 ` [syzbot] [kernel?] KASAN: slab-use-after-free Write in bus_for_each_drv syzbot
[not found] <20260824070042.33037-1-kmehltretter@gmail.com>
2026-08-24 8:44 ` syzbot
[not found] <20260824015334.56759-1-kmehltretter@gmail.com>
2026-08-24 2:20 ` syzbot
2026-08-10 0:22 syzbot
2026-08-10 22:39 ` syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox