From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f52.google.com (mail-wr1-f52.google.com [209.85.221.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 13B0A2E889C for ; Sat, 28 Feb 2026 21:55:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.52 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772315737; cv=none; b=LO6z/8pNFag6JZS55YQRzq6z/sKvV9+mjNDBhtYLRofPkKZvvlgeh+XfQA5khpmryQ8Z3jtNILPFnn9lOhAWBVlvfuxktc50FbdyI5jWSX8cfThPxLWHpIXvqFxwF+Qojsg0EyOiZvo14YUe+Vkj5/tSS7WaqtXy3QZj5RId41A= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772315737; c=relaxed/simple; bh=XmSfggXeUsgGATiVVTmtHJkiXdfZdq1pwEwurLOPi14=; h=Date:From:To:Cc:Subject:Message-ID:MIME-Version:Content-Type: Content-Disposition; b=l+7L0piHTsHmKJghbUGdBUDPM7kXSfiVjKk5ZW5Y3V1Nk9YgcVp4jv6KGMBD6h6MNivF/c6zT2Q7bCQEryxk8HScEFWnwcPJARDbDutiQrVwaApcxpps/jepv19d6Q3qvfTvVN6wGcmgYJ/pESY3DQYN2b3cVMkRYe2bZrBdQbg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=hUcWIB7Y; arc=none smtp.client-ip=209.85.221.52 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="hUcWIB7Y" Received: by mail-wr1-f52.google.com with SMTP id ffacd0b85a97d-439a89b6fd0so577195f8f.2 for ; Sat, 28 Feb 2026 13:55:35 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1772315734; x=1772920534; darn=vger.kernel.org; h=content-disposition:mime-version:message-id:subject:cc:to:from:date :from:to:cc:subject:date:message-id:reply-to; bh=9PzG1y8eGf6bFHDqe1ccj4Hs3oBUQIz//rTfv7W5Ml8=; b=hUcWIB7YiQmZeZk0SOoqAJl3LhJYq/rOv0F6j1Dor3uLnlbANTsjR6CB+VNtl7x7yd i8m9KZIHwzCV7L4pXmBE9heNwtEwVBXvabbiRmx7ypAm9U3qNQTZs/QhkvQUk9Nni9Ok I0+p8xvcDewODqeyM/a2wfsmDL/jEE6N7TSJV7EgvxYxGiHuEsvBArturEaSja1gT7nv LEjiJKDNeBLOWM10V7c6QUpYw2862APmE3HTMcn5v6iC3yBMpyX/rA1FB1W2cPyWvqYV ibj0amlgJGJUDV7SCOld3QXnV16r238nKo2uCU3mNfh7XjzN9hm9jirQ0hXFqVxI6vLJ cHzA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1772315734; x=1772920534; h=content-disposition:mime-version:message-id:subject:cc:to:from:date :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=9PzG1y8eGf6bFHDqe1ccj4Hs3oBUQIz//rTfv7W5Ml8=; b=krjryPxulPjQSbct4w9YTpI+e7C/KNv2G8W7tr/w2mPo4Tggpx6qznCspHX2IpVPuP 5xhuHu66e6FY5aPUu925Pu7QqjcCf9antJIf9XJpXF2GGxi40H5YtD5P54yBn0MaGnT7 9T6Wk2DTUtVUAqU/aJ2zRcsC4kvU9qN8Eeq8bJlqmXlyGd300YK2ruHxvO06khSmCPOh 93xxlgYGvcaVM0TerXtnzMQS/eS63NppmQvvnz98cv/Kgpz3LTPL/qKnAv0uhtFr7WqJ /+oC7WgaaQWzdJk3vDzG3eHR/OpxfR7i8ibQQBNCQvRXxQrhrAj9qQrRRGzCYM0PUWPx SlBw== X-Gm-Message-State: AOJu0YwlDg9WX+yOPtOU8HoM/1no8zmKLMYVsPLy8vEXA0a+ZqZj2Mjd 7uzW37vahS1LSaARxD1na/1RznuCT9ZVy0tl1GvVbqCJKg+eTCZAgSGzEusBwzG5 X-Gm-Gg: ATEYQzyW48Cwa2r8aP4P/zBTVp0QG0kKQWvlxFgB58VDE98bmcTZuOf3GtxXwz2BVQg tzlfAZvbC65zTf/loxn3a4Ao6zJZ3o2YTCkGt0mzCkVhKLicZiZpvus5+9RH/264+uoAZVCXBtE vaHLEA/L7JvQBIj+z67PSqJb7MugupnqQiv5CGbGSgxuSqqX3q3dQT4Aj+4awfCZPxX3FcKW82S EFQVpces+liw62Kx7OBGddj1B4JUf87wIFslMRSL9/Vbv63qVC9kAJxGe7S3E7w8u+oUW/qSz8l HwBB4wQwzmGL/Xr5uEfwdOJGbKb/OUUprC7di7LgE8ioONwGG0NvoyiVGPhLoCfYJZ8DLNc8QzE dCClcBdx7udhYONJeq0rMHT9dhh4A873X7JDc4I08X/r06WYi9MPNgPQfv+Ta0wz/P1ip2ISUqL wfKwTpcijC4JYwYEuyU4VMlo+wN/+XFZzSj2g= X-Received: by 2002:a05:6000:2311:b0:439:8487:73a7 with SMTP id ffacd0b85a97d-4399de4a5b7mr13167415f8f.40.1772315734056; Sat, 28 Feb 2026 13:55:34 -0800 (PST) Received: from debian.local ([2a0a:ef40:ecc:da01:fefd:28fc:2252:7a2d]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-439ad3daf89sm8896072f8f.20.2026.02.28.13.55.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 28 Feb 2026 13:55:33 -0800 (PST) Date: Sat, 28 Feb 2026 21:55:32 +0000 From: Chris Bainbridge To: sudipm.mukherjee@gmail.com Cc: linux-kernel@vger.kernel.org, gregkh@linuxfoundation.org, rafael@kernel.org, dakr@kernel.org Subject: [BUG] KASAN: slab-use-after-free in parport_register_dev_model Message-ID: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Hi, I saw the following when booting 7.0-rc1 (on a modern AMD laptop with no parallel port). The bug appears to be intermittent - I tried rebooting a few times to see if it would trivially reoccur, but it did not. [ 7.234416] systemd[1]: Finished kmod-static-nodes.service - Create List of Static Device Nodes. [ 7.249613] ================================================================== [ 7.250299] BUG: KASAN: slab-use-after-free in parport_register_dev_model+0xd99/0xe20 [parport] [ 7.250864] Read of size 8 at addr ffff88810969feb8 by task systemd-modules/289 [ 7.251957] CPU: 11 UID: 0 PID: 289 Comm: systemd-modules Not tainted 7.0.0-rc1 #446 PREEMPT(lazy) [ 7.251961] Hardware name: HP HP Pavilion Aero Laptop 13-be0xxx/8916, BIOS F.14 10/25/2023 [ 7.251962] Call Trace: [ 7.251964] [ 7.251965] dump_stack_lvl+0x6a/0x90 [ 7.251972] print_report+0x174/0x4f2 [ 7.251975] ? __virt_addr_valid+0x208/0x430 [ 7.251979] ? parport_register_dev_model+0xd99/0xe20 [parport] [ 7.251983] kasan_report+0xdb/0x1b0 [ 7.251988] ? parport_register_dev_model+0xd99/0xe20 [parport] [ 7.251993] parport_register_dev_model+0xd99/0xe20 [parport] [ 7.251999] lp_register+0xfe/0x320 [lp] [ 7.252003] ? lp_reset.isra.0+0x4e0/0x4e0 [lp] [ 7.252006] ? 0xffffffffc0440000 [ 7.252009] ? mark_held_locks+0x40/0x70 [ 7.252012] ? _raw_spin_unlock_irqrestore+0x48/0x60 [ 7.252016] ? _raw_spin_unlock_irqrestore+0x48/0x60 [ 7.252018] lp_attach+0x123/0x1e0 [lp] [ 7.252021] ? parport_irq_handler+0xc0/0xc0 [parport] [ 7.252026] port_check+0x5c/0x90 [parport] [ 7.252031] bus_for_each_dev+0x101/0x180 [ 7.252035] ? bus_remove_file+0x40/0x40 [ 7.252038] ? kobject_put+0x5d/0x4e0 [ 7.252043] __parport_register_driver+0x145/0x1d0 [parport] [ 7.252048] lp_init_module+0x57d/0x1000 [lp] [ 7.252051] ? ppdev_cleanup+0xd30/0xd30 [ppdev] [ 7.252056] ? ppdev_cleanup+0xd30/0xd30 [ppdev] [ 7.252059] do_one_initcall+0xce/0x4d0 [ 7.252062] ? trace_event_raw_event_initcall_level+0x200/0x200 [ 7.252066] ? kasan_unpoison+0x40/0x60 [ 7.252069] do_init_module+0x27b/0x830 [ 7.252073] ? free_module+0x450/0x450 [ 7.252075] ? kfree+0x226/0x5e0 [ 7.252078] ? lockdep_hardirqs_on+0x78/0x100 [ 7.252081] load_module+0x5f71/0x8f70 [ 7.252088] ? module_frob_arch_sections+0x20/0x20 [ 7.252090] ? process_measurement+0x1c80/0x1c80 [ 7.252095] ? rw_verify_area+0x33d/0x540 [ 7.252100] ? kernel_read_file+0x3db/0x870 [ 7.252103] ? __ia32_sys_fsconfig+0x150/0x150 [ 7.252107] ? init_module_from_file+0x153/0x180 [ 7.252109] init_module_from_file+0x153/0x180 [ 7.252111] ? __do_sys_init_module+0x250/0x250 [ 7.252114] ? __x64_sys_pread64+0x199/0x1e0 [ 7.252118] ? find_held_lock+0x2b/0x80 [ 7.252120] ? idempotent_init_module+0x5e5/0x760 [ 7.252123] ? idempotent_init_module+0x5e5/0x760 [ 7.252125] ? lock_release+0x17b/0x2d0 [ 7.252127] ? do_raw_spin_unlock+0x54/0x1e0 [ 7.252130] idempotent_init_module+0x22d/0x760 [ 7.252133] ? init_module_from_file+0x180/0x180 [ 7.252139] __x64_sys_finit_module+0xca/0x150 [ 7.252141] ? do_syscall_64+0x57/0x810 [ 7.252144] do_syscall_64+0x13a/0x810 [ 7.252146] ? lockdep_hardirqs_on+0x78/0x100 [ 7.252148] ? do_syscall_64+0x281/0x810 [ 7.252150] ? do_syscall_64+0x263/0x810 [ 7.252153] ? entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 7.252155] ? lockdep_hardirqs_on+0x78/0x100 [ 7.252157] ? do_syscall_64+0x281/0x810 [ 7.252159] ? find_held_lock+0x2b/0x80 [ 7.252161] ? exc_page_fault+0x83/0x110 [ 7.252163] ? exc_page_fault+0x83/0x110 [ 7.252165] ? lock_release+0x17b/0x2d0 [ 7.252168] ? irqentry_exit+0xe7/0x670 [ 7.252170] ? lockdep_hardirqs_on_prepare+0xdd/0x1a0 [ 7.252173] ? irqentry_exit+0xec/0x670 [ 7.252175] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 7.252177] RIP: 0033:0x7f93c92de8cd [ 7.252179] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 13 c5 0d 00 f7 d8 64 89 01 48 [ 7.252182] RSP: 002b:00007f93c8975b48 EFLAGS: 00000246 ORIG_RAX: 0000000000000139 [ 7.252185] RAX: ffffffffffffffda RBX: 00007f93c0009bf0 RCX: 00007f93c92de8cd [ 7.252187] RDX: 0000000000000000 RSI: 00007f93c716d317 RDI: 000000000000000b [ 7.252188] RBP: 00007f93c8975be0 R08: 0000000000000000 R09: 00007f93c0009e80 [ 7.252190] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f93c716d317 [ 7.252191] R13: 00007f93c00020a0 R14: 0000000000020000 R15: 0000000000000000 [ 7.252195] [ 7.257125] systemd[1]: Starting systemd-tmpfiles-setup-dev-early.service - Create Static Device Nodes in /dev gracefully... [ 7.257511] Allocated by task 277: [ 7.257513] kasan_save_stack+0x2c/0x50 [ 7.277216] kasan_save_track+0x10/0x30 [ 7.277220] __kasan_kmalloc+0x83/0x90 [ 7.277222] __parport_pc_probe_port+0x8c3/0x1950 [parport_pc] [ 7.277226] parport_pc_exit+0x1efc/0x2650 [parport_pc] [ 7.277229] do_one_initcall+0xce/0x4d0 [ 7.277232] do_init_module+0x27b/0x830 [ 7.277234] load_module+0x5f71/0x8f70 [ 7.277236] init_module_from_file+0x153/0x180 [ 7.277238] idempotent_init_module+0x22d/0x760 [ 7.277240] __x64_sys_finit_module+0xca/0x150 [ 7.277242] do_syscall_64+0x13a/0x810 [ 7.277244] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 7.277247] Freed by task 277: [ 7.277249] kasan_save_stack+0x2c/0x50 [ 7.277251] kasan_save_track+0x10/0x30 [ 7.277253] kasan_save_free_info+0x37/0x50 [ 7.277255] __kasan_slab_free+0x3b/0x60 [ 7.277257] kfree+0x226/0x5e0 [ 7.277259] __parport_pc_probe_port+0x521/0x1950 [parport_pc] [ 7.277262] parport_pc_exit+0x1efc/0x2650 [parport_pc] [ 7.277264] do_one_initcall+0xce/0x4d0 [ 7.277266] do_init_module+0x27b/0x830 [ 7.277268] load_module+0x5f71/0x8f70 [ 7.277270] init_module_from_file+0x153/0x180 [ 7.277272] idempotent_init_module+0x22d/0x760 [ 7.277274] __x64_sys_finit_module+0xca/0x150 [ 7.277276] do_syscall_64+0x13a/0x810 [ 7.277278] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 7.277280] The buggy address belongs to the object at ffff88810969fe00 which belongs to the cache kmalloc-192 of size 192 [ 7.277282] The buggy address is located 184 bytes inside of freed 192-byte region [ffff88810969fe00, ffff88810969fec0) [ 7.277285] The buggy address belongs to the physical page: [ 7.277287] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10969e [ 7.277289] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 7.277291] flags: 0x17ffffc0000040(head|node=0|zone=2|lastcpupid=0x1fffff) [ 7.277294] page_type: f5(slab) [ 7.277297] raw: 0017ffffc0000040 ffff8881000423c0 dead000000000100 dead000000000122 [ 7.277299] raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000 [ 7.277301] head: 0017ffffc0000040 ffff8881000423c0 dead000000000100 dead000000000122 [ 7.277303] head: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000 [ 7.277304] head: 0017ffffc0000001 ffffea000425a781 00000000ffffffff 00000000ffffffff [ 7.277305] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 [ 7.277306] page dumped because: kasan: bad access detected [ 7.277308] Memory state around the buggy address: [ 7.277309] ffff88810969fd80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 7.277311] ffff88810969fe00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 7.277312] >ffff88810969fe80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 7.277313] ^ [ 7.277314] ffff88810969ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 7.277316] ffff88810969ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 7.277317] ================================================================== [ 7.277390] Disabling lock debugging due to kernel taint [ 7.294143] lp: driver loaded but no devices found [ 7.294157] ppdev: user-space parallel port driver [ 7.318526] systemd[1]: Finished systemd-modules-load.service - Load Kernel Modules.