From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qk1-f181.google.com (mail-qk1-f181.google.com [209.85.222.181]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1FB54146D53 for ; Sun, 14 Jun 2026 19:48:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.181 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781466534; cv=none; b=iFGzQoactLQFBccQd15idHK2eEyWCGt0+uC6u0G9PZTPAamguoj4GHEvY9xA95TAviv7+6NDxEtSN9vYr1rJPu1AiLA+hDGfoX0jTCASXPDnhC66LYAZEUEfAow2KM3EfXotdL9e1wQcdZdyZ4IoTahxriOHKHfnc29BBRRVrMY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781466534; c=relaxed/simple; bh=NDPfwOD66WskPFb2GpfNI9tKJYkRevfExK7UlzurRxk=; h=From:To:Subject:Date:Message-ID:MIME-Version:Content-Type; b=uuZ4nuydSQiaW8j00SQfQEflGXqTXYYopJmccJEf3utsP03terrFw/edPKV62TvmmpJ5x3qXY4+/sux91qcGofHuzd3eegEk6tG8uFQqnOQjY68N1+15at2LJelEqI++TYvqbA1P4g9GHZoxadIQBSnYDojYVGBISo/4Z1kYVR4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=NTPCo0Pp; arc=none smtp.client-ip=209.85.222.181 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="NTPCo0Pp" Received: by mail-qk1-f181.google.com with SMTP id af79cd13be357-9157b895c57so248672485a.3 for ; Sun, 14 Jun 2026 12:48:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781466532; x=1782071332; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:from:to:cc:subject:date:message-id:reply-to; bh=7jwOJxoTbYrT2BU4tcVO0FDOibfZNtVpkcNggaZiYXI=; b=NTPCo0PpvORHWbFQzCckT02YOKs+oriWVWNrSX77PmZFbfHWpCQ7/hTKU6wTq27THb n3/QBLU+PGJ70rjcSERJnURdZITKwdoXU6qjuntuxh3pWITFTu57uPMlyHVFUMfYoa+Z 54Xd1Aj+AsD45EZOVdLSaszxKxxfBYOB1kE3IYsHgsDxZZ3/IeQYJ/Bt51hn+RJbt/Ck 5sfPBXBwryvbedFedj0sSK71polN5e7xt0Vxz8zi2IP0T548/gk2726n9BSHNHxS6M1p jyEnYmhEQ/gd5VD9EmUcEXj0ZVP09yC09lf7TpiLUykD7sQs+der0WKcf4sUcEYhnQhO TArA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781466532; x=1782071332; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=7jwOJxoTbYrT2BU4tcVO0FDOibfZNtVpkcNggaZiYXI=; b=W6Ocq5WrrMZfnCscM2QZtouNX5xg+V88LfZf3td+Thoh6Va7J9K5Vs4c6zhyx1gdG4 MtA98oxoK4xlP2X5Wnek1FMZlkwb2UBZj6lfXU0kGNvoyPhBFM9dNYtJKYw9XP72ykKC qP7stCAHZ+F5puWX4H+F8+HSR8fblS8PAQ7t/qjgAyINP9ZZiKk8SoIfIXvZ/r64vVoJ sWFZOW1aCfOYPPbiynHdWmXfjxQX96Zhy/zbHp37ynSlf6zb11l6nu+uFnOryYMST+Gz 6ua9RRwd2F2Pe0S5Ehb4/yIl2ITyTuWU5jlmrwPkrG+w29neJPgHO9yCmDlnawP/PV1h VZ3w== X-Forwarded-Encrypted: i=1; AFNElJ/nC7GPhpKRhYb1cfhOZKLPczyG7uPpzNPi/DMBVdUiEUJ7HZflnyfju4nmmDvBrOQKi3t78zsSH6De5iQ=@vger.kernel.org X-Gm-Message-State: AOJu0YxSB5wyI1kagaNXC0yUM02olOq7JCB+ucOUYbtUjusSsnk5Hqj1 L4GXUqdaq3vvBQQu1jCcz/b+KiMIu/+ElgQWfa0H3KaagzlW+tfb9EVQ X-Gm-Gg: Acq92OHYwFeVGRpp8yfxRem8dgvUTBTPfWrr3iDRspEkYxiHNwnLq8F227CNwZqL5cq UJ2TcvQXonnag152WVZBwk8uRU5PcImjLBW+cS4EldDezzvQ7sZ4d7+sx2/J+xRRoWWrxmwZwkk GafE5NoIX3vOE7nZF2bX7ts163jpMv5RagHRP4en4Qnb41XU6Fi/JXSKds1F7IDIqe5JevMSD/c ESZD2yBYNGEJd7iUPTgvAisBqmKKHuk8hxr3hHocNoT/dWX5I9jxoa8eWE6z8dvuwI7KvUHjRZz jIMO0ORv7ufPo7ve3ewWCH6iDiWdD1iZ5IbEXed/yJhzFm3jOxDTCBDGnNHZTp8eVbJp0g/fGeG 0aPdKPCRBuQ4Dg1oQAAeevafewT67Zb2i+97fTvofVgT5L+hb6QSymwKJUqvXOiskWoHbAEDKUs Ik+r+bo1nnlZpK4a90Hg2dsHKuTmFgh4j2oZWQO9t76nOpJyVd52ItQTtvOSknDer8PlyMr6No X-Received: by 2002:a05:620a:31a1:b0:914:d348:fd63 with SMTP id af79cd13be357-917f1865d50mr1340162585a.50.1781466531993; Sun, 14 Jun 2026 12:48:51 -0700 (PDT) Received: from localhost.localdomain ([2607:fb90:a8d1:8eec:c0e9:106e:b2e:e8e9]) by smtp.gmail.com with ESMTPSA id af79cd13be357-91619f1c851sm853824785a.16.2026.06.14.12.48.51 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Sun, 14 Jun 2026 12:48:51 -0700 (PDT) From: Shuangpeng Bai To: vaibhavgupta40@gmail.com, jens.taprogge@taprogge.org, gregkh@linuxfoundation.org, kees@kernel.org, industrypack-devel@lists.sourceforge.net, linux-kernel@vger.kernel.org Subject: [BUG] KASAN: slab-use-after-free in ipoctal_write_tty Date: Sun, 14 Jun 2026 15:48:50 -0400 Message-ID: <178144969601.60470.1257088106279546587@gmail.com> X-Mailer: git-send-email 2.47.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Hi Kernel Maintainers, I hit the following report while testing current upstream kernel: KASAN: slab-use-after-free in ipoctal_write_tty on commit: e8c2f9fdadee7cbc75134dc463c1e0d856d6e5c7 (May 25 2026) The reproducer and .config files are here. https://gist.github.com/shuangpengbai/bc71ccd7ce1454abae45897fdde6813b I'm happy to test debug patches or provide additional information. Reported-by: Shuangpeng Bai [ 109.226970][ T8370] BUG: KASAN: slab-use-after-free in ipoctal_write_tty (drivers/ipack/devices/ipoctal.c:446 drivers/ipack/devices/ipoctal.c:465) [ 109.227786][ T8370] Read of size 4 at addr ffff88810539e040 by task ipoctal_fd_afte/8370 [ 109.228633][ T8370] [ 109.228884][ T8370] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 109.228887][ T8370] Call Trace: [ 109.228890][ T8370] [ 109.228892][ T8370] dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) [ 109.228898][ T8370] print_report (mm/kasan/report.c:378 mm/kasan/report.c:482) [ 109.228916][ T8370] kasan_report (mm/kasan/report.c:595) [ 109.228931][ T8370] ipoctal_write_tty (drivers/ipack/devices/ipoctal.c:446 drivers/ipack/devices/ipoctal.c:465) [ 109.228936][ T8370] n_tty_write (drivers/tty/n_tty.c:2388) [ 109.228977][ T8370] file_tty_write (drivers/tty/tty_io.c:1006 drivers/tty/tty_io.c:1081) [ 109.228982][ T8370] vfs_write (fs/read_write.c:595 fs/read_write.c:688) [ 109.229000][ T8370] ksys_write (fs/read_write.c:740) [ 109.229006][ T8370] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) [ 109.229009][ T8370] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) [ 109.229013][ T8370] RIP: 0033:0x7f4626f1a473 [ 109.229017][ T8370] Code: 8b 15 21 2a 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 64 8b 04 25 18 00 00 00 85 c0 75 14 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 55 c3 0f 1f 40 00 48 83 ec 28 48 89 54 24 18 [ 109.229020][ T8370] RSP: 002b:00007ffe7ca57188 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 109.229025][ T8370] RAX: ffffffffffffffda RBX: 0000000000000001 RCX: 00007f4626f1a473 [ 109.229028][ T8370] RDX: 0000000000001000 RSI: 00007ffe7ca571a0 RDI: 0000000000000003 [ 109.229031][ T8370] RBP: 0000000000000003 R08: 0000000000000000 R09: 00007f4626fbe0c0 [ 109.229033][ T8370] R10: fffffffffffff5fb R11: 0000000000000246 R12: 0000000000000000 [ 109.229035][ T8370] R13: 00007ffe7ca571a0 R14: 000000000000000f R15: 00007ffe7ca5719c [ 109.229039][ T8370] [ 109.229041][ T8370] [ 109.253422][ T8370] Freed by task 8370 on cpu 0 at 106.552583s: [ 109.254047][ T8370] kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78) [ 109.254541][ T8370] kasan_save_free_info (mm/kasan/generic.c:584) [ 109.255058][ T8370] __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285) [ 109.255556][ T8370] kfree (include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6566) [ 109.255962][ T8370] device_release_driver_internal (drivers/base/dd.c:619 drivers/base/dd.c:1352 drivers/base/dd.c:1375) [ 109.256595][ T8370] bus_remove_device (drivers/base/bus.c:657) [ 109.257105][ T8370] device_del (drivers/base/core.c:3895) [ 109.257564][ T8370] ipack_unregister_bus_member (drivers/ipack/ipack.c:469 drivers/ipack/ipack.c:231) [ 109.258138][ T8370] bus_for_each_dev (drivers/base/bus.c:383) [ 109.258648][ T8370] ipack_bus_unregister (drivers/ipack/ipack.c:238) [ 109.259164][ T8370] tpci200_pci_remove (drivers/ipack/carriers/tpci200.c:611 drivers/ipack/carriers/tpci200.c:628) [ 109.259678][ T8370] pci_device_remove (drivers/pci/pci-driver.c:512) [ 109.260181][ T8370] device_release_driver_internal (drivers/base/dd.c:619 drivers/base/dd.c:1352 drivers/base/dd.c:1375) [ 109.260812][ T8370] unbind_store (drivers/base/bus.c:244) [ 109.261292][ T8370] kernfs_fop_write_iter (fs/kernfs/file.c:352) [ 109.261840][ T8370] vfs_write (fs/read_write.c:595 fs/read_write.c:688) [ 109.262286][ T8370] ksys_write (fs/read_write.c:740) [ 109.262736][ T8370] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) [ 109.263216][ T8370] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) [ 109.263835][ T8370] [ 109.264082][ T8370] The buggy address belongs to the object at ffff88810539e000 [ 109.264082][ T8370] which belongs to the cache kmalloc-4k of size 4096 [ 109.265511][ T8370] The buggy address is located 64 bytes inside of [ 109.265511][ T8370] freed 4096-byte region [ffff88810539e000, ffff88810539f000) [ 109.266919][ T8370] Best, Shuangpeng