From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv1-f52.google.com (mail-qv1-f52.google.com [209.85.219.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 158DB33CEA5 for ; Sun, 14 Jun 2026 22:25:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.52 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781475915; cv=none; b=EFdU2w4cHPji2z2KQjTF81IwoAKlYvBgKoMgKfTP7eqehOO7XmACvUlxrlCErQaDnUIG/kG/WuAtC4iok4H0/7gU/KUkWM7mB6vY6KLivKddAsVd4wxMmn/t0sV3KXDYy/BIlDkTpfSMxphmRrcXSVimz23bzIHydZsrwqXVq7A= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781475915; c=relaxed/simple; bh=+Lv2p9wIP9EFEfU2eUqwYf4SEv7BSK40JaPUyutaYUs=; h=From:To:Subject:Date:Message-ID:MIME-Version:Content-Type; b=XkolMBn3hr75JoY5PIEO9QjdiHhC4Jr+VkXbe2Tvv2/tzeonbztTL7GXYtKnOIMrwVyswaWrkC6oVoR/2KzmrxmIu4dLTgTc3fsxB/5eKrHNZUgeYWSF51AamXnW9u6jqKhe7uBbHA09Gv2JJQdcpiqsOwgxOaxpBdWdi95Iutc= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=COusgsau; arc=none smtp.client-ip=209.85.219.52 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="COusgsau" Received: by mail-qv1-f52.google.com with SMTP id 6a1803df08f44-8ccf18ef922so41895376d6.3 for ; Sun, 14 Jun 2026 15:25:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781475913; x=1782080713; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:from:to:cc:subject:date:message-id:reply-to; bh=ff7a5JWt0Gvm6RJJjDbcY+1GbrIxaRFH7IFbpay1lUc=; b=COusgsaulFyDBVwev5wbRS3EzJ65R+ZHSUc23gOOgknmDYXjfyG7n+OPOptRSMmmVe UHuj+6MT/VnfnBpycoPq8v3iWtBnkp3tkeIj6ylCAXMVliXnIdrGhZ0Q9TDRj0WU18QB ekDQjJGr6qHurWX4imAn64RkbdHWmuzzTGLq/6P9sPX87n/7e7umB5eWmEaQ++1Jm36z KjbhJ6uswTqE9E5VdB8ldqIC+RTXqKZXFXG71Eje6aaKtTIlynwGi1ShTxBEV08CJWz3 rtFThcyte72pCL2TJqVrSUc3AfzSKgo6nelHrtsA3v2pnelatTVL3ZS4P1JJ+e5EWMCA 0fvg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781475913; x=1782080713; h=content-transfer-encoding:mime-version:message-id:date:subject:to :from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=ff7a5JWt0Gvm6RJJjDbcY+1GbrIxaRFH7IFbpay1lUc=; b=S5uLXfGv2X9lCK4ovMFnydIhpGsQTuymhDvY9pSMprODeTtt3I6uFo9b/e7ey++Oo6 bAKOzsTEWmH7e3V78vzAWE0hUBtxtB1fdBI0aEgLzCZ/amrmI5Nv7Wl4LeY2GxipEzeR oo1bDHn233q/Utdb3ztTWY44wgdjfWzVBapm/9RT2WRoyPnFH4W2I7u6cXfz57iBTGt/ n5Sv/yp4HiAWPgZVK4x1DEznpSlzQ6PAEu+pYz/sTeEBTPu6lV4IfeE+lQlQ3Dd23RLn Ighk7DIiC3JIAksE42aYcIRnerZufSMZv04Wjb+qxCYx3ZICy95mN3DavaxY3FLXBPDo mDUQ== X-Forwarded-Encrypted: i=1; AFNElJ9LquAJsWd1QyOjrwt/Zew7+J5rJN7ChUU0XmOXbHwgPl45RLznwGtBBx59jxgHvtv6TdcFu+ghNtowMpU=@vger.kernel.org X-Gm-Message-State: AOJu0Yyakbt96mX4NMi4E6KoHbFLO9Y1fpe4sjg9e1a82w1yABHid1px p+TQisbpuT79amID82evl+d4tMLr4IT++0d9bMfuVeRtJTlO51D/1+Oi X-Gm-Gg: Acq92OF4hc725Fv/j9cs9naKWql50PfUuTn6/YksYUsoc0r3EUEMowCCvY+VLlS6yMS CNXbJzFvscUTrPHhrN5PunVTi515LFwpLEWm1mRFMmouxx93euTw19ETiL1K3G2ZPeNCRDUdzXF WUmVLwDkUwI1mTiVn2+EkXVqizCSd8o79CndNmUDs3p/rzLOL3TKEufUCnyq66vXQC1T6VpA13P 2yowDCeqmtS+F+JDYzLTt3rJ6NPOO7VHPWlbdehmpK0I943SWItKg+SVppi5XvUg9Nd5Zq0OhHa CKWPRGUI4IePA6AZl1zO95ncv8W+pYFnyRSyShy2PJw06LR7LgS404jWkeNZfCZ6OmkEvtPB72i FccRy2q8aLL6PAydRW1ieQI+Y1VT56OyBSmEu9ahFO64ZkxB8zFlKqYF9yfe0A1kN1x4UljQ7zK f9MhjdeAPMpeq16OaxKVyUNb3QbpYNCN1AKRQ7M/MZ03ZRIJd5kR1xY+vQmQQBbOVE/X9Kz7Z0w g== X-Received: by 2002:a05:6214:194a:b0:8ce:b2e9:a4bf with SMTP id 6a1803df08f44-8d44ce641aemr167032516d6.16.1781475912958; Sun, 14 Jun 2026 15:25:12 -0700 (PDT) Received: from localhost.localdomain ([2607:fb91:14e1:4204:4d87:aacf:f5f1:c2dd]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-8d6fdd815c2sm44447536d6.40.2026.06.14.15.25.12 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Sun, 14 Jun 2026 15:25:12 -0700 (PDT) From: Shuangpeng Bai To: jirislaby@kernel.org, arnd@arndb.de, gregkh@linuxfoundation.org, linux-kernel@vger.kernel.org Subject: [BUG] KASAN: slab-use-after-free in phantom_poll Date: Sun, 14 Jun 2026 18:25:10 -0400 Message-ID: <178144969601.60470.17668056448395653027@gmail.com> X-Mailer: git-send-email 2.47.1 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Hi Kernel Maintainers, I hit the following report while testing current upstream kernel: KASAN: slab-use-after-free in phantom_poll I reproduced this on commit: e8c2f9fdadee7cbc75134dc463c1e0d856d6e5c7 (May 25 2026) The reproducer and .config files are here. https://gist.github.com/shuangpengbai/9ebd2c068afd887ba91fcb77f312d6e4 I'm happy to test debug patches or provide additional information. Reported-by: Shuangpeng Bai [ 175.822967][ T8426] BUG: KASAN: slab-use-after-free in phantom_poll (drivers/misc/phantom.c:266) [ 175.827261][ T8426] Read of size 8 at addr ffff888124e23020 by task phantom_old_fd_/8426 [ 175.828414][ T8426] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 175.828418][ T8426] Call Trace: [ 175.828422][ T8426] [ 175.828425][ T8426] dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) [ 175.828433][ T8426] print_report (mm/kasan/report.c:378 mm/kasan/report.c:482) [ 175.828445][ T8426] kasan_report (mm/kasan/report.c:595) [ 175.828452][ T8426] phantom_poll (drivers/misc/phantom.c:266) [ 175.828456][ T8426] do_sys_poll (include/linux/poll.h:82 fs/select.c:877 fs/select.c:920 fs/select.c:1015) [ 175.829625][ T8426] __x64_sys_poll (fs/select.c:1072 fs/select.c:1060 fs/select.c:1060) [ 175.829637][ T8426] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) [ 175.829641][ T8426] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) [ 175.829673][ T8426] [ 175.857686][ T8426] Freed by task 8426 on cpu 0 at 175.821282s: [ 175.858322][ T8426] kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78) [ 175.858811][ T8426] kasan_save_free_info (mm/kasan/generic.c:584) [ 175.859338][ T8426] __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285) [ 175.859831][ T8426] kfree (include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6566) [ 175.860237][ T8426] phantom_remove (drivers/misc/phantom.c:453) [ 175.860721][ T8426] pci_device_remove (drivers/pci/pci-driver.c:512) [ 175.861226][ T8426] device_release_driver_internal (drivers/base/dd.c:619 drivers/base/dd.c:1352 drivers/base/dd.c:1375) [ 175.861849][ T8426] unbind_store (drivers/base/bus.c:244) [ 175.862325][ T8426] kernfs_fop_write_iter (fs/kernfs/file.c:352) [ 175.862872][ T8426] vfs_write (fs/read_write.c:595 fs/read_write.c:688) [ 175.863323][ T8426] ksys_write (fs/read_write.c:740) [ 175.863774][ T8426] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) [ 175.864261][ T8426] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121) [ 175.865117][ T8426] The buggy address belongs to the object at ffff888124e23000 [ 175.865117][ T8426] which belongs to the cache kmalloc-256 of size 256 [ 175.866544][ T8426] The buggy address is located 32 bytes inside of [ 175.866544][ T8426] freed 256-byte region [ffff888124e23000, ffff888124e23100) Best, Shuangpeng