From: Peter Zijlstra <peterz@infradead.org>
To: 王志 <wangzhi_xd@stu.xidian.edu.cn>
Cc: linux-crypto@vger.kernel.org, qat-linux@intel.com,
syzkaller-bugs@googlegroups.com, security@kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: [syzbot] BUG: KASAN: slab-use-after-free in mutex_optimistic_spin via adf_ctl_ioctl
Date: Thu, 8 Jan 2026 12:24:11 +0100 [thread overview]
Message-ID: <20260108112411.GI272712@noisy.programming.kicks-ass.net> (raw)
In-Reply-To: <7b50a9a8.abb1.19b9b902fae.Coremail.wangzhi_xd@stu.xidian.edu.cn>
On Thu, Jan 08, 2026 at 11:04:36AM +0800, 王志 wrote:
> syzbot has found the following issue on:
>
> HEAD commit: 6.18.0 (custom build)
> git tree: linux-stable
> console output: (see below)
> kernel config: (attached)
>
> ---
>
> QAT: failed to copy from user cfg_data.
> c6xxvf 0000:00:05.0: Starting acceleration device qat_dev0.
> ==================================================================
> BUG: KASAN: slab-use-after-free in owner_on_cpu home/wmy/Fuzzer/third_tool/linux-6.18/include/linux/sched.h:2282 [inline]
> BUG: KASAN: slab-use-after-free in mutex_can_spin_on_owner home/wmy/Fuzzer/third_tool/linux-6.18/kernel/locking/mutex.c:397 [inline]
> BUG: KASAN: slab-use-after-free in mutex_optimistic_spin home/wmy/Fuzzer/third_tool/linux-6.18/kernel/locking/mutex.c:440 [inline]
> BUG: KASAN: slab-use-after-free in __mutex_lock_common home/wmy/Fuzzer/third_tool/linux-6.18/kernel/locking/mutex.c:602 [inline]
> BUG: KASAN: slab-use-after-free in __mutex_lock+0xd0a/0x1160 home/wmy/Fuzzer/third_tool/linux-6.18/kernel/locking/mutex.c:760
> Allocated by task 150:
> getname_flags.part.0+0x50/0x560 home/wmy/Fuzzer/third_tool/linux-6.18/fs/namei.c:146
> getname_flags+0x9a/0xe0 home/wmy/Fuzzer/third_tool/linux-6.18/include/linux/audit.h:345
> getname home/wmy/Fuzzer/third_tool/linux-6.18/include/linux/fs.h:2924 [inline]
>
> Freed by task 150:
> putname.part.0+0x120/0x160 home/wmy/Fuzzer/third_tool/linux-6.18/fs/namei.c:297
> putname+0x41/0x50 home/wmy/Fuzzer/third_tool/linux-6.18/include/linux/err.h:84
> The buggy address belongs to the object at ffff888104e04400
> which belongs to the cache names_cache of size 4096
So how again is mutex->owner a names_cache object? This seems to suggest
something has gone terribly wrong somewhere.
next prev parent reply other threads:[~2026-01-08 11:24 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-01-08 3:04 王志
2026-01-08 11:24 ` Peter Zijlstra [this message]
-- strict thread matches above, loose matches on Subject: below --
2026-01-08 2:56 王志
2026-01-08 5:14 ` Hillf Danton
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260108112411.GI272712@noisy.programming.kicks-ass.net \
--to=peterz@infradead.org \
--cc=linux-crypto@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=qat-linux@intel.com \
--cc=security@kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
--cc=wangzhi_xd@stu.xidian.edu.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®