Re: [syzbot] [fs?] KASAN: slab-use-after-free Read in reverse_path_check_proc

[Hillf Danton <hdanton@sina.com>]

> Date: Fri, 22 May 2026 12:48:27 -0700	[thread overview]
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    80dd246accce Add linux-next specific files for 20260518
> git tree:       linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=113cba73980000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=2a0b5969e136a632
> dashboard link: https://syzkaller.appspot.com/bug?extid=e70e1b6cba8714543f7c
> compiler:       Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=14dc9fba580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=10bffcc8580000

#syz test

--- x/fs/eventpoll.c
+++ y/fs/eventpoll.c
@@ -456,14 +456,21 @@ static struct kmem_cache *pwq_cache __ro
 struct epitems_head {
 	struct hlist_head epitems;
 	struct epitems_head *next;
+	struct rcu_head rcu;
 };
 
 static struct kmem_cache *ephead_cache __ro_after_init;
 
+static void __free_ephead(struct rcu_head *r)
+{
+	struct epitems_head *head = container_of(r, struct epitems_head, rcu);
+	kmem_cache_free(ephead_cache, head);
+}
+
 static inline void free_ephead(struct epitems_head *head)
 {
 	if (head)
-		kmem_cache_free(ephead_cache, head);
+		call_rcu(&head->rcu, __free_ephead);
 }
 
 static void list_file(struct file *file, struct ep_ctl_ctx *ctx)
--