From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv1-f42.google.com (mail-qv1-f42.google.com [209.85.219.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 65C9725B09C for ; Fri, 31 Jul 2026 20:45:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.42 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785530719; cv=none; b=FspqPNZPeRyjdpTa2Mh1C/+K2mDq0kXg9+02VpSDQgkiW8C0FLmHTbh1uYPli8VxDcp9jlDZ2Zt69WEn1biS0JbinKhXlyJQrFv++WOzd324m5jNv8sAdU69iJVMZVcJ5Qw+WIxJKns9z4RUY/Rf6vn9Bl2MdXGY4P7FtCsZ/jw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785530719; c=relaxed/simple; bh=+tfra3n8YK5LXGbuVxyQfpPFvfsUtRKvvq6nvre9Fwk=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=kCmUinVOyQZBXikas03W5R4rapxtly7JUpiW1wmqZNbOIrZUANi6HNtFzaQnM6UZ7PbdrkNzGh12YUdjOFUEck/cHd7poxH1xDbBilDTNFwRU6TjR0dslgLzi3wBe4F4CL95VpIeb9Kk+Tl6JOj+hdaZYByvJir9D/DrPe4/CqM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=SggvC8wP; arc=none smtp.client-ip=209.85.219.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="SggvC8wP" Received: by mail-qv1-f42.google.com with SMTP id 6a1803df08f44-9034b6b7674so9685736d6.0 for ; Fri, 31 Jul 2026 13:45:18 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785530717; x=1786135517; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=xATEhxPNQxKXaG8sP+LX++AZXbUnFoZsLWamigGd8LI=; b=SggvC8wPxgmG2P62yPca1nklZqBMV3XU1rcnFhkWs+Jmg5Gwq9hMSZDageZECE7kGO p1ZlrKHO+Cb4GCeAdnXsoI/gDGuG1GdrFi6fQHOrvdDBaGWgW1iZw6mNS+7pesQtHKqj iGLwXvlDAeLFttBpvqIqCWYQQaWfNj6nldpJ3/qKdUcYEolvPUoIGuqobtk90pePfdTV wDJLnrzhf9hngZDSVCCavBLEFNmGm8qOl6uMgcKR7PWdMFSrEdHiB26xkVzxoRZmbzTY 11o26h3Oyn/auVmxz0yOlBAvKtJmB1/gECK4UyeXWHGnluDNq8DBvEEsPEiK5ntraz3i 9Owg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785530717; x=1786135517; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=xATEhxPNQxKXaG8sP+LX++AZXbUnFoZsLWamigGd8LI=; b=qszyq9m2/lFS/xLP9GUYGfOx5/HH1uczU9zp1rp5SuGVJJnEtRrIUxkG+p8uPt6mHJ GqPJ9KCLWezsT8XAWknI0eZziGSXMztqOZTBx1y20sz+/X6pUFIID2oqIp0nHf/A8vLP 43JH1TToeIzQBZxMwDK7lq3pQgeF1/uih6WKlhE+r0L8YWIZShXCsWo8F32brCh4RPxU OAB0eEJ75yfcOMc9he4lTYhU60O/wAaEfBIoyqfeK1K7uKI+z3cDC8/10tb05Ew8O9Xq b67sNcsu/benuq2oc5QRsaA3MY/biVKj8ssfRyHTON7LgmPnG2IjgegLupN3FX13aEcO HCPg== X-Forwarded-Encrypted: i=1; AHgh+RojVWW1ZRvyMM02J6a+NMC9AHQn3h35ywsPhhFaqDvc2sQyJaTp7ywm02zyL+NuL/3WJg7Cua80d9qQkEo=@vger.kernel.org X-Gm-Message-State: AOJu0Ywbqs2RIyFmAYpkiw8qUtUmQ9n5DiWVzpvAZ7BVB7d0w+kaER6W crLiRYQVTF9YvyzVunT0M1m85WZukiGANYwuwR503bVXvMCNkVBLxsIw X-Gm-Gg: AR+sD13CZlZpjuzfKw4/3gNP36OrNNkaxr9VhHoKkosRBAipG0FhmNpQzmr5KBN7dcc K0A1bvY7aJ34SN7Xn3scMAmWdD4o5M3OmjG+hPingnoNZbig9uIEw0KFf1x4m37ydhTXD6LruE9 BVVkjLgdv0euhWRl1QWP5zUPkeXQii7DbagjERrfJIrnGdk/ITy7Hn+dP4nBC863usoECyZ8zh0 l0iazgvo32wIcdeuWu8OhITufs6Cc0QGYe4vc/eeLMtadDXcxstRCLzvD/kYgHu3jRdqfIKT3B7 TnIlhHCAUax8+F/pKazVfNUU4JwZSMKTBSVtvegUnICGFLLrQKlt9XSnGxhghDSMGkuAB7r0Y1j k2OZnYlvlwSyFnI4ueP0rSicg2ALe6ANeQfaQVcH9p10kXNADM1lDfLRTPawf06oEWN/UktLl83 XoTL3WUIegaoenvkWdLCJQbSVEyjFIiSMXgjvXDaDgk8ikT5fNO90UKniRdcKBLbJVNz++dU4Xw 2N7kt6fH2SUsoL2Dg== X-Received: by 2002:ad4:5944:0:b0:8f1:323a:fc45 with SMTP id 6a1803df08f44-908495fbc7dmr21340776d6.15.1785530717136; Fri, 31 Jul 2026 13:45:17 -0700 (PDT) Received: from i4-l-hqh5357-03.ad.psu.edu ([130.203.139.71]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-908435def8fsm18173676d6.38.2026.07.31.13.45.16 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 31 Jul 2026 13:45:16 -0700 (PDT) From: Shuangpeng Bai To: Justin Tee , Naresh Gottumukkala , Paul Ely , Christoph Hellwig , Sagi Grimberg , Chaitanya Kulkarni Cc: Shuangpeng Bai , linux-nvme@lists.infradead.org, linux-kernel@vger.kernel.org Subject: [BUG] nvmet-fc: KASAN: slab-use-after-free in nvmet_fc_handle_ls_rqst_work Date: Fri, 31 Jul 2026 16:44:47 -0400 Message-ID: <20260731204504.2396434-1-shuangpeng.kernel@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Hi Kernel Maintainers, I hit the following report while testing current upstream kernel: KASAN: slab-use-after-free in nvmet_fc_handle_ls_rqst_work on commit: 0d6269a4f6059d185d9f7e3efe7b58f8c0d9faf3 (2026-07-27) To help trigger the bug more reliably, we applied a minimal diagnostic patch that only adds a delay and a printk. The reproducer and .config files are here. https://gist.github.com/shuangpengbai/47cf6fb1b80e28f3c30a372333d1151e I'm happy to test debug patches or provide additional information. Reported-by: Shuangpeng Bai [ 405.999314][ T1167] BUG: KASAN: slab-use-after-free in nvmet_fc_handle_ls_rqst_work (drivers/nvme/target/fc.c:193 drivers/nvme/target/fc.c:1841 drivers/nvme/target/fc.c:1995 drivers/nvme/target/fc.c:2021) [ 406.000605][ T1167] Read of size 8 at addr ffff888179f1b000 by task kworker/u9:2/1167 [ 406.001734][ T1167] [ 406.002128][ T1167] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 406.002134][ T1167] Workqueue: nvmet-wq nvmet_fc_handle_ls_rqst_work [ 406.002165][ T1167] Call Trace: [ 406.002182][ T1167] [ 406.002187][ T1167] dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) [ 406.002201][ T1167] print_report (mm/kasan/report.c:378 mm/kasan/report.c:482) [ 406.002220][ T1167] kasan_report (mm/kasan/report.c:595) [ 406.002232][ T1167] nvmet_fc_handle_ls_rqst_work (drivers/nvme/target/fc.c:193 drivers/nvme/target/fc.c:1841 drivers/nvme/target/fc.c:1995 drivers/nvme/target/fc.c:2021) [ 406.002238][ T1167] process_scheduled_works (kernel/workqueue.c:3322 kernel/workqueue.c:3405) [ 406.002250][ T1167] worker_thread (kernel/workqueue.c:3486) [ 406.002280][ T1167] kthread (kernel/kthread.c:436) [ 406.002296][ T1167] ret_from_fork (archkernel/process.c:158) [ 406.002320][ T1167] ret_from_fork_asm (arch/x86/entry/entry_64.S:245) [ 406.002328][ T1167] [ 406.002330][ T1167] [ 406.020787][ T1167] Freed by task 1167 on cpu 0 at 405.998150s: [ 406.021660][ T1167] kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78) [ 406.022343][ T1167] kasan_save_free_info (mm/kasan/generic.c:584) [ 406.023069][ T1167] __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285) [ 406.023749][ T1167] kfree (include/linux/kasan.h:235 mm/slub.c:2705 mm/slub.c:6405 mm/slub.c:6720) [ 406.024312][ T1167] nvmet_fc_handle_ls_rqst_work (drivers/nvme/target/fc.c:1808 drivers/nvme/target/fc.c:1995 drivers/nvme/target/fc.c:2021) [ 406.025172][ T1167] process_scheduled_works (kernel/workqueue.c:3322 kernel/workqueue.c:3405) [ 406.025972][ T1167] worker_thread (kernel/workqueue.c:3486) [ 406.026653][ T1167] kthread (kernel/kthread.c:436) [ 406.027248][ T1167] ret_from_fork (archkernel/process.c:158) [ 406.027931][ T1167] ret_from_fork_asm (arch/x86/entry/entry_64.S:245) [ 406.028638][ T1167] [ 406.028989][ T1167] The buggy address belongs to the object at ffff888179f1b000 [ 406.028989][ T1167] which belongs to the cache kmalloc-2k of size 2048 [ 406.031005][ T1167] The buggy address is located 0 bytes inside of [ 406.031005][ T1167] freed 2048-byte region [ffff888179f1b000, ffff888179f1b800) Best, Shuangpeng