Re: [syzbot] [dm?] KASAN: slab-use-after-free Read in snapshot_ctr

[Hillf Danton <hdanton@sina.com>]

> Date: Sat, 24 Oct 2026 08:49:41 -0700	[thread overview]
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    f47d223627f8 Merge tag 'vfs-7.4-rc1.sync_close' of git://g..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=127202a5580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=97e47414c855a3d8
> dashboard link: https://syzkaller.appspot.com/bug?extid=8e6fc64255334ccf3ab3
> compiler:       Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=16a47f71580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=13edba35580000

#syz test: upstream  f47d223627f8

--- x/drivers/md/dm-table.c
+++ y/drivers/md/dm-table.c
@@ -400,8 +400,8 @@ int dm_get_device(struct dm_target *ti,
 		if (r)
 			return r;
 	}
-	refcount_inc(&dd->count);
 out:
+	refcount_inc(&dd->count);
 	*result = dd->dm_dev;
 	return 0;
 }
--- x/drivers/md/dm-snap.c
+++ y/drivers/md/dm-snap.c
@@ -1390,6 +1390,7 @@ static int snapshot_ctr(struct dm_target
 	if (r)
 		goto bad_read_metadata;
 
+	dm_put_device(ti, s->cow);
 	return 0;
 
 bad_read_metadata:
--