* [BUG] KASAN: slab-use-after-free in au0828_dvb_register @ 2026-05-29 0:17 Shuangpeng 2026-05-29 8:30 ` xiaopeitux 0 siblings, 1 reply; 8+ messages in thread From: Shuangpeng @ 2026-05-29 0:17 UTC (permalink / raw) To: mchehab, mingo, hverkuil+cisco, tglx, brad; +Cc: linux-media, linux-kernel Hi Kernel Maintainers, We hit the following KASAN report while testing current upstream kernel: KASAN: slab-use-after-free in au0828_dvb_register on commit: e8c2f9fdadee7cbc75134dc463c1e0d856d6e5c7 (May 25 2026) The reproducer and .config files are here. https://gist.github.com/shuangpengbai/c31163f8ef234ba4fe85038c2f97f9cc I’m happy to test debug patches or provide additional information. Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com> [ 141.481576][ T48] ================================================================== [ 141.482348][ T48] BUG: KASAN: slab-use-after-free in au0828_dvb_register (drivers/media/usb/au0828/au0828-dvb.c:636) [ 141.483148][ T48] Read of size 8 at addr ffff888171d4a118 by task kworker/1:1/48 [ 141.483903][ T48] [ 141.484144][ T48] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.34 [ 141.484148][ T48] Workqueue: usb_hub_wq hub_event [ 141.484154][ T48] Call Trace: [ 141.484157][ T48] <TASK> [ 141.484159][ T48] dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) [ 141.484164][ T48] print_report (mm/kasan/report.c:378 mm/kasan/report.c:482) [ 141.484177][ T48] kasan_report (mm/kasan/report.c:595) [ 141.484183][ T48] au0828_dvb_register (drivers/media/usb/au0828/au0828-dvb.c:636) [ 141.484190][ T48] au0828_usb_probe (drivers/media/usb/au0828/au0828-core.c:733) [ 141.484193][ T48] usb_probe_interface (drivers/usb/core/driver.c:396) [ 141.484198][ T48] really_probe (drivers/base/dd.c:? drivers/base/dd.c:709) [ 141.484204][ T48] __driver_probe_device (drivers/base/dd.c:871) [ 141.484207][ T48] driver_probe_device (drivers/base/dd.c:901) [ 141.484211][ T48] __device_attach_driver (drivers/base/dd.c:1029) [ 141.484217][ T48] bus_for_each_drv (drivers/base/bus.c:500) [ 141.484264][ T48] __device_attach (drivers/base/dd.c:1101) [ 141.484289][ T48] device_initial_probe (drivers/base/dd.c:1156) [ 141.484292][ T48] bus_probe_device (drivers/base/bus.c:613) [ 141.484296][ T48] device_add (drivers/base/core.c:3706) [ 141.484299][ T48] usb_set_configuration (drivers/usb/core/message.c:2268) [ 141.484303][ T48] usb_generic_driver_probe (drivers/usb/core/generic.c:250) [ 141.484308][ T48] usb_probe_device (drivers/usb/core/driver.c:291) [ 141.484311][ T48] really_probe (drivers/base/dd.c:? drivers/base/dd.c:709) [ 141.484315][ T48] __driver_probe_device (drivers/base/dd.c:871) [ 141.484318][ T48] driver_probe_device (drivers/base/dd.c:901) [ 141.484321][ T48] __device_attach_driver (drivers/base/dd.c:1029) [ 141.484328][ T48] bus_for_each_drv (drivers/base/bus.c:500) [ 141.484346][ T48] __device_attach (drivers/base/dd.c:1101) [ 141.484367][ T48] device_initial_probe (drivers/base/dd.c:1156) [ 141.484370][ T48] bus_probe_device (drivers/base/bus.c:613) [ 141.484374][ T48] device_add (drivers/base/core.c:3706) [ 141.484376][ T48] usb_new_device (drivers/usb/core/hub.c:2695) [ 141.484386][ T48] hub_event (drivers/usb/core/hub.c:5567 drivers/usb/core/hub.c:5707 drivers/usb/core/hub.c:5871 drivers/usb/core/hub.c:5953) [ 141.484406][ T48] process_scheduled_works (kernel/workqueue.c:3314 kernel/workqueue.c:3397) [ 141.484412][ T48] worker_thread (kernel/workqueue.c:3478) [ 141.484420][ T48] kthread (kernel/kthread.c:436) [ 141.484431][ T48] ret_from_fork (arch/x86/kernel/process.c:158) [ 141.484445][ T48] ret_from_fork_asm (arch/x86/entry/entry_64.S:245) [ 141.484450][ T48] </TASK> [ 141.484451][ T48] [ 141.523531][ T48] Freed by task 48 on cpu 1 at 141.481575s: [ 141.524120][ T48] kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78) [ 141.524594][ T48] kasan_save_free_info (mm/kasan/generic.c:584) [ 141.525089][ T48] __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285) [ 141.525570][ T48] kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6566) [ 141.525957][ T48] au8522_release_state (drivers/media/dvb-frontends/au8522_common.c:124) [ 141.526467][ T48] dvb_frontend_put (drivers/media/dvb-core/dvb_frontend.c:3093 drivers/media/dvb-core/dvb_frontend.c:141 drivers/media/dvb-core/dvb_frontend.c:166) [ 141.526957][ T48] au0828_dvb_register (drivers/media/usb/au0828/au0828-dvb.c:518 drivers/media/usb/au0828/au0828-dvb.c:634) [ 141.527469][ T48] au0828_usb_probe (drivers/media/usb/au0828/au0828-core.c:733) [ 141.527952][ T48] usb_probe_interface (drivers/usb/core/driver.c:396) [ 141.528455][ T48] really_probe (drivers/base/dd.c:? drivers/base/dd.c:709) [ 141.528908][ T48] __driver_probe_device (drivers/base/dd.c:871) [ 141.529426][ T48] driver_probe_device (drivers/base/dd.c:901) [ 141.529932][ T48] __device_attach_driver (drivers/base/dd.c:1029) [ 141.530459][ T48] bus_for_each_drv (drivers/base/bus.c:500) [ 141.530949][ T48] __device_attach (drivers/base/dd.c:1101) [ 141.531419][ T48] device_initial_probe (drivers/base/dd.c:1156) [ 141.531923][ T48] bus_probe_device (drivers/base/bus.c:613) [ 141.532404][ T48] device_add (drivers/base/core.c:3706) [ 141.532840][ T48] usb_set_configuration (drivers/usb/core/message.c:2268) [ 141.533373][ T48] usb_generic_driver_probe (drivers/usb/core/generic.c:250) [ 141.533907][ T48] usb_probe_device (drivers/usb/core/driver.c:291) [ 141.534377][ T48] really_probe (drivers/base/dd.c:? drivers/base/dd.c:709) [ 141.534833][ T48] __driver_probe_device (drivers/base/dd.c:871) [ 141.535352][ T48] driver_probe_device (drivers/base/dd.c:901) [ 141.535856][ T48] __device_attach_driver (drivers/base/dd.c:1029) [ 141.536384][ T48] bus_for_each_drv (drivers/base/bus.c:500) [ 141.536869][ T48] __device_attach (drivers/base/dd.c:1101) [ 141.537340][ T48] device_initial_probe (drivers/base/dd.c:1156) [ 141.537839][ T48] bus_probe_device (drivers/base/bus.c:613) [ 141.538320][ T48] device_add (drivers/base/core.c:3706) [ 141.538753][ T48] usb_new_device (drivers/usb/core/hub.c:2695) [ 141.539226][ T48] hub_event (drivers/usb/core/hub.c:5567 drivers/usb/core/hub.c:5707 drivers/usb/core/hub.c:5871 drivers/usb/core/hub.c:5953) [ 141.539672][ T48] process_scheduled_works (kernel/workqueue.c:3314 kernel/workqueue.c:3397) [ 141.540205][ T48] worker_thread (kernel/workqueue.c:3478) [ 141.540666][ T48] kthread (kernel/kthread.c:436) [ 141.541069][ T48] ret_from_fork (arch/x86/kernel/process.c:158) [ 141.541524][ T48] ret_from_fork_asm (arch/x86/entry/entry_64.S:245) [ 141.541999][ T48] [ 141.542236][ T48] The buggy address belongs to the object at ffff888171d4a000 [ 141.542236][ T48] which belongs to the cache kmalloc-4k of size 4096 [ 141.543602][ T48] The buggy address is located 280 bytes inside of [ 141.543602][ T48] freed 4096-byte region [ffff888171d4a000, ffff888171d4b000) Best, Shuangpeng ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re:[BUG] KASAN: slab-use-after-free in au0828_dvb_register 2026-05-29 0:17 [BUG] KASAN: slab-use-after-free in au0828_dvb_register Shuangpeng @ 2026-05-29 8:30 ` xiaopeitux 2026-05-29 19:22 ` [BUG] " Shuangpeng 0 siblings, 1 reply; 8+ messages in thread From: xiaopeitux @ 2026-05-29 8:30 UTC (permalink / raw) To: shuangpeng.kernel Cc: brad, hverkuil+cisco, linux-kernel, linux-media, mchehab, mingo, tglx, Pei Xiao From: Pei Xiao <xiaopei01@kylinos.cn> > Hi Kernel Maintainers, > > We hit the following KASAN report while testing current upstream kernel: > > KASAN: slab-use-after-free in au0828_dvb_register > > on commit: e8c2f9fdadee7cbc75134dc463c1e0d856d6e5c7 (May 25 2026) > > The reproducer and .config files are here. > https://gist.github.com/shuangpengbai/c31163f8ef234ba4fe85038c2f97f9cc > > I’m happy to test debug patches or provide additional information. > > Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com> Can you help post all the crash logs? Does the kernel log have this print: "The frontend of your DVB/ATSC card isn't supported yet." Please help post all the logs, thank you! > > > [ 141.481576][ T48] ================================================================== > [ 141.482348][ T48] BUG: KASAN: slab-use-after-free in au0828_dvb_register (drivers/media/usb/au0828/au0828-dvb.c:636) > [ 141.483148][ T48] Read of size 8 at addr ffff888171d4a118 by task kworker/1:1/48 > [ 141.483903][ T48] > [ 141.484144][ T48] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.34 > [ 141.484148][ T48] Workqueue: usb_hub_wq hub_event > [ 141.484154][ T48] Call Trace: > [ 141.484157][ T48] <TASK> > [ 141.484159][ T48] dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) > [ 141.484164][ T48] print_report (mm/kasan/report.c:378 mm/kasan/report.c:482) > [ 141.484177][ T48] kasan_report (mm/kasan/report.c:595) > [ 141.484183][ T48] au0828_dvb_register (drivers/media/usb/au0828/au0828-dvb.c:636) > [ 141.484190][ T48] au0828_usb_probe (drivers/media/usb/au0828/au0828-core.c:733) > [ 141.484193][ T48] usb_probe_interface (drivers/usb/core/driver.c:396) > [ 141.484198][ T48] really_probe (drivers/base/dd.c:? drivers/base/dd.c:709) > [ 141.484204][ T48] __driver_probe_device (drivers/base/dd.c:871) > [ 141.484207][ T48] driver_probe_device (drivers/base/dd.c:901) > [ 141.484211][ T48] __device_attach_driver (drivers/base/dd.c:1029) > [ 141.484217][ T48] bus_for_each_drv (drivers/base/bus.c:500) > [ 141.484264][ T48] __device_attach (drivers/base/dd.c:1101) > [ 141.484289][ T48] device_initial_probe (drivers/base/dd.c:1156) > [ 141.484292][ T48] bus_probe_device (drivers/base/bus.c:613) > [ 141.484296][ T48] device_add (drivers/base/core.c:3706) > [ 141.484299][ T48] usb_set_configuration (drivers/usb/core/message.c:2268) > [ 141.484303][ T48] usb_generic_driver_probe (drivers/usb/core/generic.c:250) > [ 141.484308][ T48] usb_probe_device (drivers/usb/core/driver.c:291) > [ 141.484311][ T48] really_probe (drivers/base/dd.c:? drivers/base/dd.c:709) > [ 141.484315][ T48] __driver_probe_device (drivers/base/dd.c:871) > [ 141.484318][ T48] driver_probe_device (drivers/base/dd.c:901) > [ 141.484321][ T48] __device_attach_driver (drivers/base/dd.c:1029) > [ 141.484328][ T48] bus_for_each_drv (drivers/base/bus.c:500) > [ 141.484346][ T48] __device_attach (drivers/base/dd.c:1101) > [ 141.484367][ T48] device_initial_probe (drivers/base/dd.c:1156) > [ 141.484370][ T48] bus_probe_device (drivers/base/bus.c:613) > [ 141.484374][ T48] device_add (drivers/base/core.c:3706) > [ 141.484376][ T48] usb_new_device (drivers/usb/core/hub.c:2695) > [ 141.484386][ T48] hub_event (drivers/usb/core/hub.c:5567 drivers/usb/core/hub.c:5707 drivers/usb/core/hub.c:5871 drivers/usb/core/hub.c:5953) > [ 141.484406][ T48] process_scheduled_works (kernel/workqueue.c:3314 kernel/workqueue.c:3397) > [ 141.484412][ T48] worker_thread (kernel/workqueue.c:3478) > [ 141.484420][ T48] kthread (kernel/kthread.c:436) > [ 141.484431][ T48] ret_from_fork (arch/x86/kernel/process.c:158) > [ 141.484445][ T48] ret_from_fork_asm (arch/x86/entry/entry_64.S:245) > [ 141.484450][ T48] </TASK> > [ 141.484451][ T48] > [ 141.523531][ T48] Freed by task 48 on cpu 1 at 141.481575s: > [ 141.524120][ T48] kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78) > [ 141.524594][ T48] kasan_save_free_info (mm/kasan/generic.c:584) > [ 141.525089][ T48] __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285) > [ 141.525570][ T48] kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6566) > [ 141.525957][ T48] au8522_release_state (drivers/media/dvb-frontends/au8522_common.c:124) > [ 141.526467][ T48] dvb_frontend_put (drivers/media/dvb-core/dvb_frontend.c:3093 drivers/media/dvb-core/dvb_frontend.c:141 drivers/media/dvb-core/dvb_frontend.c:166) > [ 141.526957][ T48] au0828_dvb_register (drivers/media/usb/au0828/au0828-dvb.c:518 drivers/media/usb/au0828/au0828-dvb.c:634) > [ 141.527469][ T48] au0828_usb_probe (drivers/media/usb/au0828/au0828-core.c:733) > [ 141.527952][ T48] usb_probe_interface (drivers/usb/core/driver.c:396) > [ 141.528455][ T48] really_probe (drivers/base/dd.c:? drivers/base/dd.c:709) > [ 141.528908][ T48] __driver_probe_device (drivers/base/dd.c:871) > [ 141.529426][ T48] driver_probe_device (drivers/base/dd.c:901) > [ 141.529932][ T48] __device_attach_driver (drivers/base/dd.c:1029) > [ 141.530459][ T48] bus_for_each_drv (drivers/base/bus.c:500) > [ 141.530949][ T48] __device_attach (drivers/base/dd.c:1101) > [ 141.531419][ T48] device_initial_probe (drivers/base/dd.c:1156) > [ 141.531923][ T48] bus_probe_device (drivers/base/bus.c:613) > [ 141.532404][ T48] device_add (drivers/base/core.c:3706) > [ 141.532840][ T48] usb_set_configuration (drivers/usb/core/message.c:2268) > [ 141.533373][ T48] usb_generic_driver_probe (drivers/usb/core/generic.c:250) > [ 141.533907][ T48] usb_probe_device (drivers/usb/core/driver.c:291) > [ 141.534377][ T48] really_probe (drivers/base/dd.c:? drivers/base/dd.c:709) > [ 141.534833][ T48] __driver_probe_device (drivers/base/dd.c:871) > [ 141.535352][ T48] driver_probe_device (drivers/base/dd.c:901) > [ 141.535856][ T48] __device_attach_driver (drivers/base/dd.c:1029) > [ 141.536384][ T48] bus_for_each_drv (drivers/base/bus.c:500) > [ 141.536869][ T48] __device_attach (drivers/base/dd.c:1101) > [ 141.537340][ T48] device_initial_probe (drivers/base/dd.c:1156) > [ 141.537839][ T48] bus_probe_device (drivers/base/bus.c:613) > [ 141.538320][ T48] device_add (drivers/base/core.c:3706) > [ 141.538753][ T48] usb_new_device (drivers/usb/core/hub.c:2695) > [ 141.539226][ T48] hub_event (drivers/usb/core/hub.c:5567 drivers/usb/core/hub.c:5707 drivers/usb/core/hub.c:5871 drivers/usb/core/hub.c:5953) > [ 141.539672][ T48] process_scheduled_works (kernel/workqueue.c:3314 kernel/workqueue.c:3397) > [ 141.540205][ T48] worker_thread (kernel/workqueue.c:3478) > [ 141.540666][ T48] kthread (kernel/kthread.c:436) > [ 141.541069][ T48] ret_from_fork (arch/x86/kernel/process.c:158) > [ 141.541524][ T48] ret_from_fork_asm (arch/x86/entry/entry_64.S:245) > [ 141.541999][ T48] > [ 141.542236][ T48] The buggy address belongs to the object at ffff888171d4a000 > [ 141.542236][ T48] which belongs to the cache kmalloc-4k of size 4096 > [ 141.543602][ T48] The buggy address is located 280 bytes inside of > [ 141.543602][ T48] freed 4096-byte region [ffff888171d4a000, ffff888171d4b000) ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [BUG] KASAN: slab-use-after-free in au0828_dvb_register 2026-05-29 8:30 ` xiaopeitux @ 2026-05-29 19:22 ` Shuangpeng 2026-06-01 1:18 ` Pei Xiao 2026-06-01 3:38 ` Pei Xiao 0 siblings, 2 replies; 8+ messages in thread From: Shuangpeng @ 2026-05-29 19:22 UTC (permalink / raw) To: xiaopeitux Cc: brad, hverkuil+cisco, linux-kernel, linux-media, mchehab, mingo, tglx, Pei Xiao > On May 29, 2026, at 04:30, xiaopeitux@foxmail.com wrote: > > From: Pei Xiao <xiaopei01@kylinos.cn> > >> Hi Kernel Maintainers, >> >> We hit the following KASAN report while testing current upstream kernel: >> >> KASAN: slab-use-after-free in au0828_dvb_register >> >> on commit: e8c2f9fdadee7cbc75134dc463c1e0d856d6e5c7 (May 25 2026) >> >> The reproducer and .config files are here. >> https://gist.github.com/shuangpengbai/c31163f8ef234ba4fe85038c2f97f9cc >> >> I’m happy to test debug patches or provide additional information. >> >> Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com> > Can you help post all the crash logs? > Does the kernel log have this print: > "The frontend of your DVB/ATSC card isn't supported yet." I did not see this message in log. > Please help post all the logs, thank you! Thank you for taking a look. All terminal outputs after running the reproducer: [ 64.807294][ T42] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 64.958989][ T42] usb 3-1: New USB device found, idVendor=0fe9, idProduct=d620, bcdDevice= 1.00 [ 64.961560][ T42] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 65.351442][ T42] au0828: i2c bus registered [ 65.634777][ T42] au8522 1-0047: creating new instance [ 65.655406][ T42] DVB: Unable to find symbol xc5000_attach() [ 65.656022][ T42] dvbdev: DVB: registering new adapter (au0828) [ 65.656632][ T42] au0828: dvb_register_frontend failed (errno = -12) [ 65.658957][ T42] au8522 1-0047: destroying instance [ 65.659499][ T42] ================================================================== [ 65.660261][ T42] BUG: KASAN: slab-use-after-free in au0828_dvb_register+0x1280/0x15f0 [ 65.661023][ T42] Read of size 8 at addr ffff8881685f4118 by task kworker/1:1/42 [ 65.661742][ T42] [ 65.661973][ T42] CPU: 1 UID: 0 PID: 42 Comm: kworker/1:1 Not tainted 7.1.0-rc5-00006-ge8c2f9fdadee #16 PREEMPT( [ 65.661978][ T42] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debia4 [ 65.661981][ T42] Workqueue: usb_hub_wq hub_event [ 65.661988][ T42] Call Trace: [ 65.661991][ T42] <TASK> [ 65.661993][ T42] dump_stack_lvl+0x26/0x80 [ 65.661999][ T42] print_report+0x16a/0x5d0 [ 65.662013][ T42] kasan_report+0xc3/0x100 [ 65.662019][ T42] au0828_dvb_register+0x1280/0x15f0 [ 65.662026][ T42] au0828_usb_probe+0x353/0x4b0 [ 65.662029][ T42] usb_probe_interface+0x4aa/0xa40 [ 65.662034][ T42] really_probe+0x259/0x9a0 [ 65.662041][ T42] __driver_probe_device+0x18b/0x370 [ 65.662045][ T42] driver_probe_device+0x4b/0x1e0 [ 65.662049][ T42] __device_attach_driver+0x1d0/0x2f0 [ 65.662055][ T42] bus_for_each_drv+0x22a/0x260 [ 65.663294][ T42] __device_attach+0x25a/0x480 [ 65.663321][ T42] device_initial_probe+0x68/0xa0 [ 65.663324][ T42] bus_probe_device+0x10a/0x1d0 [ 65.663328][ T42] device_add+0x56b/0x9c0 [ 65.663332][ T42] usb_set_configuration+0x1775/0x1d80 [ 65.663337][ T42] usb_generic_driver_probe+0x61/0xf0 [ 65.663343][ T42] usb_probe_device+0xd3/0x2a0 [ 65.663346][ T42] really_probe+0x259/0x9a0 [ 65.663350][ T42] __driver_probe_device+0x18b/0x370 [ 65.663354][ T42] driver_probe_device+0x4b/0x1e0 [ 65.663357][ T42] __device_attach_driver+0x1d0/0x2f0 [ 65.663363][ T42] bus_for_each_drv+0x22a/0x260 [ 65.663381][ T42] __device_attach+0x25a/0x480 [ 65.663403][ T42] device_initial_probe+0x68/0xa0 [ 65.663405][ T42] bus_probe_device+0x10a/0x1d0 [ 65.663409][ T42] device_add+0x56b/0x9c0 [ 65.663412][ T42] usb_new_device+0xbdd/0x1830 [ 65.663423][ T42] hub_event+0x2358/0x4090 [ 65.663443][ T42] process_scheduled_works+0x73d/0xed0 [ 65.663451][ T42] worker_thread+0x7d6/0xb60 [ 65.663459][ T42] kthread+0x322/0x410 [ 65.663470][ T42] ret_from_fork+0x285/0x750 [ 65.663485][ T42] ret_from_fork_asm+0x1a/0x30 [ 65.663491][ T42] </TASK> [ 65.663493][ T42] [ 65.702422][ T42] Freed by task 42 on cpu 1 at 65.659497s: [ 65.702994][ T42] kasan_save_track+0x2e/0x90 [ 65.703471][ T42] kasan_save_free_info+0x3c/0x50 [ 65.703965][ T42] __kasan_slab_free+0x36/0x60 [ 65.704450][ T42] kfree+0x154/0x450 [ 65.704839][ T42] au8522_release_state+0x1b6/0x210 [ 65.705364][ T42] dvb_frontend_put+0x12a/0x170 [ 65.705848][ T42] au0828_dvb_register+0xfd9/0x15f0 [ 65.706373][ T42] au0828_usb_probe+0x353/0x4b0 [ 65.706854][ T42] usb_probe_interface+0x4aa/0xa40 [ 65.707373][ T42] really_probe+0x259/0x9a0 [ 65.707822][ T42] __driver_probe_device+0x18b/0x370 [ 65.708347][ T42] driver_probe_device+0x4b/0x1e0 [ 65.708845][ T42] __device_attach_driver+0x1d0/0x2f0 [ 65.709383][ T42] bus_for_each_drv+0x22a/0x260 [ 65.709864][ T42] __device_attach+0x25a/0x480 [ 65.710339][ T42] device_initial_probe+0x68/0xa0 [ 65.710836][ T42] bus_probe_device+0x10a/0x1d0 [ 65.711323][ T42] device_add+0x56b/0x9c0 [ 65.711750][ T42] usb_set_configuration+0x1775/0x1d80 [ 65.712294][ T42] usb_generic_driver_probe+0x61/0xf0 [ 65.712822][ T42] usb_probe_device+0xd3/0x2a0 [ 65.713305][ T42] really_probe+0x259/0x9a0 [ 65.713752][ T42] __driver_probe_device+0x18b/0x370 [ 65.714282][ T42] driver_probe_device+0x4b/0x1e0 [ 65.714779][ T42] __device_attach_driver+0x1d0/0x2f0 [ 65.715313][ T42] bus_for_each_drv+0x22a/0x260 [ 65.715794][ T42] __device_attach+0x25a/0x480 [ 65.716271][ T42] device_initial_probe+0x68/0xa0 [ 65.716767][ T42] bus_probe_device+0x10a/0x1d0 [ 65.717262][ T42] device_add+0x56b/0x9c0 [ 65.717690][ T42] usb_new_device+0xbdd/0x1830 [ 65.717869][ C0] clocksource: Watchdog remote CPU 1 read timed out [ 65.718172][ T42] hub_event+0x2358/0x4090 [ 65.718177][ T42] process_scheduled_works+0x73d/0xed0 [ 65.718180][ T42] worker_thread+0x7d6/0xb60 [ 65.718183][ T42] kthread+0x322/0x410 [ 65.718187][ T42] ret_from_fork+0x285/0x750 [ 65.718189][ T42] ret_from_fork_asm+0x1a/0x30 [ 65.718192][ T42] [ 65.718194][ T42] The buggy address belongs to the object at ffff8881685f4000 [ 65.718194][ T42] which belongs to the cache kmalloc-4k of size 4096 [ 65.718197][ T42] The buggy address is located 280 bytes inside of [ 65.718197][ T42] freed 4096-byte region [ffff8881685f4000, ffff8881685f5000) [ 65.718200][ T42] [ 65.718201][ T42] The buggy address belongs to the physical page: [ 65.718204][ T42] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1685f0 [ 65.718209][ T42] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 65.718212][ T42] flags: 0x17ff00000000040(head|node=0|zone=2|lastcpupid=0x7ff) [ 65.729357][ T42] page_type: f5(slab) [ 65.729757][ T42] raw: 017ff00000000040 ffff888100042140 dead000000000100 dead000000000122 [ 65.730603][ T42] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 65.731450][ T42] head: 017ff00000000040 ffff888100042140 dead000000000100 dead000000000122 [ 65.732301][ T42] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 65.733211][ T42] head: 017ff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 65.734064][ T42] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 65.734922][ T42] page dumped because: kasan: bad access detected [ 65.735562][ T42] page_owner tracks the page as allocated [ 65.736133][ T42] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__G2 [ 65.738177][ T42] post_alloc_hook+0x152/0x180 [ 65.738654][ T42] get_page_from_freelist+0x3996/0x3b50 [ 65.739207][ T42] __alloc_frozen_pages_noprof+0x243/0x750 [ 65.739783][ T42] allocate_slab+0x76/0x5e0 [ 65.740242][ T42] refill_objects+0x2e1/0x360 [ 65.740706][ T42] __pcs_replace_empty_main+0x233/0x440 [ 65.741262][ T42] __kmalloc_cache_noprof+0x2d0/0x490 [ 65.741791][ T42] au8522_get_state+0x266/0x4c0 [ 65.742280][ T42] au8522_attach+0xba/0x2d0 [ 65.742728][ T42] au0828_dvb_register+0xcc/0x15f0 [ 65.743241][ T42] au0828_usb_probe+0x353/0x4b0 [ 65.743723][ T42] usb_probe_interface+0x4aa/0xa40 [ 65.744264][ T42] really_probe+0x259/0x9a0 [ 65.744713][ T42] __driver_probe_device+0x18b/0x370 [ 65.745246][ T42] driver_probe_device+0x4b/0x1e0 [ 65.745745][ T42] __device_attach_driver+0x1d0/0x2f0 [ 65.746284][ T42] page last free pid 4578 tgid 4578 stack trace: [ 65.746909][ T42] __free_frozen_pages+0xb8c/0xcb0 [ 65.747427][ T42] __slab_free+0x219/0x260 [ 65.747870][ T42] qlist_free_all+0x33/0x120 [ 65.748339][ T42] kasan_quarantine_reduce+0x152/0x170 [ 65.748877][ T42] __kasan_slab_alloc+0x1f/0x60 [ 65.749368][ T42] kmem_cache_alloc_noprof+0x1f0/0x480 [ 65.749908][ T42] do_getname+0x2a/0x1c0 [ 65.750337][ T42] do_sys_openat2+0x99/0x190 [ 65.750798][ T42] __x64_sys_openat+0x20b/0x260 [ 65.751287][ T42] do_syscall_64+0x125/0x590 [ 65.751744][ T42] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 65.752334][ T42] [ 65.752572][ T42] Memory state around the buggy address: [ 65.753132][ T42] ffff8881685f4000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 65.753918][ T42] ffff8881685f4080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 65.754712][ T42] >ffff8881685f4100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 65.755504][ T42] ^ [ 65.755985][ T42] ffff8881685f4180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 65.756775][ T42] ffff8881685f4200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 65.757575][ T42] ================================================================== [ 65.758570][ T42] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 65.759306][ T42] CPU: 1 UID: 0 PID: 42 Comm: kworker/1:1 Not tainted 7.1.0-rc5-00006-ge8c2f9fdadee #16 PREEMPT( [ 65.760402][ T42] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debia4 [ 65.761615][ T42] Workqueue: usb_hub_wq hub_event [ 65.762263][ T42] Call Trace: [ 65.762658][ T42] <TASK> [ 65.762956][ T42] dump_stack_lvl+0x26/0x80 [ 65.763420][ T42] vpanic+0x37d/0x710 [ 65.764686][ T42] panic+0x9f/0xa0 [ 65.767120][ T42] check_panic_on_warn+0x58/0x70 [ 65.768155][ T42] end_report+0x44/0xe0 [ 65.769116][ T42] kasan_report+0xd4/0x100 [ 65.770092][ T42] au0828_dvb_register+0x1280/0x15f0 [ 65.771097][ T42] au0828_usb_probe+0x353/0x4b0 [ 65.771586][ T42] usb_probe_interface+0x4aa/0xa40 [ 65.772089][ T42] really_probe+0x259/0x9a0 [ 65.772549][ T42] __driver_probe_device+0x18b/0x370 [ 65.773069][ T42] driver_probe_device+0x4b/0x1e0 [ 65.773576][ T42] __device_attach_driver+0x1d0/0x2f0 [ 65.774692][ T42] bus_for_each_drv+0x22a/0x260 [ 65.777453][ T42] __device_attach+0x25a/0x480 [ 65.780818][ T42] device_initial_probe+0x68/0xa0 [ 65.781322][ T42] bus_probe_device+0x10a/0x1d0 [ 65.781800][ T42] device_add+0x56b/0x9c0 [ 65.782284][ T42] usb_set_configuration+0x1775/0x1d80 [ 65.782822][ T42] usb_generic_driver_probe+0x61/0xf0 [ 65.783361][ T42] usb_probe_device+0xd3/0x2a0 [ 65.783832][ T42] really_probe+0x259/0x9a0 [ 65.784286][ T42] __driver_probe_device+0x18b/0x370 [ 65.784804][ T42] driver_probe_device+0x4b/0x1e0 [ 65.785304][ T42] __device_attach_driver+0x1d0/0x2f0 [ 65.786416][ T42] bus_for_each_drv+0x22a/0x260 [ 65.789198][ T42] __device_attach+0x25a/0x480 [ 65.792606][ T42] device_initial_probe+0x68/0xa0 [ 65.793101][ T42] bus_probe_device+0x10a/0x1d0 [ 65.793602][ T42] device_add+0x56b/0x9c0 [ 65.794028][ T42] usb_new_device+0xbdd/0x1830 [ 65.795025][ T42] hub_event+0x2358/0x4090 [ 65.797580][ T42] process_scheduled_works+0x73d/0xed0 [ 65.798124][ T42] worker_thread+0x7d6/0xb60 [ 65.799085][ T42] kthread+0x322/0x410 [ 65.800465][ T42] ret_from_fork+0x285/0x750 [ 65.802356][ T42] ret_from_fork_asm+0x1a/0x30 [ 65.802830][ T42] </TASK> [ 65.803886][ T42] Kernel Offset: disabled [ 65.804329][ T42] ---[ end Kernel panic - not syncing: KASAN: panic_on_warn set ... ]— > >> >> >> [ 141.481576][ T48] ================================================================== >> [ 141.482348][ T48] BUG: KASAN: slab-use-after-free in au0828_dvb_register (drivers/media/usb/au0828/au0828-dvb.c:636) >> [ 141.483148][ T48] Read of size 8 at addr ffff888171d4a118 by task kworker/1:1/48 >> [ 141.483903][ T48] >> [ 141.484144][ T48] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.34 >> [ 141.484148][ T48] Workqueue: usb_hub_wq hub_event >> [ 141.484154][ T48] Call Trace: >> [ 141.484157][ T48] <TASK> >> [ 141.484159][ T48] dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) >> [ 141.484164][ T48] print_report (mm/kasan/report.c:378 mm/kasan/report.c:482) >> [ 141.484177][ T48] kasan_report (mm/kasan/report.c:595) >> [ 141.484183][ T48] au0828_dvb_register (drivers/media/usb/au0828/au0828-dvb.c:636) >> [ 141.484190][ T48] au0828_usb_probe (drivers/media/usb/au0828/au0828-core.c:733) >> [ 141.484193][ T48] usb_probe_interface (drivers/usb/core/driver.c:396) >> [ 141.484198][ T48] really_probe (drivers/base/dd.c:? drivers/base/dd.c:709) >> [ 141.484204][ T48] __driver_probe_device (drivers/base/dd.c:871) >> [ 141.484207][ T48] driver_probe_device (drivers/base/dd.c:901) >> [ 141.484211][ T48] __device_attach_driver (drivers/base/dd.c:1029) >> [ 141.484217][ T48] bus_for_each_drv (drivers/base/bus.c:500) >> [ 141.484264][ T48] __device_attach (drivers/base/dd.c:1101) >> [ 141.484289][ T48] device_initial_probe (drivers/base/dd.c:1156) >> [ 141.484292][ T48] bus_probe_device (drivers/base/bus.c:613) >> [ 141.484296][ T48] device_add (drivers/base/core.c:3706) >> [ 141.484299][ T48] usb_set_configuration (drivers/usb/core/message.c:2268) >> [ 141.484303][ T48] usb_generic_driver_probe (drivers/usb/core/generic.c:250) >> [ 141.484308][ T48] usb_probe_device (drivers/usb/core/driver.c:291) >> [ 141.484311][ T48] really_probe (drivers/base/dd.c:? drivers/base/dd.c:709) >> [ 141.484315][ T48] __driver_probe_device (drivers/base/dd.c:871) >> [ 141.484318][ T48] driver_probe_device (drivers/base/dd.c:901) >> [ 141.484321][ T48] __device_attach_driver (drivers/base/dd.c:1029) >> [ 141.484328][ T48] bus_for_each_drv (drivers/base/bus.c:500) >> [ 141.484346][ T48] __device_attach (drivers/base/dd.c:1101) >> [ 141.484367][ T48] device_initial_probe (drivers/base/dd.c:1156) >> [ 141.484370][ T48] bus_probe_device (drivers/base/bus.c:613) >> [ 141.484374][ T48] device_add (drivers/base/core.c:3706) >> [ 141.484376][ T48] usb_new_device (drivers/usb/core/hub.c:2695) >> [ 141.484386][ T48] hub_event (drivers/usb/core/hub.c:5567 drivers/usb/core/hub.c:5707 drivers/usb/core/hub.c:5871 drivers/usb/core/hub.c:5953) >> [ 141.484406][ T48] process_scheduled_works (kernel/workqueue.c:3314 kernel/workqueue.c:3397) >> [ 141.484412][ T48] worker_thread (kernel/workqueue.c:3478) >> [ 141.484420][ T48] kthread (kernel/kthread.c:436) >> [ 141.484431][ T48] ret_from_fork (arch/x86/kernel/process.c:158) >> [ 141.484445][ T48] ret_from_fork_asm (arch/x86/entry/entry_64.S:245) >> [ 141.484450][ T48] </TASK> >> [ 141.484451][ T48] >> [ 141.523531][ T48] Freed by task 48 on cpu 1 at 141.481575s: >> [ 141.524120][ T48] kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78) >> [ 141.524594][ T48] kasan_save_free_info (mm/kasan/generic.c:584) >> [ 141.525089][ T48] __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285) >> [ 141.525570][ T48] kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6566) >> [ 141.525957][ T48] au8522_release_state (drivers/media/dvb-frontends/au8522_common.c:124) >> [ 141.526467][ T48] dvb_frontend_put (drivers/media/dvb-core/dvb_frontend.c:3093 drivers/media/dvb-core/dvb_frontend.c:141 drivers/media/dvb-core/dvb_frontend.c:166) >> [ 141.526957][ T48] au0828_dvb_register (drivers/media/usb/au0828/au0828-dvb.c:518 drivers/media/usb/au0828/au0828-dvb.c:634) >> [ 141.527469][ T48] au0828_usb_probe (drivers/media/usb/au0828/au0828-core.c:733) >> [ 141.527952][ T48] usb_probe_interface (drivers/usb/core/driver.c:396) >> [ 141.528455][ T48] really_probe (drivers/base/dd.c:? drivers/base/dd.c:709) >> [ 141.528908][ T48] __driver_probe_device (drivers/base/dd.c:871) >> [ 141.529426][ T48] driver_probe_device (drivers/base/dd.c:901) >> [ 141.529932][ T48] __device_attach_driver (drivers/base/dd.c:1029) >> [ 141.530459][ T48] bus_for_each_drv (drivers/base/bus.c:500) >> [ 141.530949][ T48] __device_attach (drivers/base/dd.c:1101) >> [ 141.531419][ T48] device_initial_probe (drivers/base/dd.c:1156) >> [ 141.531923][ T48] bus_probe_device (drivers/base/bus.c:613) >> [ 141.532404][ T48] device_add (drivers/base/core.c:3706) >> [ 141.532840][ T48] usb_set_configuration (drivers/usb/core/message.c:2268) >> [ 141.533373][ T48] usb_generic_driver_probe (drivers/usb/core/generic.c:250) >> [ 141.533907][ T48] usb_probe_device (drivers/usb/core/driver.c:291) >> [ 141.534377][ T48] really_probe (drivers/base/dd.c:? drivers/base/dd.c:709) >> [ 141.534833][ T48] __driver_probe_device (drivers/base/dd.c:871) >> [ 141.535352][ T48] driver_probe_device (drivers/base/dd.c:901) >> [ 141.535856][ T48] __device_attach_driver (drivers/base/dd.c:1029) >> [ 141.536384][ T48] bus_for_each_drv (drivers/base/bus.c:500) >> [ 141.536869][ T48] __device_attach (drivers/base/dd.c:1101) >> [ 141.537340][ T48] device_initial_probe (drivers/base/dd.c:1156) >> [ 141.537839][ T48] bus_probe_device (drivers/base/bus.c:613) >> [ 141.538320][ T48] device_add (drivers/base/core.c:3706) >> [ 141.538753][ T48] usb_new_device (drivers/usb/core/hub.c:2695) >> [ 141.539226][ T48] hub_event (drivers/usb/core/hub.c:5567 drivers/usb/core/hub.c:5707 drivers/usb/core/hub.c:5871 drivers/usb/core/hub.c:5953) >> [ 141.539672][ T48] process_scheduled_works (kernel/workqueue.c:3314 kernel/workqueue.c:3397) >> [ 141.540205][ T48] worker_thread (kernel/workqueue.c:3478) >> [ 141.540666][ T48] kthread (kernel/kthread.c:436) >> [ 141.541069][ T48] ret_from_fork (arch/x86/kernel/process.c:158) >> [ 141.541524][ T48] ret_from_fork_asm (arch/x86/entry/entry_64.S:245) >> [ 141.541999][ T48] >> [ 141.542236][ T48] The buggy address belongs to the object at ffff888171d4a000 >> [ 141.542236][ T48] which belongs to the cache kmalloc-4k of size 4096 >> [ 141.543602][ T48] The buggy address is located 280 bytes inside of >> [ 141.543602][ T48] freed 4096-byte region [ffff888171d4a000, ffff888171d4b000) ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [BUG] KASAN: slab-use-after-free in au0828_dvb_register 2026-05-29 19:22 ` [BUG] " Shuangpeng @ 2026-06-01 1:18 ` Pei Xiao 2026-06-01 3:38 ` Pei Xiao 1 sibling, 0 replies; 8+ messages in thread From: Pei Xiao @ 2026-06-01 1:18 UTC (permalink / raw) To: Shuangpeng, xiaopeitux Cc: brad, hverkuil+cisco, linux-kernel, linux-media, mchehab, mingo, tglx 在 2026/5/30 03:22, Shuangpeng 写道: > >> On May 29, 2026, at 04:30, xiaopeitux@foxmail.com wrote: >> >> From: Pei Xiao <xiaopei01@kylinos.cn> >> >>> Hi Kernel Maintainers, >>> >>> We hit the following KASAN report while testing current upstream kernel: >>> >>> KASAN: slab-use-after-free in au0828_dvb_register >>> >>> on commit: e8c2f9fdadee7cbc75134dc463c1e0d856d6e5c7 (May 25 2026) >>> >>> The reproducer and .config files are here. >>> https://gist.github.com/shuangpengbai/c31163f8ef234ba4fe85038c2f97f9cc >>> >>> I’m happy to test debug patches or provide additional information. >>> >>> Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com> >> Can you help post all the crash logs? >> Does the kernel log have this print: >> "The frontend of your DVB/ATSC card isn't supported yet." > I did not see this message in log. > > >> Please help post all the logs, thank you! > Thank you for taking a look. All terminal outputs after running the reproducer: > > [ 64.807294][ T42] usb 3-1: new high-speed USB device number 2 using dummy_hcd > [ 64.958989][ T42] usb 3-1: New USB device found, idVendor=0fe9, idProduct=d620, bcdDevice= 1.00 > [ 64.961560][ T42] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 > [ 65.351442][ T42] au0828: i2c bus registered > [ 65.634777][ T42] au8522 1-0047: creating new instance > [ 65.655406][ T42] DVB: Unable to find symbol xc5000_attach() > [ 65.656022][ T42] dvbdev: DVB: registering new adapter (au0828) > [ 65.656632][ T42] au0828: dvb_register_frontend failed (errno = -12) Why print dvb_register_frontend failed (errno = -12) fe->frontend_priv = kzalloc_obj(struct dvb_frontend_private); if (!fe->frontend_priv) { mutex_unlock(&frontend_mutex); return -ENOMEM; } -12 is out of memory, very strange > [ 65.658957][ T42] au8522 1-0047: destroying instance > [ 65.659499][ T42] ================================================================== > [ 65.660261][ T42] BUG: KASAN: slab-use-after-free in au0828_dvb_register+0x1280/0x15f0 > [ 65.661023][ T42] Read of size 8 at addr ffff8881685f4118 by task kworker/1:1/42 > [ 65.661742][ T42] > [ 65.661973][ T42] CPU: 1 UID: 0 PID: 42 Comm: kworker/1:1 Not tainted 7.1.0-rc5-00006-ge8c2f9fdadee #16 PREEMPT( > [ 65.661978][ T42] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debia4 > [ 65.661981][ T42] Workqueue: usb_hub_wq hub_event > [ 65.661988][ T42] Call Trace: > [ 65.661991][ T42] <TASK> > [ 65.661993][ T42] dump_stack_lvl+0x26/0x80 > [ 65.661999][ T42] print_report+0x16a/0x5d0 > [ 65.662013][ T42] kasan_report+0xc3/0x100 > [ 65.662019][ T42] au0828_dvb_register+0x1280/0x15f0 > [ 65.662026][ T42] au0828_usb_probe+0x353/0x4b0 > [ 65.662029][ T42] usb_probe_interface+0x4aa/0xa40 > [ 65.662034][ T42] really_probe+0x259/0x9a0 > [ 65.662041][ T42] __driver_probe_device+0x18b/0x370 > [ 65.662045][ T42] driver_probe_device+0x4b/0x1e0 > [ 65.662049][ T42] __device_attach_driver+0x1d0/0x2f0 > [ 65.662055][ T42] bus_for_each_drv+0x22a/0x260 > [ 65.663294][ T42] __device_attach+0x25a/0x480 > [ 65.663321][ T42] device_initial_probe+0x68/0xa0 > [ 65.663324][ T42] bus_probe_device+0x10a/0x1d0 > [ 65.663328][ T42] device_add+0x56b/0x9c0 > [ 65.663332][ T42] usb_set_configuration+0x1775/0x1d80 > [ 65.663337][ T42] usb_generic_driver_probe+0x61/0xf0 > [ 65.663343][ T42] usb_probe_device+0xd3/0x2a0 > [ 65.663346][ T42] really_probe+0x259/0x9a0 > [ 65.663350][ T42] __driver_probe_device+0x18b/0x370 > [ 65.663354][ T42] driver_probe_device+0x4b/0x1e0 > [ 65.663357][ T42] __device_attach_driver+0x1d0/0x2f0 > [ 65.663363][ T42] bus_for_each_drv+0x22a/0x260 > [ 65.663381][ T42] __device_attach+0x25a/0x480 > [ 65.663403][ T42] device_initial_probe+0x68/0xa0 > [ 65.663405][ T42] bus_probe_device+0x10a/0x1d0 > [ 65.663409][ T42] device_add+0x56b/0x9c0 > [ 65.663412][ T42] usb_new_device+0xbdd/0x1830 > [ 65.663423][ T42] hub_event+0x2358/0x4090 > [ 65.663443][ T42] process_scheduled_works+0x73d/0xed0 > [ 65.663451][ T42] worker_thread+0x7d6/0xb60 > [ 65.663459][ T42] kthread+0x322/0x410 > [ 65.663470][ T42] ret_from_fork+0x285/0x750 > [ 65.663485][ T42] ret_from_fork_asm+0x1a/0x30 > [ 65.663491][ T42] </TASK> > [ 65.663493][ T42] > [ 65.702422][ T42] Freed by task 42 on cpu 1 at 65.659497s: > [ 65.702994][ T42] kasan_save_track+0x2e/0x90 > [ 65.703471][ T42] kasan_save_free_info+0x3c/0x50 > [ 65.703965][ T42] __kasan_slab_free+0x36/0x60 > [ 65.704450][ T42] kfree+0x154/0x450 > [ 65.704839][ T42] au8522_release_state+0x1b6/0x210 > [ 65.705364][ T42] dvb_frontend_put+0x12a/0x170 > [ 65.705848][ T42] au0828_dvb_register+0xfd9/0x15f0 > [ 65.706373][ T42] au0828_usb_probe+0x353/0x4b0 > [ 65.706854][ T42] usb_probe_interface+0x4aa/0xa40 > [ 65.707373][ T42] really_probe+0x259/0x9a0 > [ 65.707822][ T42] __driver_probe_device+0x18b/0x370 > [ 65.708347][ T42] driver_probe_device+0x4b/0x1e0 > [ 65.708845][ T42] __device_attach_driver+0x1d0/0x2f0 > [ 65.709383][ T42] bus_for_each_drv+0x22a/0x260 > [ 65.709864][ T42] __device_attach+0x25a/0x480 > [ 65.710339][ T42] device_initial_probe+0x68/0xa0 > [ 65.710836][ T42] bus_probe_device+0x10a/0x1d0 > [ 65.711323][ T42] device_add+0x56b/0x9c0 > [ 65.711750][ T42] usb_set_configuration+0x1775/0x1d80 > [ 65.712294][ T42] usb_generic_driver_probe+0x61/0xf0 > [ 65.712822][ T42] usb_probe_device+0xd3/0x2a0 > [ 65.713305][ T42] really_probe+0x259/0x9a0 > [ 65.713752][ T42] __driver_probe_device+0x18b/0x370 > [ 65.714282][ T42] driver_probe_device+0x4b/0x1e0 > [ 65.714779][ T42] __device_attach_driver+0x1d0/0x2f0 > [ 65.715313][ T42] bus_for_each_drv+0x22a/0x260 > [ 65.715794][ T42] __device_attach+0x25a/0x480 > [ 65.716271][ T42] device_initial_probe+0x68/0xa0 > [ 65.716767][ T42] bus_probe_device+0x10a/0x1d0 > [ 65.717262][ T42] device_add+0x56b/0x9c0 > [ 65.717690][ T42] usb_new_device+0xbdd/0x1830 > [ 65.717869][ C0] clocksource: Watchdog remote CPU 1 read timed out > [ 65.718172][ T42] hub_event+0x2358/0x4090 > [ 65.718177][ T42] process_scheduled_works+0x73d/0xed0 > [ 65.718180][ T42] worker_thread+0x7d6/0xb60 > [ 65.718183][ T42] kthread+0x322/0x410 > [ 65.718187][ T42] ret_from_fork+0x285/0x750 > [ 65.718189][ T42] ret_from_fork_asm+0x1a/0x30 > [ 65.718192][ T42] > [ 65.718194][ T42] The buggy address belongs to the object at ffff8881685f4000 > [ 65.718194][ T42] which belongs to the cache kmalloc-4k of size 4096 > [ 65.718197][ T42] The buggy address is located 280 bytes inside of > [ 65.718197][ T42] freed 4096-byte region [ffff8881685f4000, ffff8881685f5000) > [ 65.718200][ T42] > [ 65.718201][ T42] The buggy address belongs to the physical page: > [ 65.718204][ T42] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1685f0 > [ 65.718209][ T42] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 > [ 65.718212][ T42] flags: 0x17ff00000000040(head|node=0|zone=2|lastcpupid=0x7ff) > [ 65.729357][ T42] page_type: f5(slab) > [ 65.729757][ T42] raw: 017ff00000000040 ffff888100042140 dead000000000100 dead000000000122 > [ 65.730603][ T42] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 > [ 65.731450][ T42] head: 017ff00000000040 ffff888100042140 dead000000000100 dead000000000122 > [ 65.732301][ T42] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 > [ 65.733211][ T42] head: 017ff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff > [ 65.734064][ T42] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 > [ 65.734922][ T42] page dumped because: kasan: bad access detected > [ 65.735562][ T42] page_owner tracks the page as allocated > [ 65.736133][ T42] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__G2 > [ 65.738177][ T42] post_alloc_hook+0x152/0x180 > [ 65.738654][ T42] get_page_from_freelist+0x3996/0x3b50 > [ 65.739207][ T42] __alloc_frozen_pages_noprof+0x243/0x750 > [ 65.739783][ T42] allocate_slab+0x76/0x5e0 > [ 65.740242][ T42] refill_objects+0x2e1/0x360 > [ 65.740706][ T42] __pcs_replace_empty_main+0x233/0x440 > [ 65.741262][ T42] __kmalloc_cache_noprof+0x2d0/0x490 > [ 65.741791][ T42] au8522_get_state+0x266/0x4c0 > [ 65.742280][ T42] au8522_attach+0xba/0x2d0 > [ 65.742728][ T42] au0828_dvb_register+0xcc/0x15f0 > [ 65.743241][ T42] au0828_usb_probe+0x353/0x4b0 > [ 65.743723][ T42] usb_probe_interface+0x4aa/0xa40 > [ 65.744264][ T42] really_probe+0x259/0x9a0 > [ 65.744713][ T42] __driver_probe_device+0x18b/0x370 > [ 65.745246][ T42] driver_probe_device+0x4b/0x1e0 > [ 65.745745][ T42] __device_attach_driver+0x1d0/0x2f0 > [ 65.746284][ T42] page last free pid 4578 tgid 4578 stack trace: > [ 65.746909][ T42] __free_frozen_pages+0xb8c/0xcb0 > [ 65.747427][ T42] __slab_free+0x219/0x260 > [ 65.747870][ T42] qlist_free_all+0x33/0x120 > [ 65.748339][ T42] kasan_quarantine_reduce+0x152/0x170 > [ 65.748877][ T42] __kasan_slab_alloc+0x1f/0x60 > [ 65.749368][ T42] kmem_cache_alloc_noprof+0x1f0/0x480 > [ 65.749908][ T42] do_getname+0x2a/0x1c0 > [ 65.750337][ T42] do_sys_openat2+0x99/0x190 > [ 65.750798][ T42] __x64_sys_openat+0x20b/0x260 > [ 65.751287][ T42] do_syscall_64+0x125/0x590 > [ 65.751744][ T42] entry_SYSCALL_64_after_hwframe+0x76/0x7e > [ 65.752334][ T42] > [ 65.752572][ T42] Memory state around the buggy address: > [ 65.753132][ T42] ffff8881685f4000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > [ 65.753918][ T42] ffff8881685f4080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > [ 65.754712][ T42] >ffff8881685f4100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > [ 65.755504][ T42] ^ > [ 65.755985][ T42] ffff8881685f4180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > [ 65.756775][ T42] ffff8881685f4200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > [ 65.757575][ T42] ================================================================== > [ 65.758570][ T42] Kernel panic - not syncing: KASAN: panic_on_warn set ... > [ 65.759306][ T42] CPU: 1 UID: 0 PID: 42 Comm: kworker/1:1 Not tainted 7.1.0-rc5-00006-ge8c2f9fdadee #16 PREEMPT( > [ 65.760402][ T42] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debia4 > [ 65.761615][ T42] Workqueue: usb_hub_wq hub_event > [ 65.762263][ T42] Call Trace: > [ 65.762658][ T42] <TASK> > [ 65.762956][ T42] dump_stack_lvl+0x26/0x80 > [ 65.763420][ T42] vpanic+0x37d/0x710 > [ 65.764686][ T42] panic+0x9f/0xa0 > [ 65.767120][ T42] check_panic_on_warn+0x58/0x70 > [ 65.768155][ T42] end_report+0x44/0xe0 > [ 65.769116][ T42] kasan_report+0xd4/0x100 > [ 65.770092][ T42] au0828_dvb_register+0x1280/0x15f0 > [ 65.771097][ T42] au0828_usb_probe+0x353/0x4b0 > [ 65.771586][ T42] usb_probe_interface+0x4aa/0xa40 > [ 65.772089][ T42] really_probe+0x259/0x9a0 > [ 65.772549][ T42] __driver_probe_device+0x18b/0x370 > [ 65.773069][ T42] driver_probe_device+0x4b/0x1e0 > [ 65.773576][ T42] __device_attach_driver+0x1d0/0x2f0 > [ 65.774692][ T42] bus_for_each_drv+0x22a/0x260 > [ 65.777453][ T42] __device_attach+0x25a/0x480 > [ 65.780818][ T42] device_initial_probe+0x68/0xa0 > [ 65.781322][ T42] bus_probe_device+0x10a/0x1d0 > [ 65.781800][ T42] device_add+0x56b/0x9c0 > [ 65.782284][ T42] usb_set_configuration+0x1775/0x1d80 > [ 65.782822][ T42] usb_generic_driver_probe+0x61/0xf0 > [ 65.783361][ T42] usb_probe_device+0xd3/0x2a0 > [ 65.783832][ T42] really_probe+0x259/0x9a0 > [ 65.784286][ T42] __driver_probe_device+0x18b/0x370 > [ 65.784804][ T42] driver_probe_device+0x4b/0x1e0 > [ 65.785304][ T42] __device_attach_driver+0x1d0/0x2f0 > [ 65.786416][ T42] bus_for_each_drv+0x22a/0x260 > [ 65.789198][ T42] __device_attach+0x25a/0x480 > [ 65.792606][ T42] device_initial_probe+0x68/0xa0 > [ 65.793101][ T42] bus_probe_device+0x10a/0x1d0 > [ 65.793602][ T42] device_add+0x56b/0x9c0 > [ 65.794028][ T42] usb_new_device+0xbdd/0x1830 > [ 65.795025][ T42] hub_event+0x2358/0x4090 > [ 65.797580][ T42] process_scheduled_works+0x73d/0xed0 > [ 65.798124][ T42] worker_thread+0x7d6/0xb60 > [ 65.799085][ T42] kthread+0x322/0x410 > [ 65.800465][ T42] ret_from_fork+0x285/0x750 > [ 65.802356][ T42] ret_from_fork_asm+0x1a/0x30 > [ 65.802830][ T42] </TASK> > [ 65.803886][ T42] Kernel Offset: disabled > [ 65.804329][ T42] ---[ end Kernel panic - not syncing: KASAN: panic_on_warn set ... ]— > >>> >>> [ 141.481576][ T48] ================================================================== >>> [ 141.482348][ T48] BUG: KASAN: slab-use-after-free in au0828_dvb_register (drivers/media/usb/au0828/au0828-dvb.c:636) >>> [ 141.483148][ T48] Read of size 8 at addr ffff888171d4a118 by task kworker/1:1/48 >>> [ 141.483903][ T48] >>> [ 141.484144][ T48] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.34 >>> [ 141.484148][ T48] Workqueue: usb_hub_wq hub_event >>> [ 141.484154][ T48] Call Trace: >>> [ 141.484157][ T48] <TASK> >>> [ 141.484159][ T48] dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) >>> [ 141.484164][ T48] print_report (mm/kasan/report.c:378 mm/kasan/report.c:482) >>> [ 141.484177][ T48] kasan_report (mm/kasan/report.c:595) >>> [ 141.484183][ T48] au0828_dvb_register (drivers/media/usb/au0828/au0828-dvb.c:636) >>> [ 141.484190][ T48] au0828_usb_probe (drivers/media/usb/au0828/au0828-core.c:733) >>> [ 141.484193][ T48] usb_probe_interface (drivers/usb/core/driver.c:396) >>> [ 141.484198][ T48] really_probe (drivers/base/dd.c:? drivers/base/dd.c:709) >>> [ 141.484204][ T48] __driver_probe_device (drivers/base/dd.c:871) >>> [ 141.484207][ T48] driver_probe_device (drivers/base/dd.c:901) >>> [ 141.484211][ T48] __device_attach_driver (drivers/base/dd.c:1029) >>> [ 141.484217][ T48] bus_for_each_drv (drivers/base/bus.c:500) >>> [ 141.484264][ T48] __device_attach (drivers/base/dd.c:1101) >>> [ 141.484289][ T48] device_initial_probe (drivers/base/dd.c:1156) >>> [ 141.484292][ T48] bus_probe_device (drivers/base/bus.c:613) >>> [ 141.484296][ T48] device_add (drivers/base/core.c:3706) >>> [ 141.484299][ T48] usb_set_configuration (drivers/usb/core/message.c:2268) >>> [ 141.484303][ T48] usb_generic_driver_probe (drivers/usb/core/generic.c:250) >>> [ 141.484308][ T48] usb_probe_device (drivers/usb/core/driver.c:291) >>> [ 141.484311][ T48] really_probe (drivers/base/dd.c:? drivers/base/dd.c:709) >>> [ 141.484315][ T48] __driver_probe_device (drivers/base/dd.c:871) >>> [ 141.484318][ T48] driver_probe_device (drivers/base/dd.c:901) >>> [ 141.484321][ T48] __device_attach_driver (drivers/base/dd.c:1029) >>> [ 141.484328][ T48] bus_for_each_drv (drivers/base/bus.c:500) >>> [ 141.484346][ T48] __device_attach (drivers/base/dd.c:1101) >>> [ 141.484367][ T48] device_initial_probe (drivers/base/dd.c:1156) >>> [ 141.484370][ T48] bus_probe_device (drivers/base/bus.c:613) >>> [ 141.484374][ T48] device_add (drivers/base/core.c:3706) >>> [ 141.484376][ T48] usb_new_device (drivers/usb/core/hub.c:2695) >>> [ 141.484386][ T48] hub_event (drivers/usb/core/hub.c:5567 drivers/usb/core/hub.c:5707 drivers/usb/core/hub.c:5871 drivers/usb/core/hub.c:5953) >>> [ 141.484406][ T48] process_scheduled_works (kernel/workqueue.c:3314 kernel/workqueue.c:3397) >>> [ 141.484412][ T48] worker_thread (kernel/workqueue.c:3478) >>> [ 141.484420][ T48] kthread (kernel/kthread.c:436) >>> [ 141.484431][ T48] ret_from_fork (arch/x86/kernel/process.c:158) >>> [ 141.484445][ T48] ret_from_fork_asm (arch/x86/entry/entry_64.S:245) >>> [ 141.484450][ T48] </TASK> >>> [ 141.484451][ T48] >>> [ 141.523531][ T48] Freed by task 48 on cpu 1 at 141.481575s: >>> [ 141.524120][ T48] kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78) >>> [ 141.524594][ T48] kasan_save_free_info (mm/kasan/generic.c:584) >>> [ 141.525089][ T48] __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285) >>> [ 141.525570][ T48] kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6566) >>> [ 141.525957][ T48] au8522_release_state (drivers/media/dvb-frontends/au8522_common.c:124) >>> [ 141.526467][ T48] dvb_frontend_put (drivers/media/dvb-core/dvb_frontend.c:3093 drivers/media/dvb-core/dvb_frontend.c:141 drivers/media/dvb-core/dvb_frontend.c:166) >>> [ 141.526957][ T48] au0828_dvb_register (drivers/media/usb/au0828/au0828-dvb.c:518 drivers/media/usb/au0828/au0828-dvb.c:634) >>> [ 141.527469][ T48] au0828_usb_probe (drivers/media/usb/au0828/au0828-core.c:733) >>> [ 141.527952][ T48] usb_probe_interface (drivers/usb/core/driver.c:396) >>> [ 141.528455][ T48] really_probe (drivers/base/dd.c:? drivers/base/dd.c:709) >>> [ 141.528908][ T48] __driver_probe_device (drivers/base/dd.c:871) >>> [ 141.529426][ T48] driver_probe_device (drivers/base/dd.c:901) >>> [ 141.529932][ T48] __device_attach_driver (drivers/base/dd.c:1029) >>> [ 141.530459][ T48] bus_for_each_drv (drivers/base/bus.c:500) >>> [ 141.530949][ T48] __device_attach (drivers/base/dd.c:1101) >>> [ 141.531419][ T48] device_initial_probe (drivers/base/dd.c:1156) >>> [ 141.531923][ T48] bus_probe_device (drivers/base/bus.c:613) >>> [ 141.532404][ T48] device_add (drivers/base/core.c:3706) >>> [ 141.532840][ T48] usb_set_configuration (drivers/usb/core/message.c:2268) >>> [ 141.533373][ T48] usb_generic_driver_probe (drivers/usb/core/generic.c:250) >>> [ 141.533907][ T48] usb_probe_device (drivers/usb/core/driver.c:291) >>> [ 141.534377][ T48] really_probe (drivers/base/dd.c:? drivers/base/dd.c:709) >>> [ 141.534833][ T48] __driver_probe_device (drivers/base/dd.c:871) >>> [ 141.535352][ T48] driver_probe_device (drivers/base/dd.c:901) >>> [ 141.535856][ T48] __device_attach_driver (drivers/base/dd.c:1029) >>> [ 141.536384][ T48] bus_for_each_drv (drivers/base/bus.c:500) >>> [ 141.536869][ T48] __device_attach (drivers/base/dd.c:1101) >>> [ 141.537340][ T48] device_initial_probe (drivers/base/dd.c:1156) >>> [ 141.537839][ T48] bus_probe_device (drivers/base/bus.c:613) >>> [ 141.538320][ T48] device_add (drivers/base/core.c:3706) >>> [ 141.538753][ T48] usb_new_device (drivers/usb/core/hub.c:2695) >>> [ 141.539226][ T48] hub_event (drivers/usb/core/hub.c:5567 drivers/usb/core/hub.c:5707 drivers/usb/core/hub.c:5871 drivers/usb/core/hub.c:5953) >>> [ 141.539672][ T48] process_scheduled_works (kernel/workqueue.c:3314 kernel/workqueue.c:3397) >>> [ 141.540205][ T48] worker_thread (kernel/workqueue.c:3478) >>> [ 141.540666][ T48] kthread (kernel/kthread.c:436) >>> [ 141.541069][ T48] ret_from_fork (arch/x86/kernel/process.c:158) >>> [ 141.541524][ T48] ret_from_fork_asm (arch/x86/entry/entry_64.S:245) >>> [ 141.541999][ T48] >>> [ 141.542236][ T48] The buggy address belongs to the object at ffff888171d4a000 >>> [ 141.542236][ T48] which belongs to the cache kmalloc-4k of size 4096 >>> [ 141.543602][ T48] The buggy address is located 280 bytes inside of >>> [ 141.543602][ T48] freed 4096-byte region [ffff888171d4a000, ffff888171d4b000) ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [BUG] KASAN: slab-use-after-free in au0828_dvb_register 2026-05-29 19:22 ` [BUG] " Shuangpeng 2026-06-01 1:18 ` Pei Xiao @ 2026-06-01 3:38 ` Pei Xiao 2026-06-01 20:35 ` Shuangpeng 1 sibling, 1 reply; 8+ messages in thread From: Pei Xiao @ 2026-06-01 3:38 UTC (permalink / raw) To: Shuangpeng, xiaopeitux Cc: brad, hverkuil+cisco, linux-kernel, linux-media, mchehab, mingo, tglx 在 2026/5/30 03:22, Shuangpeng 写道: > >> On May 29, 2026, at 04:30, xiaopeitux@foxmail.com wrote: >> >> From: Pei Xiao <xiaopei01@kylinos.cn> >> >>> Hi Kernel Maintainers, >>> >>> We hit the following KASAN report while testing current upstream kernel: >>> >>> KASAN: slab-use-after-free in au0828_dvb_register >>> >>> on commit: e8c2f9fdadee7cbc75134dc463c1e0d856d6e5c7 (May 25 2026) >>> >>> The reproducer and .config files are here. >>> https://gist.github.com/shuangpengbai/c31163f8ef234ba4fe85038c2f97f9cc >>> >>> I’m happy to test debug patches or provide additional information. >>> >>> Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com> >> Can you help post all the crash logs? >> Does the kernel log have this print: >> "The frontend of your DVB/ATSC card isn't supported yet." > I did not see this message in log. > > >> Please help post all the logs, thank you! > Thank you for taking a look. All terminal outputs after running the reproducer: au0828_usb_probe au0828_dvb_register dvb_attach(xc5000_attach, dvb->frontend, dvb_register if (dvb->frontend->ops.release) dvb->frontend->ops.release(dvb->frontend); dvb_register result = dvb_register_frontend(&dvb->adapter, dvb->frontend); pr_err("dvb_register_frontend failed (errno = %d)\n",//-12, no kref_init(&fe->refcount);，fe->frontend_priv is NULL result); goto fail_frontend fail_frontend: dvb_frontend_detach(dvb->frontend); dvb_frontend_detach: dvb_frontend_put __dvb_frontend_free dvb_frontend_invoke_release(fe, fe->ops.release); static void dvb_frontend_invoke_release(struct dvb_frontend *fe, void (*release)(struct dvb_frontend *fe)) { if (release) { release(fe); #ifdef CONFIG_MEDIA_ATTACH dvb_detach(release); #endif } } au8522_attach .release = au8522_release, au8522_release_state kfree(state);//have free How did this problem occur, and is the probability of it occurring high? so we can remove in au0828_dvb_register function follow lines to fix this UAF bug? ret = dvb_register(dev); if (ret < 0) { // if (dvb->frontend->ops.release) // dvb->frontend->ops.release(dvb->frontend); // dvb->frontend = NULL; return ret; } Could you please help test this modified code? > [ 64.807294][ T42] usb 3-1: new high-speed USB device number 2 using dummy_hcd > [ 64.958989][ T42] usb 3-1: New USB device found, idVendor=0fe9, idProduct=d620, bcdDevice= 1.00 > [ 64.961560][ T42] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 > [ 65.351442][ T42] au0828: i2c bus registered > [ 65.634777][ T42] au8522 1-0047: creating new instance > [ 65.655406][ T42] DVB: Unable to find symbol xc5000_attach() > [ 65.656022][ T42] dvbdev: DVB: registering new adapter (au0828) > [ 65.656632][ T42] au0828: dvb_register_frontend failed (errno = -12) > [ 65.658957][ T42] au8522 1-0047: destroying instance > [ 65.659499][ T42] ================================================================== > [ 65.660261][ T42] BUG: KASAN: slab-use-after-free in au0828_dvb_register+0x1280/0x15f0 > [ 65.661023][ T42] Read of size 8 at addr ffff8881685f4118 by task kworker/1:1/42 > [ 65.661742][ T42] > [ 65.661973][ T42] CPU: 1 UID: 0 PID: 42 Comm: kworker/1:1 Not tainted 7.1.0-rc5-00006-ge8c2f9fdadee #16 PREEMPT( > [ 65.661978][ T42] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debia4 > [ 65.661981][ T42] Workqueue: usb_hub_wq hub_event > [ 65.661988][ T42] Call Trace: > [ 65.661991][ T42] <TASK> > [ 65.661993][ T42] dump_stack_lvl+0x26/0x80 > [ 65.661999][ T42] print_report+0x16a/0x5d0 > [ 65.662013][ T42] kasan_report+0xc3/0x100 > [ 65.662019][ T42] au0828_dvb_register+0x1280/0x15f0 > [ 65.662026][ T42] au0828_usb_probe+0x353/0x4b0 > [ 65.662029][ T42] usb_probe_interface+0x4aa/0xa40 > [ 65.662034][ T42] really_probe+0x259/0x9a0 > [ 65.662041][ T42] __driver_probe_device+0x18b/0x370 > [ 65.662045][ T42] driver_probe_device+0x4b/0x1e0 > [ 65.662049][ T42] __device_attach_driver+0x1d0/0x2f0 > [ 65.662055][ T42] bus_for_each_drv+0x22a/0x260 > [ 65.663294][ T42] __device_attach+0x25a/0x480 > [ 65.663321][ T42] device_initial_probe+0x68/0xa0 > [ 65.663324][ T42] bus_probe_device+0x10a/0x1d0 > [ 65.663328][ T42] device_add+0x56b/0x9c0 > [ 65.663332][ T42] usb_set_configuration+0x1775/0x1d80 > [ 65.663337][ T42] usb_generic_driver_probe+0x61/0xf0 > [ 65.663343][ T42] usb_probe_device+0xd3/0x2a0 > [ 65.663346][ T42] really_probe+0x259/0x9a0 > [ 65.663350][ T42] __driver_probe_device+0x18b/0x370 > [ 65.663354][ T42] driver_probe_device+0x4b/0x1e0 > [ 65.663357][ T42] __device_attach_driver+0x1d0/0x2f0 > [ 65.663363][ T42] bus_for_each_drv+0x22a/0x260 > [ 65.663381][ T42] __device_attach+0x25a/0x480 > [ 65.663403][ T42] device_initial_probe+0x68/0xa0 > [ 65.663405][ T42] bus_probe_device+0x10a/0x1d0 > [ 65.663409][ T42] device_add+0x56b/0x9c0 > [ 65.663412][ T42] usb_new_device+0xbdd/0x1830 > [ 65.663423][ T42] hub_event+0x2358/0x4090 > [ 65.663443][ T42] process_scheduled_works+0x73d/0xed0 > [ 65.663451][ T42] worker_thread+0x7d6/0xb60 > [ 65.663459][ T42] kthread+0x322/0x410 > [ 65.663470][ T42] ret_from_fork+0x285/0x750 > [ 65.663485][ T42] ret_from_fork_asm+0x1a/0x30 > [ 65.663491][ T42] </TASK> > [ 65.663493][ T42] > [ 65.702422][ T42] Freed by task 42 on cpu 1 at 65.659497s: > [ 65.702994][ T42] kasan_save_track+0x2e/0x90 > [ 65.703471][ T42] kasan_save_free_info+0x3c/0x50 > [ 65.703965][ T42] __kasan_slab_free+0x36/0x60 > [ 65.704450][ T42] kfree+0x154/0x450 > [ 65.704839][ T42] au8522_release_state+0x1b6/0x210 > [ 65.705364][ T42] dvb_frontend_put+0x12a/0x170 > [ 65.705848][ T42] au0828_dvb_register+0xfd9/0x15f0 > [ 65.706373][ T42] au0828_usb_probe+0x353/0x4b0 > [ 65.706854][ T42] usb_probe_interface+0x4aa/0xa40 > [ 65.707373][ T42] really_probe+0x259/0x9a0 > [ 65.707822][ T42] __driver_probe_device+0x18b/0x370 > [ 65.708347][ T42] driver_probe_device+0x4b/0x1e0 > [ 65.708845][ T42] __device_attach_driver+0x1d0/0x2f0 > [ 65.709383][ T42] bus_for_each_drv+0x22a/0x260 > [ 65.709864][ T42] __device_attach+0x25a/0x480 > [ 65.710339][ T42] device_initial_probe+0x68/0xa0 > [ 65.710836][ T42] bus_probe_device+0x10a/0x1d0 > [ 65.711323][ T42] device_add+0x56b/0x9c0 > [ 65.711750][ T42] usb_set_configuration+0x1775/0x1d80 > [ 65.712294][ T42] usb_generic_driver_probe+0x61/0xf0 > [ 65.712822][ T42] usb_probe_device+0xd3/0x2a0 > [ 65.713305][ T42] really_probe+0x259/0x9a0 > [ 65.713752][ T42] __driver_probe_device+0x18b/0x370 > [ 65.714282][ T42] driver_probe_device+0x4b/0x1e0 > [ 65.714779][ T42] __device_attach_driver+0x1d0/0x2f0 > [ 65.715313][ T42] bus_for_each_drv+0x22a/0x260 > [ 65.715794][ T42] __device_attach+0x25a/0x480 > [ 65.716271][ T42] device_initial_probe+0x68/0xa0 > [ 65.716767][ T42] bus_probe_device+0x10a/0x1d0 > [ 65.717262][ T42] device_add+0x56b/0x9c0 > [ 65.717690][ T42] usb_new_device+0xbdd/0x1830 > [ 65.717869][ C0] clocksource: Watchdog remote CPU 1 read timed out > [ 65.718172][ T42] hub_event+0x2358/0x4090 > [ 65.718177][ T42] process_scheduled_works+0x73d/0xed0 > [ 65.718180][ T42] worker_thread+0x7d6/0xb60 > [ 65.718183][ T42] kthread+0x322/0x410 > [ 65.718187][ T42] ret_from_fork+0x285/0x750 > [ 65.718189][ T42] ret_from_fork_asm+0x1a/0x30 > [ 65.718192][ T42] > [ 65.718194][ T42] The buggy address belongs to the object at ffff8881685f4000 > [ 65.718194][ T42] which belongs to the cache kmalloc-4k of size 4096 > [ 65.718197][ T42] The buggy address is located 280 bytes inside of > [ 65.718197][ T42] freed 4096-byte region [ffff8881685f4000, ffff8881685f5000) > [ 65.718200][ T42] > [ 65.718201][ T42] The buggy address belongs to the physical page: > [ 65.718204][ T42] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1685f0 > [ 65.718209][ T42] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 > [ 65.718212][ T42] flags: 0x17ff00000000040(head|node=0|zone=2|lastcpupid=0x7ff) > [ 65.729357][ T42] page_type: f5(slab) > [ 65.729757][ T42] raw: 017ff00000000040 ffff888100042140 dead000000000100 dead000000000122 > [ 65.730603][ T42] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 > [ 65.731450][ T42] head: 017ff00000000040 ffff888100042140 dead000000000100 dead000000000122 > [ 65.732301][ T42] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 > [ 65.733211][ T42] head: 017ff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff > [ 65.734064][ T42] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 > [ 65.734922][ T42] page dumped because: kasan: bad access detected > [ 65.735562][ T42] page_owner tracks the page as allocated > [ 65.736133][ T42] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__G2 > [ 65.738177][ T42] post_alloc_hook+0x152/0x180 > [ 65.738654][ T42] get_page_from_freelist+0x3996/0x3b50 > [ 65.739207][ T42] __alloc_frozen_pages_noprof+0x243/0x750 > [ 65.739783][ T42] allocate_slab+0x76/0x5e0 > [ 65.740242][ T42] refill_objects+0x2e1/0x360 > [ 65.740706][ T42] __pcs_replace_empty_main+0x233/0x440 > [ 65.741262][ T42] __kmalloc_cache_noprof+0x2d0/0x490 > [ 65.741791][ T42] au8522_get_state+0x266/0x4c0 > [ 65.742280][ T42] au8522_attach+0xba/0x2d0 > [ 65.742728][ T42] au0828_dvb_register+0xcc/0x15f0 > [ 65.743241][ T42] au0828_usb_probe+0x353/0x4b0 > [ 65.743723][ T42] usb_probe_interface+0x4aa/0xa40 > [ 65.744264][ T42] really_probe+0x259/0x9a0 > [ 65.744713][ T42] __driver_probe_device+0x18b/0x370 > [ 65.745246][ T42] driver_probe_device+0x4b/0x1e0 > [ 65.745745][ T42] __device_attach_driver+0x1d0/0x2f0 > [ 65.746284][ T42] page last free pid 4578 tgid 4578 stack trace: > [ 65.746909][ T42] __free_frozen_pages+0xb8c/0xcb0 > [ 65.747427][ T42] __slab_free+0x219/0x260 > [ 65.747870][ T42] qlist_free_all+0x33/0x120 > [ 65.748339][ T42] kasan_quarantine_reduce+0x152/0x170 > [ 65.748877][ T42] __kasan_slab_alloc+0x1f/0x60 > [ 65.749368][ T42] kmem_cache_alloc_noprof+0x1f0/0x480 > [ 65.749908][ T42] do_getname+0x2a/0x1c0 > [ 65.750337][ T42] do_sys_openat2+0x99/0x190 > [ 65.750798][ T42] __x64_sys_openat+0x20b/0x260 > [ 65.751287][ T42] do_syscall_64+0x125/0x590 > [ 65.751744][ T42] entry_SYSCALL_64_after_hwframe+0x76/0x7e > [ 65.752334][ T42] > [ 65.752572][ T42] Memory state around the buggy address: > [ 65.753132][ T42] ffff8881685f4000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > [ 65.753918][ T42] ffff8881685f4080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > [ 65.754712][ T42] >ffff8881685f4100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > [ 65.755504][ T42] ^ > [ 65.755985][ T42] ffff8881685f4180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > [ 65.756775][ T42] ffff8881685f4200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb > [ 65.757575][ T42] ================================================================== > [ 65.758570][ T42] Kernel panic - not syncing: KASAN: panic_on_warn set ... > [ 65.759306][ T42] CPU: 1 UID: 0 PID: 42 Comm: kworker/1:1 Not tainted 7.1.0-rc5-00006-ge8c2f9fdadee #16 PREEMPT( > [ 65.760402][ T42] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debia4 > [ 65.761615][ T42] Workqueue: usb_hub_wq hub_event > [ 65.762263][ T42] Call Trace: > [ 65.762658][ T42] <TASK> > [ 65.762956][ T42] dump_stack_lvl+0x26/0x80 > [ 65.763420][ T42] vpanic+0x37d/0x710 > [ 65.764686][ T42] panic+0x9f/0xa0 > [ 65.767120][ T42] check_panic_on_warn+0x58/0x70 > [ 65.768155][ T42] end_report+0x44/0xe0 > [ 65.769116][ T42] kasan_report+0xd4/0x100 > [ 65.770092][ T42] au0828_dvb_register+0x1280/0x15f0 > [ 65.771097][ T42] au0828_usb_probe+0x353/0x4b0 > [ 65.771586][ T42] usb_probe_interface+0x4aa/0xa40 > [ 65.772089][ T42] really_probe+0x259/0x9a0 > [ 65.772549][ T42] __driver_probe_device+0x18b/0x370 > [ 65.773069][ T42] driver_probe_device+0x4b/0x1e0 > [ 65.773576][ T42] __device_attach_driver+0x1d0/0x2f0 > [ 65.774692][ T42] bus_for_each_drv+0x22a/0x260 > [ 65.777453][ T42] __device_attach+0x25a/0x480 > [ 65.780818][ T42] device_initial_probe+0x68/0xa0 > [ 65.781322][ T42] bus_probe_device+0x10a/0x1d0 > [ 65.781800][ T42] device_add+0x56b/0x9c0 > [ 65.782284][ T42] usb_set_configuration+0x1775/0x1d80 > [ 65.782822][ T42] usb_generic_driver_probe+0x61/0xf0 > [ 65.783361][ T42] usb_probe_device+0xd3/0x2a0 > [ 65.783832][ T42] really_probe+0x259/0x9a0 > [ 65.784286][ T42] __driver_probe_device+0x18b/0x370 > [ 65.784804][ T42] driver_probe_device+0x4b/0x1e0 > [ 65.785304][ T42] __device_attach_driver+0x1d0/0x2f0 > [ 65.786416][ T42] bus_for_each_drv+0x22a/0x260 > [ 65.789198][ T42] __device_attach+0x25a/0x480 > [ 65.792606][ T42] device_initial_probe+0x68/0xa0 > [ 65.793101][ T42] bus_probe_device+0x10a/0x1d0 > [ 65.793602][ T42] device_add+0x56b/0x9c0 > [ 65.794028][ T42] usb_new_device+0xbdd/0x1830 > [ 65.795025][ T42] hub_event+0x2358/0x4090 > [ 65.797580][ T42] process_scheduled_works+0x73d/0xed0 > [ 65.798124][ T42] worker_thread+0x7d6/0xb60 > [ 65.799085][ T42] kthread+0x322/0x410 > [ 65.800465][ T42] ret_from_fork+0x285/0x750 > [ 65.802356][ T42] ret_from_fork_asm+0x1a/0x30 > [ 65.802830][ T42] </TASK> > [ 65.803886][ T42] Kernel Offset: disabled > [ 65.804329][ T42] ---[ end Kernel panic - not syncing: KASAN: panic_on_warn set ... ]— > >>> >>> [ 141.481576][ T48] ================================================================== >>> [ 141.482348][ T48] BUG: KASAN: slab-use-after-free in au0828_dvb_register (drivers/media/usb/au0828/au0828-dvb.c:636) >>> [ 141.483148][ T48] Read of size 8 at addr ffff888171d4a118 by task kworker/1:1/48 >>> [ 141.483903][ T48] >>> [ 141.484144][ T48] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.34 >>> [ 141.484148][ T48] Workqueue: usb_hub_wq hub_event >>> [ 141.484154][ T48] Call Trace: >>> [ 141.484157][ T48] <TASK> >>> [ 141.484159][ T48] dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) >>> [ 141.484164][ T48] print_report (mm/kasan/report.c:378 mm/kasan/report.c:482) >>> [ 141.484177][ T48] kasan_report (mm/kasan/report.c:595) >>> [ 141.484183][ T48] au0828_dvb_register (drivers/media/usb/au0828/au0828-dvb.c:636) >>> [ 141.484190][ T48] au0828_usb_probe (drivers/media/usb/au0828/au0828-core.c:733) >>> [ 141.484193][ T48] usb_probe_interface (drivers/usb/core/driver.c:396) >>> [ 141.484198][ T48] really_probe (drivers/base/dd.c:? drivers/base/dd.c:709) >>> [ 141.484204][ T48] __driver_probe_device (drivers/base/dd.c:871) >>> [ 141.484207][ T48] driver_probe_device (drivers/base/dd.c:901) >>> [ 141.484211][ T48] __device_attach_driver (drivers/base/dd.c:1029) >>> [ 141.484217][ T48] bus_for_each_drv (drivers/base/bus.c:500) >>> [ 141.484264][ T48] __device_attach (drivers/base/dd.c:1101) >>> [ 141.484289][ T48] device_initial_probe (drivers/base/dd.c:1156) >>> [ 141.484292][ T48] bus_probe_device (drivers/base/bus.c:613) >>> [ 141.484296][ T48] device_add (drivers/base/core.c:3706) >>> [ 141.484299][ T48] usb_set_configuration (drivers/usb/core/message.c:2268) >>> [ 141.484303][ T48] usb_generic_driver_probe (drivers/usb/core/generic.c:250) >>> [ 141.484308][ T48] usb_probe_device (drivers/usb/core/driver.c:291) >>> [ 141.484311][ T48] really_probe (drivers/base/dd.c:? drivers/base/dd.c:709) >>> [ 141.484315][ T48] __driver_probe_device (drivers/base/dd.c:871) >>> [ 141.484318][ T48] driver_probe_device (drivers/base/dd.c:901) >>> [ 141.484321][ T48] __device_attach_driver (drivers/base/dd.c:1029) >>> [ 141.484328][ T48] bus_for_each_drv (drivers/base/bus.c:500) >>> [ 141.484346][ T48] __device_attach (drivers/base/dd.c:1101) >>> [ 141.484367][ T48] device_initial_probe (drivers/base/dd.c:1156) >>> [ 141.484370][ T48] bus_probe_device (drivers/base/bus.c:613) >>> [ 141.484374][ T48] device_add (drivers/base/core.c:3706) >>> [ 141.484376][ T48] usb_new_device (drivers/usb/core/hub.c:2695) >>> [ 141.484386][ T48] hub_event (drivers/usb/core/hub.c:5567 drivers/usb/core/hub.c:5707 drivers/usb/core/hub.c:5871 drivers/usb/core/hub.c:5953) >>> [ 141.484406][ T48] process_scheduled_works (kernel/workqueue.c:3314 kernel/workqueue.c:3397) >>> [ 141.484412][ T48] worker_thread (kernel/workqueue.c:3478) >>> [ 141.484420][ T48] kthread (kernel/kthread.c:436) >>> [ 141.484431][ T48] ret_from_fork (arch/x86/kernel/process.c:158) >>> [ 141.484445][ T48] ret_from_fork_asm (arch/x86/entry/entry_64.S:245) >>> [ 141.484450][ T48] </TASK> >>> [ 141.484451][ T48] >>> [ 141.523531][ T48] Freed by task 48 on cpu 1 at 141.481575s: >>> [ 141.524120][ T48] kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78) >>> [ 141.524594][ T48] kasan_save_free_info (mm/kasan/generic.c:584) >>> [ 141.525089][ T48] __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285) >>> [ 141.525570][ T48] kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6566) >>> [ 141.525957][ T48] au8522_release_state (drivers/media/dvb-frontends/au8522_common.c:124) >>> [ 141.526467][ T48] dvb_frontend_put (drivers/media/dvb-core/dvb_frontend.c:3093 drivers/media/dvb-core/dvb_frontend.c:141 drivers/media/dvb-core/dvb_frontend.c:166) >>> [ 141.526957][ T48] au0828_dvb_register (drivers/media/usb/au0828/au0828-dvb.c:518 drivers/media/usb/au0828/au0828-dvb.c:634) >>> [ 141.527469][ T48] au0828_usb_probe (drivers/media/usb/au0828/au0828-core.c:733) >>> [ 141.527952][ T48] usb_probe_interface (drivers/usb/core/driver.c:396) >>> [ 141.528455][ T48] really_probe (drivers/base/dd.c:? drivers/base/dd.c:709) >>> [ 141.528908][ T48] __driver_probe_device (drivers/base/dd.c:871) >>> [ 141.529426][ T48] driver_probe_device (drivers/base/dd.c:901) >>> [ 141.529932][ T48] __device_attach_driver (drivers/base/dd.c:1029) >>> [ 141.530459][ T48] bus_for_each_drv (drivers/base/bus.c:500) >>> [ 141.530949][ T48] __device_attach (drivers/base/dd.c:1101) >>> [ 141.531419][ T48] device_initial_probe (drivers/base/dd.c:1156) >>> [ 141.531923][ T48] bus_probe_device (drivers/base/bus.c:613) >>> [ 141.532404][ T48] device_add (drivers/base/core.c:3706) >>> [ 141.532840][ T48] usb_set_configuration (drivers/usb/core/message.c:2268) >>> [ 141.533373][ T48] usb_generic_driver_probe (drivers/usb/core/generic.c:250) >>> [ 141.533907][ T48] usb_probe_device (drivers/usb/core/driver.c:291) >>> [ 141.534377][ T48] really_probe (drivers/base/dd.c:? drivers/base/dd.c:709) >>> [ 141.534833][ T48] __driver_probe_device (drivers/base/dd.c:871) >>> [ 141.535352][ T48] driver_probe_device (drivers/base/dd.c:901) >>> [ 141.535856][ T48] __device_attach_driver (drivers/base/dd.c:1029) >>> [ 141.536384][ T48] bus_for_each_drv (drivers/base/bus.c:500) >>> [ 141.536869][ T48] __device_attach (drivers/base/dd.c:1101) >>> [ 141.537340][ T48] device_initial_probe (drivers/base/dd.c:1156) >>> [ 141.537839][ T48] bus_probe_device (drivers/base/bus.c:613) >>> [ 141.538320][ T48] device_add (drivers/base/core.c:3706) >>> [ 141.538753][ T48] usb_new_device (drivers/usb/core/hub.c:2695) >>> [ 141.539226][ T48] hub_event (drivers/usb/core/hub.c:5567 drivers/usb/core/hub.c:5707 drivers/usb/core/hub.c:5871 drivers/usb/core/hub.c:5953) >>> [ 141.539672][ T48] process_scheduled_works (kernel/workqueue.c:3314 kernel/workqueue.c:3397) >>> [ 141.540205][ T48] worker_thread (kernel/workqueue.c:3478) >>> [ 141.540666][ T48] kthread (kernel/kthread.c:436) >>> [ 141.541069][ T48] ret_from_fork (arch/x86/kernel/process.c:158) >>> [ 141.541524][ T48] ret_from_fork_asm (arch/x86/entry/entry_64.S:245) >>> [ 141.541999][ T48] >>> [ 141.542236][ T48] The buggy address belongs to the object at ffff888171d4a000 >>> [ 141.542236][ T48] which belongs to the cache kmalloc-4k of size 4096 >>> [ 141.543602][ T48] The buggy address is located 280 bytes inside of >>> [ 141.543602][ T48] freed 4096-byte region [ffff888171d4a000, ffff888171d4b000) ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [BUG] KASAN: slab-use-after-free in au0828_dvb_register 2026-06-01 3:38 ` Pei Xiao @ 2026-06-01 20:35 ` Shuangpeng 2026-06-02 2:44 ` Pei Xiao 0 siblings, 1 reply; 8+ messages in thread From: Shuangpeng @ 2026-06-01 20:35 UTC (permalink / raw) To: Pei Xiao Cc: xiaopeitux, brad, hverkuil+cisco, linux-kernel, linux-media, mchehab, mingo, tglx > On May 31, 2026, at 23:38, Pei Xiao <xiaopei01@kylinos.cn> wrote: > > > > 在 2026/5/30 03:22, Shuangpeng 写道: >> >>> On May 29, 2026, at 04:30, xiaopeitux@foxmail.com wrote: >>> >>> From: Pei Xiao <xiaopei01@kylinos.cn> >>> >>>> Hi Kernel Maintainers, >>>> >>>> We hit the following KASAN report while testing current upstream kernel: >>>> >>>> KASAN: slab-use-after-free in au0828_dvb_register >>>> >>>> on commit: e8c2f9fdadee7cbc75134dc463c1e0d856d6e5c7 (May 25 2026) >>>> >>>> The reproducer and .config files are here. >>>> https://gist.github.com/shuangpengbai/c31163f8ef234ba4fe85038c2f97f9cc >>>> >>>> I’m happy to test debug patches or provide additional information. >>>> >>>> Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com> >>> Can you help post all the crash logs? >>> Does the kernel log have this print: >>> "The frontend of your DVB/ATSC card isn't supported yet." >> I did not see this message in log. >> >> >>> Please help post all the logs, thank you! >> Thank you for taking a look. All terminal outputs after running the reproducer: > au0828_usb_probe > au0828_dvb_register > dvb_attach(xc5000_attach, dvb->frontend, > dvb_register > if (dvb->frontend->ops.release) > dvb->frontend->ops.release(dvb->frontend); > > dvb_register > result = dvb_register_frontend(&dvb->adapter, dvb->frontend); > pr_err("dvb_register_frontend failed (errno = %d)\n",//-12, no kref_init(&fe->refcount);，fe->frontend_priv is NULL > result); > goto fail_frontend > > fail_frontend: > dvb_frontend_detach(dvb->frontend); > > dvb_frontend_detach: > dvb_frontend_put > __dvb_frontend_free > dvb_frontend_invoke_release(fe, fe->ops.release); > > > static void dvb_frontend_invoke_release(struct dvb_frontend *fe, > void (*release)(struct dvb_frontend *fe)) > { > if (release) { > release(fe); > #ifdef CONFIG_MEDIA_ATTACH > dvb_detach(release); > #endif > } > } > > au8522_attach > .release = au8522_release, > au8522_release_state > kfree(state);//have free > > How did this problem occur, and is the probability of it occurring high? I found this issue during testing kernel with our tool. This bug can be reliably reproduced. > so we can remove in au0828_dvb_register function follow lines to fix this UAF bug? > > ret = dvb_register(dev); > if (ret < 0) { > // if (dvb->frontend->ops.release) > // dvb->frontend->ops.release(dvb->frontend); > // dvb->frontend = NULL; > return ret; > } > Could you please help test this modified code? Could you please confirm whether the following is the intended change? I locally tested it by commenting out the three lines in the error path of au0828_dvb_register(): diff --git a/drivers/media/usb/au0828/au0828-dvb.c b/drivers/media/usb/au0828/au0828-dvb.c index 31123e6f9fc3..f3d5a2b0de71 100644 --- a/drivers/media/usb/au0828/au0828-dvb.c +++ b/drivers/media/usb/au0828/au0828-dvb.c @@ -633,9 +633,9 @@ int au0828_dvb_register(struct au0828_dev *dev) /* register everything */ ret = dvb_register(dev); if (ret < 0) { - if (dvb->frontend->ops.release) - dvb->frontend->ops.release(dvb->frontend); - dvb->frontend = NULL; + // if (dvb->frontend->ops.release) + // dvb->frontend->ops.release(dvb->frontend); + // dvb->frontend = NULL; return ret; } With this change, I reran the reproducer and hit a NULL pointer dereference: [ 90.096547][ T10] BUG: kernel NULL pointer dereference, address: 0000000000000000 [ 90.107156][ T10] au0828_dvb_unregister (drivers/media/usb/au0828/au0828-dvb.c:543) [ 90.107518][ T10] au0828_usb_disconnect (drivers/media/usb/au0828/au0828-core.c:179) [ 90.107875][ T10] usb_unbind_interface (drivers/usb/core/driver.c:458) [ 90.108965][ T10] device_release_driver_internal (drivers/base/dd.c:621 drivers/base/dd.c:1352 drivers/base/dd.c:1375) [ 90.109384][ T10] bus_remove_device (drivers/base/bus.c:657) [ 90.110494][ T10] device_del (drivers/base/core.c:3895) [ 90.111787][ T10] usb_disable_device (drivers/usb/core/message.c:1478) [ 90.112134][ T10] usb_disconnect (drivers/input/misc/yealink.c:421) [ 90.112460][ T10] hub_event (drivers/usb/core/hub.c:5407 drivers/usb/core/hub.c:5707 drivers/usb/core/hub.c:5871 drivers/usb/core/hub.c:5953) [ 90.114436][ T10] process_scheduled_works (kernel/workqueue.c:3314 kernel/workqueue.c:3397) [ 90.114817][ T10] worker_thread (kernel/workqueue.c:3478) [ 90.115490][ T10] kthread (kernel/kthread.c:436) [ 90.116448][ T10] ret_from_fork (arch/x86/kernel/process.c:158) [ 90.117759][ T10] ret_from_fork_asm (arch/x86/entry/entry_64.S:245) The crash happens in au0828_dvb_unregister() at: dvb->demux.dmx.remove_frontend(&dvb->demux.dmx, &dvb->fe_mem); So if this is the intended change, it seems to avoid the original release path, but it also leaves the device in a partially initialized state and triggers a NULL pointer dereference during disconnect. Please let me know if there is a new patch you would like me to test. >> [ 64.807294][ T42] usb 3-1: new high-speed USB device number 2 using dummy_hcd >> [ 64.958989][ T42] usb 3-1: New USB device found, idVendor=0fe9, idProduct=d620, bcdDevice= 1.00 >> [ 64.961560][ T42] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 >> [ 65.351442][ T42] au0828: i2c bus registered >> [ 65.634777][ T42] au8522 1-0047: creating new instance >> [ 65.655406][ T42] DVB: Unable to find symbol xc5000_attach() >> [ 65.656022][ T42] dvbdev: DVB: registering new adapter (au0828) >> [ 65.656632][ T42] au0828: dvb_register_frontend failed (errno = -12) >> [ 65.658957][ T42] au8522 1-0047: destroying instance >> [ 65.659499][ T42] ================================================================== >> [ 65.660261][ T42] BUG: KASAN: slab-use-after-free in au0828_dvb_register+0x1280/0x15f0 >> [ 65.661023][ T42] Read of size 8 at addr ffff8881685f4118 by task kworker/1:1/42 >> [ 65.661742][ T42] >> [ 65.661973][ T42] CPU: 1 UID: 0 PID: 42 Comm: kworker/1:1 Not tainted 7.1.0-rc5-00006-ge8c2f9fdadee #16 PREEMPT( >> [ 65.661978][ T42] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debia4 >> [ 65.661981][ T42] Workqueue: usb_hub_wq hub_event >> [ 65.661988][ T42] Call Trace: >> [ 65.661991][ T42] <TASK> >> [ 65.661993][ T42] dump_stack_lvl+0x26/0x80 >> [ 65.661999][ T42] print_report+0x16a/0x5d0 >> [ 65.662013][ T42] kasan_report+0xc3/0x100 >> [ 65.662019][ T42] au0828_dvb_register+0x1280/0x15f0 >> [ 65.662026][ T42] au0828_usb_probe+0x353/0x4b0 >> [ 65.662029][ T42] usb_probe_interface+0x4aa/0xa40 >> [ 65.662034][ T42] really_probe+0x259/0x9a0 >> [ 65.662041][ T42] __driver_probe_device+0x18b/0x370 >> [ 65.662045][ T42] driver_probe_device+0x4b/0x1e0 >> [ 65.662049][ T42] __device_attach_driver+0x1d0/0x2f0 >> [ 65.662055][ T42] bus_for_each_drv+0x22a/0x260 >> [ 65.663294][ T42] __device_attach+0x25a/0x480 >> [ 65.663321][ T42] device_initial_probe+0x68/0xa0 >> [ 65.663324][ T42] bus_probe_device+0x10a/0x1d0 >> [ 65.663328][ T42] device_add+0x56b/0x9c0 >> [ 65.663332][ T42] usb_set_configuration+0x1775/0x1d80 >> [ 65.663337][ T42] usb_generic_driver_probe+0x61/0xf0 >> [ 65.663343][ T42] usb_probe_device+0xd3/0x2a0 >> [ 65.663346][ T42] really_probe+0x259/0x9a0 >> [ 65.663350][ T42] __driver_probe_device+0x18b/0x370 >> [ 65.663354][ T42] driver_probe_device+0x4b/0x1e0 >> [ 65.663357][ T42] __device_attach_driver+0x1d0/0x2f0 >> [ 65.663363][ T42] bus_for_each_drv+0x22a/0x260 >> [ 65.663381][ T42] __device_attach+0x25a/0x480 >> [ 65.663403][ T42] device_initial_probe+0x68/0xa0 >> [ 65.663405][ T42] bus_probe_device+0x10a/0x1d0 >> [ 65.663409][ T42] device_add+0x56b/0x9c0 >> [ 65.663412][ T42] usb_new_device+0xbdd/0x1830 >> [ 65.663423][ T42] hub_event+0x2358/0x4090 >> [ 65.663443][ T42] process_scheduled_works+0x73d/0xed0 >> [ 65.663451][ T42] worker_thread+0x7d6/0xb60 >> [ 65.663459][ T42] kthread+0x322/0x410 >> [ 65.663470][ T42] ret_from_fork+0x285/0x750 >> [ 65.663485][ T42] ret_from_fork_asm+0x1a/0x30 >> [ 65.663491][ T42] </TASK> >> [ 65.663493][ T42] >> [ 65.702422][ T42] Freed by task 42 on cpu 1 at 65.659497s: >> [ 65.702994][ T42] kasan_save_track+0x2e/0x90 >> [ 65.703471][ T42] kasan_save_free_info+0x3c/0x50 >> [ 65.703965][ T42] __kasan_slab_free+0x36/0x60 >> [ 65.704450][ T42] kfree+0x154/0x450 >> [ 65.704839][ T42] au8522_release_state+0x1b6/0x210 >> [ 65.705364][ T42] dvb_frontend_put+0x12a/0x170 >> [ 65.705848][ T42] au0828_dvb_register+0xfd9/0x15f0 >> [ 65.706373][ T42] au0828_usb_probe+0x353/0x4b0 >> [ 65.706854][ T42] usb_probe_interface+0x4aa/0xa40 >> [ 65.707373][ T42] really_probe+0x259/0x9a0 >> [ 65.707822][ T42] __driver_probe_device+0x18b/0x370 >> [ 65.708347][ T42] driver_probe_device+0x4b/0x1e0 >> [ 65.708845][ T42] __device_attach_driver+0x1d0/0x2f0 >> [ 65.709383][ T42] bus_for_each_drv+0x22a/0x260 >> [ 65.709864][ T42] __device_attach+0x25a/0x480 >> [ 65.710339][ T42] device_initial_probe+0x68/0xa0 >> [ 65.710836][ T42] bus_probe_device+0x10a/0x1d0 >> [ 65.711323][ T42] device_add+0x56b/0x9c0 >> [ 65.711750][ T42] usb_set_configuration+0x1775/0x1d80 >> [ 65.712294][ T42] usb_generic_driver_probe+0x61/0xf0 >> [ 65.712822][ T42] usb_probe_device+0xd3/0x2a0 >> [ 65.713305][ T42] really_probe+0x259/0x9a0 >> [ 65.713752][ T42] __driver_probe_device+0x18b/0x370 >> [ 65.714282][ T42] driver_probe_device+0x4b/0x1e0 >> [ 65.714779][ T42] __device_attach_driver+0x1d0/0x2f0 >> [ 65.715313][ T42] bus_for_each_drv+0x22a/0x260 >> [ 65.715794][ T42] __device_attach+0x25a/0x480 >> [ 65.716271][ T42] device_initial_probe+0x68/0xa0 >> [ 65.716767][ T42] bus_probe_device+0x10a/0x1d0 >> [ 65.717262][ T42] device_add+0x56b/0x9c0 >> [ 65.717690][ T42] usb_new_device+0xbdd/0x1830 >> [ 65.717869][ C0] clocksource: Watchdog remote CPU 1 read timed out >> [ 65.718172][ T42] hub_event+0x2358/0x4090 >> [ 65.718177][ T42] process_scheduled_works+0x73d/0xed0 >> [ 65.718180][ T42] worker_thread+0x7d6/0xb60 >> [ 65.718183][ T42] kthread+0x322/0x410 >> [ 65.718187][ T42] ret_from_fork+0x285/0x750 >> [ 65.718189][ T42] ret_from_fork_asm+0x1a/0x30 >> [ 65.718192][ T42] >> [ 65.718194][ T42] The buggy address belongs to the object at ffff8881685f4000 >> [ 65.718194][ T42] which belongs to the cache kmalloc-4k of size 4096 >> [ 65.718197][ T42] The buggy address is located 280 bytes inside of >> [ 65.718197][ T42] freed 4096-byte region [ffff8881685f4000, ffff8881685f5000) >> [ 65.718200][ T42] >> [ 65.718201][ T42] The buggy address belongs to the physical page: >> [ 65.718204][ T42] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1685f0 >> [ 65.718209][ T42] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 >> [ 65.718212][ T42] flags: 0x17ff00000000040(head|node=0|zone=2|lastcpupid=0x7ff) >> [ 65.729357][ T42] page_type: f5(slab) >> [ 65.729757][ T42] raw: 017ff00000000040 ffff888100042140 dead000000000100 dead000000000122 >> [ 65.730603][ T42] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 >> [ 65.731450][ T42] head: 017ff00000000040 ffff888100042140 dead000000000100 dead000000000122 >> [ 65.732301][ T42] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 >> [ 65.733211][ T42] head: 017ff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff >> [ 65.734064][ T42] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 >> [ 65.734922][ T42] page dumped because: kasan: bad access detected >> [ 65.735562][ T42] page_owner tracks the page as allocated >> [ 65.736133][ T42] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__G2 >> [ 65.738177][ T42] post_alloc_hook+0x152/0x180 >> [ 65.738654][ T42] get_page_from_freelist+0x3996/0x3b50 >> [ 65.739207][ T42] __alloc_frozen_pages_noprof+0x243/0x750 >> [ 65.739783][ T42] allocate_slab+0x76/0x5e0 >> [ 65.740242][ T42] refill_objects+0x2e1/0x360 >> [ 65.740706][ T42] __pcs_replace_empty_main+0x233/0x440 >> [ 65.741262][ T42] __kmalloc_cache_noprof+0x2d0/0x490 >> [ 65.741791][ T42] au8522_get_state+0x266/0x4c0 >> [ 65.742280][ T42] au8522_attach+0xba/0x2d0 >> [ 65.742728][ T42] au0828_dvb_register+0xcc/0x15f0 >> [ 65.743241][ T42] au0828_usb_probe+0x353/0x4b0 >> [ 65.743723][ T42] usb_probe_interface+0x4aa/0xa40 >> [ 65.744264][ T42] really_probe+0x259/0x9a0 >> [ 65.744713][ T42] __driver_probe_device+0x18b/0x370 >> [ 65.745246][ T42] driver_probe_device+0x4b/0x1e0 >> [ 65.745745][ T42] __device_attach_driver+0x1d0/0x2f0 >> [ 65.746284][ T42] page last free pid 4578 tgid 4578 stack trace: >> [ 65.746909][ T42] __free_frozen_pages+0xb8c/0xcb0 >> [ 65.747427][ T42] __slab_free+0x219/0x260 >> [ 65.747870][ T42] qlist_free_all+0x33/0x120 >> [ 65.748339][ T42] kasan_quarantine_reduce+0x152/0x170 >> [ 65.748877][ T42] __kasan_slab_alloc+0x1f/0x60 >> [ 65.749368][ T42] kmem_cache_alloc_noprof+0x1f0/0x480 >> [ 65.749908][ T42] do_getname+0x2a/0x1c0 >> [ 65.750337][ T42] do_sys_openat2+0x99/0x190 >> [ 65.750798][ T42] __x64_sys_openat+0x20b/0x260 >> [ 65.751287][ T42] do_syscall_64+0x125/0x590 >> [ 65.751744][ T42] entry_SYSCALL_64_after_hwframe+0x76/0x7e >> [ 65.752334][ T42] >> [ 65.752572][ T42] Memory state around the buggy address: >> [ 65.753132][ T42] ffff8881685f4000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >> [ 65.753918][ T42] ffff8881685f4080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >> [ 65.754712][ T42] >ffff8881685f4100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >> [ 65.755504][ T42] ^ >> [ 65.755985][ T42] ffff8881685f4180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >> [ 65.756775][ T42] ffff8881685f4200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >> [ 65.757575][ T42] ================================================================== >> [ 65.758570][ T42] Kernel panic - not syncing: KASAN: panic_on_warn set ... >> [ 65.759306][ T42] CPU: 1 UID: 0 PID: 42 Comm: kworker/1:1 Not tainted 7.1.0-rc5-00006-ge8c2f9fdadee #16 PREEMPT( >> [ 65.760402][ T42] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debia4 >> [ 65.761615][ T42] Workqueue: usb_hub_wq hub_event >> [ 65.762263][ T42] Call Trace: >> [ 65.762658][ T42] <TASK> >> [ 65.762956][ T42] dump_stack_lvl+0x26/0x80 >> [ 65.763420][ T42] vpanic+0x37d/0x710 >> [ 65.764686][ T42] panic+0x9f/0xa0 >> [ 65.767120][ T42] check_panic_on_warn+0x58/0x70 >> [ 65.768155][ T42] end_report+0x44/0xe0 >> [ 65.769116][ T42] kasan_report+0xd4/0x100 >> [ 65.770092][ T42] au0828_dvb_register+0x1280/0x15f0 >> [ 65.771097][ T42] au0828_usb_probe+0x353/0x4b0 >> [ 65.771586][ T42] usb_probe_interface+0x4aa/0xa40 >> [ 65.772089][ T42] really_probe+0x259/0x9a0 >> [ 65.772549][ T42] __driver_probe_device+0x18b/0x370 >> [ 65.773069][ T42] driver_probe_device+0x4b/0x1e0 >> [ 65.773576][ T42] __device_attach_driver+0x1d0/0x2f0 >> [ 65.774692][ T42] bus_for_each_drv+0x22a/0x260 >> [ 65.777453][ T42] __device_attach+0x25a/0x480 >> [ 65.780818][ T42] device_initial_probe+0x68/0xa0 >> [ 65.781322][ T42] bus_probe_device+0x10a/0x1d0 >> [ 65.781800][ T42] device_add+0x56b/0x9c0 >> [ 65.782284][ T42] usb_set_configuration+0x1775/0x1d80 >> [ 65.782822][ T42] usb_generic_driver_probe+0x61/0xf0 >> [ 65.783361][ T42] usb_probe_device+0xd3/0x2a0 >> [ 65.783832][ T42] really_probe+0x259/0x9a0 >> [ 65.784286][ T42] __driver_probe_device+0x18b/0x370 >> [ 65.784804][ T42] driver_probe_device+0x4b/0x1e0 >> [ 65.785304][ T42] __device_attach_driver+0x1d0/0x2f0 >> [ 65.786416][ T42] bus_for_each_drv+0x22a/0x260 >> [ 65.789198][ T42] __device_attach+0x25a/0x480 >> [ 65.792606][ T42] device_initial_probe+0x68/0xa0 >> [ 65.793101][ T42] bus_probe_device+0x10a/0x1d0 >> [ 65.793602][ T42] device_add+0x56b/0x9c0 >> [ 65.794028][ T42] usb_new_device+0xbdd/0x1830 >> [ 65.795025][ T42] hub_event+0x2358/0x4090 >> [ 65.797580][ T42] process_scheduled_works+0x73d/0xed0 >> [ 65.798124][ T42] worker_thread+0x7d6/0xb60 >> [ 65.799085][ T42] kthread+0x322/0x410 >> [ 65.800465][ T42] ret_from_fork+0x285/0x750 >> [ 65.802356][ T42] ret_from_fork_asm+0x1a/0x30 >> [ 65.802830][ T42] </TASK> >> [ 65.803886][ T42] Kernel Offset: disabled >> [ 65.804329][ T42] ---[ end Kernel panic - not syncing: KASAN: panic_on_warn set ... ]— >> >>>> >>>> [ 141.481576][ T48] ================================================================== >>>> [ 141.482348][ T48] BUG: KASAN: slab-use-after-free in au0828_dvb_register (drivers/media/usb/au0828/au0828-dvb.c:636) >>>> [ 141.483148][ T48] Read of size 8 at addr ffff888171d4a118 by task kworker/1:1/48 >>>> [ 141.483903][ T48] >>>> [ 141.484144][ T48] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.34 >>>> [ 141.484148][ T48] Workqueue: usb_hub_wq hub_event >>>> [ 141.484154][ T48] Call Trace: >>>> [ 141.484157][ T48] <TASK> >>>> [ 141.484159][ T48] dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) >>>> [ 141.484164][ T48] print_report (mm/kasan/report.c:378 mm/kasan/report.c:482) >>>> [ 141.484177][ T48] kasan_report (mm/kasan/report.c:595) >>>> [ 141.484183][ T48] au0828_dvb_register (drivers/media/usb/au0828/au0828-dvb.c:636) >>>> [ 141.484190][ T48] au0828_usb_probe (drivers/media/usb/au0828/au0828-core.c:733) >>>> [ 141.484193][ T48] usb_probe_interface (drivers/usb/core/driver.c:396) >>>> [ 141.484198][ T48] really_probe (drivers/base/dd.c:? drivers/base/dd.c:709) >>>> [ 141.484204][ T48] __driver_probe_device (drivers/base/dd.c:871) >>>> [ 141.484207][ T48] driver_probe_device (drivers/base/dd.c:901) >>>> [ 141.484211][ T48] __device_attach_driver (drivers/base/dd.c:1029) >>>> [ 141.484217][ T48] bus_for_each_drv (drivers/base/bus.c:500) >>>> [ 141.484264][ T48] __device_attach (drivers/base/dd.c:1101) >>>> [ 141.484289][ T48] device_initial_probe (drivers/base/dd.c:1156) >>>> [ 141.484292][ T48] bus_probe_device (drivers/base/bus.c:613) >>>> [ 141.484296][ T48] device_add (drivers/base/core.c:3706) >>>> [ 141.484299][ T48] usb_set_configuration (drivers/usb/core/message.c:2268) >>>> [ 141.484303][ T48] usb_generic_driver_probe (drivers/usb/core/generic.c:250) >>>> [ 141.484308][ T48] usb_probe_device (drivers/usb/core/driver.c:291) >>>> [ 141.484311][ T48] really_probe (drivers/base/dd.c:? drivers/base/dd.c:709) >>>> [ 141.484315][ T48] __driver_probe_device (drivers/base/dd.c:871) >>>> [ 141.484318][ T48] driver_probe_device (drivers/base/dd.c:901) >>>> [ 141.484321][ T48] __device_attach_driver (drivers/base/dd.c:1029) >>>> [ 141.484328][ T48] bus_for_each_drv (drivers/base/bus.c:500) >>>> [ 141.484346][ T48] __device_attach (drivers/base/dd.c:1101) >>>> [ 141.484367][ T48] device_initial_probe (drivers/base/dd.c:1156) >>>> [ 141.484370][ T48] bus_probe_device (drivers/base/bus.c:613) >>>> [ 141.484374][ T48] device_add (drivers/base/core.c:3706) >>>> [ 141.484376][ T48] usb_new_device (drivers/usb/core/hub.c:2695) >>>> [ 141.484386][ T48] hub_event (drivers/usb/core/hub.c:5567 drivers/usb/core/hub.c:5707 drivers/usb/core/hub.c:5871 drivers/usb/core/hub.c:5953) >>>> [ 141.484406][ T48] process_scheduled_works (kernel/workqueue.c:3314 kernel/workqueue.c:3397) >>>> [ 141.484412][ T48] worker_thread (kernel/workqueue.c:3478) >>>> [ 141.484420][ T48] kthread (kernel/kthread.c:436) >>>> [ 141.484431][ T48] ret_from_fork (arch/x86/kernel/process.c:158) >>>> [ 141.484445][ T48] ret_from_fork_asm (arch/x86/entry/entry_64.S:245) >>>> [ 141.484450][ T48] </TASK> >>>> [ 141.484451][ T48] >>>> [ 141.523531][ T48] Freed by task 48 on cpu 1 at 141.481575s: >>>> [ 141.524120][ T48] kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78) >>>> [ 141.524594][ T48] kasan_save_free_info (mm/kasan/generic.c:584) >>>> [ 141.525089][ T48] __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285) >>>> [ 141.525570][ T48] kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6566) >>>> [ 141.525957][ T48] au8522_release_state (drivers/media/dvb-frontends/au8522_common.c:124) >>>> [ 141.526467][ T48] dvb_frontend_put (drivers/media/dvb-core/dvb_frontend.c:3093 drivers/media/dvb-core/dvb_frontend.c:141 drivers/media/dvb-core/dvb_frontend.c:166) >>>> [ 141.526957][ T48] au0828_dvb_register (drivers/media/usb/au0828/au0828-dvb.c:518 drivers/media/usb/au0828/au0828-dvb.c:634) >>>> [ 141.527469][ T48] au0828_usb_probe (drivers/media/usb/au0828/au0828-core.c:733) >>>> [ 141.527952][ T48] usb_probe_interface (drivers/usb/core/driver.c:396) >>>> [ 141.528455][ T48] really_probe (drivers/base/dd.c:? drivers/base/dd.c:709) >>>> [ 141.528908][ T48] __driver_probe_device (drivers/base/dd.c:871) >>>> [ 141.529426][ T48] driver_probe_device (drivers/base/dd.c:901) >>>> [ 141.529932][ T48] __device_attach_driver (drivers/base/dd.c:1029) >>>> [ 141.530459][ T48] bus_for_each_drv (drivers/base/bus.c:500) >>>> [ 141.530949][ T48] __device_attach (drivers/base/dd.c:1101) >>>> [ 141.531419][ T48] device_initial_probe (drivers/base/dd.c:1156) >>>> [ 141.531923][ T48] bus_probe_device (drivers/base/bus.c:613) >>>> [ 141.532404][ T48] device_add (drivers/base/core.c:3706) >>>> [ 141.532840][ T48] usb_set_configuration (drivers/usb/core/message.c:2268) >>>> [ 141.533373][ T48] usb_generic_driver_probe (drivers/usb/core/generic.c:250) >>>> [ 141.533907][ T48] usb_probe_device (drivers/usb/core/driver.c:291) >>>> [ 141.534377][ T48] really_probe (drivers/base/dd.c:? drivers/base/dd.c:709) >>>> [ 141.534833][ T48] __driver_probe_device (drivers/base/dd.c:871) >>>> [ 141.535352][ T48] driver_probe_device (drivers/base/dd.c:901) >>>> [ 141.535856][ T48] __device_attach_driver (drivers/base/dd.c:1029) >>>> [ 141.536384][ T48] bus_for_each_drv (drivers/base/bus.c:500) >>>> [ 141.536869][ T48] __device_attach (drivers/base/dd.c:1101) >>>> [ 141.537340][ T48] device_initial_probe (drivers/base/dd.c:1156) >>>> [ 141.537839][ T48] bus_probe_device (drivers/base/bus.c:613) >>>> [ 141.538320][ T48] device_add (drivers/base/core.c:3706) >>>> [ 141.538753][ T48] usb_new_device (drivers/usb/core/hub.c:2695) >>>> [ 141.539226][ T48] hub_event (drivers/usb/core/hub.c:5567 drivers/usb/core/hub.c:5707 drivers/usb/core/hub.c:5871 drivers/usb/core/hub.c:5953) >>>> [ 141.539672][ T48] process_scheduled_works (kernel/workqueue.c:3314 kernel/workqueue.c:3397) >>>> [ 141.540205][ T48] worker_thread (kernel/workqueue.c:3478) >>>> [ 141.540666][ T48] kthread (kernel/kthread.c:436) >>>> [ 141.541069][ T48] ret_from_fork (arch/x86/kernel/process.c:158) >>>> [ 141.541524][ T48] ret_from_fork_asm (arch/x86/entry/entry_64.S:245) >>>> [ 141.541999][ T48] >>>> [ 141.542236][ T48] The buggy address belongs to the object at ffff888171d4a000 >>>> [ 141.542236][ T48] which belongs to the cache kmalloc-4k of size 4096 >>>> [ 141.543602][ T48] The buggy address is located 280 bytes inside of >>>> [ 141.543602][ T48] freed 4096-byte region [ffff888171d4a000, ffff888171d4b000) ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [BUG] KASAN: slab-use-after-free in au0828_dvb_register 2026-06-01 20:35 ` Shuangpeng @ 2026-06-02 2:44 ` Pei Xiao 2026-06-02 3:51 ` Shuangpeng 0 siblings, 1 reply; 8+ messages in thread From: Pei Xiao @ 2026-06-02 2:44 UTC (permalink / raw) To: Shuangpeng Cc: xiaopeitux, brad, hverkuil+cisco, linux-kernel, linux-media, mchehab, mingo, tglx 在 2026/6/2 04:35, Shuangpeng 写道: > >> On May 31, 2026, at 23:38, Pei Xiao <xiaopei01@kylinos.cn> wrote: >> >> >> >> 在 2026/5/30 03:22, Shuangpeng 写道: >>>> On May 29, 2026, at 04:30, xiaopeitux@foxmail.com wrote: >>>> >>>> From: Pei Xiao <xiaopei01@kylinos.cn> >>>> >>>>> Hi Kernel Maintainers, >>>>> >>>>> We hit the following KASAN report while testing current upstream kernel: >>>>> >>>>> KASAN: slab-use-after-free in au0828_dvb_register >>>>> >>>>> on commit: e8c2f9fdadee7cbc75134dc463c1e0d856d6e5c7 (May 25 2026) >>>>> >>>>> The reproducer and .config files are here. >>>>> https://gist.github.com/shuangpengbai/c31163f8ef234ba4fe85038c2f97f9cc >>>>> >>>>> I’m happy to test debug patches or provide additional information. >>>>> >>>>> Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com> >>>> Can you help post all the crash logs? >>>> Does the kernel log have this print: >>>> "The frontend of your DVB/ATSC card isn't supported yet." >>> I did not see this message in log. >>> >>> >>>> Please help post all the logs, thank you! >>> Thank you for taking a look. All terminal outputs after running the reproducer: >> au0828_usb_probe >> au0828_dvb_register >> dvb_attach(xc5000_attach, dvb->frontend, >> dvb_register >> if (dvb->frontend->ops.release) >> dvb->frontend->ops.release(dvb->frontend); >> >> dvb_register >> result = dvb_register_frontend(&dvb->adapter, dvb->frontend); >> pr_err("dvb_register_frontend failed (errno = %d)\n",//-12, no kref_init(&fe->refcount);，fe->frontend_priv is NULL >> result); >> goto fail_frontend >> >> fail_frontend: >> dvb_frontend_detach(dvb->frontend); >> >> dvb_frontend_detach: >> dvb_frontend_put >> __dvb_frontend_free >> dvb_frontend_invoke_release(fe, fe->ops.release); >> >> >> static void dvb_frontend_invoke_release(struct dvb_frontend *fe, >> void (*release)(struct dvb_frontend *fe)) >> { >> if (release) { >> release(fe); >> #ifdef CONFIG_MEDIA_ATTACH >> dvb_detach(release); >> #endif >> } >> } >> >> au8522_attach >> .release = au8522_release, >> au8522_release_state >> kfree(state);//have free >> >> How did this problem occur, and is the probability of it occurring high? > I found this issue during testing kernel with our tool. This bug can be reliably reproduced. > >> so we can remove in au0828_dvb_register function follow lines to fix this UAF bug? >> >> ret = dvb_register(dev); >> if (ret < 0) { >> // if (dvb->frontend->ops.release) >> // dvb->frontend->ops.release(dvb->frontend); >> // dvb->frontend = NULL; >> return ret; >> } >> Could you please help test this modified code? > Could you please confirm whether the following is the intended change? > > I locally tested it by commenting out the three lines in the error path of > au0828_dvb_register(): > > diff --git a/drivers/media/usb/au0828/au0828-dvb.c b/drivers/media/usb/au0828/au0828-dvb.c > index 31123e6f9fc3..f3d5a2b0de71 100644 > --- a/drivers/media/usb/au0828/au0828-dvb.c > +++ b/drivers/media/usb/au0828/au0828-dvb.c > @@ -633,9 +633,9 @@ int au0828_dvb_register(struct au0828_dev *dev) > /* register everything */ > ret = dvb_register(dev); > if (ret < 0) { > - if (dvb->frontend->ops.release) > - dvb->frontend->ops.release(dvb->frontend); > - dvb->frontend = NULL; > + // if (dvb->frontend->ops.release) > + // dvb->frontend->ops.release(dvb->frontend); > + // dvb->frontend = NULL; > return ret; > } > > With this change, I reran the reproducer and hit a NULL pointer > dereference: > > [ 90.096547][ T10] BUG: kernel NULL pointer dereference, address: 0000000000000000 > [ 90.107156][ T10] au0828_dvb_unregister (drivers/media/usb/au0828/au0828-dvb.c:543) > [ 90.107518][ T10] au0828_usb_disconnect (drivers/media/usb/au0828/au0828-core.c:179) > [ 90.107875][ T10] usb_unbind_interface (drivers/usb/core/driver.c:458) > [ 90.108965][ T10] device_release_driver_internal (drivers/base/dd.c:621 drivers/base/dd.c:1352 drivers/base/dd.c:1375) > [ 90.109384][ T10] bus_remove_device (drivers/base/bus.c:657) > [ 90.110494][ T10] device_del (drivers/base/core.c:3895) > [ 90.111787][ T10] usb_disable_device (drivers/usb/core/message.c:1478) > [ 90.112134][ T10] usb_disconnect (drivers/input/misc/yealink.c:421) > [ 90.112460][ T10] hub_event (drivers/usb/core/hub.c:5407 drivers/usb/core/hub.c:5707 drivers/usb/core/hub.c:5871 drivers/usb/core/hub.c:5953) > [ 90.114436][ T10] process_scheduled_works (kernel/workqueue.c:3314 kernel/workqueue.c:3397) > [ 90.114817][ T10] worker_thread (kernel/workqueue.c:3478) > [ 90.115490][ T10] kthread (kernel/kthread.c:436) > [ 90.116448][ T10] ret_from_fork (arch/x86/kernel/process.c:158) > [ 90.117759][ T10] ret_from_fork_asm (arch/x86/entry/entry_64.S:245) > > The crash happens in au0828_dvb_unregister() at: > dvb->demux.dmx.remove_frontend(&dvb->demux.dmx, &dvb->fe_mem); > > So if this is the intended change, it seems to avoid the original release path, > but it also leaves the device in a partially initialized state and triggers a > NULL pointer dereference during disconnect. Hi Shuangpeng: please test this patch: diff --git a/drivers/media/usb/au0828/au0828-dvb.c b/drivers/media/usb/au0828/au0828-dvb.c index 31123e6f9fc3..052637429d8a 100644 --- a/drivers/media/usb/au0828/au0828-dvb.c +++ b/drivers/media/usb/au0828/au0828-dvb.c @@ -633,8 +633,8 @@ int au0828_dvb_register(struct au0828_dev *dev) /* register everything */ ret = dvb_register(dev); if (ret < 0) { - if (dvb->frontend->ops.release) - dvb->frontend->ops.release(dvb->frontend); + /* dvb->frontend freed in dvb_frontend_put, now we can set + * frontent to NULL */ dvb->frontend = NULL; return ret; } thank you so much! Pei. > Please let me know if there is a new patch you would like me to test. > > >>> [ 64.807294][ T42] usb 3-1: new high-speed USB device number 2 using dummy_hcd >>> [ 64.958989][ T42] usb 3-1: New USB device found, idVendor=0fe9, idProduct=d620, bcdDevice= 1.00 >>> [ 64.961560][ T42] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 >>> [ 65.351442][ T42] au0828: i2c bus registered >>> [ 65.634777][ T42] au8522 1-0047: creating new instance >>> [ 65.655406][ T42] DVB: Unable to find symbol xc5000_attach() >>> [ 65.656022][ T42] dvbdev: DVB: registering new adapter (au0828) >>> [ 65.656632][ T42] au0828: dvb_register_frontend failed (errno = -12) >>> [ 65.658957][ T42] au8522 1-0047: destroying instance >>> [ 65.659499][ T42] ================================================================== >>> [ 65.660261][ T42] BUG: KASAN: slab-use-after-free in au0828_dvb_register+0x1280/0x15f0 >>> [ 65.661023][ T42] Read of size 8 at addr ffff8881685f4118 by task kworker/1:1/42 >>> [ 65.661742][ T42] >>> [ 65.661973][ T42] CPU: 1 UID: 0 PID: 42 Comm: kworker/1:1 Not tainted 7.1.0-rc5-00006-ge8c2f9fdadee #16 PREEMPT( >>> [ 65.661978][ T42] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debia4 >>> [ 65.661981][ T42] Workqueue: usb_hub_wq hub_event >>> [ 65.661988][ T42] Call Trace: >>> [ 65.661991][ T42] <TASK> >>> [ 65.661993][ T42] dump_stack_lvl+0x26/0x80 >>> [ 65.661999][ T42] print_report+0x16a/0x5d0 >>> [ 65.662013][ T42] kasan_report+0xc3/0x100 >>> [ 65.662019][ T42] au0828_dvb_register+0x1280/0x15f0 >>> [ 65.662026][ T42] au0828_usb_probe+0x353/0x4b0 >>> [ 65.662029][ T42] usb_probe_interface+0x4aa/0xa40 >>> [ 65.662034][ T42] really_probe+0x259/0x9a0 >>> [ 65.662041][ T42] __driver_probe_device+0x18b/0x370 >>> [ 65.662045][ T42] driver_probe_device+0x4b/0x1e0 >>> [ 65.662049][ T42] __device_attach_driver+0x1d0/0x2f0 >>> [ 65.662055][ T42] bus_for_each_drv+0x22a/0x260 >>> [ 65.663294][ T42] __device_attach+0x25a/0x480 >>> [ 65.663321][ T42] device_initial_probe+0x68/0xa0 >>> [ 65.663324][ T42] bus_probe_device+0x10a/0x1d0 >>> [ 65.663328][ T42] device_add+0x56b/0x9c0 >>> [ 65.663332][ T42] usb_set_configuration+0x1775/0x1d80 >>> [ 65.663337][ T42] usb_generic_driver_probe+0x61/0xf0 >>> [ 65.663343][ T42] usb_probe_device+0xd3/0x2a0 >>> [ 65.663346][ T42] really_probe+0x259/0x9a0 >>> [ 65.663350][ T42] __driver_probe_device+0x18b/0x370 >>> [ 65.663354][ T42] driver_probe_device+0x4b/0x1e0 >>> [ 65.663357][ T42] __device_attach_driver+0x1d0/0x2f0 >>> [ 65.663363][ T42] bus_for_each_drv+0x22a/0x260 >>> [ 65.663381][ T42] __device_attach+0x25a/0x480 >>> [ 65.663403][ T42] device_initial_probe+0x68/0xa0 >>> [ 65.663405][ T42] bus_probe_device+0x10a/0x1d0 >>> [ 65.663409][ T42] device_add+0x56b/0x9c0 >>> [ 65.663412][ T42] usb_new_device+0xbdd/0x1830 >>> [ 65.663423][ T42] hub_event+0x2358/0x4090 >>> [ 65.663443][ T42] process_scheduled_works+0x73d/0xed0 >>> [ 65.663451][ T42] worker_thread+0x7d6/0xb60 >>> [ 65.663459][ T42] kthread+0x322/0x410 >>> [ 65.663470][ T42] ret_from_fork+0x285/0x750 >>> [ 65.663485][ T42] ret_from_fork_asm+0x1a/0x30 >>> [ 65.663491][ T42] </TASK> >>> [ 65.663493][ T42] >>> [ 65.702422][ T42] Freed by task 42 on cpu 1 at 65.659497s: >>> [ 65.702994][ T42] kasan_save_track+0x2e/0x90 >>> [ 65.703471][ T42] kasan_save_free_info+0x3c/0x50 >>> [ 65.703965][ T42] __kasan_slab_free+0x36/0x60 >>> [ 65.704450][ T42] kfree+0x154/0x450 >>> [ 65.704839][ T42] au8522_release_state+0x1b6/0x210 >>> [ 65.705364][ T42] dvb_frontend_put+0x12a/0x170 >>> [ 65.705848][ T42] au0828_dvb_register+0xfd9/0x15f0 >>> [ 65.706373][ T42] au0828_usb_probe+0x353/0x4b0 >>> [ 65.706854][ T42] usb_probe_interface+0x4aa/0xa40 >>> [ 65.707373][ T42] really_probe+0x259/0x9a0 >>> [ 65.707822][ T42] __driver_probe_device+0x18b/0x370 >>> [ 65.708347][ T42] driver_probe_device+0x4b/0x1e0 >>> [ 65.708845][ T42] __device_attach_driver+0x1d0/0x2f0 >>> [ 65.709383][ T42] bus_for_each_drv+0x22a/0x260 >>> [ 65.709864][ T42] __device_attach+0x25a/0x480 >>> [ 65.710339][ T42] device_initial_probe+0x68/0xa0 >>> [ 65.710836][ T42] bus_probe_device+0x10a/0x1d0 >>> [ 65.711323][ T42] device_add+0x56b/0x9c0 >>> [ 65.711750][ T42] usb_set_configuration+0x1775/0x1d80 >>> [ 65.712294][ T42] usb_generic_driver_probe+0x61/0xf0 >>> [ 65.712822][ T42] usb_probe_device+0xd3/0x2a0 >>> [ 65.713305][ T42] really_probe+0x259/0x9a0 >>> [ 65.713752][ T42] __driver_probe_device+0x18b/0x370 >>> [ 65.714282][ T42] driver_probe_device+0x4b/0x1e0 >>> [ 65.714779][ T42] __device_attach_driver+0x1d0/0x2f0 >>> [ 65.715313][ T42] bus_for_each_drv+0x22a/0x260 >>> [ 65.715794][ T42] __device_attach+0x25a/0x480 >>> [ 65.716271][ T42] device_initial_probe+0x68/0xa0 >>> [ 65.716767][ T42] bus_probe_device+0x10a/0x1d0 >>> [ 65.717262][ T42] device_add+0x56b/0x9c0 >>> [ 65.717690][ T42] usb_new_device+0xbdd/0x1830 >>> [ 65.717869][ C0] clocksource: Watchdog remote CPU 1 read timed out >>> [ 65.718172][ T42] hub_event+0x2358/0x4090 >>> [ 65.718177][ T42] process_scheduled_works+0x73d/0xed0 >>> [ 65.718180][ T42] worker_thread+0x7d6/0xb60 >>> [ 65.718183][ T42] kthread+0x322/0x410 >>> [ 65.718187][ T42] ret_from_fork+0x285/0x750 >>> [ 65.718189][ T42] ret_from_fork_asm+0x1a/0x30 >>> [ 65.718192][ T42] >>> [ 65.718194][ T42] The buggy address belongs to the object at ffff8881685f4000 >>> [ 65.718194][ T42] which belongs to the cache kmalloc-4k of size 4096 >>> [ 65.718197][ T42] The buggy address is located 280 bytes inside of >>> [ 65.718197][ T42] freed 4096-byte region [ffff8881685f4000, ffff8881685f5000) >>> [ 65.718200][ T42] >>> [ 65.718201][ T42] The buggy address belongs to the physical page: >>> [ 65.718204][ T42] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1685f0 >>> [ 65.718209][ T42] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 >>> [ 65.718212][ T42] flags: 0x17ff00000000040(head|node=0|zone=2|lastcpupid=0x7ff) >>> [ 65.729357][ T42] page_type: f5(slab) >>> [ 65.729757][ T42] raw: 017ff00000000040 ffff888100042140 dead000000000100 dead000000000122 >>> [ 65.730603][ T42] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 >>> [ 65.731450][ T42] head: 017ff00000000040 ffff888100042140 dead000000000100 dead000000000122 >>> [ 65.732301][ T42] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 >>> [ 65.733211][ T42] head: 017ff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff >>> [ 65.734064][ T42] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 >>> [ 65.734922][ T42] page dumped because: kasan: bad access detected >>> [ 65.735562][ T42] page_owner tracks the page as allocated >>> [ 65.736133][ T42] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__G2 >>> [ 65.738177][ T42] post_alloc_hook+0x152/0x180 >>> [ 65.738654][ T42] get_page_from_freelist+0x3996/0x3b50 >>> [ 65.739207][ T42] __alloc_frozen_pages_noprof+0x243/0x750 >>> [ 65.739783][ T42] allocate_slab+0x76/0x5e0 >>> [ 65.740242][ T42] refill_objects+0x2e1/0x360 >>> [ 65.740706][ T42] __pcs_replace_empty_main+0x233/0x440 >>> [ 65.741262][ T42] __kmalloc_cache_noprof+0x2d0/0x490 >>> [ 65.741791][ T42] au8522_get_state+0x266/0x4c0 >>> [ 65.742280][ T42] au8522_attach+0xba/0x2d0 >>> [ 65.742728][ T42] au0828_dvb_register+0xcc/0x15f0 >>> [ 65.743241][ T42] au0828_usb_probe+0x353/0x4b0 >>> [ 65.743723][ T42] usb_probe_interface+0x4aa/0xa40 >>> [ 65.744264][ T42] really_probe+0x259/0x9a0 >>> [ 65.744713][ T42] __driver_probe_device+0x18b/0x370 >>> [ 65.745246][ T42] driver_probe_device+0x4b/0x1e0 >>> [ 65.745745][ T42] __device_attach_driver+0x1d0/0x2f0 >>> [ 65.746284][ T42] page last free pid 4578 tgid 4578 stack trace: >>> [ 65.746909][ T42] __free_frozen_pages+0xb8c/0xcb0 >>> [ 65.747427][ T42] __slab_free+0x219/0x260 >>> [ 65.747870][ T42] qlist_free_all+0x33/0x120 >>> [ 65.748339][ T42] kasan_quarantine_reduce+0x152/0x170 >>> [ 65.748877][ T42] __kasan_slab_alloc+0x1f/0x60 >>> [ 65.749368][ T42] kmem_cache_alloc_noprof+0x1f0/0x480 >>> [ 65.749908][ T42] do_getname+0x2a/0x1c0 >>> [ 65.750337][ T42] do_sys_openat2+0x99/0x190 >>> [ 65.750798][ T42] __x64_sys_openat+0x20b/0x260 >>> [ 65.751287][ T42] do_syscall_64+0x125/0x590 >>> [ 65.751744][ T42] entry_SYSCALL_64_after_hwframe+0x76/0x7e >>> [ 65.752334][ T42] >>> [ 65.752572][ T42] Memory state around the buggy address: >>> [ 65.753132][ T42] ffff8881685f4000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >>> [ 65.753918][ T42] ffff8881685f4080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >>> [ 65.754712][ T42] >ffff8881685f4100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >>> [ 65.755504][ T42] ^ >>> [ 65.755985][ T42] ffff8881685f4180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >>> [ 65.756775][ T42] ffff8881685f4200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >>> [ 65.757575][ T42] ================================================================== >>> [ 65.758570][ T42] Kernel panic - not syncing: KASAN: panic_on_warn set ... >>> [ 65.759306][ T42] CPU: 1 UID: 0 PID: 42 Comm: kworker/1:1 Not tainted 7.1.0-rc5-00006-ge8c2f9fdadee #16 PREEMPT( >>> [ 65.760402][ T42] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debia4 >>> [ 65.761615][ T42] Workqueue: usb_hub_wq hub_event >>> [ 65.762263][ T42] Call Trace: >>> [ 65.762658][ T42] <TASK> >>> [ 65.762956][ T42] dump_stack_lvl+0x26/0x80 >>> [ 65.763420][ T42] vpanic+0x37d/0x710 >>> [ 65.764686][ T42] panic+0x9f/0xa0 >>> [ 65.767120][ T42] check_panic_on_warn+0x58/0x70 >>> [ 65.768155][ T42] end_report+0x44/0xe0 >>> [ 65.769116][ T42] kasan_report+0xd4/0x100 >>> [ 65.770092][ T42] au0828_dvb_register+0x1280/0x15f0 >>> [ 65.771097][ T42] au0828_usb_probe+0x353/0x4b0 >>> [ 65.771586][ T42] usb_probe_interface+0x4aa/0xa40 >>> [ 65.772089][ T42] really_probe+0x259/0x9a0 >>> [ 65.772549][ T42] __driver_probe_device+0x18b/0x370 >>> [ 65.773069][ T42] driver_probe_device+0x4b/0x1e0 >>> [ 65.773576][ T42] __device_attach_driver+0x1d0/0x2f0 >>> [ 65.774692][ T42] bus_for_each_drv+0x22a/0x260 >>> [ 65.777453][ T42] __device_attach+0x25a/0x480 >>> [ 65.780818][ T42] device_initial_probe+0x68/0xa0 >>> [ 65.781322][ T42] bus_probe_device+0x10a/0x1d0 >>> [ 65.781800][ T42] device_add+0x56b/0x9c0 >>> [ 65.782284][ T42] usb_set_configuration+0x1775/0x1d80 >>> [ 65.782822][ T42] usb_generic_driver_probe+0x61/0xf0 >>> [ 65.783361][ T42] usb_probe_device+0xd3/0x2a0 >>> [ 65.783832][ T42] really_probe+0x259/0x9a0 >>> [ 65.784286][ T42] __driver_probe_device+0x18b/0x370 >>> [ 65.784804][ T42] driver_probe_device+0x4b/0x1e0 >>> [ 65.785304][ T42] __device_attach_driver+0x1d0/0x2f0 >>> [ 65.786416][ T42] bus_for_each_drv+0x22a/0x260 >>> [ 65.789198][ T42] __device_attach+0x25a/0x480 >>> [ 65.792606][ T42] device_initial_probe+0x68/0xa0 >>> [ 65.793101][ T42] bus_probe_device+0x10a/0x1d0 >>> [ 65.793602][ T42] device_add+0x56b/0x9c0 >>> [ 65.794028][ T42] usb_new_device+0xbdd/0x1830 >>> [ 65.795025][ T42] hub_event+0x2358/0x4090 >>> [ 65.797580][ T42] process_scheduled_works+0x73d/0xed0 >>> [ 65.798124][ T42] worker_thread+0x7d6/0xb60 >>> [ 65.799085][ T42] kthread+0x322/0x410 >>> [ 65.800465][ T42] ret_from_fork+0x285/0x750 >>> [ 65.802356][ T42] ret_from_fork_asm+0x1a/0x30 >>> [ 65.802830][ T42] </TASK> >>> [ 65.803886][ T42] Kernel Offset: disabled >>> [ 65.804329][ T42] ---[ end Kernel panic - not syncing: KASAN: panic_on_warn set ... ]— >>> >>>>> [ 141.481576][ T48] ================================================================== >>>>> [ 141.482348][ T48] BUG: KASAN: slab-use-after-free in au0828_dvb_register (drivers/media/usb/au0828/au0828-dvb.c:636) >>>>> [ 141.483148][ T48] Read of size 8 at addr ffff888171d4a118 by task kworker/1:1/48 >>>>> [ 141.483903][ T48] >>>>> [ 141.484144][ T48] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.34 >>>>> [ 141.484148][ T48] Workqueue: usb_hub_wq hub_event >>>>> [ 141.484154][ T48] Call Trace: >>>>> [ 141.484157][ T48] <TASK> >>>>> [ 141.484159][ T48] dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) >>>>> [ 141.484164][ T48] print_report (mm/kasan/report.c:378 mm/kasan/report.c:482) >>>>> [ 141.484177][ T48] kasan_report (mm/kasan/report.c:595) >>>>> [ 141.484183][ T48] au0828_dvb_register (drivers/media/usb/au0828/au0828-dvb.c:636) >>>>> [ 141.484190][ T48] au0828_usb_probe (drivers/media/usb/au0828/au0828-core.c:733) >>>>> [ 141.484193][ T48] usb_probe_interface (drivers/usb/core/driver.c:396) >>>>> [ 141.484198][ T48] really_probe (drivers/base/dd.c:? drivers/base/dd.c:709) >>>>> [ 141.484204][ T48] __driver_probe_device (drivers/base/dd.c:871) >>>>> [ 141.484207][ T48] driver_probe_device (drivers/base/dd.c:901) >>>>> [ 141.484211][ T48] __device_attach_driver (drivers/base/dd.c:1029) >>>>> [ 141.484217][ T48] bus_for_each_drv (drivers/base/bus.c:500) >>>>> [ 141.484264][ T48] __device_attach (drivers/base/dd.c:1101) >>>>> [ 141.484289][ T48] device_initial_probe (drivers/base/dd.c:1156) >>>>> [ 141.484292][ T48] bus_probe_device (drivers/base/bus.c:613) >>>>> [ 141.484296][ T48] device_add (drivers/base/core.c:3706) >>>>> [ 141.484299][ T48] usb_set_configuration (drivers/usb/core/message.c:2268) >>>>> [ 141.484303][ T48] usb_generic_driver_probe (drivers/usb/core/generic.c:250) >>>>> [ 141.484308][ T48] usb_probe_device (drivers/usb/core/driver.c:291) >>>>> [ 141.484311][ T48] really_probe (drivers/base/dd.c:? drivers/base/dd.c:709) >>>>> [ 141.484315][ T48] __driver_probe_device (drivers/base/dd.c:871) >>>>> [ 141.484318][ T48] driver_probe_device (drivers/base/dd.c:901) >>>>> [ 141.484321][ T48] __device_attach_driver (drivers/base/dd.c:1029) >>>>> [ 141.484328][ T48] bus_for_each_drv (drivers/base/bus.c:500) >>>>> [ 141.484346][ T48] __device_attach (drivers/base/dd.c:1101) >>>>> [ 141.484367][ T48] device_initial_probe (drivers/base/dd.c:1156) >>>>> [ 141.484370][ T48] bus_probe_device (drivers/base/bus.c:613) >>>>> [ 141.484374][ T48] device_add (drivers/base/core.c:3706) >>>>> [ 141.484376][ T48] usb_new_device (drivers/usb/core/hub.c:2695) >>>>> [ 141.484386][ T48] hub_event (drivers/usb/core/hub.c:5567 drivers/usb/core/hub.c:5707 drivers/usb/core/hub.c:5871 drivers/usb/core/hub.c:5953) >>>>> [ 141.484406][ T48] process_scheduled_works (kernel/workqueue.c:3314 kernel/workqueue.c:3397) >>>>> [ 141.484412][ T48] worker_thread (kernel/workqueue.c:3478) >>>>> [ 141.484420][ T48] kthread (kernel/kthread.c:436) >>>>> [ 141.484431][ T48] ret_from_fork (arch/x86/kernel/process.c:158) >>>>> [ 141.484445][ T48] ret_from_fork_asm (arch/x86/entry/entry_64.S:245) >>>>> [ 141.484450][ T48] </TASK> >>>>> [ 141.484451][ T48] >>>>> [ 141.523531][ T48] Freed by task 48 on cpu 1 at 141.481575s: >>>>> [ 141.524120][ T48] kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78) >>>>> [ 141.524594][ T48] kasan_save_free_info (mm/kasan/generic.c:584) >>>>> [ 141.525089][ T48] __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285) >>>>> [ 141.525570][ T48] kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6566) >>>>> [ 141.525957][ T48] au8522_release_state (drivers/media/dvb-frontends/au8522_common.c:124) >>>>> [ 141.526467][ T48] dvb_frontend_put (drivers/media/dvb-core/dvb_frontend.c:3093 drivers/media/dvb-core/dvb_frontend.c:141 drivers/media/dvb-core/dvb_frontend.c:166) >>>>> [ 141.526957][ T48] au0828_dvb_register (drivers/media/usb/au0828/au0828-dvb.c:518 drivers/media/usb/au0828/au0828-dvb.c:634) >>>>> [ 141.527469][ T48] au0828_usb_probe (drivers/media/usb/au0828/au0828-core.c:733) >>>>> [ 141.527952][ T48] usb_probe_interface (drivers/usb/core/driver.c:396) >>>>> [ 141.528455][ T48] really_probe (drivers/base/dd.c:? drivers/base/dd.c:709) >>>>> [ 141.528908][ T48] __driver_probe_device (drivers/base/dd.c:871) >>>>> [ 141.529426][ T48] driver_probe_device (drivers/base/dd.c:901) >>>>> [ 141.529932][ T48] __device_attach_driver (drivers/base/dd.c:1029) >>>>> [ 141.530459][ T48] bus_for_each_drv (drivers/base/bus.c:500) >>>>> [ 141.530949][ T48] __device_attach (drivers/base/dd.c:1101) >>>>> [ 141.531419][ T48] device_initial_probe (drivers/base/dd.c:1156) >>>>> [ 141.531923][ T48] bus_probe_device (drivers/base/bus.c:613) >>>>> [ 141.532404][ T48] device_add (drivers/base/core.c:3706) >>>>> [ 141.532840][ T48] usb_set_configuration (drivers/usb/core/message.c:2268) >>>>> [ 141.533373][ T48] usb_generic_driver_probe (drivers/usb/core/generic.c:250) >>>>> [ 141.533907][ T48] usb_probe_device (drivers/usb/core/driver.c:291) >>>>> [ 141.534377][ T48] really_probe (drivers/base/dd.c:? drivers/base/dd.c:709) >>>>> [ 141.534833][ T48] __driver_probe_device (drivers/base/dd.c:871) >>>>> [ 141.535352][ T48] driver_probe_device (drivers/base/dd.c:901) >>>>> [ 141.535856][ T48] __device_attach_driver (drivers/base/dd.c:1029) >>>>> [ 141.536384][ T48] bus_for_each_drv (drivers/base/bus.c:500) >>>>> [ 141.536869][ T48] __device_attach (drivers/base/dd.c:1101) >>>>> [ 141.537340][ T48] device_initial_probe (drivers/base/dd.c:1156) >>>>> [ 141.537839][ T48] bus_probe_device (drivers/base/bus.c:613) >>>>> [ 141.538320][ T48] device_add (drivers/base/core.c:3706) >>>>> [ 141.538753][ T48] usb_new_device (drivers/usb/core/hub.c:2695) >>>>> [ 141.539226][ T48] hub_event (drivers/usb/core/hub.c:5567 drivers/usb/core/hub.c:5707 drivers/usb/core/hub.c:5871 drivers/usb/core/hub.c:5953) >>>>> [ 141.539672][ T48] process_scheduled_works (kernel/workqueue.c:3314 kernel/workqueue.c:3397) >>>>> [ 141.540205][ T48] worker_thread (kernel/workqueue.c:3478) >>>>> [ 141.540666][ T48] kthread (kernel/kthread.c:436) >>>>> [ 141.541069][ T48] ret_from_fork (arch/x86/kernel/process.c:158) >>>>> [ 141.541524][ T48] ret_from_fork_asm (arch/x86/entry/entry_64.S:245) >>>>> [ 141.541999][ T48] >>>>> [ 141.542236][ T48] The buggy address belongs to the object at ffff888171d4a000 >>>>> [ 141.542236][ T48] which belongs to the cache kmalloc-4k of size 4096 >>>>> [ 141.543602][ T48] The buggy address is located 280 bytes inside of >>>>> [ 141.543602][ T48] freed 4096-byte region [ffff888171d4a000, ffff888171d4b000) ^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: [BUG] KASAN: slab-use-after-free in au0828_dvb_register 2026-06-02 2:44 ` Pei Xiao @ 2026-06-02 3:51 ` Shuangpeng 0 siblings, 0 replies; 8+ messages in thread From: Shuangpeng @ 2026-06-02 3:51 UTC (permalink / raw) To: Pei Xiao Cc: xiaopeitux, brad, hverkuil+cisco, linux-kernel, linux-media, mchehab, mingo, tglx > On Jun 1, 2026, at 22:44, Pei Xiao <xiaopei01@kylinos.cn> wrote: > > > > 在 2026/6/2 04:35, Shuangpeng 写道: >> >>> On May 31, 2026, at 23:38, Pei Xiao <xiaopei01@kylinos.cn> wrote: >>> >>> >>> >>> 在 2026/5/30 03:22, Shuangpeng 写道: >>>>> On May 29, 2026, at 04:30, xiaopeitux@foxmail.com wrote: >>>>> >>>>> From: Pei Xiao <xiaopei01@kylinos.cn> >>>>> >>>>>> Hi Kernel Maintainers, >>>>>> >>>>>> We hit the following KASAN report while testing current upstream kernel: >>>>>> >>>>>> KASAN: slab-use-after-free in au0828_dvb_register >>>>>> >>>>>> on commit: e8c2f9fdadee7cbc75134dc463c1e0d856d6e5c7 (May 25 2026) >>>>>> >>>>>> The reproducer and .config files are here. >>>>>> https://gist.github.com/shuangpengbai/c31163f8ef234ba4fe85038c2f97f9cc >>>>>> >>>>>> I’m happy to test debug patches or provide additional information. >>>>>> >>>>>> Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com> >>>>> Can you help post all the crash logs? >>>>> Does the kernel log have this print: >>>>> "The frontend of your DVB/ATSC card isn't supported yet." >>>> I did not see this message in log. >>>> >>>> >>>>> Please help post all the logs, thank you! >>>> Thank you for taking a look. All terminal outputs after running the reproducer: >>> au0828_usb_probe >>> au0828_dvb_register >>> dvb_attach(xc5000_attach, dvb->frontend, >>> dvb_register >>> if (dvb->frontend->ops.release) >>> dvb->frontend->ops.release(dvb->frontend); >>> >>> dvb_register >>> result = dvb_register_frontend(&dvb->adapter, dvb->frontend); >>> pr_err("dvb_register_frontend failed (errno = %d)\n",//-12, no kref_init(&fe->refcount);，fe->frontend_priv is NULL >>> result); >>> goto fail_frontend >>> >>> fail_frontend: >>> dvb_frontend_detach(dvb->frontend); >>> >>> dvb_frontend_detach: >>> dvb_frontend_put >>> __dvb_frontend_free >>> dvb_frontend_invoke_release(fe, fe->ops.release); >>> >>> >>> static void dvb_frontend_invoke_release(struct dvb_frontend *fe, >>> void (*release)(struct dvb_frontend *fe)) >>> { >>> if (release) { >>> release(fe); >>> #ifdef CONFIG_MEDIA_ATTACH >>> dvb_detach(release); >>> #endif >>> } >>> } >>> >>> au8522_attach >>> .release = au8522_release, >>> au8522_release_state >>> kfree(state);//have free >>> >>> How did this problem occur, and is the probability of it occurring high? >> I found this issue during testing kernel with our tool. This bug can be reliably reproduced. >> >>> so we can remove in au0828_dvb_register function follow lines to fix this UAF bug? >>> >>> ret = dvb_register(dev); >>> if (ret < 0) { >>> // if (dvb->frontend->ops.release) >>> // dvb->frontend->ops.release(dvb->frontend); >>> // dvb->frontend = NULL; >>> return ret; >>> } >>> Could you please help test this modified code? >> Could you please confirm whether the following is the intended change? >> >> I locally tested it by commenting out the three lines in the error path of >> au0828_dvb_register(): >> >> diff --git a/drivers/media/usb/au0828/au0828-dvb.c b/drivers/media/usb/au0828/au0828-dvb.c >> index 31123e6f9fc3..f3d5a2b0de71 100644 >> --- a/drivers/media/usb/au0828/au0828-dvb.c >> +++ b/drivers/media/usb/au0828/au0828-dvb.c >> @@ -633,9 +633,9 @@ int au0828_dvb_register(struct au0828_dev *dev) >> /* register everything */ >> ret = dvb_register(dev); >> if (ret < 0) { >> - if (dvb->frontend->ops.release) >> - dvb->frontend->ops.release(dvb->frontend); >> - dvb->frontend = NULL; >> + // if (dvb->frontend->ops.release) >> + // dvb->frontend->ops.release(dvb->frontend); >> + // dvb->frontend = NULL; >> return ret; >> } >> >> With this change, I reran the reproducer and hit a NULL pointer >> dereference: >> >> [ 90.096547][ T10] BUG: kernel NULL pointer dereference, address: 0000000000000000 >> [ 90.107156][ T10] au0828_dvb_unregister (drivers/media/usb/au0828/au0828-dvb.c:543) >> [ 90.107518][ T10] au0828_usb_disconnect (drivers/media/usb/au0828/au0828-core.c:179) >> [ 90.107875][ T10] usb_unbind_interface (drivers/usb/core/driver.c:458) >> [ 90.108965][ T10] device_release_driver_internal (drivers/base/dd.c:621 drivers/base/dd.c:1352 drivers/base/dd.c:1375) >> [ 90.109384][ T10] bus_remove_device (drivers/base/bus.c:657) >> [ 90.110494][ T10] device_del (drivers/base/core.c:3895) >> [ 90.111787][ T10] usb_disable_device (drivers/usb/core/message.c:1478) >> [ 90.112134][ T10] usb_disconnect (drivers/input/misc/yealink.c:421) >> [ 90.112460][ T10] hub_event (drivers/usb/core/hub.c:5407 drivers/usb/core/hub.c:5707 drivers/usb/core/hub.c:5871 drivers/usb/core/hub.c:5953) >> [ 90.114436][ T10] process_scheduled_works (kernel/workqueue.c:3314 kernel/workqueue.c:3397) >> [ 90.114817][ T10] worker_thread (kernel/workqueue.c:3478) >> [ 90.115490][ T10] kthread (kernel/kthread.c:436) >> [ 90.116448][ T10] ret_from_fork (arch/x86/kernel/process.c:158) >> [ 90.117759][ T10] ret_from_fork_asm (arch/x86/entry/entry_64.S:245) >> >> The crash happens in au0828_dvb_unregister() at: >> dvb->demux.dmx.remove_frontend(&dvb->demux.dmx, &dvb->fe_mem); >> >> So if this is the intended change, it seems to avoid the original release path, >> but it also leaves the device in a partially initialized state and triggers a >> NULL pointer dereference during disconnect. > Hi Shuangpeng: > please test this patch: > diff --git a/drivers/media/usb/au0828/au0828-dvb.c b/drivers/media/usb/au0828/au0828-dvb.c > index 31123e6f9fc3..052637429d8a 100644 > --- a/drivers/media/usb/au0828/au0828-dvb.c > +++ b/drivers/media/usb/au0828/au0828-dvb.c > @@ -633,8 +633,8 @@ int au0828_dvb_register(struct au0828_dev *dev) > /* register everything */ > ret = dvb_register(dev); > if (ret < 0) { > - if (dvb->frontend->ops.release) > - dvb->frontend->ops.release(dvb->frontend); > + /* dvb->frontend freed in dvb_frontend_put, now we can set > + * frontent to NULL */ > dvb->frontend = NULL; > return ret; > } > I tested this patch with my reproducer, and I could no longer trigger the bug. The fix works on my side. One minor nit: there is a typo in the comment: "frontent" should be "frontend". Please feel free to add: Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com> Thanks for the fix! Shuangpeng > thank you so much! > Pei. >> Please let me know if there is a new patch you would like me to test. >> >> >>>> [ 64.807294][ T42] usb 3-1: new high-speed USB device number 2 using dummy_hcd >>>> [ 64.958989][ T42] usb 3-1: New USB device found, idVendor=0fe9, idProduct=d620, bcdDevice= 1.00 >>>> [ 64.961560][ T42] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 >>>> [ 65.351442][ T42] au0828: i2c bus registered >>>> [ 65.634777][ T42] au8522 1-0047: creating new instance >>>> [ 65.655406][ T42] DVB: Unable to find symbol xc5000_attach() >>>> [ 65.656022][ T42] dvbdev: DVB: registering new adapter (au0828) >>>> [ 65.656632][ T42] au0828: dvb_register_frontend failed (errno = -12) >>>> [ 65.658957][ T42] au8522 1-0047: destroying instance >>>> [ 65.659499][ T42] ================================================================== >>>> [ 65.660261][ T42] BUG: KASAN: slab-use-after-free in au0828_dvb_register+0x1280/0x15f0 >>>> [ 65.661023][ T42] Read of size 8 at addr ffff8881685f4118 by task kworker/1:1/42 >>>> [ 65.661742][ T42] >>>> [ 65.661973][ T42] CPU: 1 UID: 0 PID: 42 Comm: kworker/1:1 Not tainted 7.1.0-rc5-00006-ge8c2f9fdadee #16 PREEMPT( >>>> [ 65.661978][ T42] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debia4 >>>> [ 65.661981][ T42] Workqueue: usb_hub_wq hub_event >>>> [ 65.661988][ T42] Call Trace: >>>> [ 65.661991][ T42] <TASK> >>>> [ 65.661993][ T42] dump_stack_lvl+0x26/0x80 >>>> [ 65.661999][ T42] print_report+0x16a/0x5d0 >>>> [ 65.662013][ T42] kasan_report+0xc3/0x100 >>>> [ 65.662019][ T42] au0828_dvb_register+0x1280/0x15f0 >>>> [ 65.662026][ T42] au0828_usb_probe+0x353/0x4b0 >>>> [ 65.662029][ T42] usb_probe_interface+0x4aa/0xa40 >>>> [ 65.662034][ T42] really_probe+0x259/0x9a0 >>>> [ 65.662041][ T42] __driver_probe_device+0x18b/0x370 >>>> [ 65.662045][ T42] driver_probe_device+0x4b/0x1e0 >>>> [ 65.662049][ T42] __device_attach_driver+0x1d0/0x2f0 >>>> [ 65.662055][ T42] bus_for_each_drv+0x22a/0x260 >>>> [ 65.663294][ T42] __device_attach+0x25a/0x480 >>>> [ 65.663321][ T42] device_initial_probe+0x68/0xa0 >>>> [ 65.663324][ T42] bus_probe_device+0x10a/0x1d0 >>>> [ 65.663328][ T42] device_add+0x56b/0x9c0 >>>> [ 65.663332][ T42] usb_set_configuration+0x1775/0x1d80 >>>> [ 65.663337][ T42] usb_generic_driver_probe+0x61/0xf0 >>>> [ 65.663343][ T42] usb_probe_device+0xd3/0x2a0 >>>> [ 65.663346][ T42] really_probe+0x259/0x9a0 >>>> [ 65.663350][ T42] __driver_probe_device+0x18b/0x370 >>>> [ 65.663354][ T42] driver_probe_device+0x4b/0x1e0 >>>> [ 65.663357][ T42] __device_attach_driver+0x1d0/0x2f0 >>>> [ 65.663363][ T42] bus_for_each_drv+0x22a/0x260 >>>> [ 65.663381][ T42] __device_attach+0x25a/0x480 >>>> [ 65.663403][ T42] device_initial_probe+0x68/0xa0 >>>> [ 65.663405][ T42] bus_probe_device+0x10a/0x1d0 >>>> [ 65.663409][ T42] device_add+0x56b/0x9c0 >>>> [ 65.663412][ T42] usb_new_device+0xbdd/0x1830 >>>> [ 65.663423][ T42] hub_event+0x2358/0x4090 >>>> [ 65.663443][ T42] process_scheduled_works+0x73d/0xed0 >>>> [ 65.663451][ T42] worker_thread+0x7d6/0xb60 >>>> [ 65.663459][ T42] kthread+0x322/0x410 >>>> [ 65.663470][ T42] ret_from_fork+0x285/0x750 >>>> [ 65.663485][ T42] ret_from_fork_asm+0x1a/0x30 >>>> [ 65.663491][ T42] </TASK> >>>> [ 65.663493][ T42] >>>> [ 65.702422][ T42] Freed by task 42 on cpu 1 at 65.659497s: >>>> [ 65.702994][ T42] kasan_save_track+0x2e/0x90 >>>> [ 65.703471][ T42] kasan_save_free_info+0x3c/0x50 >>>> [ 65.703965][ T42] __kasan_slab_free+0x36/0x60 >>>> [ 65.704450][ T42] kfree+0x154/0x450 >>>> [ 65.704839][ T42] au8522_release_state+0x1b6/0x210 >>>> [ 65.705364][ T42] dvb_frontend_put+0x12a/0x170 >>>> [ 65.705848][ T42] au0828_dvb_register+0xfd9/0x15f0 >>>> [ 65.706373][ T42] au0828_usb_probe+0x353/0x4b0 >>>> [ 65.706854][ T42] usb_probe_interface+0x4aa/0xa40 >>>> [ 65.707373][ T42] really_probe+0x259/0x9a0 >>>> [ 65.707822][ T42] __driver_probe_device+0x18b/0x370 >>>> [ 65.708347][ T42] driver_probe_device+0x4b/0x1e0 >>>> [ 65.708845][ T42] __device_attach_driver+0x1d0/0x2f0 >>>> [ 65.709383][ T42] bus_for_each_drv+0x22a/0x260 >>>> [ 65.709864][ T42] __device_attach+0x25a/0x480 >>>> [ 65.710339][ T42] device_initial_probe+0x68/0xa0 >>>> [ 65.710836][ T42] bus_probe_device+0x10a/0x1d0 >>>> [ 65.711323][ T42] device_add+0x56b/0x9c0 >>>> [ 65.711750][ T42] usb_set_configuration+0x1775/0x1d80 >>>> [ 65.712294][ T42] usb_generic_driver_probe+0x61/0xf0 >>>> [ 65.712822][ T42] usb_probe_device+0xd3/0x2a0 >>>> [ 65.713305][ T42] really_probe+0x259/0x9a0 >>>> [ 65.713752][ T42] __driver_probe_device+0x18b/0x370 >>>> [ 65.714282][ T42] driver_probe_device+0x4b/0x1e0 >>>> [ 65.714779][ T42] __device_attach_driver+0x1d0/0x2f0 >>>> [ 65.715313][ T42] bus_for_each_drv+0x22a/0x260 >>>> [ 65.715794][ T42] __device_attach+0x25a/0x480 >>>> [ 65.716271][ T42] device_initial_probe+0x68/0xa0 >>>> [ 65.716767][ T42] bus_probe_device+0x10a/0x1d0 >>>> [ 65.717262][ T42] device_add+0x56b/0x9c0 >>>> [ 65.717690][ T42] usb_new_device+0xbdd/0x1830 >>>> [ 65.717869][ C0] clocksource: Watchdog remote CPU 1 read timed out >>>> [ 65.718172][ T42] hub_event+0x2358/0x4090 >>>> [ 65.718177][ T42] process_scheduled_works+0x73d/0xed0 >>>> [ 65.718180][ T42] worker_thread+0x7d6/0xb60 >>>> [ 65.718183][ T42] kthread+0x322/0x410 >>>> [ 65.718187][ T42] ret_from_fork+0x285/0x750 >>>> [ 65.718189][ T42] ret_from_fork_asm+0x1a/0x30 >>>> [ 65.718192][ T42] >>>> [ 65.718194][ T42] The buggy address belongs to the object at ffff8881685f4000 >>>> [ 65.718194][ T42] which belongs to the cache kmalloc-4k of size 4096 >>>> [ 65.718197][ T42] The buggy address is located 280 bytes inside of >>>> [ 65.718197][ T42] freed 4096-byte region [ffff8881685f4000, ffff8881685f5000) >>>> [ 65.718200][ T42] >>>> [ 65.718201][ T42] The buggy address belongs to the physical page: >>>> [ 65.718204][ T42] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1685f0 >>>> [ 65.718209][ T42] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 >>>> [ 65.718212][ T42] flags: 0x17ff00000000040(head|node=0|zone=2|lastcpupid=0x7ff) >>>> [ 65.729357][ T42] page_type: f5(slab) >>>> [ 65.729757][ T42] raw: 017ff00000000040 ffff888100042140 dead000000000100 dead000000000122 >>>> [ 65.730603][ T42] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 >>>> [ 65.731450][ T42] head: 017ff00000000040 ffff888100042140 dead000000000100 dead000000000122 >>>> [ 65.732301][ T42] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 >>>> [ 65.733211][ T42] head: 017ff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff >>>> [ 65.734064][ T42] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 >>>> [ 65.734922][ T42] page dumped because: kasan: bad access detected >>>> [ 65.735562][ T42] page_owner tracks the page as allocated >>>> [ 65.736133][ T42] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__G2 >>>> [ 65.738177][ T42] post_alloc_hook+0x152/0x180 >>>> [ 65.738654][ T42] get_page_from_freelist+0x3996/0x3b50 >>>> [ 65.739207][ T42] __alloc_frozen_pages_noprof+0x243/0x750 >>>> [ 65.739783][ T42] allocate_slab+0x76/0x5e0 >>>> [ 65.740242][ T42] refill_objects+0x2e1/0x360 >>>> [ 65.740706][ T42] __pcs_replace_empty_main+0x233/0x440 >>>> [ 65.741262][ T42] __kmalloc_cache_noprof+0x2d0/0x490 >>>> [ 65.741791][ T42] au8522_get_state+0x266/0x4c0 >>>> [ 65.742280][ T42] au8522_attach+0xba/0x2d0 >>>> [ 65.742728][ T42] au0828_dvb_register+0xcc/0x15f0 >>>> [ 65.743241][ T42] au0828_usb_probe+0x353/0x4b0 >>>> [ 65.743723][ T42] usb_probe_interface+0x4aa/0xa40 >>>> [ 65.744264][ T42] really_probe+0x259/0x9a0 >>>> [ 65.744713][ T42] __driver_probe_device+0x18b/0x370 >>>> [ 65.745246][ T42] driver_probe_device+0x4b/0x1e0 >>>> [ 65.745745][ T42] __device_attach_driver+0x1d0/0x2f0 >>>> [ 65.746284][ T42] page last free pid 4578 tgid 4578 stack trace: >>>> [ 65.746909][ T42] __free_frozen_pages+0xb8c/0xcb0 >>>> [ 65.747427][ T42] __slab_free+0x219/0x260 >>>> [ 65.747870][ T42] qlist_free_all+0x33/0x120 >>>> [ 65.748339][ T42] kasan_quarantine_reduce+0x152/0x170 >>>> [ 65.748877][ T42] __kasan_slab_alloc+0x1f/0x60 >>>> [ 65.749368][ T42] kmem_cache_alloc_noprof+0x1f0/0x480 >>>> [ 65.749908][ T42] do_getname+0x2a/0x1c0 >>>> [ 65.750337][ T42] do_sys_openat2+0x99/0x190 >>>> [ 65.750798][ T42] __x64_sys_openat+0x20b/0x260 >>>> [ 65.751287][ T42] do_syscall_64+0x125/0x590 >>>> [ 65.751744][ T42] entry_SYSCALL_64_after_hwframe+0x76/0x7e >>>> [ 65.752334][ T42] >>>> [ 65.752572][ T42] Memory state around the buggy address: >>>> [ 65.753132][ T42] ffff8881685f4000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >>>> [ 65.753918][ T42] ffff8881685f4080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >>>> [ 65.754712][ T42] >ffff8881685f4100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >>>> [ 65.755504][ T42] ^ >>>> [ 65.755985][ T42] ffff8881685f4180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >>>> [ 65.756775][ T42] ffff8881685f4200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >>>> [ 65.757575][ T42] ================================================================== >>>> [ 65.758570][ T42] Kernel panic - not syncing: KASAN: panic_on_warn set ... >>>> [ 65.759306][ T42] CPU: 1 UID: 0 PID: 42 Comm: kworker/1:1 Not tainted 7.1.0-rc5-00006-ge8c2f9fdadee #16 PREEMPT( >>>> [ 65.760402][ T42] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debia4 >>>> [ 65.761615][ T42] Workqueue: usb_hub_wq hub_event >>>> [ 65.762263][ T42] Call Trace: >>>> [ 65.762658][ T42] <TASK> >>>> [ 65.762956][ T42] dump_stack_lvl+0x26/0x80 >>>> [ 65.763420][ T42] vpanic+0x37d/0x710 >>>> [ 65.764686][ T42] panic+0x9f/0xa0 >>>> [ 65.767120][ T42] check_panic_on_warn+0x58/0x70 >>>> [ 65.768155][ T42] end_report+0x44/0xe0 >>>> [ 65.769116][ T42] kasan_report+0xd4/0x100 >>>> [ 65.770092][ T42] au0828_dvb_register+0x1280/0x15f0 >>>> [ 65.771097][ T42] au0828_usb_probe+0x353/0x4b0 >>>> [ 65.771586][ T42] usb_probe_interface+0x4aa/0xa40 >>>> [ 65.772089][ T42] really_probe+0x259/0x9a0 >>>> [ 65.772549][ T42] __driver_probe_device+0x18b/0x370 >>>> [ 65.773069][ T42] driver_probe_device+0x4b/0x1e0 >>>> [ 65.773576][ T42] __device_attach_driver+0x1d0/0x2f0 >>>> [ 65.774692][ T42] bus_for_each_drv+0x22a/0x260 >>>> [ 65.777453][ T42] __device_attach+0x25a/0x480 >>>> [ 65.780818][ T42] device_initial_probe+0x68/0xa0 >>>> [ 65.781322][ T42] bus_probe_device+0x10a/0x1d0 >>>> [ 65.781800][ T42] device_add+0x56b/0x9c0 >>>> [ 65.782284][ T42] usb_set_configuration+0x1775/0x1d80 >>>> [ 65.782822][ T42] usb_generic_driver_probe+0x61/0xf0 >>>> [ 65.783361][ T42] usb_probe_device+0xd3/0x2a0 >>>> [ 65.783832][ T42] really_probe+0x259/0x9a0 >>>> [ 65.784286][ T42] __driver_probe_device+0x18b/0x370 >>>> [ 65.784804][ T42] driver_probe_device+0x4b/0x1e0 >>>> [ 65.785304][ T42] __device_attach_driver+0x1d0/0x2f0 >>>> [ 65.786416][ T42] bus_for_each_drv+0x22a/0x260 >>>> [ 65.789198][ T42] __device_attach+0x25a/0x480 >>>> [ 65.792606][ T42] device_initial_probe+0x68/0xa0 >>>> [ 65.793101][ T42] bus_probe_device+0x10a/0x1d0 >>>> [ 65.793602][ T42] device_add+0x56b/0x9c0 >>>> [ 65.794028][ T42] usb_new_device+0xbdd/0x1830 >>>> [ 65.795025][ T42] hub_event+0x2358/0x4090 >>>> [ 65.797580][ T42] process_scheduled_works+0x73d/0xed0 >>>> [ 65.798124][ T42] worker_thread+0x7d6/0xb60 >>>> [ 65.799085][ T42] kthread+0x322/0x410 >>>> [ 65.800465][ T42] ret_from_fork+0x285/0x750 >>>> [ 65.802356][ T42] ret_from_fork_asm+0x1a/0x30 >>>> [ 65.802830][ T42] </TASK> >>>> [ 65.803886][ T42] Kernel Offset: disabled >>>> [ 65.804329][ T42] ---[ end Kernel panic - not syncing: KASAN: panic_on_warn set ... ]— >>>> >>>>>> [ 141.481576][ T48] ================================================================== >>>>>> [ 141.482348][ T48] BUG: KASAN: slab-use-after-free in au0828_dvb_register (drivers/media/usb/au0828/au0828-dvb.c:636) >>>>>> [ 141.483148][ T48] Read of size 8 at addr ffff888171d4a118 by task kworker/1:1/48 >>>>>> [ 141.483903][ T48] >>>>>> [ 141.484144][ T48] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.34 >>>>>> [ 141.484148][ T48] Workqueue: usb_hub_wq hub_event >>>>>> [ 141.484154][ T48] Call Trace: >>>>>> [ 141.484157][ T48] <TASK> >>>>>> [ 141.484159][ T48] dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) >>>>>> [ 141.484164][ T48] print_report (mm/kasan/report.c:378 mm/kasan/report.c:482) >>>>>> [ 141.484177][ T48] kasan_report (mm/kasan/report.c:595) >>>>>> [ 141.484183][ T48] au0828_dvb_register (drivers/media/usb/au0828/au0828-dvb.c:636) >>>>>> [ 141.484190][ T48] au0828_usb_probe (drivers/media/usb/au0828/au0828-core.c:733) >>>>>> [ 141.484193][ T48] usb_probe_interface (drivers/usb/core/driver.c:396) >>>>>> [ 141.484198][ T48] really_probe (drivers/base/dd.c:? drivers/base/dd.c:709) >>>>>> [ 141.484204][ T48] __driver_probe_device (drivers/base/dd.c:871) >>>>>> [ 141.484207][ T48] driver_probe_device (drivers/base/dd.c:901) >>>>>> [ 141.484211][ T48] __device_attach_driver (drivers/base/dd.c:1029) >>>>>> [ 141.484217][ T48] bus_for_each_drv (drivers/base/bus.c:500) >>>>>> [ 141.484264][ T48] __device_attach (drivers/base/dd.c:1101) >>>>>> [ 141.484289][ T48] device_initial_probe (drivers/base/dd.c:1156) >>>>>> [ 141.484292][ T48] bus_probe_device (drivers/base/bus.c:613) >>>>>> [ 141.484296][ T48] device_add (drivers/base/core.c:3706) >>>>>> [ 141.484299][ T48] usb_set_configuration (drivers/usb/core/message.c:2268) >>>>>> [ 141.484303][ T48] usb_generic_driver_probe (drivers/usb/core/generic.c:250) >>>>>> [ 141.484308][ T48] usb_probe_device (drivers/usb/core/driver.c:291) >>>>>> [ 141.484311][ T48] really_probe (drivers/base/dd.c:? drivers/base/dd.c:709) >>>>>> [ 141.484315][ T48] __driver_probe_device (drivers/base/dd.c:871) >>>>>> [ 141.484318][ T48] driver_probe_device (drivers/base/dd.c:901) >>>>>> [ 141.484321][ T48] __device_attach_driver (drivers/base/dd.c:1029) >>>>>> [ 141.484328][ T48] bus_for_each_drv (drivers/base/bus.c:500) >>>>>> [ 141.484346][ T48] __device_attach (drivers/base/dd.c:1101) >>>>>> [ 141.484367][ T48] device_initial_probe (drivers/base/dd.c:1156) >>>>>> [ 141.484370][ T48] bus_probe_device (drivers/base/bus.c:613) >>>>>> [ 141.484374][ T48] device_add (drivers/base/core.c:3706) >>>>>> [ 141.484376][ T48] usb_new_device (drivers/usb/core/hub.c:2695) >>>>>> [ 141.484386][ T48] hub_event (drivers/usb/core/hub.c:5567 drivers/usb/core/hub.c:5707 drivers/usb/core/hub.c:5871 drivers/usb/core/hub.c:5953) >>>>>> [ 141.484406][ T48] process_scheduled_works (kernel/workqueue.c:3314 kernel/workqueue.c:3397) >>>>>> [ 141.484412][ T48] worker_thread (kernel/workqueue.c:3478) >>>>>> [ 141.484420][ T48] kthread (kernel/kthread.c:436) >>>>>> [ 141.484431][ T48] ret_from_fork (arch/x86/kernel/process.c:158) >>>>>> [ 141.484445][ T48] ret_from_fork_asm (arch/x86/entry/entry_64.S:245) >>>>>> [ 141.484450][ T48] </TASK> >>>>>> [ 141.484451][ T48] >>>>>> [ 141.523531][ T48] Freed by task 48 on cpu 1 at 141.481575s: >>>>>> [ 141.524120][ T48] kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78) >>>>>> [ 141.524594][ T48] kasan_save_free_info (mm/kasan/generic.c:584) >>>>>> [ 141.525089][ T48] __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285) >>>>>> [ 141.525570][ T48] kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6566) >>>>>> [ 141.525957][ T48] au8522_release_state (drivers/media/dvb-frontends/au8522_common.c:124) >>>>>> [ 141.526467][ T48] dvb_frontend_put (drivers/media/dvb-core/dvb_frontend.c:3093 drivers/media/dvb-core/dvb_frontend.c:141 drivers/media/dvb-core/dvb_frontend.c:166) >>>>>> [ 141.526957][ T48] au0828_dvb_register (drivers/media/usb/au0828/au0828-dvb.c:518 drivers/media/usb/au0828/au0828-dvb.c:634) >>>>>> [ 141.527469][ T48] au0828_usb_probe (drivers/media/usb/au0828/au0828-core.c:733) >>>>>> [ 141.527952][ T48] usb_probe_interface (drivers/usb/core/driver.c:396) >>>>>> [ 141.528455][ T48] really_probe (drivers/base/dd.c:? drivers/base/dd.c:709) >>>>>> [ 141.528908][ T48] __driver_probe_device (drivers/base/dd.c:871) >>>>>> [ 141.529426][ T48] driver_probe_device (drivers/base/dd.c:901) >>>>>> [ 141.529932][ T48] __device_attach_driver (drivers/base/dd.c:1029) >>>>>> [ 141.530459][ T48] bus_for_each_drv (drivers/base/bus.c:500) >>>>>> [ 141.530949][ T48] __device_attach (drivers/base/dd.c:1101) >>>>>> [ 141.531419][ T48] device_initial_probe (drivers/base/dd.c:1156) >>>>>> [ 141.531923][ T48] bus_probe_device (drivers/base/bus.c:613) >>>>>> [ 141.532404][ T48] device_add (drivers/base/core.c:3706) >>>>>> [ 141.532840][ T48] usb_set_configuration (drivers/usb/core/message.c:2268) >>>>>> [ 141.533373][ T48] usb_generic_driver_probe (drivers/usb/core/generic.c:250) >>>>>> [ 141.533907][ T48] usb_probe_device (drivers/usb/core/driver.c:291) >>>>>> [ 141.534377][ T48] really_probe (drivers/base/dd.c:? drivers/base/dd.c:709) >>>>>> [ 141.534833][ T48] __driver_probe_device (drivers/base/dd.c:871) >>>>>> [ 141.535352][ T48] driver_probe_device (drivers/base/dd.c:901) >>>>>> [ 141.535856][ T48] __device_attach_driver (drivers/base/dd.c:1029) >>>>>> [ 141.536384][ T48] bus_for_each_drv (drivers/base/bus.c:500) >>>>>> [ 141.536869][ T48] __device_attach (drivers/base/dd.c:1101) >>>>>> [ 141.537340][ T48] device_initial_probe (drivers/base/dd.c:1156) >>>>>> [ 141.537839][ T48] bus_probe_device (drivers/base/bus.c:613) >>>>>> [ 141.538320][ T48] device_add (drivers/base/core.c:3706) >>>>>> [ 141.538753][ T48] usb_new_device (drivers/usb/core/hub.c:2695) >>>>>> [ 141.539226][ T48] hub_event (drivers/usb/core/hub.c:5567 drivers/usb/core/hub.c:5707 drivers/usb/core/hub.c:5871 drivers/usb/core/hub.c:5953) >>>>>> [ 141.539672][ T48] process_scheduled_works (kernel/workqueue.c:3314 kernel/workqueue.c:3397) >>>>>> [ 141.540205][ T48] worker_thread (kernel/workqueue.c:3478) >>>>>> [ 141.540666][ T48] kthread (kernel/kthread.c:436) >>>>>> [ 141.541069][ T48] ret_from_fork (arch/x86/kernel/process.c:158) >>>>>> [ 141.541524][ T48] ret_from_fork_asm (arch/x86/entry/entry_64.S:245) >>>>>> [ 141.541999][ T48] >>>>>> [ 141.542236][ T48] The buggy address belongs to the object at ffff888171d4a000 >>>>>> [ 141.542236][ T48] which belongs to the cache kmalloc-4k of size 4096 >>>>>> [ 141.543602][ T48] The buggy address is located 280 bytes inside of >>>>>> [ 141.543602][ T48] freed 4096-byte region [ffff888171d4a000, ffff888171d4b000) > ^ permalink raw reply [flat|nested] 8+ messages in thread
end of thread, other threads:[~2026-06-02 3:52 UTC | newest] Thread overview: 8+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2026-05-29 0:17 [BUG] KASAN: slab-use-after-free in au0828_dvb_register Shuangpeng 2026-05-29 8:30 ` xiaopeitux 2026-05-29 19:22 ` [BUG] " Shuangpeng 2026-06-01 1:18 ` Pei Xiao 2026-06-01 3:38 ` Pei Xiao 2026-06-01 20:35 ` Shuangpeng 2026-06-02 2:44 ` Pei Xiao 2026-06-02 3:51 ` Shuangpeng
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®