From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-oi1-f197.google.com (mail-oi1-f197.google.com [209.85.167.197]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0B07463B9 for ; Sat, 21 Feb 2026 14:53:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.197 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771685585; cv=none; b=ZpmR7v6Y+fcQnfWOGoZFl0orEKV6A53hnKhiMx4jwI0GeTxtJuZPNnE5rzVHuUJWovNYkCS8e2i6lGkRk8k2hK9dyIgWCIKLlsEbfkMIDHdoB+avHdxGpdWj5CUPrlVSKf0z7ZZcZW82gLqwSEuL2XbVyGbI4fSoiRadlXVk0ls= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771685585; c=relaxed/simple; bh=AHgRozI/26jWkOFTSSqqKHdPa1407gJWHtez5QD2pjU=; h=MIME-Version:Date:In-Reply-To:Message-ID:Subject:From:To: Content-Type; b=RR1092CL3RlqqlWNisFLftUAQ9P/JPKZfMAaqaFIRhb2YIrdNWvWXU8MjvLM0KsOqVIu/WKiFgx3NiUlik93+VtC4fmFDYZhqoxvmX54Ul5WIU6Sx2HtXvk0tSh++YLNzPU9nk46KTGt1uzhDrUFALWpC2gUxmshheTKfhC/85U= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.167.197 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-oi1-f197.google.com with SMTP id 5614622812f47-463905cb295so12460036b6e.2 for ; Sat, 21 Feb 2026 06:53:03 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1771685583; x=1772290383; h=to:from:subject:message-id:in-reply-to:date:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=EepLkC6+X6jxRTa24++oMiLDnI1xYnGNLNedKmLKEjM=; b=XRMRQ+qYyaAVz2rIBm9DXUrw8WRYyqPwwClR0p6U4PtANGuWY6C/3CTy6dR5DKuFMn 9Zx+D6Bzg3OTIy9LHHk/dSbsM/64f2lgT4WZovNGgBDiovQ9BdAggdtRBMNd36AAcD2c wnDh3PL/H9Wd33pPraXEY6L2RE02cC5Bt4Dr1SNyxMoYKjQbSUtiHxJ7agbCnS0qnN6U 9Ihfl/WO4RpFNYy60LoQWWtASbuBIjJt8GRRXWfKuM9tq3QeXNvuFHf9p7uz+TQiVvwt sP6dA8feoUxD3HAYWuou8PX/txYD2/2lJB1zeh0s3Pwn8csF5fibkHb1SAn7J4DcElwi HVQA== X-Forwarded-Encrypted: i=1; AJvYcCWerNwIxpToKVWCTfTZqChVJFoypjPpfXARhITPgRv5KZak4Nhp2ayS4idRFCkMomJ96Dcw3I23PrRpiRk=@vger.kernel.org X-Gm-Message-State: AOJu0YwDH1v0it7nF3z193fu0QCiozmofGdacbQ11jwHTt0Ok4VsVtDe CWoyJV9BT88vslgRA/iBQkZoCoJHtNRKSek5nqJuEnwH0BV/8l/qBtaj3tcLXVVvN51PmIQBPNe Ame2gCUoaFAAt2TtwjYpY3TkxUg71gaePMNvW/RTLZHlr86MFf//257AHi7E= Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a05:6820:4a8a:b0:663:888:73d1 with SMTP id 006d021491bc7-679c44f3842mr1318700eaf.60.1771685582914; Sat, 21 Feb 2026 06:53:02 -0800 (PST) Date: Sat, 21 Feb 2026 06:53:02 -0800 In-Reply-To: <20260221143547.3277-1-hdanton@sina.com> X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <6999c6ce.a70a0220.2c38d7.015d.GAE@google.com> Subject: Re: [syzbot] [media?] KASAN: slab-use-after-free Read in dvb_frontend_release (3) From: syzbot To: hdanton@sina.com, linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Content-Type: text/plain; charset="UTF-8" Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: BUG: corrupted list in dvb_remove_device non-paged memory list_del corruption, ffff88802b938400->next is LIST_POISON1 (dead000000000100) ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:58! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 1 UID: 0 PID: 6584 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 RIP: 0010:__list_del_entry_valid_or_report+0x10e/0x190 lib/list_debug.c:56 Code: a0 47 a6 8b 48 89 de e8 20 01 80 fc 90 0f 0b 4c 89 e7 e8 b5 c4 61 fd 48 c7 c7 00 48 a6 8b 48 89 de 4c 89 e2 e8 03 01 80 fc 90 <0f> 0b 4c 89 e7 e8 98 c4 61 fd 48 c7 c7 60 48 a6 8b 48 89 de 4c 89 RSP: 0018:ffffc90003b6fa88 EFLAGS: 00010246 RAX: 000000000000004e RBX: ffff88802b938400 RCX: 70c5d03fc278f600 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000 R10: dffffc0000000000 R11: ffffed1017124923 R12: dead000000000100 R13: dffffc0000000000 R14: dead000000000100 R15: dead000000000122 FS: 000055556ef5d500(0000) GS:ffff888126442000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f467ca4efeb CR3: 0000000025052000 CR4: 00000000003526f0 Call Trace: __list_del_entry_valid include/linux/list.h:132 [inline] __list_del_entry include/linux/list.h:223 [inline] list_del include/linux/list.h:237 [inline] dvb_remove_device+0x131/0x280 drivers/media/dvb-core/dvbdev.c:611 dvb_frontend_release+0x3e6/0x510 drivers/media/dvb-core/dvb_frontend.c:2936 __fput+0x461/0xa90 fs/file_table.c:469 task_work_run+0x1d9/0x270 kernel/task_work.c:233 get_signal+0x11c3/0x1310 kernel/signal.c:2807 arch_do_signal_or_restart+0xbc/0x830 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline] exit_to_user_mode_loop+0x86/0x480 kernel/entry/common.c:98 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline] do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fe67637bf79 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffc7f8caa78 EFLAGS: 00000246 ORIG_RAX: 00000000000001b4 RAX: 0000000000000000 RBX: 00007ffc7f8cab60 RCX: 00007fe67637bf79 RDX: 0000000000000000 RSI: 000000000000001e RDI: 0000000000000003 RBP: 0000000000023360 R08: 0000000000000001 R09: 0000000000000000 R10: 0000001b30020000 R11: 0000000000000246 R12: 00007ffc7f8caba0 R13: 00007fe6765f5fac R14: 00000000000233c3 R15: 00007fe6765f5fa0 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:__list_del_entry_valid_or_report+0x10e/0x190 lib/list_debug.c:56 Code: a0 47 a6 8b 48 89 de e8 20 01 80 fc 90 0f 0b 4c 89 e7 e8 b5 c4 61 fd 48 c7 c7 00 48 a6 8b 48 89 de 4c 89 e2 e8 03 01 80 fc 90 <0f> 0b 4c 89 e7 e8 98 c4 61 fd 48 c7 c7 60 48 a6 8b 48 89 de 4c 89 RSP: 0018:ffffc90003b6fa88 EFLAGS: 00010246 RAX: 000000000000004e RBX: ffff88802b938400 RCX: 70c5d03fc278f600 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000 R10: dffffc0000000000 R11: ffffed1017124923 R12: dead000000000100 R13: dffffc0000000000 R14: dead000000000100 R15: dead000000000122 FS: 000055556ef5d500(0000) GS:ffff888126442000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f467ca4efeb CR3: 0000000025052000 CR4: 00000000003526f0 Tested on: commit: d79526b8 Merge tag 'spi-fix-v7.0-merge-window' of git:.. git tree: upstream console output: https://syzkaller.appspot.com/x/log.txt?x=143a8152580000 kernel config: https://syzkaller.appspot.com/x/.config?x=4b084d82ac8e0fbd dashboard link: https://syzkaller.appspot.com/bug?extid=ae466a728017ec940b41 compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8 patch: https://syzkaller.appspot.com/x/patch.diff?x=1572f95a580000