From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv1-f48.google.com (mail-qv1-f48.google.com [209.85.219.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D9BBE3EDAA9 for ; Wed, 3 Jun 2026 03:15:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.48 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780456526; cv=none; b=DaLhGq1yoiSshPOpErHT2yL+9D+Xe+Lz9gcM+nItfQdGXO01ZnNqip6RWJGiyId3wfDzPUwJjNEL6YWdrD098yiiJnPSufk7/lQl508hCGsimBrx2W0/usdbSFEyvCHxKtzYZho0yCv/JbfiTw9Ejw1AG3v/EFSlUEv3Xk9sbL8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780456526; c=relaxed/simple; bh=QGGjOLDzzFZ0oaThLwWTpjJnB0OoTEFbgnyNymeN5Cg=; h=From:Content-Type:Mime-Version:Subject:Message-Id:Date:Cc:To; b=mru0CxGgBLzjy2bYAvgVXxkLVDEvUmuLtjXj1cB++OOHyabmJzud5HuoJzcP+4ThXEgXPbifB9DaKOrSONW5fJWq4xAfCnDTMUQjA6Gkesw3X9pGE0FV1f8exFkTtJF0taMn80VzabLRS6rGyi3oFozNUu21QORphBFODdadtpM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=ISHcX0vR; arc=none smtp.client-ip=209.85.219.48 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ISHcX0vR" Received: by mail-qv1-f48.google.com with SMTP id 6a1803df08f44-8ce9d444173so35525426d6.2 for ; Tue, 02 Jun 2026 20:15:23 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780456523; x=1781061323; darn=vger.kernel.org; h=to:cc:date:message-id:subject:mime-version :content-transfer-encoding:from:from:to:cc:subject:date:message-id :reply-to; bh=r5PaakmDObNtfyoDT6IPk/0GVwBbjH2Axz2rUNVenOg=; b=ISHcX0vRDtqXZ6np14e2BZHtlDmQRcios6GMy8o5VyQYSMCwmKEzuGJ9zTkn68qa8c ZLC0RCAVty+mQSLOuXoMcP0b77lSsd9gGOfoQM7Ojzi2Uw/f82qeXmiED6txLX7RUxGp SEwpkJcwiKWhNKKAonbLTbCSAmKVPyUdJQkSdVc1ujhDVY2v+SkV9lsmSPL124noR6KJ /8jEgRG1/uuTZtWcAtCHzEm4XbM/ghwrx95//e2YRBizkRZvQdoj7LJEuGOORrC6wMXy GYuW4U7eXtIBoFhFco9g1NqB+ok5gsEo7hNi2X5rSLbVJAUcm08DxKsKv52B+UVeZ6D9 gRpQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780456523; x=1781061323; h=to:cc:date:message-id:subject:mime-version :content-transfer-encoding:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=r5PaakmDObNtfyoDT6IPk/0GVwBbjH2Axz2rUNVenOg=; b=DbmOqyE29DUuo0ecgjtX6rRnjSRbrRtBsMp761oY+j7sSLXHOJ1kmvDOZAccrd7k44 0RQQJYX7u7J7InvnIH1RKC61aRgdCu8bm2/palFiLWpjWVgG3dH/bWCRyx7o8lwNjjGp nD9B+Lfbbq+gxAXE/nrPSBz2PkmcgEpPhyhkJn3Rh9epBSPjrk0id6GwmSu6pVL9ZxiG e3XjHB4C5DEECr+sE3mQLqr1YodbPA6IE1F8h2Bs8cCMDviTYoSCYfoIubnIF3Wuvkn7 YyMZ4WAT3PmZ+KHb9V7YYvzjc9L9Hb3JZbzZEKgr5KUPeeAIhiGhv89HT1OoUjj0l8Do I2AA== X-Forwarded-Encrypted: i=1; AFNElJ/5anFAiQ4lPzTRWYaJ9OoAP8+QL/wUFdHnUXvCaoQeVP1sltuA+3fVLLSb8xoaAZAAocSeGWr7l/7OgCg=@vger.kernel.org X-Gm-Message-State: AOJu0Yxh6Ew8HU/k5J1j00Q0c1FDRFD+MypxRldjdcqNYhIElcehp2hO 8TX41voicDUejOmjhBiG9OxWommWbvsJpP5tDedGTK58BpV/6/glKVvB X-Gm-Gg: Acq92OG7sNjx/6vPKSichQ9v2ICyolQc0kmrHZMX7/blPGM3T3fHkhTmW99/4XKrQEm /V0EEuEoI35XEFwj60MV9MrDxq9jJiIo7Ek7GBaeBERsZNL+WZucl29imi2bFuIyq6fraT4p9qz HuKrbWTLf5G2PWucuVjn0tu4E5mrqLsdcDjxI8JS3YwOoJeMVj0XSU+SY5C69v/ZJnw5jUuAcTW +iG5jYzWjIbh146MybV6eGTCF7rYHILzYXwskcA1ncpHcp1XUfElGS/CxBx4rfpXZP0m4Nt/xY8 fJOdOWNRKCNvMtLll0KuxIN7oY2cNkwOT8d8XqDlD/HKq3byLqRhBbgn8wxEzqzUxT3pzisDKqF y5J7ngLPccD1OKGZBaeHptrcMF6qMQfZ6ASARJio4VS3eXxZ2PPSLOTxYgqt9LzqZPnYZCyWcqi /p2dtuxgAUS/Kmmd/ujvywQ6uv5UL5L9Md/dyRnE7O1rAPPiBXWrvPWVBxl83EqcQn4m8bnUZu5 4Q= X-Received: by 2002:ad4:5be8:0:b0:8cc:e965:a562 with SMTP id 6a1803df08f44-8cecdf0c010mr21134226d6.25.1780456522909; Tue, 02 Jun 2026 20:15:22 -0700 (PDT) Received: from smtpclient.apple ([2601:985:4601:5df0:6079:17ed:fd11:8e45]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-8cecd2629cesm8795536d6.41.2026.06.02.20.15.22 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 02 Jun 2026 20:15:22 -0700 (PDT) From: Shuangpeng Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3864.600.51.1.1\)) Subject: [BUG] KASAN: slab-use-after-free in pvr2_v4l2_dev_init Message-Id: <6C2D160B-37DD-40F0-B8A2-089B8CAACB58@gmail.com> Date: Tue, 2 Jun 2026 23:15:11 -0400 Cc: linux-media@vger.kernel.org, linux-kernel@vger.kernel.org To: isely@pobox.com, mchehab@kernel.org X-Mailer: Apple Mail (2.3864.600.51.1.1) Hi Kernel Maintainers, I hit the following KASAN report while testing current upstream kernel: KASAN: slab-use-after-free in pvr2_v4l2_dev_init on commit: e8c2f9fdadee7cbc75134dc463c1e0d856d6e5c7 (May 25 2026) The reproducer and .config files are here. https://gist.github.com/shuangpengbai/1bb11709aa99114979c00138773e23f3 I=E2=80=99m happy to test debug patches or provide additional = information. Reported-by: Shuangpeng Bai [ 594.064526][ T2009] = =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D [ 594.066061][ T2009] BUG: KASAN: slab-use-after-free in = pvr2_v4l2_dev_init (drivers/media/usb/pvrusb2/pvrusb2-v4l2.c:1221) [ 594.067466][ T2009] Read of size 4 at addr ffff88810a2aa4b4 by task = pvrusb2-context/2009 [ 594.068813][ T2009] [ 594.069190][ T2009] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + = PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 594.069195][ T2009] Call Trace: [ 594.069199][ T2009] [ 594.069204][ T2009] dump_stack_lvl (lib/dump_stack.c:94 = lib/dump_stack.c:120) [ 594.069211][ T2009] print_report (mm/kasan/report.c:378 = mm/kasan/report.c:482) [ 594.069231][ T2009] kasan_report (mm/kasan/report.c:595) [ 594.069243][ T2009] pvr2_v4l2_dev_init = (drivers/media/usb/pvrusb2/pvrusb2-v4l2.c:1221) [ 594.069263][ T2009] pvr2_v4l2_create = (drivers/media/usb/pvrusb2/pvrusb2-v4l2.c:1249) [ 594.069270][ T2009] pvr_setup_attach = (drivers/media/usb/pvrusb2/pvrusb2-main.c:40) [ 594.069275][ T2009] pvr2_context_thread_func = (drivers/media/usb/pvrusb2/pvrusb2-context.c:117 = drivers/media/usb/pvrusb2/pvrusb2-context.c:158) [ 594.069333][ T2009] kthread (kernel/kthread.c:436) [ 594.069351][ T2009] ret_from_fork (arch/x86/kernel/process.c:158) [ 594.069375][ T2009] ret_from_fork_asm = (arch/x86/entry/entry_64.S:245) [ 594.069383][ T2009] [ 594.069385][ T2009] [ 594.087179][ T2009] Freed by task 2009 on cpu 1 at 594.064509s: [ 594.087705][ T2009] kasan_save_track (mm/kasan/common.c:57 = mm/kasan/common.c:78) [ 594.088130][ T2009] kasan_save_free_info (mm/kasan/generic.c:584) [ 594.088566][ T2009] __kasan_slab_free (mm/kasan/common.c:253 = mm/kasan/common.c:285) [ 594.088980][ T2009] kfree (./include/linux/kasan.h:235 = mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6566) [ 594.089324][ T2009] v4l2_device_release = (drivers/media/v4l2-core/v4l2-dev.c:225) [ 594.089762][ T2009] device_release = (drivers/gpu/drm/vkms/vkms_configfs.c:690) [ 594.090164][ T2009] kobject_put (lib/kobject.c:689 lib/kobject.c:720 = ./include/linux/kref.h:65 lib/kobject.c:737) [ 594.090544][ T2009] __video_register_device = (drivers/media/v4l2-core/v4l2-dev.c:1080) [ 594.091031][ T2009] pvr2_v4l2_dev_init = (./include/media/v4l2-dev.h:390 = drivers/media/usb/pvrusb2/pvrusb2-v4l2.c:1218) [ 594.091460][ T2009] pvr2_v4l2_create = (drivers/media/usb/pvrusb2/pvrusb2-v4l2.c:1249) [ 594.091943][ T2009] pvr_setup_attach = (drivers/media/usb/pvrusb2/pvrusb2-main.c:40) [ 594.092348][ T2009] pvr2_context_thread_func = (drivers/media/usb/pvrusb2/pvrusb2-context.c:117 = drivers/media/usb/pvrusb2/pvrusb2-context.c:158) [ 594.092825][ T2009] kthread (kernel/kthread.c:436) [ 594.093188][ T2009] ret_from_fork (arch/x86/kernel/process.c:158) [ 594.093587][ T2009] ret_from_fork_asm = (arch/x86/entry/entry_64.S:245) [ 594.094004][ T2009] [ 594.094213][ T2009] The buggy address belongs to the object at = ffff88810a2aa000 [ 594.094213][ T2009] which belongs to the cache kmalloc-2k of size = 2048 [ 594.095415][ T2009] The buggy address is located 1204 bytes inside of [ 594.095415][ T2009] freed 2048-byte region [ffff88810a2aa000, = ffff88810a2aa800) Best, Shuangpeng