From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-oi1-f198.google.com (mail-oi1-f198.google.com [209.85.167.198]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 618AF341660 for ; Fri, 31 Jul 2026 06:59:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.198 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785481145; cv=none; b=bJAdXf2tSNkDJYaWvSjTPMJHYP1EGgViNdGvJnZmRkSjjpNyPOsm92H7hcgMiCRsXFVwY3jtX8SVN54qF2rrVPiNMzLOEx2AsfCFosDFQ8fewgYs8FSNCtBub7y1X7/ynC+9dIQFbV70+aeFNbmhauetQTy2k3AbFs+G3bao7vY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785481145; c=relaxed/simple; bh=dVKMO5c52o8PjzGU3mPYsmi3UWdkgJ96q32uaUOGZXE=; h=MIME-Version:Date:In-Reply-To:Message-ID:Subject:From:To: Content-Type; b=bWrXqq0Nl2wCE22k+umzjPA9U8aZWim7GLLyiXY0ihbfuInLu3fLPZpdO0KBQr0exJj3WcIyHSDB+DiBF43qs8pjpRToBS3F13HUrecQaYOnxMOwLdIUyW4MJTAuPlA2RI1obt7RlRiYFJZ+LuKU5+L8kLx/YTaYLluyTxOlRYg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.167.198 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-oi1-f198.google.com with SMTP id 5614622812f47-4ab8b4887d4so483562b6e.1 for ; Thu, 30 Jul 2026 23:59:03 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785481142; x=1786085942; h=content-type:to:from:subject:message-id:in-reply-to:date :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to:content-type; bh=omc9W0g1nI+O8F73AuD1JKy4NWQy6IvH+gknX83LvS4=; b=ZGUQGL6h/vqaJtaFtP1RHyB7z6uUu1ZwcNLT4hSa6DOneGBmY6eKmcTyay3tNVz3qv q7z+04fIvn6EMCT+I4uUhgliz4uibk9xfkqWYj00fSqdHE/d8X9dMfUqhvHILlCCiee7 A4JXlgTL1C6LzVBZTx/KQb2j+l0+LESe0AlE8ghSXoXpKE2Jp8EHYymGuc5/o41dYD2m F7hk/2ftlE1VM3gkoVPTfP6S5or90iQffps4icu1nLGe71tciLufFU0f0Him0KWcQixO 0FMYprFgyWF7hy3n/nS+j8SbsVZWV04ge+okYLAs/c84Sr2Xdr6QFLrROUCqqVhQXOqK lnig== X-Forwarded-Encrypted: i=1; AHgh+RooJzNDvXVGyG/HL9zc9MdCPaOKuSsWk65dX5HzwAY7M/0RqZjjEZob5qmaoTJzueTZZHGE5j4LKJYuctE=@vger.kernel.org X-Gm-Message-State: AOJu0YxwAsRbKA+steZ9puGA4WRVKN4lKnc5D3dv/TYKGVTuIv+4XJJs G+CGMA/kgM363S9jhKWfGE6mEnfy40nYfdK1nXARvRn1aR9laVbGfCXK5WXtUB4ke1gdtMVfhy+ /XqGEBeMmwdPlt5CD/wEhOW3jlvaXu+0jwxHsBtOUxCGgcwYxtMrDj+7PIGk= Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a05:6808:1908:b0:4ab:2256:a410 with SMTP id 5614622812f47-4ae5aba03b3mr895943b6e.22.1785481142384; Thu, 30 Jul 2026 23:59:02 -0700 (PDT) Date: Thu, 30 Jul 2026 23:59:02 -0700 In-Reply-To: <20260731044451.10817-1-kartikey406@gmail.com> X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <6a6c47b6.1b55b669.19788.0019.GAE@google.com> Subject: Re: [syzbot] [usb?] KASAN: slab-use-after-free Read in ep_open From: syzbot To: kartikey406@gmail.com, linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Content-Type: text/plain; charset="UTF-8" Hello, syzbot has tested the proposed patch but the reproducer is still triggering an issue: KASAN: slab-use-after-free Write in ep_open ================================================================== BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline] BUG: KASAN: slab-use-after-free in atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:252 [inline] BUG: KASAN: slab-use-after-free in __refcount_add include/linux/refcount.h:283 [inline] BUG: KASAN: slab-use-after-free in __refcount_inc include/linux/refcount.h:366 [inline] BUG: KASAN: slab-use-after-free in refcount_inc include/linux/refcount.h:383 [inline] BUG: KASAN: slab-use-after-free in get_ep drivers/usb/gadget/legacy/inode.c:214 [inline] BUG: KASAN: slab-use-after-free in ep_open+0xb8/0x2bc drivers/usb/gadget/legacy/inode.c:831 Write of size 4 at addr ffff0000d322748c by task syz-executor/5557 CPU: 1 UID: 0 PID: 5557 Comm: syz-executor Not tainted syzkaller #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 print_address_description+0xb0/0x238 mm/kasan/report.c:378 print_report+0x68/0x84 mm/kasan/report.c:482 kasan_report+0x8c/0xc4 mm/kasan/report.c:595 check_region_inline mm/kasan/generic.c:-1 [inline] kasan_check_range+0x17c/0x1ac mm/kasan/generic.c:200 __kasan_check_write+0x20/0x30 mm/kasan/shadow.c:37 instrument_atomic_read_write include/linux/instrumented.h:112 [inline] atomic_fetch_add_relaxed include/linux/atomic/atomic-instrumented.h:252 [inline] __refcount_add include/linux/refcount.h:283 [inline] __refcount_inc include/linux/refcount.h:366 [inline] refcount_inc include/linux/refcount.h:383 [inline] get_ep drivers/usb/gadget/legacy/inode.c:214 [inline] ep_open+0xb8/0x2bc drivers/usb/gadget/legacy/inode.c:831 do_dentry_open+0x5c4/0xfc0 fs/open.c:947 vfs_open+0x44/0x2dc fs/open.c:1052 do_open fs/namei.c:4700 [inline] path_openat+0x21fc/0x2a60 fs/namei.c:4863 do_file_open+0x1c8/0x2e8 fs/namei.c:4892 do_sys_openat2+0x114/0x1e8 fs/open.c:1368 do_sys_open+0xb0/0xe0 fs/open.c:1374 __do_sys_openat fs/open.c:1390 [inline] __se_sys_openat fs/open.c:1385 [inline] __arm64_sys_openat+0xa0/0xbc fs/open.c:1385 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:736 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:755 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594 Allocated by task 5798: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:78 kasan_save_alloc_info+0x44/0x54 mm/kasan/generic.c:570 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0x9c/0xb4 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x2e8/0x5ec mm/slub.c:5515 _kmalloc_noprof include/linux/slab.h:969 [inline] _kzalloc_noprof include/linux/slab.h:1290 [inline] activate_ep_files drivers/usb/gadget/legacy/inode.c:1616 [inline] gadgetfs_bind+0x204/0x7a0 drivers/usb/gadget/legacy/inode.c:1708 gadget_bind_driver+0x274/0x834 drivers/usb/gadget/udc/core.c:1662 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x29c/0x800 drivers/base/dd.c:706 __driver_probe_device+0x1e0/0x350 drivers/base/dd.c:868 driver_probe_device+0x6c/0x19c drivers/base/dd.c:898 __driver_attach+0x168/0x384 drivers/base/dd.c:1292 bus_for_each_dev+0x128/0x1b4 drivers/base/bus.c:383 driver_attach+0x50/0x60 drivers/base/dd.c:1310 bus_add_driver+0x208/0x500 drivers/base/bus.c:763 driver_register+0x220/0x310 drivers/base/driver.c:174 usb_gadget_register_driver_owner+0xf0/0x25c drivers/usb/gadget/udc/core.c:1752 dev_config+0x91c/0xcc0 drivers/usb/gadget/legacy/inode.c:1899 vfs_write+0x2a4/0xa0c fs/read_write.c:685 ksys_write+0x12c/0x228 fs/read_write.c:739 __do_sys_write fs/read_write.c:750 [inline] __se_sys_write fs/read_write.c:747 [inline] __arm64_sys_write+0x7c/0x90 fs/read_write.c:747 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:736 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:755 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594 Freed by task 5799: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:78 kasan_save_free_info+0x58/0x70 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x74/0xa4 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2705 [inline] slab_free mm/slub.c:6405 [inline] kfree+0x188/0x690 mm/slub.c:6720 put_ep+0xd0/0x144 drivers/usb/gadget/legacy/inode.c:225 destroy_ep_files+0x244/0x2dc drivers/usb/gadget/legacy/inode.c:1597 gadgetfs_unbind+0x114/0x1f0 drivers/usb/gadget/legacy/inode.c:1673 gadget_unbind_driver+0x188/0x790 drivers/usb/gadget/udc/core.c:1724 device_remove+0xc4/0x134 drivers/base/dd.c:616 __device_release_driver drivers/base/dd.c:1349 [inline] device_release_driver_internal+0x124/0x20c drivers/base/dd.c:1372 driver_detach+0x124/0x1b4 drivers/base/dd.c:1435 bus_remove_driver+0x124/0x22c drivers/base/bus.c:832 driver_unregister+0x78/0xac drivers/base/driver.c:202 usb_gadget_unregister_driver+0x50/0x78 drivers/usb/gadget/udc/core.c:1784 dev_release+0x8c/0x15c drivers/usb/gadget/legacy/inode.c:1213 __fput+0x338/0x74c fs/file_table.c:512 ____fput+0x20/0x30 fs/file_table.c:540 task_work_run+0x1cc/0x25c kernel/task_work.c:233 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0x58c/0x1a74 kernel/exit.c:1009 __do_sys_exit kernel/exit.c:1119 [inline] __se_sys_exit kernel/exit.c:1117 [inline] do_group_exit+0x0/0x238 kernel/exit.c:1117 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:736 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:755 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594 The buggy address belongs to the object at ffff0000d3227400 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 140 bytes inside of freed 512-byte region [ffff0000d3227400, ffff0000d3227600) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113224 head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff) page_type: f5(slab) raw: 05ffc00000000040 ffff0000c0001c80 dead000000000100 dead000000000122 raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 head: 05ffc00000000040 ffff0000c0001c80 dead000000000100 dead000000000122 head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 head: 05ffc00000000002 fffffdffc34c8901 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000d3227380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff0000d3227400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff0000d3227480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff0000d3227500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff0000d3227580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== ------------[ cut here ]------------ refcount_t: addition on 0; use-after-free. WARNING: lib/refcount.c:25 at refcount_warn_saturate+0x134/0x1f8 lib/refcount.c:25, CPU#1: syz-executor/5557 Modules linked in: CPU: 1 UID: 0 PID: 5557 Comm: syz-executor Tainted: G B syzkaller #0 PREEMPT Tainted: [B]=BAD_PAGE Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 pstate: 634000c5 (nZCv daIF +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : refcount_warn_saturate+0x134/0x1f8 lib/refcount.c:25 lr : refcount_warn_saturate+0x134/0x1f8 lib/refcount.c:25 sp : ffff800094a97740 x29: ffff800094a97740 x28: dfff800000000000 x27: 1fffe00019788600 x26: ffff0000cbc43008 x25: 1fffe0001aebd509 x24: ffff0000d75ea848 x23: dfff800000000000 x22: 0000000000000000 x21: ffff0000cbc42fc0 x20: ffff0000d322748c x19: ffff80008a158000 x18: 0000000000000000 x17: 3d3d3d3d3d3d3d3d x16: 3d3d3d3d3d3d3d3d x15: 3d3d3d3d3d3d3d3d x14: 3d3d3d3d3d3d3d3d x13: 0000000000000001 x12: 0000000000000000 x11: 0000000000000000 x10: 0000000000000003 x9 : 360a90020a0ce000 x8 : 360a90020a0ce000 x7 : 0000000000000001 x6 : ffff80008048de94 x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000802f8054 x2 : 0000000100000001 x1 : ffff0000c2a03a80 x0 : 0000000000000000 Call trace: refcount_warn_saturate+0x134/0x1f8 lib/refcount.c:25 (P) __refcount_add include/linux/refcount.h:-1 [inline] __refcount_inc include/linux/refcount.h:366 [inline] refcount_inc include/linux/refcount.h:383 [inline] get_ep drivers/usb/gadget/legacy/inode.c:214 [inline] ep_open+0x238/0x2bc drivers/usb/gadget/legacy/inode.c:831 do_dentry_open+0x5c4/0xfc0 fs/open.c:947 vfs_open+0x44/0x2dc fs/open.c:1052 do_open fs/namei.c:4700 [inline] path_openat+0x21fc/0x2a60 fs/namei.c:4863 do_file_open+0x1c8/0x2e8 fs/namei.c:4892 do_sys_openat2+0x114/0x1e8 fs/open.c:1368 do_sys_open+0xb0/0xe0 fs/open.c:1374 __do_sys_openat fs/open.c:1390 [inline] __se_sys_openat fs/open.c:1385 [inline] __arm64_sys_openat+0xa0/0xbc fs/open.c:1385 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:736 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:755 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594 irq event stamp: 217440 hardirqs last enabled at (217439): [] kasan_quarantine_put+0xb4/0x1c4 mm/kasan/quarantine.c:234 hardirqs last disabled at (217440): [] __raw_spin_lock_irq include/linux/spinlock_api_smp.h:140 [inline] hardirqs last disabled at (217440): [] _raw_spin_lock_irq+0x28/0x70 kernel/locking/spinlock.c:174 softirqs last enabled at (213442): [] local_bh_enable include/linux/bottom_half.h:33 [inline] softirqs last enabled at (213442): [] put_cpu_fpsimd_context arch/arm64/kernel/fpsimd.c:251 [inline] softirqs last enabled at (213442): [] fpsimd_restore_current_state+0x39c/0x9c8 arch/arm64/kernel/fpsimd.c:1797 softirqs last disabled at (213440): [] local_bh_disable include/linux/bottom_half.h:20 [inline] softirqs last disabled at (213440): [] get_cpu_fpsimd_context arch/arm64/kernel/fpsimd.c:234 [inline] softirqs last disabled at (213440): [] fpsimd_restore_current_state+0x44/0x9c8 arch/arm64/kernel/fpsimd.c:1790 ---[ end trace 0000000000000000 ]--- Tested on: commit: 365f9c7a Merge branches 'for-next/core' and 'for-next/.. git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci console output: https://syzkaller.appspot.com/x/log.txt?x=114978c6580000 kernel config: https://syzkaller.appspot.com/x/.config?x=72c97575381cec47 dashboard link: https://syzkaller.appspot.com/bug?extid=df9e891bf8ea586f846b compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8 userspace arch: arm64 patch: https://syzkaller.appspot.com/x/patch.diff?x=12b475b9580000