* [syzbot] KASAN: slab-use-after-free Read in fcloop_rport_lsrqst_work
@ 2026-09-20 2:02 syzbot
2026-09-20 14:06 ` Forwarded: [PATCH] nvmet-fc: fix use-after-free of nvmet_fc_ls_req_op syzbot
2026-09-20 14:09 ` syzbot
0 siblings, 2 replies; 3+ messages in thread
From: syzbot @ 2026-09-20 2:02 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 518e5b794c06 Merge tag 'for-7.3-rc3-tag' of git://git.kern..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
console output: https://syzkaller.appspot.com/x/log.txt?x=15045ff9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=84649d3ff8d550cb
dashboard link: https://syzkaller.appspot.com/bug?extid=77955102efac681ec73b
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1210d915580000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+77955102efac681ec73b@syzkaller.appspotmail.com
nvmet_fc: {0:0}: Association deleted
nvmet_fc: {0:0}: Association freed
==================================================================
BUG: KASAN: slab-use-after-free in fcloop_rport_lsrqst_work+0x242/0x2e0 drivers/nvme/target/fcloop.c:342
Read of size 8 at addr ffff8880234fdc38 by task kworker/u33:6/188
CPU: 3 UID: 0 PID: 188 Comm: kworker/u33:6 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Workqueue: nvmet-wq fcloop_tport_lsrqst_work
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x13d/0x4b0 mm/kasan/report.c:482
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
fcloop_rport_lsrqst_work+0x242/0x2e0 drivers/nvme/target/fcloop.c:342
process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396
process_scheduled_works kernel/workqueue.c:3479 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
</TASK>
Allocated by task 188:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__do_kmalloc_node mm/slub.c:5414 [inline]
__kmalloc_noprof+0x32f/0x840 mm/slub.c:5439
_kmalloc_noprof include/linux/slab.h:995 [inline]
_kzalloc_noprof include/linux/slab.h:1312 [inline]
nvmet_fc_xmt_disconnect_assoc drivers/nvme/target/fc.c:489 [inline]
nvmet_fc_target_assoc_free+0xbd5/0x2220 drivers/nvme/target/fc.c:1177
kref_put include/linux/kref.h:65 [inline]
nvmet_fc_tgt_a_put drivers/nvme/target/fc.c:1195 [inline]
nvmet_fc_delete_assoc_work.cold+0x118/0x144 drivers/nvme/target/fc.c:1068
process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396
process_scheduled_works kernel/workqueue.c:3479 [inline]
worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Freed by task 6009:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2748 [inline]
slab_free mm/slub.c:6508 [inline]
kfree+0x22b/0x6d0 mm/slub.c:6801
nvmet_fc_free_pending_reqs drivers/nvme/target/fc.c:1619 [inline]
nvmet_fc_unregister_targetport+0x351/0x760 drivers/nvme/target/fc.c:1651
__targetport_unreg drivers/nvme/target/fcloop.c:1600 [inline]
fcloop_delete_target_port+0x185/0x1f0 drivers/nvme/target/fcloop.c:1630
dev_attr_store+0x58/0x80 drivers/base/core.c:2509
sysfs_kf_write+0xf2/0x150 fs/sysfs/file.c:145
kernfs_fop_write_iter+0x3e0/0x5f0 fs/kernfs/file.c:345
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x6af/0x1050 fs/read_write.c:687
ksys_write+0x12a/0x250 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff8880234fdc00
which belongs to the cache kmalloc-256 of size 256
The buggy address is located 56 bytes inside of
freed 256-byte region [ffff8880234fdc00, ffff8880234fdd00)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x234fc
head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801c042b40 dead000000000100 dead000000000122
raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff88801c042b40 dead000000000100 dead000000000122
head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5742, tgid 5742 (udevd), ts 51615023593
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1871
prep_new_page mm/page_alloc.c:1879 [inline]
get_page_from_freelist+0x110d/0x35d0 mm/page_alloc.c:3943
__alloc_frozen_pages_noprof+0x2eb/0x3300 mm/page_alloc.c:5436
alloc_slab_page mm/slub.c:3347 [inline]
allocate_slab mm/slub.c:3462 [inline]
new_slab+0xa9/0x6e0 mm/slub.c:3513
refill_objects+0xe3/0x410 mm/slub.c:7417
refill_sheaf mm/slub.c:2885 [inline]
__pcs_replace_empty_main+0x35e/0x650 mm/slub.c:4774
alloc_from_pcs mm/slub.c:4850 [inline]
slab_alloc_node mm/slub.c:4984 [inline]
__do_kmalloc_node mm/slub.c:5413 [inline]
__kmalloc_noprof+0x67c/0x840 mm/slub.c:5439
_kmalloc_noprof include/linux/slab.h:995 [inline]
_kmalloc_array_noprof include/linux/slab.h:1211 [inline]
security_inode_init_security+0x113/0x370 security/security.c:1347
shmem_mknod+0x2ce/0x480 mm/shmem.c:3838
lookup_open+0x1255/0x1990 fs/namei.c:4567
open_last_lookups fs/namei.c:4767 [inline]
path_openat+0xa2c/0x2440 fs/namei.c:4997
do_file_open+0x20e/0x430 fs/namei.c:5029
do_sys_openat2+0x10f/0x1e0 fs/open.c:1417
do_sys_open fs/open.c:1423 [inline]
__do_sys_openat fs/open.c:1439 [inline]
__se_sys_openat fs/open.c:1434 [inline]
__x64_sys_openat+0x12d/0x210 fs/open.c:1434
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 29 tgid 29 ts 51596759354 stack trace:
reset_page_owner include/linux/page_owner.h:26 [inline]
__free_pages_prepare mm/page_alloc.c:1418 [inline]
__free_frozen_pages+0x79f/0x10f0 mm/page_alloc.c:2962
rcu_do_batch kernel/rcu/tree.c:2650 [inline]
rcu_core+0x5f0/0x1260 kernel/rcu/tree.c:2919
handle_softirqs+0x1e6/0x9d0 kernel/softirq.c:645
run_ksoftirqd kernel/softirq.c:1099 [inline]
run_ksoftirqd+0x38/0x60 kernel/softirq.c:1091
smpboot_thread_fn+0x3d3/0xab0 kernel/smpboot.c:160
kthread+0x373/0x450 kernel/kthread.c:436
ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Memory state around the buggy address:
ffff8880234fdb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8880234fdb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8880234fdc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880234fdc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880234fdd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply [flat|nested] 3+ messages in thread
* Forwarded: [PATCH] nvmet-fc: fix use-after-free of nvmet_fc_ls_req_op
2026-09-20 2:02 [syzbot] KASAN: slab-use-after-free Read in fcloop_rport_lsrqst_work syzbot
@ 2026-09-20 14:06 ` syzbot
2026-09-20 14:09 ` syzbot
1 sibling, 0 replies; 3+ messages in thread
From: syzbot @ 2026-09-20 14:06 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] nvmet-fc: fix use-after-free of nvmet_fc_ls_req_op
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
nvmet_fc_free_pending_reqs() unconditionally frees each queued
nvmet_fc_ls_req_op (lsop) when a targetport is unregistered, but an
LLDD (e.g. fcloop) may still hold a pointer to that request queued on
its own async work, with no way for the target core to know.
If the targetport is torn down while such a request is still in
flight, the LLDD later dereferences the freed lsop when its completion
work runs, causing a slab-use-after-free.
Fix this by refcounting nvmet_fc_ls_req_op: one reference for the
core's ls_req_list, and one for the in-flight request handed to the
LLDD via ->ls_req(). The object is only freed once both the normal
completion path (__nvmet_fc_finish_ls_req) and teardown
(nvmet_fc_free_pending_reqs) have dropped their reference, whichever
runs last.
Reported-by: syzbot+77955102efac681ec73b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=77955102efac681ec73b
Signed-off-by: Deepanshu kartikey <kartikey406@gmail.com>
---
drivers/nvme/target/fc.c | 38 ++++++++++++++++++++++++--------------
1 file changed, 24 insertions(+), 14 deletions(-)
diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
index 1b557775e033..a25f7579049d 100644
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -56,6 +56,7 @@ struct nvmet_fc_ls_req_op { /* for an LS RQST XMT */
bool req_queued;
struct work_struct put_work;
+ struct kref ref;
};
@@ -339,6 +340,22 @@ fc_dma_unmap_sg(struct device *dev, struct scatterlist *sg, int nents,
dma_unmap_sg(dev, sg, nents, dir);
}
+static void
+nvmet_fc_ls_req_op_release(struct kref *ref)
+{
+ struct nvmet_fc_ls_req_op *lsop =
+ container_of(ref, struct nvmet_fc_ls_req_op, ref);
+ struct nvmet_fc_tgtport *tgtport = lsop->tgtport;
+ struct nvmefc_ls_req *lsreq = &lsop->ls_req;
+
+ if (lsop->req_queued)
+ fc_dma_unmap_single(tgtport->dev, lsreq->rqstdma,
+ (lsreq->rqstlen + lsreq->rsplen),
+ DMA_BIDIRECTIONAL);
+ queue_work(nvmet_wq, &lsop->put_work);
+}
+
+
/* ********************** FC-NVME LS XMT Handling ************************* */
@@ -347,7 +364,6 @@ static void
__nvmet_fc_finish_ls_req(struct nvmet_fc_ls_req_op *lsop)
{
struct nvmet_fc_tgtport *tgtport = lsop->tgtport;
- struct nvmefc_ls_req *lsreq = &lsop->ls_req;
unsigned long flags;
spin_lock_irqsave(&tgtport->lock, flags);
@@ -363,12 +379,8 @@ __nvmet_fc_finish_ls_req(struct nvmet_fc_ls_req_op *lsop)
spin_unlock_irqrestore(&tgtport->lock, flags);
- fc_dma_unmap_single(tgtport->dev, lsreq->rqstdma,
- (lsreq->rqstlen + lsreq->rsplen),
- DMA_BIDIRECTIONAL);
-
out_putwork:
- queue_work(nvmet_wq, &lsop->put_work);
+ kref_put(&lsop->ref, nvmet_fc_ls_req_op_release);
}
static int
@@ -406,12 +418,16 @@ __nvmet_fc_send_ls_req(struct nvmet_fc_tgtport *tgtport,
lsop->req_queued = true;
+ kref_init(&lsop->ref);
+ kref_get(&lsop->ref);
spin_unlock_irqrestore(&tgtport->lock, flags);
ret = tgtport->ops->ls_req(&tgtport->fc_target_port, lsop->hosthandle,
lsreq);
- if (ret)
+ if (ret) {
+ kref_put(&lsop->ref, nvmet_fc_ls_req_op_release);
goto out_unlink;
+ }
return 0;
@@ -1591,7 +1607,6 @@ static void
nvmet_fc_free_pending_reqs(struct nvmet_fc_tgtport *tgtport)
{
struct nvmet_fc_ls_req_op *lsop;
- struct nvmefc_ls_req *lsreq;
struct nvmet_fc_ls_iod *iod;
int i;
@@ -1611,12 +1626,7 @@ nvmet_fc_free_pending_reqs(struct nvmet_fc_tgtport *tgtport)
if (!lsop->req_queued)
continue;
- lsreq = &lsop->ls_req;
- fc_dma_unmap_single(tgtport->dev, lsreq->rqstdma,
- (lsreq->rqstlen + lsreq->rsplen),
- DMA_BIDIRECTIONAL);
- nvmet_fc_tgtport_put(tgtport);
- kfree(lsop);
+ kref_put(&lsop->ref, nvmet_fc_ls_req_op_release);
}
}
--
2.43.0
^ permalink raw reply [flat|nested] 3+ messages in thread
* Forwarded: [PATCH] nvmet-fc: fix use-after-free of nvmet_fc_ls_req_op
2026-09-20 2:02 [syzbot] KASAN: slab-use-after-free Read in fcloop_rport_lsrqst_work syzbot
2026-09-20 14:06 ` Forwarded: [PATCH] nvmet-fc: fix use-after-free of nvmet_fc_ls_req_op syzbot
@ 2026-09-20 14:09 ` syzbot
1 sibling, 0 replies; 3+ messages in thread
From: syzbot @ 2026-09-20 14:09 UTC (permalink / raw)
To: linux-kernel, syzkaller-bugs
For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com.
***
Subject: [PATCH] nvmet-fc: fix use-after-free of nvmet_fc_ls_req_op
Author: kartikey406@gmail.com
#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
nvmet_fc_free_pending_reqs() unconditionally frees each queued
nvmet_fc_ls_req_op (lsop) when a targetport is unregistered, but an
LLDD (e.g. fcloop) may still hold a pointer to that request queued on
its own async work, with no way for the target core to know.
If the targetport is torn down while such a request is still in
flight, the LLDD later dereferences the freed lsop when its completion
work runs, causing a slab-use-after-free.
Fix this by refcounting nvmet_fc_ls_req_op: one reference for the
core's ls_req_list, and one for the in-flight request handed to the
LLDD via ->ls_req(). The object is only freed once both the normal
completion path (__nvmet_fc_finish_ls_req) and teardown
(nvmet_fc_free_pending_reqs) have dropped their reference, whichever
runs last.
Reported-by: syzbot+77955102efac681ec73b@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=77955102efac681ec73b
Signed-off-by: Deepanshu kartikey <kartikey406@gmail.com>
---
drivers/nvme/target/fc.c | 38 ++++++++++++++++++++++++--------------
1 file changed, 24 insertions(+), 14 deletions(-)
diff --git a/drivers/nvme/target/fc.c b/drivers/nvme/target/fc.c
index 1b557775e033..a25f7579049d 100644
--- a/drivers/nvme/target/fc.c
+++ b/drivers/nvme/target/fc.c
@@ -56,6 +56,7 @@ struct nvmet_fc_ls_req_op { /* for an LS RQST XMT */
bool req_queued;
struct work_struct put_work;
+ struct kref ref;
};
@@ -339,6 +340,22 @@ fc_dma_unmap_sg(struct device *dev, struct scatterlist *sg, int nents,
dma_unmap_sg(dev, sg, nents, dir);
}
+static void
+nvmet_fc_ls_req_op_release(struct kref *ref)
+{
+ struct nvmet_fc_ls_req_op *lsop =
+ container_of(ref, struct nvmet_fc_ls_req_op, ref);
+ struct nvmet_fc_tgtport *tgtport = lsop->tgtport;
+ struct nvmefc_ls_req *lsreq = &lsop->ls_req;
+
+ if (lsop->req_queued)
+ fc_dma_unmap_single(tgtport->dev, lsreq->rqstdma,
+ (lsreq->rqstlen + lsreq->rsplen),
+ DMA_BIDIRECTIONAL);
+ queue_work(nvmet_wq, &lsop->put_work);
+}
+
+
/* ********************** FC-NVME LS XMT Handling ************************* */
@@ -347,7 +364,6 @@ static void
__nvmet_fc_finish_ls_req(struct nvmet_fc_ls_req_op *lsop)
{
struct nvmet_fc_tgtport *tgtport = lsop->tgtport;
- struct nvmefc_ls_req *lsreq = &lsop->ls_req;
unsigned long flags;
spin_lock_irqsave(&tgtport->lock, flags);
@@ -363,12 +379,8 @@ __nvmet_fc_finish_ls_req(struct nvmet_fc_ls_req_op *lsop)
spin_unlock_irqrestore(&tgtport->lock, flags);
- fc_dma_unmap_single(tgtport->dev, lsreq->rqstdma,
- (lsreq->rqstlen + lsreq->rsplen),
- DMA_BIDIRECTIONAL);
-
out_putwork:
- queue_work(nvmet_wq, &lsop->put_work);
+ kref_put(&lsop->ref, nvmet_fc_ls_req_op_release);
}
static int
@@ -406,12 +418,16 @@ __nvmet_fc_send_ls_req(struct nvmet_fc_tgtport *tgtport,
lsop->req_queued = true;
+ kref_init(&lsop->ref);
+ kref_get(&lsop->ref);
spin_unlock_irqrestore(&tgtport->lock, flags);
ret = tgtport->ops->ls_req(&tgtport->fc_target_port, lsop->hosthandle,
lsreq);
- if (ret)
+ if (ret) {
+ kref_put(&lsop->ref, nvmet_fc_ls_req_op_release);
goto out_unlink;
+ }
return 0;
@@ -1591,7 +1607,6 @@ static void
nvmet_fc_free_pending_reqs(struct nvmet_fc_tgtport *tgtport)
{
struct nvmet_fc_ls_req_op *lsop;
- struct nvmefc_ls_req *lsreq;
struct nvmet_fc_ls_iod *iod;
int i;
@@ -1611,12 +1626,7 @@ nvmet_fc_free_pending_reqs(struct nvmet_fc_tgtport *tgtport)
if (!lsop->req_queued)
continue;
- lsreq = &lsop->ls_req;
- fc_dma_unmap_single(tgtport->dev, lsreq->rqstdma,
- (lsreq->rqstlen + lsreq->rsplen),
- DMA_BIDIRECTIONAL);
- nvmet_fc_tgtport_put(tgtport);
- kfree(lsop);
+ kref_put(&lsop->ref, nvmet_fc_ls_req_op_release);
}
}
--
2.43.0
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-09-20 14:10 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-20 2:02 [syzbot] KASAN: slab-use-after-free Read in fcloop_rport_lsrqst_work syzbot
2026-09-20 14:06 ` Forwarded: [PATCH] nvmet-fc: fix use-after-free of nvmet_fc_ls_req_op syzbot
2026-09-20 14:09 ` syzbot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®