* [BUG] KASAN: slab-use-after-free in pvr2_v4l2_dev_init @ 2026-06-03 3:15 Shuangpeng 2026-06-04 1:47 ` [PATCH] media: usb: pvrusb2: fix " xiaopeitux 0 siblings, 1 reply; 4+ messages in thread From: Shuangpeng @ 2026-06-03 3:15 UTC (permalink / raw) To: isely, mchehab; +Cc: linux-media, linux-kernel Hi Kernel Maintainers, I hit the following KASAN report while testing current upstream kernel: KASAN: slab-use-after-free in pvr2_v4l2_dev_init on commit: e8c2f9fdadee7cbc75134dc463c1e0d856d6e5c7 (May 25 2026) The reproducer and .config files are here. https://gist.github.com/shuangpengbai/1bb11709aa99114979c00138773e23f3 I’m happy to test debug patches or provide additional information. Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com> [ 594.064526][ T2009] ================================================================== [ 594.066061][ T2009] BUG: KASAN: slab-use-after-free in pvr2_v4l2_dev_init (drivers/media/usb/pvrusb2/pvrusb2-v4l2.c:1221) [ 594.067466][ T2009] Read of size 4 at addr ffff88810a2aa4b4 by task pvrusb2-context/2009 [ 594.068813][ T2009] [ 594.069190][ T2009] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 594.069195][ T2009] Call Trace: [ 594.069199][ T2009] <TASK> [ 594.069204][ T2009] dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) [ 594.069211][ T2009] print_report (mm/kasan/report.c:378 mm/kasan/report.c:482) [ 594.069231][ T2009] kasan_report (mm/kasan/report.c:595) [ 594.069243][ T2009] pvr2_v4l2_dev_init (drivers/media/usb/pvrusb2/pvrusb2-v4l2.c:1221) [ 594.069263][ T2009] pvr2_v4l2_create (drivers/media/usb/pvrusb2/pvrusb2-v4l2.c:1249) [ 594.069270][ T2009] pvr_setup_attach (drivers/media/usb/pvrusb2/pvrusb2-main.c:40) [ 594.069275][ T2009] pvr2_context_thread_func (drivers/media/usb/pvrusb2/pvrusb2-context.c:117 drivers/media/usb/pvrusb2/pvrusb2-context.c:158) [ 594.069333][ T2009] kthread (kernel/kthread.c:436) [ 594.069351][ T2009] ret_from_fork (arch/x86/kernel/process.c:158) [ 594.069375][ T2009] ret_from_fork_asm (arch/x86/entry/entry_64.S:245) [ 594.069383][ T2009] </TASK> [ 594.069385][ T2009] [ 594.087179][ T2009] Freed by task 2009 on cpu 1 at 594.064509s: [ 594.087705][ T2009] kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78) [ 594.088130][ T2009] kasan_save_free_info (mm/kasan/generic.c:584) [ 594.088566][ T2009] __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285) [ 594.088980][ T2009] kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6566) [ 594.089324][ T2009] v4l2_device_release (drivers/media/v4l2-core/v4l2-dev.c:225) [ 594.089762][ T2009] device_release (drivers/gpu/drm/vkms/vkms_configfs.c:690) [ 594.090164][ T2009] kobject_put (lib/kobject.c:689 lib/kobject.c:720 ./include/linux/kref.h:65 lib/kobject.c:737) [ 594.090544][ T2009] __video_register_device (drivers/media/v4l2-core/v4l2-dev.c:1080) [ 594.091031][ T2009] pvr2_v4l2_dev_init (./include/media/v4l2-dev.h:390 drivers/media/usb/pvrusb2/pvrusb2-v4l2.c:1218) [ 594.091460][ T2009] pvr2_v4l2_create (drivers/media/usb/pvrusb2/pvrusb2-v4l2.c:1249) [ 594.091943][ T2009] pvr_setup_attach (drivers/media/usb/pvrusb2/pvrusb2-main.c:40) [ 594.092348][ T2009] pvr2_context_thread_func (drivers/media/usb/pvrusb2/pvrusb2-context.c:117 drivers/media/usb/pvrusb2/pvrusb2-context.c:158) [ 594.092825][ T2009] kthread (kernel/kthread.c:436) [ 594.093188][ T2009] ret_from_fork (arch/x86/kernel/process.c:158) [ 594.093587][ T2009] ret_from_fork_asm (arch/x86/entry/entry_64.S:245) [ 594.094004][ T2009] [ 594.094213][ T2009] The buggy address belongs to the object at ffff88810a2aa000 [ 594.094213][ T2009] which belongs to the cache kmalloc-2k of size 2048 [ 594.095415][ T2009] The buggy address is located 1204 bytes inside of [ 594.095415][ T2009] freed 2048-byte region [ffff88810a2aa000, ffff88810a2aa800) Best, Shuangpeng ^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH] media: usb: pvrusb2: fix slab-use-after-free in pvr2_v4l2_dev_init 2026-06-03 3:15 [BUG] KASAN: slab-use-after-free in pvr2_v4l2_dev_init Shuangpeng @ 2026-06-04 1:47 ` xiaopeitux 2026-06-04 3:20 ` Mike Isely 2026-09-08 12:13 ` hverkuil+cisco 0 siblings, 2 replies; 4+ messages in thread From: xiaopeitux @ 2026-06-04 1:47 UTC (permalink / raw) To: shuangpeng.kernel, mchehab+huawei, hverkuil+cisco Cc: isely, linux-kernel, linux-media, mchehab, Pei Xiao From: Pei Xiao <xiaopei01@kylinos.cn> The driver attempts to register the same video_device twice if the first registration with a specific minor number fails. However, when the first video_register_device() call fails, the underlying device structure is released via put_device(), which frees the video_device object. The second call then uses the already freed pointer, causing a KASAN slab-use-after-free error. Moreover, the second call always uses -1 (automatic minor allocation), which is redundant because mindevnum already can be -1 when no fixed minor is requested. Keeping both calls does not provide any benefit but introduces a use-after-free vulnerability. Fix this by removing the second registration attempt and using only the first call with mindevnum. This preserves the ability to request a specific minor number (when mindevnum >= 0) while falling back to automatic allocation (when mindevnum == -1) without double-registering the same device. Logs: BUG: KASAN: slab-use-after-free in pvr2_v4l2_dev_init (drivers/media/usb/pvrusb2/pvrusb2-v4l2.c:1221) Read of size 4 at addr ffff88810a2aa4b4 by task pvrusb2-context/2009 Call Trace: dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) print_report (mm/kasan/report.c:378 mm/kasan/report.c:482) kasan_report (mm/kasan/report.c:595) pvr2_v4l2_dev_init (drivers/media/usb/pvrusb2/pvrusb2-v4l2.c:1221) pvr2_v4l2_create (drivers/media/usb/pvrusb2/pvrusb2-v4l2.c:1249) pvr_setup_attach (drivers/media/usb/pvrusb2/pvrusb2-main.c:40) ... Freed by task 2009 on cpu 1 at 594.064509s: kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78) kasan_save_free_info (mm/kasan/generic.c:584) __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285) kfree v4l2_device_release (drivers/media/v4l2-core/v4l2-dev.c:225) device_release (drivers/gpu/drm/vkms/vkms_configfs.c:690) kobject_put __video_register_device (drivers/media/v4l2-core/v4l2-dev.c:1080) pvr2_v4l2_dev_init (drivers/media/usb/pvrusb2/pvrusb2-v4l2.c:1218) pvr2_v4l2_create (drivers/media/usb/pvrusb2/pvrusb2-v4l2.c:1249) pvr_setup_attach (drivers/media/usb/pvrusb2/pvrusb2-main.c:40) ... Fixes: 0c0d06cac63e ("[media] rename most media/video usb drivers to media/usb") Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com> Closes: https://lore.kernel.org/lkml/6C2D160B-37DD-40F0-B8A2-089B8CAACB58@gmail.com/ stable@vger.kernel.org Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn> --- drivers/media/usb/pvrusb2/pvrusb2-v4l2.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c b/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c index 101b2e9fbaab..f9df813ca09b 100644 --- a/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c +++ b/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c @@ -1215,13 +1215,10 @@ static void pvr2_v4l2_dev_init(struct pvr2_v4l2_dev *dip, mindevnum = nr_ptr[unit_number]; } pvr2_hdw_set_v4l2_dev(hdw, &dip->devbase); - if ((video_register_device(&dip->devbase, - dip->v4l_type, mindevnum) < 0) && - (video_register_device(&dip->devbase, - dip->v4l_type, -1) < 0)) { + if (video_register_device(&dip->devbase, + dip->v4l_type, mindevnum) < 0) pr_err(KBUILD_MODNAME ": Failed to register pvrusb2 v4l device\n"); - } pr_info("pvrusb2: registered device %s [%s]\n", video_device_node_name(&dip->devbase), -- 2.25.1 ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] media: usb: pvrusb2: fix slab-use-after-free in pvr2_v4l2_dev_init 2026-06-04 1:47 ` [PATCH] media: usb: pvrusb2: fix " xiaopeitux @ 2026-06-04 3:20 ` Mike Isely 2026-09-08 12:13 ` hverkuil+cisco 1 sibling, 0 replies; 4+ messages in thread From: Mike Isely @ 2026-06-04 3:20 UTC (permalink / raw) To: xiaopeitux Cc: shuangpeng.kernel, mchehab+huawei, hverkuil+cisco, Linux Kernel Mailing List, linux-media, mchehab, Pei Xiao, Mike Isely at pobox Acked-By: Mike Isely <isely@pobox.com> On Thu, 4 Jun 2026, xiaopeitux@foxmail.com wrote: > From: Pei Xiao <xiaopei01@kylinos.cn> > > The driver attempts to register the same video_device twice if the first > registration with a specific minor number fails. However, when the first > video_register_device() call fails, the underlying device structure is > released via put_device(), which frees the video_device object. The second > call then uses the already freed pointer, causing a KASAN > slab-use-after-free error. > > Moreover, the second call always uses -1 (automatic minor allocation), > which is redundant because mindevnum already can be -1 when no fixed > minor is requested. Keeping both calls does not provide any benefit but > introduces a use-after-free vulnerability. > > Fix this by removing the second registration attempt and using only > the first call with mindevnum. This preserves the ability to request > a specific minor number (when mindevnum >= 0) while falling back to > automatic allocation (when mindevnum == -1) without double-registering > the same device. > > Logs: > BUG: KASAN: slab-use-after-free in pvr2_v4l2_dev_init > (drivers/media/usb/pvrusb2/pvrusb2-v4l2.c:1221) > Read of size 4 at addr ffff88810a2aa4b4 by task pvrusb2-context/2009 > > Call Trace: > dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) > print_report (mm/kasan/report.c:378 mm/kasan/report.c:482) > kasan_report (mm/kasan/report.c:595) > pvr2_v4l2_dev_init (drivers/media/usb/pvrusb2/pvrusb2-v4l2.c:1221) > pvr2_v4l2_create (drivers/media/usb/pvrusb2/pvrusb2-v4l2.c:1249) > pvr_setup_attach (drivers/media/usb/pvrusb2/pvrusb2-main.c:40) > ... > > Freed by task 2009 on cpu 1 at 594.064509s: > kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78) > kasan_save_free_info (mm/kasan/generic.c:584) > __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285) > kfree > v4l2_device_release (drivers/media/v4l2-core/v4l2-dev.c:225) > device_release (drivers/gpu/drm/vkms/vkms_configfs.c:690) > kobject_put > __video_register_device (drivers/media/v4l2-core/v4l2-dev.c:1080) > pvr2_v4l2_dev_init (drivers/media/usb/pvrusb2/pvrusb2-v4l2.c:1218) > pvr2_v4l2_create (drivers/media/usb/pvrusb2/pvrusb2-v4l2.c:1249) > pvr_setup_attach (drivers/media/usb/pvrusb2/pvrusb2-main.c:40) > ... > > Fixes: 0c0d06cac63e ("[media] rename most media/video usb drivers to media/usb") > Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com> > Closes: https://lore.kernel.org/lkml/6C2D160B-37DD-40F0-B8A2-089B8CAACB58@gmail.com/ > stable@vger.kernel.org > Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn> > --- > drivers/media/usb/pvrusb2/pvrusb2-v4l2.c | 7 ++----- > 1 file changed, 2 insertions(+), 5 deletions(-) > > diff --git a/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c b/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c > index 101b2e9fbaab..f9df813ca09b 100644 > --- a/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c > +++ b/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c > @@ -1215,13 +1215,10 @@ static void pvr2_v4l2_dev_init(struct pvr2_v4l2_dev *dip, > mindevnum = nr_ptr[unit_number]; > } > pvr2_hdw_set_v4l2_dev(hdw, &dip->devbase); > - if ((video_register_device(&dip->devbase, > - dip->v4l_type, mindevnum) < 0) && > - (video_register_device(&dip->devbase, > - dip->v4l_type, -1) < 0)) { > + if (video_register_device(&dip->devbase, > + dip->v4l_type, mindevnum) < 0) > pr_err(KBUILD_MODNAME > ": Failed to register pvrusb2 v4l device\n"); > - } > > pr_info("pvrusb2: registered device %s [%s]\n", > video_device_node_name(&dip->devbase), > ^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] media: usb: pvrusb2: fix slab-use-after-free in pvr2_v4l2_dev_init 2026-06-04 1:47 ` [PATCH] media: usb: pvrusb2: fix " xiaopeitux 2026-06-04 3:20 ` Mike Isely @ 2026-09-08 12:13 ` hverkuil+cisco 1 sibling, 0 replies; 4+ messages in thread From: hverkuil+cisco @ 2026-09-08 12:13 UTC (permalink / raw) To: xiaopeitux, shuangpeng.kernel, mchehab+huawei Cc: isely, linux-kernel, linux-media, mchehab, Pei Xiao On 04/06/2026 03:47, xiaopeitux@foxmail.com wrote: > From: Pei Xiao <xiaopei01@kylinos.cn> > > The driver attempts to register the same video_device twice if the first > registration with a specific minor number fails. However, when the first > video_register_device() call fails, the underlying device structure is > released via put_device(), which frees the video_device object. The second > call then uses the already freed pointer, causing a KASAN > slab-use-after-free error. > > Moreover, the second call always uses -1 (automatic minor allocation), > which is redundant because mindevnum already can be -1 when no fixed > minor is requested. Keeping both calls does not provide any benefit but > introduces a use-after-free vulnerability. > > Fix this by removing the second registration attempt and using only > the first call with mindevnum. This preserves the ability to request > a specific minor number (when mindevnum >= 0) while falling back to > automatic allocation (when mindevnum == -1) without double-registering > the same device. The video_register_device change that called put_device was reverted (it was a bad idea), so this patch is no longer needed. Regards, Hans > > Logs: > BUG: KASAN: slab-use-after-free in pvr2_v4l2_dev_init > (drivers/media/usb/pvrusb2/pvrusb2-v4l2.c:1221) > Read of size 4 at addr ffff88810a2aa4b4 by task pvrusb2-context/2009 > > Call Trace: > dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120) > print_report (mm/kasan/report.c:378 mm/kasan/report.c:482) > kasan_report (mm/kasan/report.c:595) > pvr2_v4l2_dev_init (drivers/media/usb/pvrusb2/pvrusb2-v4l2.c:1221) > pvr2_v4l2_create (drivers/media/usb/pvrusb2/pvrusb2-v4l2.c:1249) > pvr_setup_attach (drivers/media/usb/pvrusb2/pvrusb2-main.c:40) > ... > > Freed by task 2009 on cpu 1 at 594.064509s: > kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78) > kasan_save_free_info (mm/kasan/generic.c:584) > __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285) > kfree > v4l2_device_release (drivers/media/v4l2-core/v4l2-dev.c:225) > device_release (drivers/gpu/drm/vkms/vkms_configfs.c:690) > kobject_put > __video_register_device (drivers/media/v4l2-core/v4l2-dev.c:1080) > pvr2_v4l2_dev_init (drivers/media/usb/pvrusb2/pvrusb2-v4l2.c:1218) > pvr2_v4l2_create (drivers/media/usb/pvrusb2/pvrusb2-v4l2.c:1249) > pvr_setup_attach (drivers/media/usb/pvrusb2/pvrusb2-main.c:40) > ... > > Fixes: 0c0d06cac63e ("[media] rename most media/video usb drivers to media/usb") > Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com> > Closes: https://lore.kernel.org/lkml/6C2D160B-37DD-40F0-B8A2-089B8CAACB58@gmail.com/ > stable@vger.kernel.org > Signed-off-by: Pei Xiao <xiaopei01@kylinos.cn> > --- > drivers/media/usb/pvrusb2/pvrusb2-v4l2.c | 7 ++----- > 1 file changed, 2 insertions(+), 5 deletions(-) > > diff --git a/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c b/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c > index 101b2e9fbaab..f9df813ca09b 100644 > --- a/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c > +++ b/drivers/media/usb/pvrusb2/pvrusb2-v4l2.c > @@ -1215,13 +1215,10 @@ static void pvr2_v4l2_dev_init(struct pvr2_v4l2_dev *dip, > mindevnum = nr_ptr[unit_number]; > } > pvr2_hdw_set_v4l2_dev(hdw, &dip->devbase); > - if ((video_register_device(&dip->devbase, > - dip->v4l_type, mindevnum) < 0) && > - (video_register_device(&dip->devbase, > - dip->v4l_type, -1) < 0)) { > + if (video_register_device(&dip->devbase, > + dip->v4l_type, mindevnum) < 0) > pr_err(KBUILD_MODNAME > ": Failed to register pvrusb2 v4l device\n"); > - } > > pr_info("pvrusb2: registered device %s [%s]\n", > video_device_node_name(&dip->devbase), ^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-09-08 12:13 UTC | newest] Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2026-06-03 3:15 [BUG] KASAN: slab-use-after-free in pvr2_v4l2_dev_init Shuangpeng 2026-06-04 1:47 ` [PATCH] media: usb: pvrusb2: fix " xiaopeitux 2026-06-04 3:20 ` Mike Isely 2026-09-08 12:13 ` hverkuil+cisco
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®