From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv1-f44.google.com (mail-qv1-f44.google.com [209.85.219.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BB22D27707 for ; Tue, 16 Jun 2026 00:12:21 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.44 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781568743; cv=none; b=KqWLyUVRjcJDG1KhNZtPg0QqPNgyQUvtE3CLDFehTHgH6g5kywI8paclHGgfqgP18zmzyp5eGBa0Fnsz5xjvhCsPNFhQ5EZRfwd5a+2wZThs6EudSIRCAv/0KJIvbz4Po34R2AszV8Nn5pbHKsScosMJEup1Fs2LjZ0B9+iPXCI= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781568743; c=relaxed/simple; bh=Gd8cPpV3tdJcGQHakceJhAkuOZmyTvylhwgQZlsax1E=; h=Content-Type:Mime-Version:Subject:From:In-Reply-To:Date:Cc: Message-Id:References:To; b=X3mR9Uxr4rHX+IFQqBwVxEGuV8YGcLDenfsoQJ0669AfARq0Yoba7ve9HnZe8CCVKa05OCj9mguesEFl+UGjvxFIsJb+ZLpQ3HtGioq8+0+ooTfpuC5fHyLkfR5JrOGpb9k+7F4rLhsf4o6iS8M060Q5CqS6RW68ZgBXed8apFI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=KaBo/DpU; arc=none smtp.client-ip=209.85.219.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="KaBo/DpU" Received: by mail-qv1-f44.google.com with SMTP id 6a1803df08f44-8ccf7b7d188so47325446d6.1 for ; Mon, 15 Jun 2026 17:12:21 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781568741; x=1782173541; darn=vger.kernel.org; h=to:references:message-id:content-transfer-encoding:cc:date :in-reply-to:from:subject:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=6fSsnD5h3gToOD/j0kGhoXy6AsZ91kE0sf4kwNhvme8=; b=KaBo/DpU0nrnNDqn3ck58hr1lIcVdW1XGOoEyOr9MJ9eUt8piI9BL+raZT8xkDM4Ul oDeEMZ+JI6JOJwOCJtlad32uuZulRCGkUYhMVot7e1Pw8UuJu8qz8XsigDUmBy1g+WIG KS6yq93ZBc1tNliWAOOSh+B0UABRrgbfhEXgFhUoDMvb+Lz0nrHex+1JzjvZptZdZnyg NfRBkVoriluQev6HTz6QpbY2DBXsC+U6Z17fv/49GMyHW7MDb2PkLT0viIzOVIdYVjc3 IsHgvZK7tEjugdf+9fQeqhKPPuscHKz5hoQQA4wIm++knQ+4DHGJeD1xVLIsQwzCoxbO HDvg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781568741; x=1782173541; h=to:references:message-id:content-transfer-encoding:cc:date :in-reply-to:from:subject:mime-version:x-gm-gg:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=6fSsnD5h3gToOD/j0kGhoXy6AsZ91kE0sf4kwNhvme8=; b=ARBVECMBFLJTZ0HgsQb3rfgr5FmNCyQ3DnyWY+79jkK+Pe0hu8liLJaj23i20J3TqK dxzXp6ba1WVKWsR+Jzjl2z49Htc0sa9YWLzmSirV6vKyXEvgJecmeMFykIrpLQpR7qha 2L8caf/w9QIAIQimn7dKdso8MbXCuqWbMcTBPq1aoUEpdyBNK4/uRnD++FHz45m3cSEr vrIaBUjexgezJPtgF8D5tnr99ey0NRcL3+m2YQtFuf/JM7AWAFGb4+9onJhhIF/oGJzA i8hmgRguCIoBcPQzqj2FYbX5BeAZS7CqlwDs6IybXLpGWe84u3AFiObG4BlB5JRYeJ0j le9g== X-Forwarded-Encrypted: i=1; AFNElJ/Yt0pCkjbYPHIijaZqK5iCufGFS4hqwK3somtZ42SE+QA9cTEsWnpM4nzdb2+EJUwSOC5DqlxqthAGiBs=@vger.kernel.org X-Gm-Message-State: AOJu0YztZI3fHtIUfp4E5XPSitkr80nW2IlC4NzR9LtXuZBz8RZDbBAM 2a9Rovijm1P8ktUO19ybouocPdmDKQyAext7ZlXrMdbPD4r7ibH+HhTL X-Gm-Gg: Acq92OEqGx91kDwZ7QX2KBR4oIRNZDKjdG4kkOmakRq3NCENTCLvoepYNms+udNPcBe NBTY6cfX8+bOJUSt9rIjBCygnRs0QdSXRwmdeDF0gvN67PXITjIh87iAxmO2cYCdpEYcK95ebDy g4ikI0nBdBDVcI1J/vyp/K1Y/LMFlrxo+S+zPna8uoZ81swZ6btjK8cp5o5dVixFiHgt79WxZXL jbuchHVi5HCmLQjOuVAVKNGPceXbcrYXVUX9fDXMBJUBemhI6CO6sT879pqy8TnktFyhVf+J75P HzERXGuGD8tOIrGNV9wVCHyi4AK01Znw1yKZ6Ax6eTO8N+uIVpFFsrdN+NC8/Tq+4jDe+JSvgD/ mSm8R/LzqAD+U3LpIJoGFwDqVZ3zauWYEsUtdEgJ+M++KS7k5xXjQ9m7K63gquYsoOSkQN6bQre U5vehxRhmgX1NRSZAkFmCIGbOK+lFCmvdYqkYTH2iYWK19Icpy7EJvS9WrRaLokXo2 X-Received: by 2002:ad4:5ae4:0:b0:8cc:de2:3b5d with SMTP id 6a1803df08f44-8d9fc4056famr31204686d6.16.1781568740704; Mon, 15 Jun 2026 17:12:20 -0700 (PDT) Received: from smtpclient.apple ([2601:985:4601:5df0:30f9:434b:1776:1583]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-8d9f1ccd9f3sm14893656d6.16.2026.06.15.17.12.19 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Mon, 15 Jun 2026 17:12:20 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3864.600.51.1.1\)) Subject: Re: [BUG] KASAN: slab-use-after-free in ipoctal_write_tty From: Shuangpeng In-Reply-To: <2026061543-require-phrasing-e2c2@gregkh> Date: Mon, 15 Jun 2026 20:11:49 -0400 Cc: vaibhavgupta40@gmail.com, jens.taprogge@taprogge.org, kees@kernel.org, industrypack-devel@lists.sourceforge.net, linux-kernel@vger.kernel.org Content-Transfer-Encoding: 7bit Message-Id: References: <178144969601.60470.1257088106279546587@gmail.com> <2026061553-childcare-rush-8f26@gregkh> <53780D3D-9EE8-4032-BC37-F17694C4D685@gmail.com> <2026061543-require-phrasing-e2c2@gregkh> To: Greg KH X-Mailer: Apple Mail (2.3864.600.51.1.1) > On Jun 15, 2026, at 16:49, Greg KH wrote: > > On Mon, Jun 15, 2026 at 04:33:09PM -0400, Shuangpeng wrote: >> >> >>> On Jun 15, 2026, at 00:03, Greg KH wrote: >>> >>> On Sun, Jun 14, 2026 at 03:48:50PM -0400, Shuangpeng Bai wrote: >>>> Hi Kernel Maintainers, >>>> >>>> I hit the following report while testing current upstream kernel: >>>> >>>> KASAN: slab-use-after-free in ipoctal_write_tty >>> >>> Cool, do you have this hardware, or is this only virtual testing? >> >> No, I do not have the physical hardware. This was reproduced with >> unmodified QEMU using its existing TPCI200/IP-Octal emulation. >> >>> >>> If virtual, are you sure that the hardware is being emulated properly? >> >> >> I understand this is not the same as testing on real hardware. However, >> my current understanding is that the crash is triggered after a >> successful probe through the normal sysfs unbind/remove path while the >> ipoctal tty fd is still open. The failing path does not seem to rely on >> device-specific emulation details after probe, but rather on the >> lifetime of the tty/device state during removal. > > What specific sysfs unbind path? That's only for root and for testing > kernel development, it's not a normal thing that a user does at all, > right? > The sysfs path used by the reproducer is: /sys/bus/pci/drivers/tpci200/unbind So yes, this is a root-only kernel testing/development path, not a normal unprivileged user path. >> Please let me know if I am missing anything here. I would also >> appreciate any suggestions on what I could check to better evaluate >> whether the emulation is appropriate for this report. > > What exactly are you trying to test? I was trying to test whether the driver handles open ipoctal tty file descriptors safely when the backing TPCI200/IPack device is removed. Thanks, Shuangpeng > > thanks, > > greg k-h