From: Shuangpeng Bai <shuangpengbai@gmail.com>
To: viro@zeniv.linux.org.uk, brauner@kernel.org, jack@suse.cz
Cc: linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [BUG] KASAN: slab-use-after-free in cdev_put
Date: Fri, 29 May 2026 16:15:12 -0400 [thread overview]
Message-ID: <EDF77EB4-909B-44F6-BEA3-0D111F76A5CD@gmail.com> (raw)
[-- Attachment #1: Type: text/plain, Size: 4119 bytes --]
Hi Kernel Maintainers,
I hit the following KASAN report while testing current upstream kernel:
KASAN: slab-use-after-free in cdev_put
on commit: e8c2f9fdadee7cbc75134dc463c1e0d856d6e5c7 (May 25 2026)
The reproducer and .config files are here.
https://gist.github.com/shuangpengbai/8f7dd0c0b1c638482b0e4cc62c554121
I’m happy to test debug patches or provide additional information.
Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
[ 133.746964][ T8494] ==================================================================
[ 133.747541][ T8494] BUG: KASAN: slab-use-after-free in cdev_put (fs/char_dev.c:361)
[ 133.748018][ T8494] Read of size 8 at addr ffff8881066d7108 by task bad_nvme_io/8494
[ 133.748544][ T8494]
[ 133.748716][ T8494] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.34
[ 133.748718][ T8494] Call Trace:
[ 133.748720][ T8494] <TASK>
[ 133.748721][ T8494] dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
[ 133.748725][ T8494] print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
[ 133.748734][ T8494] kasan_report (mm/kasan/report.c:595)
[ 133.748738][ T8494] cdev_put (fs/char_dev.c:361)
[ 133.748740][ T8494] __fput (fs/file_table.c:513)
[ 133.748743][ T8494] fput_close_sync (fs/file_table.c:615)
[ 133.748756][ T8494] __x64_sys_close (fs/open.c:1507 fs/open.c:1492 fs/open.c:1492)
[ 133.748759][ T8494] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
[ 133.748761][ T8494] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
[ 133.748764][ T8494] RIP: 0033:0x7fd3713a311b
[ 133.748767][ T8494] Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 f3 fb ff f4
Code starting with the faulting instruction
===========================================
0: 0f 05 syscall
2: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax
8: 77 45 ja 0x4f
a: c3 ret
b: 0f 1f 40 00 nopl 0x0(%rax)
f: 48 83 ec 18 sub $0x18,%rsp
13: 89 7c 24 0c mov %edi,0xc(%rsp)
17: e8 f3 fb ff f4 call 0xfffffffff4fffc0f
[ 133.748769][ T8494] RSP: 002b:00007fd3709b7e60 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
[ 133.748773][ T8494] RAX: ffffffffffffffda RBX: 0000557a0cdd5390 RCX: 00007fd3713a311b
[ 133.748775][ T8494] RDX: 00007fd3709b7e80 RSI: 00000000c0484e43 RDI: 0000000000000010
[ 133.748776][ T8494] RBP: 0000000000000010 R08: 0000000000000000 R09: 00007fd3709b8700
[ 133.748778][ T8494] R10: 0000000000000000 R11: 0000000000000293 R12: 00007fd3709b7e80
[ 133.748779][ T8494] R13: 000000000000010b R14: 00007fd3709b7fc0 R15: 0000000000802000
[ 133.748782][ T8494] </TASK>
[ 133.748783][ T8494]
[ 133.760567][ T8494] Freed by task 8494 on cpu 1 at 133.746963s:
[ 133.760976][ T8494] kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78)
[ 133.761296][ T8494] kasan_save_free_info (mm/kasan/generic.c:584)
[ 133.761651][ T8494] __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)
[ 133.761976][ T8494] kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6566)
[ 133.762243][ T8494] nvme_ns_head_chr_release (drivers/nvme/host/multipath.c:606)
[ 133.762617][ T8494] __fput (fs/file_table.c:510)
[ 133.762889][ T8494] fput_close_sync (fs/file_table.c:615)
[ 133.763213][ T8494] __x64_sys_close (fs/open.c:1507 fs/open.c:1492 fs/open.c:1492)
[ 133.763526][ T8494] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
[ 133.763838][ T8494] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
[ 133.764235][ T8494]
[ 133.764398][ T8494] The buggy address belongs to the object at ffff8881066d7000
[ 133.764398][ T8494] which belongs to the cache kmalloc-2k of size 2048
[ 133.765325][ T8494] The buggy address is located 264 bytes inside of
[ 133.765325][ T8494] freed 2048-byte region [ffff8881066d7000, ffff8881066d7800)
Best,
Shuangpeng
[-- Attachment #2: smime.p7s --]
[-- Type: application/pkcs7-signature, Size: 1400 bytes --]
reply other threads:[~2026-05-29 20:15 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=EDF77EB4-909B-44F6-BEA3-0D111F76A5CD@gmail.com \
--to=shuangpengbai@gmail.com \
--cc=brauner@kernel.org \
--cc=jack@suse.cz \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®