From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv1-f42.google.com (mail-qv1-f42.google.com [209.85.219.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0521A425CEE for ; Tue, 16 Jun 2026 16:27:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.42 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781627233; cv=none; b=pHjlu5LtMn45tK2J5C4EFYeHLrZcFgriDfNgRvKebJgcU1cwikcNrHn9C97sAeQK4OtaXIz4H9ofNipmia7RlSrCCfeJqEiaYhzaOdtymQcDd9XTenHvUtC/aYGpIcbux80xsFlqQrAP6tm78iOUZwCkotivjG+HIR31L4X18v4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781627233; c=relaxed/simple; bh=Djbsrl9SayM3lLR0BU5eR3F+vTzESp6dmkTdtGp4PAg=; h=Content-Type:Mime-Version:Subject:From:In-Reply-To:Date:Cc: Message-Id:References:To; b=QO3m+3o50VS+o3L2ydCnIpzc+SsphxIeznjMq4hGqxIyeI2LmTbXSgb8zS7mKvhAlA1TBTHYXbXq1595tUE814Q+GQ+92ALLTd1pnNpuNKzSAPm9vH320hPY1dsY7IWKGMrlxZz6EBkf6RkQ9aDwUW6pYntm1Q/zU66+bwNpU1I= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=OqmDq8G6; arc=none smtp.client-ip=209.85.219.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="OqmDq8G6" Received: by mail-qv1-f42.google.com with SMTP id 6a1803df08f44-8ccef25789fso36426486d6.3 for ; Tue, 16 Jun 2026 09:27:11 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781627231; x=1782232031; darn=vger.kernel.org; h=to:references:message-id:content-transfer-encoding:cc:date :in-reply-to:from:subject:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=vGPlVjxBcU57kDDMGhZS1uavav3fsCxcZWyfJXhxreo=; b=OqmDq8G6LgLFuCFkPNp+0jVRGUy0GSEwgo7CJPaX25uMrr88rDbUkOGbQ71hXRi84r MjiCfl5zBhDf9I21A+SHrLRsv/9AQjovKLMshJGzPDDa9TtbT8jwlo7CrhJP0osIzG+F tdV0vebv+BcKxBr7bnn1DPNxhZtCXBf8s2HwLSsmep9a0rW9dKrWhLk4c+nwov/7duSl fyyHaywq5nL+kjaW40Bgp0pIIHBXanZarMBUBZJ+9cmWAs+g/2KLF4bpfAc7tTmR7wZ5 Zhxp4l6Vn+ylZn8d7x1+g12kP2JmIX7tnb0lWh8pjvhA8v9D146PZUTqda0GK5pTEFUq gKOA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781627231; x=1782232031; h=to:references:message-id:content-transfer-encoding:cc:date :in-reply-to:from:subject:mime-version:x-gm-gg:x-gm-message-state :from:to:cc:subject:date:message-id:reply-to; bh=vGPlVjxBcU57kDDMGhZS1uavav3fsCxcZWyfJXhxreo=; b=gsfD7uR+DzR1jO49r2HMimAfc9bzwCvoV/DCq/OPQiea3UW/rRdnf+0bjvDQ50+hP4 fkUQSVRcnrSO2msHOOrWBi+9BYu5B4MrBCX0ACPZXmsx+IR9dGsJ54TTvkS9RPQ6KJ0g WyqfiE5pcXPhrgK+mlO9xvSQ0TOIB0E6fFB3hI6ofA7sKiHU8fZeguTaQhNH8e22LI60 8xSLd1SOGSBu9Kikt6ZxlCDYmxNoboVTtVRJjByLoNGZjlvE0MapjzJuvcyBe6HF2EcP XrDkA4LsvEjCLocbk1mrevZiRTSE6rRg90C1eJo+JWkLa3qTq0SgcfelSQV56FcIYg2k zgqA== X-Forwarded-Encrypted: i=1; AFNElJ87GJdUgQiWj8M3F4Q0RB6Pk8iZI2BV2EvQQL2x4hD3PUxAK/a0v3UwfJI77Vnyno80QpDuKjPYxPpbOXs=@vger.kernel.org X-Gm-Message-State: AOJu0Yz26Q6Bw6sbQkKb6Wr3PpAUZFJH7bjiqUch7KjzvAO5eD8Vh601 lPBkDAUaGDDZAGiXsWZRhc4ARxssIZctB6GbCVPVHMVcG47QhGGmbgPf X-Gm-Gg: Acq92OH92e9r/2j/zjzeHaejevkFAUvcq3+Xk7ZgQfstcQ8Y40o24KNSjGbvPJSzISY /5MbrB5slPUJPqM3lIcyv/90Rfo24KHrmV99ekXbvJrhJ4g2LOWnzKvOAsDViOCyqyy/GFHc0Lo k9CL7NE4vbVeCQLXynJb0C4dVhYy2dm3h9DhSchIKJbtdyAe/Z2nfLnF/l27CzDtTQDlIwbwOEB I+Bt/QcZlb/CmskHtjEMpJlKZM1YQVoXzdGf/49iTh0NcFO9qZZFdnuf5gtUi4oRB/kIamlWD47 GxyRh+khuWbe6hj/fGanxMGgj81+OUXZBCAlWxTan5RmTdx7dsMOqdVW19uwnSlaOxxGc0hSLI0 7Q9FA7GQbVxnSKlz4ilMgKaz/WoExke5CvmfbG0gTrUB3/5okkxa8u5YeHjj4RkoNTyaFmAziOj lFUX4aC7I+jHvMG8ht3QMbPvTQV2fZmLWe1JtIevaKW5AyzWMQ9+a5kw== X-Received: by 2002:a05:6214:5190:b0:8ce:d557:74df with SMTP id 6a1803df08f44-8db5ca18d46mr6311356d6.22.1781627230713; Tue, 16 Jun 2026 09:27:10 -0700 (PDT) Received: from smtpclient.apple ([104.39.165.68]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-8d9f50eb32fsm37655106d6.38.2026.06.16.09.27.09 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 16 Jun 2026 09:27:10 -0700 (PDT) Content-Type: text/plain; charset=us-ascii Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3864.600.51.1.1\)) Subject: Re: [BUG] KASAN: slab-use-after-free in ipoctal_write_tty From: Shuangpeng In-Reply-To: <2026061658-expert-chimp-f49c@gregkh> Date: Tue, 16 Jun 2026 12:26:39 -0400 Cc: vaibhavgupta40@gmail.com, jens.taprogge@taprogge.org, kees@kernel.org, industrypack-devel@lists.sourceforge.net, linux-kernel@vger.kernel.org Content-Transfer-Encoding: 7bit Message-Id: References: <178144969601.60470.1257088106279546587@gmail.com> <2026061553-childcare-rush-8f26@gregkh> <53780D3D-9EE8-4032-BC37-F17694C4D685@gmail.com> <2026061543-require-phrasing-e2c2@gregkh> <2026061658-expert-chimp-f49c@gregkh> To: Greg KH X-Mailer: Apple Mail (2.3864.600.51.1.1) > On Jun 15, 2026, at 22:46, Greg KH wrote: > > On Mon, Jun 15, 2026 at 08:11:49PM -0400, Shuangpeng wrote: >> >> >>> On Jun 15, 2026, at 16:49, Greg KH wrote: >>> >>> On Mon, Jun 15, 2026 at 04:33:09PM -0400, Shuangpeng wrote: >>>> >>>> >>>>> On Jun 15, 2026, at 00:03, Greg KH wrote: >>>>> >>>>> On Sun, Jun 14, 2026 at 03:48:50PM -0400, Shuangpeng Bai wrote: >>>>>> Hi Kernel Maintainers, >>>>>> >>>>>> I hit the following report while testing current upstream kernel: >>>>>> >>>>>> KASAN: slab-use-after-free in ipoctal_write_tty >>>>> >>>>> Cool, do you have this hardware, or is this only virtual testing? >>>> >>>> No, I do not have the physical hardware. This was reproduced with >>>> unmodified QEMU using its existing TPCI200/IP-Octal emulation. >>>> >>>>> >>>>> If virtual, are you sure that the hardware is being emulated properly? >>>> >>>> >>>> I understand this is not the same as testing on real hardware. However, >>>> my current understanding is that the crash is triggered after a >>>> successful probe through the normal sysfs unbind/remove path while the >>>> ipoctal tty fd is still open. The failing path does not seem to rely on >>>> device-specific emulation details after probe, but rather on the >>>> lifetime of the tty/device state during removal. >>> >>> What specific sysfs unbind path? That's only for root and for testing >>> kernel development, it's not a normal thing that a user does at all, >>> right? >>> >> >> The sysfs path used by the reproducer is: >> >> /sys/bus/pci/drivers/tpci200/unbind >> >> So yes, this is a root-only kernel testing/development path, not a >> normal unprivileged user path. >> >>>> Please let me know if I am missing anything here. I would also >>>> appreciate any suggestions on what I could check to better evaluate >>>> whether the emulation is appropriate for this report. >>> >>> What exactly are you trying to test? >> >> I was trying to test whether the driver handles open ipoctal tty file >> descriptors safely when the backing TPCI200/IPack device is removed. > > As you found, it doesn't :) > > See the discussions about device unbind and misc/char device nodes on > the mailing lists for many messages about this and potential ways to > resolve it. As it's not a real issue for drivers like this, it's a very > low priority for other people to resolve, but we will always gladly > review patches from others. > Thanks for the explanation and the pointers. I will read through the related discussions to better understand how opened file descriptors are expected to be handled when the underlying device or driver is removed. This is very helpful. Thanks, Shuangpeng > thanks, > > greg k-h