From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qt1-f169.google.com (mail-qt1-f169.google.com [209.85.160.169]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2C36C3F0762 for ; Wed, 3 Jun 2026 03:23:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.160.169 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780457007; cv=none; b=rqXKXpAf8UvePZCenWtcJHSUEfVJl+frCSKf9lshS3UOfincLnOpsa76V/ihVB6Ia3Y3Y8UYgsIC1Y6nJ1pC7rnb+J7VgWWDVRXtYcmF1FAhxx8vjvo92sHlsP7Unyxps2xrL0eAu4XeXlGpDlT0W3/oZrz97pmIIJkb0XevpxA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780457007; c=relaxed/simple; bh=q/9QSmlwvyQ7YX+ip3mA2ABV0en3bHcR7/Ftk9aBTEI=; h=From:Content-Type:Mime-Version:Subject:Message-Id:Date:Cc:To; b=Bp1LBYzng7wTZE9WUDfM1LkqxmYRAUft4FlrUV1H7V2LOgeAsWJmNmM6jPWPLORtk+sM/ID4PoaL+FKC8Crj7Jn3Htp1JnqXcs7k2DjeoZqdrrwxF0lMsuif2F0Rr6EvV3Bcs9SEHS8sbc+WBlGaFIkV4W73Phvm9uc+XAIvpKE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=cfgk5Ycf; arc=none smtp.client-ip=209.85.160.169 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="cfgk5Ycf" Received: by mail-qt1-f169.google.com with SMTP id d75a77b69052e-5177b9a02bdso3898731cf.1 for ; Tue, 02 Jun 2026 20:23:25 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780457005; x=1781061805; darn=vger.kernel.org; h=to:cc:date:message-id:subject:mime-version :content-transfer-encoding:from:from:to:cc:subject:date:message-id :reply-to; bh=q/9QSmlwvyQ7YX+ip3mA2ABV0en3bHcR7/Ftk9aBTEI=; b=cfgk5YcfG2lGWhfcw97tKZ+wvHOwXw0o2WbQaoK/w3/9jRjoDyDduh8GoW+Q3Gy0e5 Z8DTPH28r85aDv5hF+MiuCWfQIMINk7kS4cTpJqqcofzkWdtSzXaOH4/FF/Mcf6iOI/S EC3B3ImNYxOodNnX4RSHDJpdSIHRGPT9dM8OW3Eu8w43VICXcdzsBQnSWYxjaMduKym+ 8Acgn6vPv0eGQSMYPAkcGbpXXEPCxQwX2kDHrbLfsV/gtjTNcWbNMS6VuHQeEBzjQf1b 0nkuio0hSgKzfzmCdDmGBNcvWmaEt6mC8LZ13fFVYiC9pm+DvtQ59LgwHVsYPcT4mwnx aajg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780457005; x=1781061805; h=to:cc:date:message-id:subject:mime-version :content-transfer-encoding:from:x-gm-gg:x-gm-message-state:from:to :cc:subject:date:message-id:reply-to; bh=q/9QSmlwvyQ7YX+ip3mA2ABV0en3bHcR7/Ftk9aBTEI=; b=jZC5c95yoVraUqHXkveKor3n6kJnlmysjrGjrowUOscge/L1Na2Pe5VybbRNRWLKij nXktOMGpFXtiaAxavs8FZ+nv0oKrdz/sBM9uozNdj9QGYmyk/IhUDsXhh0bVj6TOj4yQ rWGUyyV+4hi63wrq5uXecsdw8n1l0KhPBo8r16giZVeHLxft3bB6sLbjfFBgoRt6jIFu cRzc8zhR+DnXi1bggT3nw40oUYPm+U6PhU7T63A08kMnLIEca4RW1EH4XngJF8ExaAoV Vt0VXF91p1PTR3KuwEhb60GsjoWkakUhPEGGU1L1s34zwoQ84pxLqfc98kdJVoR/9yGB KOxA== X-Forwarded-Encrypted: i=1; AFNElJ+mKwLarhaGFMR6iqRonl9efGq+Vsl9rRNnAF4o+r2pRSI227Bvadrp7atQNyEIknHkOGoUIveE4X2UQv4=@vger.kernel.org X-Gm-Message-State: AOJu0YxT9EKKX1EBhWhYk60B2Z4WbY4sONngGIV+I3j30yuOEtYnXt1y Mw/tBlfgL5kafG+kAzeRdq/iCvyEFjW2/gaJ+6TA0KSto3QEPt7LrpTA X-Gm-Gg: Acq92OHIJOBMVl6qWC9wiocXgDGsTUHRj8B9SkCtJsT0rWI8g2obogqHkr6lYop7H4z kcrHP+fk1Fk6NXGCOe4bhjyLdwy3/k9WJaqpBnWXOVSh1JrUosqaVktS6y8aF25Jm236P8LI5KX 18RHmu72rBFGm2/cWBLMxytgUlsQTdzyzsBJsKSyonT7zjfO2UL9VSRCslQRUc9mkpAYjAhkndV YiVZDs2ubkTAmbWratDRaumIbHVXacp4Bs2cAiAXXMfXgS7zuoOhmdK+1nl3+uWD2/NrjqvFd9b +FaxGoG+tZ4ahhPoepXSbub5qyiDOmkCX3TiJBF6Upc/hJDBQlenSxHrNZ+uNJlXivSslBS7I/d hXX3gaCWSsTb4V/Hmt0efSvSncJjDdD+BOybZBS/PpRC1edkMxHOBQn13ZAmxb2AwZvSgziUrtl NyhEXzo9fDcQvdjsgTcJ4ZLlH5h4omC+SZijuE/m6s9YXX73Y6GA/q29DQw4KRCA0qp3G8gUAQv E4= X-Received: by 2002:ac8:5844:0:b0:50f:b13e:b746 with SMTP id d75a77b69052e-517787847f5mr27759121cf.44.1780457005139; Tue, 02 Jun 2026 20:23:25 -0700 (PDT) Received: from smtpclient.apple ([2601:985:4601:5df0:6079:17ed:fd11:8e45]) by smtp.gmail.com with ESMTPSA id d75a77b69052e-51775c07f0dsm14808491cf.3.2026.06.02.20.23.24 (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Tue, 02 Jun 2026 20:23:24 -0700 (PDT) From: Shuangpeng Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 (Mac OS X Mail 16.0 \(3864.600.51.1.1\)) Subject: [BUG] KASAN: slab-use-after-free in nvmet_fc_tgt_q_put Message-Id: Date: Tue, 2 Jun 2026 23:23:13 -0400 Cc: linux-nvme@lists.infradead.org, linux-kernel@vger.kernel.org To: justin.tee@broadcom.com, nareshgottumukkala83@gmail.com, paul.ely@broadcom.com, hch@lst.de, sagi@grimberg.me, kch@nvidia.com X-Mailer: Apple Mail (2.3864.600.51.1.1) Hi Kernel Maintainers, I hit the following KASAN report while testing current upstream kernel: KASAN: slab-use-after-free in nvmet_fc_tgt_q_put on commit: e8c2f9fdadee7cbc75134dc463c1e0d856d6e5c7 (May 25 2026) To help trigger the bug more reliably, we applied a minimal diagnostic = patch that only adds delays and print statements. The reproducer and .config files are here. https://gist.github.com/shuangpengbai/57055c1ccb14132218674ec5f3f31d34 I=E2=80=99m happy to test debug patches or provide additional = information. Reported-by: Shuangpeng Bai [ 755.638997][ T62] BUG: KASAN: slab-use-after-free in = nvmet_fc_tgt_q_put (drivers/nvme/target/fc.c:845 = ./include/linux/kref.h:65 drivers/nvme/target/fc.c:855) [ 755.639021][ T62] Read of size 8 at addr ffff8881789bd010 by task = kworker/u9:1/62 [ 755.639025][ T62] [ 755.639049][ T62] Tainted: [D]=3DDIE [ 755.639051][ T62] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + = PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 755.639055][ T62] Workqueue: nvmet-wq fcloop_fcp_recv_work [ 755.639063][ T62] Call Trace: [ 755.639066][ T62] [ 755.639075][ T62] dump_stack_lvl (lib/dump_stack.c:94 = lib/dump_stack.c:120) [ 755.639082][ T62] print_report (mm/kasan/report.c:378 = mm/kasan/report.c:482) [ 755.639145][ T62] kasan_report (mm/kasan/report.c:595) [ 755.639167][ T62] nvmet_fc_tgt_q_put (drivers/nvme/target/fc.c:845 = ./include/linux/kref.h:65 drivers/nvme/target/fc.c:855) [ 755.639172][ T62] nvmet_fc_free_fcp_iod (drivers/nvme/target/fc.c:742) [ 755.639183][ T62] __nvmet_req_complete = (drivers/nvme/target/core.c:800) [ 755.639228][ T62] nvmet_req_init (drivers/nvme/target/core.c:1228) [ 755.639235][ T62] nvmet_fc_queue_fcp_req = (drivers/nvme/target/fc.c:2574 drivers/nvme/target/fc.c:703) [ 755.639309][ T62] nvmet_fc_rcv_fcp_req (drivers/nvme/target/fc.c:2706) [ 755.639320][ T62] fcloop_fcp_recv_work = (drivers/nvme/target/fcloop.c:695) [ 755.639326][ T62] process_scheduled_works (kernel/workqueue.c:3314 = kernel/workqueue.c:3397) [ 755.639334][ T62] worker_thread (kernel/workqueue.c:3478) [ 755.639346][ T62] kthread (kernel/kthread.c:436) [ 755.639361][ T62] ret_from_fork (arch/x86/kernel/process.c:158) [ 755.639382][ T62] ret_from_fork_asm (arch/x86/entry/entry_64.S:245) [ 755.639388][ T62] [ 755.639391][ T62] [ 755.695276][ T62] Freed by task 8206 on cpu 1 at 750.648915s: [ 755.695819][ T62] kasan_save_track (mm/kasan/common.c:57 = mm/kasan/common.c:78) [ 755.696265][ T62] kasan_save_free_info (mm/kasan/generic.c:584) [ 755.696716][ T62] __kasan_slab_free (mm/kasan/common.c:253 = mm/kasan/common.c:285) [ 755.697150][ T62] kfree (./include/linux/kasan.h:235 mm/slub.c:2689 = mm/slub.c:6251 mm/slub.c:6566) [ 755.697522][ T62] nvmet_fc_delete_assoc_work = (drivers/nvme/target/fc.c:1071) [ 755.698028][ T62] process_scheduled_works (kernel/workqueue.c:3314 = kernel/workqueue.c:3397) [ 755.698518][ T62] worker_thread (kernel/workqueue.c:3478) [ 755.698929][ T62] kthread (kernel/kthread.c:436) [ 755.699300][ T62] ret_from_fork (arch/x86/kernel/process.c:158) [ 755.699713][ T62] ret_from_fork_asm (arch/x86/entry/entry_64.S:245) [ 755.700142][ T62] [ 755.700357][ T62] The buggy address belongs to the object at = ffff8881789bd000 [ 755.700357][ T62] which belongs to the cache kmalloc-2k of size 2048 [ 755.701604][ T62] The buggy address is located 16 bytes inside of Best, Shuangpeng