syzbot

 sign-in | mailing list | source | docs
🐞 Open [816]
🐞 Fixed [85]
🐞 Invalid [1148]
⬇ Missing Backports [132]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

KASAN: use-after-free Write in __run_timers

Status: upstream: reported C repro on 2025/12/12 05:05
Reported-by: syzbot+67aa817ae7362047af2c@syzkaller.appspotmail.com
First crash: 2d08h, last: 2d08h
▶ ▼ Similar bugs (10)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
android-6-1 KASAN: use-after-free Write in __run_timers origin:lts 24 C 464 2d00h 378d 0/2 upstream: reported C repro on 2024/12/01 07:19
android-54 KASAN: use-after-free Write in __run_timers (2) 24 C 752 202d 291d 0/2 upstream: reported C repro on 2025/02/25 14:17
upstream KASAN: use-after-free Write in __run_timers 24 6144 2975d 3035d 3/29 fixed on 2017/11/11 01:37
android-54 KASAN: use-after-free Write in __run_timers 24 syz 449 529d 1981d 0/2 auto-obsoleted due to no activity on 2024/09/11 00:16
upstream KASAN: invalid-access Write in __run_timers kernel -1 8 1759d 1765d 0/29 auto-closed as invalid on 2021/05/20 13:15
upstream KMSAN: uninit-value in __run_timers (3) net 7 C error 4 831d 867d 0/29 auto-obsoleted due to no activity on 2024/01/10 00:11
upstream KASAN: slab-use-after-free Write in __run_timers net 24 1 288d 288d 0/29 closed as invalid on 2025/03/30 10:14
upstream BUG: unable to handle kernel paging request in __run_timers (2) sound 23 3 9d13h 48d 0/29 moderation: reported on 2025/10/27 03:36
android-54 KASAN: slab-out-of-bounds Write in __run_timers 23 4 1630d 1820d 0/2 auto-closed as invalid on 2021/10/26 12:53
upstream BUG: unable to handle kernel NULL pointer dereference in __run_timers arm 10 1 564d 560d 0/29 auto-obsoleted due to no activity on 2024/08/27 10:03

Sample crash report:
==================================================================
BUG: KASAN: use-after-free in hlist_move_list include/linux/list.h:986 [inline]
BUG: KASAN: use-after-free in collect_expired_timers kernel/time/timer.c:1517 [inline]
BUG: KASAN: use-after-free in __run_timers+0x311/0x7c0 kernel/time/timer.c:1753
Write of size 8 at addr ffff88814635a848 by task kworker/1:6/4344

CPU: 1 PID: 4344 Comm: kworker/1:6 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
Workqueue: usb_hub_wq hub_event
Call Trace:
 <IRQ>
 dump_stack_lvl+0x168/0x230 lib/dump_stack.c:106
 print_address_description+0x60/0x2d0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:434 [inline]
 kasan_report+0xdf/0x130 mm/kasan/report.c:451
 hlist_move_list include/linux/list.h:986 [inline]
 collect_expired_timers kernel/time/timer.c:1517 [inline]
 __run_timers+0x311/0x7c0 kernel/time/timer.c:1753
 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1780
 handle_softirqs+0x328/0x820 kernel/softirq.c:576
 __do_softirq kernel/softirq.c:610 [inline]
 invoke_softirq kernel/softirq.c:450 [inline]
 __irq_exit_rcu+0x12f/0x220 kernel/softirq.c:659
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
 sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:lock_acquire+0x1f2/0x3f0 kernel/locking/lockdep.c:5627
Code: 00 9c 8f 84 24 80 00 00 00 f6 84 24 81 00 00 00 02 0f 85 f6 00 00 00 41 f7 c6 00 02 00 00 74 01 fb 48 c7 44 24 60 0e 36 e0 45 <4b> c7 44 3d 00 00 00 00 00 66 43 c7 44 3d 09 00 00 43 c6 44 3d 0b
RSP: 0018:ffffc900032de660 EFLAGS: 00000206
RAX: 0000000000000001 RBX: 0000000000000000 RCX: bef0aa2cf241da00
RDX: 0000000000000000 RSI: ffffffff8a0b2e80 RDI: ffffffff8a59e800
RBP: ffffc900032de778 R08: dffffc0000000000 R09: fffffbfff1ff541b
R10: fffffbfff1ff541b R11: 1ffffffff1ff541a R12: ffffffff8c1ece20
R13: 1ffff9200065bcd8 R14: 0000000000000246 R15: dffffc0000000000
 fs_reclaim_acquire+0x91/0x100 mm/page_alloc.c:4597
 might_alloc include/linux/sched/mm.h:206 [inline]
 slab_pre_alloc_hook+0x20/0xc0 mm/slab.h:492
 slab_alloc_node mm/slub.c:3139 [inline]
 slab_alloc mm/slub.c:3233 [inline]
 __kmalloc_track_caller+0x69/0x330 mm/slub.c:4930
 kstrdup mm/util.c:60 [inline]
 kstrdup_const+0x51/0x90 mm/util.c:83
 __kernfs_new_node+0x9b/0x680 fs/kernfs/dir.c:589
 kernfs_new_node+0x148/0x250 fs/kernfs/dir.c:669
 kernfs_create_link+0xa3/0x200 fs/kernfs/symlink.c:39
 sysfs_do_create_link_sd+0x83/0x110 fs/sysfs/symlink.c:44
 device_add_class_symlinks drivers/base/core.c:3154 [inline]
 device_add+0x7ed/0xfb0 drivers/base/core.c:3360
 snd_register_device+0x32c/0x480 sound/core/sound.c:281
 snd_rawmidi_dev_register+0x308/0xe60 sound/core/rawmidi.c:1884
 __snd_device_register sound/core/device.c:149 [inline]
 snd_device_register_all+0xc8/0x190 sound/core/device.c:197
 snd_card_register+0x1a9/0x6c0 sound/core/init.c:903
 try_to_register_card+0x299/0x320 sound/usb/card.c:-1
 usb_audio_probe+0x17f8/0x1d50 sound/usb/card.c:930
 usb_probe_interface+0x5a0/0xaf0 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x284/0xc80 drivers/base/dd.c:595
 __driver_probe_device+0x18c/0x330 drivers/base/dd.c:755
 driver_probe_device+0x4f/0x420 drivers/base/dd.c:785
 __device_attach_driver+0x2b0/0x500 drivers/base/dd.c:907
 bus_for_each_drv+0x175/0x200 drivers/base/bus.c:429
 __device_attach+0x29b/0x460 drivers/base/dd.c:979
 bus_probe_device+0xbc/0x1e0 drivers/base/bus.c:489
 device_add+0xa00/0xfb0 drivers/base/core.c:3412
 usb_set_configuration+0x1991/0x1fd0 drivers/usb/core/message.c:2165
 usb_generic_driver_probe+0x89/0x150 drivers/usb/core/generic.c:238
 usb_probe_device+0x139/0x270 drivers/usb/core/driver.c:293
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x284/0xc80 drivers/base/dd.c:595
 __driver_probe_device+0x18c/0x330 drivers/base/dd.c:755
 driver_probe_device+0x4f/0x420 drivers/base/dd.c:785
 __device_attach_driver+0x2b0/0x500 drivers/base/dd.c:907
 bus_for_each_drv+0x175/0x200 drivers/base/bus.c:429
 __device_attach+0x29b/0x460 drivers/base/dd.c:979
 bus_probe_device+0xbc/0x1e0 drivers/base/bus.c:489
 device_add+0xa00/0xfb0 drivers/base/core.c:3412
 usb_new_device+0xd53/0x1640 drivers/usb/core/hub.c:2632
 hub_port_connect drivers/usb/core/hub.c:5497 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5637 [inline]
 port_event drivers/usb/core/hub.c:5799 [inline]
 hub_event+0x2dd9/0x5560 drivers/usb/core/hub.c:5881
 process_one_work+0x863/0x1000 kernel/workqueue.c:2310
 worker_thread+0xaa8/0x12a0 kernel/workqueue.c:2457
 kthread+0x436/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>

Allocated by task 4190:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:46 [inline]
 set_alloc_info mm/kasan/common.c:434 [inline]
 ____kasan_kmalloc mm/kasan/common.c:513 [inline]
 __kasan_kmalloc+0xb5/0xf0 mm/kasan/common.c:522
 kmalloc include/linux/slab.h:607 [inline]
 kzalloc include/linux/slab.h:738 [inline]
 __snd_usbmidi_create+0xda/0x2f90 sound/usb/midi.c:2539
 snd_usb_create_quirk sound/usb/quirks.c:577 [inline]
 create_composite_quirk+0x1ec/0x4e0 sound/usb/quirks.c:48
 usb_audio_probe+0xb72/0x1d50 sound/usb/card.c:885
 usb_probe_interface+0x5a0/0xaf0 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x284/0xc80 drivers/base/dd.c:595
 __driver_probe_device+0x18c/0x330 drivers/base/dd.c:755
 driver_probe_device+0x4f/0x420 drivers/base/dd.c:785
 __device_attach_driver+0x2b0/0x500 drivers/base/dd.c:907
 bus_for_each_drv+0x175/0x200 drivers/base/bus.c:429
 __device_attach+0x29b/0x460 drivers/base/dd.c:979
 bus_probe_device+0xbc/0x1e0 drivers/base/bus.c:489
 device_add+0xa00/0xfb0 drivers/base/core.c:3412
 usb_set_configuration+0x1991/0x1fd0 drivers/usb/core/message.c:2165
 usb_generic_driver_probe+0x89/0x150 drivers/usb/core/generic.c:238
 usb_probe_device+0x139/0x270 drivers/usb/core/driver.c:293
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x284/0xc80 drivers/base/dd.c:595
 __driver_probe_device+0x18c/0x330 drivers/base/dd.c:755
 driver_probe_device+0x4f/0x420 drivers/base/dd.c:785
 __device_attach_driver+0x2b0/0x500 drivers/base/dd.c:907
 bus_for_each_drv+0x175/0x200 drivers/base/bus.c:429
 __device_attach+0x29b/0x460 drivers/base/dd.c:979
 bus_probe_device+0xbc/0x1e0 drivers/base/bus.c:489
 device_add+0xa00/0xfb0 drivers/base/core.c:3412
 usb_new_device+0xd53/0x1640 drivers/usb/core/hub.c:2632
 hub_port_connect drivers/usb/core/hub.c:5497 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5637 [inline]
 port_event drivers/usb/core/hub.c:5799 [inline]
 hub_event+0x2dd9/0x5560 drivers/usb/core/hub.c:5881
 process_one_work+0x863/0x1000 kernel/workqueue.c:2310
 worker_thread+0xaa8/0x12a0 kernel/workqueue.c:2457
 kthread+0x436/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287

Freed by task 4190:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:46
 kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:360
 ____kasan_slab_free+0xd5/0x110 mm/kasan/common.c:366
 kasan_slab_free include/linux/kasan.h:230 [inline]
 slab_free_hook mm/slub.c:1710 [inline]
 slab_free_freelist_hook+0xea/0x170 mm/slub.c:1736
 slab_free mm/slub.c:3504 [inline]
 kfree+0xef/0x2a0 mm/slub.c:4564
 snd_rawmidi_free+0x3b7/0x3e0 sound/core/rawmidi.c:1844
 snd_rawmidi_dev_free+0x34/0x40 sound/core/rawmidi.c:1853
 __snd_device_free+0x1cd/0x2e0 sound/core/device.c:76
 snd_device_free_all+0xcb/0x180 sound/core/device.c:233
 snd_card_do_free sound/core/init.c:588 [inline]
 release_card_device+0x6d/0x1f0 sound/core/init.c:145
 device_release+0x92/0x1c0 drivers/base/core.c:-1
 kobject_cleanup lib/kobject.c:713 [inline]
 kobject_release lib/kobject.c:744 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x21d/0x460 lib/kobject.c:761
 snd_card_free_when_closed sound/core/init.c:620 [inline]
 snd_card_free+0x123/0x190 sound/core/init.c:653
 usb_audio_probe+0x187f/0x1d50 sound/usb/card.c:939
 usb_probe_interface+0x5a0/0xaf0 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x284/0xc80 drivers/base/dd.c:595
 __driver_probe_device+0x18c/0x330 drivers/base/dd.c:755
 driver_probe_device+0x4f/0x420 drivers/base/dd.c:785
 __device_attach_driver+0x2b0/0x500 drivers/base/dd.c:907
 bus_for_each_drv+0x175/0x200 drivers/base/bus.c:429
 __device_attach+0x29b/0x460 drivers/base/dd.c:979
 bus_probe_device+0xbc/0x1e0 drivers/base/bus.c:489
 device_add+0xa00/0xfb0 drivers/base/core.c:3412
 usb_set_configuration+0x1991/0x1fd0 drivers/usb/core/message.c:2165
 usb_generic_driver_probe+0x89/0x150 drivers/usb/core/generic.c:238
 usb_probe_device+0x139/0x270 drivers/usb/core/driver.c:293
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x284/0xc80 drivers/base/dd.c:595
 __driver_probe_device+0x18c/0x330 drivers/base/dd.c:755
 driver_probe_device+0x4f/0x420 drivers/base/dd.c:785
 __device_attach_driver+0x2b0/0x500 drivers/base/dd.c:907
 bus_for_each_drv+0x175/0x200 drivers/base/bus.c:429
 __device_attach+0x29b/0x460 drivers/base/dd.c:979
 bus_probe_device+0xbc/0x1e0 drivers/base/bus.c:489
 device_add+0xa00/0xfb0 drivers/base/core.c:3412
 usb_new_device+0xd53/0x1640 drivers/usb/core/hub.c:2632
 hub_port_connect drivers/usb/core/hub.c:5497 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5637 [inline]
 port_event drivers/usb/core/hub.c:5799 [inline]
 hub_event+0x2dd9/0x5560 drivers/usb/core/hub.c:5881
 process_one_work+0x863/0x1000 kernel/workqueue.c:2310
 worker_thread+0xaa8/0x12a0 kernel/workqueue.c:2457
 kthread+0x436/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287

Last potentially related work creation:
 kasan_save_stack+0x35/0x60 mm/kasan/common.c:38
 kasan_record_aux_stack+0xb8/0x100 mm/kasan/generic.c:348
 __call_rcu kernel/rcu/tree.c:3011 [inline]
 call_rcu+0x182/0x930 kernel/rcu/tree.c:3091
 process_one_work+0x863/0x1000 kernel/workqueue.c:2310
 worker_thread+0xaa8/0x12a0 kernel/workqueue.c:2457
 kthread+0x436/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287

The buggy address belongs to the object at ffff88814635a800
 which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 72 bytes inside of
 1024-byte region [ffff88814635a800, ffff88814635ac00)
The buggy address belongs to the page:
page:ffffea000518d600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x146358
head:ffffea000518d600 order:3 compound_mapcount:0 compound_pincount:0
flags: 0x57ff00000010200(slab|head|node=1|zone=2|lastcpupid=0x7ff)
raw: 057ff00000010200 ffffea0001871e00 0000000300000003 ffff888016841dc0
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 4205, ts 78095644272, free_ts 77861086038
 prep_new_page mm/page_alloc.c:2426 [inline]
 get_page_from_freelist+0x1b77/0x1c60 mm/page_alloc.c:4192
 __alloc_pages+0x1e1/0x470 mm/page_alloc.c:5487
 __alloc_pages_node include/linux/gfp.h:570 [inline]
 alloc_slab_page mm/slub.c:1782 [inline]
 allocate_slab mm/slub.c:1917 [inline]
 new_slab+0xb6/0x4b0 mm/slub.c:1980
 ___slab_alloc+0x81e/0xdf0 mm/slub.c:3013
 __slab_alloc mm/slub.c:3100 [inline]
 slab_alloc_node mm/slub.c:3191 [inline]
 __kmalloc_node+0x200/0x3b0 mm/slub.c:4456
 kmalloc_node include/linux/slab.h:630 [inline]
 kvmalloc_node+0x84/0x130 mm/util.c:619
 kvzalloc_node include/linux/mm.h:820 [inline]
 alloc_shrinker_info+0xef/0x3b0 mm/vmscan.c:278
 mem_cgroup_css_online+0x18/0x1d0 mm/memcontrol.c:5333
 online_css+0xb9/0x260 kernel/cgroup/cgroup.c:5338
 css_create kernel/cgroup/cgroup.c:5409 [inline]
 cgroup_apply_control_enable+0x804/0xb00 kernel/cgroup/cgroup.c:3212
 cgroup_mkdir+0xc67/0xe60 kernel/cgroup/cgroup.c:5608
 kernfs_iop_mkdir+0x24c/0x3d0 fs/kernfs/dir.c:1175
 vfs_mkdir+0x387/0x570 fs/namei.c:4073
 do_mkdirat+0x1d7/0x5a0 fs/namei.c:4098
 __do_sys_mkdirat fs/namei.c:4113 [inline]
 __se_sys_mkdirat fs/namei.c:4111 [inline]
 __x64_sys_mkdirat+0x85/0x90 fs/namei.c:4111
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1340 [inline]
 free_pcp_prepare mm/page_alloc.c:1391 [inline]
 free_unref_page_prepare+0x637/0x6c0 mm/page_alloc.c:3317
 free_unref_page+0x94/0x280 mm/page_alloc.c:3396
 qlist_free_all+0x35/0x90 mm/kasan/quarantine.c:176
 kasan_quarantine_reduce+0x150/0x160 mm/kasan/quarantine.c:283
 __kasan_slab_alloc+0x2f/0xd0 mm/kasan/common.c:444
 kasan_slab_alloc include/linux/kasan.h:254 [inline]
 slab_post_alloc_hook+0x4c/0x380 mm/slab.h:519
 slab_alloc_node mm/slub.c:3225 [inline]
 slab_alloc mm/slub.c:3233 [inline]
 kmem_cache_alloc+0x100/0x290 mm/slub.c:3238
 getname_flags+0xb5/0x500 fs/namei.c:138
 do_sys_openat2+0xcf/0x4a0 fs/open.c:1249
 do_sys_open fs/open.c:1271 [inline]
 __do_sys_openat fs/open.c:1287 [inline]
 __se_sys_openat fs/open.c:1282 [inline]
 __x64_sys_openat+0x135/0x160 fs/open.c:1282
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0

Memory state around the buggy address:
 ffff88814635a700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88814635a780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88814635a800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                              ^
 ffff88814635a880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88814635a900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess):
   0:	00 9c 8f 84 24 80 00 	add    %bl,0x802484(%rdi,%rcx,4)
   7:	00 00                	add    %al,(%rax)
   9:	f6 84 24 81 00 00 00 	testb  $0x2,0x81(%rsp)
  10:	02
  11:	0f 85 f6 00 00 00    	jne    0x10d
  17:	41 f7 c6 00 02 00 00 	test   $0x200,%r14d
  1e:	74 01                	je     0x21
  20:	fb                   	sti
  21:	48 c7 44 24 60 0e 36 	movq   $0x45e0360e,0x60(%rsp)
  28:	e0 45
* 2a:	4b c7 44 3d 00 00 00 	movq   $0x0,0x0(%r13,%r15,1) <-- trapping instruction
  31:	00 00
  33:	66 43 c7 44 3d 09 00 	movw   $0x0,0x9(%r13,%r15,1)
  3a:	00
  3b:	43                   	rex.XB
  3c:	c6                   	.byte 0xc6
  3d:	44                   	rex.R
  3e:	3d                   	.byte 0x3d
  3f:	0b                   	.byte 0xb

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/12/12 05:04 linux-5.15.y 68efe5a6c16a d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-5-15-kasan KASAN: use-after-free Write in __run_timers
* Struck through repros no longer work on HEAD.