KASAN: slab-out-of-bounds Read in usbatm_usb_disconnect

Status: upstream: reported C repro on 2026/08/19 06:08
Reported-by: syzbot+6f5f0713e63aa7a08958@syzkaller.appspotmail.com
First crash: 1d10h, last: 1d10h
Similar bugs (2)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 KASAN: slab-out-of-bounds Read in usbatm_usb_disconnect 17 1 3d08h 3d08h 0/3 upstream: reported on 2026/08/17 08:29
upstream KASAN: slab-out-of-bounds Read in usbatm_usb_disconnect prio:high usb 17 syz, C 19 29d 34d 29/29 fixed on 2026/08/17 15:57

Sample crash report:
usb 1-1: [ueagle-atm] ADSL device founded vid (0X1110) pid (0X9010) Rev (0X0): Eagle I
usb 1-1: [ueagle-atm] pre-firmware device, uploading firmware
usb 1-1: [ueagle-atm] loading firmware ueagle-atm/eagleI.fw
usb 1-1: USB disconnect, device number 2
==================================================================
BUG: KASAN: slab-out-of-bounds in __mutex_lock_common kernel/locking/mutex.c:582 [inline]
BUG: KASAN: slab-out-of-bounds in __mutex_lock+0xf4/0xae0 kernel/locking/mutex.c:747
Read of size 8 at addr ffff88807ea5c568 by task kworker/0:1/14

CPU: 0 PID: 14 Comm: kworker/0:1 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: usb_hub_wq hub_event
Call Trace:
 <TASK>
 dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:316 [inline]
 print_report+0xa8/0x210 mm/kasan/report.c:420
 kasan_report+0x10b/0x140 mm/kasan/report.c:524
 __mutex_lock_common kernel/locking/mutex.c:582 [inline]
 __mutex_lock+0xf4/0xae0 kernel/locking/mutex.c:747
 usbatm_usb_disconnect+0x70/0x5d0 drivers/usb/atm/usbatm.c:1220
 uea_disconnect+0x1f8/0x2f0 drivers/usb/atm/ueagle-atm.c:2649
 usb_unbind_interface+0x203/0x870 drivers/usb/core/driver.c:458
 device_remove drivers/base/dd.c:549 [inline]
 __device_release_driver drivers/base/dd.c:1279 [inline]
 device_release_driver_internal+0x4cf/0x7c0 drivers/base/dd.c:1305
 bus_remove_device+0x2dd/0x400 drivers/base/bus.c:531
 device_del+0x63f/0xa80 drivers/base/core.c:3900
 usb_disable_device+0x3e7/0x8a0 drivers/usb/core/message.c:1472
 usb_disconnect+0x33c/0x8a0 drivers/usb/core/hub.c:2314
 hub_port_connect drivers/usb/core/hub.c:5361 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5657 [inline]
 port_event drivers/usb/core/hub.c:5817 [inline]
 hub_event+0x1d27/0x5200 drivers/usb/core/hub.c:5899
 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
 process_scheduled_works kernel/workqueue.c:2355 [inline]
 worker_thread+0xd6e/0x12a0 kernel/workqueue.c:2441
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>

Allocated by task 4297:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
 ____kasan_kmalloc mm/kasan/common.c:375 [inline]
 __kasan_kmalloc+0x8e/0xa0 mm/kasan/common.c:384
 kasan_kmalloc include/linux/kasan.h:211 [inline]
 __do_kmalloc_node mm/slab_common.c:936 [inline]
 __kmalloc+0xb3/0x240 mm/slab_common.c:949
 kmalloc include/linux/slab.h:568 [inline]
 kzalloc include/linux/slab.h:699 [inline]
 tomoyo_encode2 security/tomoyo/realpath.c:45 [inline]
 tomoyo_encode+0x28a/0x550 security/tomoyo/realpath.c:80
 tomoyo_realpath_from_path+0x578/0x5c0 security/tomoyo/realpath.c:283
 tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
 tomoyo_check_open_permission+0x212/0x440 security/tomoyo/file.c:771
 security_file_open+0x5e/0xa0 security/security.c:1682
 do_dentry_open+0x2fd/0x10b0 fs/open.c:869
 do_open fs/namei.c:3634 [inline]
 path_openat+0x2674/0x2f10 fs/namei.c:3791
 do_filp_open+0x1ee/0x420 fs/namei.c:3818
 do_sys_openat2+0x14b/0x4f0 fs/open.c:1320
 do_sys_open fs/open.c:1336 [inline]
 __do_sys_openat fs/open.c:1352 [inline]
 __se_sys_openat fs/open.c:1347 [inline]
 __x64_sys_openat+0x135/0x160 fs/open.c:1347
 do_syscall_64+0x4c/0x

Crashes (1):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/08/19 06:08 linux-6.1.y e4f7d8be268e 1e72964b .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: slab-out-of-bounds Read in usbatm_usb_disconnect
* Struck through repros no longer work on HEAD.