KASAN: use-after-free Read in __usb_hcd_giveback_urb

Status: upstream: reported syz repro on 2024/04/06 03:35
Reported-by: syzbot+94936196e16d5ad44ed6@syzkaller.appspotmail.com
First crash: 842d, last: 10d
Fix bisection: failed (error log, bisect log)
  
▶ ▼ Bug presence (1)
Date Name Commit Repro Result
2025/03/22 upstream (ToT) 183601b78a9b syz Didn't crash
▶ ▼ Similar bugs (7)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 KASAN: use-after-free Read in __usb_hcd_giveback_urb 19 39 400d 989d 0/3 auto-obsoleted due to no activity on 2025/09/30 06:38
upstream KASAN: use-after-free Read in __usb_hcd_giveback_urb (2) usb 19 1 1333d 1328d 0/29 auto-obsoleted due to no activity on 2023/03/31 19:51
linux-5.15 KASAN: use-after-free Read in __usb_hcd_giveback_urb (2) 19 41 15d 282d 0/3 upstream: reported on 2025/10/17 22:12
upstream KASAN: use-after-free Read in __usb_hcd_giveback_urb usb 19 1 2181d 2180d 0/29 auto-closed as invalid on 2020/12/04 05:52
upstream KASAN: slab-use-after-free Read in __usb_hcd_giveback_urb usb 19 1 1072d 1070d 0/29 auto-obsoleted due to no activity on 2023/11/28 05:12
upstream KASAN: slab-use-after-free Read in __usb_hcd_giveback_urb (2) prio:high usb 22 362 1d15h 856d 0/29 upstream: reported on 2024/03/22 17:26
linux-6.6 KASAN: slab-use-after-free Read in __usb_hcd_giveback_urb 19 21 8d12h 382d 0/2 upstream: reported on 2025/07/10 08:57

Sample crash report:
xpad 1-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19
xpad 1-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19
==================================================================
BUG: KASAN: use-after-free in register_lock_class+0x7d9/0x870 kernel/locking/lockdep.c:1331
Read of size 1 at addr ffff88802c8c0091 by task kworker/u5:6/4284

CPU: 1 PID: 4284 Comm: kworker/u5:6 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/25/2026
Workqueue: hci0 hci_rx_work
Call Trace:
 <IRQ>
 dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:316 [inline]
 print_report+0xa8/0x210 mm/kasan/report.c:420
 kasan_report+0x10b/0x140 mm/kasan/report.c:524
 register_lock_class+0x7d9/0x870 kernel/locking/lockdep.c:1331
 __lock_acquire+0x172/0x7c40 kernel/locking/lockdep.c:4942
 lock_acquire+0x1bb/0x4a0 kernel/locking/lockdep.c:5676
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0xb0/0x100 kernel/locking/spinlock.c:162
 __wake_up_common_lock kernel/sched/wait.c:137 [inline]
 __wake_up+0x107/0x1a0 kernel/sched/wait.c:160
 __usb_hcd_giveback_urb+0x394/0x520 drivers/usb/core/hcd.c:1676
 dummy_timer+0xa21/0x3420 drivers/usb/gadget/udc/dummy_hcd.c:2004
 __run_hrtimer kernel/time/hrtimer.c:1751 [inline]
 __hrtimer_run_queues+0x522/0xc90 kernel/time/hrtimer.c:1815
 hrtimer_run_softirq+0x173/0x290 kernel/time/hrtimer.c:1832
 handle_softirqs+0x291/0x910 kernel/softirq.c:596
 __do_softirq kernel/softirq.c:630 [inline]
 invoke_softirq kernel/softirq.c:470 [inline]
 __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
 sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:queue_delayed_work_on+0x1a7/0x1f0 kernel/workqueue.c:1709
Code: 4d 85 ed 75 16 e8 69 e9 2d 00 eb 15 e8 62 e9 2d 00 e8 ed 11 dc 08 4d 85 ed 74 ea e8 53 e9 2d 00 fb 48 c7 44 24 20 0e 36 e0 45 <48> b8 00 00 00 00 00 fc ff df 49 c7 04 06 00 00 00 00 41 c7 44 06
RSP: 0018:ffffc900040278a0 EFLAGS: 00000287
RAX: ffffffff8154384d RBX: 0000000000000000 RCX: 0000000000100000
RDX: ffffc9001baed000 RSI: 000000000000084f RDI: 0000000000000850
RBP: ffffc90004027978 R08: ffffffff90b10317 R09: 1ffffffff2162062
R10: dffffc0000000000 R11: fffffbfff2162063 R12: dffffc0000000001
R13: 0000000000000200 R14: 1ffff92000804f18 R15: 0000000000000000
 queue_delayed_work include/linux/workqueue.h:527 [inline]
 handle_cmd_cnt_and_timer+0x264/0x2e0 net/bluetooth/hci_event.c:3812
 hci_cmd_complete_evt+0x4b6/0x950 net/bluetooth/hci_event.c:4241
 hci_event_func net/bluetooth/hci_event.c:7426 [inline]
 hci_event_packet+0x7b3/0x1290 net/bluetooth/hci_event.c:7481
 hci_rx_work+0x3eb/0xd40 net/bluetooth/hci_core.c:4109
 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
 worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
 </TASK>

Allocated by task 4315:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
 ____kasan_kmalloc mm/kasan/common.c:375 [inline]
 __kasan_kmalloc+0x8e/0xa0 mm/kasan/common.c:384
 kmalloc include/linux/slab.h:563 [inline]
 kzalloc include/linux/slab.h:699 [inline]
 xpad_probe+0x437/0x1ed0 drivers/input/joystick/xpad.c:1971
 usb_probe_interface+0x5be/0xae0 drivers/usb/core/driver.c:396
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x24a/0xb40 drivers/base/dd.c:639
 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:805
 driver_probe_device+0x4f/0x420 drivers/base/dd.c:835
 __device_attach_driver+0x2c6/0x510 drivers/base/dd.c:963
 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
 __device_attach+0x2a7/0x480 drivers/base/dd.c:1035
 bus_probe_device+0xba/0x1d0 drivers/base/bus.c:489
 device_add+0xbcf/0x1050 drivers/base/core.c:3712
 usb_set_configuration+0x19d5/0x2030 drivers/usb/core/message.c:2223
 usb_generic_driver_probe+0x89/0x150 drivers/usb/core/generic.c:238
 usb_probe_device+0x126/0x250 drivers/usb/core/driver.c:293
 call_driver_probe drivers/base/dd.c:-1 [inline]
 really_probe+0x24a/0xb40 drivers/base/dd.c:639
 __driver_probe_device+0x1f5/0x390 drivers/base/dd.c:805
 driver_probe_device+0x4f/0x420 drivers/base/dd.c:835
 __device_attach_driver+0x2c6/0x510 drivers/base/dd.c:963
 bus_for_each_drv+0x184/0x210 drivers/base/bus.c:429
 __device_attach+0x2a7/0x480 drivers/base/dd.c:1035
 bus_probe_device+0xba/0x1d0 drivers/base/bus.c:489
 device_add+0xbcf/0x1050 drivers/base/core.c:3712
 usb_new_device+0xa01/0x15e0 drivers/usb/core/hub.c:2659
 hub_port_connect drivers/usb/core/hub.c:5517 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5657 [inline]
 port_event drivers/usb/core/hub.c:5817 [inline]
 hub_event+0x2b2f/0x5200 drivers/usb/core/hub.c:5899
 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
 worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

Freed by task 14437:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
 kasan_save_free_info+0x27/0x40 mm/kasan/generic.c:516
 ____kasan_slab_free+0x126/0x1f0 mm/kasan/common.c:237
 kasan_slab_free include/linux/kasan.h:177 [inline]
 slab_free_hook mm/slub.c:1729 [inline]
 slab_free_freelist_hook+0x133/0x1b0 mm/slub.c:1755
 slab_free mm/slub.c:3687 [inline]
 __kmem_cache_free+0xb6/0x200 mm/slub.c:3700
 xpad_disconnect+0x31f/0x440 drivers/input/joystick/xpad.c:2152
 usb_unbind_interface+0x203/0x870 drivers/usb/core/driver.c:458
 device_remove drivers/base/dd.c:550 [inline]
 __device_release_driver drivers/base/dd.c:1280 [inline]
 device_release_driver_internal+0x4cf/0x7c0 drivers/base/dd.c:1306
 bus_remove_device+0x2dd/0x400 drivers/base/bus.c:531
 device_del+0x63f/0xa80 drivers/base/core.c:3900
 usb_disable_device+0x3e7/0x8a0 drivers/usb/core/message.c:1472
 usb_disconnect+0x33c/0x8a0 drivers/usb/core/hub.c:2314
 hub_port_connect drivers/usb/core/hub.c:5361 [inline]
 hub_port_connect_change drivers/usb/core/hub.c:5657 [inline]
 port_event drivers/usb/core/hub.c:5817 [inline]
 hub_event+0x1d27/0x5200 drivers/usb/core/hub.c:5899
 process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
 worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439
 kthread+0x29d/0x330 kernel/kthread.c:376
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

The buggy address belongs to the object at ffff88802c8c0000
 which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 145 bytes inside of
 1024-byte region [ffff88802c8c0000, ffff88802c8c0400)

The buggy address belongs to the physical page:
page:ffffea0000b23000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2c8c0
head:ffffea0000b23000 order:3 compound_mapcount:0 compound_pincount:0
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 dead000000000100 dead000000000122 ffff888017441dc0
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4055, tgid 4055 (dhcpcd), ts 57295915072, free_ts 57217709310
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x173/0x1a0 mm/page_alloc.c:2560
 prep_new_page mm/page_alloc.c:2567 [inline]
 get_page_from_freelist+0x206b/0x2180 mm/page_alloc.c:4358
 __alloc_pages+0x1ec/0x4f0 mm/page_alloc.c:5658
 alloc_slab_page+0x5d/0x180 mm/slub.c:1799
 allocate_slab mm/slub.c:1944 [inline]
 new_slab+0x87/0x2d0 mm/slub.c:1997
 ___slab_alloc+0xbc5/0x1240 mm/slub.c:3154
 __slab_alloc mm/slub.c:3240 [inline]
 slab_alloc_node mm/slub.c:3325 [inline]
 __kmem_cache_alloc_node+0x126/0x270 mm/slub.c:3398
 __do_kmalloc_node mm/slab_common.c:935 [inline]
 __kmalloc+0xa3/0x240 mm/slab_common.c:949
 kmalloc include/linux/slab.h:568 [inline]
 load_elf_phdrs fs/binfmt_elf.c:507 [inline]
 load_elf_binary+0x26e/0x2820 fs/binfmt_elf.c:887
 search_binary_handler fs/exec.c:1764 [inline]
 exec_binprm fs/exec.c:1805 [inline]
 bprm_execve+0xaf7/0x17e0 fs/exec.c:1874
 do_execveat_common+0x501/0x6b0 fs/exec.c:1979
 do_execve fs/exec.c:2053 [inline]
 __do_sys_execve fs/exec.c:2129 [inline]
 __se_sys_execve fs/exec.c:2124 [inline]
 __x64_sys_execve+0x8e/0xa0 fs/exec.c:2124
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1487 [inline]
 free_pcp_prepare mm/page_alloc.c:1537 [inline]
 free_unref_page_prepare+0x8e5/0x9e0 mm/page_alloc.c:3414
 free_unref_page+0x2e/0x3f0 mm/page_alloc.c:3509
 qlink_free mm/kasan/quarantine.c:168 [inline]
 qlist_free_all+0x76/0xe0 mm/kasan/quarantine.c:187
 kasan_quarantine_reduce+0x144/0x160 mm/kasan/quarantine.c:294
 __kasan_slab_alloc+0x1e/0x80 mm/kasan/common.c:306
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook+0x4b/0x490 mm/slab.h:737
 slab_alloc_node mm/slub.c:3359 [inline]
 slab_alloc mm/slub.c:3367 [inline]
 __kmem_cache_alloc_lru mm/slub.c:3374 [inline]
 kmem_cache_alloc+0x18b/0x2f0 mm/slub.c:3383
 mt_alloc_one lib/maple_tree.c:154 [inline]
 mas_alloc_nodes+0x2ec/0x880 lib/maple_tree.c:1279
 mas_node_count_gfp lib/maple_tree.c:1361 [inline]
 mas_preallocate+0x162/0x3b0 lib/maple_tree.c:5809
 do_mas_align_munmap+0x239/0x12d0 mm/mmap.c:2453
 do_mas_munmap+0x240/0x2b0 mm/mmap.c:2650
 __mmap_region mm/mmap.c:2698 [inline]
 mmap_region+0x7ab/0x1c50 mm/mmap.c:2916
 do_mmap+0x9ce/0x10d0 mm/mmap.c:1436
 vm_mmap_pgoff+0x1c1/0x2d0 mm/util.c:520
 ksys_mmap_pgoff+0x4bf/0x720 mm/mmap.c:1482
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76

Memory state around the buggy address:
 ffff88802c8bff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88802c8c0000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88802c8c0080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                         ^
 ffff88802c8c0100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88802c8c0180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess):
   0:	4d 85 ed             	test   %r13,%r13
   3:	75 16                	jne    0x1b
   5:	e8 69 e9 2d 00       	call   0x2de973
   a:	eb 15                	jmp    0x21
   c:	e8 62 e9 2d 00       	call   0x2de973
  11:	e8 ed 11 dc 08       	call   0x8dc1203
  16:	4d 85 ed             	test   %r13,%r13
  19:	74 ea                	je     0x5
  1b:	e8 53 e9 2d 00       	call   0x2de973
  20:	fb                   	sti
  21:	48 c7 44 24 20 0e 36 	movq   $0x45e0360e,0x20(%rsp)
  28:	e0 45
* 2a:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax <-- trapping instruction
  31:	fc ff df
  34:	49 c7 04 06 00 00 00 	movq   $0x0,(%r14,%rax,1)
  3b:	00
  3c:	41                   	rex.B
  3d:	c7                   	.byte 0xc7
  3e:	44 06                	rex.R (bad)

Crashes (39):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/07/16 12:34 linux-6.1.y 090666d3cc90 71b49442 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
2026/06/25 20:01 linux-6.1.y fdb6fcb41cc7 7ff32d8b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
2026/06/23 13:50 linux-6.1.y fdb6fcb41cc7 4b1d8f01 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
2026/06/03 12:10 linux-6.1.y 228da13e907e 234057e5 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
2026/05/22 01:51 linux-6.1.y c27210688955 70ae9b03 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
2026/05/16 21:58 linux-6.1.y c27210688955 de5aae85 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
2026/04/29 09:37 linux-6.1.y 7c87defbd336 7ca9e4d8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
2026/04/11 12:23 linux-6.1.y 1989cd3d56e2 38c8e246 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
2026/03/08 09:58 linux-6.1.y f2ddafa93a25 5cb44a80 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
2026/03/05 14:29 linux-6.1.y 2f66dd9cff42 d20b04c8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
2026/01/26 11:04 linux-6.1.y cd9b81672742 a4c52dd6 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
2026/01/20 11:44 linux-6.1.y cd9b81672742 06648d9c .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
2026/01/17 00:38 linux-6.1.y bec0e10ee67e 20d37d28 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
2026/01/08 00:43 linux-6.1.y 50cbba13faa2 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
2025/11/25 03:59 linux-6.1.y f6e38ae624cf 64219f15 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
2025/10/05 04:44 linux-6.1.y 882efbdd9d34 49379ee0 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
2025/09/11 17:06 linux-6.1.y 3db754f56897 fdeaa69b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
2025/09/04 16:50 linux-6.1.y 28c695c365e1 d291dd2d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
2025/09/02 01:43 linux-6.1.y f89b6e15694c 807a3b61 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
2025/07/16 11:23 linux-6.1.y f2198ea7eb3e 124ec9cc .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
2025/07/10 11:43 linux-6.1.y 04d1ccaa9c28 956bd956 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
2025/07/07 02:39 linux-6.1.y 04d1ccaa9c28 4f67c4ae .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
2025/05/22 16:02 linux-6.1.y da3c5173c55f 0919b50b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
2025/05/22 07:18 linux-6.1.y 325285d9fc86 0919b50b .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
2025/05/15 02:16 linux-6.1.y 02b72ccb5f9d d6b2ee52 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
2025/05/01 05:11 linux-6.1.y 535ec20c5027 ce7952f4 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
2025/04/07 19:38 linux-6.1.y 3dfebb87d7eb a2ada0e7 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
2025/03/14 01:34 linux-6.1.y 344a09659766 e2826670 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
2025/02/22 13:34 linux-6.1.y 3a8358583626 d34966d1 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
2025/02/04 00:58 linux-6.1.y 0cbb5f65e52f 8f267cef .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
2025/01/14 16:36 linux-6.1.y c63962be84ef f310a27d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
2024/10/31 07:53 linux-6.1.y 7ec6f9fa3d97 96eb609f .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
2024/10/30 04:54 linux-6.1.y 7ec6f9fa3d97 66aeb999 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
2024/10/25 23:36 linux-6.1.y 7ec6f9fa3d97 045e728d .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
2024/07/19 14:55 linux-6.1.y 9b3f9a5b12dc ee4e11c8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
2024/06/20 17:51 linux-6.1.y eb44d83053d6 dac2aa43 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
2024/04/22 01:30 linux-6.1.y 6741e066ec76 af24b050 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
2024/04/15 22:40 linux-6.1.y cd5d98c0556c b9af7e61 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
2024/04/06 03:34 linux-6.1.y 347385861c50 ca620dd8 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan KASAN: use-after-free Read in __usb_hcd_giveback_urb
* Struck through repros no longer work on HEAD.