syzbot
KASAN: slab-use-after-free Read in handle_control_request
Status:
upstream: reported on 2026/08/03 16:19
Reported-by: syzbot+fd2ab1faf69c46651ed1@syzkaller.appspotmail.com
First crash: 22d, last: 22d
Sample crash report:
==================================================================
BUG: KASAN: slab-use-after-free in find_endpoint drivers/usb/gadget/udc/dummy_hcd.c:1617 [inline]
BUG: KASAN: slab-use-after-free in handle_control_request+0xb03/0x1870 drivers/usb/gadget/udc/dummy_hcd.c:1760
Read of size 1 at addr ffff88805ad37172 by task swapper/0/0
CPU: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
<IRQ>
dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:364 [inline]
print_report+0xa8/0x210 mm/kasan/report.c:468
kasan_report+0x117/0x150 mm/kasan/report.c:581
find_endpoint drivers/usb/gadget/udc/dummy_hcd.c:1617 [inline]
handle_control_request+0xb03/0x1870 drivers/usb/gadget/udc/dummy_hcd.c:1760
dummy_timer+0x1298/0x34e0 drivers/usb/gadget/udc/dummy_hcd.c:1940
__run_hrtimer kernel/time/hrtimer.c:1754 [inline]
__hrtimer_run_queues+0x525/0xc10 kernel/time/hrtimer.c:1818
hrtimer_run_softirq+0x177/0x290 kernel/time/hrtimer.c:1835
handle_softirqs+0x27d/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:pv_native_safe_halt+0xf/0x10 arch/x86/kernel/paravirt.c:148
Code: 4e 1c 02 c3 cc cc cc cc cc cc cc f3 0f 1e fa 0f 0b 66 2e 0f 1f 84 00 00 00 00 00 f3 0f 1e fa 66 90 0f 00 2d a3 5a 3b 00 fb f4 <c3> 66 0f 1f 00 55 41 57 41 56 41 54 53 50 8b 2f eb 2c 89 cb 80 f9
RSP: 0018:ffffffff8ce07d80 EFLAGS: 000002c2
RAX: f5bc2c763801b300 RBX: ffffffff81630d54 RCX: f5bc2c763801b300
RDX: 0000000000000001 RSI: ffffffff8acacbe0 RDI: ffffffff8b1d0ca0
RBP: ffffffff8ce07eb8 R08: ffff8880b8e36bab R09: 1ffff110171c6d75
R10: dffffc0000000000 R11: ffffed10171c6d76 R12: 1ffffffff19c0fbc
R13: dffffc0000000000 R14: 1ffffffff19d2688 R15: 0000000000000000
arch_safe_halt arch/x86/include/asm/paravirt.h:108 [inline]
default_idle+0x13/0x20 arch/x86/kernel/process.c:753
default_idle_call+0x6c/0xa0 kernel/sched/idle.c:97
cpuidle_idle_call kernel/sched/idle.c:178 [inline]
do_idle+0x334/0x5c0 kernel/sched/idle.c:302
cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:401
rest_init+0x2e2/0x300 init/main.c:705
arch_call_rest_init+0xe/0x10 init/main.c:801
start_kernel+0x461/0x4e0 init/main.c:1046
x86_64_start_reservations+0x2a/0x30 arch/x86/kernel/head64.c:555
x86_64_start_kernel+0x60/0x60 arch/x86/kernel/head64.c:536
secondary_startup_64_no_verify+0x179/0x17b
</TASK>
Allocated by task 5141:
kasan_save_stack mm/kasan/common.c:46 [inline]
kasan_set_track+0x4e/0x70 mm/kasan/common.c:53
____kasan_kmalloc mm/kasan/common.c:375 [inline]
__kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:384
kmalloc include/linux/slab.h:600 [inline]
kzalloc include/linux/slab.h:721 [inline]
kernfs_fop_open+0x3d2/0xc60 fs/kernfs/file.c:690
do_dentry_open+0x880/0x14b0 fs/open.c:929
do_open fs/namei.c:3683 [inline]
path_openat+0x284f/0x3270 fs/namei.c:3844
do_filp_open+0x1f2/0x430 fs/namei.c:3871
do_sys_openat2+0x134/0x1d0 fs/open.c:1422
do_sys_open fs/open.c:1437 [inline]
__do_sys_openat fs/open.c:1453 [inline]
__se_sys_openat fs/open.c:1448 [inline]
__x64_sys_openat+0x139/0x160 fs/open.c:1448
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
Freed by task 5141:
kasan_save_stack mm/kasan/common.c:46 [inline]
kasan_set_track+0x4e/0x70 mm/kasan/common.c:53
kasan_save_free_info+0x28/0x40 mm/kasan/generic.c:522
____kasan_slab_free+0x126/0x1f0 mm/kasan/common.c:237
kasan_slab_free include/linux/kasan.h:164 [inline]
slab_free_hook mm/slub.c:1811 [inline]
slab_free_freelist_hook+0x130/0x1a0 mm/slub.c:1837
slab_free mm/slub.c:3830 [inline]
__kmem_cache_free+0xba/0x1f0 mm/slub.c:3843
kernfs_fop_release+0x166/0x190 fs/kernfs/file.c:828
__fput+0x221/0x940 fs/file_table.c:418
__do_sys_close fs/open.c:1574 [inline]
__se_sys_close+0x15c/0x1e0 fs/open.c:1559
do_syscall_x64 arch/x86/entry/common.c:46 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
entry_SYSCALL_64_after_hwframe+0x68/0xd2
Last potentially related work creation:
kasan_save_stack+0x3e/0x60 mm/kasan/common.c:46
__kasan_record_aux_stack+0xaf/0xc0 mm/kasan/generic.c:492
insert_work+0x3d/0x310 kernel/workqueue.c:1674
__queue_work+0xcf4/0xfd0 kernel/workqueue.c:1827
call_timer_fn+0x189/0x540 kernel/time/timer.c:1701
expire_timers kernel/time/timer.c:1747 [inline]
__run_timers+0x59c/0x810 kernel/time/timer.c:2023
run_timer_softirq+0x67/0xf0 kernel/time/timer.c:2036
handle_softirqs+0x27d/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
Second to last potentially related work creation:
kasan_save_stack+0x3e/0x60 mm/kasan/common.c:46
__kasan_record_aux_stack+0xaf/0xc0 mm/kasan/generic.c:492
insert_work+0x3d/0x310 kernel/workqueue.c:1674
__queue_work+0xcf4/0xfd0 kernel/workqueue.c:1827
call_timer_fn+0x189/0x540 kernel/time/timer.c:1701
expire_timers kernel/time/timer.c:1747 [inline]
__run_timers+0x59c/0x810 kernel/time/timer.c:2023
run_timer_softirq+0x67/0xf0 kernel/time/timer.c:2036
handle_softirqs+0x27d/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xd3/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
The buggy address belongs to the object at ffff88805ad37000
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 370 bytes inside of
freed 512-byte region [ffff88805ad37000, ffff88805ad37200)
The buggy address belongs to the physical page:
page:ffffea00016b4d00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5ad34
head:ffffea00016b4d00 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0
anon flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000840 ffff888017c41c80 0000000000000000 dead000000000001
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 5900, tgid 5896 (syz.3.11), ts 91569852771, free_ts 32209647102
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x1c1/0x200 mm/page_alloc.c:1582
prep_new_page mm/page_alloc.c:1589 [inline]
get_page_from_freelist+0x2181/0x22a0 mm/page_alloc.c:3221
__alloc_pages+0x1f0/0x460 mm/page_alloc.c:4501
alloc_slab_page+0x5d/0x180 mm/slub.c:1881
allocate_slab mm/slub.c:2028 [inline]
new_slab+0x87/0x2d0 mm/slub.c:2081
___slab_alloc+0xc5c/0x12f0 mm/slub.c:3253
__slab_alloc mm/slub.c:3339 [inline]
__slab_alloc_node mm/slub.c:3392 [inline]
slab_alloc_node mm/slub.c:3485 [inline]
__kmem_cache_alloc_node+0x11f/0x250 mm/slub.c:3534
__do_kmalloc_node mm/slab_common.c:1006 [inline]
__kmalloc_node_track_caller+0xa4/0x230 mm/slab_common.c:1027
__do_krealloc mm/slab_common.c:1402 [inline]
krealloc+0x86/0x120 mm/slab_common.c:1435
copy_array+0x64/0xf0 kernel/bpf/verifier.c:1591
copy_verifier_state+0xb2/0xd50 kernel/bpf/verifier.c:1783
push_stack+0x1b9/0x500 kernel/bpf/verifier.c:2078
check_cond_jmp_op+0x10a4/0x28b0 kernel/bpf/verifier.c:14800
do_check+0x6992/0xd0a0 kernel/bpf/verifier.c:17551
do_check_common+0xacc/0x1410 kernel/bpf/verifier.c:19897
do_check_main kernel/bpf/verifier.c:19960 [inline]
bpf_check+0x65d1/0xec30 kernel/bpf/verifier.c:20628
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1182 [inline]
free_unref_page_prepare+0x7d7/0x8f0 mm/page_alloc.c:2366
free_unref_page+0x32/0x2e0 mm/page_alloc.c:2459
free_contig_range+0xa1/0x150 mm/page_alloc.c:6421
destroy_args+0x7d/0x840 mm/debug_vm_pgtable.c:1015
debug_vm_pgtable+0x411/0x440 mm/debug_vm_pgtable.c:1400
do_one_initcall+0x242/0x790 init/main.c:1210
do_initcall_level+0x13d/0x1f0 init/main.c:1272
do_initcalls+0x69/0xd0 init/main.c:1288
kernel_init_freeable+0x3d9/0x560 init/main.c:1525
kernel_init+0x1d/0x1c0 init/main.c:1415
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
Memory state around the buggy address:
ffff88805ad37000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88805ad37080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88805ad37100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88805ad37180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88805ad37200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
----------------
Code disassembly (best guess):
0: 4e 1c 02 rex.WRX sbb $0x2,%al
3: c3 ret
4: cc int3
5: cc int3
6: cc int3
7: cc int3
8: cc int3
9: cc int3
a: cc int3
b: f3 0f 1e fa endbr64
f: 0f 0b ud2
11: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1)
18: 00 00 00
1b: f3 0f 1e fa endbr64
1f: 66 90 xchg %ax,%ax
21: 0f 00 2d a3 5a 3b 00 verw 0x3b5aa3(%rip) # 0x3b5acb
28: fb sti
29: f4 hlt
* 2a: c3 ret <-- trapping instruction
2b: 66 0f 1f 00 nopw (%rax)
2f: 55 push %rbp
30: 41 57 push %r15
32: 41 56 push %r14
34: 41 54 push %r12
36: 53 push %rbx
37: 50 push %rax
38: 8b 2f mov (%rdi),%ebp
3a: eb 2c jmp 0x68
3c: 89 cb mov %ecx,%ebx
3e: 80 .byte 0x80
3f: f9 stc
Struck through repros no longer work on HEAD.