KASAN: slab-use-after-free Write in tty_init_dev

Status: upstream: reported C repro on 2026/07/31 06:14
Subsystems: serial
Labels: prio:normal
[Documentation on labels]
Reported-by: syzbot+fe63e4d633540f230624@syzkaller.appspotmail.com
First crash: 52d, last: 12d
▶ ▼ ✨ AI Patch Versions (3)
Version Stage Reported Report Link Job
3 moderation 2026/09/10 16:27 Discussion 957ebad8-eaaa-4b1f-923f-1a8b49536793
2 moderation 2026/09/10 11:27 Discussion 0076f60b-d76e-4eb9-b805-b385e7452af0
1 moderation 2026/09/08 12:00 Discussion b41b38ff-60c3-4626-adff-58b24c0a4cbc
▶ ▼ ✨ AI Jobs (5)
ID Workflow Result Correct Bug Created Started Finished Revision
957ebad8 patch-iteration ❓ KASAN: slab-use-after-free Write in tty_init_dev 2026/09/10 16:00 2026/09/10 16:00 2026/09/10 16:27 1fe56c0a
af2372bc patch-iteration ❓ KASAN: slab-use-after-free Write in tty_init_dev 2026/09/10 11:27 2026/09/10 11:27 2026/09/10 12:56 1fe56c0a
0076f60b patch-iteration ❓ KASAN: slab-use-after-free Write in tty_init_dev 2026/09/10 10:29 2026/09/10 10:29 2026/09/10 11:27 1fe56c0a
b41b38ff patching ❓ KASAN: slab-use-after-free Write in tty_init_dev 2026/09/08 09:31 2026/09/08 09:31 2026/09/08 12:00 680aa3e1
7b53c78e assessment-security DenialOfService: ✅ Exploitable: ✅ FilesystemTrigger: ❌ NetworkTrigger: ❌ PeripheralTrigger: ❌ RemoteTrigger: ❌ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ ❓ KASAN: slab-use-after-free Write in tty_init_dev 2026/07/29 01:36 2026/07/29 01:36 2026/07/29 02:22 7be3c40b
▶ ▼ Discussions (4)
Title Replies (including bot) Last reply
[PATCH] usb: gadget: u_serial: fix use-after-free between tty open/close and gserial_free_line 3 (3) 2026/09/10 10:57
[PATCH v2] usb: gadget: u_serial: fix use-after-free between tty open/close and gserial_free_line 1 (1) 2026/09/10 10:53
[syzbot] [serial?] KASAN: slab-use-after-free Write in tty_init_dev 0 (7) 2026/09/10 06:09
[syzbot] Monthly serial report (Aug 2026) 0 (1) 2026/08/04 12:32
▶ ▼ Last patch testing requests (5)
Created Duration User Patch Repo Result
2026/09/10 06:09 14m syedtayyabfarooq08@gmail.com patch upstream OK job log log
2026/09/09 13:06 12m syedtayyabfarooq08@gmail.com patch upstream report job log log
2026/09/09 11:35 8m syedtayyabfarooq08@gmail.com patch upstream error job log
2026/09/09 07:44 13m syedtayyabfarooq08@gmail.com patch upstream report job log log
2026/09/09 07:10 12m syedtayyabfarooq08@gmail.com patch upstream report job log log

Sample crash report:
==================================================================
BUG: KASAN: slab-use-after-free in tty_init_dev.part.0+0x44f/0x470 drivers/tty/tty_io.c:1397
Write of size 8 at addr ffff8880274af128 by task syz-executor119/6040

CPU: 1 UID: 0 PID: 6040 Comm: syz-executor119 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x13d/0x4b0 mm/kasan/report.c:482
 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
 tty_init_dev.part.0+0x44f/0x470 drivers/tty/tty_io.c:1397
 tty_init_dev include/linux/err.h:78 [inline]
 tty_open_by_driver drivers/tty/tty_io.c:2046 [inline]
 tty_open+0x953/0xe20 drivers/tty/tty_io.c:2093
 chrdev_open+0x234/0x6a0 fs/char_dev.c:411
 do_dentry_open+0x6ab/0x14d0 fs/open.c:996
 vfs_open+0x82/0x3f0 fs/open.c:1101
 do_open fs/namei.c:4837 [inline]
 path_openat+0x19fa/0x2440 fs/namei.c:5000
 do_file_open+0x20e/0x430 fs/namei.c:5029
 do_sys_openat2+0x10f/0x1e0 fs/open.c:1417
 do_sys_open fs/open.c:1423 [inline]
 __do_sys_openat fs/open.c:1439 [inline]
 __se_sys_openat fs/open.c:1434 [inline]
 __x64_sys_openat+0x12d/0x210 fs/open.c:1434
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f21702aea1e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007f216fa58158 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f216fa586c0 RCX: 00007f21702aea1e
RDX: 0000000000000002 RSI: 00007f21702fa028 RDI: ffffffffffffff9c
RBP: 0000000000000021 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffebbe3db80 R15: 00007ffebbe3dc68
 </TASK>

Allocated by task 6037:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x2f8/0x6d0 mm/slub.c:5563
 _kmalloc_noprof include/linux/slab.h:991 [inline]
 _kzalloc_noprof include/linux/slab.h:1312 [inline]
 gs_port_alloc drivers/usb/gadget/function/u_serial.c:1218 [inline]
 gserial_alloc_line_no_console+0xac/0x710 drivers/usb/gadget/function/u_serial.c:1298
 gserial_alloc_line+0x16/0xa0 drivers/usb/gadget/function/u_serial.c:1332
 acm_alloc_instance+0xd9/0x160 drivers/usb/gadget/function/f_acm.c:891
 try_get_usb_function_instance+0x136/0x1f0 drivers/usb/gadget/functions.c:28
 usb_get_function_instance+0x16/0x70 drivers/usb/gadget/functions.c:44
 function_make+0x18c/0x3f0 drivers/usb/gadget/configfs.c:626
 configfs_mkdir+0x525/0xd40 fs/configfs/dir.c:1360
 vfs_mkdir+0x364/0x850 fs/namei.c:5410
 filename_mkdirat+0x48b/0x5e0 fs/namei.c:5443
 __do_sys_mkdir fs/namei.c:5470 [inline]
 __se_sys_mkdir fs/namei.c:5467 [inline]
 __x64_sys_mkdir+0x6b/0x90 fs/namei.c:5467
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 6037:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2748 [inline]
 slab_free mm/slub.c:6499 [inline]
 kfree+0x22b/0x6d0 mm/slub.c:6792
 gserial_free_port+0x146/0x2f0 drivers/usb/gadget/function/u_serial.c:1262
 gserial_free_line+0xf8/0x1e0 drivers/usb/gadget/function/u_serial.c:1279
 acm_free_instance+0x3b/0x60 drivers/usb/gadget/function/f_acm.c:875
 usb_put_function_instance+0x89/0xc0 drivers/usb/gadget/functions.c:77
 config_item_cleanup+0x146/0x240 fs/configfs/item.c:128
 config_item_release fs/configfs/item.c:137 [inline]
 kref_put include/linux/kref.h:65 [inline]
 config_item_put fs/configfs/item.c:149 [inline]
 config_item_put+0x93/0xb0 fs/configfs/item.c:146
 configfs_rmdir+0x5e3/0x950 fs/configfs/dir.c:1571
 vfs_rmdir fs/namei.c:5515 [inline]
 vfs_rmdir+0x328/0x8a0 fs/namei.c:5488
 filename_rmdir+0x31a/0x5c0 fs/namei.c:5572
 __do_sys_rmdir fs/namei.c:5595 [inline]
 __se_sys_rmdir fs/namei.c:5592 [inline]
 __x64_sys_rmdir+0x46/0x70 fs/namei.c:5592
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff8880274af000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 296 bytes inside of
 freed 2048-byte region [ffff8880274af000, ffff8880274af800)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880274ae000 pfn:0x274a8
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000240 ffff88801c042f00 ffffea0000fca410 ffffea0000bd2610
raw: ffff8880274ae000 0000000000080007 00000000f5000000 0000000000000000
head: 00fff00000000240 ffff88801c042f00 ffffea0000fca410 ffffea0000bd2610
head: ffff8880274ae000 0000000000080007 00000000f5000000 0000000000000000
head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5597, tgid 5597 (dhcpcd), ts 32458864732
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1871
 prep_new_page mm/page_alloc.c:1879 [inline]
 get_page_from_freelist+0x110d/0x35d0 mm/page_alloc.c:3943
 __alloc_frozen_pages_noprof+0x2eb/0x3300 mm/page_alloc.c:5436
 alloc_slab_page mm/slub.c:3347 [inline]
 allocate_slab mm/slub.c:3462 [inline]
 new_slab+0xa9/0x6e0 mm/slub.c:3513
 refill_objects+0xe3/0x410 mm/slub.c:7410
 refill_sheaf mm/slub.c:2885 [inline]
 __pcs_replace_empty_main+0x35e/0x650 mm/slub.c:4774
 alloc_from_pcs mm/slub.c:4850 [inline]
 slab_alloc_node mm/slub.c:4984 [inline]
 __do_kmalloc_node mm/slub.c:5413 [inline]
 __kvmalloc_node_noprof+0x7bb/0x9b0 mm/slub.c:7005
 bpf_jit_binary_pack_alloc+0xd2/0x2b0 kernel/bpf/core.c:1221
 bpf_int_jit_compile+0x526/0x1820 arch/x86/net/bpf_jit_comp.c:4077
 bpf_prog_jit_compile kernel/bpf/core.c:2639 [inline]
 __bpf_prog_select_runtime+0x896/0xbd0 kernel/bpf/core.c:2689
 bpf_migrate_filter net/core/filter.c:1322 [inline]
 bpf_prepare_filter+0xd32/0x11e0 net/core/filter.c:1370
 bpf_prog_create_from_user+0x1df/0x2e0 net/core/filter.c:1464
 seccomp_prepare_filter kernel/seccomp.c:701 [inline]
 seccomp_prepare_user_filter kernel/seccomp.c:738 [inline]
 seccomp_set_mode_filter kernel/seccomp.c:1988 [inline]
 do_seccomp+0x870/0x27c0 kernel/seccomp.c:2108
 prctl_set_seccomp+0x4b/0x70 kernel/seccomp.c:2161
 __do_sys_prctl+0xe7b/0x2270 kernel/sys.c:2626
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
page last free pid 5573 tgid 5573 ts 31201307355 stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 __free_pages_prepare mm/page_alloc.c:1418 [inline]
 __free_frozen_pages+0x79f/0x10f0 mm/page_alloc.c:2962
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4683 [inline]
 slab_alloc_node mm/slub.c:4996 [inline]
 kmem_cache_alloc_noprof+0x269/0x6a0 mm/slub.c:5010
 alloc_filename fs/namei.c:147 [inline]
 do_getname+0x35/0x390 fs/namei.c:187
 getname include/linux/fs.h:2557 [inline]
 class_filename_constructor include/linux/fs.h:2584 [inline]
 user_statfs+0x8c/0x1a0 fs/statfs.c:102
 __do_sys_statfs+0x8d/0x100 fs/statfs.c:194
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff8880274af000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8880274af080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8880274af100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                  ^
 ffff8880274af180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8880274af200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Crashes (7):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/04 12:52 git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git bc35965f6940 746171ee .config console log report C ci-qemu-upstream KASAN: slab-use-after-free Write in tty_init_dev
2026/09/04 12:38 git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git bc35965f6940 746171ee .config console log report C ci-qemu-upstream KASAN: slab-use-after-free Write in tty_init_dev
2026/07/29 12:21 upstream fc02acf6ac0c 19622d9d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: slab-use-after-free Write in tty_init_dev
2026/07/29 12:19 upstream fc02acf6ac0c 19622d9d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: slab-use-after-free Write in tty_init_dev
2026/07/28 14:15 upstream 62cc90241548 45ae1df4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root KASAN: slab-use-after-free Write in tty_init_dev
2026/07/27 13:12 upstream f5098b6bae76 492bab15 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: slab-use-after-free Write in tty_init_dev
2026/07/27 06:06 upstream 4235cb24ec1e 492bab15 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: slab-use-after-free Write in tty_init_dev
* Struck through repros no longer work on HEAD.