KASAN: use-after-free Read in device_shutdown (2)

Status: auto-obsoleted due to no activity on 2025/04/25 22:07
Reported-by: syzbot+753f1b48ec417bf9e804@syzkaller.appspotmail.com
First crash: 579d, last: 579d
▶ ▼ Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
linux-5.15 KASAN: use-after-free Read in device_shutdown 19 3 699d 704d 0/3 auto-obsoleted due to no activity on 2024/12/26 22:56
linux-5.15 KASAN: use-after-free Read in device_shutdown (4) 19 10 89d 243d 0/3 upstream: reported on 2025/12/18 09:02
linux-5.15 KASAN: use-after-free Read in device_shutdown (3) 19 2 448d 461d 0/3 auto-obsoleted due to no activity on 2025/09/03 15:39

Sample crash report:
==================================================================
BUG: KASAN: use-after-free in __mutex_waiter_is_first kernel/locking/mutex.c:191 [inline]
BUG: KASAN: use-after-free in __mutex_lock_common+0xe4a/0x25a0 kernel/locking/mutex.c:671
Read of size 8 at addr ffff88807dda8160 by task init/6640

CPU: 0 PID: 6640 Comm: init Not tainted 5.15.176-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e3/0x2d0 lib/dump_stack.c:106
 print_address_description+0x63/0x3b0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:434 [inline]
 kasan_report+0x16b/0x1c0 mm/kasan/report.c:451
 __mutex_waiter_is_first kernel/locking/mutex.c:191 [inline]
 __mutex_lock_common+0xe4a/0x25a0 kernel/locking/mutex.c:671
 __mutex_lock kernel/locking/mutex.c:729 [inline]
 mutex_lock_nested+0x17/0x20 kernel/locking/mutex.c:743
 device_lock include/linux/device.h:760 [inline]
 device_shutdown+0x1fd/0x620 drivers/base/core.c:4548
 kernel_shutdown_prepare kernel/reboot.c:266 [inline]
 kernel_power_off+0x4f/0xb0 kernel/reboot.c:291

Crashes (2):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/01/15 22:06 linux-5.15.y 4735586da88e 968edaf4 .config console log report info ci2-linux-5-15-kasan KASAN: use-after-free Read in device_shutdown
2025/01/15 20:44 linux-5.15.y 4735586da88e 968edaf4 .config console log report info ci2-linux-5-15-kasan KASAN: use-after-free Read in device_shutdown
* Struck through repros no longer work on HEAD.