ci starts bisection 2026-08-17 02:39:06.009032108 +0000 UTC m=+216289.893988745 bisecting cause commit starting from 9a143525f62bd6a871a49a61a5b3e07f5d54f654 building syzkaller on e4ef95d66b43846d6ffc71464fef148e16493289 ensuring issue is reproducible on original commit 9a143525f62bd6a871a49a61a5b3e07f5d54f654 testing commit 9a143525f62bd6a871a49a61a5b3e07f5d54f654 gcc compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: d12b7b0717d1f74a716f11a6a924632c173ca671153304b5ccc732ff7a69c9db all runs: crashed: KASAN: slab-use-after-free Read in ep_open representative crash: KASAN: slab-use-after-free Read in ep_open, types: [KASAN-USE-AFTER-FREE-READ] check whether we can drop unnecessary instrumentation disabling configs for [locking atomic_sleep hang memleak ubsan bug_or_warning], they are not needed testing commit 9a143525f62bd6a871a49a61a5b3e07f5d54f654 gcc compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 3cb22bff6e7faad1f5857ccf1070f2b4a6e09b6af5af81ea9ec7444682fbc44b all runs: crashed: KASAN: slab-use-after-free Read in ep_open representative crash: KASAN: slab-use-after-free Read in ep_open, types: [KASAN-USE-AFTER-FREE-READ] the bug reproduces without the instrumentation disabling configs for [hang memleak ubsan bug_or_warning locking atomic_sleep], they are not needed kconfig minimization: base=4168 full=8595 leaves diff=2130 split chunks (needed=false): <2130> split chunk #0 of len 2130 into 5 parts testing without sub-chunk 1/5 disabling configs for [locking atomic_sleep hang memleak ubsan bug_or_warning], they are not needed testing commit 9a143525f62bd6a871a49a61a5b3e07f5d54f654 gcc compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 17a4d761750d92efe5993823dd5b55b4ea0b3d8c1e04e23accefddcb60bd3d94 all runs: crashed: KASAN: slab-use-after-free Read in ep_open representative crash: KASAN: slab-use-after-free Read in ep_open, types: [KASAN-USE-AFTER-FREE-READ] the chunk can be dropped testing without sub-chunk 2/5 disabling configs for [hang memleak ubsan bug_or_warning locking atomic_sleep], they are not needed testing commit 9a143525f62bd6a871a49a61a5b3e07f5d54f654 gcc compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: d467ccf3e975a9829a59cbe6bb35c4d1fe01cbf0b270f7a37eefbbc1b0977a2d all runs: crashed: KASAN: slab-use-after-free Read in ep_open representative crash: KASAN: slab-use-after-free Read in ep_open, types: [KASAN-USE-AFTER-FREE-READ] the chunk can be dropped testing without sub-chunk 3/5 disabling configs for [memleak ubsan bug_or_warning locking atomic_sleep hang], they are not needed testing commit 9a143525f62bd6a871a49a61a5b3e07f5d54f654 gcc compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 218dc2365a952ffa7453ad91f4e215b47ec83b72b4ac4d89370ba17b89793a54 all runs: crashed: KASAN: slab-use-after-free Read in ep_open representative crash: KASAN: slab-use-after-free Read in ep_open, types: [KASAN-USE-AFTER-FREE-READ] the chunk can be dropped testing without sub-chunk 4/5 disabling configs for [hang memleak ubsan bug_or_warning locking atomic_sleep], they are not needed testing commit 9a143525f62bd6a871a49a61a5b3e07f5d54f654 gcc compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: acc22dcb386ba382c690e8dfe369cf3cd503dcb941fe513a8b42e2ea1bb6437d all runs: crashed: KASAN: slab-use-after-free Read in ep_open representative crash: KASAN: slab-use-after-free Read in ep_open, types: [KASAN-USE-AFTER-FREE-READ] the chunk can be dropped testing without sub-chunk 5/5 disabling configs for [atomic_sleep hang memleak ubsan bug_or_warning locking], they are not needed testing commit 9a143525f62bd6a871a49a61a5b3e07f5d54f654 gcc compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 48786534d56287177d62090efca30ea28cd9d4dae71dd252cf466ccf2b5096c1 all runs: OK false negative chance: 0.000 minimized to 426 configs; suspects: [ATM BCMA BLK_DEV_ZONED BPF_SYSCALL CARDBUS CFG80211 CFG80211_WEXT COMMON_CLK CONTIG_ALLOC DVB_CORE EXTCON GPIOLIB HID_ZEROPLUS I2C_MUX IIO IOMMUFD KVM KVM_INTEL LIBNVDIMM MEDIA_ANALOG_TV_SUPPORT MEDIA_CAMERA_SUPPORT MEDIA_CEC_SUPPORT MEDIA_CONTROLLER MEDIA_DIGITAL_TV_SUPPORT MEDIA_RADIO_SUPPORT MEDIA_SDR_SUPPORT MEDIA_SUPPORT MEDIA_TEST_SUPPORT MEDIA_USB_SUPPORT MEMORY_HOTPLUG MEMORY_HOTREMOVE MFD_VIPERBOARD NOP_USB_XCEIV PARPORT PCCARD PCMCIA PHONET RADIO_ADAPTERS RADIO_SI470X RADIO_SI4713 RC_CORE RFKILL SND SOUND SPI SSB TAP TARGET_CORE TUN USB_AMD5536UDC USB_ATM USB_C67X00_HCD USB_CATC USB_CDC_PHONET USB_CDNS2_UDC USB_CDNS3 USB_CDNS3_GADGET USB_CDNS3_HOST USB_CDNS3_PCI_WRAP USB_CDNSP_PCI USB_CDNS_SUPPORT USB_CHAOSKEY USB_CHIPIDEA USB_CHIPIDEA_GENERIC USB_CHIPIDEA_HOST USB_CHIPIDEA_MSM USB_CHIPIDEA_NPCM USB_CHIPIDEA_PCI USB_CHIPIDEA_UDC USB_CONFIGFS USB_CONFIGFS_ACM USB_CONFIGFS_ECM USB_CONFIGFS_ECM_SUBSET USB_CONFIGFS_EEM USB_CONFIGFS_F_FS USB_CONFIGFS_F_HID USB_CONFIGFS_F_LB_SS USB_CONFIGFS_F_MIDI USB_CONFIGFS_F_MIDI2 USB_CONFIGFS_F_PRINTER USB_CONFIGFS_F_TCM USB_CONFIGFS_F_UAC1 USB_CONFIGFS_F_UAC1_LEGACY USB_CONFIGFS_F_UAC2 USB_CONFIGFS_F_UVC USB_CONFIGFS_MASS_STORAGE USB_CONFIGFS_NCM USB_CONFIGFS_OBEX USB_CONFIGFS_PHONET USB_CONFIGFS_RNDIS USB_CONFIGFS_SERIAL USB_CONN_GPIO USB_CXACRU USB_CYPRESS_CY7C63 USB_CYTHERM USB_DSBR USB_DUMMY_HCD USB_DWC2 USB_DWC2_HOST USB_DWC2_PCI USB_DWC3 USB_DWC3_GADGET USB_DWC3_GENERIC_PLAT USB_DWC3_HAPS USB_DWC3_OF_SIMPLE USB_DWC3_PCI USB_DWC3_ULPI USB_DYNAMIC_MINORS USB_EG20T USB_EHCI_FSL USB_EHCI_HCD_PLATFORM USB_EHCI_ROOT_HUB_TT USB_EHSET_TEST_FIXTURE USB_EMI26 USB_EMI62 USB_EPSON2888 USB_EZUSB_FX2 USB_FEW_INIT_RETRIES USB_F_ACM USB_F_ECM USB_F_EEM USB_F_FS USB_F_HID USB_F_MASS_STORAGE USB_F_MIDI USB_F_MIDI2 USB_F_NCM USB_F_OBEX USB_F_PHONET USB_F_PRINTER USB_F_RNDIS USB_F_SERIAL USB_F_SS_LB USB_F_SUBSET USB_F_TCM USB_F_UAC1 USB_F_UAC1_LEGACY USB_F_UAC2 USB_F_UVC USB_GADGET USB_GADGETFS USB_GADGET_DEBUG_FILES USB_GADGET_DEBUG_FS USB_GL860 USB_GOKU USB_GR_UDC USB_GSPCA USB_GSPCA_BENQ USB_GSPCA_CONEX USB_GSPCA_CPIA1 USB_GSPCA_DTCS033 USB_GSPCA_ETOMS USB_GSPCA_FINEPIX USB_GSPCA_JEILINJ USB_GSPCA_JL2005BCD USB_GSPCA_KINECT USB_GSPCA_KONICA USB_GSPCA_MARS USB_GSPCA_MR97310A USB_GSPCA_NW80X USB_GSPCA_OV519 USB_GSPCA_OV534 USB_GSPCA_OV534_9 USB_GSPCA_PAC207 USB_GSPCA_PAC7302 USB_GSPCA_PAC7311 USB_GSPCA_SE401 USB_GSPCA_SN9C2028 USB_GSPCA_SN9C20X USB_GSPCA_SONIXB USB_GSPCA_SONIXJ USB_GSPCA_SPCA1528 USB_GSPCA_SPCA500 USB_GSPCA_SPCA501 USB_GSPCA_SPCA505 USB_GSPCA_SPCA506 USB_GSPCA_SPCA508 USB_GSPCA_SPCA561 USB_GSPCA_SQ905 USB_GSPCA_SQ905C USB_GSPCA_SQ930X USB_GSPCA_STK014 USB_GSPCA_STK1135 USB_GSPCA_STV0680 USB_GSPCA_SUNPLUS USB_GSPCA_T613 USB_GSPCA_TOPRO USB_GSPCA_TOUPTEK USB_GSPCA_TV8532 USB_GSPCA_VC032X USB_GSPCA_VICAM USB_GSPCA_XIRLINK_CIT USB_GSPCA_ZC3XX USB_HACKRF USB_HCD_BCMA USB_HCD_SSB USB_HSIC_USB3503 USB_HSIC_USB4604 USB_HSO USB_HUB_USB251XB USB_IDMOUSE USB_IOWARRIOR USB_IPHETH USB_ISIGHTFW USB_ISP116X_HCD USB_ISP1301 USB_ISP1760 USB_ISP1760_DUAL_ROLE USB_ISP1760_HCD USB_ISP1761_UDC USB_KAWETH USB_KC2190 USB_KEENE USB_LAN78XX USB_LCD USB_LD USB_LEDS_TRIGGER_USBPORT USB_LED_TRIG USB_LEGOTOWER USB_LGM_PHY USB_LIBCOMPOSITE USB_LINK_LAYER_TEST USB_M5602 USB_MA901 USB_MAX3420_UDC USB_MAX3421_HCD USB_MDC800 USB_MICROTEK USB_MR800 USB_MSI2500 USB_MUSB_DUAL_ROLE USB_MUSB_HDRC USB_NET2280 USB_NET_AQC111 USB_NET_AX88179_178A USB_NET_AX8817X USB_NET_CDCETHER USB_NET_CDC_EEM USB_NET_CDC_MBIM USB_NET_CDC_NCM USB_NET_CDC_SUBSET USB_NET_CDC_SUBSET_ENABLE USB_NET_CH9200 USB_NET_CX82310_ETH USB_NET_DM9601 USB_NET_GL620A USB_NET_HUAWEI_CDC_NCM USB_NET_INT51X1 USB_NET_KALMIA USB_NET_MCS7830 USB_NET_NET1080 USB_NET_PLUSB USB_NET_QMI_WWAN USB_NET_RNDIS_HOST USB_NET_SMSC75XX USB_NET_SMSC95XX USB_NET_SR9700 USB_NET_SR9800 USB_NET_ZAURUS USB_OHCI_HCD_PLATFORM USB_OTG USB_OTG_FSM USB_OXU210HP_HCD USB_PEGASUS USB_PULSE8_CEC USB_PWC USB_PWC_INPUT_EVDEV USB_PXA27X USB_R8A66597 USB_R8A66597_HCD USB_RAINSHADOW_CEC USB_RAREMONO USB_RAW_GADGET USB_RTL8150 USB_RTL8152 USB_RTL8153_ECM USB_S2255 USB_SERIAL USB_SERIAL_AIRCABLE USB_SERIAL_ARK3116 USB_SERIAL_BELKIN USB_SERIAL_CH341 USB_SERIAL_CONSOLE USB_SERIAL_CP210X USB_SERIAL_CYBERJACK USB_SERIAL_CYPRESS_M8 USB_SERIAL_DEBUG USB_SERIAL_DIGI_ACCELEPORT USB_SERIAL_EDGEPORT USB_SERIAL_EDGEPORT_TI USB_SERIAL_EMPEG USB_SERIAL_F81232 USB_SERIAL_F8153X USB_SERIAL_FTDI_SIO USB_SERIAL_GARMIN USB_SERIAL_GENERIC USB_SERIAL_IPAQ USB_SERIAL_IPW USB_SERIAL_IR USB_SERIAL_IUU USB_SERIAL_KEYSPAN USB_SERIAL_KEYSPAN_PDA USB_SERIAL_KLSI USB_SERIAL_KOBIL_SCT USB_SERIAL_MCT_U232 USB_SERIAL_METRO USB_SERIAL_MOS7715_PARPORT USB_SERIAL_MOS7720 USB_SERIAL_MOS7840 USB_SERIAL_MXUPORT USB_SERIAL_NAVMAN USB_SERIAL_OMNINET USB_SERIAL_OPTICON USB_SERIAL_OPTION USB_SERIAL_OTI6858 USB_SERIAL_PL2303 USB_SERIAL_QCAUX USB_SERIAL_QT2 USB_SERIAL_QUALCOMM USB_SERIAL_SAFE USB_SERIAL_SIERRAWIRELESS USB_SERIAL_SIMPLE USB_SERIAL_SPCP8X5 USB_SERIAL_SSU100 USB_SERIAL_SYMBOL USB_SERIAL_TI USB_SERIAL_UPD78F0730 USB_SERIAL_VISOR USB_SERIAL_WHITEHEAT USB_SERIAL_WISHBONE USB_SERIAL_WWAN USB_SERIAL_XR USB_SERIAL_XSENS_MT USB_SEVSEG USB_SI470X USB_SI4713 USB_SIERRA_NET USB_SISUSBVGA USB_SL811_CS USB_SL811_HCD USB_SL811_HCD_ISO USB_SNP_CORE USB_SPEEDTOUCH USB_STORAGE_ALAUDA USB_STORAGE_CYPRESS_ATACB USB_STORAGE_DATAFAB USB_STORAGE_ENE_UB6250 USB_STORAGE_FREECOM USB_STORAGE_ISD200 USB_STORAGE_JUMPSHOT USB_STORAGE_KARMA USB_STORAGE_ONETOUCH USB_STORAGE_SDDR09 USB_STORAGE_SDDR55 USB_STORAGE_USBAT USB_STV06XX USB_TEST USB_TMC USB_TRANCEVIBRATOR USB_UAS USB_UEAGLEATM USB_ULPI_BUS USB_USBNET USB_USS720 USB_U_AUDIO USB_U_ETHER USB_U_SERIAL USB_VIDEO_CLASS USB_VIDEO_CLASS_INPUT_EVDEV USB_VL600 USB_WDM USB_XHCI_DBGCAP USB_XHCI_PCI_RENESAS USB_XHCI_PLATFORM USB_XUSBATM USB_YUREX USERFAULTFD USERIO USER_RETURN_NOTIFIER UVC_COMMON U_SERIAL_CONSOLE V4L2_MEM2MEM_DEV V4L_TEST_DRIVERS VALIDATE_FS_PARSER VDPA VDPA_SIM VDPA_SIM_BLOCK VDPA_SIM_NET VETH VFIO VFIO_DEVICE_CDEV VFIO_PCI VFIO_PCI_CORE VFIO_PCI_INTX VFIO_VIRQFD VGASTATE VHOST VHOST_CROSS_ENDIAN_LEGACY VHOST_IOTLB VHOST_NET VHOST_RING VHOST_TASK VHOST_VDPA VHOST_VSOCK VIDEO VIDEOBUF2_CORE VIDEOBUF2_DMA_CONTIG VIDEOBUF2_DMA_SG VIDEOBUF2_MEMOPS VIDEOBUF2_V4L2 VIDEOBUF2_VMALLOC VIDEOMODE_HELPERS VIDEO_AU0828 VIDEO_AU0828_RC VIDEO_AU0828_V4L2 VIDEO_CS53L32A VIDEO_CX231XX VIDEO_CX231XX_ALSA VIDEO_CX231XX_DVB VIDEO_CX231XX_RC VIDEO_CX2341X VIDEO_CX25840 VIDEO_DEV VIDEO_EM28XX VIDEO_EM28XX_ALSA VIDEO_EM28XX_DVB VIDEO_EM28XX_RC VIDEO_EM28XX_V4L2 VIDEO_GO7007 VIDEO_GO7007_LOADER VIDEO_GO7007_USB VIDEO_GO7007_USB_S2250_BOARD VIDEO_HDPVR VIDEO_MSP3400 VIDEO_PVRUSB2 VIDEO_PVRUSB2_DVB VIDEO_PVRUSB2_SYSFS VIDEO_SAA711X VIDEO_STK1160 VIDEO_TUNER VIDEO_TVEEPROM VIDEO_USBTV VIDEO_V4L2_I2C VIDEO_V4L2_SUBDEV_API VIDEO_V4L2_TPG VIDEO_VICODEC VIDEO_VIM2M VIDEO_VIMC VIDEO_VIVID VIDEO_VIVID_CEC VIDEO_WM8775 VIPERBOARD_ADC VIRTIO_BALLOON VIRTIO_DMA_SHARED_BUFFER VIRTIO_MEM VIRTIO_MMIO VIRTIO_MMIO_CMDLINE_DEVICES VIRTIO_PMEM VIRTIO_VDPA VIRTIO_VSOCKETS VIRTIO_VSOCKETS_COMMON VIRT_WIFI VIRT_XFER_TO_GUEST_WORK VLAN_8021Q VLAN_8021Q_GVRP VLAN_8021Q_MVRP VMAP_PFN VMWARE_VMCI VMXNET3 VP_VDPA VSOCKETS VSOCKETS_DIAG VSOCKETS_LOOPBACK VSOCKMON VT_HW_CONSOLE_BINDING WANT_DEV_COREDUMP WEXT_CORE WEXT_PROC WIREGUARD WIRELESS WLAN WLAN_VENDOR_ADMTEK WLAN_VENDOR_SILABS X86_FRED X86_SGX X86_SGX_KVM X86_USER_SHADOW_STACK X86_X32_ABI XDP_SOCKETS XDP_SOCKETS_DIAG XFRM_ESPINTCP XFRM_INTERFACE XFRM_IPCOMP XFRM_MIGRATE XFRM_OFFLOAD XFRM_STATISTICS XFRM_SUB_POLICY XFRM_USER_COMPAT XFS_BTREE_IN_MEM XFS_DRAIN_INTENTS XFS_FS XFS_LIVE_HOOKS XFS_MEMORY_BUFS XFS_ONLINE_REPAIR XFS_ONLINE_SCRUB XFS_POSIX_ACL XFS_QUOTA XFS_RT XILLYBUS_CLASS XILLYUSB XOR_BLOCKS XOR_BLOCKS_ARCH YENTA YENTA_ENE_TUNE YENTA_O2 YENTA_RICOH YENTA_TI YENTA_TOSHIBA ZEROPLUS_FF ZLIB_DEFLATE ZONEFS_FS ZRAM ZRAM_BACKEND_FORCE_LZO ZRAM_BACKEND_LZO ZRAM_DEF_COMP_LZO ZSMALLOC ZSTD_COMPRESS ZSWAP ZSWAP_COMPRESSOR_DEFAULT_842 ZSWAP_DEFAULT_ON ZSWAP_SHRINKER_DEFAULT_ON] disabling configs for [locking atomic_sleep hang memleak ubsan bug_or_warning], they are not needed picked [v7.1 v7.0 v6.19 v6.17 v6.15 v6.13 v6.11 v6.9 v6.6 v6.3 v6.0 v5.17 v5.14 v5.11 v5.8 v5.5 v5.2 v4.20 v4.19] out of 44 release tags testing release v7.1 testing commit 8cd9520d35a6c38db6567e97dd93b1f11f185dc6 gcc compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 633e486b3405a6ee1f3740b1df7099b128f3060afd0f2ebc0e2612d759b7b484 all runs: crashed: KASAN: slab-use-after-free Read in ep_open representative crash: KASAN: slab-use-after-free Read in ep_open, types: [KASAN-USE-AFTER-FREE-READ] testing release v7.0 testing commit 028ef9c96e96197026887c0f092424679298aae8 gcc compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 0ea71d9f54939651fc6c3cf8c02ba0526066326bbefa33ad241452874a4677ac run #0: crashed: KASAN: slab-use-after-free Read in ep_open run #1: crashed: KASAN: slab-use-after-free Read in ep_open run #2: crashed: KASAN: slab-use-after-free Read in ep_open run #3: crashed: KASAN: slab-use-after-free Read in ep_open run #4: crashed: KASAN: slab-use-after-free Read in ep_open run #5: crashed: KASAN: slab-use-after-free Read in ep_open run #6: crashed: KASAN: slab-use-after-free Read in ep_open run #7: crashed: KASAN: slab-use-after-free Read in ep_open run #8: OK run #9: OK representative crash: KASAN: slab-use-after-free Read in ep_open, types: [KASAN-USE-AFTER-FREE-READ] testing release v6.19 testing commit 05f7e89ab9731565d8a62e3b5d1ec206485eeb0b gcc compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 272c2e6d1437e39e420f5dad2acbccbb0142057b437c9c3644ef061894b6c02c all runs: crashed: KASAN: slab-use-after-free Read in ep_open representative crash: KASAN: slab-use-after-free Read in ep_open, types: [KASAN-USE-AFTER-FREE-READ] testing release v6.17 testing commit e5f0a698b34ed76002dc5cff3804a61c80233a7a gcc compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: f4171df9ba14f4eee9b235c60152671114c6891a0ae7e5761adc73db80ba3bdb all runs: crashed: KASAN: slab-use-after-free Read in ep_open representative crash: KASAN: slab-use-after-free Read in ep_open, types: [KASAN-USE-AFTER-FREE-READ] testing release v6.15 testing commit 0ff41df1cb268fc69e703a08a57ee14ae967d0ca gcc compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 3e8b3034dd02add485a7bbb5f17fc413db0980df85ae5c9d86d5b8adbd2e845d run #0: crashed: KASAN: slab-use-after-free Read in ep_open run #1: crashed: KASAN: slab-use-after-free Read in ep_open run #2: crashed: KASAN: slab-use-after-free Read in ep_open run #3: crashed: KASAN: slab-use-after-free Read in ep_open run #4: crashed: KASAN: slab-use-after-free Read in ep_open run #5: crashed: KASAN: slab-use-after-free Read in ep_open run #6: crashed: KASAN: slab-use-after-free Read in ep_open run #7: crashed: KASAN: slab-use-after-free Read in ep_open run #8: crashed: KASAN: slab-use-after-free Read in ep_open run #9: OK representative crash: KASAN: slab-use-after-free Read in ep_open, types: [KASAN-USE-AFTER-FREE-READ] testing release v6.13 testing commit ffd294d346d185b70e28b1a28abe367bbfe53c04 gcc compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: a1cbc41a04d85c3d40f3ec75b2a7f76f08c460c41880f556d7214d99bc8a6d50 all runs: crashed: KASAN: slab-use-after-free Read in ep_open representative crash: KASAN: slab-use-after-free Read in ep_open, types: [KASAN-USE-AFTER-FREE-READ] testing release v6.11 testing commit 98f7e32f20d28ec452afb208f9cffc08448a2652 gcc compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 0e2f874592aedc39979e95bd7c970f943970c2071993a96773de76c82e9db87b all runs: OK false negative chance: 0.000 # git bisect start ffd294d346d185b70e28b1a28abe367bbfe53c04 98f7e32f20d28ec452afb208f9cffc08448a2652 Bisecting: 14399 revisions left to test after this (roughly 14 steps) [a3c1185e931929255003c094a9bd4b7516238d71] Merge branch 'bna-remove-error-checking-for-debugfs-create-apis' testing commit a3c1185e931929255003c094a9bd4b7516238d71 gcc compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: a286158160ff3c41fc285d0e500836e8e4a8b49383a4713f2e3e2171cdff8f76 all runs: OK false negative chance: 0.000 # git bisect good a3c1185e931929255003c094a9bd4b7516238d71 Bisecting: 6418 revisions left to test after this (roughly 13 steps) [28eb75e178d389d325f1666e422bc13bbbb9804c] Merge tag 'drm-next-2024-11-21' of https://gitlab.freedesktop.org/drm/kernel testing commit 28eb75e178d389d325f1666e422bc13bbbb9804c gcc compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 68e8c13cae2704816c7bbdec77f9b473a6cb8ef649445dda8958ff9052a67a8b run #0: crashed: KASAN: slab-use-after-free Read in ep_open run #1: crashed: KASAN: slab-use-after-free Read in ep_open run #2: crashed: KASAN: slab-use-after-free Read in ep_open run #3: crashed: KASAN: slab-use-after-free Read in ep_open run #4: crashed: KASAN: slab-use-after-free Read in ep_open run #5: crashed: KASAN: slab-use-after-free Read in ep_open run #6: crashed: KASAN: slab-use-after-free Read in ep_open run #7: crashed: KASAN: slab-use-after-free Read in ep_open run #8: OK run #9: OK representative crash: KASAN: slab-use-after-free Read in ep_open, types: [KASAN-USE-AFTER-FREE-READ] # git bisect bad 28eb75e178d389d325f1666e422bc13bbbb9804c Bisecting: 4142 revisions left to test after this (roughly 12 steps) [79caa6c88ac484111b24488eb9fe1c86a3d18016] Merge tag 'asm-generic-3.13' of git://git.kernel.org/pub/scm/linux/kernel/git/arnd/asm-generic testing commit 79caa6c88ac484111b24488eb9fe1c86a3d18016 gcc compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: e3d0d633165bf90a18e5bb82a0b07997902477f1ad04f799b5d4d57363a692d3 run #0: crashed: KASAN: slab-use-after-free Read in ep_open run #1: crashed: KASAN: slab-use-after-free Read in ep_open run #2: crashed: KASAN: slab-use-after-free Read in ep_open run #3: crashed: KASAN: slab-use-after-free Read in ep_open run #4: crashed: KASAN: slab-use-after-free Read in ep_open run #5: crashed: KASAN: slab-use-after-free Read in ep_open run #6: crashed: KASAN: slab-use-after-free Read in ep_open run #7: crashed: KASAN: slab-use-after-free Read in ep_open run #8: crashed: KASAN: slab-use-after-free Read in ep_open run #9: OK representative crash: KASAN: slab-use-after-free Read in ep_open, types: [KASAN-USE-AFTER-FREE-READ] # git bisect bad 79caa6c88ac484111b24488eb9fe1c86a3d18016 Bisecting: 1952 revisions left to test after this (roughly 11 steps) [9aa4c37f71b9a0a4f51692fbb874888c139805ce] Merge tag 'm68k-for-v6.13-tag1' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k testing commit 9aa4c37f71b9a0a4f51692fbb874888c139805ce gcc compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: c69405de27267ed4af7230282dba30afaf85787f88075bafdd9d9bf2a8d6c9f5 run #0: crashed: KASAN: slab-use-after-free Read in ep_open run #1: crashed: KASAN: slab-use-after-free Read in ep_open run #2: OK run #3: OK run #4: OK run #5: OK run #6: OK run #7: OK run #8: OK run #9: OK representative crash: KASAN: slab-use-after-free Read in ep_open, types: [KASAN-USE-AFTER-FREE-READ] # git bisect bad 9aa4c37f71b9a0a4f51692fbb874888c139805ce Bisecting: 942 revisions left to test after this (roughly 10 steps) [2b1ef80d68100a064f94fb2e658881b9f260cf08] btrfs: remove redundant level argument from read_block_for_search() testing commit 2b1ef80d68100a064f94fb2e658881b9f260cf08 gcc compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 7bce3b206cea41f95547d5022ac3f003aceafd0b6c659cdc9f953c09388bcc87 all runs: OK false negative chance: 0.000 # git bisect good 2b1ef80d68100a064f94fb2e658881b9f260cf08 Bisecting: 486 revisions left to test after this (roughly 9 steps) [c6d64479d6093a5c3d709d4cc992a5344877cc3c] Merge tag 'pull-statx' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs testing commit c6d64479d6093a5c3d709d4cc992a5344877cc3c gcc compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 22ae896fe779b8eedb173a339008193c92ca747a35019048ffb681ace339cb74 all runs: OK false negative chance: 0.000 # git bisect good c6d64479d6093a5c3d709d4cc992a5344877cc3c Bisecting: 262 revisions left to test after this (roughly 8 steps) [77a0cfafa9af9c0d5b43534eb90d530c189edca1] Merge tag 'for-6.13/block-20241118' of git://git.kernel.dk/linux testing commit 77a0cfafa9af9c0d5b43534eb90d530c189edca1 gcc compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: b5e5a434af13c581b529095943ce0690d384f072b05a09f02b3235a0262ba65c all runs: OK false negative chance: 0.000 # git bisect good 77a0cfafa9af9c0d5b43534eb90d530c189edca1 Bisecting: 131 revisions left to test after this (roughly 7 steps) [cd5e5a3723001aa750ed64c97e36872f8b0a6fb0] s390/dasd: Convert to use flag output macros testing commit cd5e5a3723001aa750ed64c97e36872f8b0a6fb0 gcc compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 8bc339e8f4d7f91ab622a4ae25884dfb66c15565fe53b2388d4b99cf62bbcb0d all runs: OK false negative chance: 0.000 # git bisect good cd5e5a3723001aa750ed64c97e36872f8b0a6fb0 Bisecting: 65 revisions left to test after this (roughly 6 steps) [af0a2ffef0e6d23412dd55df29f5caef8f3583f2] io_uring: avoid normal tw intermediate fallback testing commit af0a2ffef0e6d23412dd55df29f5caef8f3583f2 gcc compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: b685e56d9d8b74ca6a19353079adde754c5ba009889c4d5a04957495626425cf run #0: crashed: KASAN: slab-use-after-free Read in ep_open run #1: crashed: KASAN: slab-use-after-free Read in ep_open run #2: crashed: KASAN: slab-use-after-free Read in ep_open run #3: crashed: KASAN: slab-use-after-free Read in ep_open run #4: crashed: KASAN: slab-use-after-free Read in ep_open run #5: crashed: KASAN: slab-use-after-free Read in ep_open run #6: crashed: KASAN: slab-use-after-free Read in ep_open run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK representative crash: KASAN: slab-use-after-free Read in ep_open, types: [KASAN-USE-AFTER-FREE-READ] # git bisect bad af0a2ffef0e6d23412dd55df29f5caef8f3583f2 Bisecting: 32 revisions left to test after this (roughly 5 steps) [0a54a7dd0a12b777721f5ca55c9d6331d2a46b01] io_uring: switch struct ext_arg from __kernel_timespec to timespec64 testing commit 0a54a7dd0a12b777721f5ca55c9d6331d2a46b01 gcc compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: cd22e0063ac577795144ae612566de6daa2daa420af51ef08308a00b434878f7 all runs: OK false negative chance: 0.000 # git bisect good 0a54a7dd0a12b777721f5ca55c9d6331d2a46b01 Bisecting: 16 revisions left to test after this (roughly 4 steps) [4007c3d8c22a2025367953f4ee36ae106a69d855] io_uring/rsrc: add io_reset_rsrc_node() helper testing commit 4007c3d8c22a2025367953f4ee36ae106a69d855 gcc compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: ff35022bfd8d59ac0aa0877b62f79b3168c4a9ba5061ea863c0c900f08c864c9 run #0: crashed: KASAN: slab-use-after-free Read in ep_open run #1: crashed: KASAN: slab-use-after-free Read in ep_open run #2: crashed: KASAN: slab-use-after-free Read in ep_open run #3: crashed: KASAN: slab-use-after-free Read in ep_open run #4: crashed: KASAN: slab-use-after-free Read in ep_open run #5: crashed: KASAN: slab-use-after-free Read in ep_open run #6: crashed: KASAN: slab-use-after-free Read in ep_open run #7: crashed: KASAN: slab-use-after-free Read in ep_open run #8: crashed: KASAN: slab-use-after-free Read in ep_open run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK representative crash: KASAN: slab-use-after-free Read in ep_open, types: [KASAN-USE-AFTER-FREE-READ] # git bisect bad 4007c3d8c22a2025367953f4ee36ae106a69d855 Bisecting: 7 revisions left to test after this (roughly 3 steps) [7029acd8a950393ee3a3d8e1a7ee1a9b77808a3b] io_uring/rsrc: get rid of per-ring io_rsrc_node list testing commit 7029acd8a950393ee3a3d8e1a7ee1a9b77808a3b gcc compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 939df11f0be9d2320680231b4efc16b6ea0d4fa85700a45dd66e3555cb7e1979 run #0: crashed: KASAN: slab-use-after-free Read in ep_open run #1: crashed: KASAN: slab-use-after-free Read in ep_open run #2: crashed: KASAN: slab-use-after-free Read in ep_open run #3: crashed: KASAN: slab-use-after-free Read in ep_open run #4: crashed: KASAN: slab-use-after-free Read in ep_open run #5: crashed: KASAN: slab-use-after-free Read in ep_open run #6: crashed: KASAN: slab-use-after-free Read in ep_open run #7: crashed: KASAN: slab-use-after-free Read in ep_open run #8: crashed: KASAN: slab-use-after-free Read in ep_open run #9: crashed: KASAN: slab-use-after-free Read in ep_open run #10: crashed: KASAN: slab-use-after-free Read in ep_open run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK representative crash: KASAN: slab-use-after-free Read in ep_open, types: [KASAN-USE-AFTER-FREE-READ] # git bisect bad 7029acd8a950393ee3a3d8e1a7ee1a9b77808a3b Bisecting: 3 revisions left to test after this (roughly 2 steps) [ff1256b8f3c45f222bce19fbfc1e1bc498b31d03] io_uring/rsrc: move struct io_fixed_file to rsrc.h header testing commit ff1256b8f3c45f222bce19fbfc1e1bc498b31d03 gcc compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: ade7580d32da4f3627eda3b418cb74d08c1699fbfef8c4c2f69d59841ae336b4 run #0: crashed: KASAN: slab-use-after-free Read in ep_open run #1: crashed: KASAN: slab-use-after-free Read in ep_open run #2: crashed: KASAN: slab-use-after-free Read in ep_open run #3: crashed: KASAN: slab-use-after-free Read in ep_open run #4: crashed: KASAN: slab-use-after-free Read in ep_open run #5: crashed: KASAN: slab-use-after-free Read in ep_open run #6: crashed: KASAN: slab-use-after-free Read in ep_open run #7: OK run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK representative crash: KASAN: slab-use-after-free Read in ep_open, types: [KASAN-USE-AFTER-FREE-READ] # git bisect bad ff1256b8f3c45f222bce19fbfc1e1bc498b31d03 Bisecting: 1 revision left to test after this (roughly 1 step) [aa00f67adc2c0d6439f81b5a81ff181377c47a7e] io_uring: add support for fixed wait regions testing commit aa00f67adc2c0d6439f81b5a81ff181377c47a7e gcc compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: 2900b319a5458fb29a8ae09fcccd4d5129b412f4d1394a313f3689e2614277dc run #0: crashed: KASAN: slab-use-after-free Read in ep_open run #1: crashed: KASAN: slab-use-after-free Read in ep_open run #2: crashed: KASAN: slab-use-after-free Read in ep_open run #3: crashed: KASAN: slab-use-after-free Read in ep_open run #4: crashed: KASAN: slab-use-after-free Read in ep_open run #5: crashed: KASAN: slab-use-after-free Read in ep_open run #6: crashed: KASAN: slab-use-after-free Read in ep_open run #7: crashed: KASAN: slab-use-after-free Read in ep_open run #8: OK run #9: OK run #10: OK run #11: OK run #12: OK run #13: OK run #14: OK run #15: OK run #16: OK run #17: OK run #18: OK run #19: OK representative crash: KASAN: slab-use-after-free Read in ep_open, types: [KASAN-USE-AFTER-FREE-READ] # git bisect bad aa00f67adc2c0d6439f81b5a81ff181377c47a7e Bisecting: 0 revisions left to test after this (roughly 0 steps) [371b47da25e1f7a1a6323f84c776bd9fa079a490] io_uring: change io_get_ext_arg() to use uaccess begin + end testing commit 371b47da25e1f7a1a6323f84c776bd9fa079a490 gcc compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44 kernel signature: d62b08d20d766bde7e505f2c370db410999c1425c3d7356719efae36fc133dc1 all runs: OK false negative chance: 0.000 # git bisect good 371b47da25e1f7a1a6323f84c776bd9fa079a490 aa00f67adc2c0d6439f81b5a81ff181377c47a7e is the first bad commit commit aa00f67adc2c0d6439f81b5a81ff181377c47a7e Author: Jens Axboe Date: Tue Oct 22 13:47:00 2024 -0600 io_uring: add support for fixed wait regions Generally applications have 1 or a few waits of waiting, yet they pass in a struct io_uring_getevents_arg every time. This needs to get copied and, in turn, the timeout value needs to get copied. Rather than do this for every invocation, allow the application to register a fixed set of wait regions that can simply be indexed when asking the kernel to wait on events. At ring setup time, the application can register a number of these wait regions and initialize region/index 0 upfront: struct io_uring_reg_wait *reg; reg = io_uring_setup_reg_wait(ring, nr_regions, &ret); /* set timeout and mark as set, sigmask/sigmask_sz as needed */ reg->ts.tv_sec = 0; reg->ts.tv_nsec = 100000; reg->flags = IORING_REG_WAIT_TS; where nr_regions >= 1 && nr_regions <= PAGE_SIZE / sizeof(*reg). The above initializes index 0, but 63 other regions can be initialized, if needed. Now, instead of doing: struct __kernel_timespec timeout = { .tv_nsec = 100000, }; io_uring_submit_and_wait_timeout(ring, &cqe, nr, &t, NULL); to wait for events for each submit_and_wait, or just wait, operation, it can just reference the above region at offset 0 and do: io_uring_submit_and_wait_reg(ring, &cqe, nr, 0); to achieve the same goal of waiting 100usec without needing to copy both struct io_uring_getevents_arg (24b) and struct __kernel_timeout (16b) for each invocation. Struct io_uring_reg_wait looks as follows: struct io_uring_reg_wait { struct __kernel_timespec ts; __u32 min_wait_usec; __u32 flags; __u64 sigmask; __u32 sigmask_sz; __u32 pad[3]; __u64 pad2[2]; }; embedding the timeout itself in the region, rather than passing it as a pointer as well. Note that the signal mask is still passed as a pointer, both for compatability reasons, but also because there doesn't seem to be a lot of high frequency waits scenarios that involve setting and resetting the signal mask for each wait. The application is free to modify any region before a wait call, or it can use keep multiple regions with different settings to avoid needing to modify the same one for wait calls. Up to a page size of regions is mapped by default, allowing PAGE_SIZE / 64 available regions for use. The registered region must fit within a page. On a 4kb page size system, that allows for 64 wait regions if a full page is used, as the size of struct io_uring_reg_wait is 64b. The region registered must be aligned to io_uring_reg_wait in size. It's valid to register less than 64 entries. In network performance testing with zero-copy, this reduced the time spent waiting on the TX side from 3.12% to 0.3% and the RX side from 4.4% to 0.3%. Wait regions are fixed for the lifetime of the ring - once registered, they are persistent until the ring is torn down. The regions support minimum wait timeout as well as the regular waits. Signed-off-by: Jens Axboe include/linux/io_uring_types.h | 10 ++++++ include/uapi/linux/io_uring.h | 41 +++++++++++++++++++++ io_uring/io_uring.c | 68 +++++++++++++++++++++++++++++------ io_uring/register.c | 82 ++++++++++++++++++++++++++++++++++++++++++ io_uring/register.h | 1 + 5 files changed, 191 insertions(+), 11 deletions(-) accumulated error probability: 0.00 culprit signature: 2900b319a5458fb29a8ae09fcccd4d5129b412f4d1394a313f3689e2614277dc parent signature: d62b08d20d766bde7e505f2c370db410999c1425c3d7356719efae36fc133dc1 reproducer is flaky (0.40 repro chance estimate) revisions tested: 29, total time: 11h1m40.299169717s (build: 4h18m51.413107726s, test: 5h23m26.500176587s) first bad commit: aa00f67adc2c0d6439f81b5a81ff181377c47a7e io_uring: add support for fixed wait regions recipients (to): ["asml.silence@gmail.com" "axboe@kernel.dk" "axboe@kernel.dk" "io-uring@vger.kernel.org"] recipients (cc): ["linux-kernel@vger.kernel.org"] crash: KASAN: slab-use-after-free Read in ep_open ================================================================== BUG: KASAN: slab-use-after-free in __mutex_lock_common kernel/locking/mutex.c:587 [inline] BUG: KASAN: slab-use-after-free in __mutex_lock+0x12bd/0x14c0 kernel/locking/mutex.c:752 Read of size 8 at addr ffff888122e1c860 by task syz-executor/2936 CPU: 0 UID: 0 PID: 2936 Comm: syz-executor Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x5b/0x90 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x156/0x4d9 mm/kasan/report.c:488 kasan_report+0xda/0x180 mm/kasan/report.c:601 __mutex_lock_common kernel/locking/mutex.c:587 [inline] __mutex_lock+0x12bd/0x14c0 kernel/locking/mutex.c:752 ep_open+0x45/0x230 drivers/usb/gadget/legacy/inode.c:824 do_dentry_open+0x448/0x10c0 fs/open.c:958 vfs_open+0x7d/0x350 fs/open.c:1088 do_open fs/namei.c:3774 [inline] path_openat+0x1a32/0x27e0 fs/namei.c:3933 do_filp_open+0x197/0x3b0 fs/namei.c:3960 do_sys_openat2+0x136/0x170 fs/open.c:1415 do_sys_open fs/open.c:1430 [inline] __do_sys_openat fs/open.c:1446 [inline] __se_sys_openat fs/open.c:1441 [inline] __x64_sys_openat+0x104/0x1d0 fs/open.c:1441 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x6d/0x1a0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f2805149257 Code: 48 89 fa 4c 89 df e8 a8 56 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff RSP: 002b:00007ffe3ee1e440 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00005555637b7500 RCX: 00007f2805149257 RDX: 0000000000000000 RSI: 00007ffe3ee1e590 RDI: ffffffffffffff9c RBP: 00007ffe3ee1e590 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 00007ffe3ee1f680 R13: 00007f2805224474 R14: 00005555637b74e8 R15: 0000000000000006 Allocated by task 4043: kasan_save_stack+0x30/0x50 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394 kmalloc_noprof include/linux/slab.h:878 [inline] kzalloc_noprof include/linux/slab.h:1014 [inline] activate_ep_files drivers/usb/gadget/legacy/inode.c:1610 [inline] gadgetfs_bind+0x267/0x850 drivers/usb/gadget/legacy/inode.c:1701 gadget_bind_driver+0x211/0xa90 drivers/usb/gadget/udc/core.c:1610 call_driver_probe drivers/base/dd.c:579 [inline] really_probe+0x1c8/0x890 drivers/base/dd.c:658 __driver_probe_device+0x187/0x370 drivers/base/dd.c:800 driver_probe_device+0x45/0x120 drivers/base/dd.c:830 __driver_attach+0x18f/0x4a0 drivers/base/dd.c:1216 bus_for_each_dev+0x101/0x180 drivers/base/bus.c:370 bus_add_driver+0x29c/0x4d0 drivers/base/bus.c:675 driver_register+0x1a0/0x350 drivers/base/driver.c:246 usb_gadget_register_driver_owner+0x118/0x220 drivers/usb/gadget/udc/core.c:1700 dev_config+0xb61/0x13f0 drivers/usb/gadget/legacy/inode.c:1892 vfs_write+0x206/0xe30 fs/read_write.c:681 ksys_write+0xf6/0x1d0 fs/read_write.c:736 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x6d/0x1a0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 965: kasan_save_stack+0x30/0x50 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:579 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x4f/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:2342 [inline] slab_free mm/slub.c:4579 [inline] kfree+0x132/0x430 mm/slub.c:4727 destroy_ep_files+0x106/0x420 drivers/usb/gadget/legacy/inode.c:1585 gadgetfs_unbind+0x10d/0x220 drivers/usb/gadget/legacy/inode.c:1664 gadget_unbind_driver+0x1d1/0x480 drivers/usb/gadget/udc/core.c:1672 __device_release_driver drivers/base/dd.c:1273 [inline] device_release_driver_internal+0x367/0x520 drivers/base/dd.c:1296 driver_detach+0xc0/0x180 drivers/base/dd.c:1359 bus_remove_driver+0x119/0x2a0 drivers/base/bus.c:744 usb_gadget_unregister_driver+0x38/0x60 drivers/usb/gadget/udc/core.c:1732 dev_release+0x115/0x190 drivers/usb/gadget/legacy/inode.c:1199 __fput+0x352/0xa80 fs/file_table.c:431 delayed_fput+0x68/0x90 fs/file_table.c:454 process_one_work+0x7c8/0x1330 kernel/workqueue.c:3229 process_scheduled_works kernel/workqueue.c:3310 [inline] worker_thread+0x594/0xf70 kernel/workqueue.c:3391 kthread+0x267/0x320 kernel/kthread.c:389 ret_from_fork+0x2c/0x70 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 The buggy address belongs to the object at ffff888122e1c800 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 96 bytes inside of freed 512-byte region [ffff888122e1c800, ffff888122e1ca00) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x122e1c head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x200000000000040(head|node=0|zone=2) page_type: f5(slab) raw: 0200000000000040 ffff888100041c80 dead000000000122 0000000000000000 raw: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 head: 0200000000000040 ffff888100041c80 dead000000000122 0000000000000000 head: 0000000000000000 0000000080100010 00000001f5000000 0000000000000000 head: 0200000000000002 ffffea00048b8701 ffffffffffffffff 0000000000000000 head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4043, tgid 4042 (syz.1.18), ts 76166027004, free_ts 76067801057 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x20b/0x360 mm/page_alloc.c:1537 prep_new_page mm/page_alloc.c:1545 [inline] get_page_from_freelist+0xb22/0x2fe0 mm/page_alloc.c:3457 __alloc_pages_noprof+0x2e4/0x5e0 mm/page_alloc.c:4733 alloc_pages_mpol_noprof+0xbf/0x380 mm/mempolicy.c:2265 alloc_slab_page mm/slub.c:2412 [inline] allocate_slab+0x26a/0x350 mm/slub.c:2578 new_slab mm/slub.c:2631 [inline] ___slab_alloc+0xb28/0x1290 mm/slub.c:3818 __slab_alloc.isra.0+0x4d/0x90 mm/slub.c:3908 __slab_alloc_node mm/slub.c:3961 [inline] slab_alloc_node mm/slub.c:4122 [inline] __kmalloc_cache_noprof+0x30d/0x350 mm/slub.c:4290 kmalloc_noprof include/linux/slab.h:878 [inline] kzalloc_noprof include/linux/slab.h:1014 [inline] activate_ep_files drivers/usb/gadget/legacy/inode.c:1610 [inline] gadgetfs_bind+0x267/0x850 drivers/usb/gadget/legacy/inode.c:1701 gadget_bind_driver+0x211/0xa90 drivers/usb/gadget/udc/core.c:1610 call_driver_probe drivers/base/dd.c:579 [inline] really_probe+0x1c8/0x890 drivers/base/dd.c:658 __driver_probe_device+0x187/0x370 drivers/base/dd.c:800 driver_probe_device+0x45/0x120 drivers/base/dd.c:830 __driver_attach+0x18f/0x4a0 drivers/base/dd.c:1216 bus_for_each_dev+0x101/0x180 drivers/base/bus.c:370 bus_add_driver+0x29c/0x4d0 drivers/base/bus.c:675 page last free pid 4033 tgid 4033 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1108 [inline] free_unref_page+0x778/0xf70 mm/page_alloc.c:2638 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0x110 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x18f/0x1c0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:247 [inline] slab_post_alloc_hook mm/slub.c:4085 [inline] slab_alloc_node mm/slub.c:4134 [inline] kmem_cache_alloc_noprof+0x176/0x340 mm/slub.c:4141 mt_alloc_one lib/maple_tree.c:162 [inline] mas_alloc_nodes+0xed/0x6c0 lib/maple_tree.c:1241 mas_preallocate+0x376/0xa10 lib/maple_tree.c:5546 vma_iter_prealloc mm/vma.h:432 [inline] commit_merge+0x303/0x8a0 mm/vma.c:601 vma_expand+0x270/0x6a0 mm/vma.c:1024 vma_merge_new_range+0x248/0xe60 mm/vma.c:963 mmap_region+0x429/0x1df0 mm/mmap.c:1421 do_mmap+0x8e2/0x1010 mm/mmap.c:496 vm_mmap_pgoff+0x173/0x2e0 mm/util.c:588 ksys_mmap_pgoff+0x2e4/0x440 mm/mmap.c:542 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0x6d/0x1a0 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff888122e1c700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888122e1c780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888122e1c800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888122e1c880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888122e1c900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================