Re: [syzbot] KASAN: slab-use-after-free Read in vhci_send_cmd_submit
Hillf Danton <[email protected]>
| Newsgroups | org.kernel.vger.linux-kernel |
|---|---|
| Message-ID | <[email protected]> |
> Date: Thu, 20 Aug 2026 07:58:25 -0700 [thread overview]
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 3eb40771c00a Merge tag 'soc-fixes-7.2-3' of git://git.kern..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=16e07a79580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=1d67342c314f228d
> dashboard link: https://syzkaller.appspot.com/bug?extid=ecbb1750082f7528b507
> compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12849949580000
#syz test
--- x/drivers/usb/core/devio.c
+++ y/drivers/usb/core/devio.c
@@ -417,6 +417,7 @@ static void free_async(struct async *as)
{
int i;
+ usb_kill_urb(as->urb);
put_pid(as->pid);
if (as->cred)
put_cred(as->cred);
--