From nobody Sat Jun 13 20:02:00 2026 Received: from mail-oo1-f78.google.com (mail-oo1-f78.google.com [209.85.161.78]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8F7CB39182F for ; Tue, 5 May 2026 15:21:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.161.78 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777994513; cv=none; b=VlSCSlJjNGW1ysje+RGPWWuBGDP5BHi0NV8YqknssCGR+IrFgT44tfg2ZxFwhRBQXrPKA6XR9IE+lD2nWsTFa2Jwy0StkmJC1gXWk394cIm+McFJiuNoz6o0AdCIin14kXLOFDyqx5Ueu9GlCGOtb5W6nnv21Iwp9Vr2FDQeYLE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1777994513; c=relaxed/simple; bh=NMJ7ZSomgNnjAqqhC1GXSgo6tRZcoZHkHcTuxrZSyiI=; h=MIME-Version:Date:In-Reply-To:Message-ID:Subject:From:To: Content-Type; b=EGWZmNn8ihc0RE4XEhN3XEQy9gzG1WkZFrDIbJpOMPg0hnnU8bCosgq32KaY5j4LFTjnN4/3Ybj8M8B1sBJIEMjB4BO0zZzKDKRpQgJ8k+79NmNvv5aelwJaP5at0LVFT60p6CZkUFkcQvsUcFHMkFcHjr8dFuErTSSl4752Xyw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com; arc=none smtp.client-ip=209.85.161.78 Authentication-Results: smtp.subspace.kernel.org; dmarc=fail (p=none dis=none) header.from=syzkaller.appspotmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=M3KW2WVRGUFZ5GODRSRYTGD7.apphosting.bounces.google.com Received: by mail-oo1-f78.google.com with SMTP id 006d021491bc7-6948d83a5c0so14220839eaf.1 for ; Tue, 05 May 2026 08:21:51 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1777994510; x=1778599310; h=to:from:subject:message-id:in-reply-to:date:mime-version :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=UdgD6/z9dlwTnNNkH8JRB6hodApry+Lqam5+1kmiBRU=; b=BjKkZm5ywE1NMCPN8NMSF8FzlFBDUvYZVKr1rotFoYkHpoMarKRDthUR8ecl1fp6/o O1FoiblJfY/NGrKEaTCOdgE4cqMOQghLe51300jB+3mw87axl1L8tRwHdb40N17SyMET 7qqNUXQasyRykXphEthYRFepHf66Tz6aZPM0ES9xnU5UUckgEkAB4xdSfug2FSnBOESB sjVC04qNAYWu2qK0bdGqpYDyjawF8Bzp5gSMEC8tySdKkqIdIn8m0xQzj6WU2GQgzriN fEuWwCmwxEEtbeMcghZ54ALFbf2fhcSzMux3y4MxeXT4/bB4QKGlGHw7gSwW4ZBQBt1F 78+A== X-Gm-Message-State: AOJu0YzbjaS156ChhY6l4WVBgJmQcrZ+70xyLNfG8OpArnS+qk/mad3V CYyI/WT+VQrzS4AqP7MUTUWwvMKC2P35TPhB1tpcvFbakkc6SaHAxDR1AoSvANIeYfYKobWhJQn z48SWMSmYOUObIzG8nwZxjw7kAx57Gjz6a2eHYZcDs5AnCNA7Jxt64P2IbrwU7w== Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Received: by 2002:a05:6820:629:b0:696:757d:1942 with SMTP id 006d021491bc7-69697c60c82mr6555903eaf.32.1777994510606; Tue, 05 May 2026 08:21:50 -0700 (PDT) Date: Tue, 05 May 2026 08:21:50 -0700 In-Reply-To: <00000000000034ae0f05e9f94c79@google.com> X-Google-Appengine-App-Id: s~syzkaller X-Google-Appengine-App-Id-Alias: syzkaller Message-ID: <69fa0b0e.170a0220.59368.0014.GAE@google.com> Subject: Forwarded: Private message regarding: Forwarded: Private message regarding: [syzbot] [jfs?] KASAN: use-after-free Read in jfs_lazycommit From: syzbot To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" For archival purposes, forwarding an incoming command email to linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com. *** Subject: Private message regarding: Forwarded: Private message regarding: [= syzbot] [jfs?] KASAN: use-after-free Read in jfs_lazycommit Author: kapoorarnav43@gmail.com #syz fix From 7e1a0b91e9efa8bec40fc5397ba6c4e683d72df0 Mon Sep 17 00:00:00 2001 From: ArnavKapoor Date: Tue, 5 May 2026 20:22:56 +0530 Subject: [PATCH] jfs: Fix use-after-free in lbmIODone during log shutdown Fix a race condition where lbmIODone() can access freed memory from lbuf structures that have been deallocated by lbmLogShutdown() before pending I/O operations complete. The issue occurs when: 1. I/O operations are submitted with lbuf as bio private data 2. During filesystem unmount, lbmLogShutdown() is called which frees all lbuf structures 3. But the bio completion callback lbmIODone() is still pending 4. When lbmIODone() executes, it accesses the freed lbuf causing use-after-free Solution: - Add atomic counter to track pending I/O operations - Add wait queue to wait for pending I/O to complete - Increment counter in lbmStartIO() before submitting bio - Decrement counter in lbmIODone() after I/O completes - In lbmLogShutdown(), wait for all pending I/O to complete before freeing This prevents the use-after-free by ensuring all pending I/O operations complete before the lbuf structures are deallocated. Link: https://syzkaller.appspot.com/bug?extid=3D885a4f3281b8d99c48d8 Signed-off-by: ArnavKapoor --- fs/jfs/jfs_logmgr.c | 15 ++++++++++++++- fs/jfs/jfs_logmgr.h | 2 ++ 2 files changed, 16 insertions(+), 1 deletion(-) diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c index 306165e61..eaeeaaa0c 100644 --- a/fs/jfs/jfs_logmgr.c +++ b/fs/jfs/jfs_logmgr.c @@ -1804,6 +1804,8 @@ static int lbmLogInit(struct jfs_log * log) * avoid deadlock here. */ init_waitqueue_head(&log->free_wait); + init_waitqueue_head(&log->ios_wait); + atomic_set(&log->ios_pending, 0); =20 log->lbuf_free =3D NULL; =20 @@ -1855,6 +1857,9 @@ static void lbmLogShutdown(struct jfs_log * log) =20 jfs_info("lbmLogShutdown: log:0x%p", log); =20 + /* Wait for all pending I/O operations to complete */ + wait_event(&log->ios_wait, atomic_read(&log->ios_pending) =3D=3D 0); + lbuf =3D log->lbuf_free; while (lbuf) { struct lbuf *next =3D lbuf->l_freelist; @@ -2123,6 +2128,9 @@ static void lbmStartIO(struct lbuf * bp) bio->bi_end_io =3D lbmIODone; bio->bi_private =3D bp; =20 + /* Increment pending I/O counter before submitting */ + atomic_inc(&log->ios_pending); + /* check if journaling to disk has been disabled */ if (log->no_integrity) { bio->bi_iter.bi_size =3D 0; @@ -2167,8 +2175,8 @@ static int lbmIOWait(struct lbuf * bp, int flag) static void lbmIODone(struct bio *bio) { struct lbuf *bp =3D bio->bi_private; + struct jfs_log *log =3D bp->l_log; struct lbuf *nextbp, *tail; - struct jfs_log *log; unsigned long flags; =20 /* @@ -2298,6 +2306,11 @@ static void lbmIODone(struct bio *bio) =20 out: bp->l_flag |=3D lbmDONE; + + /* Decrement pending I/O counter and wake up if waiting */ + if (atomic_dec_and_test(&log->ios_pending)) + wake_up(&log->ios_wait); + LCACHE_UNLOCK(flags); } =20 diff --git a/fs/jfs/jfs_logmgr.h b/fs/jfs/jfs_logmgr.h index 09e0ef6ae..b89b198d4 100644 --- a/fs/jfs/jfs_logmgr.h +++ b/fs/jfs/jfs_logmgr.h @@ -400,6 +400,8 @@ struct jfs_log { uuid_t uuid; /* 16: 128-bit uuid of log device */ =20 int no_integrity; /* 3: flag to disable journaling to disk */ + atomic_t ios_pending; /* 4: count of pending I/O operations */ + wait_queue_head_t ios_wait; /* 4: wait queue for I/O completion */ }; =20 /* --=20 2.43.0 On Tuesday, 5 May 2026 at 20:47:39 UTC+5:30 syzbot wrote: For archival purposes, forwarding an incoming command email to=20 linux-...@vger.kernel.org, syzkall...@googlegroups.com.=20 ***=20 Subject: Private message regarding: [syzbot] [jfs?] KASAN: use-after-free=20 Read in jfs_lazycommit=20 Author: kapoor...@gmail.com=20 #syz fix=20 From 7e1a0b91e9efa8bec40fc5397ba6c4e683d72df0 Mon Sep 17 00:00:00 2001=20 From: ArnavKapoor =20 Date: Tue, 5 May 2026 20:22:56 +0530=20 Subject: [PATCH] jfs: Fix use-after-free in lbmIODone during log shutdown=20 Fix a race condition where lbmIODone() can access freed memory from lbuf=20 structures that have been deallocated by lbmLogShutdown() before pending=20 I/O operations complete.=20 The issue occurs when:=20 1. I/O operations are submitted with lbuf as bio private data=20 2. During filesystem unmount, lbmLogShutdown() is called which frees all=20 lbuf structures=20 3. But the bio completion callback lbmIODone() is still pending=20 4. When lbmIODone() executes, it accesses the freed lbuf causing=20 use-after-free=20 Solution:=20 - Add atomic counter to track pending I/O operations=20 - Add wait queue to wait for pending I/O to complete=20 - Increment counter in lbmStartIO() before submitting bio=20 - Decrement counter in lbmIODone() after I/O completes=20 - In lbmLogShutdown(), wait for all pending I/O to complete before freeing=20 This prevents the use-after-free by ensuring all pending I/O operations=20 complete before the lbuf structures are deallocated.=20 Link: https://syzkaller.appspot.com/bug?extid=3D885a4f3281b8d99c48d8=20 Signed-off-by: ArnavKapoor =20 ---=20 fs/jfs/jfs_logmgr.c | 15 ++++++++++++++-=20 fs/jfs/jfs_logmgr.h | 2 ++=20 2 files changed, 16 insertions(+), 1 deletion(-)=20 diff --git a/fs/jfs/jfs_logmgr.c b/fs/jfs/jfs_logmgr.c=20 index 306165e61..eaeeaaa0c 100644=20 --- a/fs/jfs/jfs_logmgr.c=20 +++ b/fs/jfs/jfs_logmgr.c=20 @@ -1804,6 +1804,8 @@ static int lbmLogInit(struct jfs_log * log)=20 * avoid deadlock here.=20 */=20 init_waitqueue_head(&log->free_wait);=20 + init_waitqueue_head(&log->ios_wait);=20 + atomic_set(&log->ios_pending, 0);=20 log->lbuf_free =3D NULL;=20 @@ -1855,6 +1857,9 @@ static void lbmLogShutdown(struct jfs_log * log)=20 jfs_info("lbmLogShutdown: log:0x%p", log);=20 + /* Wait for all pending I/O operations to complete */=20 + wait_event(&log->ios_wait, atomic_read(&log->ios_pending) =3D=3D 0);=20 +=20 lbuf =3D log->lbuf_free;=20 while (lbuf) {=20 struct lbuf *next =3D lbuf->l_freelist;=20 @@ -2123,6 +2128,9 @@ static void lbmStartIO(struct lbuf * bp)=20 bio->bi_end_io =3D lbmIODone;=20 bio->bi_private =3D bp;=20 + /* Increment pending I/O counter before submitting */=20 + atomic_inc(&log->ios_pending);=20 +=20 /* check if journaling to disk has been disabled */=20 if (log->no_integrity) {=20 bio->bi_iter.bi_size =3D 0;=20 @@ -2167,8 +2175,8 @@ static int lbmIOWait(struct lbuf * bp, int flag)=20 static void lbmIODone(struct bio *bio)=20 {=20 struct lbuf *bp =3D bio->bi_private;=20 + struct jfs_log *log =3D bp->l_log;=20 struct lbuf *nextbp, *tail;=20 - struct jfs_log *log;=20 unsigned long flags;=20 /*=20 @@ -2298,6 +2306,11 @@ static void lbmIODone(struct bio *bio)=20 out:=20 bp->l_flag |=3D lbmDONE;=20 +=20 + /* Decrement pending I/O counter and wake up if waiting */=20 + if (atomic_dec_and_test(&log->ios_pending))=20 + wake_up(&log->ios_wait);=20 +=20 LCACHE_UNLOCK(flags);=20 }=20 diff --git a/fs/jfs/jfs_logmgr.h b/fs/jfs/jfs_logmgr.h=20 index 09e0ef6ae..b89b198d4 100644=20 --- a/fs/jfs/jfs_logmgr.h=20 +++ b/fs/jfs/jfs_logmgr.h=20 @@ -400,6 +400,8 @@ struct jfs_log {=20 uuid_t uuid; /* 16: 128-bit uuid of log device */=20 int no_integrity; /* 3: flag to disable journaling to disk */=20 + atomic_t ios_pending; /* 4: count of pending I/O operations */=20 + wait_queue_head_t ios_wait; /* 4: wait queue for I/O completion */=20 };=20 /*=20 --=20 2.43.0=20 On Tuesday, 5 May 2026 at 18:56:07 UTC+5:30 syzbot wrote:=20 Hello,=20 syzbot has tested the proposed patch but the reproducer is still triggering=20 an issue:=20 KASAN: slab-use-after-free Read in blk_update_request=20 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=20 BUG: KASAN: slab-use-after-free in __raw_spin_lock_irqsave=20 include/linux/spinlock_api_smp.h:132 [inline]=20 BUG: KASAN: slab-use-after-free in _raw_spin_lock_irqsave+0x40/0x60=20 kernel/locking/spinlock.c:166=20 Read of size 1 at addr ffff88802a964100 by task kworker/u8:7/165=20 CPU: 0 UID: 0 PID: 165 Comm: kworker/u8:7 Not tainted syzkaller #0=20 PREEMPT_{RT,(full)}=20 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS=20 Google 04/18/2026=20 Workqueue: netns cleanup_net=20 Call Trace:=20 =20 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120=20 print_address_description+0x55/0x1e0 mm/kasan/report.c:378=20 print_report+0x58/0x70 mm/kasan/report.c:482=20 kasan_report+0x117/0x150 mm/kasan/report.c:595=20 __kasan_check_byte+0x2a/0x40 mm/kasan/common.c:574=20 kasan_check_byte include/linux/kasan.h:402 [inline]=20 lock_acquire+0x84/0x350 kernel/locking/lockdep.c:5842=20 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:132 [inline]=20 _raw_spin_lock_irqsave+0x40/0x60 kernel/locking/spinlock.c:166=20 rtlock_slowlock kernel/locking/rtmutex.c:1913 [inline]=20 rtlock_lock kernel/locking/spinlock_rt.c:43 [inline]=20 __rt_spin_lock kernel/locking/spinlock_rt.c:49 [inline]=20 rt_spin_lock+0x157/0x400 kernel/locking/spinlock_rt.c:57=20 spin_lock include/linux/spinlock_rt.h:45 [inline]=20 __wake_up_common_lock+0x2f/0x1e0 kernel/sched/wait.c:124=20 blk_update_request+0x57e/0xe60 block/blk-mq.c:1016=20 blk_mq_end_request+0x3e/0x70 block/blk-mq.c:1178=20 blk_complete_reqs block/blk-mq.c:1253 [inline]=20 blk_done_softirq+0x10a/0x160 block/blk-mq.c:1258=20 handle_softirqs+0x1de/0x6d0 kernel/softirq.c:622=20 __do_softirq kernel/softirq.c:656 [inline]=20 __local_bh_enable_ip+0x170/0x2b0 kernel/softirq.c:302=20 local_bh_enable include/linux/bottom_half.h:33 [inline]=20 spin_unlock_bh include/linux/spinlock_rt.h:116 [inline]=20 __fib6_clean_all+0x4d1/0x610 net/ipv6/ip6_fib.c:2325=20 rt6_sync_down_dev net/ipv6/route.c:5018 [inline]=20 rt6_disable_ip+0x11f/0x750 net/ipv6/route.c:5023=20 addrconf_ifdown+0x157/0x1aa0 net/ipv6/addrconf.c:3865=20 addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1=20 notifier_call_chain+0x1ad/0x3d0 kernel/notifier.c:85=20 call_netdevice_notifiers_extack net/core/dev.c:2287 [inline]=20 call_netdevice_notifiers net/core/dev.c:2301 [inline]=20 netif_close_many+0x2ae/0x420 net/core/dev.c:1805=20 unregister_netdevice_many_notify+0xb50/0x22b0 net/core/dev.c:12388=20 unregister_netdevice_many net/core/dev.c:12481 [inline]=20 default_device_exit_batch+0x981/0xa00 net/core/dev.c:13073=20 ops_exit_list net/core/net_namespace.c:205 [inline]=20 ops_undo_list+0x52b/0x940 net/core/net_namespace.c:252=20 cleanup_net+0x56e/0x800 net/core/net_namespace.c:702=20 process_one_work kernel/workqueue.c:3302 [inline]=20 process_scheduled_works+0xb5d/0x1860 kernel/workqueue.c:3385=20 worker_thread+0xa53/0xfc0 kernel/workqueue.c:3466=20 kthread+0x388/0x470 kernel/kthread.c:436=20 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158=20 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245=20 =20 Allocated by task 8907:=20 kasan_save_stack mm/kasan/common.c:57 [inline]=20 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78=20 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]=20 __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415=20 kasan_kmalloc include/linux/kasan.h:263 [inline]=20 __kmalloc_cache_noprof+0x3a6/0x690 mm/slub.c:5419=20 kmalloc_noprof include/linux/slab.h:950 [inline]=20 kzalloc_noprof include/linux/slab.h:1188 [inline]=20 open_inline_log fs/jfs/jfs_logmgr.c:1157 [inline]=20 lmLogOpen+0x2d1/0xfa0 fs/jfs/jfs_logmgr.c:1067=20 jfs_mount_rw+0xee/0x670 fs/jfs/jfs_mount.c:257=20 jfs_fill_super+0x754/0xd80 fs/jfs/super.c:532=20 get_tree_bdev_flags+0x431/0x4f0 fs/super.c:1694=20 vfs_get_tree+0x92/0x2a0 fs/super.c:1754=20 fc_mount fs/namespace.c:1193 [inline]=20 do_new_mount_fc fs/namespace.c:3758 [inline]=20 do_new_mount+0x341/0xd30 fs/namespace.c:3834=20 do_mount fs/namespace.c:4167 [inline]=20 __do_sys_mount fs/namespace.c:4383 [inline]=20 __se_sys_mount+0x31d/0x420 fs/namespace.c:4360=20 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]=20 do_syscall_64+0x15f/0xf80 arch/x86/entry/syscall_64.c:94=20 entry_SYSCALL_64_after_hwframe+0x77/0x7f=20 Freed by task 8892:=20 kasan_save_stack mm/kasan/common.c:57 [inline]=20 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78=20 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584=20 poison_slab_object mm/kasan/common.c:253 [inline]=20 __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285=20 kasan_slab_free include/linux/kasan.h:235 [inline]=20 slab_free_hook mm/slub.c:2689 [inline]=20 slab_free mm/slub.c:6250 [inline]=20 kfree+0x1c5/0x6c0 mm/slub.c:6565=20 lmLogClose+0x297/0x520 fs/jfs/jfs_logmgr.c:-1=20 jfs_umount+0x304/0x3e0 fs/jfs/jfs_umount.c:131=20 jfs_put_super+0x8c/0x190 fs/jfs/super.c:194=20 generic_shutdown_super+0x13d/0x2d0 fs/super.c:646=20 kill_block_super+0x44/0x90 fs/super.c:1725=20 deactivate_locked_super+0xbc/0x130 fs/super.c:476=20 cleanup_mnt+0x437/0x4d0 fs/namespace.c:1312=20 task_work_run+0x1d9/0x270 kernel/task_work.c:233=20 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]=20 __exit_to_user_mode_loop kernel/entry/common.c:67 [inline]=20 exit_to_user_mode_loop+0xed/0x480 kernel/entry/common.c:98=20 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline]=20 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:238=20 [inline]=20 syscall_exit_to_user_mode include/linux/entry-common.h:318 [inline]=20 do_syscall_64+0x33e/0xf80 arch/x86/entry/syscall_64.c:100=20 entry_SYSCALL_64_after_hwframe+0x77/0x7f=20 The buggy address belongs to the object at ffff88802a964000=20 which belongs to the cache kmalloc-2k of size 2048=20 The buggy address is located 256 bytes inside of=20 freed 2048-byte region [ffff88802a964000, ffff88802a964800)=20 The buggy address belongs to the physical page:=20 page: refcount:0 mapcount:0 mapping:0000000000000000=20 index:0xffff88802a961000 pfn:0x2a960=20 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0=20 flags: 0x80000000000240(workingset|head|node=3D0|zone=3D1)=20 page_type: f5(slab)=20 raw: 0080000000000240 ffff88801a010000 ffffea0000ebf410 ffffea0001007a10=20 raw: ffff88802a961000 0000000800080007 00000000f5000000 0000000000000000=20 head: 0080000000000240 ffff88801a010000 ffffea0000ebf410 ffffea0001007a10=20 head: ffff88802a961000 0000000800080007 00000000f5000000 0000000000000000=20 head: 0080000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff=20 head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008=20 page dumped because: kasan: bad access detected=20 page_owner tracks the page as allocated=20 page last allocated via order 3, migratetype Unmovable, gfp_mask=20 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEM= ALLOC),=20 pid 1, tgid 1 (swapper/0), ts 11357773279, free_ts 0=20 set_page_owner include/linux/page_owner.h:32 [inline]=20 post_alloc_hook+0x231/0x280 mm/page_alloc.c:1858=20 prep_new_page mm/page_alloc.c:1866 [inline]=20 get_page_from_freelist+0x27c8/0x2840 mm/page_alloc.c:3946=20 __alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5226=20 alloc_slab_page mm/slub.c:3278 [inline]=20 allocate_slab+0x77/0x660 mm/slub.c:3467=20 new_slab mm/slub.c:3525 [inline]=20 refill_objects+0x33c/0x3d0 mm/slub.c:7255=20 refill_sheaf mm/slub.c:2816 [inline]=20 __pcs_replace_empty_main+0x373/0x720 mm/slub.c:4651=20 alloc_from_pcs mm/slub.c:4749 [inline]=20 slab_alloc_node mm/slub.c:4883 [inline]=20 __kmalloc_cache_noprof+0x44e/0x690 mm/slub.c:5414=20 kmalloc_noprof include/linux/slab.h:950 [inline]=20 kzalloc_noprof include/linux/slab.h:1188 [inline]=20 hub_probe+0x571/0x3c30 drivers/usb/core/hub.c:1961=20 usb_probe_interface+0x659/0xc70 drivers/usb/core/driver.c:396=20 call_driver_probe drivers/base/dd.c:-1 [inline]=20 really_probe+0x267/0xaf0 drivers/base/dd.c:709=20 __driver_probe_device+0x1ef/0x380 drivers/base/dd.c:871=20 driver_probe_device+0x4f/0x240 drivers/base/dd.c:901=20 __device_attach_driver+0x279/0x430 drivers/base/dd.c:1029=20 bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500=20 __device_attach+0x2c8/0x450 drivers/base/dd.c:1101=20 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1156=20 page_owner free stack trace missing=20 Memory state around the buggy address:=20 ffff88802a964000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb=20 ffff88802a964080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb=20 >ffff88802a964100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb=20 ^=20 ffff88802a964180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb=20 ffff88802a964200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb=20 =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=20 Tested on:=20 commit: a293ec25 Merge tag 'linux_kselftest-fixes-7.1-rc3' of ..=20 git tree: upstream=20 console output: https://syzkaller.appspot.com/x/log.txt?x=3D146a4ad2580000=20 kernel config: https://syzkaller.appspot.com/x/.config?x=3Df2e8ebfec4636d32=20 dashboard link: https://syzkaller.appspot.com/bug?extid=3D885a4f3281b8d99c4= 8d8=20 compiler: Debian clang version 21.1.8=20 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8=20 patch: https://syzkaller.appspot.com/x/patch.diff?x=3D171e59ce580000