slab-use-after-free in report_descriptor_read+0xbb/0x100 drivers/hid/hid-core.c:2272 Read of size 24 at addr ffff888120aa1480 by task fido_id/6160 CPU: 1 UID: 0 PID: 6160

slab-use-after-free in __mutex_lock_common kernel/locking/mutex.c:728 [inline] BUG: KASAN: slab-use-after-free in __mutex_lock+0x18bb/0x1bd0 kernel/locking/mutex

slab-use-after-free in release_tty+0x36b/0x560 drivers/tty/tty_io.c:1584 Write of size 8 at addr ffff888027479120 by task syz-executor331/5612 CPU: 1 UID: 0 PID: 5612 Comm

slab-use-after-free in usa49_glocont_callback+0x232/0x260 drivers/usb/serial/keyspan.c:1045 Read of size 4 at addr ffff888028940cb0 by task syz.4.480/7762 CPU: 0 UID: 0

slab-use-after-free in fuse_dev_do_write+0xb54/0xbf0 fs/fuse/dev.c:1940 Read of size 2 at addr ffff88802990801b by task syz.6.1795/14368 CPU: 0 UID: 0 PID: 14368 Comm: syz.

slab-use-after-free in hci_cmd_data net/bluetooth/hci_core.c:3119 [inline] BUG: KASAN: slab-use-after-free in hci_sent_cmd_data net/bluetooth/hci_core.c:3134 [inline

the > use-after-free crash in event_handler(). > > For reference, here's a C reproducer for the original bug: > https://syzkaller.appspot.com/text?tag=ReproC&x

slab-use-after-free in rxrpc_destroy_all_peers+0x1ce/0x1d0 net/rxrpc/peer_object.c:461 Read of size 8 at addr ffff888054f70c20 by task kworker/u8:3/48 CPU: 0 UID: 0 PID:

slab-use-after-free in string_nocheck lib/vsprintf.c:648 [inline] BUG: KASAN: slab-use-after-free in string+0x216/0x2d0 lib/vsprintf.c:730 Read of size 1 at addr ffff88802b56ac0a

slab-use-after-free in i2c_adapter_depth drivers/i2c/i2c-core-base.c:1243 [inline] BUG: KASAN: slab-use-after-free in i2c_adapter_lock_bus+0x5e/0xf0 drivers/i2c/

slab-use-after-free in do_trace_event_raw_event_udc_log_req drivers/usb/gadget/udc/trace.h:223 [inline] BUG: KASAN: slab-use-after-free in trace_event_raw_event_udc_log_req

slab-use-after-free in xsk_bind+0x1582/0x16c0 net/xdp/xsk.c:1758 Read of size 4 at addr ffff88802a91a18c by task syz-executor236/5659 CPU: 1 UID: 0 PID: 5659 Comm: syz-executor236

slab-use-after-free in string_nocheck lib/vsprintf.c:648 [inline] BUG: KASAN: slab-use-after-free in string+0x216/0x2d0 lib/vsprintf.c:730 Read of size 1 at addr ffff888051fda758

slab-use-after-free in vdev_to_vhci_hcd drivers/usb/usbip/vhci.h:171 [inline] BUG: KASAN: slab-use-after-free in vhci_cleanup_unlink_list+0x44/0x456 drivers/usb/

slab-use-after-free in sur40_init drivers/input/touchscreen/sur40.c:352 [inline] BUG: KASAN: slab-use-after-free in sur40_open+0x46c/0x500 drivers/input/touchscreen

slab-use-after-free in string_nocheck lib/vsprintf.c:648 [inline] BUG: KASAN: slab-use-after-free in string+0x471/0x4d0 lib/vsprintf.c:730 Read of size 1 at addr ffff88807aced758

slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline] BUG: KASAN: slab-use-after-free in atomic_fetch_sub_release include

slab-use-after-free in free_all_midi2_umps sound/usb/midi2.c:689 [inline] BUG: KASAN: slab-use-after-free in snd_usb_midi_v2_free+0x52d/0x670 sound/usb/midi2.c:941

slab-use-after-free in vhci_shutdown_connection.cold+0x2f1/0x37c drivers/usb/usbip/vhci_hcd.c:1062 Read of size 8 at addr ffff8880264a0780 by task kworker/u32:4/5988

slab-use-after-free in cec_transmit_done_ts+0xf08/0x1470 drivers/media/cec/core/cec-adap.c:604 Read of size 1 at addr ffff88803354e749 by task vivid_cec-vivid/2119 CPU

slab-use-after-free in timer_is_static_object+0x80/0x90 kernel/time/timer.c:691 Read of size 8 at addr ffff88805443f8f8 by task kworker/0:7/5803 CPU: 0 UID: 0 PID: 5803 Comm

slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:112 [inline] BUG: KASAN: slab-use-after-free in atomic_fetch_sub_release include

rds: use krealloc_array() for iovector gr.. git tree: net-next console output: https://syzkaller.appspot.com/x/log.txt?x=1141c49e580000 kernel config: https://syzkaller

slab-use-after-free in __release_resource+0x276/0x2c0 kernel/resource.c:221 Read of size 8 at addr ffff888021f70c38 by task syz.9.908/9637 CPU: 3 UID: 0 PID: 9637 Comm: syz

slab-use-after-free in lookup_noperm_common+0x407/0x430 fs/namei.c:3106 Read of size 4 at addr ffff888040cd8000 by task syz-executor329/6384 CPU: 0 UID: 0 PID: 6384 Comm: syz

slab-use-after-free in __mutex_lock_common kernel/locking/mutex.c:625 [inline] BUG: KASAN: slab-use-after-free in __mutex_lock+0x15ca/0x1bd0 kernel/locking/mutex

slab-use-after-free in find_endpoint+0x2a3/0x2c0 drivers/usb/gadget/udc/dummy_hcd.c:1618 Read of size 1 at addr ffff8880359f2912 by task kworker/0:5/18466 CPU: 0 UID: 0

slab-use-after-free in serial_core_get_ctrl_dev drivers/tty/serial/serial_core.c:3236 [inline] BUG: KASAN: slab-use-after-free in serial_core_ctrl_find drivers/tty

slab-use-after-free in __raw_spin_lock include/linux/spinlock_api_smp.h:158 [inline] BUG: KASAN: slab-use-after-free in _raw_spin_lock+0x2e/0x40 kernel/locking/spinlock

slab-use-after-free in llc_conn_ac_send_sabme_cmd_p_set_x+0x442/0x470 net/llc/llc_c_ac.c:782 >Read of size 1 at addr ffff8880370c8010 by task kworker/u8:0/11804 >