[v5.15] KASAN: use-after-free Read in io_poll_remove_entries
5 views
Skip to first unread message
syzbot
Jul 28, 2025, 12:44:33 AM7/28/25
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: c79648372d02 Linux 5.15.189
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=16f8b8a2580000
kernel config: https://syzkaller.appspot.com/x/.config?x=9e47345638b85bd0
dashboard link: https://syzkaller.appspot.com/bug?extid=a93c18fff361680557d8
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
userspace arch: arm64
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/7ab49562317a/disk-c7964837.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e847ec1e38d3/vmlinux-c7964837.xz
kernel image: https://storage.googleapis.com/syzbot-assets/263158c6371c/Image-c7964837.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a93c18...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in __lock_acquire+0xf0/0x651c kernel/locking/lockdep.c:4882
Read of size 8 at addr ffff0000d249d4b8 by task syz.1.131/4739
CPU: 1 PID: 4739 Comm: syz.1.131 Not tainted 5.15.189-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call trace:
dump_backtrace+0x0/0x43c arch/arm64/kernel/stacktrace.c:152
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
__dump_stack+0x30/0x40 lib/dump_stack.c:88
dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106
print_address_description+0x78/0x30c mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:434 [inline]
kasan_report+0xec/0x15c mm/kasan/report.c:451
__asan_report_load8_noabort+0x44/0x50 mm/kasan/report_generic.c:309
__lock_acquire+0xf0/0x651c kernel/locking/lockdep.c:4882
lock_acquire+0x1f4/0x620 kernel/locking/lockdep.c:5623
__raw_spin_lock_irq include/linux/spinlock_api_smp.h:128 [inline]
_raw_spin_lock_irq+0xcc/0x13c kernel/locking/spinlock.c:170
spin_lock_irq include/linux/spinlock.h:388 [inline]
io_poll_remove_entry io_uring/io_uring.c:5578 [inline]
io_poll_remove_entries+0x168/0x430 io_uring/io_uring.c:5606
io_poll_task_func+0xe8/0x250 io_uring/io_uring.c:5708
tctx_task_work+0x284/0x514 io_uring/io_uring.c:2209
task_work_run+0x12c/0x1e0 kernel/task_work.c:188
exit_task_work include/linux/task_work.h:33 [inline]
do_exit+0x684/0x1f58 kernel/exit.c:883
do_group_exit+0x100/0x268 kernel/exit.c:997
get_signal+0x73c/0x1340 kernel/signal.c:2900
do_signal arch/arm64/kernel/signal.c:893 [inline]
do_notify_resume+0x35c/0x3128 arch/arm64/kernel/signal.c:946
prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:133 [inline]
exit_to_user_mode arch/arm64/kernel/entry-common.c:138 [inline]
el0_svc+0xf0/0x1e0 arch/arm64/kernel/entry-common.c:609
el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
Allocated by task 1:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:434 [inline]
____kasan_kmalloc mm/kasan/common.c:513 [inline]
__kasan_kmalloc+0xb0/0xf0 mm/kasan/common.c:522
kasan_kmalloc include/linux/kasan.h:264 [inline]
kmem_cache_alloc_trace+0x274/0x3fc mm/slub.c:3247
kmalloc include/linux/slab.h:604 [inline]
kzalloc include/linux/slab.h:735 [inline]
__comedi_device_postconfig_async drivers/comedi/drivers.c:664 [inline]
__comedi_device_postconfig drivers/comedi/drivers.c:721 [inline]
comedi_device_postconfig+0x428/0xb48 drivers/comedi/drivers.c:756
comedi_auto_config+0x228/0x328 drivers/comedi/drivers.c:1069
comedi_test_init+0xb0/0x14c drivers/comedi/drivers/comedi_test.c:834
do_one_initcall+0x228/0x8b0 init/main.c:1302
do_initcall_level+0x154/0x214 init/main.c:1375
do_initcalls+0x58/0xac init/main.c:1391
do_basic_setup+0x8c/0xa0 init/main.c:1410
kernel_init_freeable+0x404/0x5fc init/main.c:1615
kernel_init+0x24/0x1d0 init/main.c:1506
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:855
Freed by task 4739:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track+0x4c/0x84 mm/kasan/common.c:46
kasan_set_free_info+0x28/0x4c mm/kasan/generic.c:360
____kasan_slab_free+0x118/0x164 mm/kasan/common.c:366
__kasan_slab_free+0x18/0x28 mm/kasan/common.c:374
kasan_slab_free include/linux/kasan.h:230 [inline]
slab_free_hook mm/slub.c:1705 [inline]
slab_free_freelist_hook+0x128/0x1e8 mm/slub.c:1731
slab_free mm/slub.c:3499 [inline]
kfree+0x170/0x40c mm/slub.c:4559
comedi_device_detach_cleanup drivers/comedi/drivers.c:172 [inline]
comedi_device_detach+0x2c4/0x5d8 drivers/comedi/drivers.c:208
do_devconfig_ioctl drivers/comedi/comedi_fops.c:829 [inline]
comedi_unlocked_ioctl+0xb28/0xdcc drivers/comedi/comedi_fops.c:2131
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl fs/ioctl.c:860 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
The buggy address belongs to the object at ffff0000d249d400
which belongs to the cache kmalloc-256 of size 256
The buggy address is located 184 bytes inside of
256-byte region [ffff0000d249d400, ffff0000d249d500)
The buggy address belongs to the page:
page:000000002af231b2 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff0000d249d600 pfn:0x11249c
head:000000002af231b2 order:1 compound_mapcount:0
flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000010200 fffffc0003464e08 fffffc0003464d88 ffff0000c0002480
raw: ffff0000d249d600 000000000010000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff0000d249d380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff0000d249d400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff0000d249d480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff0000d249d500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff0000d249d580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: c79648372d02 Linux 5.15.189
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=16f8b8a2580000
kernel config: https://syzkaller.appspot.com/x/.config?x=9e47345638b85bd0
dashboard link: https://syzkaller.appspot.com/bug?extid=a93c18fff361680557d8
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
userspace arch: arm64
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/7ab49562317a/disk-c7964837.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e847ec1e38d3/vmlinux-c7964837.xz
kernel image: https://storage.googleapis.com/syzbot-assets/263158c6371c/Image-c7964837.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a93c18...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in __lock_acquire+0xf0/0x651c kernel/locking/lockdep.c:4882
Read of size 8 at addr ffff0000d249d4b8 by task syz.1.131/4739
CPU: 1 PID: 4739 Comm: syz.1.131 Not tainted 5.15.189-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call trace:
dump_backtrace+0x0/0x43c arch/arm64/kernel/stacktrace.c:152
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
__dump_stack+0x30/0x40 lib/dump_stack.c:88
dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106
print_address_description+0x78/0x30c mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:434 [inline]
kasan_report+0xec/0x15c mm/kasan/report.c:451
__asan_report_load8_noabort+0x44/0x50 mm/kasan/report_generic.c:309
__lock_acquire+0xf0/0x651c kernel/locking/lockdep.c:4882
lock_acquire+0x1f4/0x620 kernel/locking/lockdep.c:5623
__raw_spin_lock_irq include/linux/spinlock_api_smp.h:128 [inline]
_raw_spin_lock_irq+0xcc/0x13c kernel/locking/spinlock.c:170
spin_lock_irq include/linux/spinlock.h:388 [inline]
io_poll_remove_entry io_uring/io_uring.c:5578 [inline]
io_poll_remove_entries+0x168/0x430 io_uring/io_uring.c:5606
io_poll_task_func+0xe8/0x250 io_uring/io_uring.c:5708
tctx_task_work+0x284/0x514 io_uring/io_uring.c:2209
task_work_run+0x12c/0x1e0 kernel/task_work.c:188
exit_task_work include/linux/task_work.h:33 [inline]
do_exit+0x684/0x1f58 kernel/exit.c:883
do_group_exit+0x100/0x268 kernel/exit.c:997
get_signal+0x73c/0x1340 kernel/signal.c:2900
do_signal arch/arm64/kernel/signal.c:893 [inline]
do_notify_resume+0x35c/0x3128 arch/arm64/kernel/signal.c:946
prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:133 [inline]
exit_to_user_mode arch/arm64/kernel/entry-common.c:138 [inline]
el0_svc+0xf0/0x1e0 arch/arm64/kernel/entry-common.c:609
el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
Allocated by task 1:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:434 [inline]
____kasan_kmalloc mm/kasan/common.c:513 [inline]
__kasan_kmalloc+0xb0/0xf0 mm/kasan/common.c:522
kasan_kmalloc include/linux/kasan.h:264 [inline]
kmem_cache_alloc_trace+0x274/0x3fc mm/slub.c:3247
kmalloc include/linux/slab.h:604 [inline]
kzalloc include/linux/slab.h:735 [inline]
__comedi_device_postconfig_async drivers/comedi/drivers.c:664 [inline]
__comedi_device_postconfig drivers/comedi/drivers.c:721 [inline]
comedi_device_postconfig+0x428/0xb48 drivers/comedi/drivers.c:756
comedi_auto_config+0x228/0x328 drivers/comedi/drivers.c:1069
comedi_test_init+0xb0/0x14c drivers/comedi/drivers/comedi_test.c:834
do_one_initcall+0x228/0x8b0 init/main.c:1302
do_initcall_level+0x154/0x214 init/main.c:1375
do_initcalls+0x58/0xac init/main.c:1391
do_basic_setup+0x8c/0xa0 init/main.c:1410
kernel_init_freeable+0x404/0x5fc init/main.c:1615
kernel_init+0x24/0x1d0 init/main.c:1506
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:855
Freed by task 4739:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track+0x4c/0x84 mm/kasan/common.c:46
kasan_set_free_info+0x28/0x4c mm/kasan/generic.c:360
____kasan_slab_free+0x118/0x164 mm/kasan/common.c:366
__kasan_slab_free+0x18/0x28 mm/kasan/common.c:374
kasan_slab_free include/linux/kasan.h:230 [inline]
slab_free_hook mm/slub.c:1705 [inline]
slab_free_freelist_hook+0x128/0x1e8 mm/slub.c:1731
slab_free mm/slub.c:3499 [inline]
kfree+0x170/0x40c mm/slub.c:4559
comedi_device_detach_cleanup drivers/comedi/drivers.c:172 [inline]
comedi_device_detach+0x2c4/0x5d8 drivers/comedi/drivers.c:208
do_devconfig_ioctl drivers/comedi/comedi_fops.c:829 [inline]
comedi_unlocked_ioctl+0xb28/0xdcc drivers/comedi/comedi_fops.c:2131
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl fs/ioctl.c:860 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
The buggy address belongs to the object at ffff0000d249d400
which belongs to the cache kmalloc-256 of size 256
The buggy address is located 184 bytes inside of
256-byte region [ffff0000d249d400, ffff0000d249d500)
The buggy address belongs to the page:
page:000000002af231b2 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff0000d249d600 pfn:0x11249c
head:000000002af231b2 order:1 compound_mapcount:0
flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000010200 fffffc0003464e08 fffffc0003464d88 ffff0000c0002480
raw: ffff0000d249d600 000000000010000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff0000d249d380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff0000d249d400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff0000d249d480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff0000d249d500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff0000d249d580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
Jul 28, 2025, 1:36:32 AM7/28/25
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: c79648372d02 Linux 5.15.189
git tree: linux-5.15.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1066f4f0580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10fcb8a2580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/7ab49562317a/disk-c7964837.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e847ec1e38d3/vmlinux-c7964837.xz
kernel image: https://storage.googleapis.com/syzbot-assets/263158c6371c/Image-c7964837.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a93c18...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in __lock_acquire+0xf0/0x651c kernel/locking/lockdep.c:4882
Read of size 8 at addr ffff0000c8cb02b8 by task syz.0.16/4162
CPU: 0 PID: 4162 Comm: syz.0.16 Not tainted 5.15.189-syzkaller #0
__se_sys_exit_group kernel/exit.c:1006 [inline]
__wake_up_parent+0x0/0x60 kernel/exit.c:1006
The buggy address belongs to the object at ffff0000c8cb0200
head:0000000027fc25b4 order:1 compound_mapcount:0
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
ffff0000c8cb0200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff0000c8cb0280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff0000c8cb0300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff0000c8cb0380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
HEAD commit: c79648372d02 Linux 5.15.189
git tree: linux-5.15.y
kernel config: https://syzkaller.appspot.com/x/.config?x=9e47345638b85bd0
dashboard link: https://syzkaller.appspot.com/bug?extid=a93c18fff361680557d8
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=177cb8a2580000
dashboard link: https://syzkaller.appspot.com/bug?extid=a93c18fff361680557d8
compiler: Debian clang version 20.1.7 (++20250616065708+6146a88f6049-1~exp1~20250616065826.132), Debian LLD 20.1.7
userspace arch: arm64
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=10fcb8a2580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/7ab49562317a/disk-c7964837.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e847ec1e38d3/vmlinux-c7964837.xz
kernel image: https://storage.googleapis.com/syzbot-assets/263158c6371c/Image-c7964837.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+a93c18...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in __lock_acquire+0xf0/0x651c kernel/locking/lockdep.c:4882
CPU: 0 PID: 4162 Comm: syz.0.16 Not tainted 5.15.189-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call trace:
dump_backtrace+0x0/0x43c arch/arm64/kernel/stacktrace.c:152
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
__dump_stack+0x30/0x40 lib/dump_stack.c:88
dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106
print_address_description+0x78/0x30c mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:434 [inline]
kasan_report+0xec/0x15c mm/kasan/report.c:451
__asan_report_load8_noabort+0x44/0x50 mm/kasan/report_generic.c:309
__lock_acquire+0xf0/0x651c kernel/locking/lockdep.c:4882
lock_acquire+0x1f4/0x620 kernel/locking/lockdep.c:5623
__raw_spin_lock_irq include/linux/spinlock_api_smp.h:128 [inline]
_raw_spin_lock_irq+0xcc/0x13c kernel/locking/spinlock.c:170
spin_lock_irq include/linux/spinlock.h:388 [inline]
io_poll_remove_entry io_uring/io_uring.c:5578 [inline]
io_poll_remove_entries+0x168/0x430 io_uring/io_uring.c:5606
io_poll_task_func+0xe8/0x250 io_uring/io_uring.c:5708
tctx_task_work+0x284/0x514 io_uring/io_uring.c:2209
task_work_run+0x12c/0x1e0 kernel/task_work.c:188
exit_task_work include/linux/task_work.h:33 [inline]
do_exit+0x684/0x1f58 kernel/exit.c:883
do_group_exit+0x100/0x268 kernel/exit.c:997
__do_sys_exit_group kernel/exit.c:1008 [inline]
Call trace:
dump_backtrace+0x0/0x43c arch/arm64/kernel/stacktrace.c:152
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
__dump_stack+0x30/0x40 lib/dump_stack.c:88
dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106
print_address_description+0x78/0x30c mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:434 [inline]
kasan_report+0xec/0x15c mm/kasan/report.c:451
__asan_report_load8_noabort+0x44/0x50 mm/kasan/report_generic.c:309
__lock_acquire+0xf0/0x651c kernel/locking/lockdep.c:4882
lock_acquire+0x1f4/0x620 kernel/locking/lockdep.c:5623
__raw_spin_lock_irq include/linux/spinlock_api_smp.h:128 [inline]
_raw_spin_lock_irq+0xcc/0x13c kernel/locking/spinlock.c:170
spin_lock_irq include/linux/spinlock.h:388 [inline]
io_poll_remove_entry io_uring/io_uring.c:5578 [inline]
io_poll_remove_entries+0x168/0x430 io_uring/io_uring.c:5606
io_poll_task_func+0xe8/0x250 io_uring/io_uring.c:5708
tctx_task_work+0x284/0x514 io_uring/io_uring.c:2209
task_work_run+0x12c/0x1e0 kernel/task_work.c:188
exit_task_work include/linux/task_work.h:33 [inline]
do_exit+0x684/0x1f58 kernel/exit.c:883
do_group_exit+0x100/0x268 kernel/exit.c:997
__se_sys_exit_group kernel/exit.c:1006 [inline]
__wake_up_parent+0x0/0x60 kernel/exit.c:1006
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
Allocated by task 1:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:434 [inline]
____kasan_kmalloc mm/kasan/common.c:513 [inline]
__kasan_kmalloc+0xb0/0xf0 mm/kasan/common.c:522
kasan_kmalloc include/linux/kasan.h:264 [inline]
kmem_cache_alloc_trace+0x274/0x3fc mm/slub.c:3247
kmalloc include/linux/slab.h:604 [inline]
kzalloc include/linux/slab.h:735 [inline]
__comedi_device_postconfig_async drivers/comedi/drivers.c:664 [inline]
__comedi_device_postconfig drivers/comedi/drivers.c:721 [inline]
comedi_device_postconfig+0x428/0xb48 drivers/comedi/drivers.c:756
comedi_auto_config+0x228/0x328 drivers/comedi/drivers.c:1069
comedi_test_init+0xb0/0x14c drivers/comedi/drivers/comedi_test.c:834
do_one_initcall+0x228/0x8b0 init/main.c:1302
do_initcall_level+0x154/0x214 init/main.c:1375
do_initcalls+0x58/0xac init/main.c:1391
do_basic_setup+0x8c/0xa0 init/main.c:1410
kernel_init_freeable+0x404/0x5fc init/main.c:1615
kernel_init+0x24/0x1d0 init/main.c:1506
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:855
Freed by task 4162:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:434 [inline]
____kasan_kmalloc mm/kasan/common.c:513 [inline]
__kasan_kmalloc+0xb0/0xf0 mm/kasan/common.c:522
kasan_kmalloc include/linux/kasan.h:264 [inline]
kmem_cache_alloc_trace+0x274/0x3fc mm/slub.c:3247
kmalloc include/linux/slab.h:604 [inline]
kzalloc include/linux/slab.h:735 [inline]
__comedi_device_postconfig_async drivers/comedi/drivers.c:664 [inline]
__comedi_device_postconfig drivers/comedi/drivers.c:721 [inline]
comedi_device_postconfig+0x428/0xb48 drivers/comedi/drivers.c:756
comedi_auto_config+0x228/0x328 drivers/comedi/drivers.c:1069
comedi_test_init+0xb0/0x14c drivers/comedi/drivers/comedi_test.c:834
do_one_initcall+0x228/0x8b0 init/main.c:1302
do_initcall_level+0x154/0x214 init/main.c:1375
do_initcalls+0x58/0xac init/main.c:1391
do_basic_setup+0x8c/0xa0 init/main.c:1410
kernel_init_freeable+0x404/0x5fc init/main.c:1615
kernel_init+0x24/0x1d0 init/main.c:1506
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:855
which belongs to the cache kmalloc-256 of size 256
The buggy address is located 184 bytes inside of
256-byte region [ffff0000c8cb0200, ffff0000c8cb0300)
The buggy address is located 184 bytes inside of
The buggy address belongs to the page:
page:0000000027fc25b4 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x108cb0
head:0000000027fc25b4 order:1 compound_mapcount:0
flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000010200 dead000000000100 dead000000000122 ffff0000c0002480
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff0000c8cb0180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
Memory state around the buggy address:
ffff0000c8cb0200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff0000c8cb0280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff0000c8cb0300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff0000c8cb0380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
syzbot
Dec 7, 2025, 9:55:18 PM12/7/25
to syzkaller...@googlegroups.com
Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.
No recent activity, existing reproducers are no longer triggering the issue.
Reply all
Reply to author
Forward
0 new messages