KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups (2)

Status: fixed on 2026/05/21 07:50
Subsystems: usb
[Documentation on labels]
Reported-by: syzbot+9a3c54f52bd1edbd975f@syzkaller.appspotmail.com
Fix commit: 8a768552f7a8 usb: usbtmc: Flush anchored URBs in usbtmc_release
First crash: 847d, last: 136d
Cause bisection: failed (error log, bisect log)
  
▶ ▼ Discussions (2)
Title Replies (including bot) Last reply
[PATCH] usb: usbtmc: Flush anchored URBs in usbtmc_release 1 (1) 2026/03/12 12:27
[syzbot] [usb?] KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups (2) 1 (6) 2026/03/12 11:58
▶ ▼ Similar bugs (3)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups usb 22 C done unreliable 14 993d 1182d 0/29 auto-obsoleted due to no activity on 2024/02/14 08:18
linux-6.1 KASAN: use-after-free Write in usb_anchor_suspend_wakeups origin:upstream 22 C error 2 296d 563d 0/3 upstream: reported C repro on 2025/01/09 05:11
linux-5.15 KASAN: use-after-free Write in usb_anchor_suspend_wakeups origin:upstream missing-backport 22 C inconclusive 1 655d 1159d 0/3 auto-obsoleted due to no activity on 2025/01/17 06:55
▶ ▼ Last patch testing requests (14)
Created Duration User Patch Repo Result
2026/03/12 11:58 24m halves@igalia.com patch upstream OK log
2026/03/12 11:27 23m halves@igalia.com upstream report log
2026/03/11 21:21 0m halves@igalia.com patch upstream error
2026/03/05 11:19 3h44m retest repro upstream report log
2026/02/19 05:01 24m retest repro upstream error
2026/02/19 05:01 1h55m retest repro upstream report log
2026/02/19 05:22 13m retest repro upstream report log
2026/02/19 05:22 0m retest repro upstream error
2026/01/22 19:30 40m retest repro upstream report log
2026/01/22 19:41 2m retest repro upstream error
2026/01/08 16:10 2h51m retest repro upstream report log
2026/01/08 16:10 2h59m retest repro upstream report log
2025/12/25 14:23 21m retest repro upstream report log
2024/04/01 23:02 25m hdanton@sina.com patch https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 480e035fc4c7 OK log
▶ ▼ Fix bisection attempts (3)
Created Duration User Patch Repo Result
2024/10/15 23:06 2h55m bisect fix upstream OK (0) job log log
2024/09/03 02:36 1h47m bisect fix upstream OK (0) job log log
2024/08/03 22:52 1h45m bisect fix upstream OK (0) job log log

Sample crash report:
==================================================================
BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
BUG: KASAN: slab-use-after-free in atomic_inc include/linux/atomic/atomic-instrumented.h:435 [inline]
BUG: KASAN: slab-use-after-free in usb_anchor_suspend_wakeups+0x28/0x50 drivers/usb/core/urb.c:910
Write of size 4 at addr ffff888034c4d1d0 by task ktimers/1/29

CPU: 1 UID: 0 PID: 29 Comm: ktimers/1 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0xba/0x230 mm/kasan/report.c:482
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x264/0x2c0 mm/kasan/generic.c:200
 instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
 atomic_inc include/linux/atomic/atomic-instrumented.h:435 [inline]
 usb_anchor_suspend_wakeups+0x28/0x50 drivers/usb/core/urb.c:910
 __usb_hcd_giveback_urb+0x264/0x5e0 drivers/usb/core/hcd.c:1648
 dummy_timer+0x8a6/0x4710 drivers/usb/gadget/udc/dummy_hcd.c:1995
 __run_hrtimer kernel/time/hrtimer.c:1777 [inline]
 __hrtimer_run_queues+0x54c/0xd10 kernel/time/hrtimer.c:1841
 hrtimer_run_softirq+0x192/0x5d0 kernel/time/hrtimer.c:1858
 handle_softirqs+0x1de/0x640 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 run_ktimerd+0x69/0x100 kernel/softirq.c:1138
 smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160
 kthread+0x726/0x8b0 kernel/kthread.c:463
 ret_from_fork+0x51b/0xa40 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246
 </TASK>

Allocated by task 6097:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __kmalloc_cache_noprof+0x1f2/0x6b0 mm/slub.c:5780
 kmalloc_noprof include/linux/slab.h:957 [inline]
 kzalloc_noprof include/linux/slab.h:1094 [inline]
 usbtmc_open+0x9c/0x910 drivers/usb/class/usbtmc.c:175
 usb_open+0x159/0x1e0 drivers/usb/core/file.c:47
 chrdev_open+0x4d0/0x5f0 fs/char_dev.c:414
 do_dentry_open+0x7d0/0x1270 fs/open.c:962
 vfs_open+0x3b/0x350 fs/open.c:1094
 do_open fs/namei.c:4637 [inline]
 path_openat+0x34c9/0x3e70 fs/namei.c:4796
 do_filp_open+0x22d/0x490 fs/namei.c:4823
 do_sys_openat2+0x12f/0x220 fs/open.c:1430
 do_sys_open fs/open.c:1436 [inline]
 __do_sys_openat fs/open.c:1452 [inline]
 __se_sys_openat fs/open.c:1447 [inline]
 __x64_sys_openat+0x138/0x170 fs/open.c:1447
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 6097:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2540 [inline]
 slab_free mm/slub.c:6674 [inline]
 kfree+0x1bb/0x8f0 mm/slub.c:6882
 usbtmc_release+0x249/0x280 drivers/usb/class/usbtmc.c:261
 __fput+0x45e/0xa80 fs/file_table.c:468
 task_work_run+0x1d9/0x270 kernel/task_work.c:233
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 __exit_to_user_mode_loop kernel/entry/common.c:44 [inline]
 exit_to_user_mode_loop+0xed/0x480 kernel/entry/common.c:75
 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline]
 syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline]
 syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline]
 syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline]
 do_syscall_64+0x2b7/0xf80 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff888034c4d000
 which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 464 bytes inside of
 freed 1024-byte region [ffff888034c4d000, ffff888034c4d400)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x34c48
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x80000000000040(head|node=0|zone=1)
page_type: f5(slab)
raw: 0080000000000040 ffff88813fe26dc0 dead000000000122 0000000000000000
raw: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
head: 0080000000000040 ffff88813fe26dc0 dead000000000122 0000000000000000
head: 0000000000000000 0000000080100010 00000000f5000000 0000000000000000
head: 0080000000000003 ffffea0000d31201 00000000ffffffff 00000000ffffffff
head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 978, tgid 978 (kworker/u8:7), ts 186018848321, free_ts 185880483242
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x228/0x280 mm/page_alloc.c:1884
 prep_new_page mm/page_alloc.c:1892 [inline]
 get_page_from_freelist+0x28bb/0x2950 mm/page_alloc.c:3945
 __alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5240
 alloc_pages_mpol+0xd1/0x380 mm/mempolicy.c:2486
 alloc_slab_page mm/slub.c:3075 [inline]
 allocate_slab+0x86/0x3a0 mm/slub.c:3248
 new_slab mm/slub.c:3302 [inline]
 ___slab_alloc+0xaf8/0x13d0 mm/slub.c:4656
 __slab_alloc+0xc5/0x1f0 mm/slub.c:4779
 __slab_alloc_node mm/slub.c:4855 [inline]
 slab_alloc_node mm/slub.c:5251 [inline]
 __do_kmalloc_node mm/slub.c:5656 [inline]
 __kmalloc_noprof+0x15e/0x7c0 mm/slub.c:5669
 kmalloc_noprof include/linux/slab.h:961 [inline]
 kzalloc_noprof include/linux/slab.h:1094 [inline]
 ieee802_11_parse_elems_full+0x159/0x2ab0 net/mac80211/parse.c:1031
 ieee802_11_parse_elems net/mac80211/ieee80211_i.h:2467 [inline]
 ieee80211_inform_bss+0x161/0x1160 net/mac80211/scan.c:79
 rdev_inform_bss net/wireless/rdev-ops.h:418 [inline]
 cfg80211_inform_single_bss_data+0xd2f/0x1b30 net/wireless/scan.c:2373
 cfg80211_inform_bss_data+0x23f/0x3c20 net/wireless/scan.c:3228
 cfg80211_inform_bss_frame_data+0x3c7/0x710 net/wireless/scan.c:3319
 ieee80211_bss_info_update+0x794/0xa40 net/mac80211/scan.c:230
 ieee80211_rx_bss_info net/mac80211/ibss.c:1094 [inline]
 ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1575 [inline]
 ieee80211_ibss_rx_queued_mgmt+0x1901/0x2c80 net/mac80211/ibss.c:1602
 ieee80211_iface_process_skb net/mac80211/iface.c:1740 [inline]
 ieee80211_iface_work+0x85e/0x12b0 net/mac80211/iface.c:1794
page last free pid 6069 tgid 6069 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1433 [inline]
 __free_frozen_pages+0xfd0/0x1160 mm/page_alloc.c:2973
 discard_slab mm/slub.c:3346 [inline]
 __put_partials+0x149/0x170 mm/slub.c:3886
 __slab_free+0x2af/0x330 mm/slub.c:5956
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x97/0x100 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4953 [inline]
 slab_alloc_node mm/slub.c:5263 [inline]
 kmem_cache_alloc_noprof+0x188/0x6a0 mm/slub.c:5270
 getname_flags+0xb7/0x540 fs/namei.c:146
 getname include/linux/fs.h:2500 [inline]
 getname_maybe_null include/linux/fs.h:2507 [inline]
 vfs_fstatat+0x43/0x170 fs/stat.c:370
 __do_sys_newfstatat fs/stat.c:542 [inline]
 __se_sys_newfstatat fs/stat.c:536 [inline]
 __x64_sys_newfstatat+0x151/0x200 fs/stat.c:536
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff888034c4d080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888034c4d100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888034c4d180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                 ^
 ffff888034c4d200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888034c4d280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

Crashes (27):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/02/05 04:38 upstream 5fd0a1df5d05 ea10c935 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
2026/02/04 22:12 upstream 5fd0a1df5d05 ea10c935 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
2025/10/09 17:55 upstream ec714e371f22 7e2882b3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
2025/05/31 22:08 upstream dee264c16a63 3d2f584d .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
2025/04/30 00:43 upstream ca91b9500108 aeb6ec69 .config strace log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
2024/03/31 05:29 upstream 480e035fc4c7 6baf5069 .config strace log report syz C [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
2025/02/10 11:06 upstream a64dcfb451e2 ef44b750 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
2024/12/06 10:57 upstream 5076001689e4 946d28f0 .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
2024/11/23 12:23 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 7b1d1d4cfac0 68da6d95 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
2025/06/20 23:24 upstream 75f5f23f8787 e3003213 .config console log report syz / log [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
2026/02/04 21:09 upstream 5fd0a1df5d05 ea10c935 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
2025/11/03 11:17 upstream 6146a0f1dfae 2c50b6a9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
2025/10/13 14:38 upstream 3a8660878839 ff1712fe .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
2025/10/09 15:58 upstream ec714e371f22 7e2882b3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
2025/05/08 08:49 upstream 707df3375124 dbf35fa1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
2024/05/05 01:39 upstream 3d25a941ea50 610f2a54 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
2024/04/03 22:10 upstream 480e035fc4c7 fed899ed .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
2024/03/31 05:00 upstream 480e035fc4c7 6baf5069 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
2025/10/21 12:03 upstream 211ddde0823f 9832ed61 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
2025/10/14 13:00 upstream 3a8660878839 b6605ba8 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
2025/01/07 14:34 upstream fbfd64d25c7a f3558dbf .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-386 KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
2025/11/13 07:10 upstream e927c520e1ba 07e030de .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
2025/10/23 09:37 upstream 43e9ad0c55a3 c0460fcd .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
2025/06/02 08:22 upstream cd2e103d57e5 3d2f584d .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
2025/05/29 03:08 upstream feacb1774bd5 3d2f584d .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
2024/11/19 08:24 upstream 9fb2cfa4635a 571351cb .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
2024/09/15 18:07 upstream 98f7e32f20d2 08d8a733 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream KASAN: slab-use-after-free Write in usb_anchor_suspend_wakeups
* Struck through repros no longer work on HEAD.