Re: [syzbot] [usb?] KASAN: slab-use-after-free Write in iowarrior_write_callback (2)

[Greg KH]

On Fri, May 22, 2026 at 01:38:40PM -0700, Joseph Bursey wrote:
> Hello, I believe I have a reproducer for this bug using a combination
> of syz-execprog and eBPF programs. There are three artifacts used to
> reproduce the bug: prog.syz loader.c and func.bpf.c, which can be
> compiled as follows:
> 
> bpftool btf dump file linux/vmlinux format c > vmlinux.h
> gcc loader.c -o loader -lbpf -lelf -lz -static -lzstd
> clang -O2 -g -target bpf -c func.bpf.c -o func.bpf.o
> 
> And then run using syz-execprog:
> 
> ./loader & ./syz-execprog -executor=./syz-executor -enable=usb,close_fds
> -repeat=0 -procs=4 -threaded -collide -slowdown=1 ./prog.syz
> 
> The following configs were added to what Syzkaller used:
> CONFIG_KPROBES=y
> CONFIG_KPROBE_EVENTS=y
> CONFIG_FTRACE_SYSCALLS=y
> CONFIG_DEBUG_INFO_BTF=y
> CONFIG_DEBUG_INFO_BTF_MODULES=y
> CONFIG_FUNCTION_TRACER=y
> CONFIG_KPROBE_EVENTS_ON_NOTRACE=y
> 
> I am interested to know if eBPF based reproducers are helpful during
> the debugging process.

If you can use that to create a fix, great!  Otherwise there's not much
we can do here with this :)

thanks,

greg k-h