[BUG] KASAN: slab-use-after-free in cdev_put
From: Shuangpeng Bai
Date: Fri May 29 2026 - 16:20:08 EST
Hi Kernel Maintainers,
I hit the following KASAN report while testing current upstream kernel:
KASAN: slab-use-after-free in cdev_put
on commit: e8c2f9fdadee7cbc75134dc463c1e0d856d6e5c7 (May 25 2026)
The reproducer and .config files are here.
https://gist.github.com/shuangpengbai/8f7dd0c0b1c638482b0e4cc62c554121
I’m happy to test debug patches or provide additional information.
Reported-by: Shuangpeng Bai <shuangpeng.kernel@xxxxxxxxx>
[ 133.746964][ T8494] =================================================================[ 133.747541][ T8494] BUG: KASAN: slab-use-after-free in cdev_put (fs/char_dev.c:361)
[ 133.748018][ T8494] Read of size 8 at addr ffff8881066d7108 by task bad_nvme_io/8494
[ 133.748544][ T8494]
[ 133.748716][ T8494] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.34
[ 133.748718][ T8494] Call Trace:
[ 133.748720][ T8494] <TASK>
[ 133.748721][ T8494] dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
[ 133.748725][ T8494] print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
[ 133.748734][ T8494] kasan_report (mm/kasan/report.c:595)
[ 133.748738][ T8494] cdev_put (fs/char_dev.c:361)
[ 133.748740][ T8494] __fput (fs/file_table.c:513)
[ 133.748743][ T8494] fput_close_sync (fs/file_table.c:615)
[ 133.748756][ T8494] __x64_sys_close (fs/open.c:1507 fs/open.c:1492 fs/open.c:1492)
[ 133.748759][ T8494] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
[ 133.748761][ T8494] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
[ 133.748764][ T8494] RIP: 0033:0x7fd3713a311b
[ 133.748767][ T8494] Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 f3 fb ff f4
Code starting with the faulting instruction
========================================== 0: 0f 05 syscall
2: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax
8: 77 45 ja 0x4f
a: c3 ret
b: 0f 1f 40 00 nopl 0x0(%rax)
f: 48 83 ec 18 sub $0x18,%rsp
13: 89 7c 24 0c mov %edi,0xc(%rsp)
17: e8 f3 fb ff f4 call 0xfffffffff4fffc0f
[ 133.748769][ T8494] RSP: 002b:00007fd3709b7e60 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
[ 133.748773][ T8494] RAX: ffffffffffffffda RBX: 0000557a0cdd5390 RCX: 00007fd3713a311b
[ 133.748775][ T8494] RDX: 00007fd3709b7e80 RSI: 00000000c0484e43 RDI: 0000000000000010
[ 133.748776][ T8494] RBP: 0000000000000010 R08: 0000000000000000 R09: 00007fd3709b8700
[ 133.748778][ T8494] R10: 0000000000000000 R11: 0000000000000293 R12: 00007fd3709b7e80
[ 133.748779][ T8494] R13: 000000000000010b R14: 00007fd3709b7fc0 R15: 0000000000802000
[ 133.748782][ T8494] </TASK>
[ 133.748783][ T8494]
[ 133.760567][ T8494] Freed by task 8494 on cpu 1 at 133.746963s:
[ 133.760976][ T8494] kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78)
[ 133.761296][ T8494] kasan_save_free_info (mm/kasan/generic.c:584)
[ 133.761651][ T8494] __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)
[ 133.761976][ T8494] kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6566)
[ 133.762243][ T8494] nvme_ns_head_chr_release (drivers/nvme/host/multipath.c:606)
[ 133.762617][ T8494] __fput (fs/file_table.c:510)
[ 133.762889][ T8494] fput_close_sync (fs/file_table.c:615)
[ 133.763213][ T8494] __x64_sys_close (fs/open.c:1507 fs/open.c:1492 fs/open.c:1492)
[ 133.763526][ T8494] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
[ 133.763838][ T8494] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
[ 133.764235][ T8494]
[ 133.764398][ T8494] The buggy address belongs to the object at ffff8881066d7000
[ 133.764398][ T8494] which belongs to the cache kmalloc-2k of size 2048
[ 133.765325][ T8494] The buggy address is located 264 bytes inside of
[ 133.765325][ T8494] freed 2048-byte region [ffff8881066d7000, ffff8881066d7800)
Best,
Shuangpeng
Attachment:
smime.p7s
Description: S/MIME cryptographic signature