[BUG] ceph: KASAN slab-use-after-free in ceph_put_wrbuffer_cap_refs

[Shuangpeng]

Hi Kernel Maintainers,

I hit the following KASAN report while testing current upstream kernel:

KASAN: slab-use-after-free in ceph_put_wrbuffer_cap_refs

on commit: e8c2f9fdadee7cbc75134dc463c1e0d856d6e5c7 (May 25 2026)

The reproducer and .config files are here.
https://gist.github.com/shuangpengbai/c82cc2452f2fd3f31815efb83ad80b1d

I'm happy to test debug patches or provide additional information.

Reported-by: Shuangpeng Bai <shuangpeng.kernel@xxxxxxxxx>

[  197.863252][  T795] ==================================================================
[  197.864328][  T795] BUG: KASAN: slab-use-after-free in ceph_put_wrbuffer_cap_refs (fs/ceph/caps.c:3404)
[  197.866347][  T795] Read of size 8 at addr ffff888117a93c38 by task kworker/1:2/795
[  197.867135][  T795]
[  197.867396][  T795] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[  197.867399][  T795] Workqueue: ceph-msgr ceph_con_workfn
[  197.868513][  T795] Call Trace:
[  197.868518][  T795]  <TASK>
[  197.868521][  T795]  dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
[  197.868529][  T795]  print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
[  197.868548][  T795]  kasan_report (mm/kasan/report.c:595)
[  197.868555][  T795]  ceph_put_wrbuffer_cap_refs (fs/ceph/caps.c:3404)
[  197.868560][  T795]  writepages_finish (fs/ceph/addr.c:980)
[  197.868568][  T795]  osd_dispatch (net/ceph/osd_client.c:2524 net/ceph/osd_client.c:3870 net/ceph/osd_client.c:5370)
[  197.869699][  T795]  ceph_con_process_message (net/ceph/messenger.c:1425)
[  197.869718][  T795]  ceph_con_v1_try_read (net/ceph/messenger_v1.c:1430)
[  197.869727][  T795]  ceph_con_workfn (net/ceph/messenger.c:1577)
[  197.869731][  T795]  process_scheduled_works (kernel/workqueue.c:3314 kernel/workqueue.c:3397)
[  197.869739][  T795]  worker_thread (kernel/workqueue.c:3478)
[  197.869754][  T795]  kthread (kernel/kthread.c:436)
[  197.869765][  T795]  ret_from_fork (kernel/process.c:158)
[  197.869773][  T795]  ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
[  197.869780][  T795]  </TASK>
[  197.869782][  T795]
[  197.887591][  T795] Freed by task 795 on cpu 1 at 197.863249s:
[  197.888221][  T795]  kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78)
[  197.888728][  T795]  kasan_save_free_info (mm/kasan/generic.c:584)
[  197.889253][  T795]  __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)
[  197.889758][  T795]  kmem_cache_free (include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6378)
[  197.890256][  T795]  ceph_try_drop_cap_snap (fs/ceph/super.h:283 fs/ceph/caps.c:3213)
[  197.890820][  T795]  ceph_put_wrbuffer_cap_refs (fs/ceph/caps.c:3396)
[  197.891411][  T795]  writepages_finish (fs/ceph/addr.c:980)
[  197.891930][  T795]  osd_dispatch (net/ceph/osd_client.c:2524 net/ceph/osd_client.c:3870 net/ceph/osd_client.c:5370)
[  197.892422][  T795]  ceph_con_process_message (net/ceph/messenger.c:1425)
[  197.892999][  T795]  ceph_con_v1_try_read (net/ceph/messenger_v1.c:1430)
[  197.893552][  T795]  ceph_con_workfn (net/ceph/messenger.c:1577)
[  197.894053][  T795]  process_scheduled_works (kernel/workqueue.c:3314 kernel/workqueue.c:3397)
[  197.894614][  T795]  worker_thread (kernel/workqueue.c:3478)
[  197.895096][  T795]  kthread (kernel/kthread.c:436)
[  197.895519][  T795]  ret_from_fork (kernel/process.c:158)
[  197.896005][  T795]  ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
[  197.896498][  T795]
[  197.896754][  T795] The buggy address belongs to the object at ffff888117a93be0
[  197.896754][  T795]  which belongs to the cache ceph_cap_snap of size 240
[  197.898196][  T795] The buggy address is located 88 bytes inside of
[  197.898196][  T795]  freed 240-byte region [ffff888117a93be0, ffff888117a93cd0)

Best,
Shuangpeng