Re: [BUG] ceph: KASAN slab-use-after-free in ceph_put_wrbuffer_cap_refs

[Viacheslav Dubeyko]

On Thu, 2026-07-02 at 19:04 -0400, Shuangpeng wrote:
> Hi Kernel Maintainers,
> 
> I hit the following KASAN report while testing current upstream kernel:
> 
> KASAN: slab-use-after-free in ceph_put_wrbuffer_cap_refs
> 
> on commit: e8c2f9fdadee7cbc75134dc463c1e0d856d6e5c7 (May 25 2026)
> 
> The reproducer and .config files are here.
> https://urldefense.proofpoint.com/v2/url?u=https-3A__gist.github.com_shuangpengbai_c82cc2452f2fd3f31815efb83ad80b1d&d=DwIFAg&c=BSDicqBQBDjDI9RkVyTcHQ&r=q5bIm4AXMzc8NJu1_RGmnQ2fMWKq4Y4RAkElvUgSs00&m=bPfk3u50-mrnDsoQNdjCYDwvBNxK4JGRLVR2_NvKuibLdwpIju0JgsLu5wfnytku&s=9_IvpHlSSMJX1HjsdL93p04TtX8z5-uuR3OBv6SgGmg&e= 
> 
> I'm happy to test debug patches or provide additional information.
> 
> Reported-by: Shuangpeng Bai <shuangpeng.kernel@xxxxxxxxx>
> 
> [  197.863252][  T795] ==================================================================
> [  197.864328][  T795] BUG: KASAN: slab-use-after-free in ceph_put_wrbuffer_cap_refs (fs/ceph/caps.c:3404)
> [  197.866347][  T795] Read of size 8 at addr ffff888117a93c38 by task kworker/1:2/795
> [  197.867135][  T795]
> [  197.867396][  T795] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
> [  197.867399][  T795] Workqueue: ceph-msgr ceph_con_workfn
> [  197.868513][  T795] Call Trace:
> [  197.868518][  T795]  <TASK>
> [  197.868521][  T795]  dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
> [  197.868529][  T795]  print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
> [  197.868548][  T795]  kasan_report (mm/kasan/report.c:595)
> [  197.868555][  T795]  ceph_put_wrbuffer_cap_refs (fs/ceph/caps.c:3404)
> [  197.868560][  T795]  writepages_finish (fs/ceph/addr.c:980)
> [  197.868568][  T795]  osd_dispatch (net/ceph/osd_client.c:2524 net/ceph/osd_client.c:3870 net/ceph/osd_client.c:5370)
> [  197.869699][  T795]  ceph_con_process_message (net/ceph/messenger.c:1425)
> [  197.869718][  T795]  ceph_con_v1_try_read (net/ceph/messenger_v1.c:1430)
> [  197.869727][  T795]  ceph_con_workfn (net/ceph/messenger.c:1577)
> [  197.869731][  T795]  process_scheduled_works (kernel/workqueue.c:3314 kernel/workqueue.c:3397)
> [  197.869739][  T795]  worker_thread (kernel/workqueue.c:3478)
> [  197.869754][  T795]  kthread (kernel/kthread.c:436)
> [  197.869765][  T795]  ret_from_fork (kernel/process.c:158)
> [  197.869773][  T795]  ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
> [  197.869780][  T795]  </TASK>
> [  197.869782][  T795]
> [  197.887591][  T795] Freed by task 795 on cpu 1 at 197.863249s:
> [  197.888221][  T795]  kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78)
> [  197.888728][  T795]  kasan_save_free_info (mm/kasan/generic.c:584)
> [  197.889253][  T795]  __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)
> [  197.889758][  T795]  kmem_cache_free (include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6251 mm/slub.c:6378)
> [  197.890256][  T795]  ceph_try_drop_cap_snap (fs/ceph/super.h:283 fs/ceph/caps.c:3213)
> [  197.890820][  T795]  ceph_put_wrbuffer_cap_refs (fs/ceph/caps.c:3396)
> [  197.891411][  T795]  writepages_finish (fs/ceph/addr.c:980)
> [  197.891930][  T795]  osd_dispatch (net/ceph/osd_client.c:2524 net/ceph/osd_client.c:3870 net/ceph/osd_client.c:5370)
> [  197.892422][  T795]  ceph_con_process_message (net/ceph/messenger.c:1425)
> [  197.892999][  T795]  ceph_con_v1_try_read (net/ceph/messenger_v1.c:1430)
> [  197.893552][  T795]  ceph_con_workfn (net/ceph/messenger.c:1577)
> [  197.894053][  T795]  process_scheduled_works (kernel/workqueue.c:3314 kernel/workqueue.c:3397)
> [  197.894614][  T795]  worker_thread (kernel/workqueue.c:3478)
> [  197.895096][  T795]  kthread (kernel/kthread.c:436)
> [  197.895519][  T795]  ret_from_fork (kernel/process.c:158)
> [  197.896005][  T795]  ret_from_fork_asm (arch/x86/entry/entry_64.S:245)
> [  197.896498][  T795]
> [  197.896754][  T795] The buggy address belongs to the object at ffff888117a93be0
> [  197.896754][  T795]  which belongs to the cache ceph_cap_snap of size 240
> [  197.898196][  T795] The buggy address is located 88 bytes inside of
> [  197.898196][  T795]  freed 240-byte region [ffff888117a93be0, ffff888117a93cd0)
> 

It will be great if you can create the ticket in Ceph tracker [1].

Thanks,
Slava.

[1] https://tracker.ceph.com/