Re: [syzbot] [sound?] KASAN: use-after-free Read in release_card_device

[Hillf Danton]

> Date: Thu, 13 Aug 2026 01:35:37 -0700	[thread overview]
> syzbot has found a reproducer for the following issue on:
> 
> HEAD commit:    3d6d817622b0 Merge tag 'scsi-fixes' of git://git.kernel.or..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=1729f479580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=aaf0da806f995318
> dashboard link: https://syzkaller.appspot.com/bug?extid=7061d72c26b7daebe2b4
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=120e8ac6580000

#syz test

--- x/sound/core/init.c
+++ y/sound/core/init.c
@@ -599,8 +599,10 @@ static int snd_card_do_free(struct snd_c
 		dev_warn(card->dev, "unable to free card info\n");
 		/* Not fatal error */
 	}
-	if (card->release_completion)
+	if (card->release_completion) {
 		complete(card->release_completion);
+		return 0;
+	}
 	if (!card->managed)
 		kfree(card);
 	return 0;
--