Re: [syzbot] [usb?] KASAN: slab-use-after-free Read in uea_upload_pre_firmware
From: Hillf Danton
Date: Sat Jul 11 2026 - 20:09:46 EST
> Date: Mon, 29 Jun 2026 14:09:27 -0700
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 3d5670d672ae Add linux-next specific files for 20260626
> git tree: linux-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=10b76dfe580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=2bb8183b2d472f18
> dashboard link: https://syzkaller.appspot.com/bug?extid=3d45d763d18796f97412
> compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15fa0e1c580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13519391580000
#syz test
--- x/drivers/usb/atm/ueagle-atm.c
+++ y/drivers/usb/atm/ueagle-atm.c
@@ -2605,9 +2605,11 @@ static void uea_disconnect(struct usb_in
usbatm_usb_disconnect(intf);
mutex_unlock(&uea_mutex);
uea_info(usb, "ADSL device removed\n");
- } else if (usb->config->desc.bNumInterfaces == 1) {
+ } else {
struct completion *fw_done = usb_get_intfdata(intf);
+ if (!fw_done)
+ return;
uea_dbg(usb, "pre-firmware device, waiting firmware upload\n");
wait_for_completion(fw_done);
uea_dbg(usb, "pre-firmware device, finished waiting\n");
--