Re: [BUG] KASAN: slab-use-after-free Read in vhci_tx_loop

[Greg Kroah-Hartman]

On Sun, Jul 12, 2026 at 06:40:37PM +0900, Jaeyoung Chung wrote:
> Hello,
> 
> We found a slab-use-after-free Read in vhci_tx_loop on Linux v7.2-rc2
> (8cdeaa50eae8dad34885515f62559ee83e7e8dda).
> 
> The report below was produced on an x86_64 QEMU guest with KASAN. The kernel
> configuration is the same as the syzbot configuration.
> 
> Required kernel config for reproducing the issue:
> 	CONFIG_USBIP_CORE=y
> 	CONFIG_USBIP_VHCI_HCD=y
> 	CONFIG_USBIP_VHCI_HC_PORTS=8
> 	CONFIG_USBIP_VHCI_NR_HCS=16
> 	CONFIG_KASAN=y
> 	CONFIG_KASAN_GENERIC=y
> 	CONFIG_KASAN_INLINE=y
> 
> To make the race reliably reproducible, I applied the testing-only delay
> patch below. I then built and ran the reproducer as root:
> 
>   gcc repro.c -o repro -static -lpthread
>   ./repro
> 
> I do not have a proposed fix for this issue. Please let me know if any
> additional information or testing would be useful.
> 
> Reported-by: Jaeyoung Chung <jjy600901@xxxxxxxxx>
> Reported-by: Eulgyu Kim <eulgyukim@xxxxxxxxx>

A proposed patch would be best as you have a way to reproduce the issue.

thanks,

greg k-h