Re: [syzbot] [kernel?] KASAN: slab-use-after-free Read in __release_resource

[Bradley Morgan]

On 1 August 2026 02:06:48 BST, syzbot
<syzbot+ee1062851b628d722093@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
>> On 1 August 2026 02:02:24 BST, syzbot
>> <syzbot+ee1062851b628d722093@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
>>>> #syz test: From 9cd23575828ada0a338a2dd0019e97476c4f5d23 Mon Sep 17
>>>
>>>I've failed to parse your command.
>>>Did you perhaps forget to provide the branch name, or added an extra
>':'?
>>>Please use one of the two supported formats:
>>>1. #syz test
>>>2. #syz test: repo branch-or-commit-hash
>>>Note the lack of ':' in option 1.
>>>
>>>> 00:00:00 2001
>>>> From: Bradley Morgan <include@xxxxxxxxx>
>>>> Date: Sat, 1 Aug 2026 00:58:20 +0000
>>>> Subject: [PATCH] driver core: platform: use remove_resource() to
>>>properly reparent children
>>>>
>>>> platform_device_add() inserts resources into the global iomem/ioport
>>>> trees via insert_resource(), which may reparent existing resources as
>>>> children of the newly inserted one.
>>>>
>>>> The teardown paths in platform_device_add() (error path) and
>>>> platform_device_del() use release_resource() to remove these
>>>> resources.  However, release_resource() calls __release_resource()
>>>> with release_child=true, which simply unlinks the resource from its
>>>> parent's child list without reparenting its children.  Any child
>>>> resources that were moved under it by insert_resource() are left
>>>> with dangling ->parent pointers.
>>>>
>>>> When the platform device's kmemdup'd resource array is subsequently
>>>> freed by platform_device_release(), those children (e.g. a PCI BAR
>>>> resource that was reparented under the platform device's resource)
>>>> end up with ->parent pointing to freed memory.  A later
>>>> release_resource() on such a child dereferences the stale pointer in
>>>> __release_resource(), causing a slab-use-after-free.
>>>>
>>>> Fix it by using remove_resource() instead, which is the proper
>>>> counterpart to insert_resource().  remove_resource() calls
>>>> __release_resource() with release_child=false, which reparents
>>>> children up to the removed resource's parent before unlinking it,
>>>> keeping all ->parent pointers valid.
>>>>
>>>> Reported-by: syzbot+ee1062851b628d722093@xxxxxxxxxxxxxxxxxxxxxxxxx
>>>> Closes:
>>>https://lore.kernel.org/all/6a6d39e7.f794c993.27aeb.0009.GAE@xxxxxxxxxx/
>>>> Assisted-by: GLM:glm-5.2
>>>> Signed-off-by: Bradley Morgan <include@xxxxxxxxx>
>>>> ---
>>>>  drivers/base/platform.c | 4 ++--
>>>>  1 file changed, 2 insertions(+), 2 deletions(-)
>>>>
>>>> diff --git a/drivers/base/platform.c b/drivers/base/platform.c
>>>> index a71015f1d915..9a6932d50ee5 100644
>>>> --- a/drivers/base/platform.c
>>>> +++ b/drivers/base/platform.c
>>>> @@ -830,7 +830,7 @@ int platform_device_add(struct platform_device
>>>*pdev)
>>>>         while (i--) {
>>>>                 struct resource *r = &pdev->resource[i];
>>>>                 if (r->parent)
>>>> -                       release_resource(r);
>>>> +                       remove_resource(r);
>>>>         }
>>>>
>>>>         return ret;
>>>> @@ -860,7 +860,7 @@ void platform_device_del(struct platform_device
>>>*pdev)
>>>>                 for (i = 0; i < pdev->num_resources; i++) {
>>>>                         struct resource *r = &pdev->resource[i];
>>>>                         if (r->parent)
>>>> -                               release_resource(r);
>>>> +                               remove_resource(r);
>>>>                 }
>>>>         }
>>>>  }
>>>> --
>>>> 2.47.3
>>>>
>>>>
>>>> Note: AI generated.
>>>> Thanks!
>>>
>>
>>
>> #syz test
>
>This crash does not have a reproducer. I cannot test it.
>
>>
>> diff --git a/drivers/base/platform.c b/drivers/base/platform.c
>> --- a/drivers/base/platform.c
>> +++ b/drivers/base/platform.c
>> @@ -830,7 +830,7 @@ int platform_device_add(struct platform_device
>*pdev)
>>         while (i--) {
>>                 struct resource *r = &pdev->resource[i];
>>                 if (r->parent)
>> -                       release_resource(r);
>> +                       remove_resource(r);
>>         }
>>
>>         return ret;
>> @@ -860,7 +860,7 @@ void platform_device_del(struct platform_device
>*pdev)
>>                 for (i = 0; i < pdev->num_resources; i++) {
>>                         struct resource *r = &pdev->resource[i];
>>                         if (r->parent)
>> -                               release_resource(r);
>> +                               remove_resource(r);
>>                 }
>>         }
>>  }
>>
>>
>> this better work. for goodness sake.... :(
>>
>> Thanks!
>



Seriously, please take this patch for the (hopeful) fix, this is AI
generated
(I
kinda wasted my time cuz I thought this was kernel/ :( )