Re: [syzbot] [kernel?] KASAN: slab-use-after-free Read in __release_resource

[Bradley Morgan]

On 1 August 2026 02:02:24 BST, syzbot
<syzbot+ee1062851b628d722093@xxxxxxxxxxxxxxxxxxxxxxxxx> wrote:
>> #syz test: From 9cd23575828ada0a338a2dd0019e97476c4f5d23 Mon Sep 17
>
>I've failed to parse your command.
>Did you perhaps forget to provide the branch name, or added an extra ':'?
>Please use one of the two supported formats:
>1. #syz test
>2. #syz test: repo branch-or-commit-hash
>Note the lack of ':' in option 1.
>
>> 00:00:00 2001
>> From: Bradley Morgan <include@xxxxxxxxx>
>> Date: Sat, 1 Aug 2026 00:58:20 +0000
>> Subject: [PATCH] driver core: platform: use remove_resource() to
>properly reparent children
>>
>> platform_device_add() inserts resources into the global iomem/ioport
>> trees via insert_resource(), which may reparent existing resources as
>> children of the newly inserted one.
>>
>> The teardown paths in platform_device_add() (error path) and
>> platform_device_del() use release_resource() to remove these
>> resources.  However, release_resource() calls __release_resource()
>> with release_child=true, which simply unlinks the resource from its
>> parent's child list without reparenting its children.  Any child
>> resources that were moved under it by insert_resource() are left
>> with dangling ->parent pointers.
>>
>> When the platform device's kmemdup'd resource array is subsequently
>> freed by platform_device_release(), those children (e.g. a PCI BAR
>> resource that was reparented under the platform device's resource)
>> end up with ->parent pointing to freed memory.  A later
>> release_resource() on such a child dereferences the stale pointer in
>> __release_resource(), causing a slab-use-after-free.
>>
>> Fix it by using remove_resource() instead, which is the proper
>> counterpart to insert_resource().  remove_resource() calls
>> __release_resource() with release_child=false, which reparents
>> children up to the removed resource's parent before unlinking it,
>> keeping all ->parent pointers valid.
>>
>> Reported-by: syzbot+ee1062851b628d722093@xxxxxxxxxxxxxxxxxxxxxxxxx
>> Closes:
>https://lore.kernel.org/all/6a6d39e7.f794c993.27aeb.0009.GAE@xxxxxxxxxx/
>> Assisted-by: GLM:glm-5.2
>> Signed-off-by: Bradley Morgan <include@xxxxxxxxx>
>> ---
>>  drivers/base/platform.c | 4 ++--
>>  1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/base/platform.c b/drivers/base/platform.c
>> index a71015f1d915..9a6932d50ee5 100644
>> --- a/drivers/base/platform.c
>> +++ b/drivers/base/platform.c
>> @@ -830,7 +830,7 @@ int platform_device_add(struct platform_device
>*pdev)
>>         while (i--) {
>>                 struct resource *r = &pdev->resource[i];
>>                 if (r->parent)
>> -                       release_resource(r);
>> +                       remove_resource(r);
>>         }
>>
>>         return ret;
>> @@ -860,7 +860,7 @@ void platform_device_del(struct platform_device
>*pdev)
>>                 for (i = 0; i < pdev->num_resources; i++) {
>>                         struct resource *r = &pdev->resource[i];
>>                         if (r->parent)
>> -                               release_resource(r);
>> +                               remove_resource(r);
>>                 }
>>         }
>>  }
>> --
>> 2.47.3
>>
>>
>> Note: AI generated.
>> Thanks!
>


#syz test

diff --git a/drivers/base/platform.c b/drivers/base/platform.c
--- a/drivers/base/platform.c
+++ b/drivers/base/platform.c
@@ -830,7 +830,7 @@ int platform_device_add(struct platform_device *pdev)
        while (i--) {
                struct resource *r = &pdev->resource[i];
                if (r->parent)
-                       release_resource(r);
+                       remove_resource(r);
        }

        return ret;
@@ -860,7 +860,7 @@ void platform_device_del(struct platform_device *pdev)
                for (i = 0; i < pdev->num_resources; i++) {
                        struct resource *r = &pdev->resource[i];
                        if (r->parent)
-                               release_resource(r);
+                               remove_resource(r);
                }
        }
 }


this better work. for goodness sake.... :(

Thanks!