Re: [syzbot] [usb?] KASAN: slab-use-after-free Read in ep_open

[Jens Axboe]

On 8/17/26 7:42 AM, syzbot wrote:
> syzbot has bisected this issue to:
> 
> commit aa00f67adc2c0d6439f81b5a81ff181377c47a7e
> Author: Jens Axboe <axboe@xxxxxxxxx>
> Date:   Tue Oct 22 19:47:00 2024 +0000
> 
>     io_uring: add support for fixed wait regions
> 
> bisection log:  https://syzkaller.appspot.com/x/bisect.txt?x=10e60679580000
> start commit:   9a143525f62b Merge tag 'ata-7.2-rc7' of git://git.kernel.o..
> git tree:       upstream
> final oops:     https://syzkaller.appspot.com/x/report.txt?x=12e60679580000
> console output: https://syzkaller.appspot.com/x/log.txt?x=14e60679580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=c44651ea7dd2f307
> dashboard link: https://syzkaller.appspot.com/bug?extid=df9e891bf8ea586f846b
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=120defb9580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=16323fb9580000
> 
> Reported-by: syzbot+df9e891bf8ea586f846b@xxxxxxxxxxxxxxxxxxxxxxxxx
> Fixes: aa00f67adc2c ("io_uring: add support for fixed wait regions")

That looks like nonsense, I strongly suspect it's a race and hence your
bisection ends up being mostly useless as it sends you in random directions.

-- 
Jens Axboe