Re: [syzbot] KASAN: slab-use-after-free Read in vhci_send_cmd_submit

[Hillf Danton]

> Date: Thu, 20 Aug 2026 07:58:25 -0700	[thread overview]
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    3eb40771c00a Merge tag 'soc-fixes-7.2-3' of git://git.kern..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=16e07a79580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=1d67342c314f228d
> dashboard link: https://syzkaller.appspot.com/bug?extid=ecbb1750082f7528b507
> compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=12849949580000

#syz test

--- x/drivers/usb/core/devio.c
+++ y/drivers/usb/core/devio.c
@@ -417,6 +417,7 @@ static void free_async(struct async *as)
 {
 	int i;
 
+	usb_kill_urb(as->urb);
 	put_pid(as->pid);
 	if (as->cred)
 		put_cred(as->cred);
--