Re: [syzbot] KASAN: slab-use-after-free Read in vhci_send_cmd_submit

[Hillf Danton]

> Date: Thu, 20 Aug 2026 07:58:25 -0700	[thread overview]
> Hello,
> 
> syzbot found the following issue on:
> 
> HEAD commit:    3eb40771c00a Merge tag 'soc-fixes-7.2-3' of git://git.kern..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=16e07a79580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=1d67342c314f228d
> dashboard link: https://syzkaller.appspot.com/bug?extid=ecbb1750082f7528b507
> compiler:       gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=12849949580000

#syz test

--- x/drivers/usb/core/devio.c
+++ y/drivers/usb/core/devio.c
@@ -612,7 +612,7 @@ __acquires(ps->lock)
 			urb = as->urb;
 			usb_get_urb(urb);
 			spin_unlock(&ps->lock);		/* Allow completions */
-			usb_unlink_urb(urb);
+			usb_kill_urb(urb);
 			usb_put_urb(urb);
 			spin_lock(&ps->lock);
 			goto rescan;
--