[BUG] KASAN: slab-use-after-free Read in vhci_urb_dequeue
From: Farhad Alemi
Date: Fri Sep 11 2026 - 12:03:11 EST
Hello,
We are reporting the following crash (reproducer attached):
Linux version 7.3.0-rc2 50d05c7c76c96b90462f24debacca971d2e86713
Build Config: UpstreamAppArmorKASAN (KASAN + UBSAN, panic_on_warn=1)
[ 44.577452][ T9485] BUG: KASAN: slab-use-after-free in
vhci_urb_dequeue+0x22a/0x670
[ 44.577476][ T9485] Read of size 8 at addr ffff888106a07a80 by task
repro/9485
[ 44.577482][ T9485]
[ 44.577492][ T9485] CPU: 1 UID: 0 PID: 9485 Comm: repro Not tainted
7.3.0-rc2-00099-g50d05c7c76c9 #1 PREEMPT(full)
[ 44.577501][ T9485] Hardware name: QEMU Standard PC (Q35 + ICH9,
2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014
[ 44.577509][ T9485] Call Trace:
[ 44.577514][ T9485] <TASK>
[ 44.577519][ T9485] dump_stack_lvl+0xe8/0x150
[ 44.577529][ T9485] print_address_description+0x55/0x1e0
[ 44.577537][ T9485] ? vhci_urb_dequeue+0x22a/0x670
[ 44.577543][ T9485] print_report+0x58/0x70
[ 44.577549][ T9485] kasan_report+0x117/0x150
[ 44.577561][ T9485] ? vhci_urb_dequeue+0x22a/0x670
[ 44.577568][ T9485] vhci_urb_dequeue+0x22a/0x670
[ 44.577576][ T9485] usb_hcd_unlink_urb+0xe6/0x1e0
[ 44.577590][ T9485] usb_kill_urb+0x10b/0x2f0
[ 44.577597][ T9485] ? __pfx_usb_kill_urb+0x10/0x10
[ 44.577606][ T9485] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 44.577617][ T9485] proc_unlinkurb+0x181/0x1c0
[ 44.577625][ T9485] usbdev_ioctl+0x1002/0x2120
[ 44.577637][ T9485] ? __pfx_usbdev_ioctl+0x10/0x10
[ 44.577646][ T9485] ? __fget_files+0x2a/0x420
[ 44.577653][ T9485] ? __fget_files+0x3a0/0x420
[ 44.577659][ T9485] ? __fget_files+0x2a/0x420
[ 44.577666][ T9485] ? bpf_lsm_file_ioctl+0x9/0x20
[ 44.577675][ T9485] ? __pfx_usbdev_ioctl+0x10/0x10
[ 44.577684][ T9485] __se_sys_ioctl+0xfc/0x170
[ 44.577694][ T9485] do_syscall_64+0x155/0x510
[ 44.577705][ T9485] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 44.577712][ T9485] ? clear_bhb_loop+0x30/0x80
[ 44.577720][ T9485] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 44.577727][ T9485] RIP: 0033:0x418cdd
[ 44.577737][ T9485] Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d
45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10
00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1a 48 8b 45 c8 64 48 2b 04 25
28 00 00 00
[ 44.577745][ T9485] RSP: 002b:00007ffefc645b10 EFLAGS: 00000246
ORIG_RAX: 0000000000000010
[ 44.577757][ T9485] RAX: ffffffffffffffda RBX: 0000000000000001
RCX: 0000000000418cdd
[ 44.577762][ T9485] RDX: 00000000004d0ba0 RSI: 000000000000550b
RDI: 0000000000000005
[ 44.577766][ T9485] RBP: 00007ffefc645b60 R08: 0000000000000000
R09: 0000000000000000
[ 44.577770][ T9485] R10: 0000000000000000 R11: 0000000000000246
R12: 00007ffefc645d48
[ 44.577775][ T9485] R13: 00007ffefc645d58 R14: 0000000000000002
R15: 00000000004caa00
[ 44.577782][ T9485] </TASK>
[ 44.577785][ T9485]
[ 44.577788][ T9485] Allocated by task 9485:
[ 44.577792][ T9485] kasan_save_track+0x3e/0x80
[ 44.577799][ T9485] __kasan_kmalloc+0x93/0xb0
[ 44.577807][ T9485] __kmalloc_cache_noprof+0x325/0x610
[ 44.577815][ T9485] vhci_urb_enqueue+0x5b9/0xe10
[ 44.577826][ T9485] usb_hcd_submit_urb+0x31f/0x1b40
[ 44.577835][ T9485] proc_do_submiturb+0x294a/0x37e0
[ 44.577842][ T9485] proc_submiturb+0x134/0x1a0
[ 44.577847][ T9485] usbdev_ioctl+0x10b9/0x2120
[ 44.577856][ T9485] __se_sys_ioctl+0xfc/0x170
[ 44.577863][ T9485] do_syscall_64+0x155/0x510
[ 44.577872][ T9485] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 44.577878][ T9485]
[ 44.577880][ T9485] Freed by task 9486:
[ 44.577883][ T9485] kasan_save_track+0x3e/0x80
[ 44.577890][ T9485] kasan_save_free_info+0x46/0x50
[ 44.577896][ T9485] __kasan_slab_free+0x5c/0x80
[ 44.577904][ T9485] kfree+0x1c5/0x650
[ 44.577910][ T9485] pickup_urb_and_free_priv+0x225/0x3f0
[ 44.577920][ T9485] vhci_rx_loop+0x3d3/0xa80
[ 44.577928][ T9485] kthread+0x38b/0x480
[ 44.577936][ T9485] ret_from_fork+0x514/0xb70
[ 44.577944][ T9485] ret_from_fork_asm+0x1a/0x30
[ 44.577951][ T9485]
[ 44.577953][ T9485] The buggy address belongs to the object at
ffff888106a07a80
[ 44.577953][ T9485] which belongs to the cache kmalloc-64 of size 64
[ 44.577960][ T9485] The buggy address is located 0 bytes inside of
[ 44.577960][ T9485] freed 64-byte region [ffff888106a07a80,
ffff888106a07ac0)
[ 44.577967][ T9485]
[ 44.577969][ T9485] The buggy address belongs to the physical page:
[ 44.577977][ T9485] page: refcount:0 mapcount:0
mapping:0000000000000000 index:0x0 pfn:0x106a07
[ 44.577984][ T9485] flags: 0x57ff00000000000(node=1|zone=2|lastcpupid=0x7ff)
[ 44.577994][ T9485] page_type: f5(slab)
[ 44.578003][ T9485] raw: 057ff00000000000 ffff88801b0418c0
dead000000000100 dead000000000122
[ 44.578008][ T9485] raw: 0000000000000000 0000000000200020
00000000f5000000 0000000000000000
[ 44.578012][ T9485] page dumped because: kasan: bad access detected
[ 44.578017][ T9485] page_owner tracks the page as allocated
[ 44.578020][ T9485] page last allocated via order 0, migratetype
Unmovable, gfp_mask
0xd2c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC),
pid 5023, tgid 5023 (9), ts 8687343046
[ 44.578031][ T9485] post_alloc_hook+0x1f9/0x250
[ 44.578038][ T9485] get_page_from_freelist+0x235a/0x23e0
[ 44.578047][ T9485] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 44.578055][ T9485] allocate_slab+0x7d/0x610
[ 44.578060][ T9485] refill_objects+0x2d6/0x350
[ 44.578066][ T9485] __pcs_replace_empty_main+0x2c9/0x6c0
[ 44.578075][ T9485] __kmalloc_noprof+0x48b/0x720
[ 44.578082][ T9485] tomoyo_encode+0x28b/0x550
[ 44.578088][ T9485] tomoyo_realpath_from_path+0x58d/0x5d0
[ 44.578094][ T9485] tomoyo_path_number_perm+0x246/0x630
[ 44.578103][ T9485] security_file_ioctl+0xc3/0x2a0
[ 44.578112][ T9485] __se_sys_ioctl+0x47/0x170
[ 44.578119][ T9485] do_syscall_64+0x155/0x510
[ 44.578128][ T9485] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 44.578134][ T9485] page last free pid 10 tgid 10 ts 3550973953 stack trace:
[ 44.578138][ T9485] free_pages_prepare+0xa03/0xb00
[ 44.578144][ T9485] __free_contig_range_common+0x174/0x340
[ 44.578154][ T9485] free_pages_bulk+0x48/0x120
[ 44.578161][ T9485] vfree+0x231/0x470
[ 44.578167][ T9485] delayed_vfree_work+0x55/0x80
[ 44.578174][ T9485] process_scheduled_works+0xc99/0x1900
[ 44.578184][ T9485] worker_thread+0xa53/0xfc0
[ 44.578190][ T9485] kthread+0x38b/0x480
[ 44.578197][ T9485] ret_from_fork+0x514/0xb70
[ 44.578204][ T9485] ret_from_fork_asm+0x1a/0x30
[ 44.578211][ T9485]
[ 44.578212][ T9485] Memory state around the buggy address:
[ 44.578216][ T9485] ffff888106a07980: 00 00 00 00 00 07 fc fc fc
fc fc fc fc fc fc fc
[ 44.578221][ T9485] ffff888106a07a00: 00 00 00 00 00 00 fc fc fc
fc fc fc fc fc fc fc
[ 44.578225][ T9485] >ffff888106a07a80: fa fb fb fb fb fb fb fb fc
fc fc fc fc fc fc fc
[ 44.578228][ T9485] ^
[ 44.578231][ T9485] ffff888106a07b00: fa fb fb fb fb fb fb fb fc
fc fc fc fc fc fc fc
[ 44.578236][ T9485] ffff888106a07b80: fa fb fb fb fb fb fb fb fc
fc fc fc fc fc fc fc
[ 44.578239][ T9485]
==================================================================
[ 44.578247][ T9485] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 44.637788][ T9485] CPU: 1 UID: 0 PID: 9485 Comm: repro Not tainted
7.3.0-rc2-00099-g50d05c7c76c9 #1 PREEMPT(full)
[ 44.638733][ T9485] Hardware name: QEMU Standard PC (Q35 + ICH9,
2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014
[ 44.639752][ T9485] Call Trace:
[ 44.640062][ T9485] <TASK>
[ 44.640338][ T9485] vpanic+0x56d/0xa60
[ 44.640714][ T9485] ? __pfx_vpanic+0x10/0x10
[ 44.641136][ T9485] panic+0xc5/0xd0
[ 44.641486][ T9485] ? __pfx_panic+0x10/0x10
[ 44.641900][ T9485] ? vhci_urb_dequeue+0x22a/0x670
[ 44.642361][ T9485] ? rcu_is_watching+0x16/0xb0
[ 44.642803][ T9485] ? vhci_urb_dequeue+0x22a/0x670
[ 44.643265][ T9485] ? vhci_urb_dequeue+0x22a/0x670
[ 44.643723][ T9485] check_panic_on_warn+0x89/0xb0
[ 44.644181][ T9485] ? vhci_urb_dequeue+0x22a/0x670
[ 44.644639][ T9485] end_report+0x73/0x170
[ 44.645035][ T9485] ? vhci_urb_dequeue+0x22a/0x670
[ 44.645519][ T9485] kasan_report+0x128/0x150
[ 44.645962][ T9485] ? vhci_urb_dequeue+0x22a/0x670
[ 44.646446][ T9485] vhci_urb_dequeue+0x22a/0x670
[ 44.646911][ T9485] usb_hcd_unlink_urb+0xe6/0x1e0
[ 44.647369][ T9485] usb_kill_urb+0x10b/0x2f0
[ 44.647787][ T9485] ? __pfx_usb_kill_urb+0x10/0x10
[ 44.648250][ T9485] ? _raw_spin_unlock_irqrestore+0x30/0x80
[ 44.648783][ T9485] proc_unlinkurb+0x181/0x1c0
[ 44.649279][ T9485] usbdev_ioctl+0x1002/0x2120
[ 44.649713][ T9485] ? __pfx_usbdev_ioctl+0x10/0x10
[ 44.650181][ T9485] ? __fget_files+0x2a/0x420
[ 44.650609][ T9485] ? __fget_files+0x3a0/0x420
[ 44.651043][ T9485] ? __fget_files+0x2a/0x420
[ 44.651466][ T9485] ? bpf_lsm_file_ioctl+0x9/0x20
[ 44.651925][ T9485] ? __pfx_usbdev_ioctl+0x10/0x10
[ 44.652390][ T9485] __se_sys_ioctl+0xfc/0x170
[ 44.652816][ T9485] do_syscall_64+0x155/0x510
[ 44.653247][ T9485] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 44.653798][ T9485] ? clear_bhb_loop+0x30/0x80
[ 44.654231][ T9485] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 44.654769][ T9485] RIP: 0033:0x418cdd
[ 44.655132][ T9485] Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d
45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10
00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1a 48 8b 45 c8 64 48 2b 04 25
28 00 00 00
[ 44.656851][ T9485] RSP: 002b:00007ffefc645b10 EFLAGS: 00000246
ORIG_RAX: 0000000000000010
[ 44.657603][ T9485] RAX: ffffffffffffffda RBX: 0000000000000001
RCX: 0000000000418cdd
[ 44.658316][ T9485] RDX: 00000000004d0ba0 RSI: 000000000000550b
RDI: 0000000000000005
[ 44.659092][ T9485] RBP: 00007ffefc645b60 R08: 0000000000000000
R09: 0000000000000000
[ 44.659801][ T9485] R10: 0000000000000000 R11: 0000000000000246
R12: 00007ffefc645d48
[ 44.660518][ T9485] R13: 00007ffefc645d58 R14: 0000000000000002
R15: 00000000004caa00
[ 44.661234][ T9485] </TASK>
[ 45.720592][ T9485] Shutting down cpus with NMI
[ 45.721627][ T9485] Kernel Offset: disabled
[ 45.722182][ T9485] Rebooting in 86400 seconds..
Regards,
Attachment:
reproducer.c
Description: Binary data