[BUG] KASAN: slab-use-after-free Read in usx2y_async_seq04_init
From: Farhad Alemi
Date: Fri Sep 11 2026 - 12:06:39 EST
Hello,
We are reporting the following crash (reproducer attached):
Linux version 7.3.0-rc2 50d05c7c76c96b90462f24debacca971d2e86713
Build Config: UpstreamAppArmorKASAN (KASAN + UBSAN, panic_on_warn=1)
[ 44.599577][ T9507] BUG: KASAN: slab-use-after-free in
usx2y_async_seq04_init+0x2b8/0x360
[ 44.599666][ T9507] Read of size 4 at addr ffff8881060f6000 by task
repro/9507
[ 44.599694][ T9507]
[ 44.599736][ T9507] CPU: 1 UID: 0 PID: 9507 Comm: repro Not tainted
7.3.0-rc2-00099-g50d05c7c76c9 #1 PREEMPT(full)
[ 44.599774][ T9507] Hardware name: QEMU Standard PC (Q35 + ICH9,
2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014
[ 44.599807][ T9507] Call Trace:
[ 44.599827][ T9507] <TASK>
[ 44.599877][ T9507] dump_stack_lvl+0xe8/0x150
[ 44.599917][ T9507] print_address_description+0x55/0x1e0
[ 44.599952][ T9507] ? usx2y_async_seq04_init+0x2b8/0x360
[ 44.599982][ T9507] print_report+0x58/0x70
[ 44.600012][ T9507] kasan_report+0x117/0x150
[ 44.600055][ T9507] ? __kmalloc_noprof+0x1af/0x720
[ 44.600093][ T9507] ? usx2y_async_seq04_init+0x2b8/0x360
[ 44.600130][ T9507] usx2y_async_seq04_init+0x2b8/0x360
[ 44.600168][ T9507] snd_usx2y_hwdep_dsp_load+0x232/0x5e0
[ 44.600205][ T9507] ? __pfx_snd_usx2y_hwdep_dsp_load+0x10/0x10
[ 44.600247][ T9507] snd_hwdep_ioctl+0x489/0x590
[ 44.600288][ T9507] ? __pfx_snd_usx2y_hwdep_dsp_load+0x10/0x10
[ 44.600322][ T9507] ? __pfx_snd_hwdep_ioctl+0x10/0x10
[ 44.600369][ T9507] ? __fget_files+0x2a/0x420
[ 44.600402][ T9507] ? __fget_files+0x2a/0x420
[ 44.600430][ T9507] ? __fget_files+0x3a0/0x420
[ 44.600460][ T9507] ? __fget_files+0x2a/0x420
[ 44.600491][ T9507] ? bpf_lsm_file_ioctl+0x9/0x20
[ 44.600525][ T9507] ? __pfx_snd_hwdep_ioctl+0x10/0x10
[ 44.600585][ T9507] __se_sys_ioctl+0xfc/0x170
[ 44.600625][ T9507] do_syscall_64+0x155/0x510
[ 44.600670][ T9507] ? trace_irq_disable+0x3b/0x140
[ 44.600709][ T9507] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 44.600741][ T9507] ? clear_bhb_loop+0x30/0x80
[ 44.600775][ T9507] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 44.600807][ T9507] RIP: 0033:0x41b46d
[ 44.600860][ T9507] Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d
45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10
00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1a 48 8b 45 c8 64 48 2b 04 25
28 00 00 00
[ 44.600895][ T9507] RSP: 002b:00007f916b837100 EFLAGS: 00000246
ORIG_RAX: 0000000000000010
[ 44.600939][ T9507] RAX: ffffffffffffffda RBX: 00007f916b8376c0
RCX: 000000000041b46d
[ 44.600963][ T9507] RDX: 00007f916b837170 RSI: 0000000040604803
RDI: 0000000000000004
[ 44.600984][ T9507] RBP: 00007f916b837150 R08: 0000000000000000
R09: 00007f916b837174
[ 44.601006][ T9507] R10: 0000000000000008 R11: 0000000000000246
R12: 00007f916b8376c0
[ 44.601026][ T9507] R13: 00007fff5766a470 R14: 00007f916b837ce4
R15: 00007fff5766a567
[ 44.601060][ T9507] </TASK>
[ 44.601072][ T9507]
[ 44.601086][ T9507] Allocated by task 988:
[ 44.601102][ T9507] kasan_save_track+0x3e/0x80
[ 44.601139][ T9507] __kasan_kmalloc+0x93/0xb0
[ 44.601176][ T9507] __kmalloc_cache_noprof+0x325/0x610
[ 44.601211][ T9507] usb_alloc_dev+0x5d/0xf00
[ 44.601265][ T9507] hub_event+0x21ce/0x4f30
[ 44.601298][ T9507] process_scheduled_works+0xc99/0x1900
[ 44.601343][ T9507] worker_thread+0xa53/0xfc0
[ 44.601370][ T9507] kthread+0x38b/0x480
[ 44.601402][ T9507] ret_from_fork+0x514/0xb70
[ 44.601434][ T9507] ret_from_fork_asm+0x1a/0x30
[ 44.601467][ T9507]
[ 44.601475][ T9507] Freed by task 988:
[ 44.601489][ T9507] kasan_save_track+0x3e/0x80
[ 44.601523][ T9507] kasan_save_free_info+0x46/0x50
[ 44.601551][ T9507] __kasan_slab_free+0x5c/0x80
[ 44.601587][ T9507] kfree+0x1c5/0x650
[ 44.601614][ T9507] device_release+0xc4/0x1f0
[ 44.601649][ T9507] kobject_put+0x228/0x560
[ 44.601678][ T9507] hub_event+0x1cc9/0x4f30
[ 44.601711][ T9507] process_scheduled_works+0xc99/0x1900
[ 44.601754][ T9507] worker_thread+0xa53/0xfc0
[ 44.601780][ T9507] kthread+0x38b/0x480
[ 44.601812][ T9507] ret_from_fork+0x514/0xb70
[ 44.601844][ T9507] ret_from_fork_asm+0x1a/0x30
[ 44.601896][ T9507]
[ 44.601903][ T9507] The buggy address belongs to the object at
ffff8881060f6000
[ 44.601903][ T9507] which belongs to the cache kmalloc-2k of size 2048
[ 44.601939][ T9507] The buggy address is located 0 bytes inside of
[ 44.601939][ T9507] freed 2048-byte region [ffff8881060f6000,
ffff8881060f6800)
[ 44.601972][ T9507]
[ 44.601980][ T9507] The buggy address belongs to the physical page:
[ 44.602011][ T9507] page: refcount:0 mapcount:0
mapping:0000000000000000 index:0x0 pfn:0x1060f0
[ 44.602041][ T9507] head: order:3 mapcount:0 entire_mapcount:0
nr_pages_mapped:0 pincount:0
[ 44.602067][ T9507] flags:
0x57ff00000000040(head|node=1|zone=2|lastcpupid=0x7ff)
[ 44.602110][ T9507] page_type: f5(slab)
[ 44.602148][ T9507] raw: 057ff00000000040 ffff88801b042000
dead000000000100 dead000000000122
[ 44.602174][ T9507] raw: 0000000000000000 0000000000080008
00000000f5000000 0000000000000000
[ 44.602202][ T9507] head: 057ff00000000040 ffff88801b042000
dead000000000100 dead000000000122
[ 44.602228][ T9507] head: 0000000000000000 0000000000080008
00000000f5000000 0000000000000000
[ 44.602255][ T9507] head: 057ff00000000003 fffffffffffffe01
00000000ffffffff 00000000ffffffff
[ 44.602280][ T9507] head: ffffffffffffffff 0000000000000000
00000000ffffffff 0000000000000008
[ 44.602296][ T9507] page dumped because: kasan: bad access detected
[ 44.602318][ T9507] page_owner tracks the page as allocated
[ 44.602330][ T9507] page last allocated via order 3, migratetype
Unmovable, gfp_mask
0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC),
pid 1, tgid 1 (swapper/0), ts 1751673867
[ 44.602381][ T9507] post_alloc_hook+0x1f9/0x250
[ 44.602412][ T9507] get_page_from_freelist+0x235a/0x23e0
[ 44.602449][ T9507] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 44.602486][ T9507] allocate_slab+0x7d/0x610
[ 44.602511][ T9507] refill_objects+0x2d6/0x350
[ 44.602536][ T9507] __pcs_replace_empty_main+0x2c9/0x6c0
[ 44.602578][ T9507] __kmalloc_cache_noprof+0x3a5/0x610
[ 44.602612][ T9507] container_device_attach+0x8e/0x220
[ 44.602645][ T9507] acpi_bus_attach+0x6fb/0xb90
[ 44.602676][ T9507] device_for_each_child+0x10b/0x1a0
[ 44.602705][ T9507] acpi_dev_for_each_child+0x9b/0xe0
[ 44.602747][ T9507] acpi_bus_attach+0x900/0xb90
[ 44.602777][ T9507] device_for_each_child+0x10b/0x1a0
[ 44.602806][ T9507] acpi_dev_for_each_child+0x9b/0xe0
[ 44.602858][ T9507] acpi_bus_attach+0x900/0xb90
[ 44.602889][ T9507] device_for_each_child+0x10b/0x1a0
[ 44.602919][ T9507] page_owner free stack trace missing
[ 44.602930][ T9507]
[ 44.602938][ T9507] Memory state around the buggy address:
[ 44.602954][ T9507] ffff8881060f5f00: fc fc fc fc fc fc fc fc fc
fc fc fc fc fc fc fc
[ 44.602974][ T9507] ffff8881060f5f80: fc fc fc fc fc fc fc fc fc
fc fc fc fc fc fc fc
[ 44.602994][ T9507] >ffff8881060f6000: fa fb fb fb fb fb fb fb fb
fb fb fb fb fb fb fb
[ 44.603010][ T9507] ^
[ 44.603025][ T9507] ffff8881060f6080: fb fb fb fb fb fb fb fb fb
fb fb fb fb fb fb fb
[ 44.603045][ T9507] ffff8881060f6100: fb fb fb fb fb fb fb fb fb
fb fb fb fb fb fb fb
[ 44.603060][ T9507]
==================================================================
[ 44.603093][ T9507] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 44.674986][ T9507] CPU: 1 UID: 0 PID: 9507 Comm: repro Not tainted
7.3.0-rc2-00099-g50d05c7c76c9 #1 PREEMPT(full)
[ 44.675924][ T9507] Hardware name: QEMU Standard PC (Q35 + ICH9,
2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014
[ 44.676874][ T9507] Call Trace:
[ 44.677180][ T9507] <TASK>
[ 44.677502][ T9507] vpanic+0x56d/0xa60
[ 44.677905][ T9507] ? __pfx_vpanic+0x10/0x10
[ 44.678355][ T9507] panic+0xc5/0xd0
[ 44.678734][ T9507] ? __pfx_panic+0x10/0x10
[ 44.679179][ T9507] ? usx2y_async_seq04_init+0x2b8/0x360
[ 44.679708][ T9507] ? rcu_is_watching+0x16/0xb0
[ 44.680182][ T9507] ? usx2y_async_seq04_init+0x2b8/0x360
[ 44.680682][ T9507] ? usx2y_async_seq04_init+0x2b8/0x360
[ 44.681188][ T9507] check_panic_on_warn+0x89/0xb0
[ 44.681642][ T9507] ? usx2y_async_seq04_init+0x2b8/0x360
[ 44.682159][ T9507] end_report+0x73/0x170
[ 44.682551][ T9507] ? usx2y_async_seq04_init+0x2b8/0x360
[ 44.683122][ T9507] kasan_report+0x128/0x150
[ 44.683540][ T9507] ? __kmalloc_noprof+0x1af/0x720
[ 44.684003][ T9507] ? usx2y_async_seq04_init+0x2b8/0x360
[ 44.684505][ T9507] usx2y_async_seq04_init+0x2b8/0x360
[ 44.684997][ T9507] snd_usx2y_hwdep_dsp_load+0x232/0x5e0
[ 44.685497][ T9507] ? __pfx_snd_usx2y_hwdep_dsp_load+0x10/0x10
[ 44.686053][ T9507] snd_hwdep_ioctl+0x489/0x590
[ 44.686491][ T9507] ? __pfx_snd_usx2y_hwdep_dsp_load+0x10/0x10
[ 44.687041][ T9507] ? __pfx_snd_hwdep_ioctl+0x10/0x10
[ 44.687523][ T9507] ? __fget_files+0x2a/0x420
[ 44.687948][ T9507] ? __fget_files+0x2a/0x420
[ 44.688368][ T9507] ? __fget_files+0x3a0/0x420
[ 44.688797][ T9507] ? __fget_files+0x2a/0x420
[ 44.689223][ T9507] ? bpf_lsm_file_ioctl+0x9/0x20
[ 44.689675][ T9507] ? __pfx_snd_hwdep_ioctl+0x10/0x10
[ 44.690158][ T9507] __se_sys_ioctl+0xfc/0x170
[ 44.690582][ T9507] do_syscall_64+0x155/0x510
[ 44.691011][ T9507] ? trace_irq_disable+0x3b/0x140
[ 44.691470][ T9507] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 44.692021][ T9507] ? clear_bhb_loop+0x30/0x80
[ 44.692465][ T9507] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 44.693056][ T9507] RIP: 0033:0x41b46d
[ 44.693415][ T9507] Code: 04 25 28 00 00 00 48 89 45 c8 31 c0 48 8d
45 10 c7 45 b0 10 00 00 00 48 89 45 b8 48 8d 45 d0 48 89 45 c0 b8 10
00 00 00 0f 05 <89> c2 3d 00 f0 ff ff 77 1a 48 8b 45 c8 64 48 2b 04 25
28 00 00 00
[ 44.695144][ T9507] RSP: 002b:00007f916b837100 EFLAGS: 00000246
ORIG_RAX: 0000000000000010
[ 44.695911][ T9507] RAX: ffffffffffffffda RBX: 00007f916b8376c0
RCX: 000000000041b46d
[ 44.696658][ T9507] RDX: 00007f916b837170 RSI: 0000000040604803
RDI: 0000000000000004
[ 44.697402][ T9507] RBP: 00007f916b837150 R08: 0000000000000000
R09: 00007f916b837174
[ 44.698141][ T9507] R10: 0000000000000008 R11: 0000000000000246
R12: 00007f916b8376c0
[ 44.698886][ T9507] R13: 00007fff5766a470 R14: 00007f916b837ce4
R15: 00007fff5766a567
[ 44.699613][ T9507] </TASK>
[ 44.700387][ T9507] Kernel Offset: disabled
[ 44.700934][ T9507] Rebooting in 86400 seconds..
Regards,
Attachment:
reproducer.c
Description: Binary data