[BUG] KASAN: slab-use-after-free Read in em28xx_v4l2_close
From: Farhad Alemi
Date: Fri Sep 11 2026 - 19:14:43 EST
Hello,
We are reporting the following crash (reproducer attached):
Linux version 7.3.0-rc2 50d05c7c76c96b90462f24debacca971d2e86713
Build Config: UpstreamAppArmorKASAN (KASAN + UBSAN, panic_on_warn=1)
[ 75.675164][ T9820] BUG: KASAN: slab-use-after-free in
em28xx_v4l2_close+0xae/0x380
[ 75.675269][ T9820] Read of size 8 at addr ffff88810850d0b8 by task
repro/9820
[ 75.675297][ T9820]
[ 75.675345][ T9820] CPU: 0 UID: 0 PID: 9820 Comm: repro Not tainted
7.3.0-rc2-00099-g50d05c7c76c9 #1 PREEMPT(full)
[ 75.675384][ T9820] Hardware name: QEMU Standard PC (Q35 + ICH9,
2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014
[ 75.675417][ T9820] Call Trace:
[ 75.675440][ T9820] <TASK>
[ 75.675462][ T9820] dump_stack_lvl+0xe8/0x150
[ 75.675502][ T9820] print_address_description+0x55/0x1e0
[ 75.675537][ T9820] ? em28xx_v4l2_close+0xae/0x380
[ 75.675574][ T9820] print_report+0x58/0x70
[ 75.675603][ T9820] kasan_report+0x117/0x150
[ 75.675649][ T9820] ? em28xx_v4l2_close+0xae/0x380
[ 75.675692][ T9820] em28xx_v4l2_close+0xae/0x380
[ 75.675765][ T9820] v4l2_release+0x250/0x370
[ 75.675795][ T9820] ? __pfx_v4l2_release+0x10/0x10
[ 75.675824][ T9820] __fput+0x44f/0xa60
[ 75.675876][ T9820] fput_close_sync+0x11f/0x240
[ 75.675922][ T9820] ? __pfx_fput_close_sync+0x10/0x10
[ 75.675976][ T9820] __x64_sys_close+0x7e/0x110
[ 75.676006][ T9820] do_syscall_64+0x155/0x510
[ 75.676052][ T9820] ? trace_irq_disable+0x3b/0x140
[ 75.676091][ T9820] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 75.676123][ T9820] ? clear_bhb_loop+0x30/0x80
[ 75.676157][ T9820] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 75.676189][ T9820] RIP: 0033:0x43d422
[ 75.676233][ T9820] Code: 08 0f 85 61 eb ff ff 49 89 fb 48 89 f0 48
89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89
5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa
55 48 89 e5
[ 75.676267][ T9820] RSP: 002b:00007f11d74d9168 EFLAGS: 00000246
ORIG_RAX: 0000000000000003
[ 75.676312][ T9820] RAX: ffffffffffffffda RBX: 00007f11d74d96c0
RCX: 000000000043d422
[ 75.676336][ T9820] RDX: 0000000000000000 RSI: 0000000000000000
RDI: 0000000000000004
[ 75.676355][ T9820] RBP: 00007f11d74d9190 R08: 0000000000000000
R09: 0000000000000000
[ 75.676375][ T9820] R10: 0000000000000000 R11: 0000000000000246
R12: 00007f11d74d96c0
[ 75.676395][ T9820] R13: 00007ffddcbf5c40 R14: 00007f11d74d9ce4
R15: 00007ffddcbf5d37
[ 75.676430][ T9820] </TASK>
[ 75.676441][ T9820]
[ 75.676456][ T9820] Allocated by task 25:
[ 75.676472][ T9820] kasan_save_track+0x3e/0x80
[ 75.676510][ T9820] __kasan_kmalloc+0x93/0xb0
[ 75.676547][ T9820] __kmalloc_cache_noprof+0x325/0x610
[ 75.676581][ T9820] usb_set_configuration+0x3c9/0x2110
[ 75.676634][ T9820] usb_generic_driver_probe+0x8d/0x150
[ 75.676669][ T9820] usb_probe_device+0x1c4/0x3b0
[ 75.676720][ T9820] really_probe+0x267/0xaf0
[ 75.676754][ T9820] __driver_probe_device+0x1e2/0x350
[ 75.676784][ T9820] driver_probe_device+0x4f/0x240
[ 75.676816][ T9820] __device_attach_driver+0x270/0x410
[ 75.676848][ T9820] bus_for_each_drv+0x258/0x2f0
[ 75.676886][ T9820] __device_attach+0x2c5/0x450
[ 75.676915][ T9820] device_initial_probe+0xa1/0xd0
[ 75.676944][ T9820] bus_probe_device+0x12a/0x220
[ 75.676983][ T9820] device_add+0x7ec/0xb90
[ 75.677007][ T9820] usb_new_device+0xa14/0x1720
[ 75.677037][ T9820] hub_event+0x2a1c/0x4f30
[ 75.677070][ T9820] process_scheduled_works+0xc99/0x1900
[ 75.677115][ T9820] worker_thread+0xa53/0xfc0
[ 75.677142][ T9820] kthread+0x38b/0x480
[ 75.677174][ T9820] ret_from_fork+0x514/0xb70
[ 75.677206][ T9820] ret_from_fork_asm+0x1a/0x30
[ 75.677240][ T9820]
[ 75.677247][ T9820] Freed by task 47:
[ 75.677261][ T9820] kasan_save_track+0x3e/0x80
[ 75.677296][ T9820] kasan_save_free_info+0x46/0x50
[ 75.677325][ T9820] __kasan_slab_free+0x5c/0x80
[ 75.677362][ T9820] kfree+0x1c5/0x650
[ 75.677388][ T9820] device_release+0xc4/0x1f0
[ 75.677422][ T9820] kobject_put+0x228/0x560
[ 75.677452][ T9820] usb_disable_device+0x611/0x8d0
[ 75.677485][ T9820] usb_disconnect+0x32f/0x990
[ 75.677513][ T9820] hub_event+0x1cc9/0x4f30
[ 75.677546][ T9820] process_scheduled_works+0xc99/0x1900
[ 75.677589][ T9820] worker_thread+0xa53/0xfc0
[ 75.677615][ T9820] kthread+0x38b/0x480
[ 75.677647][ T9820] ret_from_fork+0x514/0xb70
[ 75.677679][ T9820] ret_from_fork_asm+0x1a/0x30
[ 75.677730][ T9820]
[ 75.677737][ T9820] The buggy address belongs to the object at
ffff88810850d000
[ 75.677737][ T9820] which belongs to the cache kmalloc-2k of size 2048
[ 75.677774][ T9820] The buggy address is located 184 bytes inside of
[ 75.677774][ T9820] freed 2048-byte region [ffff88810850d000,
ffff88810850d800)
[ 75.677807][ T9820]
[ 75.677815][ T9820] The buggy address belongs to the physical page:
[ 75.677846][ T9820] page: refcount:0 mapcount:0
mapping:0000000000000000 index:0xffff88810850c000 pfn:0x108508
[ 75.677886][ T9820] head: order:3 mapcount:0 entire_mapcount:0
nr_pages_mapped:0 pincount:0
[ 75.677912][ T9820] flags:
0x57ff00000000240(workingset|head|node=1|zone=2|lastcpupid=0x7ff)
[ 75.677956][ T9820] page_type: f5(slab)
[ 75.677994][ T9820] raw: 057ff00000000240 ffff88801b042000
ffffea000425b210 ffffea000409e810
[ 75.678022][ T9820] raw: ffff88810850c000 0000000000080004
00000000f5000000 0000000000000000
[ 75.678050][ T9820] head: 057ff00000000240 ffff88801b042000
ffffea000425b210 ffffea000409e810
[ 75.678077][ T9820] head: ffff88810850c000 0000000000080004
00000000f5000000 0000000000000000
[ 75.678104][ T9820] head: 057ff00000000003 fffffffffffffe01
00000000ffffffff 00000000ffffffff
[ 75.678129][ T9820] head: ffffffffffffffff 0000000000000000
00000000ffffffff 0000000000000008
[ 75.678145][ T9820] page dumped because: kasan: bad access detected
[ 75.678167][ T9820] page_owner tracks the page as allocated
[ 75.678179][ T9820] page last allocated via order 3, migratetype
Unmovable, gfp_mask
0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC),
pid 1, tgid 1 (swapper/0), ts 5467643024
[ 75.678230][ T9820] post_alloc_hook+0x1f9/0x250
[ 75.678262][ T9820] get_page_from_freelist+0x235a/0x23e0
[ 75.678299][ T9820] __alloc_frozen_pages_noprof+0x217/0x5a0
[ 75.678336][ T9820] allocate_slab+0x7d/0x610
[ 75.678361][ T9820] refill_objects+0x2d6/0x350
[ 75.678387][ T9820] __pcs_replace_empty_main+0x2c9/0x6c0
[ 75.678429][ T9820] __kmalloc_cache_noprof+0x3a5/0x610
[ 75.678462][ T9820] __media_device_register+0x57/0x3c0
[ 75.678493][ T9820] vivid_create_devnodes+0x2037/0x2bf0
[ 75.678523][ T9820] vivid_probe+0x5109/0x7290
[ 75.678548][ T9820] platform_probe+0xf9/0x190
[ 75.678575][ T9820] really_probe+0x267/0xaf0
[ 75.678606][ T9820] __driver_probe_device+0x1e2/0x350
[ 75.678636][ T9820] driver_probe_device+0x4f/0x240
[ 75.678667][ T9820] __driver_attach+0x33c/0x600
[ 75.678696][ T9820] bus_for_each_dev+0x23b/0x2c0
[ 75.678747][ T9820] page_owner free stack trace missing
[ 75.678767][ T9820]
[ 75.678774][ T9820] Memory state around the buggy address:
[ 75.678790][ T9820] ffff88810850cf80: fc fc fc fc fc fc fc fc fc
fc fc fc fc fc fc fc
[ 75.678811][ T9820] ffff88810850d000: fa fb fb fb fb fb fb fb fb
fb fb fb fb fb fb fb
[ 75.678831][ T9820] >ffff88810850d080: fb fb fb fb fb fb fb fb fb
fb fb fb fb fb fb fb
[ 75.678846][ T9820] ^
[ 75.678863][ T9820] ffff88810850d100: fb fb fb fb fb fb fb fb fb
fb fb fb fb fb fb fb
[ 75.678883][ T9820] ffff88810850d180: fb fb fb fb fb fb fb fb fb
fb fb fb fb fb fb fb
[ 75.678898][ T9820]
==================================================================
[ 75.678931][ T9820] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 75.757208][ T9820] CPU: 0 UID: 0 PID: 9820 Comm: repro Not tainted
7.3.0-rc2-00099-g50d05c7c76c9 #1 PREEMPT(full)
[ 75.758160][ T9820] Hardware name: QEMU Standard PC (Q35 + ICH9,
2009), BIOS 1.17.0-debian-1.17.0-1ubuntu1 04/01/2014
[ 75.759122][ T9820] Call Trace:
[ 75.759432][ T9820] <TASK>
[ 75.759711][ T9820] vpanic+0x56d/0xa60
[ 75.760087][ T9820] ? __pfx_vpanic+0x10/0x10
[ 75.760512][ T9820] panic+0xc5/0xd0
[ 75.760865][ T9820] ? __pfx_panic+0x10/0x10
[ 75.761278][ T9820] ? em28xx_v4l2_close+0xae/0x380
[ 75.761750][ T9820] ? em28xx_v4l2_close+0xae/0x380
[ 75.762215][ T9820] ? em28xx_v4l2_close+0xae/0x380
[ 75.762679][ T9820] ? em28xx_v4l2_close+0xae/0x380
[ 75.763238][ T9820] check_panic_on_warn+0x89/0xb0
[ 75.763699][ T9820] ? em28xx_v4l2_close+0xae/0x380
[ 75.764213][ T9820] end_report+0x73/0x170
[ 75.764610][ T9820] ? em28xx_v4l2_close+0xae/0x380
[ 75.765093][ T9820] kasan_report+0x128/0x150
[ 75.765516][ T9820] ? em28xx_v4l2_close+0xae/0x380
[ 75.765983][ T9820] em28xx_v4l2_close+0xae/0x380
[ 75.766434][ T9820] v4l2_release+0x250/0x370
[ 75.766855][ T9820] ? __pfx_v4l2_release+0x10/0x10
[ 75.767316][ T9820] __fput+0x44f/0xa60
[ 75.767692][ T9820] fput_close_sync+0x11f/0x240
[ 75.768140][ T9820] ? __pfx_fput_close_sync+0x10/0x10
[ 75.768631][ T9820] __x64_sys_close+0x7e/0x110
[ 75.769067][ T9820] do_syscall_64+0x155/0x510
[ 75.769499][ T9820] ? trace_irq_disable+0x3b/0x140
[ 75.769966][ T9820] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 75.770521][ T9820] ? clear_bhb_loop+0x30/0x80
[ 75.770958][ T9820] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 75.771498][ T9820] RIP: 0033:0x43d422
[ 75.771866][ T9820] Code: 08 0f 85 61 eb ff ff 49 89 fb 48 89 f0 48
89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89
5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa
55 48 89 e5
[ 75.773649][ T9820] RSP: 002b:00007f11d74d9168 EFLAGS: 00000246
ORIG_RAX: 0000000000000003
[ 75.774409][ T9820] RAX: ffffffffffffffda RBX: 00007f11d74d96c0
RCX: 000000000043d422
[ 75.775143][ T9820] RDX: 0000000000000000 RSI: 0000000000000000
RDI: 0000000000000004
[ 75.775928][ T9820] RBP: 00007f11d74d9190 R08: 0000000000000000
R09: 0000000000000000
[ 75.776678][ T9820] R10: 0000000000000000 R11: 0000000000000246
R12: 00007f11d74d96c0
[ 75.777420][ T9820] R13: 00007ffddcbf5c40 R14: 00007f11d74d9ce4
R15: 00007ffddcbf5d37
[ 75.778144][ T9820] </TASK>
[ 75.779091][ T9820] Kernel Offset: disabled
[ 75.779640][ T9820] Rebooting in 86400 seconds..
Regards,
Attachment:
reproducer.c
Description: Binary data