Re: [syzbot] [dm?] KASAN: slab-use-after-free Read in snapshot_ctr
From: Hillf Danton
Date: Sat Oct 24 2026 - 21:02:06 EST
> Date: Sat, 24 Oct 2026 08:49:41 -0700 [thread overview]
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: f47d223627f8 Merge tag 'vfs-7.4-rc1.sync_close' of git://g..
> git tree: upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=127202a5580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=97e47414c855a3d8
> dashboard link: https://syzkaller.appspot.com/bug?extid=8e6fc64255334ccf3ab3
> compiler: Debian clang version 22.1.8 (1~deb13u4), Debian LLD 22.1.8
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16a47f71580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=13edba35580000
#syz test: upstream f47d223627f8
--- x/drivers/md/dm-table.c
+++ y/drivers/md/dm-table.c
@@ -400,8 +400,8 @@ int dm_get_device(struct dm_target *ti,
if (r)
return r;
}
- refcount_inc(&dd->count);
out:
+ refcount_inc(&dd->count);
*result = dd->dm_dev;
return 0;
}
--- x/drivers/md/dm-snap.c
+++ y/drivers/md/dm-snap.c
@@ -1390,6 +1390,7 @@ static int snapshot_ctr(struct dm_target
if (r)
goto bad_read_metadata;
+ dm_put_device(ti, s->cow);
return 0;
bad_read_metadata:
--