el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:736 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:755 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594 ------------[ cut here ]------------ WARNING: drivers/mtd/mtdpart.c:38 at release_mtd_partition+0x8c/0x94 drivers/mtd/mtdpart.c:38, CPU#1: syz.4.250/5665 Modules linked in: CPU: 1 UID: 0 PID: 5665 Comm: syz.4.250 Not tainted syzkaller #0 PREEMPT Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026 pstate: 83400005 (Nzcv daif +PAN -UAO +TCO +DIT -SSBS BTYPE=--) pc : release_mtd_partition+0x8c/0x94 drivers/mtd/mtdpart.c:38 lr : release_mtd_partition+0x8c/0x94 drivers/mtd/mtdpart.c:38 sp : ffff8000aa647310 x29: ffff8000aa647310 x28: ffff7000154c8e90 x27: 1fffe0001b87ae3b x26: 0000000000000001 x25: 1fffe0001b87ae34 x24: 1ffff00010df2bd8 x23: dfff800000000000 x22: ffff0000dc3d76a0 x21: ffff0000dc3d76b8 x20: dfff800000000000 x19: ffff0000dc3d7000 x18: 1fffe00035bd2e28 x17: 0000000000000003 x16: 0000000000000001 x15: 0000000000000000 x14: 0000000000000000 x13: 0000000000000001 x12: 0000000000000000 x11: 0000000000000000 x10: ffff6000182fcf9c x9 : 0000000000000000 x8 : 0000000000000000 x7 : 0000000000000000 x6 : 0000000000000000 x5 : 00000000ffffffff x4 : 0000000000000dc0 x3 : ffff8000868956b0 x2 : 0000000000000006 x1 : ffff0000d1781d40 x0 : 0000000000000000 Call trace: release_mtd_partition+0x8c/0x94 drivers/mtd/mtdpart.c:38 (P) mtd_release+0xd8/0x118 drivers/mtd/mtdcore.c:102 device_release+0xb4/0x1d4 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1dc/0x4b8 lib/kobject.c:737 put_device+0x28/0x40 drivers/base/core.c:3880 add_mtd_device+0xb98/0x14cc drivers/mtd/mtdcore.c:803 mtd_add_partition+0x2d4/0x3f4 drivers/mtd/mtdpart.c:280 mtdchar_blkpg_ioctl+0x224/0x248 drivers/mtd/mtdchar.c:562 mtdchar_ioctl+0x1218/0x1a7c drivers/mtd/mtdchar.c:1218 mtdchar_unlocked_ioctl+0xb0/0xd8 drivers/mtd/mtdchar.c:1241 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __arm64_sys_ioctl+0x14c/0x1c4 fs/ioctl.c:583 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:736 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:755 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594 irq event stamp: 202 hardirqs last enabled at (201): [] irqentry_exit_to_kernel_mode_after_preempt include/linux/irq-entry-common.h:507 [inline] hardirqs last enabled at (201): [] arm64_exit_to_kernel_mode+0x80/0x94 arch/arm64/kernel/entry-common.c:62 hardirqs last disabled at (202): [] el1_brk64+0x20/0x54 arch/arm64/kernel/entry-common.c:425 softirqs last enabled at (142): [] local_bh_enable include/linux/bottom_half.h:33 [inline] softirqs last enabled at (142): [] put_cpu_fpsimd_context arch/arm64/kernel/fpsimd.c:251 [inline] softirqs last enabled at (142): [] do_sve_acc+0x32c/0x4b8 arch/arm64/kernel/fpsimd.c:1349 softirqs last disabled at (140): [] local_bh_disable include/linux/bottom_half.h:20 [inline] softirqs last disabled at (140): [] get_cpu_fpsimd_context arch/arm64/kernel/fpsimd.c:234 [inline] softirqs last disabled at (140): [] do_sve_acc+0x10c/0x4b8 arch/arm64/kernel/fpsimd.c:1325 ---[ end trace 0000000000000000 ]--- ================================================================== BUG: KASAN: slab-use-after-free in dev_of_node include/linux/device.h:1277 [inline] BUG: KASAN: slab-use-after-free in mtd_get_of_node include/linux/mtd/mtd.h:471 [inline] BUG: KASAN: slab-use-after-free in add_mtd_device+0xbbc/0x14cc drivers/mtd/mtdcore.c:845 Read of size 8 at addr ffff0000dc3d75c8 by task syz.4.250/5665 CPU: 1 UID: 0 PID: 5665 Comm: syz.4.250 Tainted: G W syzkaller #0 PREEMPT Tainted: [W]=WARN Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/02/2026 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 print_address_description+0xb0/0x238 mm/kasan/report.c:378 print_report+0x68/0x84 mm/kasan/report.c:482 kasan_report+0x8c/0xc4 mm/kasan/report.c:595 __asan_report_load8_noabort+0x20/0x2c mm/kasan/report_generic.c:381 dev_of_node include/linux/device.h:1277 [inline] mtd_get_of_node include/linux/mtd/mtd.h:471 [inline] add_mtd_device+0xbbc/0x14cc drivers/mtd/mtdcore.c:845 mtd_add_partition+0x2d4/0x3f4 drivers/mtd/mtdpart.c:280 mtdchar_blkpg_ioctl+0x224/0x248 drivers/mtd/mtdchar.c:562 mtdchar_ioctl+0x1218/0x1a7c drivers/mtd/mtdchar.c:1218 mtdchar_unlocked_ioctl+0xb0/0xd8 drivers/mtd/mtdchar.c:1241 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __arm64_sys_ioctl+0x14c/0x1c4 fs/ioctl.c:583 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:736 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:755 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594 Allocated by task 5665: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:78 kasan_save_alloc_info+0x44/0x54 mm/kasan/generic.c:570 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0x9c/0xb4 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x2e8/0x5ec mm/slub.c:5515 _kmalloc_noprof include/linux/slab.h:969 [inline] _kzalloc_noprof include/linux/slab.h:1290 [inline] allocate_partition+0x13c/0x14cc drivers/mtd/mtdpart.c:57 mtd_add_partition+0x194/0x3f4 drivers/mtd/mtdpart.c:272 mtdchar_blkpg_ioctl+0x224/0x248 drivers/mtd/mtdchar.c:562 mtdchar_ioctl+0x1218/0x1a7c drivers/mtd/mtdchar.c:1218 mtdchar_unlocked_ioctl+0xb0/0xd8 drivers/mtd/mtdchar.c:1241 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __arm64_sys_ioctl+0x14c/0x1c4 fs/ioctl.c:583 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:736 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:755 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594 Freed by task 5665: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:78 kasan_save_free_info+0x58/0x70 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x74/0xa4 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2705 [inline] slab_free mm/slub.c:6405 [inline] kfree+0x188/0x690 mm/slub.c:6720 free_partition drivers/mtd/mtdpart.c:33 [inline] release_mtd_partition+0x74/0x94 drivers/mtd/mtdpart.c:39 mtd_release+0xd8/0x118 drivers/mtd/mtdcore.c:102 device_release+0xb4/0x1d4 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1dc/0x4b8 lib/kobject.c:737 put_device+0x28/0x40 drivers/base/core.c:3880 add_mtd_device+0xb98/0x14cc drivers/mtd/mtdcore.c:803 mtd_add_partition+0x2d4/0x3f4 drivers/mtd/mtdpart.c:280 mtdchar_blkpg_ioctl+0x224/0x248 drivers/mtd/mtdchar.c:562 mtdchar_ioctl+0x1218/0x1a7c drivers/mtd/mtdchar.c:1218 mtdchar_unlocked_ioctl+0xb0/0xd8 drivers/mtd/mtdchar.c:1241 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __arm64_sys_ioctl+0x14c/0x1c4 fs/ioctl.c:583 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:736 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:755 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:594 The buggy address belongs to the object at ffff0000dc3d7000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 1480 bytes inside of freed 2048-byte region [ffff0000dc3d7000, ffff0000dc3d7800) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff0000dc3d1000 pfn:0x11c3d0 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x5ffc00000000240(workingset|head|node=0|zone=2|lastcpupid=0x7ff) page_type: f5(slab) raw: 05ffc00000000240 ffff0000c0002000 fffffdffc35d4410 fffffdffc35bc210 raw: ffff0000dc3d1000 0000000800080007 00000000f5000000 0000000000000000 head: 05ffc00000000240 ffff0000c0002000 fffffdffc35d4410 fffffdffc35bc210 head: ffff0000dc3d1000 0000000800080007 00000000f5000000 0000000000000000 head: 05ffc00000000003 fffffdffc370f401 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000dc3d7480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff0000dc3d7500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff0000dc3d7580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff0000dc3d7600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff0000dc3d7680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================