KASAN: invalid-free in create_cache
5 views
Skip to first unread message
syzbot
Nov 27, 2020, 10:57:17 PM11/27/20
to syzkaller-a...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: e37aca80 ANDROID: modpost: Forbid double exports
git tree: android12-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=140d6785500000
kernel config: https://syzkaller.appspot.com/x/.config?x=ad643f8e0f1f7aa8
dashboard link: https://syzkaller.appspot.com/bug?extid=6038e5964bf567082212
compiler: Android (6032204 based on r370808) clang version 10.0.1 (https://android.googlesource.com/toolchain/llvm-project 6e765c10313d15c02ab29977a82938f66742c3a9)
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+6038e5...@syzkaller.appspotmail.com
RBP: 00007f580d8afca0 R08: 0000000020000380 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000018
R13: 00007ffeb758636f R14: 00007f580d8b09c0 R15: 000000000118bf2c
kobject_add_internal failed for 9p-fcall-cache (error: -12 parent: slab)
==================================================================
BUG: KASAN: double-free or invalid-free in slab_free mm/slub.c:3051 [inline]
BUG: KASAN: double-free or invalid-free in kmem_cache_free+0xac/0x610 mm/slub.c:3067
CPU: 1 PID: 17334 Comm: syz-executor.1 Not tainted 5.4.80-syzkaller-00759-ge37aca80313f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1dd/0x24e lib/dump_stack.c:118
print_address_description+0x96/0x640 mm/kasan/report.c:374
kasan_report_invalid_free+0x54/0xc0 mm/kasan/report.c:468
__kasan_slab_free+0x102/0x230 mm/kasan/common.c:459
slab_free_hook mm/slub.c:1453 [inline]
slab_free_freelist_hook+0xd0/0x150 mm/slub.c:1486
slab_free mm/slub.c:3051 [inline]
kmem_cache_free+0xac/0x610 mm/slub.c:3067
create_cache+0x1cc/0x1f0 mm/slab_common.c:429
kmem_cache_create_usercopy+0x145/0x1d0 mm/slab_common.c:513
p9_client_create+0x9ff/0xb90 net/9p/client.c:1061
v9fs_session_init+0x208/0x1a00 fs/9p/v9fs.c:406
v9fs_mount+0x7f/0x790 fs/9p/vfs_super.c:124
legacy_get_tree+0xde/0x170 fs/fs_context.c:647
vfs_get_tree+0x85/0x260 fs/super.c:1547
do_new_mount fs/namespace.c:2822 [inline]
do_mount+0x18ab/0x2660 fs/namespace.c:3142
ksys_mount+0xc2/0xf0 fs/namespace.c:3351
__do_sys_mount fs/namespace.c:3365 [inline]
__se_sys_mount fs/namespace.c:3362 [inline]
__x64_sys_mount+0xb1/0xc0 fs/namespace.c:3362
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45deb9
Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f580d8afc78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000021800 RCX: 000000000045deb9
RDX: 00000000200001c0 RSI: 0000000020000180 RDI: 0000000000000000
RBP: 00007f580d8afca0 R08: 0000000020000380 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000018
R13: 00007ffeb758636f R14: 00007f580d8b09c0 R15: 000000000118bf2c
Allocated by task 17334:
save_stack mm/kasan/common.c:69 [inline]
set_track mm/kasan/common.c:77 [inline]
__kasan_kmalloc+0x129/0x1c0 mm/kasan/common.c:510
slab_post_alloc_hook mm/slab.h:584 [inline]
slab_alloc_node mm/slub.c:2803 [inline]
slab_alloc mm/slub.c:2811 [inline]
kmem_cache_alloc+0x1e0/0x270 mm/slub.c:2816
kmem_cache_zalloc include/linux/slab.h:680 [inline]
create_cache+0x3b/0x1f0 mm/slab_common.c:400
kmem_cache_create_usercopy+0x145/0x1d0 mm/slab_common.c:513
p9_client_create+0x9ff/0xb90 net/9p/client.c:1061
v9fs_session_init+0x208/0x1a00 fs/9p/v9fs.c:406
v9fs_mount+0x7f/0x790 fs/9p/vfs_super.c:124
legacy_get_tree+0xde/0x170 fs/fs_context.c:647
vfs_get_tree+0x85/0x260 fs/super.c:1547
do_new_mount fs/namespace.c:2822 [inline]
do_mount+0x18ab/0x2660 fs/namespace.c:3142
ksys_mount+0xc2/0xf0 fs/namespace.c:3351
__do_sys_mount fs/namespace.c:3365 [inline]
__se_sys_mount fs/namespace.c:3362 [inline]
__x64_sys_mount+0xb1/0xc0 fs/namespace.c:3362
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Freed by task 17334:
save_stack mm/kasan/common.c:69 [inline]
set_track mm/kasan/common.c:77 [inline]
kasan_set_free_info mm/kasan/common.c:332 [inline]
__kasan_slab_free+0x17e/0x230 mm/kasan/common.c:471
slab_free_hook mm/slub.c:1453 [inline]
slab_free_freelist_hook+0xd0/0x150 mm/slub.c:1486
slab_free mm/slub.c:3051 [inline]
kmem_cache_free+0xac/0x610 mm/slub.c:3067
kobject_cleanup+0x1e1/0x3c0 lib/kobject.c:708
sysfs_slab_add+0x1a1/0x310 mm/slub.c:5825
__kmem_cache_create+0x67c/0x6f0 mm/slub.c:4375
create_cache+0x156/0x1f0 mm/slab_common.c:415
kmem_cache_create_usercopy+0x145/0x1d0 mm/slab_common.c:513
p9_client_create+0x9ff/0xb90 net/9p/client.c:1061
v9fs_session_init+0x208/0x1a00 fs/9p/v9fs.c:406
v9fs_mount+0x7f/0x790 fs/9p/vfs_super.c:124
legacy_get_tree+0xde/0x170 fs/fs_context.c:647
vfs_get_tree+0x85/0x260 fs/super.c:1547
do_new_mount fs/namespace.c:2822 [inline]
do_mount+0x18ab/0x2660 fs/namespace.c:3142
ksys_mount+0xc2/0xf0 fs/namespace.c:3351
__do_sys_mount fs/namespace.c:3365 [inline]
__se_sys_mount fs/namespace.c:3362 [inline]
__x64_sys_mount+0xb1/0xc0 fs/namespace.c:3362
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
The buggy address belongs to the object at ffff8881a805b180
which belongs to the cache kmem_cache of size 472
The buggy address is located 0 bytes inside of
472-byte region [ffff8881a805b180, ffff8881a805b358)
The buggy address belongs to the page:
page:ffffea0006a01680 refcount:1 mapcount:0 mapping:ffff8881f6002000 index:0xffff8881a805a500 compound_mapcount: 0
flags: 0x8000000000010200(slab|head)
raw: 8000000000010200 ffffea0007b2e880 0000000400000004 ffff8881f6002000
raw: ffff8881a805a500 00000000800c0006 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881a805b080: fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc
ffff8881a805b100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8881a805b180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881a805b200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881a805b280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot found the following issue on:
HEAD commit: e37aca80 ANDROID: modpost: Forbid double exports
git tree: android12-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=140d6785500000
kernel config: https://syzkaller.appspot.com/x/.config?x=ad643f8e0f1f7aa8
dashboard link: https://syzkaller.appspot.com/bug?extid=6038e5964bf567082212
compiler: Android (6032204 based on r370808) clang version 10.0.1 (https://android.googlesource.com/toolchain/llvm-project 6e765c10313d15c02ab29977a82938f66742c3a9)
Unfortunately, I don't have any reproducer for this issue yet.
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+6038e5...@syzkaller.appspotmail.com
RBP: 00007f580d8afca0 R08: 0000000020000380 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000018
R13: 00007ffeb758636f R14: 00007f580d8b09c0 R15: 000000000118bf2c
kobject_add_internal failed for 9p-fcall-cache (error: -12 parent: slab)
==================================================================
BUG: KASAN: double-free or invalid-free in slab_free mm/slub.c:3051 [inline]
BUG: KASAN: double-free or invalid-free in kmem_cache_free+0xac/0x610 mm/slub.c:3067
CPU: 1 PID: 17334 Comm: syz-executor.1 Not tainted 5.4.80-syzkaller-00759-ge37aca80313f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1dd/0x24e lib/dump_stack.c:118
print_address_description+0x96/0x640 mm/kasan/report.c:374
kasan_report_invalid_free+0x54/0xc0 mm/kasan/report.c:468
__kasan_slab_free+0x102/0x230 mm/kasan/common.c:459
slab_free_hook mm/slub.c:1453 [inline]
slab_free_freelist_hook+0xd0/0x150 mm/slub.c:1486
slab_free mm/slub.c:3051 [inline]
kmem_cache_free+0xac/0x610 mm/slub.c:3067
create_cache+0x1cc/0x1f0 mm/slab_common.c:429
kmem_cache_create_usercopy+0x145/0x1d0 mm/slab_common.c:513
p9_client_create+0x9ff/0xb90 net/9p/client.c:1061
v9fs_session_init+0x208/0x1a00 fs/9p/v9fs.c:406
v9fs_mount+0x7f/0x790 fs/9p/vfs_super.c:124
legacy_get_tree+0xde/0x170 fs/fs_context.c:647
vfs_get_tree+0x85/0x260 fs/super.c:1547
do_new_mount fs/namespace.c:2822 [inline]
do_mount+0x18ab/0x2660 fs/namespace.c:3142
ksys_mount+0xc2/0xf0 fs/namespace.c:3351
__do_sys_mount fs/namespace.c:3365 [inline]
__se_sys_mount fs/namespace.c:3362 [inline]
__x64_sys_mount+0xb1/0xc0 fs/namespace.c:3362
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45deb9
Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f580d8afc78 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000021800 RCX: 000000000045deb9
RDX: 00000000200001c0 RSI: 0000000020000180 RDI: 0000000000000000
RBP: 00007f580d8afca0 R08: 0000000020000380 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000018
R13: 00007ffeb758636f R14: 00007f580d8b09c0 R15: 000000000118bf2c
Allocated by task 17334:
save_stack mm/kasan/common.c:69 [inline]
set_track mm/kasan/common.c:77 [inline]
__kasan_kmalloc+0x129/0x1c0 mm/kasan/common.c:510
slab_post_alloc_hook mm/slab.h:584 [inline]
slab_alloc_node mm/slub.c:2803 [inline]
slab_alloc mm/slub.c:2811 [inline]
kmem_cache_alloc+0x1e0/0x270 mm/slub.c:2816
kmem_cache_zalloc include/linux/slab.h:680 [inline]
create_cache+0x3b/0x1f0 mm/slab_common.c:400
kmem_cache_create_usercopy+0x145/0x1d0 mm/slab_common.c:513
p9_client_create+0x9ff/0xb90 net/9p/client.c:1061
v9fs_session_init+0x208/0x1a00 fs/9p/v9fs.c:406
v9fs_mount+0x7f/0x790 fs/9p/vfs_super.c:124
legacy_get_tree+0xde/0x170 fs/fs_context.c:647
vfs_get_tree+0x85/0x260 fs/super.c:1547
do_new_mount fs/namespace.c:2822 [inline]
do_mount+0x18ab/0x2660 fs/namespace.c:3142
ksys_mount+0xc2/0xf0 fs/namespace.c:3351
__do_sys_mount fs/namespace.c:3365 [inline]
__se_sys_mount fs/namespace.c:3362 [inline]
__x64_sys_mount+0xb1/0xc0 fs/namespace.c:3362
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Freed by task 17334:
save_stack mm/kasan/common.c:69 [inline]
set_track mm/kasan/common.c:77 [inline]
kasan_set_free_info mm/kasan/common.c:332 [inline]
__kasan_slab_free+0x17e/0x230 mm/kasan/common.c:471
slab_free_hook mm/slub.c:1453 [inline]
slab_free_freelist_hook+0xd0/0x150 mm/slub.c:1486
slab_free mm/slub.c:3051 [inline]
kmem_cache_free+0xac/0x610 mm/slub.c:3067
kobject_cleanup+0x1e1/0x3c0 lib/kobject.c:708
sysfs_slab_add+0x1a1/0x310 mm/slub.c:5825
__kmem_cache_create+0x67c/0x6f0 mm/slub.c:4375
create_cache+0x156/0x1f0 mm/slab_common.c:415
kmem_cache_create_usercopy+0x145/0x1d0 mm/slab_common.c:513
p9_client_create+0x9ff/0xb90 net/9p/client.c:1061
v9fs_session_init+0x208/0x1a00 fs/9p/v9fs.c:406
v9fs_mount+0x7f/0x790 fs/9p/vfs_super.c:124
legacy_get_tree+0xde/0x170 fs/fs_context.c:647
vfs_get_tree+0x85/0x260 fs/super.c:1547
do_new_mount fs/namespace.c:2822 [inline]
do_mount+0x18ab/0x2660 fs/namespace.c:3142
ksys_mount+0xc2/0xf0 fs/namespace.c:3351
__do_sys_mount fs/namespace.c:3365 [inline]
__se_sys_mount fs/namespace.c:3362 [inline]
__x64_sys_mount+0xb1/0xc0 fs/namespace.c:3362
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
The buggy address belongs to the object at ffff8881a805b180
which belongs to the cache kmem_cache of size 472
The buggy address is located 0 bytes inside of
472-byte region [ffff8881a805b180, ffff8881a805b358)
The buggy address belongs to the page:
page:ffffea0006a01680 refcount:1 mapcount:0 mapping:ffff8881f6002000 index:0xffff8881a805a500 compound_mapcount: 0
flags: 0x8000000000010200(slab|head)
raw: 8000000000010200 ffffea0007b2e880 0000000400000004 ffff8881f6002000
raw: ffff8881a805a500 00000000800c0006 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881a805b080: fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc
ffff8881a805b100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8881a805b180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881a805b200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881a805b280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot
Nov 27, 2020, 11:15:15 PM11/27/20
to syzkaller-a...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: e37aca80 ANDROID: modpost: Forbid double exports
git tree: android12-5.4
console output: https://syzkaller.appspot.com/x/log.txt?x=10730e65500000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1771b3dd500000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+6038e5...@syzkaller.appspotmail.com
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000005 R14: 0000000000000000 R15: 0000000000000000
RIP: 0033:0x446359
Code: e8 1c e7 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 01 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffc34fb9a38 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000446359
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000005 R14: 0000000000000000 R15: 0000000000000000
Allocated by task 403:
The buggy address belongs to the object at ffff8881e24e7b80
flags: 0x8000000000010200(slab|head)
raw: 8000000000010200 dead000000000100 dead000000000122 ffff8881f6002000
raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000
ffff8881e24e7b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8881e24e7b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881e24e7c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881e24e7c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
CPU: 0 PID: 403 Comm: syz-executor525 Tainted: G B 5.4.80-syzkaller-00759-ge37aca80313f #0
end_report mm/kasan/report.c:96 [inline]
kasan_report_invalid_free+0xb7/0xc0 mm/kasan/report.c:471
Code: e8 1c e7 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 01 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffc34fb9a38 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000446359
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000005 R14: 0000000000000000 R15: 0000000000000000
Kernel Offset: disabled
Rebooting in 86400 seconds..
HEAD commit: e37aca80 ANDROID: modpost: Forbid double exports
git tree: android12-5.4
kernel config: https://syzkaller.appspot.com/x/.config?x=ad643f8e0f1f7aa8
dashboard link: https://syzkaller.appspot.com/bug?extid=6038e5964bf567082212
compiler: Android (6032204 based on r370808) clang version 10.0.1 (https://android.googlesource.com/toolchain/llvm-project 6e765c10313d15c02ab29977a82938f66742c3a9)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15d1ce8b500000
dashboard link: https://syzkaller.appspot.com/bug?extid=6038e5964bf567082212
compiler: Android (6032204 based on r370808) clang version 10.0.1 (https://android.googlesource.com/toolchain/llvm-project 6e765c10313d15c02ab29977a82938f66742c3a9)
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1771b3dd500000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+6038e5...@syzkaller.appspotmail.com
R13: 0000000000000005 R14: 0000000000000000 R15: 0000000000000000
BUG: KASAN: double-free or invalid-free in slab_free mm/slub.c:3051 [inline]
BUG: KASAN: double-free or invalid-free in kmem_cache_free+0xac/0x610 mm/slub.c:3067
CPU: 0 PID: 403 Comm: syz-executor525 Not tainted 5.4.80-syzkaller-00759-ge37aca80313f #0
BUG: KASAN: double-free or invalid-free in kmem_cache_free+0xac/0x610 mm/slub.c:3067
Code: e8 1c e7 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 01 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffc34fb9a38 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000446359
RDX: 00000000200001c0 RSI: 0000000020000180 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000020000380 R09: 0000000000003532
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000005 R14: 0000000000000000 R15: 0000000000000000
Allocated by task 403:
save_stack mm/kasan/common.c:69 [inline]
set_track mm/kasan/common.c:77 [inline]
__kasan_kmalloc+0x129/0x1c0 mm/kasan/common.c:510
slab_post_alloc_hook mm/slab.h:584 [inline]
slab_alloc_node mm/slub.c:2803 [inline]
slab_alloc mm/slub.c:2811 [inline]
kmem_cache_alloc+0x1e0/0x270 mm/slub.c:2816
kmem_cache_zalloc include/linux/slab.h:680 [inline]
create_cache+0x3b/0x1f0 mm/slab_common.c:400
kmem_cache_create_usercopy+0x145/0x1d0 mm/slab_common.c:513
p9_client_create+0x9ff/0xb90 net/9p/client.c:1061
v9fs_session_init+0x208/0x1a00 fs/9p/v9fs.c:406
v9fs_mount+0x7f/0x790 fs/9p/vfs_super.c:124
legacy_get_tree+0xde/0x170 fs/fs_context.c:647
vfs_get_tree+0x85/0x260 fs/super.c:1547
do_new_mount fs/namespace.c:2822 [inline]
do_mount+0x18ab/0x2660 fs/namespace.c:3142
ksys_mount+0xc2/0xf0 fs/namespace.c:3351
__do_sys_mount fs/namespace.c:3365 [inline]
__se_sys_mount fs/namespace.c:3362 [inline]
__x64_sys_mount+0xb1/0xc0 fs/namespace.c:3362
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Freed by task 403:
set_track mm/kasan/common.c:77 [inline]
__kasan_kmalloc+0x129/0x1c0 mm/kasan/common.c:510
slab_post_alloc_hook mm/slab.h:584 [inline]
slab_alloc_node mm/slub.c:2803 [inline]
slab_alloc mm/slub.c:2811 [inline]
kmem_cache_alloc+0x1e0/0x270 mm/slub.c:2816
kmem_cache_zalloc include/linux/slab.h:680 [inline]
create_cache+0x3b/0x1f0 mm/slab_common.c:400
kmem_cache_create_usercopy+0x145/0x1d0 mm/slab_common.c:513
p9_client_create+0x9ff/0xb90 net/9p/client.c:1061
v9fs_session_init+0x208/0x1a00 fs/9p/v9fs.c:406
v9fs_mount+0x7f/0x790 fs/9p/vfs_super.c:124
legacy_get_tree+0xde/0x170 fs/fs_context.c:647
vfs_get_tree+0x85/0x260 fs/super.c:1547
do_new_mount fs/namespace.c:2822 [inline]
do_mount+0x18ab/0x2660 fs/namespace.c:3142
ksys_mount+0xc2/0xf0 fs/namespace.c:3351
__do_sys_mount fs/namespace.c:3365 [inline]
__se_sys_mount fs/namespace.c:3362 [inline]
__x64_sys_mount+0xb1/0xc0 fs/namespace.c:3362
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
which belongs to the cache kmem_cache of size 472
The buggy address is located 0 bytes inside of
472-byte region [ffff8881e24e7b80, ffff8881e24e7d58)
The buggy address is located 0 bytes inside of
The buggy address belongs to the page:
page:ffffea0007893980 refcount:1 mapcount:0 mapping:ffff8881f6002000 index:0x0 compound_mapcount: 0
flags: 0x8000000000010200(slab|head)
raw: 8000000000010200 dead000000000100 dead000000000122 ffff8881f6002000
raw: 0000000000000000 00000000800c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881e24e7a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
Memory state around the buggy address:
ffff8881e24e7b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8881e24e7b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881e24e7c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881e24e7c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
CPU: 0 PID: 403 Comm: syz-executor525 Tainted: G B 5.4.80-syzkaller-00759-ge37aca80313f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1dd/0x24e lib/dump_stack.c:118
panic+0x285/0x750 kernel/panic.c:221
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1dd/0x24e lib/dump_stack.c:118
end_report mm/kasan/report.c:96 [inline]
kasan_report_invalid_free+0xb7/0xc0 mm/kasan/report.c:471
__kasan_slab_free+0x102/0x230 mm/kasan/common.c:459
slab_free_hook mm/slub.c:1453 [inline]
slab_free_freelist_hook+0xd0/0x150 mm/slub.c:1486
slab_free mm/slub.c:3051 [inline]
kmem_cache_free+0xac/0x610 mm/slub.c:3067
create_cache+0x1cc/0x1f0 mm/slab_common.c:429
kmem_cache_create_usercopy+0x145/0x1d0 mm/slab_common.c:513
p9_client_create+0x9ff/0xb90 net/9p/client.c:1061
v9fs_session_init+0x208/0x1a00 fs/9p/v9fs.c:406
v9fs_mount+0x7f/0x790 fs/9p/vfs_super.c:124
legacy_get_tree+0xde/0x170 fs/fs_context.c:647
vfs_get_tree+0x85/0x260 fs/super.c:1547
do_new_mount fs/namespace.c:2822 [inline]
do_mount+0x18ab/0x2660 fs/namespace.c:3142
ksys_mount+0xc2/0xf0 fs/namespace.c:3351
__do_sys_mount fs/namespace.c:3365 [inline]
__se_sys_mount fs/namespace.c:3362 [inline]
__x64_sys_mount+0xb1/0xc0 fs/namespace.c:3362
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x446359
slab_free_hook mm/slub.c:1453 [inline]
slab_free_freelist_hook+0xd0/0x150 mm/slub.c:1486
slab_free mm/slub.c:3051 [inline]
kmem_cache_free+0xac/0x610 mm/slub.c:3067
create_cache+0x1cc/0x1f0 mm/slab_common.c:429
kmem_cache_create_usercopy+0x145/0x1d0 mm/slab_common.c:513
p9_client_create+0x9ff/0xb90 net/9p/client.c:1061
v9fs_session_init+0x208/0x1a00 fs/9p/v9fs.c:406
v9fs_mount+0x7f/0x790 fs/9p/vfs_super.c:124
legacy_get_tree+0xde/0x170 fs/fs_context.c:647
vfs_get_tree+0x85/0x260 fs/super.c:1547
do_new_mount fs/namespace.c:2822 [inline]
do_mount+0x18ab/0x2660 fs/namespace.c:3142
ksys_mount+0xc2/0xf0 fs/namespace.c:3351
__do_sys_mount fs/namespace.c:3365 [inline]
__se_sys_mount fs/namespace.c:3362 [inline]
__x64_sys_mount+0xb1/0xc0 fs/namespace.c:3362
do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Code: e8 1c e7 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 fb 01 fc ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffc34fb9a38 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000446359
RDX: 00000000200001c0 RSI: 0000000020000180 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000020000380 R09: 0000000000003532
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000005 R14: 0000000000000000 R15: 0000000000000000
Kernel Offset: disabled
Rebooting in 86400 seconds..
syzbot
Apr 17, 2023, 1:57:33 PM4/17/23
to syzkaller-a...@googlegroups.com
Auto-closing this bug as obsolete.
No recent activity, existing reproducers are no longer triggering the issue.
No recent activity, existing reproducers are no longer triggering the issue.
Reply all
Reply to author
Forward
0 new messages