==================================================================
BUG: KASAN: double-free in slab_free mm/slub.c:3809 [inline]
BUG: KASAN: double-free in __kmem_cache_free+0xc0/0x180 mm/slub.c:3822
Free of addr ffff888051c22900 by task syz-executor.1/5220
CPU: 0 PID: 5220 Comm: syz-executor.1 Not tainted 6.7.0-rc1-syzkaller-00213-g791c8ab095f7 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:364 [inline]
print_report+0xc4/0x620 mm/kasan/report.c:475
kasan_report_invalid_free+0xab/0xd0 mm/kasan/report.c:550
____kasan_slab_free+0x180/0x1b0 mm/kasan/common.c:225
kasan_slab_free include/linux/kasan.h:164 [inline]
slab_free_hook mm/slub.c:1800 [inline]
slab_free_freelist_hook+0x114/0x1e0 mm/slub.c:1826
slab_free mm/slub.c:3809 [inline]
__kmem_cache_free+0xc0/0x180 mm/slub.c:3822
hfs_btree_close+0xac/0x390 fs/hfs/btree.c:154
hfs_mdb_put+0xbf/0x380 fs/hfs/mdb.c:360
generic_shutdown_super+0x161/0x3d0 fs/super.c:696
kill_block_super+0x3b/0x90 fs/super.c:1667
deactivate_locked_super+0xbc/0x1a0 fs/super.c:484
deactivate_super+0xde/0x100 fs/super.c:517
cleanup_mnt+0x222/0x450 fs/namespace.c:1256
task_work_run+0x14d/0x240 kernel/task_work.c:180
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
exit_to_user_mode_prepare+0x217/0x240 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline]
syscall_exit_to_user_mode+0x1e/0x60 kernel/entry/common.c:296
__do_fast_syscall_32+0x6f/0xe0 arch/x86/entry/common.c:233
do_fast_syscall_32+0x33/0x70 arch/x86/entry/common.c:255
entry_SYSENTER_compat_after_hwframe+0x70/0x7a
RIP: 0023:0xf7f87579
Code: b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
RSP: 002b:00000000ff99dcf8 EFLAGS: 00000292 ORIG_RAX: 0000000000000034
RAX: 0000000000000000 RBX: 00000000ff99dda0 RCX: 000000000000000a
RDX: 00000000f7353ff4 RSI: 00000000f72a53bd RDI: 00000000ff99ee44
RBP: 00000000ff99dda0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000296 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
</TASK>
Allocated by task 8783:
kasan_save_stack+0x33/0x50 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
____kasan_kmalloc mm/kasan/common.c:374 [inline]
__kasan_kmalloc+0xa2/0xb0 mm/kasan/common.c:383
kasan_kmalloc include/linux/kasan.h:198 [inline]
__do_kmalloc_node mm/slab_common.c:1007 [inline]
__kmalloc+0x59/0x90 mm/slab_common.c:1020
kmalloc include/linux/slab.h:604 [inline]
kzalloc include/linux/slab.h:721 [inline]
__hfs_bnode_create+0x108/0x850 fs/hfs/bnode.c:259
hfs_bnode_find+0x2cf/0xcb0 fs/hfs/bnode.c:335
hfs_brec_find+0x2af/0x510 fs/hfs/bfind.c:126
hfs_cat_create+0x58d/0x810 fs/hfs/catalog.c:124
hfs_create+0x67/0xe0 fs/hfs/dir.c:202
lookup_open.isra.0+0x1095/0x13b0 fs/namei.c:3477
open_last_lookups fs/namei.c:3546 [inline]
path_openat+0x922/0x2c50 fs/namei.c:3776
do_filp_open+0x1de/0x430 fs/namei.c:3809
do_sys_openat2+0x176/0x1e0 fs/open.c:1440
do_sys_open fs/open.c:1455 [inline]
__do_compat_sys_open fs/open.c:1506 [inline]
__se_compat_sys_open fs/open.c:1504 [inline]
__ia32_compat_sys_open+0x147/0x1d0 fs/open.c:1504
do_syscall_32_irqs_on arch/x86/entry/common.c:164 [inline]
__do_fast_syscall_32+0x62/0xe0 arch/x86/entry/common.c:230
do_fast_syscall_32+0x33/0x70 arch/x86/entry/common.c:255
entry_SYSENTER_compat_after_hwframe+0x70/0x7a
Freed by task 108:
kasan_save_stack+0x33/0x50 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:522
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free+0x15b/0x1b0 mm/kasan/common.c:200
kasan_slab_free include/linux/kasan.h:164 [inline]
slab_free_hook mm/slub.c:1800 [inline]
slab_free_freelist_hook+0x114/0x1e0 mm/slub.c:1826
slab_free mm/slub.c:3809 [inline]
__kmem_cache_free+0xc0/0x180 mm/slub.c:3822
hfs_release_folio+0x431/0x570 fs/hfs/inode.c:123
filemap_release_folio+0x1f1/0x270 mm/filemap.c:4076
shrink_folio_list+0x2991/0x3f00 mm/vmscan.c:1368
evict_folios+0x6e7/0x1b90 mm/vmscan.c:4499
try_to_shrink_lruvec+0x769/0xb00 mm/vmscan.c:4678
shrink_one+0x45f/0x700 mm/vmscan.c:4722
shrink_many mm/vmscan.c:4776 [inline]
lru_gen_shrink_node mm/vmscan.c:4893 [inline]
shrink_node+0x20cd/0x3790 mm/vmscan.c:5833
kswapd_shrink_node mm/vmscan.c:6638 [inline]
balance_pgdat+0x9d2/0x1a90 mm/vmscan.c:6828
kswapd+0x5be/0xbf0 mm/vmscan.c:7088
kthread+0x2c6/0x3a0 kernel/kthread.c:388
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242
Last potentially related work creation:
kasan_save_stack+0x33/0x50 mm/kasan/common.c:45
__kasan_record_aux_stack+0xbc/0xd0 mm/kasan/generic.c:492
insert_work+0x38/0x230 kernel/workqueue.c:1647
__queue_work+0xcdc/0x11f0 kernel/workqueue.c:1803
queue_work_on+0xed/0x110 kernel/workqueue.c:1834
queue_work include/linux/workqueue.h:562 [inline]
addr_event.constprop.0+0x391/0x560 drivers/infiniband/core/roce_gid_mgmt.c:853
inet6addr_event+0x113/0x180 drivers/infiniband/core/roce_gid_mgmt.c:883
notifier_call_chain+0xb6/0x3b0 kernel/notifier.c:93
atomic_notifier_call_chain+0x71/0x1b0 kernel/notifier.c:231
ipv6_add_addr+0x1400/0x2040 net/ipv6/addrconf.c:1176
addrconf_add_linklocal+0x299/0x640 net/ipv6/addrconf.c:3264
addrconf_addr_gen+0x366/0x3b0 net/ipv6/addrconf.c:3395
addrconf_dev_config net/ipv6/addrconf.c:3440 [inline]
addrconf_init_auto_addrs+0x446/0x820 net/ipv6/addrconf.c:3518
addrconf_notify+0x714/0x1920 net/ipv6/addrconf.c:3691
notifier_call_chain+0xb6/0x3b0 kernel/notifier.c:93
call_netdevice_notifiers_info+0xbe/0x130 net/core/dev.c:1967
netdev_state_change net/core/dev.c:1349 [inline]
netdev_state_change+0x111/0x140 net/core/dev.c:1342
linkwatch_do_dev+0x122/0x150 net/core/link_watch.c:182
__linkwatch_run_queue+0x233/0x680 net/core/link_watch.c:235
linkwatch_event+0x8f/0xc0 net/core/link_watch.c:278
process_one_work+0x886/0x15d0 kernel/workqueue.c:2630
process_scheduled_works kernel/workqueue.c:2703 [inline]
worker_thread+0x8b9/0x1290 kernel/workqueue.c:2784
kthread+0x2c6/0x3a0 kernel/kthread.c:388
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242
The buggy address belongs to the object at ffff888051c22900
which belongs to the cache kmalloc-192 of size 192
The buggy address is located 0 bytes inside of
192-byte region [ffff888051c22900, ffff888051c229c0)
The buggy address belongs to the physical page:
page:ffffea0001470880 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x51c22
flags: 0x4fff00000000800(slab|node=1|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 04fff00000000800 ffff888013042a00 ffffea00011068c0 dead000000000004
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 5211, tgid 5211 (syz-executor.0), ts 158850736380, free_ts 156638627431
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x2d0/0x350 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1544 [inline]
get_page_from_freelist+0xa25/0x36d0 mm/page_alloc.c:3312
__alloc_pages+0x22e/0x2420 mm/page_alloc.c:4568
__alloc_pages_node include/linux/gfp.h:238 [inline]
alloc_slab_page mm/slub.c:1872 [inline]
allocate_slab mm/slub.c:2017 [inline]
new_slab+0xca/0x3c0 mm/slub.c:2070
___slab_alloc+0x979/0x1500 mm/slub.c:3223
__slab_alloc.constprop.0+0x56/0xa0 mm/slub.c:3322
__slab_alloc_node mm/slub.c:3375 [inline]
slab_alloc_node mm/slub.c:3468 [inline]
__kmem_cache_alloc_node+0x131/0x310 mm/slub.c:3517
__do_kmalloc_node mm/slab_common.c:1006 [inline]
__kmalloc_node+0x4c/0x90 mm/slab_common.c:1014
kmalloc_array_node include/linux/slab.h:698 [inline]
kcalloc_node include/linux/slab.h:703 [inline]
memcg_alloc_slab_cgroups+0xa9/0x180 mm/memcontrol.c:2968
account_slab mm/slab.h:637 [inline]
allocate_slab mm/slub.c:2035 [inline]
new_slab+0x2fd/0x3c0 mm/slub.c:2070
___slab_alloc+0x979/0x1500 mm/slub.c:3223
__slab_alloc.constprop.0+0x56/0xa0 mm/slub.c:3322
__slab_alloc_node mm/slub.c:3375 [inline]
slab_alloc_node mm/slub.c:3468 [inline]
slab_alloc mm/slub.c:3486 [inline]
__kmem_cache_alloc_lru mm/slub.c:3493 [inline]
kmem_cache_alloc+0x2dc/0x2f0 mm/slub.c:3502
vma_lock_alloc kernel/fork.c:459 [inline]
vm_area_dup+0x53/0x2f0 kernel/fork.c:512
dup_mmap+0x93c/0x1d90 kernel/fork.c:710
dup_mm kernel/fork.c:1691 [inline]
copy_mm kernel/fork.c:1740 [inline]
copy_process+0x43c8/0x73f0 kernel/fork.c:2502
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1137 [inline]
free_unref_page_prepare+0x4fa/0xaa0 mm/page_alloc.c:2347
free_unref_page+0x33/0x3b0 mm/page_alloc.c:2487
qlink_free mm/kasan/quarantine.c:168 [inline]
qlist_free_all+0x6a/0x170 mm/kasan/quarantine.c:187
kasan_quarantine_reduce+0x18e/0x1d0 mm/kasan/quarantine.c:294
__kasan_slab_alloc+0x65/0x90 mm/kasan/common.c:305
kasan_slab_alloc include/linux/kasan.h:188 [inline]
slab_post_alloc_hook mm/slab.h:763 [inline]
slab_alloc_node mm/slub.c:3478 [inline]
slab_alloc mm/slub.c:3486 [inline]
__kmem_cache_alloc_lru mm/slub.c:3493 [inline]
kmem_cache_alloc+0x15d/0x2f0 mm/slub.c:3502
zswap_entry_cache_alloc mm/zswap.c:302 [inline]
zswap_store+0x533/0x23d0 mm/zswap.c:1263
swap_writepage+0x8b/0x1e0 mm/page_io.c:198
pageout+0x399/0x9d0 mm/vmscan.c:654
shrink_folio_list+0x2fb0/0x3f00 mm/vmscan.c:1315
evict_folios+0x6e7/0x1b90 mm/vmscan.c:4499
try_to_shrink_lruvec+0x769/0xb00 mm/vmscan.c:4678
shrink_one+0x45f/0x700 mm/vmscan.c:4722
shrink_many mm/vmscan.c:4776 [inline]
lru_gen_shrink_node mm/vmscan.c:4893 [inline]
shrink_node+0x20cd/0x3790 mm/vmscan.c:5833
kswapd_shrink_node mm/vmscan.c:6638 [inline]
balance_pgdat+0x9d2/0x1a90 mm/vmscan.c:6828
kswapd+0x5be/0xbf0 mm/vmscan.c:7088
Memory state around the buggy address:
ffff888051c22800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888051c22880: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff888051c22900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888051c22980: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff888051c22a00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess), 2 bytes skipped:
0: 10 06 adc %al,(%rsi)
2: 03 74 b4 01 add 0x1(%rsp,%rsi,4),%esi
6: 10 07 adc %al,(%rdi)
8: 03 74 b0 01 add 0x1(%rax,%rsi,4),%esi
c: 10 08 adc %cl,(%rax)
e: 03 74 d8 01 add 0x1(%rax,%rbx,8),%esi
1e: 00 51 52 add %dl,0x52(%rcx)
21: 55 push %rbp
22: 89 e5 mov %esp,%ebp
24: 0f 34 sysenter
26: cd 80 int $0x80
* 28: 5d pop %rbp <-- trapping instruction
29: 5a pop %rdx
2a: 59 pop %rcx
2b: c3 ret
2c: 90 nop
2d: 90 nop
2e: 90 nop
2f: 90 nop
30: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi
37: 8d b4 26 00 00 00 00 lea 0x0(%rsi,%riz,1),%esi