syzbot

random: sshd: uninitialized urandom read (32 bytes read)
random: sshd: uninitialized urandom read (32 bytes read)
random: sshd: uninitialized urandom read (32 bytes read)
random: sshd: uninitialized urandom read (32 bytes read)
==================================================================
BUG: KASAN: double-free or invalid-free in p9stat_free+0x35/0x100 net/9p/protocol.c:48

CPU: 1 PID: 3808 Comm: syz-executor747 Not tainted 4.9.124-g09eb2ba #31
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801d906fa90 ffffffff81eb95e9 ffffea00071f7f40 ffff8801c7dfdc00
 ffff8801da001c80 ffffffff839c4e35 0000000000000282 ffff8801d906fac8
 ffffffff8156c35e ffff8801c7dfdc00 ffffffff839c4e35 ffff8801da001c80
Call Trace:
 [<ffffffff81eb95e9>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81eb95e9>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff8156c35e>] print_address_description+0x6c/0x234 mm/kasan/report.c:256
 [<ffffffff8153f934>] kasan_report_double_free+0x64/0xa0 mm/kasan/report.c:337
 [<ffffffff8153f4d4>] kasan_slab_free+0xa4/0xc0 mm/kasan/kasan.c:572
 [<ffffffff8153c8ab>] slab_free_hook mm/slub.c:1355 [inline]
 [<ffffffff8153c8ab>] slab_free_freelist_hook mm/slub.c:1377 [inline]
 [<ffffffff8153c8ab>] slab_free mm/slub.c:2958 [inline]
 [<ffffffff8153c8ab>] kfree+0xfb/0x310 mm/slub.c:3878
 [<ffffffff839c4e35>] p9stat_free+0x35/0x100 net/9p/protocol.c:48
 [<ffffffff8195f3fe>] v9fs_dir_readdir+0x49e/0x820 fs/9p/vfs_dir.c:153
 [<ffffffff815b86dc>] iterate_dir+0x1ac/0x600 fs/readdir.c:50
 [<ffffffff815b971c>] SYSC_getdents fs/readdir.c:230 [inline]
 [<ffffffff815b971c>] SyS_getdents+0x13c/0x2a0 fs/readdir.c:211
 [<ffffffff81006316>] do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282
 [<ffffffff83a019d3>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Allocated by task 3808:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack+0x43/0xd0 mm/kasan/kasan.c:505
 set_track mm/kasan/kasan.c:517 [inline]
 kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:609
 __kmalloc+0x11d/0x300 mm/slub.c:3741
 kmalloc include/linux/slab.h:495 [inline]
 p9pdu_vreadf net/9p/protocol.c:157 [inline]
 p9pdu_readf+0x483/0x1d50 net/9p/protocol.c:535
 p9pdu_vreadf net/9p/protocol.c:208 [inline]
 p9pdu_readf+0xefc/0x1d50 net/9p/protocol.c:535
 p9stat_read+0xda/0x400 net/9p/protocol.c:564
 v9fs_dir_readdir+0x475/0x820 fs/9p/vfs_dir.c:149
 iterate_dir+0x1ac/0x600 fs/readdir.c:50
 SYSC_getdents fs/readdir.c:230 [inline]
 SyS_getdents+0x13c/0x2a0 fs/readdir.c:211
 do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282
 entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Freed by task 3808:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack+0x43/0xd0 mm/kasan/kasan.c:505
 set_track mm/kasan/kasan.c:517 [inline]
 kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:582
 slab_free_hook mm/slub.c:1355 [inline]
 slab_free_freelist_hook mm/slub.c:1377 [inline]
 slab_free mm/slub.c:2958 [inline]
 kfree+0xfb/0x310 mm/slub.c:3878
 p9stat_free+0x35/0x100 net/9p/protocol.c:48
 p9pdu_vreadf net/9p/protocol.c:220 [inline]
 p9pdu_readf+0xf14/0x1d50 net/9p/protocol.c:535
 p9stat_read+0xda/0x400 net/9p/protocol.c:564
 v9fs_dir_readdir+0x475/0x820 fs/9p/vfs_dir.c:149
 iterate_dir+0x1ac/0x600 fs/readdir.c:50
 SYSC_getdents fs/readdir.c:230 [inline]
 SyS_getdents+0x13c/0x2a0 fs/readdir.c:211
 do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282
 entry_SYSCALL_64_after_swapgs+0x5d/0xdb

The buggy address belongs to the object at ffff8801c7dfdc00
 which belongs to the cache kmalloc-8 of size 8
The buggy address is located 0 bytes inside of
 8-byte region [ffff8801c7dfdc00, ffff8801c7dfdc08)
The buggy address belongs to the page:
page:ffffea00071f7f40 count:1 mapcount:0 mapping:          (null) index:0x0
flags: 0x8000000000000080(slab)
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801c7dfdb00: fc fc 00 fc fc 00 fc fc 00 fc fc 00 fc fc 00 fc
 ffff8801c7dfdb80: fc fb fc fc fb fc fc fb fc fc fb fc fc fb fc fc
>ffff8801c7dfdc00: fb fc fc fb fc fc fb fc fc fb fc fc 00 fc fc 00
                   ^
 ffff8801c7dfdc80: fc fc 00 fc fc 00 fc fc fb fc fc 00 fc fc 00 fc
 ffff8801c7dfdd00: fc fb fc fc fb fc fc 00 fc fc 00 fc fc 00 fc fc
==================================================================