syzbot

IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
IPv6: ADDRCONF(NETDEV_UP): veth1: link is not ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
==================================================================
BUG: KASAN: use-after-free in snd_timer_interrupt+0xa5c/0xc40 sound/core/timer.c:801
Read of size 4 at addr ffff8801cfc91c90 by task syz-executor2/12666

CPU: 1 PID: 12666 Comm: syz-executor2 Not tainted 4.9.103-g0cecdf8 #38
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801db307b98 ffffffff81eb34a9 ffffea00073f2440 ffff8801cfc91c90
 0000000000000000 ffff8801cfc91c90 ffff8801cfc91c80 ffff8801db307bd0
 ffffffff815676bb ffff8801cfc91c90 0000000000000004 0000000000000000
Call Trace:
 <IRQ> [  185.785001]  [<ffffffff81eb34a9>] __dump_stack lib/dump_stack.c:15 [inline]
 <IRQ> [  185.785001]  [<ffffffff81eb34a9>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff815676bb>] print_address_description+0x6c/0x234 mm/kasan/report.c:256
 [<ffffffff81567ac5>] kasan_report_error mm/kasan/report.c:355 [inline]
 [<ffffffff81567ac5>] kasan_report.cold.6+0x242/0x2fe mm/kasan/report.c:412
 [<ffffffff8153b724>] __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:432
 [<ffffffff82ee46fc>] snd_timer_interrupt+0xa5c/0xc40 sound/core/timer.c:801
 [<ffffffff82ee499d>] snd_timer_s_function+0xbd/0x120 sound/core/timer.c:1028
 [<ffffffff81298b23>] call_timer_fn+0x163/0x6e0 kernel/time/timer.c:1319
 [<ffffffff8129fc87>] expire_timers kernel/time/timer.c:1359 [inline]
 [<ffffffff8129fc87>] __run_timers kernel/time/timer.c:1658 [inline]
 [<ffffffff8129fc87>] run_timer_softirq+0x1047/0x1590 kernel/time/timer.c:1684
 [<ffffffff839febfb>] __do_softirq+0x20b/0x937 kernel/softirq.c:284
 [<ffffffff8114b0b7>] invoke_softirq kernel/softirq.c:364 [inline]
 [<ffffffff8114b0b7>] irq_exit+0x147/0x190 kernel/softirq.c:405
 [<ffffffff839fd7e1>] exiting_irq arch/x86/include/asm/apic.h:659 [inline]
 [<ffffffff839fd7e1>] smp_apic_timer_interrupt+0x81/0xa0 arch/x86/kernel/apic/apic.c:960
 [<ffffffff839f9970>] apic_timer_interrupt+0xa0/0xb0 arch/x86/entry/entry_64.S:648
 <EOI> [  185.943926]  [<ffffffff839f771f>] ? arch_local_irq_restore arch/x86/include/asm/paravirt.h:768 [inline]
 <EOI> [  185.943926]  [<ffffffff839f771f>] ? __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:162 [inline]
 <EOI> [  185.943926]  [<ffffffff839f771f>] ? _raw_spin_unlock_irqrestore+0x5f/0x70 kernel/locking/spinlock.c:191
 [<ffffffff81f1e0fc>] __debug_check_no_obj_freed lib/debugobjects.c:733 [inline]
 [<ffffffff81f1e0fc>] debug_check_no_obj_freed+0x2ec/0x930 lib/debugobjects.c:749
 [<ffffffff8144a4bd>] free_pages_prepare mm/page_alloc.c:1061 [inline]
 [<ffffffff8144a4bd>] __free_pages_ok+0x1dd/0x1610 mm/page_alloc.c:1263
 [<ffffffff8144f90b>] __free_pages+0x5b/0x80 mm/page_alloc.c:3901
 [<ffffffff8112d1f5>] free_thread_stack kernel/fork.c:239 [inline]
 [<ffffffff8112d1f5>] release_task_stack kernel/fork.c:325 [inline]
 [<ffffffff8112d1f5>] put_task_stack+0x125/0x2c0 kernel/fork.c:336
 [<ffffffff811bac86>] finish_task_switch+0x296/0x640 kernel/sched/core.c:2842
 [<ffffffff839e7125>] context_switch kernel/sched/core.c:2958 [inline]
 [<ffffffff839e7125>] __schedule+0x655/0x1bd0 kernel/sched/core.c:3502
 [<ffffffff839e871f>] schedule+0x7f/0x1b0 kernel/sched/core.c:3557
 [<ffffffff839f5675>] freezable_schedule include/linux/freezer.h:171 [inline]
 [<ffffffff839f5675>] do_nanosleep+0x1f5/0x4d0 kernel/time/hrtimer.c:1497
 [<ffffffff812a6400>] hrtimer_nanosleep+0x210/0x540 kernel/time/hrtimer.c:1566
 [<ffffffff812fbbce>] C_SYSC_nanosleep kernel/compat.c:254 [inline]
 [<ffffffff812fbbce>] compat_SyS_nanosleep+0x27e/0x390 kernel/compat.c:239
 [<ffffffff81006da7>] do_syscall_32_irqs_on arch/x86/entry/common.c:325 [inline]
 [<ffffffff81006da7>] do_fast_syscall_32+0x2f7/0x870 arch/x86/entry/common.c:387
 [<ffffffff839f9710>] entry_SYSENTER_compat+0x90/0xa2 arch/x86/entry/entry_64_compat.S:137

Allocated by task 12678:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack+0x43/0xd0 mm/kasan/kasan.c:505
 set_track mm/kasan/kasan.c:517 [inline]
 kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:609
 kmem_cache_alloc_trace+0xfd/0x2b0 mm/slub.c:2742
 kmalloc include/linux/slab.h:490 [inline]
 kzalloc include/linux/slab.h:636 [inline]
 snd_timer_instance_new+0x52/0x3a0 sound/core/timer.c:107
 snd_timer_open+0x500/0xdd0 sound/core/timer.c:290
 snd_timer_user_tselect sound/core/timer.c:1621 [inline]
 __snd_timer_user_ioctl.isra.23+0x675/0x22c0 sound/core/timer.c:1914
 __snd_timer_user_ioctl_compat sound/core/timer_compat.c:157 [inline]
 snd_timer_user_ioctl_compat+0x563/0x760 sound/core/timer_compat.c:179
 C_SYSC_ioctl fs/compat_ioctl.c:1602 [inline]
 compat_SyS_ioctl+0x126/0x1fe0 fs/compat_ioctl.c:1549
 do_syscall_32_irqs_on arch/x86/entry/common.c:325 [inline]
 do_fast_syscall_32+0x2f7/0x870 arch/x86/entry/common.c:387
 entry_SYSENTER_compat+0x90/0xa2 arch/x86/entry/entry_64_compat.S:137

Freed by task 12685:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack+0x43/0xd0 mm/kasan/kasan.c:505
 set_track mm/kasan/kasan.c:517 [inline]
 kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:582
 slab_free_hook mm/slub.c:1355 [inline]
 slab_free_freelist_hook mm/slub.c:1377 [inline]
 slab_free mm/slub.c:2958 [inline]
 kfree+0xfb/0x310 mm/slub.c:3878
 snd_timer_close+0x36d/0x660 sound/core/timer.c:372
 snd_timer_user_release+0x97/0x130 sound/core/timer.c:1365
 __fput+0x263/0x700 fs/file_table.c:208
 ____fput+0x15/0x20 fs/file_table.c:244
 task_work_run+0x10c/0x180 kernel/task_work.c:116
 exit_task_work include/linux/task_work.h:21 [inline]
 do_exit+0x9e1/0x27c0 kernel/exit.c:837
 do_group_exit+0x111/0x340 kernel/exit.c:941
 get_signal+0x4cf/0x1450 kernel/signal.c:2317
 do_signal+0x87/0x19f0 arch/x86/kernel/signal.c:807
 exit_to_usermode_loop+0xe1/0x120 arch/x86/entry/common.c:157
 prepare_exit_to_usermode arch/x86/entry/common.c:191 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:260 [inline]
 do_syscall_32_irqs_on arch/x86/entry/common.c:331 [inline]
 do_fast_syscall_32+0x5c3/0x870 arch/x86/entry/common.c:387
 entry_SYSENTER_compat+0x90/0xa2 arch/x86/entry/entry_64_compat.S:137

The buggy address belongs to the object at ffff8801cfc91c80
 which belongs to the cache kmalloc-256 of size 256
The buggy address is located 16 bytes inside of
 256-byte region [ffff8801cfc91c80, ffff8801cfc91d80)
The buggy address belongs to the page:
page:ffffea00073f2440 count:1 mapcount:0 mapping:          (null) index:0x0
flags: 0x8000000000000080(slab)
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801cfc91b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8801cfc91c00: 00 00 00 00 00 00 00 05 fc fc fc fc fc fc fc fc
>ffff8801cfc91c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                         ^
 ffff8801cfc91d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8801cfc91d80: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
==================================================================