audit: type=1804 audit(1546646089.916:39): pid=9194 uid=0 auid=4294967295 ses=4294967295 subj==unconfined op=invalid_pcr cause=ToMToU comm="syz-executor4" name="/root/syzkaller-testdir279489048/syzkaller.8hMJvv/34/memory.events" dev="sda1" ino=16638 res=1
==================================================================
BUG: KASAN: double-free or invalid-free in free_inode_nonrcu+0x1d/0x30 fs/inode.c:230
CPU: 1 PID: 8011 Comm: sshd Not tainted 4.20.0+ #8
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1db/0x2d0 lib/dump_stack.c:113
print_address_description.cold+0x7c/0x20d mm/kasan/report.c:187
kasan_report_invalid_free+0x65/0xa0 mm/kasan/report.c:278
__kasan_slab_free+0x13a/0x150 mm/kasan/common.c:423
kasan_slab_free+0xe/0x10 mm/kasan/common.c:452
__cache_free mm/slab.c:3485 [inline]
kmem_cache_free+0x86/0x260 mm/slab.c:3747
free_inode_nonrcu+0x1d/0x30 fs/inode.c:230
destroy_inode+0x14f/0x1f0 fs/inode.c:267
evict+0x5c3/0x940 fs/inode.c:575
iput_final fs/inode.c:1550 [inline]
iput fs/inode.c:1576 [inline]
iput+0x67e/0xae0 fs/inode.c:1562
dentry_unlink_inode+0x43a/0x5e0 fs/dcache.c:360
__dentry_kill+0x472/0x780 fs/dcache.c:552
dentry_kill+0xd7/0x5e0 fs/dcache.c:671
dput+0x654/0x790 fs/dcache.c:832
__fput+0x51f/0xb10 fs/file_table.c:291
____fput+0x16/0x20 fs/file_table.c:309
task_work_run+0x1f4/0x2b0 kernel/task_work.c:113
exit_task_work include/linux/task_work.h:22 [inline]
do_exit+0x19d6/0x2650 kernel/exit.c:867
do_group_exit+0x177/0x430 kernel/exit.c:970
get_signal+0x8b4/0x19b0 kernel/signal.c:2517
do_signal+0x91/0x1e80 arch/x86/kernel/signal.c:816
exit_to_usermode_loop+0x2f7/0x3b0 arch/x86/entry/common.c:162
prepare_exit_to_usermode+0x32e/0x3b0 arch/x86/entry/common.c:197
retint_user+0x8/0x18
RIP: 0033:0x558fb3c94858
Code: Bad RIP value.
RSP: 002b:00007ffdbd566878 EFLAGS: 00010202
RAX: 000000001ffff110 RBX: 0000000000000000 RCX: 0000558fb4df5b00
RDX: 0000000000000a00 RSI: 0000000000000000 RDI: 00007ffdbd566910
RBP: 0000558fb3f07c88 R08: 00007ffdbd566950 R09: 0101010101010101
R10: 0000000000000000 R11: 0000000000000246 R12: 0000558fb4df0a70
R13: 0000558fb3f05fb4 R14: 0000000000000028 R15: 0000558fb3f07ca0
The buggy address belongs to the object at ffff88809735a180
which belongs to the cache of size -1
The buggy address is located 2113 bytes to the right of
-1-byte region [ffff88809735a180, ffff88809735a17f)
The buggy address belongs to the page:
page:ffffea00025cd680 count:1 mapcount:0 mapping:ffff8880aa16ac40 index:0xffff88809735affd
flags: 0x1fffc0000000200(slab)
raw: 01fffc0000000200 ffffea00023a87c8 ffffea00025cd5c8 ffff8880aa16ac40
raw: ffff88809735affd ffff88809735a180 0000000100000003 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88809735a880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88809735a900: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
>ffff88809735a980: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
^
ffff88809735aa00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88809735aa80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
==================================================================