==================================================================
BUG: KASAN: use-after-free in __hlist_del include/linux/list.h:829 [inline]
BUG: KASAN: use-after-free in hlist_del_init include/linux/list.h:857 [inline]
BUG: KASAN: use-after-free in dentry_unlink_inode+0x3c0/0x3d0 fs/dcache.c:365
Write of size 8 at addr ffff888200000000 by task syz-executor.1/6973
CPU: 1 PID: 6973 Comm: syz-executor.1 Not tainted 5.9.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x198/0x1fd lib/dump_stack.c:118
print_address_description.constprop.0.cold+0xae/0x497 mm/kasan/report.c:383
__kasan_report mm/kasan/report.c:513 [inline]
kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530
__hlist_del include/linux/list.h:829 [inline]
hlist_del_init include/linux/list.h:857 [inline]
dentry_unlink_inode+0x3c0/0x3d0 fs/dcache.c:365
__dentry_kill+0x3c0/0x640 fs/dcache.c:579
shrink_dentry_list+0x144/0x480 fs/dcache.c:1141
shrink_dcache_parent+0x219/0x3c0 fs/dcache.c:1568
d_invalidate fs/dcache.c:1677 [inline]
d_invalidate+0x13f/0x280 fs/dcache.c:1662
proc_invalidate_siblings_dcache+0x43b/0x600 fs/proc/inode.c:150
release_task+0xc63/0x14d0 kernel/exit.c:221
wait_task_zombie kernel/exit.c:1088 [inline]
wait_consider_task+0x2fd2/0x3b70 kernel/exit.c:1315
do_wait_thread kernel/exit.c:1378 [inline]
do_wait+0x376/0xa00 kernel/exit.c:1449
kernel_wait4+0x14c/0x260 kernel/exit.c:1621
__do_sys_wait4+0x13f/0x150 kernel/exit.c:1649
do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x41723b
Code: 54 55 41 89 d4 53 48 89 f5 89 fb 48 83 ec 10 e8 1b f9 ff ff 45 31 d2 41 89 c0 49 63 d4 48 89 ee 48 63 fb b8 3d 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 19 44 89 c7 89 44 24 0c e8 51 f9 ff ff 8b 44
RSP: 002b:000000000169fd80 EFLAGS: 00000246 ORIG_RAX: 000000000000003d
RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 000000000041723b
RDX: 0000000040000001 RSI: 000000000169fde0 RDI: ffffffffffffffff
RBP: 000000000169fde0 R08: 0000000000000000 R09: 0000000001b34940
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000040000001
R13: 000000000169fde0 R14: 00000000001d8097 R15: 000000000169fdf0
The buggy address belongs to the page:
page:000000007a937d95 refcount:0 mapcount:-128 mapping:0000000000000000 index:0xffff888200000000 pfn:0x200000
flags: 0x57ffe0000000000()
raw: 057ffe0000000000 ffffea0008010008 ffffea0008028008 0000000000000000
raw: ffff888200000000 0000000000000007 00000000ffffff7f 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881ffffff00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881ffffff80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888200000000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888200000080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888200000100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================