Warning: Permanently added '10.128.0.108' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 50.086467][ T5058] ================================================================== [ 50.094571][ T5058] BUG: KASAN: use-after-free in io_worker_get+0x77/0x2a0 [ 50.096918][ T5062] ------------[ cut here ]------------ [ 50.101689][ T5058] Read of size 4 at addr ffff888028085c00 by task syz-executor161/5058 [ 50.101706][ T5058] [ 50.101711][ T5058] CPU: 0 PID: 5058 Comm: syz-executor161 Not tainted 6.2.0-rc2-syzkaller-00256-ga689b938df39 #0 [ 50.101728][ T5058] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 50.101736][ T5058] Call Trace: [ 50.101741][ T5058] [ 50.101748][ T5058] dump_stack_lvl+0x1e3/0x2d0 [ 50.101776][ T5058] ? nf_tcp_handle_invalid+0x630/0x630 [ 50.107250][ T5062] refcount_t: underflow; use-after-free. [ 50.115855][ T5058] ? __wake_up_klogd+0xcd/0x100 [ 50.115878][ T5058] ? panic+0x770/0x770 [ 50.115896][ T5058] ? _printk+0xcf/0x110 [ 50.115914][ T5058] print_address_description+0x74/0x340 [ 50.115936][ T5058] print_report+0x107/0x220 [ 50.120563][ T5062] WARNING: CPU: 1 PID: 5062 at lib/refcount.c:28 refcount_warn_saturate+0x15b/0x1a0 [ 50.128879][ T5058] ? do_raw_spin_unlock+0x134/0x8a0 [ 50.128903][ T5058] ? __virt_addr_valid+0x21b/0x2d0 [ 50.128922][ T5058] ? __phys_addr+0xb5/0x160 [ 50.128940][ T5058] ? io_worker_get+0x77/0x2a0 [ 50.128953][ T5058] kasan_report+0x139/0x170 [ 50.128974][ T5058] ? io_worker_get+0x77/0x2a0 [ 50.139872][ T5062] Modules linked in: [ 50.142384][ T5058] kasan_check_range+0x2a7/0x2e0 [ 50.142410][ T5058] io_worker_get+0x77/0x2a0 [ 50.142425][ T5058] ? create_worker_cb+0x330/0x330 [ 50.142439][ T5058] ? io_wq_put_and_exit+0x137/0xcb0 [ 50.142451][ T5058] ? __kmem_cache_free+0x71/0x110 [ 50.146093][ T5062] [ 50.150019][ T5058] io_wq_put_and_exit+0x2f8/0xcb0 [ 50.155945][ T5062] CPU: 1 PID: 5062 Comm: iou-wrk-5058 Not tainted 6.2.0-rc2-syzkaller-00256-ga689b938df39 #0 [ 50.161144][ T5058] ? xa_find+0x410/0x410 [ 50.166285][ T5062] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 50.170026][ T5058] ? io_wq_exit_start+0x20/0x20 [ 50.174497][ T5062] RIP: 0010:refcount_warn_saturate+0x15b/0x1a0 [ 50.179672][ T5058] ? io_uring_clean_tctx+0x106/0x1d0 [ 50.301528][ T5058] ? __kmem_cache_free+0x71/0x110 [ 50.306553][ T5058] io_uring_clean_tctx+0x164/0x1d0 [ 50.311669][ T5058] ? io_uring_del_tctx_node+0x2b0/0x2b0 [ 50.317297][ T5058] ? io_uring_drop_tctx_refs+0x11b/0x1b0 [ 50.323618][ T5058] io_uring_cancel_generic+0x60e/0x670 [ 50.329101][ T5058] ? io_uring_drop_tctx_refs+0x1b0/0x1b0 [ 50.334741][ T5058] ? wake_bit_function+0x240/0x240 [ 50.339945][ T5058] ? print_irqtrace_events+0x220/0x220 [ 50.345408][ T5058] ? do_exit+0x2150/0x2150 [ 50.349839][ T5058] do_exit+0x2ad/0x2150 [ 50.353996][ T5058] ? mm_update_next_owner+0x6d0/0x6d0 [ 50.359364][ T5058] ? _raw_spin_unlock_irq+0x25/0x40 [ 50.364555][ T5058] do_group_exit+0x1fd/0x2b0 [ 50.369142][ T5058] __x64_sys_exit_group+0x3b/0x40 [ 50.374160][ T5058] do_syscall_64+0x2b/0x70 [ 50.378681][ T5058] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 50.384741][ T5058] RIP: 0033:0x7f43fd8b3ce9 [ 50.389146][ T5058] Code: 00 49 c7 c0 c0 ff ff ff be e7 00 00 00 ba 3c 00 00 00 eb 12 0f 1f 44 00 00 89 d0 0f 05 48 3d 00 f0 ff ff 77 1c f4 89 f0 0f 05 <48> 3d 00 f0 ff ff 76 e7 f7 d8 64 41 89 00 eb df 0f 1f 80 00 00 00 [ 50.409371][ T5058] RSP: 002b:00007fffe594c5b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 50.417799][ T5058] RAX: ffffffffffffffda RBX: 00007f43fd929350 RCX: 00007f43fd8b3ce9 [ 50.425766][ T5058] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 [ 50.434617][ T5058] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000000000000 [ 50.442685][ T5058] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f43fd929350 [ 50.450673][ T5058] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001 [ 50.458644][ T5058] [ 50.461652][ T5058] [ 50.463961][ T5058] Allocated by task 5058: [ 50.468416][ T5058] kasan_set_track+0x4c/0x70 [ 50.473014][ T5058] __kasan_kmalloc+0x97/0xb0 [ 50.477619][ T5058] create_io_worker+0xef/0x630 [ 50.482396][ T5058] create_worker_cb+0x16b/0x330 [ 50.487335][ T5058] task_work_run+0x243/0x300 [ 50.491923][ T5058] get_signal+0x1654/0x1820 [ 50.496427][ T5058] arch_do_signal_or_restart+0x8d/0x5f0 [ 50.501963][ T5058] exit_to_user_mode_loop+0x74/0x160 [ 50.507322][ T5058] exit_to_user_mode_prepare+0xad/0x110 [ 50.512945][ T5058] irqentry_exit_to_user_mode+0x5/0x30 [ 50.518396][ T5058] exc_page_fault+0xa2/0x120 [ 50.523146][ T5058] asm_exc_page_fault+0x22/0x30 [ 50.527986][ T5058] [ 50.530297][ T5058] Freed by task 5058: [ 50.534259][ T5058] kasan_set_track+0x4c/0x70 [ 50.538863][ T5058] kasan_save_free_info+0x27/0x40 [ 50.543894][ T5058] ____kasan_slab_free+0xd6/0x120 [ 50.548924][ T5058] slab_free_freelist_hook+0x12e/0x1a0 [ 50.554374][ T5058] __kmem_cache_free+0x71/0x110 [ 50.559219][ T5058] io_wq_put_and_exit+0x137/0xcb0 [ 50.564237][ T5058] io_uring_clean_tctx+0x164/0x1d0 [ 50.569516][ T5058] io_uring_cancel_generic+0x60e/0x670 [ 50.574970][ T5058] do_exit+0x2ad/0x2150 [ 50.579139][ T5058] do_group_exit+0x1fd/0x2b0 [ 50.583722][ T5058] __x64_sys_exit_group+0x3b/0x40 [ 50.588829][ T5058] do_syscall_64+0x2b/0x70 [ 50.593319][ T5058] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 50.599204][ T5058] [ 50.602296][ T5058] Last potentially related work creation: [ 50.607996][ T5058] kasan_save_stack+0x3b/0x60 [ 50.612662][ T5058] __kasan_record_aux_stack+0xb0/0xc0 [ 50.618027][ T5058] task_work_add+0x87/0x340 [ 50.622521][ T5058] io_queue_worker_create+0x1e2/0x430 [ 50.628311][ T5058] schedule+0x63/0x190 [ 50.632372][ T5058] schedule_timeout+0xac/0x300 [ 50.637130][ T5058] wait_woken+0xca/0x1b0 [ 50.641360][ T5058] af_alg_wait_for_data+0x458/0x700 [ 50.646551][ T5058] skcipher_recvmsg+0x2d9/0xea0 [ 50.651393][ T5058] sock_read_iter+0x3fa/0x530 [ 50.656063][ T5058] io_read+0x4a8/0x1310 [ 50.660220][ T5058] io_issue_sqe+0x44e/0xcd0 [ 50.664714][ T5058] io_wq_submit_work+0x44a/0x9c0 [ 50.669645][ T5058] io_worker_handle_work+0x8e1/0xee0 [ 50.675178][ T5058] io_wqe_worker+0x36c/0xde0 [ 50.679758][ T5058] ret_from_fork+0x1f/0x30 [ 50.684181][ T5058] [ 50.686509][ T5058] The buggy address belongs to the object at ffff888028085c00 [ 50.686509][ T5058] which belongs to the cache kmalloc-512 of size 512 [ 50.700574][ T5058] The buggy address is located 0 bytes inside of [ 50.700574][ T5058] 512-byte region [ffff888028085c00, ffff888028085e00) [ 50.713667][ T5058] [ 50.715988][ T5058] The buggy address belongs to the physical page: [ 50.722390][ T5058] page:ffffea0000a02100 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x28084 [ 50.732783][ T5058] head:ffffea0000a02100 order:2 compound_mapcount:0 subpages_mapcount:0 compound_pincount:0 [ 50.742829][ T5058] anon flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 50.751250][ T5058] raw: 00fff00000010200 ffff888012841c80 0000000000000000 dead000000000001 [ 50.759849][ T5058] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 50.768427][ T5058] page dumped because: kasan: bad access detected [ 50.774826][ T5058] page_owner tracks the page as allocated [ 50.780546][ T5058] page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 9757639976, free_ts 0 [ 50.800175][ T5058] get_page_from_freelist+0x72b/0x7a0 [ 50.805550][ T5058] __alloc_pages+0x259/0x560 [ 50.810133][ T5058] alloc_page_interleave+0x22/0x1c0 [ 50.815490][ T5058] alloc_slab_page+0xbd/0x190 [ 50.820156][ T5058] allocate_slab+0x5e/0x3c0 [ 50.824642][ T5058] ___slab_alloc+0x7f4/0xeb0 [ 50.829477][ T5058] __kmem_cache_alloc_node+0x25b/0x340 [ 50.835005][ T5058] kmalloc_trace+0x26/0x60 [ 50.839495][ T5058] device_add+0xb6/0xf90 [ 50.843723][ T5058] netdev_register_kobject+0x178/0x310 [ 50.849168][ T5058] register_netdevice+0x136c/0x1a30 [ 50.854386][ T5058] register_netdev+0x37/0x50 [ 50.858966][ T5058] rose_proto_init+0x197/0x7c0 [ 50.863729][ T5058] do_one_initcall+0xbd/0x2c0 [ 50.868393][ T5058] do_initcall_level+0x168/0x220 [ 50.873333][ T5058] do_initcalls+0x43/0x90 [ 50.877650][ T5058] page_owner free stack trace missing [ 50.883001][ T5058] [ 50.885307][ T5058] Memory state around the buggy address: [ 50.890920][ T5058] ffff888028085b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 50.898965][ T5058] ffff888028085b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 50.907032][ T5058] >ffff888028085c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 50.915088][ T5058] ^ [ 50.919147][ T5058] ffff888028085c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 50.927195][ T5058] ffff888028085d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 50.935240][ T5058] ================================================================== [ 50.949649][ T5062] Code: c7 80 32 69 8b 31 c0 e8 93 c0 10 fd 0f 0b eb 85 e8 fa 6d 4a fd c6 05 4a f9 58 0a 01 48 c7 c7 e0 32 69 8b 31 c0 e8 75 c0 10 fd <0f> 0b e9 64 ff ff ff e8 d9 6d 4a fd c6 05 2a f9 58 0a 01 48 c7 c7 [ 50.951325][ T5058] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 50.951336][ T5058] CPU: 1 PID: 5058 Comm: syz-executor161 Not tainted 6.2.0-rc2-syzkaller-00256-ga689b938df39 #0 [ 50.951353][ T5058] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 [ 50.951361][ T5058] Call Trace: [ 50.951367][ T5058] [ 50.951372][ T5058] dump_stack_lvl+0x1e3/0x2d0 [ 50.951395][ T5058] ? nf_tcp_handle_invalid+0x630/0x630 [ 50.951410][ T5058] ? panic+0x770/0x770 [ 50.951428][ T5058] ? preempt_schedule_common+0xb7/0xe0 [ 50.951447][ T5058] ? vscnprintf+0x59/0x80 [ 50.951468][ T5058] panic+0x316/0x770 [ 50.951487][ T5058] ? check_panic_on_warn+0x1d/0xa0 [ 50.951505][ T5058] ? memcpy_page_flushcache+0x100/0x100 [ 50.951525][ T5058] ? _raw_spin_unlock_irqrestore+0x128/0x130 [ 50.951545][ T5058] ? _raw_spin_unlock+0x40/0x40 [ 50.951563][ T5058] ? print_report+0x1e0/0x220 [ 50.951586][ T5058] check_panic_on_warn+0x80/0xa0 [ 50.951603][ T5058] ? io_worker_get+0x77/0x2a0 [ 50.951617][ T5058] end_report+0x47/0x90 [ 50.951635][ T5058] kasan_report+0x146/0x170 [ 50.951654][ T5058] ? io_worker_get+0x77/0x2a0 [ 50.951670][ T5058] kasan_check_range+0x2a7/0x2e0 [ 50.951690][ T5058] io_worker_get+0x77/0x2a0 [ 50.951704][ T5058] ? create_worker_cb+0x330/0x330 [ 50.951717][ T5058] ? io_wq_put_and_exit+0x137/0xcb0 [ 50.951731][ T5058] ? __kmem_cache_free+0x71/0x110 [ 50.951747][ T5058] io_wq_put_and_exit+0x2f8/0xcb0 [ 50.951764][ T5058] ? xa_find+0x410/0x410 [ 50.951778][ T5058] ? io_wq_exit_start+0x20/0x20 [ 50.951801][ T5058] ? io_uring_clean_tctx+0x106/0x1d0 [ 50.951821][ T5058] ? __kmem_cache_free+0x71/0x110 [ 50.951838][ T5058] io_uring_clean_tctx+0x164/0x1d0 [ 50.951860][ T5058] ? io_uring_del_tctx_node+0x2b0/0x2b0 [ 50.951883][ T5058] ? io_uring_drop_tctx_refs+0x11b/0x1b0 [ 50.951904][ T5058] io_uring_cancel_generic+0x60e/0x670 [ 50.951928][ T5058] ? io_uring_drop_tctx_refs+0x1b0/0x1b0 [ 50.951948][ T5058] ? wake_bit_function+0x240/0x240 [ 50.951966][ T5058] ? print_irqtrace_events+0x220/0x220 [ 50.951982][ T5058] ? do_exit+0x2150/0x2150 [ 50.952006][ T5058] do_exit+0x2ad/0x2150 [ 50.952032][ T5058] ? mm_update_next_owner+0x6d0/0x6d0 [ 50.952056][ T5058] ? _raw_spin_unlock_irq+0x25/0x40 [ 50.952077][ T5058] do_group_exit+0x1fd/0x2b0 [ 50.952099][ T5058] __x64_sys_exit_group+0x3b/0x40 [ 50.952121][ T5058] do_syscall_64+0x2b/0x70 [ 50.952134][ T5058] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 50.952158][ T5058] RIP: 0033:0x7f43fd8b3ce9 [ 50.952172][ T5058] Code: 00 49 c7 c0 c0 ff ff ff be e7 00 00 00 ba 3c 00 00 00 eb 12 0f 1f 44 00 00 89 d0 0f 05 48 3d 00 f0 ff ff 77 1c f4 89 f0 0f 05 <48> 3d 00 f0 ff ff 76 e7 f7 d8 64 41 89 00 eb df 0f 1f 80 00 00 00 [ 50.952183][ T5058] RSP: 002b:00007fffe594c5b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 50.952200][ T5058] RAX: ffffffffffffffda RBX: 00007f43fd929350 RCX: 00007f43fd8b3ce9 [ 50.952211][ T5058] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 [ 50.952220][ T5058] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000000000000 [ 50.952230][ T5058] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f43fd929350 [ 50.952240][ T5058] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001 [ 50.952260][ T5058] [ 50.969428][ T5058] Kernel Offset: disabled [ 51.285433][ T5058] Rebooting in 86400 seconds..