DUID 00:04:f8:bf:f0:9c:61:e1:97:95:98:d7:6e:33:ae:fb:a4:bd forked to background, child pid 3181 [ 41.095278][ T3182] 8021q: adding VLAN 0 to HW filter on device bond0 [ 41.109085][ T3182] eql: remember to turn off Van-Jacobson compression on your slave devices Starting sshd: OK syzkaller Warning: Permanently added '10.128.0.42' (ECDSA) to the list of known hosts. syzkaller login: [ 56.819067][ T3595] cgroup: Unknown subsys name 'net' [ 56.963805][ T3595] cgroup: Unknown subsys name 'rlimit' executing program [ 57.133608][ T3598] ================================================================== [ 57.141695][ T3598] BUG: KASAN: use-after-free in __lock_acquire+0x3d86/0x54a0 [ 57.149071][ T3598] Read of size 8 at addr ffff888015be3740 by task syz-executor161/3598 [ 57.157551][ T3598] [ 57.159868][ T3598] CPU: 1 PID: 3598 Comm: syz-executor161 Not tainted 5.16.0-rc4-syzkaller #0 [ 57.168626][ T3598] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 57.178669][ T3598] Call Trace: [ 57.181940][ T3598] <TASK> [ 57.184858][ T3598] dump_stack_lvl+0xcd/0x134 [ 57.189454][ T3598] print_address_description.constprop.0.cold+0x8d/0x320 [ 57.196473][ T3598] ? __lock_acquire+0x3d86/0x54a0 [ 57.201490][ T3598] ? __lock_acquire+0x3d86/0x54a0 [ 57.206516][ T3598] kasan_report.cold+0x83/0xdf [ 57.211297][ T3598] ? __lock_acquire+0x3d86/0x54a0 [ 57.216314][ T3598] __lock_acquire+0x3d86/0x54a0 [ 57.221165][ T3598] ? __lock_acquire+0xbc2/0x54a0 [ 57.226097][ T3598] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 57.232073][ T3598] lock_acquire+0x1ab/0x510 [ 57.236570][ T3598] ? remove_wait_queue+0x1d/0x180 [ 57.241586][ T3598] ? lock_release+0x720/0x720 [ 57.246250][ T3598] ? lock_release+0x720/0x720 [ 57.250912][ T3598] ? _raw_spin_lock_irqsave+0x4e/0x50 [ 57.256281][ T3598] _raw_spin_lock_irqsave+0x39/0x50 [ 57.261463][ T3598] ? remove_wait_queue+0x1d/0x180 [ 57.266474][ T3598] remove_wait_queue+0x1d/0x180 [ 57.271320][ T3598] ep_remove_wait_queue+0x88/0x1a0 [ 57.276425][ T3598] ep_remove+0x106/0x9c0 [ 57.280652][ T3598] eventpoll_release_file+0xe1/0x130 [ 57.285977][ T3598] __fput+0x87b/0x9f0 [ 57.289944][ T3598] task_work_run+0xdd/0x1a0 [ 57.294429][ T3598] exit_to_user_mode_prepare+0x27e/0x290 [ 57.300052][ T3598] syscall_exit_to_user_mode+0x19/0x60 [ 57.305494][ T3598] do_syscall_64+0x42/0xb0 [ 57.309899][ T3598] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 57.315780][ T3598] RIP: 0033:0x7f3167c0def3 [ 57.320182][ T3598] Code: c7 c2 c0 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb ba 0f 1f 00 64 8b 04 25 18 00 00 00 85 c0 75 14 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 [ 57.339786][ T3598] RSP: 002b:00007ffddef2e488 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 57.348180][ T3598] RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00007f3167c0def3 [ 57.356220][ T3598] RDX: 000000000000002f RSI: 0000000020001340 RDI: 0000000000000004 [ 57.364173][ T3598] RBP: 0000000000000000 R08: 0000000000000014 R09: 00007ffddef2e4b0 [ 57.372128][ T3598] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffddef2e4ac [ 57.380080][ T3598] R13: 00007ffddef2e4c0 R14: 00007ffddef2e500 R15: 0000000000000000 [ 57.388039][ T3598] </TASK> [ 57.391048][ T3598] [ 57.393351][ T3598] Allocated by task 3598: [ 57.397650][ T3598] kasan_save_stack+0x1e/0x50 [ 57.402327][ T3598] __kasan_kmalloc+0xa9/0xd0 [ 57.406904][ T3598] psi_trigger_create.part.0+0x15e/0x7f0 [ 57.412521][ T3598] cgroup_pressure_write+0x15d/0x6b0 [ 57.417786][ T3598] cgroup_file_write+0x1ec/0x780 [ 57.422703][ T3598] kernfs_fop_write_iter+0x342/0x500 [ 57.427970][ T3598] new_sync_write+0x429/0x660 [ 57.432733][ T3598] vfs_write+0x7cd/0xae0 [ 57.436958][ T3598] ksys_write+0x12d/0x250 [ 57.441274][ T3598] do_syscall_64+0x35/0xb0 [ 57.445696][ T3598] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 57.451568][ T3598] [ 57.453871][ T3598] Freed by task 3598: [ 57.457824][ T3598] kasan_save_stack+0x1e/0x50 [ 57.462574][ T3598] kasan_set_track+0x21/0x30 [ 57.467146][ T3598] kasan_set_free_info+0x20/0x30 [ 57.472062][ T3598] __kasan_slab_free+0xff/0x130 [ 57.477067][ T3598] slab_free_freelist_hook+0x8b/0x1c0 [ 57.482509][ T3598] kfree+0xf6/0x560 [ 57.486303][ T3598] cgroup_pressure_write+0x18d/0x6b0 [ 57.491571][ T3598] cgroup_file_write+0x1ec/0x780 [ 57.496488][ T3598] kernfs_fop_write_iter+0x342/0x500 [ 57.501755][ T3598] new_sync_write+0x429/0x660 [ 57.506418][ T3598] vfs_write+0x7cd/0xae0 [ 57.510645][ T3598] ksys_write+0x12d/0x250 [ 57.514955][ T3598] do_syscall_64+0x35/0xb0 [ 57.519350][ T3598] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 57.525221][ T3598] [ 57.527522][ T3598] The buggy address belongs to the object at ffff888015be3700 [ 57.527522][ T3598] which belongs to the cache kmalloc-192 of size 192 [ 57.541560][ T3598] The buggy address is located 64 bytes inside of [ 57.541560][ T3598] 192-byte region [ffff888015be3700, ffff888015be37c0) [ 57.554905][ T3598] The buggy address belongs to the page: [ 57.560515][ T3598] page:ffffea000056f8c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x15be3 [ 57.570647][ T3598] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) [ 57.578183][ T3598] raw: 00fff00000000200 0000000000000000 dead000000000001 ffff888010c41a00 [ 57.586756][ T3598] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 57.595318][ T3598] page dumped because: kasan: bad access detected [ 57.601730][ T3598] page_owner tracks the page as allocated [ 57.607419][ T3598] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, ts 1983850449, free_ts 0 [ 57.622264][ T3598] get_page_from_freelist+0xa72/0x2f50 [ 57.627711][ T3598] __alloc_pages+0x1b2/0x500 [ 57.632281][ T3598] alloc_page_interleave+0x1e/0x200 [ 57.637466][ T3598] alloc_pages+0x29f/0x300 [ 57.641864][ T3598] new_slab+0x32d/0x4a0 [ 57.646001][ T3598] ___slab_alloc+0x918/0xfe0 [ 57.650746][ T3598] __slab_alloc.constprop.0+0x4d/0xa0 [ 57.656101][ T3598] kmem_cache_alloc_trace+0x289/0x2c0 [ 57.661457][ T3598] call_usermodehelper_setup+0x97/0x340 [ 57.666984][ T3598] kobject_uevent_env+0xf73/0x1650 [ 57.672081][ T3598] param_sysfs_init+0x146/0x43b [ 57.676936][ T3598] do_one_initcall+0x103/0x650 [ 57.681682][ T3598] kernel_init_freeable+0x6b1/0x73a [ 57.687033][ T3598] kernel_init+0x1a/0x1d0 [ 57.691349][ T3598] ret_from_fork+0x1f/0x30 [ 57.695755][ T3598] page_owner free stack trace missing [ 57.701105][ T3598] [ 57.703536][ T3598] Memory state around the buggy address: [ 57.709152][ T3598] ffff888015be3600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 57.717188][ T3598] ffff888015be3680: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc [ 57.725225][ T3598] >ffff888015be3700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 57.733271][ T3598] ^ [ 57.739596][ T3598] ffff888015be3780: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 57.747651][ T3598] ffff888015be3800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 57.755707][ T3598] ================================================================== [ 57.763749][ T3598] Disabling lock debugging due to kernel taint [ 57.769881][ T3598] Kernel panic - not syncing: panic_on_warn set ... [ 57.776442][ T3598] CPU: 1 PID: 3598 Comm: syz-executor161 Tainted: G B 5.16.0-rc4-syzkaller #0 [ 57.786577][ T3598] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 57.796628][ T3598] Call Trace: [ 57.799894][ T3598] <TASK> [ 57.802812][ T3598] dump_stack_lvl+0xcd/0x134 [ 57.807389][ T3598] panic+0x2b0/0x6dd [ 57.811268][ T3598] ? __warn_printk+0xf3/0xf3 [ 57.815840][ T3598] ? __lock_acquire+0x3d86/0x54a0 [ 57.820849][ T3598] ? __lock_acquire+0x3d86/0x54a0 [ 57.825860][ T3598] ? __lock_acquire+0x3d86/0x54a0 [ 57.830870][ T3598] end_report.cold+0x63/0x6f [ 57.835801][ T3598] kasan_report.cold+0x71/0xdf [ 57.840544][ T3598] ? __lock_acquire+0x3d86/0x54a0 [ 57.845556][ T3598] __lock_acquire+0x3d86/0x54a0 [ 57.850391][ T3598] ? __lock_acquire+0xbc2/0x54a0 [ 57.855318][ T3598] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 57.861288][ T3598] lock_acquire+0x1ab/0x510 [ 57.865781][ T3598] ? remove_wait_queue+0x1d/0x180 [ 57.870786][ T3598] ? lock_release+0x720/0x720 [ 57.875455][ T3598] ? lock_release+0x720/0x720 [ 57.880122][ T3598] ? _raw_spin_lock_irqsave+0x4e/0x50 [ 57.885476][ T3598] _raw_spin_lock_irqsave+0x39/0x50 [ 57.890659][ T3598] ? remove_wait_queue+0x1d/0x180 [ 57.895664][ T3598] remove_wait_queue+0x1d/0x180 [ 57.900598][ T3598] ep_remove_wait_queue+0x88/0x1a0 [ 57.905714][ T3598] ep_remove+0x106/0x9c0 [ 57.909938][ T3598] eventpoll_release_file+0xe1/0x130 [ 57.915205][ T3598] __fput+0x87b/0x9f0 [ 57.919174][ T3598] task_work_run+0xdd/0x1a0 [ 57.923678][ T3598] exit_to_user_mode_prepare+0x27e/0x290 [ 57.929297][ T3598] syscall_exit_to_user_mode+0x19/0x60 [ 57.934744][ T3598] do_syscall_64+0x42/0xb0 [ 57.939142][ T3598] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 57.945019][ T3598] RIP: 0033:0x7f3167c0def3 [ 57.949421][ T3598] Code: c7 c2 c0 ff ff ff f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb ba 0f 1f 00 64 8b 04 25 18 00 00 00 85 c0 75 14 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 [ 57.969092][ T3598] RSP: 002b:00007ffddef2e488 EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 57.977587][ T3598] RAX: 0000000000000000 RBX: 0000000000000005 RCX: 00007f3167c0def3 [ 57.985548][ T3598] RDX: 000000000000002f RSI: 0000000020001340 RDI: 0000000000000004 [ 57.993502][ T3598] RBP: 0000000000000000 R08: 0000000000000014 R09: 00007ffddef2e4b0 [ 58.001457][ T3598] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffddef2e4ac [ 58.009427][ T3598] R13: 00007ffddef2e4c0 R14: 00007ffddef2e500 R15: 0000000000000000 [ 58.017385][ T3598] </TASK> [ 58.020633][ T3598] Kernel Offset: disabled [ 58.024999][ T3598] Rebooting in 86400 seconds..