Starting Load/Save RF Kill Switch Status... [ 53.444527][ T6728] BUG: using smp_processor_id() in preemptible [00000000] code: systemd-rfkill/6728 [ 53.454123][ T6728] caller is ext4_mb_new_blocks+0xa4d/0x3b70 [ 53.460014][ T6728] CPU: 0 PID: 6728 Comm: systemd-rfkill Not tainted 5.7.0-next-20200612-syzkaller #0 [ 53.469448][ T6728] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 53.479495][ T6728] Call Trace: [ 53.482860][ T6728] dump_stack+0x18f/0x20d [ 53.487172][ T6728] check_preemption_disabled+0x20d/0x220 [ 53.492783][ T6728] ext4_mb_new_blocks+0xa4d/0x3b70 [ 53.498188][ T6728] ? ext4_ext_search_right+0x2ca/0xb20 [ 53.503643][ T6728] ? ext4_inode_to_goal_block+0x2df/0x3f0 [ 53.509374][ T6728] ext4_ext_map_blocks+0x201b/0x33e0 [ 53.514660][ T6728] ? ext4_ext_release+0x10/0x10 [ 53.519513][ T6728] ? down_write_killable+0x170/0x170 [ 53.524802][ T6728] ? ext4_es_lookup_extent+0x41d/0xd10 [ 53.530251][ T6728] ext4_map_blocks+0x4cb/0x1640 [ 53.535189][ T6728] ? ext4_issue_zeroout+0x1e0/0x1e0 [ 53.540385][ T6728] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 53.545911][ T6728] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 53.552152][ T6728] ? prandom_u32_state+0xe/0x170 [ 53.557070][ T6728] ? __brelse+0x84/0xa0 [ 53.561208][ T6728] ? __ext4_new_inode+0x144/0x55e0 [ 53.566324][ T6728] ext4_getblk+0xad/0x520 [ 53.570653][ T6728] ? ext4_iomap_overwrite_begin+0xa0/0xa0 [ 53.576447][ T6728] ? ext4_free_inode+0x1700/0x1700 [ 53.581542][ T6728] ext4_bread+0x7c/0x380 [ 53.585768][ T6728] ? ext4_getblk+0x520/0x520 [ 53.590356][ T6728] ? dquot_get_next_dqblk+0x180/0x180 [ 53.595720][ T6728] ext4_append+0x153/0x360 [ 53.600119][ T6728] ext4_mkdir+0x5e0/0xdf0 [ 53.604459][ T6728] ? ext4_rmdir+0xde0/0xde0 [ 53.608941][ T6728] ? security_inode_permission+0xc4/0xf0 [ 53.614558][ T6728] vfs_mkdir+0x419/0x690 [ 53.618789][ T6728] do_mkdirat+0x21e/0x280 [ 53.623097][ T6728] ? __ia32_sys_mknod+0xb0/0xb0 [ 53.627928][ T6728] ? do_syscall_64+0x1c/0xe0 [ 53.632497][ T6728] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 53.638456][ T6728] do_syscall_64+0x60/0xe0 [ 53.642865][ T6728] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 53.648907][ T6728] RIP: 0033:0x7fd9a5f32687 [ 53.653320][ T6728] Code: Bad RIP value. [ 53.657378][ T6728] RSP: 002b:00007ffc4fa1c4f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 [ 53.665784][ T6728] RAX: ffffffffffffffda RBX: 000055a3596a9985 RCX: 00007fd9a5f32687 [ 53.673736][ T6728] RDX: 00007ffc4fa1c3c0 RSI: 00000000000001ed RDI: 000055a3596a9985 [ 53.681701][ T6728] RBP: 00007fd9a5f32680 R08: 0000000000000100 R09: 0000000000000000 [ 53.689667][ T6728] R10: 000055a3596a9980 R11: 0000000000000246 R12: 00000000000001ed [ 53.697719][ T6728] R13: 00007ffc4fa1c680 R14: 0000000000000000 R15: 0000000000000000 [ OK ] Started Load/Save RF Kill Switch Status. Debian GNU/Linux 9 syzkaller ttyS0 Warning: Permanently added '10.128.0.48' (ECDSA) to the list of known hosts. 2020/06/13 04:31:07 fuzzer started 2020/06/13 04:31:07 connecting to host at 10.128.0.26:34261 2020/06/13 04:31:07 checking machine... 2020/06/13 04:31:07 checking revisions... 2020/06/13 04:31:07 testing simple program... syzkaller login: [ 58.594003][ T6798] BUG: using smp_processor_id() in preemptible [00000000] code: syz-fuzzer/6798 [ 58.603355][ T6798] caller is ext4_mb_new_blocks+0xa4d/0x3b70 [ 58.612016][ T6798] CPU: 0 PID: 6798 Comm: syz-fuzzer Not tainted 5.7.0-next-20200612-syzkaller #0 [ 58.621138][ T6798] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 58.631195][ T6798] Call Trace: [ 58.634492][ T6798] dump_stack+0x18f/0x20d [ 58.638806][ T6798] check_preemption_disabled+0x20d/0x220 [ 58.644683][ T6798] ext4_mb_new_blocks+0xa4d/0x3b70 [ 58.649798][ T6798] ? ext4_ext_search_right+0x2ca/0xb20 [ 58.655236][ T6798] ? ext4_inode_to_goal_block+0x2df/0x3f0 [ 58.660949][ T6798] ext4_ext_map_blocks+0x201b/0x33e0 [ 58.666318][ T6798] ? ext4_ext_release+0x10/0x10 [ 58.671182][ T6798] ? down_write_killable+0x170/0x170 [ 58.676666][ T6798] ? ext4_es_lookup_extent+0x41d/0xd10 [ 58.682118][ T6798] ext4_map_blocks+0x4cb/0x1640 [ 58.686968][ T6798] ? ext4_issue_zeroout+0x1e0/0x1e0 [ 58.692147][ T6798] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 58.697703][ T6798] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 58.703674][ T6798] ? prandom_u32_state+0xe/0x170 [ 58.708611][ T6798] ? __brelse+0x84/0xa0 [ 58.712760][ T6798] ? __ext4_new_inode+0x144/0x55e0 [ 58.717869][ T6798] ext4_getblk+0xad/0x520 [ 58.722192][ T6798] ? ext4_iomap_overwrite_begin+0xa0/0xa0 [ 58.727894][ T6798] ? ext4_free_inode+0x1700/0x1700 [ 58.732981][ T6798] ext4_bread+0x7c/0x380 [ 58.737217][ T6798] ? ext4_getblk+0x520/0x520 [ 58.741799][ T6798] ? dquot_get_next_dqblk+0x180/0x180 [ 58.747169][ T6798] ext4_append+0x153/0x360 [ 58.751572][ T6798] ext4_mkdir+0x5e0/0xdf0 [ 58.755898][ T6798] ? ext4_rmdir+0xde0/0xde0 [ 58.760393][ T6798] ? security_inode_permission+0xc4/0xf0 [ 58.766008][ T6798] vfs_mkdir+0x419/0x690 [ 58.770235][ T6798] do_mkdirat+0x21e/0x280 [ 58.774543][ T6798] ? __ia32_sys_mknod+0xb0/0xb0 [ 58.779377][ T6798] ? do_syscall_64+0x1c/0xe0 [ 58.783945][ T6798] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 58.789903][ T6798] do_syscall_64+0x60/0xe0 [ 58.794297][ T6798] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 58.800175][ T6798] RIP: 0033:0x4b02a0 [ 58.804129][ T6798] Code: Bad RIP value. [ 58.808168][ T6798] RSP: 002b:000000c0003c94b8 EFLAGS: 00000212 ORIG_RAX: 0000000000000102 [ 58.816569][ T6798] RAX: ffffffffffffffda RBX: 000000c00002c000 RCX: 00000000004b02a0 [ 58.824536][ T6798] RDX: 00000000000001c0 RSI: 000000c000026ba0 RDI: ffffffffffffff9c [ 58.832485][ T6798] RBP: 000000c0003c9510 R08: 0000000000000000 R09: 0000000000000000 [ 58.840456][ T6798] R10: 0000000000000000 R11: 0000000000000212 R12: ffffffffffffffff [ 58.848419][ T6798] R13: 000000000000005e R14: 000000000000005d R15: 0000000000000100 [ 58.857268][ T38] BUG: using smp_processor_id() in preemptible [00000000] code: kworker/u4:2/38 [ 58.866569][ T38] caller is ext4_mb_new_blocks+0xa4d/0x3b70 [ 58.872481][ T38] CPU: 1 PID: 38 Comm: kworker/u4:2 Not tainted 5.7.0-next-20200612-syzkaller #0 [ 58.881581][ T38] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 58.891733][ T38] Workqueue: writeback wb_workfn (flush-8:0) [ 58.897743][ T38] Call Trace: [ 58.901047][ T38] dump_stack+0x18f/0x20d [ 58.905400][ T38] check_preemption_disabled+0x20d/0x220 [ 58.911052][ T38] ext4_mb_new_blocks+0xa4d/0x3b70 [ 58.912984][ T6803] BUG: using smp_processor_id() in preemptible [00000000] code: syz-executor.0/6803 [ 58.916182][ T38] ? ext4_find_extent+0x81a/0xad0 [ 58.925628][ T6803] caller is ext4_mb_new_blocks+0xa4d/0x3b70 [ 58.931517][ T38] ? ext4_ext_search_right+0x2ca/0xb20 [ 58.942821][ T38] ? ext4_inode_to_goal_block+0x2df/0x3f0 [ 58.948549][ T38] ext4_ext_map_blocks+0x201b/0x33e0 [ 58.953826][ T38] ? ext4_ext_release+0x10/0x10 [ 58.958677][ T38] ? down_write_killable+0x170/0x170 [ 58.963952][ T38] ? ext4_es_lookup_extent+0x41d/0xd10 [ 58.969402][ T38] ext4_map_blocks+0x4cb/0x1640 [ 58.974245][ T38] ? ext4_issue_zeroout+0x1e0/0x1e0 [ 58.979433][ T38] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 58.984963][ T38] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 58.990943][ T38] ? ext4_alloc_io_end_vec+0x145/0x1c0 [ 58.996388][ T38] ext4_writepages+0x1a83/0x33c0 [ 59.001327][ T38] ? __ext4_mark_inode_dirty+0x940/0x940 [ 59.006944][ T38] ? __lock_acquire+0x2224/0x48b0 [ 59.011967][ T38] ? lockdep_hardirqs_on_prepare+0x590/0x590 [ 59.017958][ T38] ? lockdep_hardirqs_on_prepare+0x590/0x590 [ 59.023935][ T38] ? __ext4_mark_inode_dirty+0x940/0x940 [ 59.029550][ T38] ? do_writepages+0xf3/0x2a0 [ 59.034218][ T38] do_writepages+0xf3/0x2a0 [ 59.038715][ T38] ? page_writeback_cpu_online+0x10/0x10 [ 59.044351][ T38] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 59.049881][ T38] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 59.055843][ T38] ? lock_downgrade+0x840/0x840 [ 59.060684][ T38] __writeback_single_inode+0x12a/0x13d0 [ 59.066304][ T38] ? _raw_spin_unlock+0x24/0x40 [ 59.071156][ T38] ? wbc_attach_and_unlock_inode+0x60a/0x9c0 [ 59.077124][ T38] writeback_sb_inodes+0x515/0xdc0 [ 59.082231][ T38] ? __writeback_single_inode+0x13d0/0x13d0 [ 59.088144][ T38] __writeback_inodes_wb+0xc3/0x250 [ 59.093334][ T38] wb_writeback+0x8c8/0xd40 [ 59.097826][ T38] ? writeback_inodes_wb.constprop.0+0x190/0x190 [ 59.104145][ T38] ? cpumask_next+0x3c/0x40 [ 59.108642][ T38] ? get_nr_dirty_inodes+0xd6/0x130 [ 59.115152][ T38] wb_workfn+0xab3/0x1090 [ 59.119471][ T38] ? inode_wait_for_writeback+0x30/0x30 [ 59.125009][ T38] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 59.130539][ T38] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 59.136512][ T38] process_one_work+0x965/0x1690 [ 59.141453][ T38] ? lock_release+0x800/0x800 [ 59.146117][ T38] ? pwq_dec_nr_in_flight+0x310/0x310 [ 59.151474][ T38] ? rwlock_bug.part.0+0x90/0x90 [ 59.156417][ T38] worker_thread+0x96/0xe10 [ 59.160912][ T38] ? process_one_work+0x1690/0x1690 [ 59.166100][ T38] kthread+0x3b5/0x4a0 [ 59.170168][ T38] ? kthread_mod_delayed_work+0x1a0/0x1a0 [ 59.175867][ T38] ? kthread_mod_delayed_work+0x1a0/0x1a0 [ 59.181596][ T38] ret_from_fork+0x1f/0x30 [ 59.186019][ T6803] CPU: 0 PID: 6803 Comm: syz-executor.0 Not tainted 5.7.0-next-20200612-syzkaller #0 [ 59.195654][ T6803] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 59.206667][ T6803] Call Trace: [ 59.209966][ T6803] dump_stack+0x18f/0x20d [ 59.214320][ T6803] check_preemption_disabled+0x20d/0x220 [ 59.219958][ T6803] ext4_mb_new_blocks+0xa4d/0x3b70 [ 59.225779][ T6803] ? ext4_ext_search_right+0x2ca/0xb20 [ 59.231251][ T6803] ? ext4_inode_to_goal_block+0x2df/0x3f0 [ 59.236973][ T6803] ext4_ext_map_blocks+0x201b/0x33e0 [ 59.242272][ T6803] ? ext4_ext_release+0x10/0x10 [ 59.247145][ T6803] ? down_write_killable+0x170/0x170 [ 59.252424][ T6803] ? ext4_es_lookup_extent+0x41d/0xd10 [ 59.257881][ T6803] ext4_map_blocks+0x4cb/0x1640 [ 59.262715][ T6803] ? ext4_issue_zeroout+0x1e0/0x1e0 [ 59.267901][ T6803] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 59.273422][ T6803] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 59.279385][ T6803] ? prandom_u32_state+0xe/0x170 [ 59.284300][ T6803] ? __brelse+0x84/0xa0 [ 59.288429][ T6803] ? __ext4_new_inode+0x144/0x55e0 [ 59.293528][ T6803] ext4_getblk+0xad/0x520 [ 59.297831][ T6803] ? ext4_iomap_overwrite_begin+0xa0/0xa0 [ 59.303527][ T6803] ? ext4_free_inode+0x1700/0x1700 [ 59.308612][ T6803] ext4_bread+0x7c/0x380 [ 59.312914][ T6803] ? ext4_getblk+0x520/0x520 [ 59.317490][ T6803] ? dquot_get_next_dqblk+0x180/0x180 [ 59.322852][ T6803] ext4_append+0x153/0x360 [ 59.327266][ T6803] ext4_mkdir+0x5e0/0xdf0 [ 59.331624][ T6803] ? ext4_rmdir+0xde0/0xde0 [ 59.336178][ T6803] ? security_inode_permission+0xc4/0xf0 [ 59.341793][ T6803] vfs_mkdir+0x419/0x690 [ 59.346049][ T6803] do_mkdirat+0x21e/0x280 [ 59.350355][ T6803] ? __ia32_sys_mknod+0xb0/0xb0 [ 59.355226][ T6803] ? do_syscall_64+0x1c/0xe0 [ 59.359804][ T6803] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 59.365767][ T6803] do_syscall_64+0x60/0xe0 [ 59.370177][ T6803] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 59.376077][ T6803] RIP: 0033:0x45bee7 [ 59.379954][ T6803] Code: Bad RIP value. [ 59.384006][ T6803] RSP: 002b:00007ffe55bf9a88 EFLAGS: 00000246 ORIG_RAX: 0000000000000053 [ 59.392423][ T6803] RAX: ffffffffffffffda RBX: 000000000003a2f8 RCX: 000000000045bee7 [ 59.400378][ T6803] RDX: 0000000000000002 RSI: 00000000000001c0 RDI: 00007ffe55bf9c60 [ 59.408439][ T6803] RBP: 0000000000000001 R08: 000000000000f8c0 R09: 0000000000002b40 [ 59.416399][ T6803] R10: 0000000000000011 R11: 0000000000000246 R12: 00000000000000c2 [ 59.424355][ T6803] R13: 00007ffe55bf9c60 R14: 8421084210842109 R15: 00007ffe55bf9c6c [ 59.513294][ T6804] IPVS: ftp: loaded support on port[0] = 21 [ 59.549175][ T6804] BUG: using smp_processor_id() in preemptible [00000000] code: syz-executor.0/6804 [ 59.558690][ T6804] caller is ext4_mb_new_blocks+0xa4d/0x3b70 [ 59.564659][ T6804] CPU: 1 PID: 6804 Comm: syz-executor.0 Not tainted 5.7.0-next-20200612-syzkaller #0 [ 59.574276][ T6804] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 59.584309][ T6804] Call Trace: [ 59.587581][ T6804] dump_stack+0x18f/0x20d [ 59.591902][ T6804] check_preemption_disabled+0x20d/0x220 [ 59.597602][ T6804] ext4_mb_new_blocks+0xa4d/0x3b70 [ 59.602696][ T6804] ? ext4_ext_search_right+0x2ca/0xb20 [ 59.608131][ T6804] ? ext4_inode_to_goal_block+0x2df/0x3f0 [ 59.613841][ T6804] ext4_ext_map_blocks+0x201b/0x33e0 [ 59.619104][ T6804] ? ext4_ext_release+0x10/0x10 [ 59.623951][ T6804] ? down_write_killable+0x170/0x170 [ 59.629222][ T6804] ? ext4_es_lookup_extent+0x41d/0xd10 [ 59.634679][ T6804] ext4_map_blocks+0x4cb/0x1640 [ 59.640563][ T6804] ? ext4_issue_zeroout+0x1e0/0x1e0 [ 59.645739][ T6804] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 59.651262][ T6804] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 59.657236][ T6804] ? prandom_u32_state+0xe/0x170 [ 59.662164][ T6804] ? __brelse+0x84/0xa0 [ 59.666301][ T6804] ? __ext4_new_inode+0x144/0x55e0 [ 59.671399][ T6804] ext4_getblk+0xad/0x520 [ 59.675708][ T6804] ? ext4_iomap_overwrite_begin+0xa0/0xa0 [ 59.681429][ T6804] ? ext4_free_inode+0x1700/0x1700 [ 59.686529][ T6804] ext4_bread+0x7c/0x380 [ 59.690759][ T6804] ? ext4_getblk+0x520/0x520 [ 59.695325][ T6804] ? dquot_get_next_dqblk+0x180/0x180 [ 59.700674][ T6804] ext4_append+0x153/0x360 [ 59.705072][ T6804] ext4_mkdir+0x5e0/0xdf0 [ 59.709384][ T6804] ? ext4_rmdir+0xde0/0xde0 [ 59.713872][ T6804] ? security_inode_permission+0xc4/0xf0 [ 59.720452][ T6804] vfs_mkdir+0x419/0x690 [ 59.724676][ T6804] do_mkdirat+0x21e/0x280 [ 59.729005][ T6804] ? __ia32_sys_mknod+0xb0/0xb0 [ 59.733835][ T6804] ? do_syscall_64+0x1c/0xe0 [ 59.738400][ T6804] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 59.744359][ T6804] do_syscall_64+0x60/0xe0 [ 59.748771][ T6804] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 59.754676][ T6804] RIP: 0033:0x45bee7 [ 59.758603][ T6804] Code: Bad RIP value. [ 59.762702][ T6804] RSP: 002b:00007ffe55bf9978 EFLAGS: 00000206 ORIG_RAX: 0000000000000053 [ 59.771101][ T6804] RAX: ffffffffffffffda RBX: 000000000078c988 RCX: 000000000045bee7 [ 59.779050][ T6804] RDX: 00007ffe55bf99c3 RSI: 00000000000001ff RDI: 00007ffe55bf99c0 [ 59.787001][ T6804] RBP: 00000000000000f8 R08: 0000000000000000 R09: 0000000000000003 [ 59.794953][ T6804] R10: 0000000000000064 R11: 0000000000000206 R12: 00000000004185d0 [ 59.803450][ T6804] R13: 00007ffe55bf99b0 R14: 0000000000000000 R15: 00007ffe55bf99c0 [ 59.856952][ T6804] BUG: using smp_processor_id() in preemptible [00000000] code: syz-executor.0/6804 [ 59.866612][ T6804] caller is ext4_mb_new_blocks+0xa4d/0x3b70 [ 59.872890][ T6804] CPU: 0 PID: 6804 Comm: syz-executor.0 Not tainted 5.7.0-next-20200612-syzkaller #0 [ 59.882348][ T6804] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 59.892430][ T6804] Call Trace: [ 59.895731][ T6804] dump_stack+0x18f/0x20d [ 59.900111][ T6804] check_preemption_disabled+0x20d/0x220 [ 59.905765][ T6804] ext4_mb_new_blocks+0xa4d/0x3b70 [ 59.910892][ T6804] ? ext4_ext_search_right+0x2ca/0xb20 [ 59.916363][ T6804] ? ext4_inode_to_goal_block+0x2df/0x3f0 [ 59.922105][ T6804] ext4_ext_map_blocks+0x201b/0x33e0 [ 59.927373][ T6804] ? ext4_ext_release+0x10/0x10 [ 59.932261][ T6804] ? down_write_killable+0x170/0x170 [ 59.937522][ T6804] ? ext4_es_lookup_extent+0x41d/0xd10 [ 59.943055][ T6804] ext4_map_blocks+0x4cb/0x1640 [ 59.947887][ T6804] ? ext4_issue_zeroout+0x1e0/0x1e0 [ 59.953419][ T6804] ? rcu_read_lock_sched_held+0x9c/0xd0 [ 59.958939][ T6804] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 59.964907][ T6804] ? prandom_u32_state+0xe/0x170 [ 59.969828][ T6804] ? __brelse+0x84/0xa0 [ 59.973958][ T6804] ? __ext4_new_inode+0x144/0x55e0 [ 59.979046][ T6804] ext4_getblk+0xad/0x520 [ 59.983354][ T6804] ? ext4_iomap_overwrite_begin+0xa0/0xa0 [ 59.989051][ T6804] ? ext4_free_inode+0x1700/0x1700 [ 59.994137][ T6804] ext4_bread+0x7c/0x380 [ 59.998366][ T6804] ? ext4_getblk+0x520/0x520 [ 60.002932][ T6804] ? dquot_get_next_dqblk+0x180/0x180 [ 60.008281][ T6804] ext4_append+0x153/0x360 [ 60.012675][ T6804] ext4_mkdir+0x5e0/0xdf0 [ 60.016997][ T6804] ? ext4_rmdir+0xde0/0xde0 [ 60.021478][ T6804] ? security_inode_permission+0xc4/0xf0 [ 60.027089][ T6804] vfs_mkdir+0x419/0x690 [ 60.031324][ T6804] do_mkdirat+0x21e/0x280 [ 60.035633][ T6804] ? __ia32_sys_mknod+0xb0/0xb0 [ 60.040459][ T6804] ? do_syscall_64+0x1c/0xe0 [ 60.045025][ T6804] ? lockdep_hardirqs_on_prepare+0x3a2/0x590 [ 60.051101][ T6804] do_syscall_64+0x60/0xe0 [ 60.055511][ T6804] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 60.061394][ T6804] RIP: 0033:0x45bee7 [ 60.065261][ T6804] Code: Bad RIP value. [ 60.069313][ T6804] RSP: 002b:00007ffe55bf9978 EFLAGS: 00000206 ORIG_RAX: 0000000000000053 [ 60.077817][ T6804] RAX: ffffffffffffffda RBX: 000000000000e9ca RCX: 000000000045bee7 [ 60.085786][ T6804] RDX: 00007ffe55bf99c3 RSI: 00000000000001ff RDI: 00007ffe55bf99c0 [ 60.094449][ T6804] RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000003 [ 60.102416][ T6804] R10: 0000000000000064 R11: 0000000000000206 R12: 0000000000000003 [ 60.110626][ T6804] R13: 00007ffe55bf99b0 R14: 000000000000e9b6 R15: 00007ffe55bf99c0 2020/06/13 04:31:09 building call list... [ 60.332557][ T38] tipc: TX() has been purged, node left! [ 60.844616][ T38] ================================================================== [ 60.852838][ T38] BUG: KASAN: use-after-free in afs_wake_up_async_call+0x6aa/0x770 [ 60.862630][ T38] Write of size 1 at addr ffff8880a6a4f9e4 by task kworker/u4:2/38 [ 60.870502][ T38] [ 60.872842][ T38] CPU: 0 PID: 38 Comm: kworker/u4:2 Not tainted 5.7.0-next-20200612-syzkaller #0 [ 60.881933][ T38] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 60.892099][ T38] Workqueue: netns cleanup_net [ 60.896872][ T38] Call Trace: [ 60.900158][ T38] dump_stack+0x18f/0x20d [ 60.904496][ T38] ? afs_wake_up_async_call+0x6aa/0x770 [ 60.910034][ T38] ? afs_wake_up_async_call+0x6aa/0x770 [ 60.915573][ T38] ? afs_put_call+0xa40/0xa40 [ 60.920246][ T38] print_address_description.constprop.0.cold+0xd3/0x413 [ 60.927269][ T38] ? vprintk_func+0x97/0x1a6 [ 60.931858][ T38] ? afs_wake_up_async_call+0x6aa/0x770 [ 60.937399][ T38] kasan_report.cold+0x1f/0x37 [ 60.942162][ T38] ? rcu_read_lock_held_common+0x41/0xa0 [ 60.947785][ T38] ? afs_wake_up_async_call+0x6aa/0x770 [ 60.953332][ T38] afs_wake_up_async_call+0x6aa/0x770 [ 60.958697][ T38] ? afs_close_socket+0x320/0x320 [ 60.963720][ T38] ? afs_put_call+0xa40/0xa40 [ 60.968394][ T38] rxrpc_notify_socket+0x1db/0x5d0 [ 60.973512][ T38] ? afs_put_call+0xa40/0xa40 [ 60.980821][ T38] __rxrpc_set_call_completion.part.0+0x172/0x410 [ 60.987245][ T38] rxrpc_call_completed+0xca/0xf0 [ 60.992362][ T38] rxrpc_discard_prealloc+0x781/0xab0 [ 60.997735][ T38] ? lock_sock_nested+0x94/0x110 [ 61.002758][ T38] rxrpc_listen+0x147/0x360 [ 61.007261][ T38] afs_close_socket+0x95/0x320 [ 61.012018][ T38] ? afs_purge_servers+0x16d/0x300 [ 61.017127][ T38] ? afs_rx_discard_new_call+0x50/0x50 [ 61.022583][ T38] ? init_wait_var_entry+0x200/0x200 [ 61.027959][ T38] ? rcu_read_lock_held_common+0xa0/0xa0 [ 61.033594][ T38] ? check_preemption_disabled+0x38/0x220 [ 61.039326][ T38] afs_net_exit+0x1bc/0x310 [ 61.043825][ T38] ? afs_net_init+0xe30/0xe30 [ 61.048493][ T38] ops_exit_list.isra.0+0xa8/0x150 [ 61.053726][ T38] cleanup_net+0x511/0xa50 [ 61.058144][ T38] ? unregister_pernet_device+0x70/0x70 [ 61.063712][ T38] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 61.069740][ T38] process_one_work+0x965/0x1690 [ 61.074730][ T38] ? lock_release+0x800/0x800 [ 61.081677][ T38] ? pwq_dec_nr_in_flight+0x310/0x310 [ 61.087095][ T38] ? rwlock_bug.part.0+0x90/0x90 [ 61.092070][ T38] worker_thread+0x96/0xe10 [ 61.096670][ T38] ? process_one_work+0x1690/0x1690 [ 61.101865][ T38] kthread+0x3b5/0x4a0 [ 61.105928][ T38] ? kthread_mod_delayed_work+0x1a0/0x1a0 [ 61.111668][ T38] ? kthread_mod_delayed_work+0x1a0/0x1a0 [ 61.117384][ T38] ret_from_fork+0x1f/0x30 [ 61.121803][ T38] [ 61.124135][ T38] Allocated by task 6804: [ 61.128460][ T38] save_stack+0x1b/0x40 [ 61.132609][ T38] __kasan_kmalloc.constprop.0+0xbf/0xd0 [ 61.138247][ T38] kmem_cache_alloc_trace+0x153/0x7d0 [ 61.143610][ T38] afs_alloc_call+0x55/0x630 [ 61.148190][ T38] afs_charge_preallocation+0xe9/0x2d0 [ 61.153639][ T38] afs_open_socket+0x292/0x360 [ 61.159170][ T38] afs_net_init+0xa6c/0xe30 [ 61.163665][ T38] ops_init+0xaf/0x420 [ 61.167740][ T38] setup_net+0x2de/0x860 [ 61.171973][ T38] copy_net_ns+0x293/0x590 [ 61.176391][ T38] create_new_namespaces+0x3fb/0xb30 [ 61.181673][ T38] unshare_nsproxy_namespaces+0xbd/0x1f0 [ 61.187331][ T38] ksys_unshare+0x43d/0x8e0 [ 61.191834][ T38] __x64_sys_unshare+0x2d/0x40 [ 61.196591][ T38] do_syscall_64+0x60/0xe0 [ 61.201084][ T38] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 61.206959][ T38] [ 61.209277][ T38] Freed by task 38: [ 61.213077][ T38] save_stack+0x1b/0x40 [ 61.217223][ T38] __kasan_slab_free+0xf7/0x140 [ 61.222065][ T38] kfree+0x109/0x2b0 [ 61.225952][ T38] afs_put_call+0x585/0xa40 [ 61.230446][ T38] rxrpc_discard_prealloc+0x764/0xab0 [ 61.235805][ T38] rxrpc_listen+0x147/0x360 [ 61.240409][ T38] afs_close_socket+0x95/0x320 [ 61.245163][ T38] afs_net_exit+0x1bc/0x310 [ 61.249659][ T38] ops_exit_list.isra.0+0xa8/0x150 [ 61.254759][ T38] cleanup_net+0x511/0xa50 [ 61.259280][ T38] process_one_work+0x965/0x1690 [ 61.264207][ T38] worker_thread+0x96/0xe10 [ 61.268703][ T38] kthread+0x3b5/0x4a0 [ 61.272765][ T38] ret_from_fork+0x1f/0x30 [ 61.277168][ T38] [ 61.279491][ T38] The buggy address belongs to the object at ffff8880a6a4f800 [ 61.279491][ T38] which belongs to the cache kmalloc-1k of size 1024 [ 61.293536][ T38] The buggy address is located 484 bytes inside of [ 61.293536][ T38] 1024-byte region [ffff8880a6a4f800, ffff8880a6a4fc00) [ 61.306968][ T38] The buggy address belongs to the page: [ 61.312612][ T38] page:ffffea00029a93c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 [ 61.323453][ T38] flags: 0xfffe0000000200(slab) [ 61.328299][ T38] raw: 00fffe0000000200 ffffea000278f708 ffffea00024ca608 ffff8880aa000c40 [ 61.336940][ T38] raw: 0000000000000000 ffff8880a6a4f000 0000000100000002 0000000000000000 [ 61.345618][ T38] page dumped because: kasan: bad access detected [ 61.352018][ T38] [ 61.354335][ T38] Memory state around the buggy address: [ 61.359971][ T38] ffff8880a6a4f880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 61.368039][ T38] ffff8880a6a4f900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 61.377592][ T38] >ffff8880a6a4f980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 61.385642][ T38] ^ executing program [ 61.392842][ T38] ffff8880a6a4fa00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 61.400895][ T38] ffff8880a6a4fa80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 61.409039][ T38] ================================================================== [ 61.417876][ T38] Disabling lock debugging due to kernel taint [ 61.424130][ T38] Kernel panic - not syncing: panic_on_warn set ... [ 61.430725][ T38] CPU: 0 PID: 38 Comm: kworker/u4:2 Tainted: G B 5.7.0-next-20200612-syzkaller #0 [ 61.441211][ T38] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 61.451263][ T38] Workqueue: netns cleanup_net [ 61.456189][ T38] Call Trace: [ 61.459477][ T38] dump_stack+0x18f/0x20d [ 61.463811][ T38] ? afs_wake_up_async_call+0x630/0x770 [ 61.469348][ T38] ? afs_put_call+0xa40/0xa40 [ 61.474389][ T38] panic+0x2e3/0x75c [ 61.479165][ T38] ? __warn_printk+0xf3/0xf3 [ 61.483747][ T38] ? asm_common_interrupt+0x1e/0x40 [ 61.488943][ T38] ? trace_hardirqs_on+0x55/0x220 [ 61.493961][ T38] ? afs_wake_up_async_call+0x6aa/0x770 [ 61.499523][ T38] ? afs_wake_up_async_call+0x6aa/0x770 [ 61.505324][ T38] ? afs_put_call+0xa40/0xa40 [ 61.509993][ T38] end_report+0x4d/0x53 [ 61.514143][ T38] kasan_report.cold+0xd/0x37 [ 61.518812][ T38] ? rcu_read_lock_held_common+0x41/0xa0 [ 61.524441][ T38] ? afs_wake_up_async_call+0x6aa/0x770 [ 61.529989][ T38] afs_wake_up_async_call+0x6aa/0x770 [ 61.535364][ T38] ? afs_close_socket+0x320/0x320 [ 61.540476][ T38] ? afs_put_call+0xa40/0xa40 [ 61.545180][ T38] rxrpc_notify_socket+0x1db/0x5d0 [ 61.550307][ T38] ? afs_put_call+0xa40/0xa40 [ 61.555022][ T38] __rxrpc_set_call_completion.part.0+0x172/0x410 [ 61.561445][ T38] rxrpc_call_completed+0xca/0xf0 [ 61.566488][ T38] rxrpc_discard_prealloc+0x781/0xab0 [ 61.571962][ T38] ? lock_sock_nested+0x94/0x110 [ 61.577175][ T38] rxrpc_listen+0x147/0x360 [ 61.581680][ T38] afs_close_socket+0x95/0x320 [ 61.586442][ T38] ? afs_purge_servers+0x16d/0x300 [ 61.591556][ T38] ? afs_rx_discard_new_call+0x50/0x50 [ 61.597020][ T38] ? init_wait_var_entry+0x200/0x200 [ 61.602317][ T38] ? rcu_read_lock_held_common+0xa0/0xa0 [ 61.608248][ T38] ? check_preemption_disabled+0x38/0x220 [ 61.614055][ T38] afs_net_exit+0x1bc/0x310 [ 61.618540][ T38] ? afs_net_init+0xe30/0xe30 [ 61.623194][ T38] ops_exit_list.isra.0+0xa8/0x150 [ 61.628285][ T38] cleanup_net+0x511/0xa50 [ 61.632680][ T38] ? unregister_pernet_device+0x70/0x70 [ 61.638240][ T38] ? rcu_read_lock_any_held.part.0+0x50/0x50 [ 61.644206][ T38] process_one_work+0x965/0x1690 [ 61.649143][ T38] ? lock_release+0x800/0x800 [ 61.653804][ T38] ? pwq_dec_nr_in_flight+0x310/0x310 [ 61.659311][ T38] ? rwlock_bug.part.0+0x90/0x90 [ 61.664248][ T38] worker_thread+0x96/0xe10 [ 61.668737][ T38] ? process_one_work+0x1690/0x1690 [ 61.673930][ T38] kthread+0x3b5/0x4a0 [ 61.677976][ T38] ? kthread_mod_delayed_work+0x1a0/0x1a0 [ 61.683699][ T38] ? kthread_mod_delayed_work+0x1a0/0x1a0 [ 61.689393][ T38] ret_from_fork+0x1f/0x30 [ 61.695134][ T38] Kernel Offset: disabled [ 61.699453][ T38] Rebooting in 86400 seconds..