================================================================== BUG: KASAN: double-free in slab_free mm/slub.c:3712 [inline] BUG: KASAN: double-free in __kmem_cache_free+0xb7/0x1b0 mm/slub.c:3728 Free of addr ffff88813a019000 by task kworker/1:2/221 CPU: 1 PID: 221 Comm: kworker/1:2 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/07/2026 Workqueue: kcryptd_io/252:1 kcryptd_io_read_work Call Trace: __dump_stack+0x21/0x24 lib/dump_stack.c:88 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106 print_address_description+0x71/0x200 mm/kasan/report.c:316 print_report+0x4a/0x60 mm/kasan/report.c:420 kasan_report_invalid_free+0xd5/0xf0 mm/kasan/report.c:489 ____kasan_slab_free+0x14f/0x180 mm/kasan/common.c:-1 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:250 kasan_slab_free include/linux/kasan.h:178 [inline] slab_free_hook mm/slub.c:1750 [inline] slab_free_freelist_hook+0xc2/0x190 mm/slub.c:1776 slab_free mm/slub.c:3712 [inline] __kmem_cache_free+0xb7/0x1b0 mm/slub.c:3728 kfree+0x6f/0xf0 mm/slab_common.c:990 crypt_dec_pending+0x231/0x600 drivers/md/dm-crypt.c:1778 kcryptd_io_read_work+0x84/0xa0 drivers/md/dm-crypt.c:1889 process_one_work+0x717/0xc30 kernel/workqueue.c:2302 worker_thread+0xa4d/0x11d0 kernel/workqueue.c:2449 kthread+0x281/0x320 kernel/kthread.c:386 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Allocated by task 580: kasan_save_stack mm/kasan/common.c:46 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:53 kasan_save_alloc_info+0x1f/0x30 mm/kasan/generic.c:505 ____kasan_kmalloc mm/kasan/common.c:380 [inline] __kasan_kmalloc+0x95/0xb0 mm/kasan/common.c:389 kasan_kmalloc include/linux/kasan.h:212 [inline] __do_kmalloc_node mm/slab_common.c:938 [inline] __kmalloc+0xb4/0x1e0 mm/slab_common.c:951 kmalloc include/linux/slab.h:568 [inline] crypt_map+0x417/0xbc0 drivers/md/dm-crypt.c:3445 __map_bio+0x159/0xb50 drivers/md/dm.c:-1 __split_and_process_bio drivers/md/dm.c:1704 [inline] dm_split_and_process_bio drivers/md/dm.c:1760 [inline] dm_submit_bio+0xf0c/0x1ce0 drivers/md/dm.c:1816 __submit_bio+0x222/0x380 block/blk-core.c:602 __submit_bio_noacct block/blk-core.c:645 [inline] submit_bio_noacct_nocheck+0x3d0/0x950 block/blk-core.c:708 submit_bio_noacct+0xded/0x1780 block/blk-core.c:801 submit_bio+0x1ae/0x2a0 block/blk-core.c:846 submit_bh_wbc+0x491/0x4f0 fs/buffer.c:2750 submit_bh fs/buffer.c:2755 [inline] __bh_read fs/buffer.c:3024 [inline] bh_read_nowait include/linux/buffer_head.h:427 [inline] __block_write_begin_int+0x108b/0x13f0 fs/buffer.c:2064 __block_write_begin fs/buffer.c:2084 [inline] block_write_begin+0x94/0x110 fs/buffer.c:2145 blkdev_write_begin+0x34/0x40 block/fops.c:407 generic_perform_write+0x32d/0x740 mm/filemap.c:3927 blkdev_write_iter+0x49b/0x6b0 block/fops.c:601 call_write_iter include/linux/fs.h:2282 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x5ef/0xd00 fs/read_write.c:584 ksys_pwrite64 fs/read_write.c:699 [inline] __do_sys_pwrite64 fs/read_write.c:709 [inline] __se_sys_pwrite64 fs/read_write.c:706 [inline] __x64_sys_pwrite64+0x194/0x220 fs/read_write.c:706 x64_sys_call+0x36/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:19 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 Freed by task 580: kasan_save_stack mm/kasan/common.c:46 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:53 kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:516 ____kasan_slab_free+0x132/0x180 mm/kasan/common.c:242 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:250 kasan_slab_free include/linux/kasan.h:178 [inline] slab_free_hook mm/slub.c:1750 [inline] slab_free_freelist_hook+0xc2/0x190 mm/slub.c:1776 slab_free mm/slub.c:3712 [inline] __kmem_cache_free+0xb7/0x1b0 mm/slub.c:3728 kfree+0x6f/0xf0 mm/slab_common.c:990 crypt_dec_pending+0x231/0x600 drivers/md/dm-crypt.c:1778 kcryptd_io_read+0x4d9/0x5f0 drivers/md/dm-crypt.c:1873 crypt_map+0x50b/0xbc0 drivers/md/dm-crypt.c:3460 __map_bio+0x159/0xb50 drivers/md/dm.c:-1 __split_and_process_bio drivers/md/dm.c:1704 [inline] dm_split_and_process_bio drivers/md/dm.c:1760 [inline] dm_submit_bio+0xf0c/0x1ce0 drivers/md/dm.c:1816 __submit_bio+0x222/0x380 block/blk-core.c:602 __submit_bio_noacct block/blk-core.c:645 [inline] submit_bio_noacct_nocheck+0x3d0/0x950 block/blk-core.c:708 submit_bio_noacct+0xded/0x1780 block/blk-core.c:801 submit_bio+0x1ae/0x2a0 block/blk-core.c:846 submit_bh_wbc+0x491/0x4f0 fs/buffer.c:2750 submit_bh fs/buffer.c:2755 [inline] __bh_read fs/buffer.c:3024 [inline] bh_read_nowait include/linux/buffer_head.h:427 [inline] __block_write_begin_int+0x108b/0x13f0 fs/buffer.c:2064 __block_write_begin fs/buffer.c:2084 [inline] block_write_begin+0x94/0x110 fs/buffer.c:2145 blkdev_write_begin+0x34/0x40 block/fops.c:407 generic_perform_write+0x32d/0x740 mm/filemap.c:3927 blkdev_write_iter+0x49b/0x6b0 block/fops.c:601 call_write_iter include/linux/fs.h:2282 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x5ef/0xd00 fs/read_write.c:584 ksys_pwrite64 fs/read_write.c:699 [inline] __do_sys_pwrite64 fs/read_write.c:709 [inline] __se_sys_pwrite64 fs/read_write.c:706 [inline] __x64_sys_pwrite64+0x194/0x220 fs/read_write.c:706 x64_sys_call+0x36/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:19 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 The buggy address belongs to the object at ffff88813a019000 which belongs to the cache kmalloc-64 of size 64 The buggy address is located 0 bytes inside of 64-byte region [ffff88813a019000, ffff88813a019040) The buggy address belongs to the physical page: page:ffffea0004e80640 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x13a019 flags: 0x4000000000000200(slab|zone=1) raw: 4000000000000200 0000000000000000 dead000000000122 ffff888100042780 raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 580, tgid 579 (syz.0.96), ts 37200700229, free_ts 37196798415 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x1f5/0x210 mm/page_alloc.c:2673 prep_new_page+0x1c/0x110 mm/page_alloc.c:2680 get_page_from_freelist+0x2ca9/0x2d20 mm/page_alloc.c:4587 __alloc_pages+0x1fa/0x610 mm/page_alloc.c:5931 alloc_slab_page+0x6e/0xf0 include/linux/gfp.h:-1 allocate_slab mm/slub.c:1967 [inline] new_slab+0x98/0x3e0 mm/slub.c:2020 ___slab_alloc+0x70f/0xb70 mm/slub.c:3177 __slab_alloc+0x5e/0xa0 mm/slub.c:3263 slab_alloc_node mm/slub.c:3348 [inline] __kmem_cache_alloc_node+0x204/0x2d0 mm/slub.c:3423 kmalloc_trace+0x29/0xb0 mm/slab_common.c:1028 kmalloc include/linux/slab.h:563 [inline] call_modprobe kernel/kmod.c:79 [inline] __request_module+0x2a7/0x910 kernel/kmod.c:170 crypto_larval_lookup crypto/api.c:284 [inline] crypto_alg_mod_lookup+0xa4/0x5c0 crypto/api.c:331 crypto_find_alg crypto/api.c:544 [inline] crypto_alloc_tfm_node+0x13b/0x350 crypto/api.c:581 crypto_alloc_tfm crypto/internal.h:124 [inline] crypto_alloc_skcipher+0x30/0x40 crypto/skcipher.c:756 cryptd_alloc_skcipher+0x102/0x220 crypto/cryptd.c:916 simd_skcipher_init+0x66/0x140 crypto/simd.c:122 page last free stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] free_pages_prepare mm/page_alloc.c:1581 [inline] free_pcp_prepare mm/page_alloc.c:1655 [inline] free_unref_page_prepare+0x81b/0x820 mm/page_alloc.c:3622 free_unref_page_list+0x117/0x8d0 mm/page_alloc.c:3773 release_pages+0xc7e/0xce0 mm/swap.c:1053 free_pages_and_swap_cache+0x86/0xa0 mm/swap_state.c:316 tlb_batch_pages_flush mm/mmu_gather.c:59 [inline] tlb_flush_mmu_free mm/mmu_gather.c:254 [inline] tlb_flush_mmu mm/mmu_gather.c:261 [inline] tlb_finish_mmu+0x1b2/0x380 mm/mmu_gather.c:361 exit_mmap+0x41d/0xc10 mm/mmap.c:3384 __mmput+0x92/0x340 kernel/fork.c:1321 mmput+0x4b/0x150 kernel/fork.c:1345 exit_mm kernel/exit.c:575 [inline] do_exit+0xa62/0x29f0 kernel/exit.c:883 do_group_exit+0x21b/0x2e0 kernel/exit.c:1040 get_signal+0x167c/0x1700 kernel/signal.c:2904 arch_do_signal_or_restart+0xd1/0x11c0 arch/x86/kernel/signal.c:871 exit_to_user_mode_loop+0x7a/0xb0 kernel/entry/common.c:174 exit_to_user_mode_prepare+0x87/0xd0 kernel/entry/common.c:210 __syscall_exit_to_user_mode_work kernel/entry/common.c:292 [inline] syscall_exit_to_user_mode+0x1a/0x30 kernel/entry/common.c:303 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:82 Memory state around the buggy address: ffff88813a018f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff88813a018f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff88813a019000: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ^ ffff88813a019080: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc ffff88813a019100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ==================================================================