================================================================== BUG: KASAN: use-after-free in class_equal+0x40/0x50 kernel/locking/lockdep.c:1527 Read of size 8 at addr ffff88808d7ebf00 by task syz-executor.2/9315 CPU: 0 PID: 9315 Comm: syz-executor.2 Not tainted 5.2.0-rc3+ #20 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: Allocated by task 2293861144: BUG: unable to handle page fault for address: ffffffff8c048c58 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 8a70067 P4D 8a70067 PUD 8a71063 PMD 0 Thread overran stack, or stack corrupted Oops: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 9315 Comm: syz-executor.2 Not tainted 5.2.0-rc3+ #20 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:stack_depot_fetch+0x10/0x30 lib/stackdepot.c:203 usercopy: Kernel memory overwrite attempt detected to SLAB object 'kmalloc-256' (offset 224, size 64)! ------------[ cut here ]------------ kernel BUG at mm/usercopy.c:102! invalid opcode: 0000 [#2] PREEMPT SMP KASAN CPU: 0 PID: 9315 Comm: syz-executor.2 Not tainted 5.2.0-rc3+ #20 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:usercopy_abort+0xbd/0xbf mm/usercopy.c:102 Code: c0 e8 68 a6 bf ff 48 8b 55 c0 49 89 d9 4d 89 f0 ff 75 c8 4c 89 e1 4c 89 ee 48 c7 c7 c0 b8 75 87 ff 75 d0 41 57 e8 28 b5 a9 ff <0f> 0b e8 3d a6 bf ff e8 a8 6a f8 ff 8b 55 d4 4c 89 e1 49 89 d8 4c RSP: 0018:ffff88808d7eb6d8 EFLAGS: 00010086 RAX: 0000000000000069 RBX: ffffffff88620bef RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff815ac936 RDI: ffffed1011afd6cd RBP: ffff88808d7eb730 R08: 0000000000000069 R09: ffffed1015d044fa R10: ffffed1015d044f9 R11: ffff8880ae8227cf R12: ffffffff886247dd R13: ffffffff8775b720 R14: ffffffff8775b660 R15: ffffffff8775b620 FS: 0000555556aff940(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffff8c048c58 CR3: 0000000092fc4000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: Modules linked in: ---[ end trace 8d8438c6dfad9951 ]--- RIP: 0010:stack_depot_fetch+0x10/0x30 lib/stackdepot.c:203 Code: e9 7b fd ff ff 4c 89 ff e8 3d c9 62 fe e9 e6 fd ff ff 90 90 90 90 90 90 90 90 89 f8 c1 ef 11 25 ff ff 1f 00 81 e7 f0 3f 00 00 <48> 03 3c c5 60 8c 04 8b 48 8d 47 18 48 89 06 8b 47 0c c3 0f 1f 00 RSP: 0018:ffff88808d7ebc48 EFLAGS: 00010006 RAX: 00000000001fffff RBX: ffff88808d7ebf84 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff88808d7ebc50 RDI: 0000000000003ff0 RBP: ffff88808d7ebc68 R08: 0000000000000020 R09: ffffed1015d044fa R10: ffffed1015d044f9 R11: ffff8880ae8227cf R12: ffffea000235fac0 R13: ffff88808d7ebf00 R14: ffff8880aa4007c0 R15: ffff88808d7ebf80 FS: 0000555556aff940(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffff8c048c58 CR3: 0000000092fc4000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400