================================================================== BUG: KASAN: slab-use-after-free in smb2_reconnect_server+0x1a9a/0x1b80 fs/smb/client/smb2pdu.c:4257 Read of size 4 at addr ffff888036f2c078 by task kworker/2:0/25 CPU: 2 UID: 0 PID: 25 Comm: kworker/2:0 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Workqueue: cifsiod smb2_reconnect_server Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x13d/0x4b0 mm/kasan/report.c:482 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595 smb2_reconnect_server+0x1a9a/0x1b80 fs/smb/client/smb2pdu.c:4257 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3396 process_scheduled_works kernel/workqueue.c:3479 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3560 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Allocated by task 7226: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x2f8/0x6d0 mm/slub.c:5563 _kmalloc_noprof include/linux/slab.h:991 [inline] _kzalloc_noprof include/linux/slab.h:1312 [inline] cifs_get_tcp_session+0x144/0x1f20 fs/smb/client/connect.c:1758 cifs_mount_get_session+0xc9/0x460 fs/smb/client/connect.c:3570 get_session fs/smb/client/dfs.c:65 [inline] dfs_mount_share+0x200/0x1e20 fs/smb/client/dfs.c:275 cifs_mount+0xc4/0xdb0 fs/smb/client/connect.c:3860 cifs_smb3_do_mount+0x2c0/0x1b10 fs/smb/client/cifsfs.c:1026 smb3_get_tree_common fs/smb/client/fs_context.c:897 [inline] smb3_get_tree fs/smb/client/fs_context.c:917 [inline] smb3_get_tree+0x1fd/0x440 fs/smb/client/fs_context.c:909 vfs_get_tree+0x92/0x320 fs/super.c:1947 fc_mount fs/namespace.c:1198 [inline] do_new_mount_fc fs/namespace.c:3772 [inline] do_new_mount fs/namespace.c:3848 [inline] path_mount+0x7d0/0x24c0 fs/namespace.c:4168 do_mount fs/namespace.c:4181 [inline] __do_sys_mount fs/namespace.c:4397 [inline] __se_sys_mount fs/namespace.c:4374 [inline] __x64_sys_mount+0x293/0x310 fs/namespace.c:4374 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 7228: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2748 [inline] slab_free mm/slub.c:6499 [inline] kfree+0x22b/0x6d0 mm/slub.c:6792 clean_demultiplex_info+0x98a/0xe90 fs/smb/client/connect.c:1146 cifs_demultiplex_thread+0x5b5/0x2ea0 fs/smb/client/connect.c:1439 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Last potentially related work creation: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_record_aux_stack+0xa7/0xc0 mm/kasan/generic.c:556 insert_work+0x36/0x230 kernel/workqueue.c:2272 __queue_work+0xa60/0x1370 kernel/workqueue.c:2448 __queue_delayed_work+0x357/0x450 kernel/workqueue.c:2617 mod_delayed_work_on+0x195/0x1c0 kernel/workqueue.c:2705 mod_delayed_work include/linux/workqueue.h:730 [inline] cifs_queue_server_reconn fs/smb/client/cifsglob.h:2340 [inline] cifs_queue_server_reconn fs/smb/client/cifsglob.h:2336 [inline] __cifs_reconnect+0x51d/0xa80 fs/smb/client/connect.c:431 _cifs_reconnect+0x6d/0x90 fs/smb/client/connect.c:590 cifs_reconnect fs/smb/client/connect.c:604 [inline] cifs_demultiplex_thread+0x1320/0x2ea0 fs/smb/client/connect.c:1312 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 The buggy address belongs to the object at ffff888036f2c000 which belongs to the cache kmalloc-4k of size 4096 The buggy address is located 120 bytes inside of freed 4096-byte region [ffff888036f2c000, ffff888036f2d000) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x36f28 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801c043040 dead000000000100 dead000000000122 raw: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000 head: 00fff00000000040 ffff88801c043040 dead000000000100 dead000000000122 head: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000 head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5147, tgid 5147 (udevd), ts 44353578357 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1871 prep_new_page mm/page_alloc.c:1879 [inline] get_page_from_freelist+0x110d/0x35d0 mm/page_alloc.c:3943 __alloc_frozen_pages_noprof+0x2eb/0x3300 mm/page_alloc.c:5436 alloc_slab_page mm/slub.c:3347 [inline] allocate_slab mm/slub.c:3462 [inline] new_slab+0xa9/0x6e0 mm/slub.c:3513 refill_objects+0xe3/0x410 mm/slub.c:7410 refill_sheaf mm/slub.c:2885 [inline] __pcs_replace_empty_main+0x35e/0x650 mm/slub.c:4774 alloc_from_pcs mm/slub.c:4850 [inline] slab_alloc_node mm/slub.c:4984 [inline] __kmalloc_cache_noprof+0x4f4/0x6d0 mm/slub.c:5559 _kmalloc_noprof include/linux/slab.h:991 [inline] selinux_genfs_get_sid security/selinux/hooks.c:1341 [inline] inode_doinit_with_dentry+0x7b1/0x1340 security/selinux/hooks.c:1565 selinux_d_instantiate+0x26/0x40 security/selinux/hooks.c:6685 security_d_instantiate+0x14c/0x1b0 security/security.c:3703 d_splice_alias_ops+0xd7/0x15b0 fs/dcache.c:3249 kernfs_iop_lookup+0x23f/0x2d0 fs/kernfs/dir.c:1288 __lookup_slow+0x155/0x320 fs/namei.c:1919 lookup_slow+0x50/0x70 fs/namei.c:1936 walk_component fs/namei.c:2282 [inline] lookup_last fs/namei.c:2789 [inline] path_lookupat+0x5e8/0xc40 fs/namei.c:2813 filename_lookup+0x202/0x590 fs/namei.c:2842 page last free pid 5146 tgid 5146 ts 44337239983 stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] __free_pages_prepare mm/page_alloc.c:1418 [inline] __free_frozen_pages+0x79f/0x10f0 mm/page_alloc.c:2962 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x47/0xf0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x1a0/0x1f0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4683 [inline] slab_alloc_node mm/slub.c:4996 [inline] kmem_cache_alloc_noprof+0x269/0x6a0 mm/slub.c:5010 alloc_filename fs/namei.c:147 [inline] do_getname+0x35/0x390 fs/namei.c:187 class_filename_flags_constructor include/linux/fs.h:2586 [inline] do_readlinkat+0xa9/0x370 fs/stat.c:569 __do_sys_readlink fs/stat.c:605 [inline] __se_sys_readlink fs/stat.c:602 [inline] __x64_sys_readlink+0x78/0xc0 fs/stat.c:602 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff888036f2bf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888036f2bf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888036f2c000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888036f2c080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888036f2c100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================