list_add corruption. prev->next should be next (ffff8881f7154060), but was ffff888155b0ac70. (prev=ffff888155b0ac70). ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:28! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 6664 Comm: syz-executor.3 Not tainted 5.10.77-syzkaller-01258-g76698ea35fd3 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__list_add_valid+0xbb/0xc0 lib/list_debug.c:26 Code: 48 c7 c7 60 d3 49 85 4c 89 e6 4c 89 f1 31 c0 e8 d2 4a fc fe 0f 0b 48 c7 c7 20 d4 49 85 4c 89 f6 4c 89 e1 31 c0 e8 bc 4a fc fe <0f> 0b 0f 1f 00 55 48 89 e5 41 57 41 56 41 54 53 49 89 fe 49 bc 00 RSP: 0018:ffffc900001609e0 EFLAGS: 00010046 RAX: 0000000000000075 RBX: ffff8881f7154068 RCX: 926ddf1628ecc100 RDX: 0000000000000102 RSI: 0000000000000102 RDI: 0000000000000000 RBP: ffffc90000160a08 R08: ffffffff81545288 R09: ffffed103ee295d8 R10: ffffed103ee295d8 R11: 0000000000000000 R12: ffff888155b0ac70 R13: dffffc0000000000 R14: ffff8881f7154060 R15: ffff888155b0ac70 FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000002000f030 CR3: 000000000640f000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __list_add include/linux/list.h:67 [inline] list_add_tail include/linux/list.h:100 [inline] insert_work+0x107/0x330 kernel/workqueue.c:1344 __queue_work+0x951/0xda0 kernel/workqueue.c:1506 queue_work_on+0xef/0x150 kernel/workqueue.c:1533 queue_work include/linux/workqueue.h:513 [inline] css_release+0xae/0xc0 kernel/cgroup/cgroup.c:5093 percpu_ref_put_many include/linux/percpu-refcount.h:322 [inline] percpu_ref_put include/linux/percpu-refcount.h:338 [inline] percpu_ref_call_confirm_rcu lib/percpu-refcount.c:162 [inline] percpu_ref_switch_to_atomic_rcu+0x5a0/0x5b0 lib/percpu-refcount.c:199 rcu_do_batch+0x4cd/0xb40 kernel/rcu/tree.c:2484 rcu_core+0x822/0x10d0 kernel/rcu/tree.c:2721 rcu_core_si+0x9/0x10 kernel/rcu/tree.c:2734 __do_softirq+0x27e/0x598 kernel/softirq.c:305 asm_call_irq_on_stack+0xf/0x20 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline] run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline] do_softirq_own_stack+0x60/0x80 arch/x86/kernel/irq_64.c:77 invoke_softirq kernel/softirq.c:402 [inline] __irq_exit_rcu+0x128/0x150 kernel/softirq.c:432 irq_exit_rcu+0x9/0x10 kernel/softirq.c:444 sysvec_apic_timer_interrupt+0xbf/0xe0 arch/x86/kernel/apic/apic.c:1095 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635 RIP: 0010:_vm_normal_page mm/memory.c:634 [inline] RIP: 0010:vm_normal_page include/linux/mm.h:1727 [inline] RIP: 0010:zap_pte_range mm/memory.c:1276 [inline] RIP: 0010:zap_pmd_range mm/memory.c:1419 [inline] RIP: 0010:zap_pud_range mm/memory.c:1448 [inline] RIP: 0010:zap_p4d_range mm/memory.c:1469 [inline] RIP: 0010:unmap_page_range+0xbbd/0x1f70 mm/memory.c:1491 Code: b6 e3 49 f7 dc 4d 31 ec 49 c1 ec 0c 48 b8 ff ff ff ff ff 00 00 00 49 21 c4 4c 89 ee 48 81 e6 00 02 00 00 31 ff e8 f3 e9 d0 ff <4c> 89 e8 48 25 00 02 00 00 0f 85 70 09 00 00 48 8b 1d 7d c4 23 05 RSP: 0018:ffffc9000e817400 EFLAGS: 00000293 RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffffff819c1265 RDX: ffff8881195ebb40 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc9000e817610 R08: ffffffff819c132d R09: ffffed10232bd769 R10: ffffed10232bd769 R11: 0000000000000000 R12: 000000000014bf54 R13: 800000014bf54007 R14: ffff8881177ba901 R15: 00000000100400fb unmap_single_vma mm/memory.c:1537 [inline] unmap_vmas+0x3a4/0x520 mm/memory.c:1569 exit_mmap+0x2c8/0x570 mm/mmap.c:3324 __mmput+0x95/0x2c0 kernel/fork.c:1128 mmput+0x4b/0x50 kernel/fork.c:1149 exit_mm+0x615/0x7e0 kernel/exit.c:489 do_exit+0x6c4/0x23a0 kernel/exit.c:800 do_group_exit+0x16a/0x2d0 kernel/exit.c:910 get_signal+0x133e/0x1f80 kernel/signal.c:2790 arch_do_signal+0x8d/0x620 arch/x86/kernel/signal.c:805 exit_to_user_mode_loop kernel/entry/common.c:161 [inline] exit_to_user_mode_prepare+0xaa/0xe0 kernel/entry/common.c:191 syscall_exit_to_user_mode+0x24/0x40 kernel/entry/common.c:266 do_syscall_64+0x3d/0x70 arch/x86/entry/common.c:56 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7fdccee6e8a7 Code: Unable to access opcode bytes at RIP 0x7fdccee6e87d. RSP: 002b:00007fdcccbc3f48 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: 0000000000000000 RBX: 00007fdcceeb8970 RCX: 00007fdccee6e8a7 RDX: 0000000000000005 RSI: 0000000000004c00 RDI: 0000000000000006 RBP: 0000000000000006 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000005 R13: 0000000000000005 R14: 0000000020000248 R15: 0000000000000003 Modules linked in: ---[ end trace 5d9dc55435a57367 ]--- RIP: 0010:__list_add_valid+0xbb/0xc0 lib/list_debug.c:26 Code: 48 c7 c7 60 d3 49 85 4c 89 e6 4c 89 f1 31 c0 e8 d2 4a fc fe 0f 0b 48 c7 c7 20 d4 49 85 4c 89 f6 4c 89 e1 31 c0 e8 bc 4a fc fe <0f> 0b 0f 1f 00 55 48 89 e5 41 57 41 56 41 54 53 49 89 fe 49 bc 00 RSP: 0018:ffffc900001609e0 EFLAGS: 00010046 RAX: 0000000000000075 RBX: ffff8881f7154068 RCX: 926ddf1628ecc100 RDX: 0000000000000102 RSI: 0000000000000102 RDI: 0000000000000000 RBP: ffffc90000160a08 R08: ffffffff81545288 R09: ffffed103ee295d8 R10: ffffed103ee295d8 R11: 0000000000000000 R12: ffff888155b0ac70 R13: dffffc0000000000 R14: ffff8881f7154060 R15: ffff888155b0ac70 FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000002000f030 CR3: 000000000640f000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: b6 e3 mov $0xe3,%dh 2: 49 f7 dc neg %r12 5: 4d 31 ec xor %r13,%r12 8: 49 c1 ec 0c shr $0xc,%r12 c: 48 b8 ff ff ff ff ff movabs $0xffffffffff,%rax 13: 00 00 00 16: 49 21 c4 and %rax,%r12 19: 4c 89 ee mov %r13,%rsi 1c: 48 81 e6 00 02 00 00 and $0x200,%rsi 23: 31 ff xor %edi,%edi 25: e8 f3 e9 d0 ff callq 0xffd0ea1d * 2a: 4c 89 e8 mov %r13,%rax <-- trapping instruction 2d: 48 25 00 02 00 00 and $0x200,%rax 33: 0f 85 70 09 00 00 jne 0x9a9 39: 48 8b 1d 7d c4 23 05 mov 0x523c47d(%rip),%rbx # 0x523c4bd