==================================================================
BUG: KASAN: slab-use-after-free in rose_timer_expiry+0x46a/0x4b0 net/rose/rose_timer.c:183
Read of size 2 at addr ffff888026a3e82a by task syz.1.848/10020
CPU: 1 PID: 10020 Comm: syz.1.848 Not tainted 6.6.101-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Call Trace:
dump_stack_lvl+0x16c/0x230 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:364 [inline]
print_report+0xac/0x220 mm/kasan/report.c:468
kasan_report+0x117/0x150 mm/kasan/report.c:581
rose_timer_expiry+0x46a/0x4b0 net/rose/rose_timer.c:183
call_timer_fn+0x16e/0x530 kernel/time/timer.c:1700
expire_timers kernel/time/timer.c:1751 [inline]
__run_timers+0x52d/0x7d0 kernel/time/timer.c:2022
run_timer_softirq+0x67/0xf0 kernel/time/timer.c:2035
handle_softirqs+0x280/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xc7/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:do_recvmmsg+0x55a/0x7d0 net/socket.c:2937
Code: a8 0b 00 00 31 d2 e8 a5 06 fd f8 2e 2e 2e 31 c0 44 39 64 24 14 74 5a 8b 5c 24 04 89 d8 c1 e8 0a 83 e0 40 09 c3 e8 b6 69 25 f9 <41> ff c4 e9 bd fd ff ff e8 a9 69 25 f9 41 bc a8 ff ff ff e9 52 01
RSP: 0018:ffffc90019a77c80 EFLAGS: 00000246
RAX: ffffffff88602bda RBX: 0000000000000002 RCX: 0000000000080000
RDX: ffffc9000e46e000 RSI: 000000000007ffff RDI: 0000000000080000
RBP: ffffc90019a77e50 R08: ffffffff8e4a84ef R09: 1ffffffff1c9509d
R10: dffffc0000000000 R11: fffffbfff1c9509e R12: 0000000000006a49
R13: 0000000000000000 R14: 00002000000000c0 R15: dffffc0000000000
__sys_recvmmsg net/socket.c:3029 [inline]
__do_sys_recvmmsg net/socket.c:3052 [inline]
__se_sys_recvmmsg net/socket.c:3045 [inline]
__x64_sys_recvmmsg+0x191/0x240 net/socket.c:3045
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f7beff8ebe9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7bf0d2f038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: ffffffffffffffda RBX: 00007f7bf01b6090 RCX: 00007f7beff8ebe9
RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000006
RBP: 00007f7bf0011e19 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f7bf01b6128 R14: 00007f7bf01b6090 R15: 00007fff55a7a188
Allocated by task 5158:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4e/0x70 mm/kasan/common.c:52
____kasan_kmalloc mm/kasan/common.c:374 [inline]
__kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:383
kmalloc include/linux/slab.h:600 [inline]
kzalloc include/linux/slab.h:721 [inline]
kernfs_fop_open+0x3f5/0xcc0 fs/kernfs/file.c:672
do_dentry_open+0x8c6/0x1500 fs/open.c:929
do_open fs/namei.c:3632 [inline]
path_openat+0x274b/0x3190 fs/namei.c:3789
do_filp_open+0x1c5/0x3d0 fs/namei.c:3816
do_sys_openat2+0x12c/0x1c0 fs/open.c:1419
do_sys_open fs/open.c:1434 [inline]
__do_sys_openat fs/open.c:1450 [inline]
__se_sys_openat fs/open.c:1445 [inline]
__x64_sys_openat+0x139/0x160 fs/open.c:1445
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
Freed by task 5158:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4e/0x70 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x50 mm/kasan/generic.c:522
____kasan_slab_free+0x126/0x1e0 mm/kasan/common.c:236
kasan_slab_free include/linux/kasan.h:164 [inline]
slab_free_hook mm/slub.c:1806 [inline]
slab_free_freelist_hook+0x130/0x1b0 mm/slub.c:1832
slab_free mm/slub.c:3816 [inline]
__kmem_cache_free+0xba/0x1f0 mm/slub.c:3829
kernfs_fop_release+0x166/0x190 fs/kernfs/file.c:810
__fput+0x234/0x970 fs/file_table.c:384
__do_sys_close fs/open.c:1571 [inline]
__se_sys_close+0x15f/0x220 fs/open.c:1556
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
Last potentially related work creation:
kasan_save_stack+0x3e/0x60 mm/kasan/common.c:45
__kasan_record_aux_stack+0xaf/0xc0 mm/kasan/generic.c:492
insert_work+0x3d/0x310 kernel/workqueue.c:1651
__queue_work+0xd2c/0x1020 kernel/workqueue.c:1804
call_timer_fn+0x16e/0x530 kernel/time/timer.c:1700
expire_timers kernel/time/timer.c:1746 [inline]
__run_timers+0x558/0x7d0 kernel/time/timer.c:2022
run_timer_softirq+0x67/0xf0 kernel/time/timer.c:2035
handle_softirqs+0x280/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xc7/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
Second to last potentially related work creation:
kasan_save_stack+0x3e/0x60 mm/kasan/common.c:45
__kasan_record_aux_stack+0xaf/0xc0 mm/kasan/generic.c:492
task_work_add+0xd3/0x440 kernel/task_work.c:77
io_req_normal_work_add io_uring/io_uring.c:1340 [inline]
__io_req_task_work_add+0x2d5/0x840 io_uring/io_uring.c:1353
io_run_cancel io_uring/io-wq.c:915 [inline]
io_acct_cancel_pending_work+0x3eb/0x510 io_uring/io-wq.c:1071
io_wq_cancel_pending_work io_uring/io-wq.c:1089 [inline]
io_wq_cancel_cb+0xca/0x330 io_uring/io-wq.c:1127
io_async_cancel_one io_uring/cancel.c:86 [inline]
io_try_cancel+0x1b7/0x2f0 io_uring/cancel.c:110
__io_async_cancel+0x85/0x470 io_uring/cancel.c:166
__io_sync_cancel io_uring/cancel.c:254 [inline]
io_sync_cancel+0x532/0x8d0 io_uring/cancel.c:294
__io_uring_register io_uring/io_uring.c:4648 [inline]
__do_sys_io_uring_register io_uring/io_uring.c:4703 [inline]
__se_sys_io_uring_register+0x55b/0xc50 io_uring/io_uring.c:4664
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
The buggy address belongs to the object at ffff888026a3e800
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 42 bytes inside of
freed 512-byte region [ffff888026a3e800, ffff888026a3ea00)
The buggy address belongs to the physical page:
page:ffffea00009a8f00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x26a3c
head:ffffea00009a8f00 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0
anon flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000840 ffff888017841c80 0000000000000000 dead000000000001
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 787, tgid 787 (kworker/0:2), ts 9851070885, free_ts 0
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x1cd/0x210 mm/page_alloc.c:1554
prep_new_page mm/page_alloc.c:1561 [inline]
get_page_from_freelist+0x195c/0x19f0 mm/page_alloc.c:3191
__alloc_pages+0x1e3/0x460 mm/page_alloc.c:4457
alloc_slab_page+0x5d/0x170 mm/slub.c:1876
allocate_slab mm/slub.c:2023 [inline]
new_slab+0x87/0x2e0 mm/slub.c:2076
___slab_alloc+0xc6d/0x12f0 mm/slub.c:3230
__slab_alloc mm/slub.c:3329 [inline]
__slab_alloc_node mm/slub.c:3382 [inline]
slab_alloc_node mm/slub.c:3475 [inline]
__kmem_cache_alloc_node+0x1a2/0x260 mm/slub.c:3524
kmalloc_trace+0x2a/0xe0 mm/slab_common.c:1098
kmalloc include/linux/slab.h:600 [inline]
kzalloc include/linux/slab.h:721 [inline]
device_private_init drivers/base/core.c:3528 [inline]
device_add+0xbe/0xc20 drivers/base/core.c:3579
device_create_groups_vargs drivers/base/core.c:4410 [inline]
device_create_with_groups+0x25d/0x2f0 drivers/base/core.c:4490
led_classdev_register_ext+0x430/0x940 drivers/leds/led-class.c:519
led_classdev_register include/linux/leds.h:279 [inline]
input_leds_connect+0x4eb/0x6b0 drivers/input/input-leds.c:139
input_attach_handler drivers/input/input.c:1064 [inline]
input_register_device+0xcdc/0x1070 drivers/input/input.c:2470
atkbd_connect+0x6fb/0x9a0 drivers/input/keyboard/atkbd.c:1342
serio_connect_driver drivers/input/serio/serio.c:44 [inline]
serio_driver_probe+0x7a/0xa0 drivers/input/serio/serio.c:775
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x25b/0xb40 drivers/base/dd.c:658
page_owner free stack trace missing
Memory state around the buggy address:
ffff888026a3e700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888026a3e780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888026a3e800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888026a3e880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888026a3e900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
vkms_vblank_simulate: vblank timer overrun
----------------
Code disassembly (best guess):
0: a8 0b test $0xb,%al
2: 00 00 add %al,(%rax)
4: 31 d2 xor %edx,%edx
6: e8 a5 06 fd f8 call 0xf8fd06b0
b: 2e 2e 2e 31 c0 cs cs cs xor %eax,%eax
10: 44 39 64 24 14 cmp %r12d,0x14(%rsp)
15: 74 5a je 0x71
17: 8b 5c 24 04 mov 0x4(%rsp),%ebx
1b: 89 d8 mov %ebx,%eax
1d: c1 e8 0a shr $0xa,%eax
20: 83 e0 40 and $0x40,%eax
23: 09 c3 or %eax,%ebx
25: e8 b6 69 25 f9 call 0xf92569e0
* 2a: 41 ff c4 inc %r12d <-- trapping instruction
2d: e9 bd fd ff ff jmp 0xfffffdef
32: e8 a9 69 25 f9 call 0xf92569e0
37: 41 bc a8 ff ff ff mov $0xffffffa8,%r12d
3d: e9 .byte 0xe9
3e: 52 push %rdx
3f: 01 .byte 0x1