================================================================== BUG: KASAN: use-after-free in __list_del_entry_valid+0xe0/0xf0 lib/list_debug.c:51 Read of size 8 at addr ffff888018a67bb0 by task syz-executor326/8992 CPU: 0 PID: 8992 Comm: syz-executor326 Not tainted 5.17.0-rc2-syzkaller-00039-g9f7fb8de5d9b #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0x8d/0x336 mm/kasan/report.c:255 __kasan_report mm/kasan/report.c:442 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:459 __list_del_entry_valid+0xe0/0xf0 lib/list_debug.c:51 __list_del_entry include/linux/list.h:134 [inline] list_del include/linux/list.h:148 [inline] hidraw_release+0xd5/0x370 drivers/hid/hidraw.c:353 __fput+0x286/0x9f0 fs/file_table.c:311 task_work_run+0xdd/0x1a0 kernel/task_work.c:164 exit_task_work include/linux/task_work.h:32 [inline] do_exit+0xb29/0x2a30 kernel/exit.c:806 do_group_exit+0xd2/0x2f0 kernel/exit.c:935 __do_sys_exit_group kernel/exit.c:946 [inline] __se_sys_exit_group kernel/exit.c:944 [inline] __x64_sys_exit_group+0x3a/0x50 kernel/exit.c:944 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f0bdf357749 Code: Unable to access opcode bytes at RIP 0x7f0bdf35771f. RSP: 002b:00007ffd565b0f08 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 00007f0bdf3cc3f0 RCX: 00007f0bdf357749 RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 00007ffd565b0f80 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f0bdf3cc3f0 R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001 Allocated by task 4297: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:436 [inline] ____kasan_kmalloc mm/kasan/common.c:515 [inline] ____kasan_kmalloc mm/kasan/common.c:474 [inline] __kasan_kmalloc+0xa9/0xd0 mm/kasan/common.c:524 kmalloc include/linux/slab.h:581 [inline] kzalloc include/linux/slab.h:715 [inline] hidraw_connect+0x4b/0x440 drivers/hid/hidraw.c:543 hid_connect+0x5be/0xbc0 drivers/hid/hid-core.c:1960 hid_hw_start drivers/hid/hid-core.c:2059 [inline] hid_hw_start+0xa2/0x130 drivers/hid/hid-core.c:2050 hid_generic_probe drivers/hid/hid-generic.c:67 [inline] hid_generic_probe+0x6d/0x90 drivers/hid/hid-generic.c:56 hid_device_probe+0x2bd/0x3f0 drivers/hid/hid-core.c:2380 call_driver_probe drivers/base/dd.c:517 [inline] really_probe+0x245/0xcc0 drivers/base/dd.c:596 __driver_probe_device+0x338/0x4d0 drivers/base/dd.c:752 driver_probe_device+0x4c/0x1a0 drivers/base/dd.c:782 __device_attach_driver+0x20b/0x2f0 drivers/base/dd.c:899 bus_for_each_drv+0x15f/0x1e0 drivers/base/bus.c:427 __device_attach+0x228/0x4a0 drivers/base/dd.c:970 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:487 device_add+0xc17/0x1ee0 drivers/base/core.c:3405 hid_add_device+0x344/0x9d0 drivers/hid/hid-core.c:2530 uhid_device_add_worker+0x36/0x60 drivers/hid/uhid.c:73 process_one_work+0x9ac/0x1650 kernel/workqueue.c:2307 worker_thread+0x657/0x1110 kernel/workqueue.c:2454 kthread+0x2e9/0x3a0 kernel/kthread.c:377 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Freed by task 8986: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track+0x21/0x30 mm/kasan/common.c:45 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370 ____kasan_slab_free mm/kasan/common.c:366 [inline] ____kasan_slab_free+0x130/0x160 mm/kasan/common.c:328 kasan_slab_free include/linux/kasan.h:236 [inline] slab_free_hook mm/slub.c:1728 [inline] slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1754 slab_free mm/slub.c:3509 [inline] kfree+0xcb/0x280 mm/slub.c:4562 drop_ref+0x28f/0x390 drivers/hid/hidraw.c:335 hidraw_disconnect+0x48/0x60 drivers/hid/hidraw.c:599 hid_disconnect+0x130/0x1a0 drivers/hid/hid-core.c:2036 hid_hw_stop drivers/hid/hid-core.c:2079 [inline] hid_device_remove+0x15d/0x200 drivers/hid/hid-core.c:2411 __device_release_driver+0x3bd/0x700 drivers/base/dd.c:1204 device_release_driver_internal drivers/base/dd.c:1237 [inline] device_release_driver+0x26/0x40 drivers/base/dd.c:1260 bus_remove_device+0x2eb/0x5a0 drivers/base/bus.c:529 device_del+0x502/0xd50 drivers/base/core.c:3592 hid_remove_device drivers/hid/hid-core.c:2578 [inline] hid_destroy_device+0xe1/0x150 drivers/hid/hid-core.c:2597 uhid_dev_destroy drivers/hid/uhid.c:587 [inline] uhid_char_release+0xed/0x210 drivers/hid/uhid.c:663 __fput+0x286/0x9f0 fs/file_table.c:311 task_work_run+0xdd/0x1a0 kernel/task_work.c:164 exit_task_work include/linux/task_work.h:32 [inline] do_exit+0xb29/0x2a30 kernel/exit.c:806 do_group_exit+0xd2/0x2f0 kernel/exit.c:935 __do_sys_exit_group kernel/exit.c:946 [inline] __se_sys_exit_group kernel/exit.c:944 [inline] __x64_sys_exit_group+0x3a/0x50 kernel/exit.c:944 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Last potentially related work creation: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 __kasan_record_aux_stack+0xbe/0xd0 mm/kasan/generic.c:348 insert_work+0x48/0x370 kernel/workqueue.c:1368 __queue_work+0x5ca/0xf30 kernel/workqueue.c:1534 queue_work_on+0xee/0x110 kernel/workqueue.c:1562 queue_work include/linux/workqueue.h:502 [inline] call_usermodehelper_exec+0x1f0/0x4c0 kernel/umh.c:435 kobject_uevent_env+0xf47/0x1600 lib/kobject_uevent.c:618 kset_register+0x185/0x1e0 lib/kobject.c:881 __class_register+0x210/0x4a0 drivers/base/class.c:188 fc_transport_init+0x76/0xe7 drivers/scsi/scsi_transport_fc.c:959 do_one_initcall+0x103/0x650 init/main.c:1300 do_initcall_level init/main.c:1373 [inline] do_initcalls init/main.c:1389 [inline] do_basic_setup init/main.c:1408 [inline] kernel_init_freeable+0x6b1/0x73a init/main.c:1613 kernel_init+0x1a/0x1d0 init/main.c:1502 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 The buggy address belongs to the object at ffff888018a67b00 which belongs to the cache kmalloc-192 of size 192 The buggy address is located 176 bytes inside of 192-byte region [ffff888018a67b00, ffff888018a67bc0) The buggy address belongs to the page: page:ffffea00006299c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x18a67 flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000200 ffffea00005b2380 dead000000000004 ffff888010c41a00 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 5, ts 8125621459, free_ts 8082543887 prep_new_page mm/page_alloc.c:2434 [inline] get_page_from_freelist+0xa72/0x2f50 mm/page_alloc.c:4165 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5389 __alloc_pages_node include/linux/gfp.h:572 [inline] alloc_slab_page mm/slub.c:1801 [inline] allocate_slab mm/slub.c:1944 [inline] new_slab+0xab/0x3b0 mm/slub.c:2004 ___slab_alloc+0x87c/0xe90 mm/slub.c:3018 __slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3105 slab_alloc_node mm/slub.c:3196 [inline] kmem_cache_alloc_node_trace+0x116/0x310 mm/slub.c:3280 kmalloc_node include/linux/slab.h:599 [inline] kzalloc_node include/linux/slab.h:726 [inline] alloc_worker+0x43/0x1c0 kernel/workqueue.c:1858 create_worker+0xd1/0x530 kernel/workqueue.c:1955 maybe_create_worker kernel/workqueue.c:2125 [inline] manage_workers kernel/workqueue.c:2177 [inline] worker_thread+0xaee/0x1110 kernel/workqueue.c:2426 kthread+0x2e9/0x3a0 kernel/kthread.c:377 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1352 [inline] free_pcp_prepare+0x374/0x870 mm/page_alloc.c:1404 free_unref_page_prepare mm/page_alloc.c:3325 [inline] free_unref_page+0x19/0x690 mm/page_alloc.c:3404 __vunmap+0x798/0xc50 mm/vmalloc.c:2635 free_work+0x58/0x70 mm/vmalloc.c:97 process_one_work+0x9ac/0x1650 kernel/workqueue.c:2307 worker_thread+0x657/0x1110 kernel/workqueue.c:2454 kthread+0x2e9/0x3a0 kernel/kthread.c:377 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Memory state around the buggy address: ffff888018a67a80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc ffff888018a67b00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888018a67b80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ^ ffff888018a67c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888018a67c80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ==================================================================