------------[ cut here ]------------ WARNING: CPU: 0 PID: 4279 at mm/slab_common.c:923 free_large_kmalloc+0x34/0x15c mm/slab_common.c:924 Modules linked in: CPU: 0 PID: 4279 Comm: syz-executor.2 Not tainted 6.1.34-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : free_large_kmalloc+0x34/0x15c mm/slab_common.c:924 lr : kfree+0x10c/0x1b8 mm/slab_common.c:1001 sp : ffff80001de077a0 x29: ffff80001de077a0 x28: ffff0000d2c6b600 x27: dfff800000000000 x26: 1fffe0001a58d6c5 x25: 0000000000000002 x24: ffff0000d2c6b620 x23: ffff0000df5d9ff0 x22: dfff800000000000 x21: ffff80000880c87c x20: ffff0001565b0000 x19: fffffc0005596c00 x18: ffff80001de07634 x17: ffff8000155bd000 x16: ffff8000121062b4 x15: 0000000000000000 x14: 1ffff00002ab80b0 x13: ffff700003bc0ec0 x12: 000000000000000f x11: ff80800008098054 x10: 0000000000000000 x9 : 0000000005596c00 x8 : ffff800017ed6000 x7 : 0000000000000000 x6 : 000000000000003f x5 : 0000000000000040 x4 : 0000000000000000 x3 : 0000000000000030 x2 : 0000000000000008 x1 : ffff0001565b0000 x0 : fffffc0005596c00 Call trace: free_large_kmalloc+0x34/0x15c mm/slab_common.c:924 kfree+0x10c/0x1b8 mm/slab_common.c:1001 diUnmount+0xf4/0x10c fs/jfs/jfs_imap.c:195 jfs_umount+0x110/0x338 fs/jfs/jfs_umount.c:63 jfs_put_super+0x90/0x188 fs/jfs/super.c:194 generic_shutdown_super+0x130/0x328 fs/super.c:501 kill_block_super+0x70/0xdc fs/super.c:1450 deactivate_locked_super+0xac/0x124 fs/super.c:332 deactivate_super+0xf0/0x110 fs/super.c:363 cleanup_mnt+0x394/0x41c fs/namespace.c:1186 __cleanup_mnt+0x20/0x30 fs/namespace.c:1193 task_work_run+0x240/0x2f0 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] do_notify_resume+0x2144/0x3470 arch/arm64/kernel/signal.c:1132 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline] exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline] el0_svc+0x9c/0x168 arch/arm64/kernel/entry-common.c:638 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581 irq event stamp: 31741098 hardirqs last enabled at (31741097): [] call_rcu+0x614/0xa40 kernel/rcu/tree.c:2834 hardirqs last disabled at (31741098): [] el1_dbg+0x24/0x80 arch/arm64/kernel/entry-common.c:405 softirqs last enabled at (31740740): [] local_bh_enable+0x10/0x34 include/linux/bottom_half.h:32 softirqs last disabled at (31740738): [] local_bh_disable+0x10/0x34 include/linux/bottom_half.h:19 ---[ end trace 0000000000000000 ]--- object pointer: 0x00000000c1e55446 ================================================================== BUG: KASAN: double-free in kfree+0x10c/0x1b8 mm/slab_common.c:1001 Free of addr ffff0001565b0000 by task syz-executor.2/4279 CPU: 0 PID: 4279 Comm: syz-executor.2 Tainted: G W 6.1.34-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023 Call trace: dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:284 [inline] print_report+0x174/0x4c0 mm/kasan/report.c:395 kasan_report_invalid_free+0xc4/0x114 mm/kasan/report.c:460 __kasan_kfree_large+0xa4/0xc0 mm/kasan/common.c:272 kasan_kfree_large include/linux/kasan.h:185 [inline] free_large_kmalloc+0x70/0x15c mm/slab_common.c:927 kfree+0x10c/0x1b8 mm/slab_common.c:1001 diUnmount+0xf4/0x10c fs/jfs/jfs_imap.c:195 jfs_umount+0x110/0x338 fs/jfs/jfs_umount.c:63 jfs_put_super+0x90/0x188 fs/jfs/super.c:194 generic_shutdown_super+0x130/0x328 fs/super.c:501 kill_block_super+0x70/0xdc fs/super.c:1450 deactivate_locked_super+0xac/0x124 fs/super.c:332 deactivate_super+0xf0/0x110 fs/super.c:363 cleanup_mnt+0x394/0x41c fs/namespace.c:1186 __cleanup_mnt+0x20/0x30 fs/namespace.c:1193 task_work_run+0x240/0x2f0 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] do_notify_resume+0x2144/0x3470 arch/arm64/kernel/signal.c:1132 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline] exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline] el0_svc+0x9c/0x168 arch/arm64/kernel/entry-common.c:638 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581 The buggy address belongs to the physical page: page:000000000c88b910 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1965b0 flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000000000 fffffc0003738208 fffffc00040e4e08 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0001565aff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff0001565aff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff0001565b0000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff0001565b0080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff0001565b0100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== page:000000000c88b910 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1965b0 head:000000000c88b910 order:3 compound_mapcount:0 compound_pincount:0 flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000010200 0000000000000000 dead000000000122 ffff0000c0002a80 raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000 page dumped because: VM_BUG_ON_FOLIO(folio_test_slab(folio)) ------------[ cut here ]------------ kernel BUG at include/linux/memcontrol.h:379! Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 4279 Comm: syz-executor.2 Tainted: G B W 6.1.34-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023 pstate: 804000c5 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __folio_memcg include/linux/memcontrol.h:379 [inline] pc : folio_memcg+0x148/0x174 include/linux/memcontrol.h:432 lr : __folio_memcg include/linux/memcontrol.h:379 [inline] lr : folio_memcg+0x148/0x174 include/linux/memcontrol.h:432 sp : ffff80001de07710 x29: ffff80001de07710 x28: ffff0000d2c6b600 x27: dfff800000000000 x26: 1fffe0001a58d6c5 x25: 0000000000000002 x24: dfff800000000000 x23: 1fffff8000ab2d81 x22: dfff800000000000 x21: 0000000000000000 x20: fffffc0005596c08 x19: fffffc0005596c00 x18: 1fffe000368b5f76 x17: 0000000000000000 x16: ffff8000121062b4 x15: 0000000000000000 x14: 0000000000000000 x13: 00000000000a4a18 x12: 0000000000000001 x11: ff80800008830644 x10: 0000000000000000 x9 : ffff800008830644 x8 : ffff0000c6c80000 x7 : 00000000000a4a18 x6 : 00000000000a49c0 x5 : ffff80001de06f98 x4 : ffff800015673748 x3 : ffff8000085879f4 x2 : 0000000000000001 x1 : 0000000100000000 x0 : 000000000000003c Call trace: __folio_memcg include/linux/memcontrol.h:379 [inline] folio_memcg+0x148/0x174 include/linux/memcontrol.h:432 page_memcg include/linux/memcontrol.h:437 [inline] __mod_lruvec_page_state+0x110/0x2ec mm/memcontrol.c:833 mod_lruvec_page_state include/linux/vmstat.h:562 [inline] free_large_kmalloc+0xa8/0x15c mm/slab_common.c:930 kfree+0x10c/0x1b8 mm/slab_common.c:1001 diUnmount+0xf4/0x10c fs/jfs/jfs_imap.c:195 jfs_umount+0x110/0x338 fs/jfs/jfs_umount.c:63 jfs_put_super+0x90/0x188 fs/jfs/super.c:194 generic_shutdown_super+0x130/0x328 fs/super.c:501 kill_block_super+0x70/0xdc fs/super.c:1450 deactivate_locked_super+0xac/0x124 fs/super.c:332 deactivate_super+0xf0/0x110 fs/super.c:363 cleanup_mnt+0x394/0x41c fs/namespace.c:1186 __cleanup_mnt+0x20/0x30 fs/namespace.c:1193 task_work_run+0x240/0x2f0 kernel/task_work.c:179 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] do_notify_resume+0x2144/0x3470 arch/arm64/kernel/signal.c:1132 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline] exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline] el0_svc+0x9c/0x168 arch/arm64/kernel/entry-common.c:638 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:581 Code: d004ca41 91320021 aa1303e0 97f9c811 (d4210000) ---[ end trace 0000000000000000 ]---