================================================================== BUG: KASAN: double-free or invalid-free in slab_free mm/slub.c:3509 [inline] BUG: KASAN: double-free or invalid-free in kfree+0xe0/0x3e4 mm/slub.c:4562 CPU: 0 PID: 3915 Comm: syz-executor.1 Not tainted 5.17.0-rc1-syzkaller-00002-g0966d385830d #0 Hardware name: riscv-virtio,qemu (DT) Call Trace: [] dump_backtrace+0x2e/0x3c arch/riscv/kernel/stacktrace.c:113 [] show_stack+0x34/0x40 arch/riscv/kernel/stacktrace.c:119 [] __dump_stack lib/dump_stack.c:88 [inline] [] dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:106 [] print_address_description.constprop.0+0x2a/0x330 mm/kasan/report.c:255 [] kasan_report_invalid_free+0x62/0x92 mm/kasan/report.c:381 [] ____kasan_slab_free+0x170/0x180 mm/kasan/common.c:346 [] __kasan_slab_free+0x10/0x18 mm/kasan/common.c:374 [] kasan_slab_free include/linux/kasan.h:236 [inline] [] slab_free_hook mm/slub.c:1728 [inline] [] slab_free_freelist_hook+0x8e/0x1cc mm/slub.c:1754 [] slab_free mm/slub.c:3509 [inline] [] kfree+0xe0/0x3e4 mm/slub.c:4562 [] gadgetfs_kill_sb+0x56/0x68 drivers/usb/gadget/legacy/inode.c:2088 [] deactivate_locked_super+0x9a/0x11a fs/super.c:332 [] vfs_get_super fs/super.c:1160 [inline] [] get_tree_single+0x11e/0x12e fs/super.c:1177 [] gadgetfs_get_tree+0x26/0x30 drivers/usb/gadget/legacy/inode.c:2067 [] vfs_get_tree+0x4a/0x19c fs/super.c:1497 [] do_new_mount fs/namespace.c:2994 [inline] [] path_mount+0xe9c/0x14dc fs/namespace.c:3324 [] do_mount fs/namespace.c:3337 [inline] [] __do_sys_mount fs/namespace.c:3545 [inline] [] sys_mount+0x360/0x3ee fs/namespace.c:3522 [] ret_from_syscall+0x0/0x2 Allocated by task 2066: stack_trace_save+0xa6/0xd8 kernel/stacktrace.c:122 kasan_save_stack+0x2c/0x58 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:436 [inline] ____kasan_kmalloc mm/kasan/common.c:515 [inline] ____kasan_kmalloc mm/kasan/common.c:474 [inline] __kasan_kmalloc+0x80/0xb2 mm/kasan/common.c:524 kasan_kmalloc include/linux/kasan.h:270 [inline] kmem_cache_alloc_trace+0x178/0x2e0 mm/slub.c:3257 kmalloc include/linux/slab.h:581 [inline] kzalloc include/linux/slab.h:715 [inline] apparmor_sk_alloc_security+0x70/0xca security/apparmor/lsm.c:792 security_sk_alloc+0x48/0x90 security/security.c:2255 sk_prot_alloc+0xb6/0x20e net/core/sock.c:1926 sk_alloc+0x34/0x602 net/core/sock.c:1976 inet_create net/ipv4/af_inet.c:319 [inline] inet_create+0x28c/0x964 net/ipv4/af_inet.c:245 __sock_create+0x322/0x646 net/socket.c:1468 sock_create net/socket.c:1519 [inline] __sys_socket+0xe4/0x1e0 net/socket.c:1561 __do_sys_socket net/socket.c:1570 [inline] sys_socket+0x2c/0x3a net/socket.c:1568 ret_from_syscall+0x0/0x2 Freed by task 3916: stack_trace_save+0xa6/0xd8 kernel/stacktrace.c:122 kasan_save_stack+0x2c/0x58 mm/kasan/common.c:38 kasan_set_track+0x1a/0x26 mm/kasan/common.c:45 kasan_set_free_info+0x1e/0x3a mm/kasan/generic.c:370 ____kasan_slab_free mm/kasan/common.c:366 [inline] ____kasan_slab_free+0x15e/0x180 mm/kasan/common.c:328 __kasan_slab_free+0x10/0x18 mm/kasan/common.c:374 kasan_slab_free include/linux/kasan.h:236 [inline] slab_free_hook mm/slub.c:1728 [inline] slab_free_freelist_hook+0x8e/0x1cc mm/slub.c:1754 slab_free mm/slub.c:3509 [inline] kfree+0xe0/0x3e4 mm/slub.c:4562 gadgetfs_kill_sb+0x56/0x68 drivers/usb/gadget/legacy/inode.c:2088 deactivate_locked_super+0x9a/0x11a fs/super.c:332 deactivate_super fs/super.c:363 [inline] deactivate_super+0x80/0x94 fs/super.c:359 cleanup_mnt+0x220/0x2c0 fs/namespace.c:1143 __cleanup_mnt+0x1c/0x26 fs/namespace.c:1150 task_work_run+0xdc/0x154 kernel/task_work.c:164 tracehook_notify_resume include/linux/tracehook.h:188 [inline] do_notify_resume+0x894/0xa56 arch/riscv/kernel/signal.c:320 ret_from_exception+0x0/0x10 Last potentially related work creation: stack_trace_save+0xa6/0xd8 kernel/stacktrace.c:122 kasan_save_stack+0x2c/0x58 mm/kasan/common.c:38 __kasan_record_aux_stack+0xc4/0xdc mm/kasan/generic.c:348 kasan_record_aux_stack_noalloc+0xe/0x16 mm/kasan/generic.c:358 kvfree_call_rcu+0x8e/0x440 kernel/rcu/tree.c:3591 memcg_update_list_lru_node mm/list_lru.c:411 [inline] memcg_update_list_lru mm/list_lru.c:467 [inline] memcg_update_all_list_lrus+0x2d0/0x5c6 mm/list_lru.c:501 memcg_alloc_cache_id mm/memcontrol.c:2964 [inline] memcg_online_kmem mm/memcontrol.c:3635 [inline] mem_cgroup_css_alloc+0xa86/0xc60 mm/memcontrol.c:5225 css_create kernel/cgroup/cgroup.c:5299 [inline] cgroup_apply_control_enable+0x2c0/0x654 kernel/cgroup/cgroup.c:3124 cgroup_mkdir+0x388/0x9e6 kernel/cgroup/cgroup.c:5517 kernfs_iop_mkdir+0xc8/0xfa fs/kernfs/dir.c:1169 vfs_mkdir+0x110/0x202 fs/namei.c:3933 do_mkdirat+0x22e/0x262 fs/namei.c:3959 __do_sys_mkdirat fs/namei.c:3974 [inline] sys_mkdirat+0x88/0xb2 fs/namei.c:3972 ret_from_syscall+0x0/0x2 The buggy address belongs to the object at ffffaf80072eb0e0 which belongs to the cache kmalloc-16 of size 16 The buggy address is located 0 bytes inside of 16-byte region [ffffaf80072eb0e0, ffffaf80072eb0f0) The buggy address belongs to the page: page:ffffaf807a84e218 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x874eb flags: 0x8000000200(slab|section=16|node=0|zone=0) raw: 0000008000000200 0000000000000100 0000000000000122 ffffaf80072013c0 raw: 0000000000000000 0000000080800080 00000001ffffffff 0000000000000000 raw: 00000000000007ff page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x0(), pid 1, ts 1244986300, free_ts 0 stack_trace_save+0xa6/0xd8 kernel/stacktrace.c:122 create_dummy_stack mm/page_owner.c:59 [inline] register_early_stack+0x8a/0xcc mm/page_owner.c:75 init_page_owner+0x8a/0x5cc mm/page_owner.c:87 invoke_init_callbacks mm/page_ext.c:112 [inline] page_ext_init+0x4e6/0x50c mm/page_ext.c:419 page_owner free stack trace missing Memory state around the buggy address: ffffaf80072eaf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffffaf80072eb000: 00 00 fc fc 00 00 fc fc 00 00 fc fc 00 01 fc fc >ffffaf80072eb080: 00 07 fc fc 00 00 fc fc fa fb fc fc fa fb fc fc ^ ffffaf80072eb100: fb fb fc fc fb fb fc fc 00 00 fc fc 00 00 fc fc ffffaf80072eb180: 00 04 fc fc 00 01 fc fc fa fb fc fc fb fb fc fc ==================================================================