list_del corruption. prev->next should be ffff88801c439048, but was ffff888017bb5048. (prev=ffff88802163d048) ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:62! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 14844 Comm: syz-executor.3 Not tainted 6.6.0-syzkaller-14651-gd2f51b3516da #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 RIP: 0010:__list_del_entry_valid_or_report+0x11f/0x1b0 lib/list_debug.c:62 Code: 83 2e 8b e8 43 98 03 fd 0f 0b 48 89 ca 48 c7 c7 c0 83 2e 8b e8 32 98 03 fd 0f 0b 48 89 c2 48 c7 c7 20 84 2e 8b e8 21 98 03 fd <0f> 0b 48 89 d1 48 c7 c7 a0 84 2e 8b 48 89 c2 e8 0d 98 03 fd 0f 0b RSP: 0018:ffffc90005747d60 EFLAGS: 00010082 RAX: 000000000000006d RBX: ffff88801c438000 RCX: ffffffff816b6ea9 RDX: 0000000000000000 RSI: ffffffff816c0332 RDI: 0000000000000005 RBP: ffff888023431820 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000080000001 R11: 00000000000c6358 R12: 0000000000000246 R13: ffff88801c439048 R14: ffff88801c439008 R15: ffff88801c439050 FS: 00007fc4ad5fe6c0(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fc4ad5bcd58 CR3: 000000007bd9d000 CR4: 0000000000350ef0 Call Trace: __list_del_entry_valid include/linux/list.h:124 [inline] __list_del_entry include/linux/list.h:215 [inline] list_del include/linux/list.h:229 [inline] ptp_release+0xc4/0x2b0 drivers/ptp/ptp_chardev.c:147 posix_clock_release+0xa4/0x160 kernel/time/posix-clock.c:157 __fput+0x270/0xbb0 fs/file_table.c:394 task_work_run+0x14d/0x240 kernel/task_work.c:180 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline] exit_to_user_mode_loop kernel/entry/common.c:171 [inline] exit_to_user_mode_prepare+0x215/0x240 kernel/entry/common.c:204 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x1d/0x60 kernel/entry/common.c:296 do_syscall_64+0x4b/0x110 arch/x86/entry/common.c:88 entry_SYSCALL_64_after_hwframe+0x63/0x6b RIP: 0033:0x7fc4aea7cae9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fc4ad5fe0c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffea RBX: 00007fc4aeb9bf80 RCX: 00007fc4aea7cae9 RDX: 000000000004c100 RSI: 0000000020000300 RDI: ffffffffffffff9c RBP: 00007fc4aeac847a R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 000000000000000b R14: 00007fc4aeb9bf80 R15: 00007ffdd212fb58 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:__list_del_entry_valid_or_report+0x11f/0x1b0 lib/list_debug.c:62 Code: 83 2e 8b e8 43 98 03 fd 0f 0b 48 89 ca 48 c7 c7 c0 83 2e 8b e8 32 98 03 fd 0f 0b 48 89 c2 48 c7 c7 20 84 2e 8b e8 21 98 03 fd <0f> 0b 48 89 d1 48 c7 c7 a0 84 2e 8b 48 89 c2 e8 0d 98 03 fd 0f 0b RSP: 0018:ffffc90005747d60 EFLAGS: 00010082 RAX: 000000000000006d RBX: ffff88801c438000 RCX: ffffffff816b6ea9 RDX: 0000000000000000 RSI: ffffffff816c0332 RDI: 0000000000000005 RBP: ffff888023431820 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000080000001 R11: 00000000000c6358 R12: 0000000000000246 R13: ffff88801c439048 R14: ffff88801c439008 R15: ffff88801c439050 FS: 00007fc4ad5fe6c0(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fc4ad5bcd58 CR3: 000000007bd9d000 CR4: 0000000000350ef0