================================================================== BUG: KASAN: use-after-free in __hlist_del include/linux/list.h:829 [inline] BUG: KASAN: use-after-free in hlist_del_init include/linux/list.h:857 [inline] BUG: KASAN: use-after-free in dentry_unlink_inode+0x3c0/0x3d0 fs/dcache.c:365 Write of size 8 at addr ffff888200000000 by task syz-executor.1/6973 CPU: 1 PID: 6973 Comm: syz-executor.1 Not tainted 5.9.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x198/0x1fd lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xae/0x497 mm/kasan/report.c:383 __kasan_report mm/kasan/report.c:513 [inline] kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530 __hlist_del include/linux/list.h:829 [inline] hlist_del_init include/linux/list.h:857 [inline] dentry_unlink_inode+0x3c0/0x3d0 fs/dcache.c:365 __dentry_kill+0x3c0/0x640 fs/dcache.c:579 shrink_dentry_list+0x144/0x480 fs/dcache.c:1141 shrink_dcache_parent+0x219/0x3c0 fs/dcache.c:1568 d_invalidate fs/dcache.c:1677 [inline] d_invalidate+0x13f/0x280 fs/dcache.c:1662 proc_invalidate_siblings_dcache+0x43b/0x600 fs/proc/inode.c:150 release_task+0xc63/0x14d0 kernel/exit.c:221 wait_task_zombie kernel/exit.c:1088 [inline] wait_consider_task+0x2fd2/0x3b70 kernel/exit.c:1315 do_wait_thread kernel/exit.c:1378 [inline] do_wait+0x376/0xa00 kernel/exit.c:1449 kernel_wait4+0x14c/0x260 kernel/exit.c:1621 __do_sys_wait4+0x13f/0x150 kernel/exit.c:1649 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x41723b Code: 54 55 41 89 d4 53 48 89 f5 89 fb 48 83 ec 10 e8 1b f9 ff ff 45 31 d2 41 89 c0 49 63 d4 48 89 ee 48 63 fb b8 3d 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 19 44 89 c7 89 44 24 0c e8 51 f9 ff ff 8b 44 RSP: 002b:000000000169fd80 EFLAGS: 00000246 ORIG_RAX: 000000000000003d RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 000000000041723b RDX: 0000000040000001 RSI: 000000000169fde0 RDI: ffffffffffffffff RBP: 000000000169fde0 R08: 0000000000000000 R09: 0000000001b34940 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000040000001 R13: 000000000169fde0 R14: 00000000001d8097 R15: 000000000169fdf0 The buggy address belongs to the page: page:000000007a937d95 refcount:0 mapcount:-128 mapping:0000000000000000 index:0xffff888200000000 pfn:0x200000 flags: 0x57ffe0000000000() raw: 057ffe0000000000 ffffea0008010008 ffffea0008028008 0000000000000000 raw: ffff888200000000 0000000000000007 00000000ffffff7f 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8881ffffff00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8881ffffff80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888200000000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff888200000080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888200000100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ==================================================================