==================================================================
BUG: KASAN: use-after-free in __lock_acquire+0x79/0x1f60 kernel/locking/lockdep.c:4925
Read of size 8 at addr ffff888020a60970 by task swapper/0/0
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.1.0-syzkaller-13781-gaeba12b26c79 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1b1/0x290 lib/dump_stack.c:106
print_address_description+0x74/0x340 mm/kasan/report.c:306
print_report+0x107/0x1f0 mm/kasan/report.c:417
kasan_report+0xcd/0x100 mm/kasan/report.c:517
__lock_acquire+0x79/0x1f60 kernel/locking/lockdep.c:4925
lock_acquire+0x182/0x3c0 kernel/locking/lockdep.c:5668
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xb3/0x100 kernel/locking/spinlock.c:162
try_to_wake_up+0x9c/0xab0 kernel/sched/core.c:4100
call_timer_fn+0xf5/0x210 kernel/time/timer.c:1700
expire_timers kernel/time/timer.c:1751 [inline]
__run_timers+0x77c/0x9a0 kernel/time/timer.c:2022
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:2035
__do_softirq+0x277/0x738 kernel/softirq.c:571
__irq_exit_rcu+0xcf/0x150 kernel/softirq.c:650
irq_exit_rcu+0x5/0x20 kernel/softirq.c:662
sysvec_apic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1107
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:29 [inline]
RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:70 [inline]
RIP: 0010:arch_irqs_disabled arch/x86/include/asm/irqflags.h:130 [inline]
RIP: 0010:acpi_safe_halt drivers/acpi/processor_idle.c:113 [inline]
RIP: 0010:acpi_idle_do_entry drivers/acpi/processor_idle.c:570 [inline]
RIP: 0010:acpi_idle_enter+0x43d/0x7e0 drivers/acpi/processor_idle.c:707
Code: ff e8 57 59 e2 f6 48 83 e3 08 44 8b 7c 24 04 0f 85 e8 00 00 00 e8 f3 06 e9 f6 66 90 e8 7c 54 e2 f6 0f 00 2d 65 79 ad 00 fb f4 <9c> 8f 44 24 40 4c 89 e0 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 e7
RSP: 0018:ffffffff8d007b80 EFLAGS: 000002d3
RAX: ffffffff8aa98674 RBX: 0000000000000000 RCX: ffffffff8d0bb7c0
RDX: 0000000000000000 RSI: ffffffff8aedbae0 RDI: ffffffff8b4bc020
RBP: ffffffff8d007c30 R08: ffffffff8aa98659 R09: fffffbfff1a176f9
R10: fffffbfff1a176f9 R11: 1ffffffff1a176f8 R12: ffffffff8d007bc0
R13: dffffc0000000000 R14: ffff88813fe7a000 R15: 0000000000000001
cpuidle_enter_state+0x50a/0xf10 drivers/cpuidle/cpuidle.c:239
cpuidle_enter+0x59/0x90 drivers/cpuidle/cpuidle.c:356
call_cpuidle kernel/sched/idle.c:155 [inline]
cpuidle_idle_call kernel/sched/idle.c:236 [inline]
do_idle+0x3b9/0x640 kernel/sched/idle.c:303
cpu_startup_entry+0x15/0x20 kernel/sched/idle.c:400
rest_init+0x24f/0x270 init/main.c:732
arch_call_rest_init+0xa/0x10 init/main.c:894
start_kernel+0x471/0x520 init/main.c:1148
secondary_startup_64_no_verify+0xcf/0xdb
Allocated by task 2:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x3d/0x60 mm/kasan/common.c:52
__kasan_slab_alloc+0x65/0x70 mm/kasan/common.c:325
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slab.h:761 [inline]
slab_alloc_node mm/slub.c:3452 [inline]
kmem_cache_alloc_node+0x1dc/0x390 mm/slub.c:3497
alloc_task_struct_node kernel/fork.c:171 [inline]
dup_task_struct+0x4e/0x490 kernel/fork.c:979
copy_process+0x53c/0x3f00 kernel/fork.c:2097
kernel_clone+0x21b/0x630 kernel/fork.c:2681
kernel_thread+0x150/0x1d0 kernel/fork.c:2741
create_kthread kernel/kthread.c:399 [inline]
kthreadd+0x57c/0x750 kernel/kthread.c:746
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
Freed by task 5153:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x3d/0x60 mm/kasan/common.c:52
kasan_save_free_info+0x27/0x40 mm/kasan/generic.c:518
____kasan_slab_free+0xd6/0x120 mm/kasan/common.c:236
kasan_slab_free include/linux/kasan.h:177 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook+0x12e/0x1a0 mm/slub.c:1807
slab_free mm/slub.c:3787 [inline]
kmem_cache_free+0x94/0x1d0 mm/slub.c:3809
rcu_do_batch kernel/rcu/tree.c:2244 [inline]
rcu_core+0x9c1/0x1690 kernel/rcu/tree.c:2504
__do_softirq+0x277/0x738 kernel/softirq.c:571
Last potentially related work creation:
kasan_save_stack+0x2b/0x50 mm/kasan/common.c:45
__kasan_record_aux_stack+0xb0/0xc0 mm/kasan/generic.c:488
__call_rcu_common kernel/rcu/tree.c:2753 [inline]
call_rcu+0x163/0xa70 kernel/rcu/tree.c:2866
context_switch kernel/sched/core.c:5247 [inline]
__schedule+0x99d/0xe20 kernel/sched/core.c:6555
preempt_schedule_irq+0xe3/0x190 kernel/sched/core.c:6867
irqentry_exit+0x53/0x80 kernel/entry/common.c:432
asm_sysvec_reschedule_ipi+0x16/0x20 arch/x86/include/asm/idtentry.h:654
Second to last potentially related work creation:
kasan_save_stack+0x2b/0x50 mm/kasan/common.c:45
__kasan_record_aux_stack+0xb0/0xc0 mm/kasan/generic.c:488
__call_rcu_common kernel/rcu/tree.c:2753 [inline]
call_rcu+0x163/0xa70 kernel/rcu/tree.c:2866
context_switch kernel/sched/core.c:5247 [inline]
__schedule+0x99d/0xe20 kernel/sched/core.c:6555
schedule_idle+0x50/0x90 kernel/sched/core.c:6659
do_idle+0x5f3/0x640 kernel/sched/idle.c:331
cpu_startup_entry+0x15/0x20 kernel/sched/idle.c:400
rest_init+0x24f/0x270 init/main.c:732
arch_call_rest_init+0xa/0x10 init/main.c:894
start_kernel+0x471/0x520 init/main.c:1148
secondary_startup_64_no_verify+0xcf/0xdb
The buggy address belongs to the object at ffff888020a60000
which belongs to the cache task_struct of size 7232
The buggy address is located 2416 bytes inside of
7232-byte region [ffff888020a60000, ffff888020a61c40)
The buggy address belongs to the physical page:
page:ffffea0000829800 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x20a60
head:ffffea0000829800 order:3 compound_mapcount:0 subpages_mapcount:0 compound_pincount:0
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 ffff888140007500 dead000000000100 dead000000000122
raw: 0000000000000000 0000000080040004 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 68, tgid 68 (kworker/u4:4), ts 6744747304, free_ts 0
prep_new_page mm/page_alloc.c:2531 [inline]
get_page_from_freelist+0x742/0x7c0 mm/page_alloc.c:4283
__alloc_pages+0x259/0x560 mm/page_alloc.c:5549
alloc_slab_page+0xbd/0x190 mm/slub.c:1851
allocate_slab+0x5e/0x3c0 mm/slub.c:1998
new_slab mm/slub.c:2051 [inline]
___slab_alloc+0x782/0xe20 mm/slub.c:3193
__slab_alloc mm/slub.c:3292 [inline]
__slab_alloc_node mm/slub.c:3345 [inline]
slab_alloc_node mm/slub.c:3442 [inline]
kmem_cache_alloc_node+0x297/0x390 mm/slub.c:3497
alloc_task_struct_node kernel/fork.c:171 [inline]
dup_task_struct+0x4e/0x490 kernel/fork.c:979
copy_process+0x53c/0x3f00 kernel/fork.c:2097
kernel_clone+0x21b/0x630 kernel/fork.c:2681
user_mode_thread+0x12d/0x190 kernel/fork.c:2757
call_usermodehelper_exec_work+0x57/0x220 kernel/umh.c:175
process_one_work+0x877/0xdb0 kernel/workqueue.c:2289
worker_thread+0xb14/0x1330 kernel/workqueue.c:2436
kthread+0x266/0x300 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
page_owner free stack trace missing
Memory state around the buggy address:
ffff888020a60800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888020a60880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888020a60900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888020a60980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888020a60a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess), 1 bytes skipped:
0: e8 57 59 e2 f6 callq 0xf6e2595c
5: 48 83 e3 08 and $0x8,%rbx
9: 44 8b 7c 24 04 mov 0x4(%rsp),%r15d
e: 0f 85 e8 00 00 00 jne 0xfc
14: e8 f3 06 e9 f6 callq 0xf6e9070c
19: 66 90 xchg %ax,%ax
1b: e8 7c 54 e2 f6 callq 0xf6e2549c
20: 0f 00 2d 65 79 ad 00 verw 0xad7965(%rip) # 0xad798c
27: fb sti
28: f4 hlt
* 29: 9c pushfq <-- trapping instruction
2a: 8f 44 24 40 popq 0x40(%rsp)
2e: 4c 89 e0 mov %r12,%rax
31: 48 c1 e8 03 shr $0x3,%rax
35: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1)
3a: 74 08 je 0x44
3c: 4c 89 e7 mov %r12,%rdi