================================================================== BUG: KASAN: use-after-free in d_inode include/linux/dcache.h:516 [inline] BUG: KASAN: use-after-free in relay_switch_subbuf+0x837/0x900 kernel/relay.c:676 Read of size 8 at addr ffff888048c8d670 by task ksoftirqd/1/21 CPU: 1 PID: 21 Comm: ksoftirqd/1 Not tainted 5.19.0-rc5-syzkaller-00233-gb1c428b6c368 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0xeb/0x495 mm/kasan/report.c:313 print_report mm/kasan/report.c:429 [inline] kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491 d_inode include/linux/dcache.h:516 [inline] relay_switch_subbuf+0x837/0x900 kernel/relay.c:676 relay_reserve include/linux/relay.h:248 [inline] trace_note+0x5af/0x720 kernel/trace/blktrace.c:95 trace_note_tsk kernel/trace/blktrace.c:126 [inline] __blk_add_trace+0xbfb/0xdf0 kernel/trace/blktrace.c:267 blk_add_trace_rq+0x392/0x490 kernel/trace/blktrace.c:845 trace_block_rq_complete include/trace/events/block.h:147 [inline] blk_update_request+0x924/0x1310 block/blk-mq.c:788 blk_mq_end_request+0x4b/0x80 block/blk-mq.c:944 lo_complete_rq+0x1c2/0x280 drivers/block/loop.c:370 blk_complete_reqs+0xad/0xe0 block/blk-mq.c:1015 __do_softirq+0x29b/0x9c2 kernel/softirq.c:571 run_ksoftirqd kernel/softirq.c:934 [inline] run_ksoftirqd+0x2d/0x60 kernel/softirq.c:926 smpboot_thread_fn+0x645/0x9c0 kernel/smpboot.c:164 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302 Allocated by task 13045: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:436 [inline] __kasan_slab_alloc+0x90/0xc0 mm/kasan/common.c:469 kasan_slab_alloc include/linux/kasan.h:224 [inline] slab_post_alloc_hook mm/slab.h:750 [inline] slab_alloc_node mm/slub.c:3243 [inline] slab_alloc mm/slub.c:3251 [inline] __kmem_cache_alloc_lru mm/slub.c:3258 [inline] kmem_cache_alloc_lru+0x31a/0x720 mm/slub.c:3275 __d_alloc+0x32/0x960 fs/dcache.c:1769 d_alloc+0x4a/0x230 fs/dcache.c:1849 d_alloc_name+0x80/0xb0 fs/dcache.c:1911 binderfs_binder_ctl_create drivers/android/binderfs.c:459 [inline] binderfs_fill_super+0xeba/0x1540 drivers/android/binderfs.c:754 vfs_get_super fs/super.c:1139 [inline] get_tree_nodev+0xcd/0x1d0 fs/super.c:1169 vfs_get_tree+0x89/0x2f0 fs/super.c:1497 do_new_mount fs/namespace.c:3040 [inline] path_mount+0x1320/0x1fa0 fs/namespace.c:3370 do_mount fs/namespace.c:3383 [inline] __do_sys_mount fs/namespace.c:3591 [inline] __se_sys_mount fs/namespace.c:3568 [inline] __x64_sys_mount+0x27f/0x300 fs/namespace.c:3568 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Last potentially related work creation: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 __kasan_record_aux_stack+0xbe/0xd0 mm/kasan/generic.c:348 call_rcu+0x99/0x790 kernel/rcu/tree.c:3126 dentry_free+0xc3/0x160 fs/dcache.c:377 __dentry_kill+0x4cb/0x640 fs/dcache.c:621 shrink_dentry_list+0x23c/0x800 fs/dcache.c:1201 shrink_dcache_parent+0x1fe/0x3c0 fs/dcache.c:1628 do_one_tree fs/dcache.c:1682 [inline] shrink_dcache_for_umount+0x71/0x330 fs/dcache.c:1699 generic_shutdown_super+0x68/0x400 fs/super.c:444 kill_anon_super fs/super.c:1056 [inline] kill_litter_super+0x6e/0xa0 fs/super.c:1065 deactivate_locked_super+0x94/0x160 fs/super.c:332 deactivate_super+0xad/0xd0 fs/super.c:363 cleanup_mnt+0x3a2/0x540 fs/namespace.c:1186 task_work_run+0xdd/0x1a0 kernel/task_work.c:177 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0xaff/0x2a00 kernel/exit.c:795 do_group_exit+0xd2/0x2f0 kernel/exit.c:925 __do_sys_exit_group kernel/exit.c:936 [inline] __se_sys_exit_group kernel/exit.c:934 [inline] __x64_sys_exit_group+0x3a/0x50 kernel/exit.c:934 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Second to last potentially related work creation: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 __kasan_record_aux_stack+0xbe/0xd0 mm/kasan/generic.c:348 call_rcu+0x99/0x790 kernel/rcu/tree.c:3126 dentry_free+0xc3/0x160 fs/dcache.c:377 __dentry_kill+0x4cb/0x640 fs/dcache.c:621 dentry_kill fs/dcache.c:745 [inline] dput+0x64d/0xdb0 fs/dcache.c:913 do_unlinkat+0x3dc/0x650 fs/namei.c:4263 __do_sys_unlink fs/namei.c:4308 [inline] __se_sys_unlink fs/namei.c:4306 [inline] __x64_sys_unlink+0xc6/0x110 fs/namei.c:4306 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 The buggy address belongs to the object at ffff888048c8d608 which belongs to the cache dentry of size 312 The buggy address is located 104 bytes inside of 312-byte region [ffff888048c8d608, ffff888048c8d740) The buggy address belongs to the physical page: page:ffffea0001232300 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888048c8d318 pfn:0x48c8c head:ffffea0001232300 order:1 compound_mapcount:0 compound_pincount:0 memcg:ffff88804b677b01 flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000010200 ffffea0001d07d08 ffffea0001235888 ffff888140007640 raw: ffff888048c8d318 0000000000150011 00000001ffffffff ffff88804b677b01 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 1, migratetype Reclaimable, gfp_mask 0x1d20d0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL|__GFP_RECLAIMABLE), pid 10973, tgid 10973 (udevd), ts 330217988823, free_ts 212193457983 prep_new_page mm/page_alloc.c:2456 [inline] get_page_from_freelist+0x1290/0x3b70 mm/page_alloc.c:4198 __alloc_pages+0x1c7/0x510 mm/page_alloc.c:5426 alloc_pages+0x1aa/0x310 mm/mempolicy.c:2272 alloc_slab_page mm/slub.c:1824 [inline] allocate_slab+0x26c/0x3c0 mm/slub.c:1969 new_slab mm/slub.c:2029 [inline] ___slab_alloc+0x9c4/0xe20 mm/slub.c:3031 __slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3118 slab_alloc_node mm/slub.c:3209 [inline] slab_alloc mm/slub.c:3251 [inline] __kmem_cache_alloc_lru mm/slub.c:3258 [inline] kmem_cache_alloc_lru+0x504/0x720 mm/slub.c:3275 __d_alloc+0x32/0x960 fs/dcache.c:1769 d_alloc+0x4a/0x230 fs/dcache.c:1849 d_alloc_parallel+0xe7/0x1af0 fs/dcache.c:2601 lookup_open.isra.0+0xb66/0x1690 fs/namei.c:3298 open_last_lookups fs/namei.c:3444 [inline] path_openat+0x9a2/0x2910 fs/namei.c:3650 do_filp_open+0x1aa/0x400 fs/namei.c:3680 do_sys_openat2+0x16d/0x4c0 fs/open.c:1278 do_sys_open fs/open.c:1294 [inline] __do_sys_openat fs/open.c:1310 [inline] __se_sys_openat fs/open.c:1305 [inline] __x64_sys_openat+0x13f/0x1f0 fs/open.c:1305 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1371 [inline] free_pcp_prepare+0x549/0xd20 mm/page_alloc.c:1421 free_unref_page_prepare mm/page_alloc.c:3343 [inline] free_unref_page+0x19/0x6a0 mm/page_alloc.c:3438 qlink_free mm/kasan/quarantine.c:168 [inline] qlist_free_all+0x6a/0x170 mm/kasan/quarantine.c:187 kasan_quarantine_reduce+0x180/0x200 mm/kasan/quarantine.c:294 __kasan_slab_alloc+0xa2/0xc0 mm/kasan/common.c:446 kasan_slab_alloc include/linux/kasan.h:224 [inline] slab_post_alloc_hook mm/slab.h:750 [inline] slab_alloc_node mm/slub.c:3243 [inline] slab_alloc mm/slub.c:3251 [inline] __kmem_cache_alloc_lru mm/slub.c:3258 [inline] kmem_cache_alloc_lru+0x255/0x720 mm/slub.c:3275 alloc_inode_sb include/linux/fs.h:2965 [inline] alloc_inode+0x168/0x230 fs/inode.c:262 new_inode_pseudo fs/inode.c:1018 [inline] new_inode+0x27/0x2f0 fs/inode.c:1047 ramfs_get_inode+0x29/0x3b0 fs/ramfs/inode.c:60 ramfs_mknod+0x52/0x130 fs/ramfs/inode.c:101 lookup_open.isra.0+0x10cc/0x1690 fs/namei.c:3374 open_last_lookups fs/namei.c:3444 [inline] path_openat+0x9a2/0x2910 fs/namei.c:3650 do_filp_open+0x1aa/0x400 fs/namei.c:3680 do_sys_openat2+0x16d/0x4c0 fs/open.c:1278 do_sys_open fs/open.c:1294 [inline] __do_sys_creat fs/open.c:1370 [inline] __se_sys_creat fs/open.c:1364 [inline] __x64_sys_creat+0xc9/0x120 fs/open.c:1364 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 Memory state around the buggy address: ffff888048c8d500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888048c8d580: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc >ffff888048c8d600: fc fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888048c8d680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888048c8d700: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ==================================================================