================================================================== BUG: KASAN: use-after-free in class_equal+0x40/0x50 kernel/locking/lockdep.c:1574 Read of size 8 at addr ffff88807bf214b0 by task syz-executor.2/8704 CPU: 0 PID: 8704 Comm: syz-executor.2 Not tainted 5.2.0-rc5-next-20190617 #16 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: Allocated by task 2249468245: BUG: unable to handle page fault for address: ffffffff8c251c98 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page PGD 8c70067 P4D 8c70067 PUD 8c71063 PMD 0 Thread overran stack, or stack corrupted Oops: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 8704 Comm: syz-executor.2 Not tainted 5.2.0-rc5-next-20190617 #16 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:stack_depot_fetch+0x10/0x30 lib/stackdepot.c:203 ------------[ cut here ]------------ kernel BUG at mm/slab.c:4169! invalid opcode: 0000 [#2] PREEMPT SMP KASAN CPU: 0 PID: 8704 Comm: syz-executor.2 Not tainted 5.2.0-rc5-next-20190617 #16 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__check_heap_object+0xa5/0xb3 mm/slab.c:4169 Code: 2b 48 c7 c7 4d 46 83 88 e8 88 bd 07 00 5d c3 41 8b 91 3c 01 00 00 48 29 c7 48 39 d7 77 bd 48 01 d0 48 29 c8 4c 39 c0 72 b2 c3 <0f> 0b 48 c7 c7 4d 46 83 88 e8 9c c2 07 00 4c 8d 45 c4 89 d9 48 c7 RSP: 0018:ffff88807bf20168 EFLAGS: 00010097 RAX: 00000000000f0f0e RBX: 0000000000000002 RCX: 000000000000000c RDX: ffff88807bf20e80 RSI: 0000000000000000 RDI: ffff88807bf20220 RBP: ffff88807bf201b8 R08: 0000000000000002 R09: ffff8880aa58fc40 R10: 00000000e1e1d6f6 R11: 0000000000000001 R12: ffff88807bf20220 R13: ffffea0001efc800 R14: ffff88807bf20222 R15: 0000000000000001 FS: 0000555556dab940(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffff8c251c98 CR3: 00000000951bf000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: Modules linked in: ---[ end trace bbcf8cecba431a26 ]--- RIP: 0010:stack_depot_fetch+0x10/0x30 lib/stackdepot.c:203 Code: e9 7b fd ff ff 4c 89 ff e8 2d ae 62 fe e9 e6 fd ff ff 90 90 90 90 90 90 90 90 89 f8 c1 ef 11 25 ff ff 1f 00 81 e7 f0 3f 00 00 <48> 03 3c c5 a0 1c 25 8b 48 8d 47 18 48 89 06 8b 47 0c c3 0f 1f 00 RSP: 0018:ffff88807bf21298 EFLAGS: 00010006 RAX: 00000000001fffff RBX: ffff88807bf21e84 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffff88807bf212a0 RDI: 0000000000003ff0 RBP: ffff88807bf212b8 R08: 0000000000000020 R09: ffffed1015d044fa R10: ffffed1015d044f9 R11: ffff8880ae8227cf R12: ffffea0001efc800 R13: ffff88807bf214b0 R14: ffff8880aa58fc40 R15: ffff88807bf21e80 FS: 0000555556dab940(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffff8c251c98 CR3: 00000000951bf000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400