==================================================================
BUG: KASAN: slab-use-after-free in __lock_acquire+0x11c/0x7f70 kernel/locking/lockdep.c:5004
Read of size 8 at addr ffff88801d4c0a00 by task swapper/1/0
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.6.0-rc5-syzkaller-00157-ge8c127b05766 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:364 [inline]
print_report+0x163/0x540 mm/kasan/report.c:475
kasan_report+0x175/0x1b0 mm/kasan/report.c:588
__lock_acquire+0x11c/0x7f70 kernel/locking/lockdep.c:5004
lock_acquire+0x1e3/0x520 kernel/locking/lockdep.c:5753
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162
class_raw_spinlock_irqsave_constructor include/linux/spinlock.h:518 [inline]
try_to_wake_up+0xb1/0x1300 kernel/sched/core.c:4230
call_timer_fn+0x17a/0x580 kernel/time/timer.c:1700
expire_timers kernel/time/timer.c:1751 [inline]
__run_timers+0x64f/0x860 kernel/time/timer.c:2022
run_timer_softirq+0x67/0xf0 kernel/time/timer.c:2035
__do_softirq+0x2ab/0x908 kernel/softirq.c:553
invoke_softirq kernel/softirq.c:427 [inline]
__irq_exit_rcu+0xf1/0x1b0 kernel/softirq.c:632
irq_exit_rcu+0x9/0x20 kernel/softirq.c:644
sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1074
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645
RIP: 0010:native_irq_disable arch/x86/include/asm/irqflags.h:37 [inline]
RIP: 0010:arch_local_irq_disable arch/x86/include/asm/irqflags.h:72 [inline]
RIP: 0010:acpi_safe_halt+0x20/0x30 drivers/acpi/processor_idle.c:113
Code: 7f 04 eb 36 66 0f 1f 44 00 00 65 48 8b 05 68 0c 35 75 48 f7 00 08 00 00 00 75 10 66 90 0f 00 2d f6 4e 94 00 f3 0f 1e fa fb f4 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 89 fa ec 48 8b 05
RSP: 0018:ffffc90000187d08 EFLAGS: 00000246
RAX: ffff888016a53b80 RBX: ffff8880146e8064 RCX: 000000000001cca1
RDX: 0000000000000001 RSI: ffff8880146e8000 RDI: ffff8880146e8064
RBP: 0000000000038df8 R08: ffff8880b9936bcb R09: 1ffff11017326d79
R10: dffffc0000000000 R11: ffffed1017326d7a R12: ffff888016302000
R13: 0000000000000000 R14: 0000000000000001 R15: ffffffff8da1daa0
acpi_idle_enter+0xe4/0x140 drivers/acpi/processor_idle.c:707
cpuidle_enter_state+0x10e/0x470 drivers/cpuidle/cpuidle.c:267
cpuidle_enter+0x5d/0x90 drivers/cpuidle/cpuidle.c:388
call_cpuidle kernel/sched/idle.c:134 [inline]
cpuidle_idle_call kernel/sched/idle.c:215 [inline]
do_idle+0x374/0x5c0 kernel/sched/idle.c:282
cpu_startup_entry+0x41/0x60 kernel/sched/idle.c:380
start_secondary+0xee/0xf0 arch/x86/kernel/smpboot.c:326
secondary_startup_64_no_verify+0x167/0x16b
Allocated by task 2:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4f/0x70 mm/kasan/common.c:52
__kasan_slab_alloc+0x66/0x70 mm/kasan/common.c:328
kasan_slab_alloc include/linux/kasan.h:188 [inline]
slab_post_alloc_hook+0x67/0x3d0 mm/slab.h:762
slab_alloc_node mm/slub.c:3478 [inline]
kmem_cache_alloc_node+0x148/0x330 mm/slub.c:3523
alloc_task_struct_node kernel/fork.c:173 [inline]
dup_task_struct+0x57/0x7d0 kernel/fork.c:1110
copy_process+0x5d1/0x41a0 kernel/fork.c:2327
kernel_clone+0x222/0x840 kernel/fork.c:2909
kernel_thread+0x1bc/0x230 kernel/fork.c:2971
create_kthread kernel/kthread.c:411 [inline]
kthreadd+0x60c/0x810 kernel/kthread.c:746
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
Freed by task 0:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4f/0x70 mm/kasan/common.c:52
kasan_save_free_info+0x28/0x40 mm/kasan/generic.c:522
____kasan_slab_free+0xd6/0x120 mm/kasan/common.c:236
kasan_slab_free include/linux/kasan.h:164 [inline]
slab_free_hook mm/slub.c:1800 [inline]
slab_free_freelist_hook mm/slub.c:1826 [inline]
slab_free mm/slub.c:3809 [inline]
kmem_cache_free+0x292/0x500 mm/slub.c:3831
put_task_struct include/linux/sched/task.h:136 [inline]
delayed_put_task_struct+0x115/0x2c0 kernel/exit.c:226
rcu_do_batch kernel/rcu/tree.c:2139 [inline]
rcu_core+0xacf/0x1790 kernel/rcu/tree.c:2403
__do_softirq+0x2ab/0x908 kernel/softirq.c:553
Last potentially related work creation:
kasan_save_stack+0x3f/0x60 mm/kasan/common.c:45
__kasan_record_aux_stack+0xad/0xc0 mm/kasan/generic.c:492
__call_rcu_common kernel/rcu/tree.c:2653 [inline]
call_rcu+0x167/0xa70 kernel/rcu/tree.c:2767
context_switch kernel/sched/core.c:5385 [inline]
__schedule+0x1974/0x4af0 kernel/sched/core.c:6695
schedule+0xc3/0x180 kernel/sched/core.c:6771
nilfs_segctor_kill_thread fs/nilfs2/segment.c:2679 [inline]
nilfs_segctor_destroy fs/nilfs2/segment.c:2761 [inline]
nilfs_detach_log_writer+0x2e8/0xbe0 fs/nilfs2/segment.c:2850
nilfs_put_super+0x4d/0x160 fs/nilfs2/super.c:499
generic_shutdown_super+0x13a/0x2c0 fs/super.c:693
kill_block_super+0x41/0x70 fs/super.c:1646
deactivate_locked_super+0xa4/0x110 fs/super.c:481
cleanup_mnt+0x426/0x4c0 fs/namespace.c:1254
task_work_run+0x24a/0x300 kernel/task_work.c:180
ptrace_notify+0x2cd/0x380 kernel/signal.c:2387
ptrace_report_syscall include/linux/ptrace.h:411 [inline]
ptrace_report_syscall_exit include/linux/ptrace.h:473 [inline]
syscall_exit_work kernel/entry/common.c:251 [inline]
syscall_exit_to_user_mode_prepare kernel/entry/common.c:278 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:283 [inline]
syscall_exit_to_user_mode+0x15c/0x280 kernel/entry/common.c:296
do_syscall_64+0x4d/0xc0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Second to last potentially related work creation:
kasan_save_stack+0x3f/0x60 mm/kasan/common.c:45
__kasan_record_aux_stack+0xad/0xc0 mm/kasan/generic.c:492
__call_rcu_common kernel/rcu/tree.c:2653 [inline]
call_rcu+0x167/0xa70 kernel/rcu/tree.c:2767
release_task+0x1656/0x16f0
wait_task_zombie kernel/exit.c:1210 [inline]
wait_consider_task+0x1a68/0x2ec0 kernel/exit.c:1437
do_wait_pid kernel/exit.c:1568 [inline]
do_wait+0x52d/0xb00 kernel/exit.c:1610
kernel_wait4+0x2a2/0x3e0 kernel/exit.c:1780
__do_sys_wait4 kernel/exit.c:1808 [inline]
__se_sys_wait4 kernel/exit.c:1804 [inline]
__x64_sys_wait4+0x134/0x1e0 kernel/exit.c:1804
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x41/0xc0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
The buggy address belongs to the object at ffff88801d4c0000
which belongs to the cache task_struct of size 7360
The buggy address is located 2560 bytes inside of
freed 7360-byte region [ffff88801d4c0000, ffff88801d4c1cc0)
The buggy address belongs to the physical page:
page:ffffea0000753000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1d4c0
head:ffffea0000753000 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
anon flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000840 ffff888014a43500 0000000000000000 dead000000000001
raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 43, tgid 43 (kworker/u4:3), ts 10356242719, free_ts 0
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x1e6/0x210 mm/page_alloc.c:1536
prep_new_page mm/page_alloc.c:1543 [inline]
get_page_from_freelist+0x31db/0x3360 mm/page_alloc.c:3170
__alloc_pages+0x255/0x670 mm/page_alloc.c:4426
alloc_slab_page+0x6a/0x160 mm/slub.c:1870
allocate_slab mm/slub.c:2017 [inline]
new_slab+0x84/0x2f0 mm/slub.c:2070
___slab_alloc+0xc85/0x1310 mm/slub.c:3223
__slab_alloc mm/slub.c:3322 [inline]
__slab_alloc_node mm/slub.c:3375 [inline]
slab_alloc_node mm/slub.c:3468 [inline]
kmem_cache_alloc_node+0x1e1/0x330 mm/slub.c:3523
alloc_task_struct_node kernel/fork.c:173 [inline]
dup_task_struct+0x57/0x7d0 kernel/fork.c:1110
copy_process+0x5d1/0x41a0 kernel/fork.c:2327
kernel_clone+0x222/0x840 kernel/fork.c:2909
user_mode_thread+0x132/0x190 kernel/fork.c:2987
call_usermodehelper_exec_work+0x5c/0x220 kernel/umh.c:172
process_one_work kernel/workqueue.c:2630 [inline]
process_scheduled_works+0x90f/0x1400 kernel/workqueue.c:2703
worker_thread+0xa5f/0xff0 kernel/workqueue.c:2784
kthread+0x2d3/0x370 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147
page_owner free stack trace missing
Memory state around the buggy address:
ffff88801d4c0900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88801d4c0980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88801d4c0a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88801d4c0a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88801d4c0b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess):
0: 7f 04 jg 0x6
2: eb 36 jmp 0x3a
4: 66 0f 1f 44 00 00 nopw 0x0(%rax,%rax,1)
a: 65 48 8b 05 68 0c 35 mov %gs:0x75350c68(%rip),%rax # 0x75350c7a
11: 75
12: 48 f7 00 08 00 00 00 testq $0x8,(%rax)
19: 75 10 jne 0x2b
1b: 66 90 xchg %ax,%ax
1d: 0f 00 2d f6 4e 94 00 verw 0x944ef6(%rip) # 0x944f1a
24: f3 0f 1e fa endbr64
28: fb sti
29: f4 hlt
* 2a: fa cli <-- trapping instruction
2b: c3 ret
2c: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1)
33: 00 00 00
36: 0f 1f 40 00 nopl 0x0(%rax)
3a: 89 fa mov %edi,%edx
3c: ec in (%dx),%al
3d: 48 rex.W
3e: 8b .byte 0x8b
3f: 05 .byte 0x5