device bridge_slave_0 left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state ================================================================== BUG: KASAN: use-after-free in relay_switch_subbuf+0x8be/0x920 kernel/relay.c:755 Read of size 8 at addr ffff888096796058 by task syz-executor.2/21625 CPU: 0 PID: 21625 Comm: syz-executor.2 Not tainted 4.19.82 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x172/0x1f0 lib/dump_stack.c:113 print_address_description.cold+0x7c/0x20d mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report mm/kasan/report.c:412 [inline] kasan_report.cold+0x8c/0x2ba mm/kasan/report.c:396 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433 relay_switch_subbuf+0x8be/0x920 kernel/relay.c:755 relay_reserve include/linux/relay.h:261 [inline] trace_note.isra.0+0x5b8/0x6e0 kernel/trace/blktrace.c:93 trace_note_tsk kernel/trace/blktrace.c:124 [inline] __blk_add_trace+0xb70/0xe10 kernel/trace/blktrace.c:264 blk_add_trace_rq+0x192/0x210 kernel/trace/blktrace.c:818 blk_add_trace_rq_complete+0x153/0x1b0 kernel/trace/blktrace.c:847 trace_block_rq_complete include/trace/events/block.h:116 [inline] blk_update_request+0x79d/0xb30 block/blk-core.c:3085 scsi_end_request+0x82/0xb70 drivers/scsi/scsi_lib.c:673 scsi_io_completion+0x2a5/0x1980 drivers/scsi/scsi_lib.c:1102 scsi_finish_command+0x3b7/0x670 drivers/scsi/scsi.c:248 scsi_softirq_done+0x344/0x3e0 drivers/scsi/scsi_lib.c:1758 __blk_mq_complete_request block/blk-mq.c:583 [inline] blk_mq_complete_request+0x3b6/0x670 block/blk-mq.c:620 scsi_mq_done+0x96/0x300 drivers/scsi/scsi_lib.c:2069 virtscsi_complete_cmd+0x566/0x730 drivers/scsi/virtio_scsi.c:207 virtscsi_vq_done+0xc9/0x180 drivers/scsi/virtio_scsi.c:223 virtscsi_req_done+0xa4/0xd0 drivers/scsi/virtio_scsi.c:238 vring_interrupt+0x127/0x170 drivers/virtio/virtio_ring.c:950 __handle_irq_event_percpu+0x144/0x8f0 kernel/irq/handle.c:149 handle_irq_event_percpu+0x74/0x160 kernel/irq/handle.c:189 handle_irq_event+0xa7/0x134 kernel/irq/handle.c:206 handle_edge_irq+0x25e/0x8d0 kernel/irq/chip.c:797 generic_handle_irq_desc include/linux/irqdesc.h:155 [inline] handle_irq+0x39/0x50 arch/x86/kernel/irq_64.c:87 do_IRQ+0x99/0x1d0 arch/x86/kernel/irq.c:246 common_interrupt+0xf/0xf arch/x86/entry/entry_64.S:670 RIP: 0033:0x40f241 Code: e0 48 89 f8 25 ff 1f 00 00 89 3c 85 00 00 73 00 83 c5 01 e8 41 29 ff ff 41 83 c7 01 45 39 7c 24 04 76 3e 44 89 f8 49 8b 34 c6 <4a> 8d 04 2e 48 3d ff ff ff 7e 0f 86 77 ff ff ff bf f9 f9 4b 00 31 RSP: 002b:00007ffde83066b0 EFLAGS: 00000206 ORIG_RAX: ffffffffffffffdc RAX: 0000000000025e9f RBX: 00000000d8888d56 RCX: 0000001b33220000 RDX: 000000005ac9d3f3 RSI: ffffffff83347113 RDI: ffffffff5ac9d3f3 RBP: 0000000000000271 R08: 000000005ac9d3f3 R09: 000000005ac9d3f7 R10: 00007ffde8306820 R11: 0000000000000246 R12: 000000000075bfa8 R13: 0000000080000000 R14: 00007fdb2a7df008 R15: 0000000000025e9f Allocated by task 18398: save_stack+0x45/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc mm/kasan/kasan.c:553 [inline] kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:531 kasan_slab_alloc+0xf/0x20 mm/kasan/kasan.c:490 kmem_cache_alloc+0x12e/0x700 mm/slab.c:3559 __d_alloc+0x2e/0x9c0 fs/dcache.c:1610 d_alloc+0x4d/0x280 fs/dcache.c:1694 d_alloc_parallel+0xf4/0x1bb0 fs/dcache.c:2441 __lookup_slow+0x1ab/0x500 fs/namei.c:1654 lookup_one_len+0x16d/0x1a0 fs/namei.c:2543 start_creating fs/debugfs/inode.c:313 [inline] start_creating+0xbf/0x1e0 fs/debugfs/inode.c:289 __debugfs_create_file+0x65/0x400 fs/debugfs/inode.c:352 debugfs_create_file+0x5a/0x70 fs/debugfs/inode.c:404 kvm_create_vm_debugfs arch/x86/kvm/../../../virt/kvm/kvm_main.c:620 [inline] kvm_dev_ioctl_create_vm arch/x86/kvm/../../../virt/kvm/kvm_main.c:3245 [inline] kvm_dev_ioctl+0x9ed/0x1710 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3272 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:501 [inline] do_vfs_ioctl+0xd5f/0x1380 fs/ioctl.c:688 ksys_ioctl+0xab/0xd0 fs/ioctl.c:705 __do_sys_ioctl fs/ioctl.c:712 [inline] __se_sys_ioctl fs/ioctl.c:710 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:710 do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 18: save_stack+0x45/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528 __cache_free mm/slab.c:3503 [inline] kmem_cache_free+0x86/0x260 mm/slab.c:3765 __d_free+0x20/0x30 fs/dcache.c:257 __rcu_reclaim kernel/rcu/rcu.h:236 [inline] rcu_do_batch kernel/rcu/tree.c:2584 [inline] invoke_rcu_callbacks kernel/rcu/tree.c:2897 [inline] __rcu_process_callbacks kernel/rcu/tree.c:2864 [inline] rcu_process_callbacks+0xba0/0x1a30 kernel/rcu/tree.c:2881 __do_softirq+0x25c/0x921 kernel/softirq.c:292 The buggy address belongs to the object at ffff888096796000 which belongs to the cache dentry(65:syz5) of size 288 The buggy address is located 88 bytes inside of 288-byte region [ffff888096796000, ffff888096796120) The buggy address belongs to the page: page:ffffea000259e580 count:1 mapcount:0 mapping:ffff88808d001a80 index:0xffff888096796580 flags: 0x1fffc0000000100(slab) raw: 01fffc0000000100 ffffea0000d400c8 ffffea0000d40308 ffff88808d001a80 raw: ffff888096796580 ffff888096796000 0000000100000008 ffff88808d252b80 page dumped because: kasan: bad access detected page->mem_cgroup:ffff88808d252b80 Memory state around the buggy address: ffff888096795f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888096795f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888096796000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888096796080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888096796100: fb fb fb fb fc fc fc fc fc fc fc fc fb fb fb fb ==================================================================