==================================================================
BUG: KASAN: slab-use-after-free in instrument_atomic_read include/linux/instrumented.h:68 [inline]
BUG: KASAN: slab-use-after-free in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
BUG: KASAN: slab-use-after-free in work_is_static_object+0x1a/0x50 kernel/workqueue.c:615
Read of size 8 at addr ffff888106742160 by task modprobe/15316
CPU: 0 UID: 0 PID: 15316 Comm: modprobe Not tainted 6.14.0-rc1-syzkaller-g9682c35ff6ec #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xc3/0x620 mm/kasan/report.c:489
kasan_report+0xd9/0x110 mm/kasan/report.c:602
check_region_inline mm/kasan/generic.c:183 [inline]
kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189
instrument_atomic_read include/linux/instrumented.h:68 [inline]
_test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
work_is_static_object+0x1a/0x50 kernel/workqueue.c:615
lookup_object_or_alloc.part.0+0x416/0x590 lib/debugobjects.c:679
lookup_object_or_alloc lib/debugobjects.c:665 [inline]
debug_object_activate+0x31a/0x4a0 lib/debugobjects.c:820
debug_work_activate kernel/workqueue.c:664 [inline]
insert_work+0x2e/0x230 kernel/workqueue.c:2180
__queue_work+0x97e/0x1080 kernel/workqueue.c:2339
call_timer_fn+0x1a0/0x610 kernel/time/timer.c:1789
expire_timers kernel/time/timer.c:1835 [inline]
__run_timers+0x56a/0x930 kernel/time/timer.c:2414
__run_timer_base kernel/time/timer.c:2426 [inline]
__run_timer_base kernel/time/timer.c:2418 [inline]
run_timer_base+0x114/0x190 kernel/time/timer.c:2435
run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2445
handle_softirqs+0x206/0x8d0 kernel/softirq.c:561
__do_softirq kernel/softirq.c:595 [inline]
invoke_softirq kernel/softirq.c:435 [inline]
__irq_exit_rcu+0xfa/0x160 kernel/softirq.c:662
irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0x90/0xb0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:mt_locked lib/maple_tree.c:796 [inline]
RIP: 0010:mt_slot lib/maple_tree.c:803 [inline]
RIP: 0010:mas_slot lib/maple_tree.c:836 [inline]
RIP: 0010:mas_prev_slot+0x414/0x2000 lib/maple_tree.c:4532
Code: 04 02 84 c0 74 08 3c 03 0f 8e d1 1a 00 00 8b 45 40 bf 00 03 00 00 25 00 03 00 00 89 c6 89 44 24 18 e8 10 0d 6c fa 8b 44 24 18 <3d> 00 03 00 00 0f 85 f0 00 00 00 e8 fc 11 6c fa 48 89 ea 48 b8 00
RSP: 0018:ffffc9001305f618 EFLAGS: 00000293
RAX: 0000000000000300 RBX: ffff8881314081c0 RCX: ffffffff870f1c60
RDX: ffff88813b878000 RSI: 0000000000000300 RDI: 0000000000000005
RBP: ffff888117b96b80 R08: 0000000000000005 R09: 0000000000000300
R10: 0000000000000300 R11: 00000000000024df R12: ffff88813197d200
R13: 0000000000000001 R14: ffff88813197d280 R15: ffffc9001305f780
mas_prev lib/maple_tree.c:5840 [inline]
mas_prev+0xe2/0xf0 lib/maple_tree.c:5833
vma_prev include/linux/mm.h:1032 [inline]
find_mergeable_anon_vma+0x15a/0x850 mm/vma.c:1869
__anon_vma_prepare+0xc7/0x5e0 mm/rmap.c:199
__vmf_anon_prepare+0x11c/0x240 mm/memory.c:3389
vmf_anon_prepare mm/internal.h:372 [inline]
do_cow_fault mm/memory.c:5412 [inline]
do_fault mm/memory.c:5528 [inline]
do_pte_missing mm/memory.c:4047 [inline]
handle_pte_fault mm/memory.c:5889 [inline]
__handle_mm_fault+0x75c/0x3450 mm/memory.c:6032
handle_mm_fault+0x3fa/0xaa0 mm/memory.c:6201
do_user_addr_fault+0x79f/0x12c0 arch/x86/mm/fault.c:1388
handle_page_fault arch/x86/mm/fault.c:1480 [inline]
exc_page_fault+0x5c/0xc0 arch/x86/mm/fault.c:1538
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0010:rep_stos_alternative+0x40/0x80 arch/x86/lib/clear_page_64.S:96
Code: ff c7 48 ff c9 75 f6 c3 cc cc cc cc 48 89 07 48 83 c7 08 83 e9 08 74 ef 83 f9 08 73 ef eb de 66 66 2e 0f 1f 84 00 00 00 00 00 <48> 89 07 48 89 47 08 48 89 47 10 48 89 47 18 48 89 47 20 48 89 47
RSP: 0018:ffffc9001305fbc8 EFLAGS: 00050206
RAX: 0000000000000000 RBX: ffff8881141c4918 RCX: 0000000000000ff8
RDX: ffff88813b878000 RSI: ffffffff81f62cc0 RDI: 0000555a39a5c008
RBP: 0000555a39a5c008 R08: 0000000000000000 R09: fffffbfff14ad6d2
R10: ffffffff8a56b697 R11: 0000000000000000 R12: 0000000000000008
R13: 0000555a39a5b000 R14: ffff8881141c4938 R15: 00007ffffffff000
__clear_user arch/x86/include/asm/uaccess_64.h:188 [inline]
clear_user arch/x86/include/asm/uaccess_64.h:205 [inline]
padzero fs/binfmt_elf.c:125 [inline]
elf_load+0x6b5/0x880 fs/binfmt_elf.c:427
load_elf_binary+0xc5f/0x4f00 fs/binfmt_elf.c:1173
search_binary_handler fs/exec.c:1775 [inline]
exec_binprm fs/exec.c:1807 [inline]
bprm_execve fs/exec.c:1859 [inline]
bprm_execve+0x8dd/0x1680 fs/exec.c:1835
kernel_execve+0x2ef/0x3b0 fs/exec.c:2026
call_usermodehelper_exec_async+0x255/0x4c0 kernel/umh.c:109
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Allocated by task 1121:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:260 [inline]
__do_kmalloc_node mm/slub.c:4294 [inline]
__kmalloc_node_track_caller_noprof+0x20b/0x4c0 mm/slub.c:4313
alloc_dr drivers/base/devres.c:119 [inline]
devm_kmalloc+0xa5/0x260 drivers/base/devres.c:843
devm_kzalloc include/linux/device.h:328 [inline]
corsair_void_probe+0x57/0xd70 drivers/hid/hid-corsair-void.c:637
__hid_device_probe drivers/hid/hid-core.c:2713 [inline]
hid_device_probe+0x349/0x700 drivers/hid/hid-core.c:2750
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x23e/0xa90 drivers/base/dd.c:658
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:800
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:830
__device_attach_driver+0x1df/0x310 drivers/base/dd.c:958
bus_for_each_drv+0x157/0x1e0 drivers/base/bus.c:462
__device_attach+0x1e8/0x4b0 drivers/base/dd.c:1030
bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:537
device_add+0x114b/0x1a70 drivers/base/core.c:3665
hid_add_device+0x374/0xa60 drivers/hid/hid-core.c:2896
usbhid_probe+0xd32/0x1400 drivers/hid/usbhid/hid-core.c:1431
usb_probe_interface+0x300/0x9c0 drivers/usb/core/driver.c:396
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x23e/0xa90 drivers/base/dd.c:658
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:800
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:830
__device_attach_driver+0x1df/0x310 drivers/base/dd.c:958
bus_for_each_drv+0x157/0x1e0 drivers/base/bus.c:462
__device_attach+0x1e8/0x4b0 drivers/base/dd.c:1030
bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:537
device_add+0x114b/0x1a70 drivers/base/core.c:3665
usb_set_configuration+0x10cb/0x1c50 drivers/usb/core/message.c:2210
usb_generic_driver_probe+0xb1/0x110 drivers/usb/core/generic.c:250
usb_probe_device+0xec/0x3e0 drivers/usb/core/driver.c:291
call_driver_probe drivers/base/dd.c:579 [inline]
really_probe+0x23e/0xa90 drivers/base/dd.c:658
__driver_probe_device+0x1de/0x440 drivers/base/dd.c:800
driver_probe_device+0x4c/0x1b0 drivers/base/dd.c:830
__device_attach_driver+0x1df/0x310 drivers/base/dd.c:958
bus_for_each_drv+0x157/0x1e0 drivers/base/bus.c:462
__device_attach+0x1e8/0x4b0 drivers/base/dd.c:1030
bus_probe_device+0x17f/0x1c0 drivers/base/bus.c:537
device_add+0x114b/0x1a70 drivers/base/core.c:3665
usb_new_device+0xd09/0x1a20 drivers/usb/core/hub.c:2652
hub_port_connect drivers/usb/core/hub.c:5523 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5663 [inline]
port_event drivers/usb/core/hub.c:5823 [inline]
hub_event+0x2e58/0x4f40 drivers/usb/core/hub.c:5905
process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3236
process_scheduled_works kernel/workqueue.c:3317 [inline]
worker_thread+0x6c8/0xf00 kernel/workqueue.c:3398
kthread+0x3af/0x750 kernel/kthread.c:464
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Freed by task 5293:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x37/0x50 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2353 [inline]
slab_free mm/slub.c:4609 [inline]
kfree+0x294/0x480 mm/slub.c:4757
release_nodes+0x11e/0x240 drivers/base/devres.c:506
devres_release_group+0x1be/0x2a0 drivers/base/devres.c:689
hid_device_remove+0x107/0x260 drivers/hid/hid-core.c:2774
device_remove+0xc8/0x170 drivers/base/dd.c:567
__device_release_driver drivers/base/dd.c:1273 [inline]
device_release_driver_internal+0x44a/0x610 drivers/base/dd.c:1296
bus_remove_device+0x22f/0x420 drivers/base/bus.c:579
device_del+0x396/0x9f0 drivers/base/core.c:3854
hid_remove_device drivers/hid/hid-core.c:2953 [inline]
hid_destroy_device+0x19c/0x240 drivers/hid/hid-core.c:2975
usbhid_disconnect+0xa0/0xe0 drivers/hid/usbhid/hid-core.c:1458
usb_unbind_interface+0x1e2/0x960 drivers/usb/core/driver.c:458
device_remove drivers/base/dd.c:569 [inline]
device_remove+0x122/0x170 drivers/base/dd.c:561
__device_release_driver drivers/base/dd.c:1273 [inline]
device_release_driver_internal+0x44a/0x610 drivers/base/dd.c:1296
bus_remove_device+0x22f/0x420 drivers/base/bus.c:579
device_del+0x396/0x9f0 drivers/base/core.c:3854
usb_disable_device+0x36c/0x7f0 drivers/usb/core/message.c:1418
usb_disconnect+0x2e1/0x920 drivers/usb/core/hub.c:2305
hub_port_connect drivers/usb/core/hub.c:5363 [inline]
hub_port_connect_change drivers/usb/core/hub.c:5663 [inline]
port_event drivers/usb/core/hub.c:5823 [inline]
hub_event+0x1bed/0x4f40 drivers/usb/core/hub.c:5905
process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3236
process_scheduled_works kernel/workqueue.c:3317 [inline]
worker_thread+0x6c8/0xf00 kernel/workqueue.c:3398
kthread+0x3af/0x750 kernel/kthread.c:464
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Last potentially related work creation:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_record_aux_stack+0x9b/0xb0 mm/kasan/generic.c:548
insert_work+0x36/0x230 kernel/workqueue.c:2183
__queue_work+0x97e/0x1080 kernel/workqueue.c:2339
call_timer_fn+0x1a0/0x610 kernel/time/timer.c:1789
expire_timers kernel/time/timer.c:1835 [inline]
__run_timers+0x56a/0x930 kernel/time/timer.c:2414
__run_timer_base kernel/time/timer.c:2426 [inline]
__run_timer_base kernel/time/timer.c:2418 [inline]
run_timer_base+0x114/0x190 kernel/time/timer.c:2435
run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2445
handle_softirqs+0x206/0x8d0 kernel/softirq.c:561
__do_softirq kernel/softirq.c:595 [inline]
invoke_softirq kernel/softirq.c:435 [inline]
__irq_exit_rcu+0xfa/0x160 kernel/softirq.c:662
irq_exit_rcu+0x9/0x30 kernel/softirq.c:678
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0x90/0xb0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
The buggy address belongs to the object at ffff888106742000
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 352 bytes inside of
freed 1024-byte region [ffff888106742000, ffff888106742400)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x106740
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
anon flags: 0x200000000000040(head|node=0|zone=2)
page_type: f5(slab)
raw: 0200000000000040 ffff888100041dc0 0000000000000000 dead000000000001
raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 0200000000000040 ffff888100041dc0 0000000000000000 dead000000000001
head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000
head: 0200000000000003 ffffea000419d001 ffffffffffffffff 0000000000000000
head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x252800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_THISNODE), pid 1, tgid 1 (swapper/0), ts 5455815546, free_ts 0
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x181/0x1b0 mm/page_alloc.c:1551
prep_new_page mm/page_alloc.c:1559 [inline]
get_page_from_freelist+0xe76/0x2b90 mm/page_alloc.c:3477
__alloc_frozen_pages_noprof+0x21c/0x2290 mm/page_alloc.c:4739
alloc_slab_page mm/slub.c:2425 [inline]
allocate_slab mm/slub.c:2587 [inline]
new_slab+0x94/0x330 mm/slub.c:2640
___slab_alloc+0xc41/0x1670 mm/slub.c:3826
__slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3916
__slab_alloc_node mm/slub.c:3991 [inline]
slab_alloc_node mm/slub.c:4152 [inline]
__kmalloc_cache_node_noprof+0x21b/0x3f0 mm/slub.c:4333
kmalloc_node_noprof include/linux/slab.h:924 [inline]
blk_mq_alloc_hctx block/blk-mq.c:3945 [inline]
blk_mq_alloc_and_init_hctx+0x639/0x11b0 block/blk-mq.c:4448
blk_mq_realloc_hw_ctxs+0x8e0/0xbe0 block/blk-mq.c:4481
blk_mq_init_allocated_queue+0x39e/0x11f0 block/blk-mq.c:4535
blk_mq_alloc_queue+0x1c3/0x290 block/blk-mq.c:4348
scsi_alloc_sdev+0x890/0xd80 drivers/scsi/scsi_scan.c:338
scsi_probe_and_add_lun+0x525/0x7b0 drivers/scsi/scsi_scan.c:1209
__scsi_scan_target+0x1e6/0x4e0 drivers/scsi/scsi_scan.c:1774
scsi_scan_channel drivers/scsi/scsi_scan.c:1862 [inline]
scsi_scan_channel+0x149/0x1e0 drivers/scsi/scsi_scan.c:1838
scsi_scan_host_selected+0x2ae/0x370 drivers/scsi/scsi_scan.c:1891
page_owner free stack trace missing
Memory state around the buggy address:
ffff888106742000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888106742080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888106742100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888106742180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888106742200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess):
0: 04 02 add $0x2,%al
2: 84 c0 test %al,%al
4: 74 08 je 0xe
6: 3c 03 cmp $0x3,%al
8: 0f 8e d1 1a 00 00 jle 0x1adf
e: 8b 45 40 mov 0x40(%rbp),%eax
11: bf 00 03 00 00 mov $0x300,%edi
16: 25 00 03 00 00 and $0x300,%eax
1b: 89 c6 mov %eax,%esi
1d: 89 44 24 18 mov %eax,0x18(%rsp)
21: e8 10 0d 6c fa call 0xfa6c0d36
26: 8b 44 24 18 mov 0x18(%rsp),%eax
* 2a: 3d 00 03 00 00 cmp $0x300,%eax <-- trapping instruction
2f: 0f 85 f0 00 00 00 jne 0x125
35: e8 fc 11 6c fa call 0xfa6c1236
3a: 48 89 ea mov %rbp,%rdx
3d: 48 rex.W
3e: b8 .byte 0xb8