================================================================== BUG: KASAN: use-after-free in class_equal+0x40/0x50 kernel/locking/lockdep.c:1579 Read of size 8 at addr ffff888083e72340 by task syz-executor.4/10344 CPU: 0 PID: 10344 Comm: syz-executor.4 Not tainted 5.2.0-rc7-next-20190702 #27 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: Allocated by task 1102416563: (stack is not available) Freed by task 2290484850: ------------[ cut here ]------------ Bad or missing usercopy whitelist? Kernel memory overwrite attempt detected to SLAB object 'shmem_inode_cache' (offset 776, size 1)! usercopy: Kernel memory overwrite attempt detected to SLAB object 'shmem_inode_cache' (offset 1304, size 2)! ------------[ cut here ]------------ kernel BUG at mm/usercopy.c:98! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 10344 Comm: syz-executor.4 Not tainted 5.2.0-rc7-next-20190702 #27 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:usercopy_abort+0xbd/0xbf mm/usercopy.c:98 Code: c0 e8 3b 1f be ff 48 8b 55 c0 49 89 d9 4d 89 f0 ff 75 c8 4c 89 e1 4c 89 ee 48 c7 c7 20 41 96 87 ff 75 d0 41 57 e8 ab c5 a7 ff <0f> 0b e8 10 1f be ff e8 2b 38 f8 ff 8b 55 d4 4c 89 e1 49 89 d8 4c RSP: 0018:ffff888083e71958 EFLAGS: 00010082 RAX: 000000000000006f RBX: ffffffff8793a200 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff815c0c96 RDI: ffffed10107ce31d RBP: ffff888083e719b0 R08: 000000000000006f R09: ffffed1015d044fa R10: ffffed1015d044f9 R11: ffff8880ae8227cf R12: ffffffff88874d8d R13: ffffffff87963f80 R14: ffffffff87963ec0 R15: ffffffff87963e80 FS: 0000555555e09940(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffff8c278838 CR3: 0000000085407000 CR4: 00000000001506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: Modules linked in: ---[ end trace 673033f89dfaca90 ]--- RIP: 0010:usercopy_abort+0xbd/0xbf mm/usercopy.c:98 Code: c0 e8 3b 1f be ff 48 8b 55 c0 49 89 d9 4d 89 f0 ff 75 c8 4c 89 e1 4c 89 ee 48 c7 c7 20 41 96 87 ff 75 d0 41 57 e8 ab c5 a7 ff <0f> 0b e8 10 1f be ff e8 2b 38 f8 ff 8b 55 d4 4c 89 e1 49 89 d8 4c RSP: 0018:ffff888083e71958 EFLAGS: 00010082 RAX: 000000000000006f RBX: ffffffff8793a200 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff815c0c96 RDI: ffffed10107ce31d RBP: ffff888083e719b0 R08: 000000000000006f R09: ffffed1015d044fa R10: ffffed1015d044f9 R11: ffff8880ae8227cf R12: ffffffff88874d8d R13: ffffffff87963f80 R14: ffffffff87963ec0 R15: ffffffff87963e80 FS: 0000555555e09940(0000) GS:ffff8880ae800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffff8c278838 CR3: 0000000085407000 CR4: 00000000001506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400