================================================================== BUG: KASAN: use-after-free in trace_event_get_offsets_lock_acquire include/trace/events/lock.h:12 [inline] BUG: KASAN: use-after-free in perf_trace_lock_acquire+0x458/0x530 include/trace/events/lock.h:12 Read of size 8 at addr ffff8801cdc7de28 by task syz-executor3/7584 CPU: 0 PID: 7584 Comm: syz-executor3 Not tainted 4.9.144+ #79 ffff8801a252f600 ffffffff81b43b89 ffffea0007371f00 ffff8801cdc7de28 0000000000000000 ffff8801cdc7de28 0000000000000000 ffff8801a252f638 ffffffff81500c38 ffff8801cdc7de28 0000000000000008 0000000000000000 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] print_address_description+0x6c/0x234 mm/kasan/report.c:256 [] kasan_report_error mm/kasan/report.c:355 [inline] [] kasan_report.cold.6+0x242/0x2fe mm/kasan/report.c:412 [] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433 [] trace_event_get_offsets_lock_acquire include/trace/events/lock.h:12 [inline] [] perf_trace_lock_acquire+0x458/0x530 include/trace/events/lock.h:12 [] trace_lock_acquire include/trace/events/lock.h:12 [inline] [] lock_acquire+0x299/0x3e0 kernel/locking/lockdep.c:3755 [] __raw_spin_lock include/linux/spinlock_api_smp.h:144 [inline] [] _raw_spin_lock+0x36/0x50 kernel/locking/spinlock.c:151 [] spin_lock include/linux/spinlock.h:302 [inline] [] shmem_fault+0x4d1/0x6d0 mm/shmem.c:1952 [] __do_fault+0x223/0x500 mm/memory.c:2833 [] do_read_fault mm/memory.c:3180 [inline] [] do_fault mm/memory.c:3315 [inline] [] handle_pte_fault mm/memory.c:3516 [inline] [] __handle_mm_fault mm/memory.c:3603 [inline] [] handle_mm_fault+0x1326/0x2350 mm/memory.c:3640 [] faultin_page mm/gup.c:386 [inline] [] __get_user_pages+0x446/0xf80 mm/gup.c:588 [] populate_vma_page_range+0x19a/0x230 mm/gup.c:1106 [] __mm_populate+0x1d7/0x320 mm/gup.c:1154 [] mm_populate include/linux/mm.h:2041 [inline] [] vm_mmap_pgoff+0x195/0x1b0 mm/util.c:333 [] SYSC_mmap_pgoff mm/mmap.c:1555 [inline] [] SyS_mmap_pgoff+0x152/0x1b0 mm/mmap.c:1513 [] SYSC_mmap arch/x86/kernel/sys_x86_64.c:96 [inline] [] SyS_mmap+0x16/0x20 arch/x86/kernel/sys_x86_64.c:87 [] do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285 [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb Allocated by task 7584: save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57 save_stack mm/kasan/kasan.c:505 [inline] set_track mm/kasan/kasan.c:517 [inline] kasan_kmalloc.part.1+0x62/0xf0 mm/kasan/kasan.c:609 kasan_kmalloc+0xaf/0xc0 mm/kasan/kasan.c:594 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:547 slab_post_alloc_hook mm/slab.h:417 [inline] slab_alloc_node mm/slub.c:2715 [inline] slab_alloc mm/slub.c:2723 [inline] kmem_cache_alloc+0xd5/0x2b0 mm/slub.c:2728 shmem_alloc_inode+0x1b/0x40 mm/shmem.c:3655 alloc_inode+0x63/0x180 fs/inode.c:207 new_inode_pseudo+0x17/0xe0 fs/inode.c:890 new_inode+0x1c/0x40 fs/inode.c:919 shmem_get_inode+0x6f/0x6c0 mm/shmem.c:2126 __shmem_file_setup.part.13+0x33a/0x420 mm/shmem.c:4033 __shmem_file_setup mm/shmem.c:4109 [inline] shmem_zero_setup+0xb5/0x1d0 mm/shmem.c:4109 mmap_region+0xcad/0xf90 mm/mmap.c:1742 do_mmap+0x53d/0xbb0 mm/mmap.c:1505 do_mmap_pgoff include/linux/mm.h:2032 [inline] vm_mmap_pgoff+0x168/0x1b0 mm/util.c:329 SYSC_mmap_pgoff mm/mmap.c:1555 [inline] SyS_mmap_pgoff+0x152/0x1b0 mm/mmap.c:1513 SYSC_mmap arch/x86/kernel/sys_x86_64.c:96 [inline] SyS_mmap+0x16/0x20 arch/x86/kernel/sys_x86_64.c:87 do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285 entry_SYSCALL_64_after_swapgs+0x5d/0xdb Freed by task 7590: save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57 save_stack mm/kasan/kasan.c:505 [inline] set_track mm/kasan/kasan.c:517 [inline] kasan_slab_free+0xac/0x190 mm/kasan/kasan.c:582 slab_free_hook mm/slub.c:1355 [inline] slab_free_freelist_hook mm/slub.c:1377 [inline] slab_free mm/slub.c:2958 [inline] kmem_cache_free+0xbe/0x310 mm/slub.c:2980 shmem_destroy_callback+0x5a/0xa0 mm/shmem.c:3666 __rcu_reclaim kernel/rcu/rcu.h:118 [inline] rcu_do_batch kernel/rcu/tree.c:2789 [inline] invoke_rcu_callbacks kernel/rcu/tree.c:3053 [inline] __rcu_process_callbacks kernel/rcu/tree.c:3020 [inline] rcu_process_callbacks+0x8ae/0x12b0 kernel/rcu/tree.c:3037 __do_softirq+0x20e/0x964 kernel/softirq.c:288 The buggy address belongs to the object at ffff8801cdc7dcb0 which belongs to the cache shmem_inode_cache of size 1096 The buggy address is located 376 bytes inside of 1096-byte region [ffff8801cdc7dcb0, ffff8801cdc7e0f8) The buggy address belongs to the page: page:ffffea0007371f00 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0 flags: 0x4000000000004080(slab|head) page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8801cdc7dd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8801cdc7dd80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8801cdc7de00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8801cdc7de80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8801cdc7df00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================