================================================================== BUG: KASAN: use-after-free in list_empty include/linux/list.h:282 [inline] BUG: KASAN: use-after-free in waitqueue_active include/linux/wait.h:128 [inline] BUG: KASAN: use-after-free in wq_has_sleeper include/linux/wait.h:162 [inline] BUG: KASAN: use-after-free in skwq_has_sleeper include/net/sock.h:2141 [inline] BUG: KASAN: use-after-free in sock_def_write_space+0x609/0x630 net/core/sock.c:2906 Read of size 8 at addr ffff8880629b3a40 by task systemd-udevd/4896 CPU: 0 PID: 4896 Comm: systemd-udevd Not tainted 5.10.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x107/0x163 lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xae/0x4c8 mm/kasan/report.c:385 __kasan_report mm/kasan/report.c:545 [inline] kasan_report.cold+0x1f/0x37 mm/kasan/report.c:562 list_empty include/linux/list.h:282 [inline] waitqueue_active include/linux/wait.h:128 [inline] wq_has_sleeper include/linux/wait.h:162 [inline] skwq_has_sleeper include/net/sock.h:2141 [inline] sock_def_write_space+0x609/0x630 net/core/sock.c:2906 sock_wfree+0x1cc/0x240 net/core/sock.c:2033 skb_release_head_state+0x9f/0x250 net/core/skbuff.c:656 skb_release_all net/core/skbuff.c:667 [inline] _kfree_skb_defer net/core/skbuff.c:875 [inline] napi_consume_skb+0x134/0x390 net/core/skbuff.c:917 free_old_xmit_skbs+0xe4/0x270 drivers/net/virtio_net.c:1394 virtnet_poll_tx+0x1e9/0x370 drivers/net/virtio_net.c:1521 napi_poll net/core/dev.c:6763 [inline] net_rx_action+0x4dc/0x1100 net/core/dev.c:6833 __do_softirq+0x2a0/0x9f6 kernel/softirq.c:298 asm_call_irq_on_stack+0xf/0x20 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline] run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline] do_softirq_own_stack+0xaa/0xd0 arch/x86/kernel/irq_64.c:77 invoke_softirq kernel/softirq.c:393 [inline] __irq_exit_rcu kernel/softirq.c:423 [inline] irq_exit_rcu+0x132/0x200 kernel/softirq.c:435 common_interrupt+0xa3/0x200 arch/x86/kernel/irq.c:239 asm_common_interrupt+0x1e/0x40 arch/x86/include/asm/idtentry.h:622 RIP: 0010:lock_is_held_type+0xc2/0x100 kernel/locking/lockdep.c:5480 Code: 03 44 39 f0 41 0f 94 c4 48 c7 c7 40 5e 4b 89 e8 d4 0b 00 00 b8 ff ff ff ff 65 0f c1 05 67 8c 1c 77 83 f8 01 75 23 ff 34 24 9d <48> 83 c4 08 44 89 e0 5b 5d 41 5c 41 5d 41 5e 41 5f c3 45 31 e4 eb RSP: 0018:ffffc9000163fbb8 EFLAGS: 00000202 RAX: 0000000000000001 RBX: 0000000000000001 RCX: 1ffffffff19d9743 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffffff8b3370a0 R08: ffffffff81e6500d R09: ffff8880628a49ef R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 R13: ffff8880147cd7d0 R14: 00000000ffffffff R15: ffff8880147cd7d0 lock_is_held include/linux/lockdep.h:271 [inline] ___might_sleep+0x236/0x2b0 kernel/sched/core.c:7264 __mutex_lock_common kernel/locking/mutex.c:935 [inline] __mutex_lock+0xa9/0x10e0 kernel/locking/mutex.c:1103 kernfs_fop_readdir+0x14d/0x890 fs/kernfs/dir.c:1673 iterate_dir+0x4eb/0x660 fs/readdir.c:65 __do_sys_getdents fs/readdir.c:283 [inline] __se_sys_getdents fs/readdir.c:268 [inline] __x64_sys_getdents+0x13a/0x2b0 fs/readdir.c:268 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7fe8490b6f2b Code: fc ff 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 41 57 41 56 48 63 ff 41 55 41 54 b8 4e 00 00 00 55 53 48 89 f3 48 83 ec 08 0f 05 <48> 3d 00 f0 ff ff 77 55 48 8d 2c 06 49 89 c4 48 39 ee 73 34 90 44 RSP: 002b:00007fff4830fd70 EFLAGS: 00000202 ORIG_RAX: 000000000000004e RAX: ffffffffffffffda RBX: 00005593e2514930 RCX: 00007fe8490b6f2b RDX: 0000000000008000 RSI: 00005593e2514930 RDI: 000000000000000f RBP: 00005593e2514930 R08: 000000000000fc01 R09: 0000000000008040 R10: 0000000000000020 R11: 0000000000000202 R12: fffffffffffffe50 R13: 0000000000000000 R14: 00000000000000ff R15: 00005593e24fce60 Allocated by task 13409: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48 kasan_set_track mm/kasan/common.c:56 [inline] __kasan_kmalloc.constprop.0+0xc2/0xd0 mm/kasan/common.c:461 slab_post_alloc_hook mm/slab.h:526 [inline] slab_alloc_node mm/slub.c:2891 [inline] slab_alloc mm/slub.c:2899 [inline] kmem_cache_alloc+0x117/0x460 mm/slub.c:2904 sock_alloc_inode+0x18/0x1c0 net/socket.c:253 alloc_inode+0x61/0x230 fs/inode.c:234 new_inode_pseudo+0x14/0xe0 fs/inode.c:930 sock_alloc+0x3c/0x260 net/socket.c:573 __sock_create+0xb9/0x780 net/socket.c:1391 sock_create net/socket.c:1478 [inline] __sys_socket+0xef/0x200 net/socket.c:1520 __do_sys_socket net/socket.c:1529 [inline] __se_sys_socket net/socket.c:1527 [inline] __x64_sys_socket+0x6f/0xb0 net/socket.c:1527 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Freed by task 16: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48 kasan_set_track+0x1c/0x30 mm/kasan/common.c:56 kasan_set_free_info+0x1b/0x30 mm/kasan/generic.c:355 __kasan_slab_free+0x102/0x140 mm/kasan/common.c:422 slab_free_hook mm/slub.c:1544 [inline] slab_free_freelist_hook+0x5d/0x150 mm/slub.c:1577 slab_free mm/slub.c:3142 [inline] kmem_cache_free+0x82/0x350 mm/slub.c:3158 i_callback+0x3f/0x70 fs/inode.c:223 rcu_do_batch kernel/rcu/tree.c:2476 [inline] rcu_core+0x5df/0xe80 kernel/rcu/tree.c:2711 __do_softirq+0x2a0/0x9f6 kernel/softirq.c:298 Last call_rcu(): kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48 kasan_record_aux_stack+0xc0/0xf0 mm/kasan/generic.c:346 __call_rcu kernel/rcu/tree.c:2953 [inline] call_rcu+0xbb/0x700 kernel/rcu/tree.c:3027 destroy_inode+0x129/0x1b0 fs/inode.c:289 iput_final fs/inode.c:1654 [inline] iput.part.0+0x3fe/0x820 fs/inode.c:1680 iput+0x58/0x70 fs/inode.c:1670 dentry_unlink_inode+0x2b1/0x3d0 fs/dcache.c:374 __dentry_kill+0x3c0/0x640 fs/dcache.c:579 dentry_kill fs/dcache.c:705 [inline] dput+0x725/0xbc0 fs/dcache.c:878 __fput+0x3ab/0x920 fs/file_table.c:294 task_work_run+0xdd/0x190 kernel/task_work.c:151 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop kernel/entry/common.c:164 [inline] exit_to_user_mode_prepare+0x17e/0x1a0 kernel/entry/common.c:191 syscall_exit_to_user_mode+0x38/0x260 kernel/entry/common.c:266 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Second to last call_rcu(): kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48 kasan_record_aux_stack+0xc0/0xf0 mm/kasan/generic.c:346 __call_rcu kernel/rcu/tree.c:2953 [inline] call_rcu+0xbb/0x700 kernel/rcu/tree.c:3027 destroy_inode+0x129/0x1b0 fs/inode.c:289 iput_final fs/inode.c:1654 [inline] iput.part.0+0x3fe/0x820 fs/inode.c:1680 iput+0x58/0x70 fs/inode.c:1670 dentry_unlink_inode+0x2b1/0x3d0 fs/dcache.c:374 __dentry_kill+0x3c0/0x640 fs/dcache.c:579 dentry_kill fs/dcache.c:705 [inline] dput+0x725/0xbc0 fs/dcache.c:878 __fput+0x3ab/0x920 fs/file_table.c:294 task_work_run+0xdd/0x190 kernel/task_work.c:151 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop kernel/entry/common.c:164 [inline] exit_to_user_mode_prepare+0x17e/0x1a0 kernel/entry/common.c:191 syscall_exit_to_user_mode+0x38/0x260 kernel/entry/common.c:266 entry_SYSCALL_64_after_hwframe+0x44/0xa9 The buggy address belongs to the object at ffff8880629b39c0 which belongs to the cache sock_inode_cache of size 1216 The buggy address is located 128 bytes inside of 1216-byte region [ffff8880629b39c0, ffff8880629b3e80) The buggy address belongs to the page: page:0000000011e960d3 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x629b0 head:0000000011e960d3 order:2 compound_mapcount:0 compound_pincount:0 flags: 0xfff00000010200(slab|head) raw: 00fff00000010200 ffffea0000be5900 0000000200000002 ffff888010cb8b40 raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880629b3900: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff8880629b3980: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb >ffff8880629b3a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880629b3a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880629b3b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================