BUG: MAX_LOCKDEP_CHAINS too low!
turning off the locking correctness validator.
CPU: 1 PID: 25429 Comm: syz-executor.2 Not tainted 5.11.0-next-20210224-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0xfa/0x151 lib/dump_stack.c:120
 add_chain_cache kernel/locking/lockdep.c:3522 [inline]
 lookup_chain_cache_add kernel/locking/lockdep.c:3621 [inline]
 validate_chain kernel/locking/lockdep.c:3642 [inline]
 __lock_acquire.cold+0x37b/0x3b4 kernel/locking/lockdep.c:4900
 lock_acquire kernel/locking/lockdep.c:5510 [inline]
 lock_acquire+0x1ab/0x730 kernel/locking/lockdep.c:5475
 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
 _raw_spin_lock+0x2a/0x40 kernel/locking/spinlock.c:151
 update_cfs_rq_load_avg kernel/sched/fair.c:3650 [inline]
 update_load_avg+0x9ef/0x18b0 kernel/sched/fair.c:3787
 enqueue_entity+0xc1/0x2080 kernel/sched/fair.c:4229
 enqueue_task_fair+0x1d8/0x1a80 kernel/sched/fair.c:5515
 enqueue_task kernel/sched/core.c:1594 [inline]
 activate_task kernel/sched/core.c:1613 [inline]
 ttwu_do_activate+0x185/0x660 kernel/sched/core.c:2991
 ttwu_queue kernel/sched/core.c:3188 [inline]
 try_to_wake_up+0x60e/0x14a0 kernel/sched/core.c:3466
 wake_up_worker kernel/workqueue.c:837 [inline]
 insert_work+0x2a0/0x370 kernel/workqueue.c:1346
 __queue_work+0x5c1/0xf00 kernel/workqueue.c:1497
 queue_work_on+0xae/0xc0 kernel/workqueue.c:1524
 queue_work include/linux/workqueue.h:507 [inline]
 schedule_work include/linux/workqueue.h:568 [inline]
 __vfree_deferred mm/vmalloc.c:2307 [inline]
 vfree_atomic+0xac/0xe0 mm/vmalloc.c:2325
 free_thread_stack kernel/fork.c:291 [inline]
 release_task_stack kernel/fork.c:428 [inline]
 put_task_stack+0x29c/0x480 kernel/fork.c:439
 finish_task_switch.isra.0+0x557/0x7e0 kernel/sched/core.c:4233
 context_switch kernel/sched/core.c:4327 [inline]
 __schedule+0x914/0x21a0 kernel/sched/core.c:5075
 preempt_schedule_irq+0x4e/0x90 kernel/sched/core.c:5532
 irqentry_exit_cond_resched kernel/entry/common.c:392 [inline]
 irqentry_exit_cond_resched kernel/entry/common.c:384 [inline]
 irqentry_exit+0x7a/0xa0 kernel/entry/common.c:428
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:632
RIP: 0010:kasan_check_range+0x16/0x180 mm/kasan/generic.c:185
Code: 02 0f 1f 00 48 89 f2 be f8 00 00 00 e9 a3 3d 2a 02 0f 1f 00 48 85 f6 0f 84 70 01 00 00 49 89 f9 41 54 44 0f b6 c2 49 01 f1 55 <53> 0f 82 18 01 00 00 48 b8 ff ff ff ff ff 7f ff ff 48 39 c7 0f 86
RSP: 0018:ffffc9000268f8a0 EFLAGS: 00000296
RAX: 0000000000019984 RBX: ffff8880191ac000 RCX: ffffffff81d9ba0c
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff8880191ac698
RBP: ffff8880191ac698 R08: 0000000000000000 R09: ffff8880191ac6a0
R10: ffffffff81d9b9d4 R11: 0000000000000006 R12: 0000000000000104
R13: ffff8880191ac440 R14: 0000000000000000 R15: ffffc9000268fa68
 instrument_atomic_read include/linux/instrumented.h:71 [inline]
 test_bit include/asm-generic/bitops/instrumented-non-atomic.h:134 [inline]
 io_uring_poll+0x21c/0x2c0 fs/io_uring.c:8445
 vfs_poll include/linux/poll.h:90 [inline]
 __io_arm_poll_handler+0x354/0xa20 fs/io_uring.c:5110
 io_poll_add fs/io_uring.c:5362 [inline]
 io_issue_sqe+0x1b8a/0x4f00 fs/io_uring.c:5973
 __io_queue_sqe+0x276/0xd60 fs/io_uring.c:6231
 io_queue_sqe+0x6f7/0xde0 fs/io_uring.c:6287
 io_submit_sqe fs/io_uring.c:6457 [inline]
 io_submit_sqes+0x520e/0x63d0 fs/io_uring.c:6571
 __do_sys_io_uring_enter+0x1154/0x1f50 fs/io_uring.c:9133
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x465ef9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fe5a2c5a188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa
RAX: ffffffffffffffda RBX: 000000000056bf60 RCX: 0000000000465ef9
RDX: 0000000000000000 RSI: 000000000000450c RDI: 0000000000000009
RBP: 00000000004bcd1c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf60
R13: 00007ffd3455898f R14: 00007fe5a2c5a300 R15: 0000000000022000
==================================================================
BUG: KASAN: use-after-free in debug_spin_lock_before kernel/locking/spinlock_debug.c:83 [inline]
BUG: KASAN: use-after-free in do_raw_spin_lock+0x262/0x2b0 kernel/locking/spinlock_debug.c:112
Read of size 4 at addr ffff88801bf208bc by task syz-executor.2/25429

CPU: 0 PID: 25429 Comm: syz-executor.2 Not tainted 5.11.0-next-20210224-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0xfa/0x151 lib/dump_stack.c:120
 print_address_description.constprop.0.cold+0x5b/0x2f8 mm/kasan/report.c:232
 __kasan_report mm/kasan/report.c:399 [inline]
 kasan_report.cold+0x7c/0xd8 mm/kasan/report.c:416
 debug_spin_lock_before kernel/locking/spinlock_debug.c:83 [inline]
 do_raw_spin_lock+0x262/0x2b0 kernel/locking/spinlock_debug.c:112
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:117 [inline]
 _raw_spin_lock_irqsave+0x41/0x50 kernel/locking/spinlock.c:159
 try_to_wake_up+0x98/0x14a0 kernel/sched/core.c:3347
 io_wq_destroy+0x74/0x3d0 fs/io-wq.c:1013
 __io_uring_files_cancel+0x195/0x230 fs/io_uring.c:8810
 io_uring_files_cancel include/linux/io_uring.h:47 [inline]
 do_exit+0x299/0x2a60 kernel/exit.c:780
 do_group_exit+0x125/0x310 kernel/exit.c:922
 get_signal+0x42c/0x2100 kernel/signal.c:2773
 arch_do_signal_or_restart+0x2a8/0x1eb0 arch/x86/kernel/signal.c:811
 handle_signal_work kernel/entry/common.c:147 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:171 [inline]
 exit_to_user_mode_prepare+0x148/0x250 kernel/entry/common.c:208
 __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline]
 syscall_exit_to_user_mode+0x19/0x50 kernel/entry/common.c:301
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x465ef9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fe5a2c5a188 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa
RAX: 000000000000307f RBX: 000000000056bf60 RCX: 0000000000465ef9
RDX: 0000000000000000 RSI: 000000000000450c RDI: 0000000000000009
RBP: 00000000004bcd1c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf60
R13: 00007ffd3455898f R14: 00007fe5a2c5a300 R15: 0000000000022000

Allocated by task 25429:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38
 kasan_set_track mm/kasan/common.c:46 [inline]
 set_alloc_info mm/kasan/common.c:427 [inline]
 __kasan_slab_alloc+0x75/0x90 mm/kasan/common.c:460
 kasan_slab_alloc include/linux/kasan.h:223 [inline]
 slab_post_alloc_hook mm/slab.h:516 [inline]
 slab_alloc_node mm/slub.c:2907 [inline]
 kmem_cache_alloc_node+0x16d/0x3c0 mm/slub.c:2943
 alloc_task_struct_node kernel/fork.c:170 [inline]
 dup_task_struct kernel/fork.c:860 [inline]
 copy_process+0x613/0x6fd0 kernel/fork.c:1940
 kernel_clone+0xe7/0xab0 kernel/fork.c:2462
 io_wq_fork_thread+0xa7/0xe0 fs/io-wq.c:601
 io_wq_create+0x81c/0xab0 fs/io-wq.c:985
 io_init_wq_offload fs/io_uring.c:7779 [inline]
 io_uring_alloc_task_context+0x185/0x510 fs/io_uring.c:7798
 io_uring_add_task_file+0x261/0x350 fs/io_uring.c:8737
 __do_sys_io_uring_enter+0x111c/0x1f50 fs/io_uring.c:9129
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Freed by task 12:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38
 kasan_set_track+0x1c/0x30 mm/kasan/common.c:46
 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:357
 ____kasan_slab_free mm/kasan/common.c:360 [inline]
 ____kasan_slab_free mm/kasan/common.c:325 [inline]
 __kasan_slab_free+0xf5/0x130 mm/kasan/common.c:367
 kasan_slab_free include/linux/kasan.h:199 [inline]
 slab_free_hook mm/slub.c:1562 [inline]
 slab_free_freelist_hook+0x72/0x1b0 mm/slub.c:1600
 slab_free mm/slub.c:3161 [inline]
 kmem_cache_free+0x8b/0x730 mm/slub.c:3177
 __put_task_struct+0x267/0x3f0 kernel/fork.c:742
 put_task_struct include/linux/sched/task.h:111 [inline]
 delayed_put_task_struct+0x1f6/0x340 kernel/exit.c:173
 rcu_do_batch kernel/rcu/tree.c:2559 [inline]
 rcu_core+0x722/0x1280 kernel/rcu/tree.c:2794
 __do_softirq+0x29b/0x9f6 kernel/softirq.c:345

Last potentially related work creation:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38
 kasan_record_aux_stack+0xe5/0x110 mm/kasan/generic.c:345
 __call_rcu kernel/rcu/tree.c:3039 [inline]
 call_rcu+0xb1/0x700 kernel/rcu/tree.c:3114
 put_task_struct_rcu_user+0x7f/0xb0 kernel/exit.c:179
 context_switch kernel/sched/core.c:4327 [inline]
 __schedule+0x914/0x21a0 kernel/sched/core.c:5075
 preempt_schedule_irq+0x4e/0x90 kernel/sched/core.c:5532
 irqentry_exit_cond_resched kernel/entry/common.c:392 [inline]
 irqentry_exit_cond_resched kernel/entry/common.c:384 [inline]
 irqentry_exit+0x7a/0xa0 kernel/entry/common.c:428
 asm_sysvec_reschedule_ipi+0x12/0x20 arch/x86/include/asm/idtentry.h:637

Second to last potentially related work creation:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38
 kasan_record_aux_stack+0xe5/0x110 mm/kasan/generic.c:345
 __call_rcu kernel/rcu/tree.c:3039 [inline]
 call_rcu+0xb1/0x700 kernel/rcu/tree.c:3114
 put_task_struct_rcu_user+0x7f/0xb0 kernel/exit.c:179
 context_switch kernel/sched/core.c:4327 [inline]
 __schedule+0x914/0x21a0 kernel/sched/core.c:5075
 schedule_idle+0x53/0x90 kernel/sched/core.c:5182
 do_idle+0x2fc/0x590 kernel/sched/idle.c:328
 cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:397
 start_kernel+0x470/0x491 init/main.c:1064
 secondary_startup_64_no_verify+0xb0/0xbb

The buggy address belongs to the object at ffff88801bf20000
 which belongs to the cache task_struct of size 6912
The buggy address is located 2236 bytes inside of
 6912-byte region [ffff88801bf20000, ffff88801bf21b00)
The buggy address belongs to the page:
page:000000002d4db040 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1bf20
head:000000002d4db040 order:3 compound_mapcount:0 compound_pincount:0
flags: 0xfff00000010200(slab|head)
raw: 00fff00000010200 dead000000000100 dead000000000122 ffff888140004000
raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88801bf20780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88801bf20800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88801bf20880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                        ^
 ffff88801bf20900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88801bf20980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================