================================================================== BUG: KASAN: use-after-free in class_equal+0x40/0x50 kernel/locking/lockdep.c:1527 Read of size 8 at addr ffff888092b5a3a0 by task syz-executor.5/9485 CPU: 1 PID: 9485 Comm: syz-executor.5 Not tainted 5.2.0-rc5+ #60 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: Allocated by task 0: (stack is not available) Freed by task 2333976992: usercopy: Kernel memory overwrite attempt detected to SLAB object 'names_cache' (offset 4208, size 2)! ------------[ cut here ]------------ kernel BUG at mm/usercopy.c:102! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 9485 Comm: syz-executor.5 Not tainted 5.2.0-rc5+ #60 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:usercopy_abort+0xbd/0xbf mm/usercopy.c:102 Code: c0 e8 f8 c0 bf ff 48 8b 55 c0 49 89 d9 4d 89 f0 ff 75 c8 4c 89 e1 4c 89 ee 48 c7 c7 c0 b6 75 87 ff 75 d0 41 57 e8 78 c6 a9 ff <0f> 0b e8 cd c0 bf ff e8 58 64 f8 ff 8b 55 d4 4c 89 e1 49 89 d8 4c RSP: 0018:ffff888092b59988 EFLAGS: 00010082 RAX: 0000000000000069 RBX: ffffffff87760480 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff815ad926 RDI: ffffed101256b323 RBP: ffff888092b599e0 R08: 0000000000000069 R09: ffffed1015d244fa R10: ffffed1015d244f9 R11: ffff8880ae9227cf R12: ffffffff88620ead R13: ffffffff8775b520 R14: ffffffff8775b460 R15: ffffffff8775b420 FS: 0000555557151940(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffff8c046b98 CR3: 000000008a854000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: Modules linked in: ---[ end trace 51a12ee23b512531 ]--- RIP: 0010:usercopy_abort+0xbd/0xbf mm/usercopy.c:102 Code: c0 e8 f8 c0 bf ff 48 8b 55 c0 49 89 d9 4d 89 f0 ff 75 c8 4c 89 e1 4c 89 ee 48 c7 c7 c0 b6 75 87 ff 75 d0 41 57 e8 78 c6 a9 ff <0f> 0b e8 cd c0 bf ff e8 58 64 f8 ff 8b 55 d4 4c 89 e1 49 89 d8 4c RSP: 0018:ffff888092b59988 EFLAGS: 00010082 RAX: 0000000000000069 RBX: ffffffff87760480 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff815ad926 RDI: ffffed101256b323 RBP: ffff888092b599e0 R08: 0000000000000069 R09: ffffed1015d244fa R10: ffffed1015d244f9 R11: ffff8880ae9227cf R12: ffffffff88620ead R13: ffffffff8775b520 R14: ffffffff8775b460 R15: ffffffff8775b420 FS: 0000555557151940(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffff8c046b98 CR3: 000000008a854000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400