list_add corruption. prev->next should be next (ffff8881f715c060), but was ffff8881139dda70. (prev=ffff8881139dda70). ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:28! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 382 Comm: syz-executor.1 Not tainted 5.10.93-syzkaller-01028-g0347b1658399 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__list_add_valid+0xbb/0xc0 lib/list_debug.c:26 Code: 48 c7 c7 a0 e0 49 85 4c 89 e6 4c 89 f1 31 c0 e8 d2 1a fc fe 0f 0b 48 c7 c7 60 e1 49 85 4c 89 f6 4c 89 e1 31 c0 e8 bc 1a fc fe <0f> 0b 0f 1f 00 55 48 89 e5 41 57 41 56 41 54 53 49 89 fe 49 bc 00 RSP: 0018:ffffc900001609e0 EFLAGS: 00010046 RAX: 0000000000000075 RBX: ffff8881f715c068 RCX: 7734f2167179de00 RDX: 0000000000000101 RSI: 0000000000000101 RDI: 0000000000000000 RBP: ffffc90000160a08 R08: ffffffff815457c8 R09: ffffed103ee2a5d8 R10: ffffed103ee2a5d8 R11: 0000000000000000 R12: ffff8881139dda70 R13: dffffc0000000000 R14: ffff8881f715c060 R15: ffff8881139dda70 FS: 0000555555d56400(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555555d67b78 CR3: 0000000159a4d000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __list_add include/linux/list.h:67 [inline] list_add_tail include/linux/list.h:100 [inline] insert_work+0x107/0x330 kernel/workqueue.c:1353 __queue_work+0x951/0xda0 kernel/workqueue.c:1515 queue_work_on+0xef/0x150 kernel/workqueue.c:1542 queue_work include/linux/workqueue.h:513 [inline] css_release+0xae/0xc0 kernel/cgroup/cgroup.c:5116 percpu_ref_put_many include/linux/percpu-refcount.h:322 [inline] percpu_ref_put include/linux/percpu-refcount.h:338 [inline] percpu_ref_call_confirm_rcu lib/percpu-refcount.c:162 [inline] percpu_ref_switch_to_atomic_rcu+0x5a0/0x5b0 lib/percpu-refcount.c:199 rcu_do_batch+0x4cd/0xb40 kernel/rcu/tree.c:2484 rcu_core+0x822/0x10d0 kernel/rcu/tree.c:2721 rcu_core_si+0x9/0x10 kernel/rcu/tree.c:2734 __do_softirq+0x27e/0x598 kernel/softirq.c:305 asm_call_irq_on_stack+0xf/0x20 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline] run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline] do_softirq_own_stack+0x60/0x80 arch/x86/kernel/irq_64.c:77 invoke_softirq kernel/softirq.c:402 [inline] __irq_exit_rcu+0x128/0x150 kernel/softirq.c:432 irq_exit_rcu+0x9/0x10 kernel/softirq.c:444 sysvec_apic_timer_interrupt+0xbf/0xe0 arch/x86/kernel/apic/apic.c:1095 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635 RIP: 0010:update_stack_state+0x272/0x530 arch/x86/kernel/unwind_frame.c:252 Code: 4c 8b 75 c8 74 35 48 8b 45 c0 8a 04 18 84 c0 0f 85 6e 02 00 00 48 8b 45 88 48 39 45 b8 73 1c 8b 45 b4 41 39 45 00 75 13 31 db <89> d8 48 83 c4 70 5b 41 5c 41 5d 41 5e 41 5f 5d c3 48 83 7d d0 00 RSP: 0018:ffffc90000c76980 EFLAGS: 00000282 RAX: dffffc0000000000 RBX: ffffffff81a12801 RCX: dffffc0000000000 RDX: 1ffff9200018ed5a RSI: ffffc90000c77048 RDI: ffffc90000c76ac0 RBP: ffffc90000c76a18 R08: ffffc90000c76ba8 R09: 0000000000000006 R10: ffffc90000c76bb0 R11: 0000000000000000 R12: 1ffff9200018ed60 R13: ffffc90000c76b08 R14: ffffc90000c76ae8 R15: ffffc90000c76b00 unwind_next_frame+0x3d4/0x740 arch/x86/kernel/unwind_frame.c:305 arch_stack_walk+0x112/0x140 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x11b/0x1e0 kernel/stacktrace.c:121 kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4c/0x80 mm/kasan/common.c:46 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:357 ____kasan_slab_free+0x133/0x170 mm/kasan/common.c:360 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:368 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:1602 [inline] slab_free_freelist_hook+0xcc/0x1a0 mm/slub.c:1628 slab_free mm/slub.c:3210 [inline] kfree+0xd5/0x320 mm/slub.c:4198 __vunmap+0x8ee/0x980 mm/vmalloc.c:2282 __vfree mm/vmalloc.c:2323 [inline] vfree+0x62/0xf0 mm/vmalloc.c:2354 copy_entries_to_user net/ipv4/netfilter/ip_tables.c:867 [inline] get_entries net/ipv4/netfilter/ip_tables.c:1023 [inline] do_ipt_get_ctl+0x17e8/0x1ec0 net/ipv4/netfilter/ip_tables.c:1662 nf_getsockopt+0x27a/0x2a0 net/netfilter/nf_sockopt.c:116 ip_getsockopt+0x1cba/0x29a0 net/ipv4/ip_sockglue.c:1777 tcp_getsockopt+0x28e/0x2ab0 net/ipv4/tcp.c:3971 sock_common_getsockopt+0x99/0xb0 net/core/sock.c:3243 __sys_getsockopt+0x27e/0x480 net/socket.c:2163 __do_sys_getsockopt net/socket.c:2178 [inline] __se_sys_getsockopt net/socket.c:2175 [inline] __x64_sys_getsockopt+0xbf/0xd0 net/socket.c:2175 do_syscall_64+0x31/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f9bff4a367a Code: 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 37 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffeb3d7d6f8 EFLAGS: 00000216 ORIG_RAX: 0000000000000037 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f9bff4a367a RDX: 0000000000000041 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 00007ffeb3d7d720 R08: 00007ffeb3d7d71c R09: ff78736871746264 R10: 00007ffeb3d7d780 R11: 0000000000000216 R12: 00007ffeb3d7d780 R13: 0000000000000003 R14: 00007ffeb3d7d71c R15: 00007f9bff587820 Modules linked in: ---[ end trace b22e7be11aa408d4 ]--- RIP: 0010:__list_add_valid+0xbb/0xc0 lib/list_debug.c:26 Code: 48 c7 c7 a0 e0 49 85 4c 89 e6 4c 89 f1 31 c0 e8 d2 1a fc fe 0f 0b 48 c7 c7 60 e1 49 85 4c 89 f6 4c 89 e1 31 c0 e8 bc 1a fc fe <0f> 0b 0f 1f 00 55 48 89 e5 41 57 41 56 41 54 53 49 89 fe 49 bc 00 RSP: 0018:ffffc900001609e0 EFLAGS: 00010046 RAX: 0000000000000075 RBX: ffff8881f715c068 RCX: 7734f2167179de00 RDX: 0000000000000101 RSI: 0000000000000101 RDI: 0000000000000000 RBP: ffffc90000160a08 R08: ffffffff815457c8 R09: ffffed103ee2a5d8 R10: ffffed103ee2a5d8 R11: 0000000000000000 R12: ffff8881139dda70 R13: dffffc0000000000 R14: ffff8881f715c060 R15: ffff8881139dda70 FS: 0000555555d56400(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555555d67b78 CR3: 0000000159a4d000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 4c 8b 75 c8 mov -0x38(%rbp),%r14 4: 74 35 je 0x3b 6: 48 8b 45 c0 mov -0x40(%rbp),%rax a: 8a 04 18 mov (%rax,%rbx,1),%al d: 84 c0 test %al,%al f: 0f 85 6e 02 00 00 jne 0x283 15: 48 8b 45 88 mov -0x78(%rbp),%rax 19: 48 39 45 b8 cmp %rax,-0x48(%rbp) 1d: 73 1c jae 0x3b 1f: 8b 45 b4 mov -0x4c(%rbp),%eax 22: 41 39 45 00 cmp %eax,0x0(%r13) 26: 75 13 jne 0x3b 28: 31 db xor %ebx,%ebx * 2a: 89 d8 mov %ebx,%eax <-- trapping instruction 2c: 48 83 c4 70 add $0x70,%rsp 30: 5b pop %rbx 31: 41 5c pop %r12 33: 41 5d pop %r13 35: 41 5e pop %r14 37: 41 5f pop %r15 39: 5d pop %rbp 3a: c3 retq 3b: 48 83 7d d0 00 cmpq $0x0,-0x30(%rbp)