------------[ cut here ]------------ ODEBUG: free active (active state 1) object type: rcu_head hint: (null) WARNING: CPU: 0 PID: 7931 at lib/debugobjects.c:325 debug_print_object+0x168/0x250 lib/debugobjects.c:325 Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 7931 Comm: syz-executor.5 Not tainted 4.19.75 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x172/0x1f0 lib/dump_stack.c:113 panic+0x263/0x507 kernel/panic.c:185 __warn.cold+0x20/0x4a kernel/panic.c:540 report_bug+0x263/0x2b0 lib/bug.c:186 fixup_bug arch/x86/kernel/traps.c:178 [inline] fixup_bug arch/x86/kernel/traps.c:173 [inline] do_error_trap+0x204/0x360 arch/x86/kernel/traps.c:296 netlink: 20 bytes leftover after parsing attributes in process `syz-executor.3'. do_invalid_op+0x1b/0x20 arch/x86/kernel/traps.c:316 invalid_op+0x14/0x20 arch/x86/entry/entry_64.S:1037 RIP: 0010:debug_print_object+0x168/0x250 lib/debugobjects.c:325 Code: dd 20 56 82 87 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 b5 00 00 00 48 8b 14 dd 20 56 82 87 48 c7 c7 60 4b 82 87 e8 d6 04 19 fe <0f> 0b 83 05 cb 83 17 06 01 48 83 c4 20 5b 41 5c 41 5d 41 5e 5d c3 netlink: 20 bytes leftover after parsing attributes in process `syz-executor.3'. RSP: 0018:ffff888046a7fb78 EFLAGS: 00010082 RAX: 0000000000000000 RBX: 0000000000000003 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff8155dbd6 RDI: ffffed1008d4ff61 RBP: ffff888046a7fbb8 R08: ffff8880955144c0 R09: ffffed1015d03ee3 R10: ffffed1015d03ee2 R11: ffff8880ae81f717 R12: 0000000000000001 R13: ffffffff8879f200 R14: 0000000000000000 R15: ffff888049cf9960 __debug_check_no_obj_freed lib/debugobjects.c:785 [inline] debug_check_no_obj_freed+0x29f/0x464 lib/debugobjects.c:817 kmem_cache_free+0x18f/0x260 mm/slab.c:3764 audit: type=1400 audit(1569790279.815:153): avc: denied { write } for pid=8066 comm="syz-executor.3" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_netfilter_socket permissive=1 free_task_struct kernel/fork.c:162 [inline] free_task+0xdd/0x120 kernel/fork.c:416 kobject: 'loop4' (000000007e7298a0): kobject_uevent_env __put_task_struct+0x20f/0x4c0 kernel/fork.c:689 put_task_struct include/linux/sched/task.h:96 [inline] finish_task_switch+0x52b/0x780 kernel/sched/core.c:2710 context_switch kernel/sched/core.c:2829 [inline] __schedule+0x86e/0x1dc0 kernel/sched/core.c:3474 preempt_schedule_common+0x4f/0xe0 kernel/sched/core.c:3598 preempt_schedule+0x4b/0x60 kernel/sched/core.c:3624 ___preempt_schedule+0x16/0x18 __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:169 [inline] _raw_spin_unlock_irq+0x74/0x90 kernel/locking/spinlock.c:192 spin_unlock_irq include/linux/spinlock.h:379 [inline] do_group_exit+0x2e9/0x370 kernel/exit.c:976 __do_sys_exit_group kernel/exit.c:990 [inline] __se_sys_exit_group kernel/exit.c:988 [inline] __x64_sys_exit_group+0x44/0x50 kernel/exit.c:988 do_syscall_64+0xfd/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x459a29 Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ffda1eedac8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 000000000000000b RCX: 0000000000459a29 RDX: 0000000000413651 RSI: 0000000000a74ef0 RDI: 0000000000000000 RBP: 00000000004bf121 R08: 000000000000000c R09: 00007ffda1eedbd0 R10: 0000555556f4d940 R11: 0000000000000246 R12: 000000000075bfc8 R13: 0000000000000005 R14: 0000000000000001 R15: 000000000075bfd4 ======================================================