==================================================================
BUG: KASAN: use-after-free in __lock_acquire+0x77/0x1f80 kernel/locking/lockdep.c:4919
Read of size 8 at addr ffff888058fc4598 by task swapper/0/0
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.1.83-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
print_address_description mm/kasan/report.c:284 [inline]
print_report+0x15f/0x4f0 mm/kasan/report.c:395
kasan_report+0x136/0x160 mm/kasan/report.c:495
__lock_acquire+0x77/0x1f80 kernel/locking/lockdep.c:4919
lock_acquire+0x1f8/0x5a0 kernel/locking/lockdep.c:5662
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd1/0x120 kernel/locking/spinlock.c:162
try_to_wake_up+0xad/0x12e0 kernel/sched/core.c:4112
call_timer_fn+0x1ad/0x6b0 kernel/time/timer.c:1474
expire_timers kernel/time/timer.c:1519 [inline]
__run_timers+0x67c/0x890 kernel/time/timer.c:1790
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1803
__do_softirq+0x2e9/0xa4c kernel/softirq.c:571
invoke_softirq kernel/softirq.c:445 [inline]
__irq_exit_rcu+0x155/0x240 kernel/softirq.c:650
irq_exit_rcu+0x5/0x20 kernel/softirq.c:662
sysvec_apic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1106
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:653
RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:22 [inline]
RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:70 [inline]
RIP: 0010:arch_irqs_disabled arch/x86/include/asm/irqflags.h:130 [inline]
RIP: 0010:acpi_safe_halt drivers/acpi/processor_idle.c:113 [inline]
RIP: 0010:acpi_idle_do_entry+0x10f/0x340 drivers/acpi/processor_idle.c:572
Code: 67 f6 f6 48 83 e3 08 0f 85 0b 01 00 00 4c 8d 74 24 20 e8 f4 23 fd f6 0f 1f 44 00 00 e8 9a 63 f6 f6 0f 00 2d a3 23 b3 00 fb f4 <4c> 89 f3 48 c1 eb 03 42 80 3c 3b 00 74 08 4c 89 f7 e8 6b d9 4d f7
RSP: 0018:ffffffff8ce07b20 EFLAGS: 000002d3
RAX: ffffffff8a942156 RBX: 0000000000000000 RCX: ffffffff8cebd800
RDX: 0000000000000000 RSI: ffffffff8aebee40 RDI: ffffffff8b3d2b40
RBP: ffffffff8ce07bb0 R08: ffffffff8a942138 R09: fffffbfff19d7b01
R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffffffff19c0f64
R13: ffff8881476f9804 R14: ffffffff8ce07b40 R15: dffffc0000000000
acpi_idle_enter+0x352/0x4f0 drivers/acpi/processor_idle.c:709
cpuidle_enter_state+0x516/0xf80 drivers/cpuidle/cpuidle.c:239
cpuidle_enter+0x59/0x90 drivers/cpuidle/cpuidle.c:356
call_cpuidle kernel/sched/idle.c:155 [inline]
cpuidle_idle_call kernel/sched/idle.c:236 [inline]
do_idle+0x3ce/0x680 kernel/sched/idle.c:303
cpu_startup_entry+0x3d/0x60 kernel/sched/idle.c:401
rest_init+0x2da/0x300 init/main.c:732
arch_call_rest_init+0xa/0xa init/main.c:892
start_kernel+0x496/0x53f init/main.c:1139
secondary_startup_64_no_verify+0xcf/0xdb
Allocated by task 2:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:52
__kasan_slab_alloc+0x65/0x70 mm/kasan/common.c:328
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook+0x52/0x3a0 mm/slab.h:737
slab_alloc_node mm/slub.c:3398 [inline]
kmem_cache_alloc_node+0x136/0x310 mm/slub.c:3443
alloc_task_struct_node kernel/fork.c:171 [inline]
dup_task_struct+0x57/0x6d0 kernel/fork.c:980
copy_process+0x637/0x4060 kernel/fork.c:2098
kernel_clone+0x222/0x920 kernel/fork.c:2682
kernel_thread+0x152/0x1d0 kernel/fork.c:2742
create_kthread kernel/kthread.c:399 [inline]
kthreadd+0x596/0x760 kernel/kthread.c:746
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:307
Freed by task 8597:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:52
kasan_save_free_info+0x27/0x40 mm/kasan/generic.c:516
____kasan_slab_free+0xd6/0x120 mm/kasan/common.c:236
kasan_slab_free include/linux/kasan.h:177 [inline]
slab_free_hook mm/slub.c:1724 [inline]
slab_free_freelist_hook mm/slub.c:1750 [inline]
slab_free mm/slub.c:3661 [inline]
kmem_cache_free+0x292/0x510 mm/slub.c:3683
rcu_do_batch kernel/rcu/tree.c:2296 [inline]
rcu_core+0xad4/0x17e0 kernel/rcu/tree.c:2556
__do_softirq+0x2e9/0xa4c kernel/softirq.c:571
Last potentially related work creation:
kasan_save_stack+0x3b/0x60 mm/kasan/common.c:45
__kasan_record_aux_stack+0xb0/0xc0 mm/kasan/generic.c:486
call_rcu+0x163/0xa10 kernel/rcu/tree.c:2844
context_switch kernel/sched/core.c:5248 [inline]
__schedule+0x1435/0x4550 kernel/sched/core.c:6558
schedule+0xbf/0x180 kernel/sched/core.c:6634
do_nanosleep+0x192/0x5f0 kernel/time/hrtimer.c:2045
hrtimer_nanosleep+0x24d/0x490 kernel/time/hrtimer.c:2098
__do_sys_clock_nanosleep kernel/time/posix-timers.c:1308 [inline]
__se_sys_clock_nanosleep+0x323/0x3b0 kernel/time/posix-timers.c:1285
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Second to last potentially related work creation:
kasan_save_stack+0x3b/0x60 mm/kasan/common.c:45
__kasan_record_aux_stack+0xb0/0xc0 mm/kasan/generic.c:486
call_rcu+0x163/0xa10 kernel/rcu/tree.c:2844
context_switch kernel/sched/core.c:5248 [inline]
__schedule+0x1435/0x4550 kernel/sched/core.c:6558
preempt_schedule_common+0x83/0xd0 kernel/sched/core.c:6727
preempt_schedule+0xd9/0xe0 kernel/sched/core.c:6751
preempt_schedule_thunk+0x16/0x18 arch/x86/entry/thunk_64.S:34
try_to_wake_up+0x87e/0x12e0 kernel/sched/core.c:4234
kthread_stop+0x1a2/0x690 kernel/kthread.c:708
destroy_workqueue+0xf2/0xae0 kernel/workqueue.c:4435
close_ctree+0x5ed/0xc35 fs/btrfs/disk-io.c:4744
generic_shutdown_super+0x130/0x340 fs/super.c:501
kill_anon_super+0x37/0x60 fs/super.c:1117
btrfs_kill_super+0x3d/0x50 fs/btrfs/super.c:2449
deactivate_locked_super+0xa0/0x110 fs/super.c:332
cleanup_mnt+0x490/0x520 fs/namespace.c:1186
task_work_run+0x246/0x300 kernel/task_work.c:179
resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
exit_to_user_mode_loop+0xde/0x100 kernel/entry/common.c:171
exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x60/0x270 kernel/entry/common.c:297
do_syscall_64+0x49/0xb0 arch/x86/entry/common.c:87
entry_SYSCALL_64_after_hwframe+0x63/0xcd
The buggy address belongs to the object at ffff888058fc3b80
which belongs to the cache task_struct of size 7360
The buggy address is located 2584 bytes inside of
7360-byte region [ffff888058fc3b80, ffff888058fc5840)
The buggy address belongs to the physical page:
page:ffffea000163f000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x58fc0
head:ffffea000163f000 order:3 compound_mapcount:0 compound_pincount:0
memcg:ffff888058d84a41
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 dead000000000100 dead000000000122 ffff888012626500
raw: 0000000000000000 0000000000040004 00000001ffffffff ffff888058d84a41
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 2, tgid 2 (kthreadd), ts 91117231312, free_ts 90410844251
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x18d/0x1b0 mm/page_alloc.c:2513
prep_new_page mm/page_alloc.c:2520 [inline]
get_page_from_freelist+0x31a1/0x3320 mm/page_alloc.c:4279
__alloc_pages+0x28d/0x770 mm/page_alloc.c:5545
alloc_slab_page+0x6a/0x150 mm/slub.c:1794
allocate_slab mm/slub.c:1939 [inline]
new_slab+0x84/0x2d0 mm/slub.c:1992
___slab_alloc+0xc20/0x1270 mm/slub.c:3180
__slab_alloc mm/slub.c:3279 [inline]
slab_alloc_node mm/slub.c:3364 [inline]
kmem_cache_alloc_node+0x1cf/0x310 mm/slub.c:3443
alloc_task_struct_node kernel/fork.c:171 [inline]
dup_task_struct+0x57/0x6d0 kernel/fork.c:980
copy_process+0x637/0x4060 kernel/fork.c:2098
kernel_clone+0x222/0x920 kernel/fork.c:2682
kernel_thread+0x152/0x1d0 kernel/fork.c:2742
create_kthread kernel/kthread.c:399 [inline]
kthreadd+0x596/0x760 kernel/kthread.c:746
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:307
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1440 [inline]
free_pcp_prepare mm/page_alloc.c:1490 [inline]
free_unref_page_prepare+0xf63/0x1120 mm/page_alloc.c:3358
free_unref_page+0x33/0x3e0 mm/page_alloc.c:3453
free_slab mm/slub.c:2031 [inline]
discard_slab mm/slub.c:2037 [inline]
__unfreeze_partials+0x1b7/0x210 mm/slub.c:2586
put_cpu_partial+0x17b/0x250 mm/slub.c:2662
qlink_free mm/kasan/quarantine.c:168 [inline]
qlist_free_all+0x76/0xe0 mm/kasan/quarantine.c:187
kasan_quarantine_reduce+0x156/0x170 mm/kasan/quarantine.c:294
__kasan_slab_alloc+0x1f/0x70 mm/kasan/common.c:305
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook+0x52/0x3a0 mm/slab.h:737
slab_alloc_node mm/slub.c:3398 [inline]
slab_alloc mm/slub.c:3406 [inline]
__kmem_cache_alloc_lru mm/slub.c:3413 [inline]
kmem_cache_alloc+0x10c/0x2d0 mm/slub.c:3422
getname_flags+0xb8/0x4f0 fs/namei.c:139
getname fs/namei.c:218 [inline]
__do_sys_unlink fs/namei.c:4440 [inline]
__se_sys_unlink fs/namei.c:4438 [inline]
__x64_sys_unlink+0x38/0x50 fs/namei.c:4438
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Memory state around the buggy address:
ffff888058fc4480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888058fc4500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888058fc4580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888058fc4600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888058fc4680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess):
0: 67 f6 f6 addr32 div %dh
3: 48 83 e3 08 and $0x8,%rbx
7: 0f 85 0b 01 00 00 jne 0x118
d: 4c 8d 74 24 20 lea 0x20(%rsp),%r14
12: e8 f4 23 fd f6 call 0xf6fd240b
17: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
1c: e8 9a 63 f6 f6 call 0xf6f663bb
21: 0f 00 2d a3 23 b3 00 verw 0xb323a3(%rip) # 0xb323cb
28: fb sti
29: f4 hlt
* 2a: 4c 89 f3 mov %r14,%rbx <-- trapping instruction
2d: 48 c1 eb 03 shr $0x3,%rbx
31: 42 80 3c 3b 00 cmpb $0x0,(%rbx,%r15,1)
36: 74 08 je 0x40
38: 4c 89 f7 mov %r14,%rdi
3b: e8 6b d9 4d f7 call 0xf74dd9ab