list_add double add: new=ffff880185d20198, prev=ffff880185d20198, next=ffff8801c63facc0. ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:31! invalid opcode: 0000 [#1] SMP KASAN CPU: 0 PID: 4455 Comm: syz-executor4 Not tainted 4.18.0+ #188 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__list_add_valid+0xaa/0xb0 lib/list_debug.c:29 Code: e8 eb a9 48 89 f7 48 89 75 e8 e8 f1 dc 58 fe 48 8b 75 e8 eb bb 48 89 f2 48 89 d9 4c 89 e6 48 c7 c7 60 7e 3a 87 e8 6a 82 01 fe <0f> 0b 0f 1f 40 00 48 b8 00 00 00 00 00 fc ff df 55 48 89 e5 41 55 RSP: 0018:ffff88019eea7378 EFLAGS: 00010282 RAX: 0000000000000058 RBX: ffff8801c63facc0 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff81637071 RDI: 0000000000000001 RBP: ffff88019eea7390 R08: ffff88019ee9c4c0 R09: ffffed003b604fd0 R10: ffffed003b604fd0 R11: ffff8801db027e87 R12: ffff880185d20198 R13: ffff8801b28c0280 R14: ffff880185d20170 R15: ffff880185d20198 FS: 0000000001d98940(0000) GS:ffff8801db000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000001da1978 CR3: 000000019ee88000 CR4: 00000000001406f0 DR0: 0000000020000000 DR1: 0000000020000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: __list_add include/linux/list.h:60 [inline] list_add_tail include/linux/list.h:93 [inline] p9_fd_request+0x145/0x440 net/9p/trans_fd.c:667 p9_client_rpc+0x290/0x1400 net/9p/client.c:769 p9_client_clunk+0x93/0x180 net/9p/client.c:1489 v9fs_dentry_release+0x68/0xd0 fs/9p/vfs_dentry.c:73 __dentry_kill+0x4c0/0x7a0 fs/dcache.c:570 dentry_kill+0xc9/0x5a0 fs/dcache.c:684 dput.part.26+0x66b/0x7a0 fs/dcache.c:845 dput fs/dcache.c:828 [inline] do_one_tree+0x37/0x40 fs/dcache.c:1528 shrink_dcache_for_umount+0xc7/0x2b0 fs/dcache.c:1542 generic_shutdown_super+0xd5/0x530 fs/super.c:438 kill_anon_super+0x3c/0x50 fs/super.c:1046 v9fs_kill_super+0x3e/0xa0 fs/9p/vfs_super.c:230 deactivate_locked_super+0x97/0x100 fs/super.c:326 deactivate_super+0x2bb/0x320 fs/super.c:357 cleanup_mnt+0xbf/0x160 fs/namespace.c:1183 __cleanup_mnt+0x16/0x20 fs/namespace.c:1190 task_work_run+0x1e8/0x2a0 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:192 [inline] exit_to_usermode_loop+0x313/0x370 arch/x86/entry/common.c:166 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline] syscall_return_slowpath arch/x86/entry/common.c:268 [inline] do_syscall_64+0x6be/0x820 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x459a97 Code: 44 00 00 b8 08 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 dd 8a fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 bd 8a fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ffcad8b98a8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 000000000005d255 RCX: 0000000000459a97 RDX: 0000000000408440 RSI: 0000000000000002 RDI: 00007ffcad8b9950 RBP: 0000000000000847 R08: 0000000000000000 R09: 000000000000000b R10: 0000000000000005 R11: 0000000000000202 R12: 00007ffcad8ba9b0 R13: 0000000001d99940 R14: 0000000000000000 R15: badc0ffeebadface Modules linked in: Dumping ftrace buffer: --------------------------------- syz-exec-11343 0...2 224368452us : 0: }D syz-exec-11343 0.Ns3 224368633us : 0: }D --------------------------------- ---[ end trace 691ad84921f2f1d7 ]--- RIP: 0010:__list_add_valid+0xaa/0xb0 lib/list_debug.c:29 Code: e8 eb a9 48 89 f7 48 89 75 e8 e8 f1 dc 58 fe 48 8b 75 e8 eb bb 48 89 f2 48 89 d9 4c 89 e6 48 c7 c7 60 7e 3a 87 e8 6a 82 01 fe <0f> 0b 0f 1f 40 00 48 b8 00 00 00 00 00 fc ff df 55 48 89 e5 41 55 RSP: 0018:ffff88019eea7378 EFLAGS: 00010282 RAX: 0000000000000058 RBX: ffff8801c63facc0 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff81637071 RDI: 0000000000000001 RBP: ffff88019eea7390 R08: ffff88019ee9c4c0 R09: ffffed003b604fd0 R10: ffffed003b604fd0 R11: ffff8801db027e87 R12: ffff880185d20198 R13: ffff8801b28c0280 R14: ffff880185d20170 R15: ffff880185d20198 FS: 0000000001d98940(0000) GS:ffff8801db000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000001da1978 CR3: 000000019ee88000 CR4: 00000000001406f0 DR0: 0000000020000000 DR1: 0000000020000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600