================================================================== BUG: KASAN: slab-use-after-free in list_add include/linux/list.h:192 [inline] BUG: KASAN: slab-use-after-free in add_to_unconfirmed+0x7ea/0x930 fs/nfsd/nfs4state.c:3993 Read of size 8 at addr ffff88804d9c7e50 by task nfsd/6425 CPU: 1 UID: 0 PID: 6425 Comm: nfsd Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x13d/0x4b0 mm/kasan/report.c:482 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595 list_add include/linux/list.h:192 [inline] add_to_unconfirmed+0x7ea/0x930 fs/nfsd/nfs4state.c:3993 nfsd4_exchange_id+0x10c0/0x15b0 fs/nfsd/nfs4state.c:4407 nfsd4_proc_compound+0xcdb/0x2830 fs/nfsd/nfs4proc.c:3313 nfsd_dispatch+0x29e/0xa10 fs/nfsd/nfssvc.c:1038 svc_process_common+0x11e5/0x1ac0 net/sunrpc/svc.c:1527 svc_process+0x6d3/0xcf0 net/sunrpc/svc.c:1682 svc_handle_xprt net/sunrpc/svc_xprt.c:886 [inline] svc_recv+0x1ec2/0x2bd0 net/sunrpc/svc_xprt.c:968 nfsd+0x312/0xc20 fs/nfsd/nfssvc.c:919 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Allocated by task 6341: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:409 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:426 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x2f8/0x6d0 mm/slub.c:5563 _kmalloc_noprof include/linux/slab.h:991 [inline] nfs4_state_create_net fs/nfsd/nfs4state.c:9736 [inline] nfs4_state_start_net+0x13b/0xf00 fs/nfsd/nfs4state.c:9834 nfsd_startup_net fs/nfsd/nfssvc.c:391 [inline] nfsd_svc+0x54a/0x7d0 fs/nfsd/nfssvc.c:775 write_threads+0x316/0x600 fs/nfsd/nfsctl.c:438 nfsctl_transaction_write+0x106/0x1a0 fs/nfsd/nfsctl.c:114 vfs_write+0x2aa/0x1050 fs/read_write.c:685 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline] __do_fast_syscall_32+0x13a/0x8b0 arch/x86/entry/syscall_32.c:291 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:316 entry_SYSENTER_compat_after_hwframe+0x84/0x8e Freed by task 6341: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:264 [inline] __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:296 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2748 [inline] slab_free mm/slub.c:6509 [inline] kfree+0x22b/0x6d0 mm/slub.c:6802 nfs4_state_destroy_net fs/nfsd/nfs4state.c:9823 [inline] nfs4_state_shutdown_net+0xcb2/0x11c0 fs/nfsd/nfs4state.c:9908 nfsd_shutdown_net fs/nfsd/nfssvc.c:421 [inline] nfsd_destroy_serv+0x385/0x4b0 fs/nfsd/nfssvc.c:534 nfsd_svc+0x48e/0x7d0 fs/nfsd/nfssvc.c:784 write_threads+0x316/0x600 fs/nfsd/nfsctl.c:438 nfsctl_transaction_write+0x106/0x1a0 fs/nfsd/nfsctl.c:114 vfs_write+0x2aa/0x1050 fs/read_write.c:685 ksys_write+0x12a/0x250 fs/read_write.c:739 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline] __do_fast_syscall_32+0x13a/0x8b0 arch/x86/entry/syscall_32.c:291 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:316 entry_SYSENTER_compat_after_hwframe+0x84/0x8e The buggy address belongs to the object at ffff88804d9c7e00 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 80 bytes inside of freed 256-byte region [ffff88804d9c7e00, ffff88804d9c7f00) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4d9c6 head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x4fff00000000040(head|node=1|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 04fff00000000040 ffff88801c042b40 dead000000000100 dead000000000122 raw: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 04fff00000000040 ffff88801c042b40 dead000000000100 dead000000000122 head: 0000000000000000 0000000000100010 00000000f5000000 0000000000000000 head: 04fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 1, migratetype Unmovable, gfp_mask 0x252800(GFP_NOWAIT|__GFP_NORETRY|__GFP_COMP|__GFP_THISNODE), pid 5997, tgid 5997 (syz.0.50), ts 43667068718 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1871 prep_new_page mm/page_alloc.c:1879 [inline] get_page_from_freelist+0x110d/0x35d0 mm/page_alloc.c:3943 __alloc_frozen_pages_noprof+0x2eb/0x3300 mm/page_alloc.c:5436 alloc_slab_page mm/slub.c:3347 [inline] allocate_slab mm/slub.c:3462 [inline] new_slab+0xa9/0x6e0 mm/slub.c:3513 ___slab_alloc+0x5d1/0x810 mm/slub.c:4568 slab_alloc_node mm/slub.c:4987 [inline] __do_kmalloc_node mm/slub.c:5413 [inline] __kmalloc_flags_noprof+0x470/0x8e0 mm/slub.c:5602 _kmalloc_flags_noprof mm/slab.h:55 [inline] alloc_slab_obj_exts+0x6a/0x170 mm/slub.c:2186 __memcg_slab_post_alloc_hook+0x3fc/0x10c0 mm/memcontrol.c:3649 memcg_slab_post_alloc_hook mm/slub.c:2517 [inline] slab_post_alloc_hook mm/slub.c:4702 [inline] slab_alloc_node mm/slub.c:4996 [inline] kmem_cache_alloc_noprof+0x4fa/0x6a0 mm/slub.c:5010 vm_area_dup+0x27/0x9d0 mm/vma_init.c:128 __split_vma+0x19c/0x1de0 mm/vma.c:560 split_vma mm/vma.c:643 [inline] vma_modify+0x1ef4/0x29b0 mm/vma.c:1771 vma_modify_flags+0x2c3/0x460 mm/vma.c:1799 mprotect_fixup+0x27a/0xe00 mm/mprotect.c:824 do_mprotect_pkey+0xa51/0xdd0 mm/mprotect.c:1002 __do_sys_mprotect mm/mprotect.c:1023 [inline] __se_sys_mprotect mm/mprotect.c:1020 [inline] __ia32_sys_mprotect+0x75/0xb0 mm/mprotect.c:1020 page last free pid 5990 tgid 5990 ts 43636288281 stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] __free_pages_prepare mm/page_alloc.c:1418 [inline] free_pages_prepare+0x586/0xe00 mm/page_alloc.c:1463 __free_contig_range_common+0x14f/0x250 mm/page_alloc.c:7072 __free_contig_range mm/page_alloc.c:7117 [inline] free_pages_bulk+0x12a/0x200 mm/page_alloc.c:5322 vm_area_free_pages+0xb2/0x2a0 mm/vmalloc.c:3461 vfree mm/vmalloc.c:3510 [inline] vfree+0xf7/0x6d0 mm/vmalloc.c:3484 dvb_dmxdev_filter_free drivers/media/dvb-core/dmxdev.c:865 [inline] dvb_demux_release+0x264/0x560 drivers/media/dvb-core/dmxdev.c:1256 __fput+0x3ff/0xb50 fs/file_table.c:512 task_work_run+0x150/0x240 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:70 [inline] exit_to_user_mode_loop+0x1d8/0x700 kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:343 [inline] __do_fast_syscall_32+0x59f/0x8b0 arch/x86/entry/syscall_32.c:294 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:316 entry_SYSENTER_compat_after_hwframe+0x84/0x8e Memory state around the buggy address: ffff88804d9c7d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88804d9c7d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88804d9c7e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88804d9c7e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88804d9c7f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================