================================================================== BUG: KASAN: use-after-free in get_disk_and_module block/genhd.c:1787 [inline] BUG: KASAN: use-after-free in exact_lock+0x38/0xd0 block/genhd.c:677 Read of size 8 at addr ffff888118132460 by task syz.0.3956/16258 CPU: 0 PID: 16258 Comm: syz.0.3956 Tainted: G W 5.10.234-syzkaller-00023-g3f5f2283d684 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack_lvl+0x1e2/0x24b lib/dump_stack.c:118 print_address_description+0x81/0x3b0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:435 [inline] kasan_report+0x179/0x1c0 mm/kasan/report.c:452 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report_generic.c:309 get_disk_and_module block/genhd.c:1787 [inline] exact_lock+0x38/0xd0 block/genhd.c:677 kobj_lookup+0x294/0x430 drivers/base/map.c:119 get_gendisk+0xf7/0x3d0 block/genhd.c:1001 bdev_get_gendisk fs/block_dev.c:1110 [inline] __blkdev_get+0x18c/0x12f0 fs/block_dev.c:1474 blkdev_get fs/block_dev.c:1653 [inline] blkdev_open+0x241/0x480 fs/block_dev.c:1770 do_dentry_open+0x7c1/0x10d0 fs/open.c:819 vfs_open+0x73/0x80 fs/open.c:942 do_open fs/namei.c:3391 [inline] path_openat+0x2660/0x3000 fs/namei.c:3509 do_filp_open+0x21c/0x460 fs/namei.c:3536 do_sys_openat2+0x13f/0x710 fs/open.c:1217 do_sys_open fs/open.c:1233 [inline] __do_sys_openat fs/open.c:1249 [inline] __se_sys_openat fs/open.c:1244 [inline] __x64_sys_openat+0x243/0x290 fs/open.c:1244 do_syscall_64+0x34/0x70 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7fe548ea0ad0 Code: 48 89 44 24 20 75 93 44 89 54 24 0c e8 49 94 02 00 44 8b 54 24 0c 89 da 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 38 44 89 c7 89 44 24 0c e8 9c 94 02 00 8b 44 RSP: 002b:00007fe54750bb70 EFLAGS: 00000293 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 0000000000000a00 RCX: 00007fe548ea0ad0 RDX: 0000000000000a00 RSI: 00007fe54750bc10 RDI: 00000000ffffff9c RBP: 00007fe54750bc10 R08: 0000000000000000 R09: 0023706f6f6c2f76 R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000 R13: 0000000000000001 R14: 00007fe5490bafa0 R15: 00007ffe3219a008 Allocated by task 12754: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:430 [inline] ____kasan_kmalloc+0xdb/0x110 mm/kasan/common.c:509 __kasan_kmalloc+0x9/0x10 mm/kasan/common.c:518 kasan_kmalloc include/linux/kasan.h:254 [inline] kmem_cache_alloc_trace+0x18a/0x2e0 mm/slub.c:2974 kmem_cache_alloc_node_trace include/linux/slab.h:440 [inline] kmalloc_node include/linux/slab.h:570 [inline] kzalloc_node include/linux/slab.h:675 [inline] __alloc_disk_node+0x76/0x570 block/genhd.c:1727 loop_add+0x32d/0x750 drivers/block/loop.c:2158 loop_probe+0x12a/0x220 drivers/block/loop.c:2264 kobj_lookup+0x39c/0x430 drivers/base/map.c:124 get_gendisk+0xf7/0x3d0 block/genhd.c:1001 bdev_get_gendisk fs/block_dev.c:1110 [inline] __blkdev_get+0x18c/0x12f0 fs/block_dev.c:1474 blkdev_get fs/block_dev.c:1653 [inline] blkdev_open+0x241/0x480 fs/block_dev.c:1770 do_dentry_open+0x7c1/0x10d0 fs/open.c:819 vfs_open+0x73/0x80 fs/open.c:942 do_open fs/namei.c:3391 [inline] path_openat+0x2660/0x3000 fs/namei.c:3509 do_filp_open+0x21c/0x460 fs/namei.c:3536 do_sys_openat2+0x13f/0x710 fs/open.c:1217 do_sys_open fs/open.c:1233 [inline] __do_sys_openat fs/open.c:1249 [inline] __se_sys_openat fs/open.c:1244 [inline] __x64_sys_openat+0x243/0x290 fs/open.c:1244 do_syscall_64+0x34/0x70 entry_SYSCALL_64_after_hwframe+0x61/0xcb Freed by task 24: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:45 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370 ____kasan_slab_free+0x121/0x160 mm/kasan/common.c:362 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:370 kasan_slab_free include/linux/kasan.h:220 [inline] slab_free_hook mm/slub.c:1595 [inline] slab_free_freelist_hook+0xc0/0x190 mm/slub.c:1621 slab_free mm/slub.c:3203 [inline] kfree+0xc3/0x270 mm/slub.c:4191 skb_free_head net/core/skbuff.c:606 [inline] skb_release_data+0x5c6/0x6f0 net/core/skbuff.c:626 skb_release_all net/core/skbuff.c:680 [inline] __kfree_skb net/core/skbuff.c:694 [inline] kfree_skb+0xb9/0x320 net/core/skbuff.c:713 kauditd_hold_skb+0x115/0x200 kernel/audit.c:614 kauditd_send_queue+0x28d/0x2e0 kernel/audit.c:769 kauditd_thread+0x523/0x890 kernel/audit.c:893 kthread+0x34b/0x3d0 kernel/kthread.c:313 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298 The buggy address belongs to the object at ffff888118132000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 1120 bytes inside of 2048-byte region [ffff888118132000, ffff888118132800) The buggy address belongs to the page: page:ffffea0004604c00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888118135000 pfn:0x118130 head:ffffea0004604c00 order:3 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head) raw: 4000000000010200 ffffea00042fe608 ffffea000492f408 ffff888100042d80 raw: ffff888118135000 0000000000080007 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 12754, ts 516746528619, free_ts 516715964332 set_page_owner include/linux/page_owner.h:35 [inline] post_alloc_hook mm/page_alloc.c:2456 [inline] prep_new_page+0x166/0x180 mm/page_alloc.c:2462 get_page_from_freelist+0x2d8c/0x2f30 mm/page_alloc.c:4254 __alloc_pages_nodemask+0x435/0xaf0 mm/page_alloc.c:5348 allocate_slab mm/slub.c:1808 [inline] new_slab+0x80/0x400 mm/slub.c:1869 new_slab_objects mm/slub.c:2627 [inline] ___slab_alloc+0x302/0x4b0 mm/slub.c:2791 __slab_alloc+0x63/0xa0 mm/slub.c:2831 slab_alloc_node mm/slub.c:2913 [inline] slab_alloc mm/slub.c:2955 [inline] __kmalloc+0x204/0x330 mm/slub.c:4029 kmalloc include/linux/slab.h:557 [inline] kzalloc include/linux/slab.h:664 [inline] ipt_alloc_initial_table+0x6c/0x5a0 net/ipv4/netfilter/ip_tables.c:38 iptable_mangle_table_init+0x52/0xa0 net/ipv4/netfilter/iptable_mangle.c:94 xt_find_table_lock+0x24a/0x3e0 net/netfilter/x_tables.c:1219 xt_request_find_table_lock+0x27/0xf0 net/netfilter/x_tables.c:1249 get_info net/ipv4/netfilter/ip_tables.c:964 [inline] do_ipt_get_ctl+0x871/0x1880 net/ipv4/netfilter/ip_tables.c:1660 nf_getsockopt+0x26c/0x290 net/netfilter/nf_sockopt.c:116 ip_getsockopt+0x1539/0x2160 net/ipv4/ip_sockglue.c:1797 tcp_getsockopt+0x216/0x4a10 net/ipv4/tcp.c:4047 sock_common_getsockopt+0x99/0xb0 net/core/sock.c:3290 page last free stack trace: reset_page_owner include/linux/page_owner.h:28 [inline] free_pages_prepare mm/page_alloc.c:1349 [inline] __free_pages_ok+0x82c/0x850 mm/page_alloc.c:1629 free_the_page+0x76/0x370 mm/page_alloc.c:5409 __free_pages+0x67/0xc0 mm/page_alloc.c:5418 __free_slab+0xcf/0x190 mm/slub.c:1894 free_slab mm/slub.c:1909 [inline] discard_slab mm/slub.c:1915 [inline] unfreeze_partials+0x15e/0x190 mm/slub.c:2410 put_cpu_partial+0xbf/0x180 mm/slub.c:2446 __slab_free+0x2c8/0x3a0 mm/slub.c:3095 do_slab_free mm/slub.c:3191 [inline] ___cache_free+0x111/0x130 mm/slub.c:3210 qlink_free+0x50/0x90 mm/kasan/quarantine.c:157 qlist_free_all+0x47/0xb0 mm/kasan/quarantine.c:176 kasan_quarantine_reduce+0x15a/0x170 mm/kasan/quarantine.c:283 __kasan_slab_alloc+0x2f/0xe0 mm/kasan/common.c:440 kasan_slab_alloc include/linux/kasan.h:244 [inline] slab_post_alloc_hook+0x61/0x2f0 mm/slab.h:583 slab_alloc_node mm/slub.c:2947 [inline] slab_alloc mm/slub.c:2955 [inline] kmem_cache_alloc+0x168/0x2e0 mm/slub.c:2960 kmem_cache_alloc_node include/linux/slab.h:423 [inline] __alloc_skb+0x80/0x510 net/core/skbuff.c:200 alloc_skb include/linux/skbuff.h:1126 [inline] nlmsg_new include/net/netlink.h:953 [inline] rtmsg_ifinfo_build_skb+0x7f/0x180 net/core/rtnetlink.c:3841 Memory state around the buggy address: ffff888118132300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888118132380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888118132400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888118132480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888118132500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================