================================================================== BUG: KASAN: use-after-free in strcmp+0x9b/0xb0 lib/string.c:346 Read of size 1 at addr ffff888011a80c44 by task syz-executor.2/4959 CPU: 1 PID: 4959 Comm: syz-executor.2 Not tainted 5.17.0-rc5-syzkaller-00041-g73878e5eb1bd #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0x8d/0x336 mm/kasan/report.c:255 __kasan_report mm/kasan/report.c:442 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:459 strcmp+0x9b/0xb0 lib/string.c:346 replace_vma_anon_name mm/madvise.c:141 [inline] madvise_update_vma+0x4e6/0x7f0 mm/madvise.c:212 madvise_vma_behavior+0x116/0x1910 mm/madvise.c:1043 madvise_walk_vmas+0x1d5/0x2d0 mm/madvise.c:1207 do_madvise mm/madvise.c:1385 [inline] do_madvise+0x249/0x3c0 mm/madvise.c:1343 __do_sys_madvise mm/madvise.c:1398 [inline] __se_sys_madvise mm/madvise.c:1396 [inline] __x64_sys_madvise+0xa6/0x110 mm/madvise.c:1396 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7fd3a224e059 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd3a0bc3168 EFLAGS: 00000246 ORIG_RAX: 000000000000001c RAX: ffffffffffffffda RBX: 00007fd3a2360f60 RCX: 00007fd3a224e059 RDX: 0000000000000000 RSI: 0000000000004000 RDI: 0000000020ffc000 RBP: 00007fd3a22a808d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fff5438290f R14: 00007fd3a0bc3300 R15: 0000000000022000 Allocated by task 4959: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:436 [inline] ____kasan_kmalloc mm/kasan/common.c:515 [inline] ____kasan_kmalloc mm/kasan/common.c:474 [inline] __kasan_kmalloc+0xa9/0xd0 mm/kasan/common.c:524 kmalloc include/linux/slab.h:586 [inline] anon_vma_name_alloc mm/madvise.c:75 [inline] replace_vma_anon_name mm/madvise.c:146 [inline] madvise_update_vma+0x546/0x7f0 mm/madvise.c:212 madvise_vma_anon_name+0x7c/0xc0 mm/madvise.c:1236 madvise_walk_vmas+0x1d5/0x2d0 mm/madvise.c:1207 madvise_set_anon_name+0xac/0xe0 mm/madvise.c:1269 prctl_set_vma kernel/sys.c:2313 [inline] __do_sys_prctl+0xeb5/0x12d0 kernel/sys.c:2602 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Freed by task 4959: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track+0x21/0x30 mm/kasan/common.c:45 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370 ____kasan_slab_free mm/kasan/common.c:366 [inline] ____kasan_slab_free+0x126/0x160 mm/kasan/common.c:328 kasan_slab_free include/linux/kasan.h:236 [inline] slab_free_hook mm/slub.c:1728 [inline] slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1754 slab_free mm/slub.c:3509 [inline] kfree+0xd0/0x390 mm/slub.c:4562 vma_anon_name_free mm/madvise.c:88 [inline] kref_put include/linux/kref.h:65 [inline] free_vma_anon_name mm/madvise.c:125 [inline] free_vma_anon_name+0xeb/0x110 mm/madvise.c:116 vm_area_free+0x11/0x30 kernel/fork.c:376 __vma_adjust+0x836/0x24a0 mm/mmap.c:962 vma_merge+0x3fa/0xeb0 mm/mmap.c:1237 madvise_update_vma+0x1b6/0x7f0 mm/madvise.c:180 madvise_vma_behavior+0x116/0x1910 mm/madvise.c:1043 madvise_walk_vmas+0x1d5/0x2d0 mm/madvise.c:1207 do_madvise mm/madvise.c:1385 [inline] do_madvise+0x249/0x3c0 mm/madvise.c:1343 __do_sys_madvise mm/madvise.c:1398 [inline] __se_sys_madvise mm/madvise.c:1396 [inline] __x64_sys_madvise+0xa6/0x110 mm/madvise.c:1396 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Last potentially related work creation: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 __kasan_record_aux_stack+0xbe/0xd0 mm/kasan/generic.c:348 kvfree_call_rcu+0x74/0x990 kernel/rcu/tree.c:3591 memcg_update_list_lru_node mm/list_lru.c:411 [inline] memcg_update_list_lru mm/list_lru.c:467 [inline] memcg_update_all_list_lrus+0x2d7/0x780 mm/list_lru.c:501 memcg_alloc_cache_id mm/memcontrol.c:2964 [inline] memcg_online_kmem mm/memcontrol.c:3635 [inline] mem_cgroup_css_alloc+0x1098/0x1880 mm/memcontrol.c:5225 css_create kernel/cgroup/cgroup.c:5304 [inline] cgroup_apply_control_enable+0x4b8/0xc00 kernel/cgroup/cgroup.c:3124 cgroup_mkdir+0x5ba/0x12a0 kernel/cgroup/cgroup.c:5522 kernfs_iop_mkdir+0x146/0x1d0 fs/kernfs/dir.c:1169 vfs_mkdir+0x1c3/0x3b0 fs/namei.c:3933 do_mkdirat+0x285/0x300 fs/namei.c:3959 __do_sys_mkdir fs/namei.c:3979 [inline] __se_sys_mkdir fs/namei.c:3977 [inline] __x64_sys_mkdir+0xf2/0x140 fs/namei.c:3977 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae The buggy address belongs to the object at ffff888011a80c40 which belongs to the cache kmalloc-16 of size 16 The buggy address is located 4 bytes inside of 16-byte region [ffff888011a80c40, ffff888011a80c50) The buggy address belongs to the page: page:ffffea000046a000 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888011a80040 pfn:0x11a80 flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000200 ffffea0000883508 ffffea000046db88 ffff888010c413c0 raw: ffff888011a80040 0000000000800074 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1, ts 1911816284, free_ts 0 prep_new_page mm/page_alloc.c:2434 [inline] get_page_from_freelist+0xa72/0x2f50 mm/page_alloc.c:4165 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5389 alloc_page_interleave+0x1e/0x200 mm/mempolicy.c:2116 alloc_pages+0x2b1/0x310 mm/mempolicy.c:2266 alloc_slab_page mm/slub.c:1799 [inline] allocate_slab+0x27f/0x3c0 mm/slub.c:1944 new_slab mm/slub.c:2004 [inline] ___slab_alloc+0xbe1/0x12b0 mm/slub.c:3018 __slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3105 slab_alloc_node mm/slub.c:3196 [inline] __kmalloc_node+0x339/0x4a0 mm/slub.c:4468 kmalloc_node include/linux/slab.h:604 [inline] kvmalloc_node+0x3e/0x100 mm/util.c:580 kvmalloc include/linux/slab.h:731 [inline] memcg_init_list_lru_node mm/list_lru.c:366 [inline] memcg_init_list_lru mm/list_lru.c:437 [inline] __list_lru_init+0x4a7/0x9e0 mm/list_lru.c:595 alloc_super+0x86d/0xa80 fs/super.c:272 sget_fc+0x13e/0x7c0 fs/super.c:530 vfs_get_super fs/super.c:1134 [inline] get_tree_nodev+0x24/0x1d0 fs/super.c:1169 vfs_get_tree+0x89/0x2f0 fs/super.c:1497 fc_mount fs/namespace.c:1030 [inline] vfs_kern_mount.part.0+0xd3/0x170 fs/namespace.c:1060 vfs_kern_mount fs/namespace.c:1047 [inline] kern_mount+0x4f/0xc0 fs/namespace.c:4405 page_owner free stack trace missing Memory state around the buggy address: ffff888011a80b00: 00 00 fc fc 00 00 fc fc 00 00 fc fc 00 00 fc fc ffff888011a80b80: 00 00 fc fc fb fb fc fc fb fb fc fc fb fb fc fc >ffff888011a80c00: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc ^ ffff888011a80c80: fa fb fc fc 00 00 fc fc 00 00 fc fc fa fb fc fc ffff888011a80d00: fa fb fc fc fa fb fc fc fa fb fc fc 00 00 fc fc ==================================================================