binder: 7226:7228 unknown command 0 binder: 7226:7228 ioctl c0306201 20a20000 returned -22 ================================================================== BUG: KASAN: use-after-free in __list_del_entry+0x1bd/0x1d0 lib/list_debug.c:48 Read of size 8 at addr ffff8801cd00f960 by task syz-executor0/7236 CPU: 0 PID: 7236 Comm: syz-executor0 Not tainted 4.9.87-ga290494 #53 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801db207b78 ffffffff81d95a19 ffffea00073403c0 ffff8801cd00f960 0000000000000000 ffff8801cd00f960 ffff8801cd00f958 ffff8801db207bb0 ffffffff8153e333 ffff8801cd00f960 0000000000000008 0000000000000000 Call Trace: [ 50.443719] [] __dump_stack lib/dump_stack.c:15 [inline] [ 50.443719] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] print_address_description+0x73/0x280 mm/kasan/report.c:252 [] kasan_report_error mm/kasan/report.c:351 [inline] [] kasan_report+0x275/0x360 mm/kasan/report.c:408 [] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:429 [] __list_del_entry+0x1bd/0x1d0 lib/list_debug.c:48 [] list_del_init include/linux/list.h:145 [inline] [] snd_timer_interrupt+0x5e6/0xc30 sound/core/timer.c:791 [] snd_timer_s_function+0xbd/0x120 sound/core/timer.c:1028 [] call_timer_fn+0x164/0x700 kernel/time/timer.c:1319 [] expire_timers kernel/time/timer.c:1359 [inline] [] __run_timers kernel/time/timer.c:1658 [inline] [] run_timer_softirq+0xe8c/0x1650 kernel/time/timer.c:1684 [] __do_softirq+0x206/0x951 kernel/softirq.c:284 [] invoke_softirq kernel/softirq.c:364 [inline] [] irq_exit+0x165/0x190 kernel/softirq.c:405 [] exiting_irq arch/x86/include/asm/apic.h:659 [inline] [] smp_apic_timer_interrupt+0x7b/0xa0 arch/x86/kernel/apic/apic.c:960 [] apic_timer_interrupt+0xa0/0xb0 arch/x86/entry/entry_64.S:649 [ 50.605578] [] ? exit_mm kernel/exit.c:514 [inline] [ 50.605578] [] ? do_exit+0x70a/0x2a40 kernel/exit.c:820 [] __save_stack_trace+0x7d/0xf0 arch/x86/kernel/stacktrace.c:42 [] save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57 [] save_stack+0x43/0xd0 mm/kasan/kasan.c:505 [] set_track mm/kasan/kasan.c:517 [inline] [] kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:582 [] slab_free_hook mm/slub.c:1355 [inline] [] slab_free_freelist_hook mm/slub.c:1377 [inline] [] slab_free mm/slub.c:2958 [inline] [] kmem_cache_free+0xc7/0x300 mm/slub.c:2980 [] remove_vma+0x11d/0x160 mm/mmap.c:175 [] exit_mmap+0x29a/0x400 mm/mmap.c:3000 [] __mmput kernel/fork.c:878 [inline] [] mmput+0xf3/0x2d0 kernel/fork.c:900 [] exit_mm kernel/exit.c:514 [inline] [] do_exit+0x70a/0x2a40 kernel/exit.c:820 [] do_group_exit+0x108/0x320 kernel/exit.c:937 [] get_signal+0x4d4/0x14e0 kernel/signal.c:2317 [] do_signal+0x87/0x19f0 arch/x86/kernel/signal.c:807 [] exit_to_usermode_loop+0xe1/0x120 arch/x86/entry/common.c:157 [] prepare_exit_to_usermode arch/x86/entry/common.c:191 [inline] [] syscall_return_slowpath arch/x86/entry/common.c:260 [inline] [] do_syscall_64+0x36f/0x490 arch/x86/entry/common.c:287 [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb Allocated by task 7222: save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57 save_stack+0x43/0xd0 mm/kasan/kasan.c:505 set_track mm/kasan/kasan.c:517 [inline] kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:609 kmem_cache_alloc_trace+0xfb/0x2a0 mm/slub.c:2742 kmalloc include/linux/slab.h:490 [inline] kzalloc include/linux/slab.h:636 [inline] snd_timer_instance_new+0x52/0x3a0 sound/core/timer.c:107 snd_timer_open+0x4f7/0xde0 sound/core/timer.c:290 snd_timer_user_tselect sound/core/timer.c:1621 [inline] __snd_timer_user_ioctl.isra.23+0x7c1/0x2280 sound/core/timer.c:1914 snd_timer_user_ioctl+0x7d/0xb0 sound/core/timer.c:1944 vfs_ioctl fs/ioctl.c:43 [inline] do_vfs_ioctl+0x1aa/0x1140 fs/ioctl.c:679 SYSC_ioctl fs/ioctl.c:694 [inline] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:685 do_syscall_64+0x1a4/0x490 arch/x86/entry/common.c:282 entry_SYSCALL_64_after_swapgs+0x5d/0xdb Freed by task 7224: save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57 save_stack+0x43/0xd0 mm/kasan/kasan.c:505 set_track mm/kasan/kasan.c:517 [inline] kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:582 slab_free_hook mm/slub.c:1355 [inline] slab_free_freelist_hook mm/slub.c:1377 [inline] slab_free mm/slub.c:2958 [inline] kfree+0x103/0x300 mm/slub.c:3878 snd_timer_close+0x376/0x670 sound/core/timer.c:372 snd_timer_user_release+0x97/0x130 sound/core/timer.c:1365 __fput+0x28c/0x6e0 fs/file_table.c:208 ____fput+0x15/0x20 fs/file_table.c:244 task_work_run+0x115/0x190 kernel/task_work.c:116 exit_task_work include/linux/task_work.h:21 [inline] do_exit+0x7e7/0x2a40 kernel/exit.c:833 do_group_exit+0x108/0x320 kernel/exit.c:937 get_signal+0x4d4/0x14e0 kernel/signal.c:2317 do_signal+0x87/0x19f0 arch/x86/kernel/signal.c:807 exit_to_usermode_loop+0xe1/0x120 arch/x86/entry/common.c:157 prepare_exit_to_usermode arch/x86/entry/common.c:191 [inline] syscall_return_slowpath arch/x86/entry/common.c:260 [inline] do_syscall_64+0x36f/0x490 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_swapgs+0x5d/0xdb The buggy address belongs to the object at ffff8801cd00f8c0 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 160 bytes inside of 256-byte region [ffff8801cd00f8c0, ffff8801cd00f9c0) The buggy address belongs to the page: page:ffffea00073403c0 count:1 mapcount:0 mapping: (null) index:0x0 flags: 0x8000000000000080(slab) page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8801cd00f800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8801cd00f880: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb >ffff8801cd00f900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8801cd00f980: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff8801cd00fa00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================