list_add double add: new=ffff8881cac6a6f8, prev=ffff8881c8d1eae8, next=ffff8881cac6a6f8. ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:31! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 19519 Comm: syz-executor.3 Not tainted 5.4.70-syzkaller-00063-gd0e6eb879517 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__list_add_valid+0x8a/0xc0 lib/list_debug.c:29 Code: 74 11 4d 39 f7 74 0c b0 01 5b 41 5c 41 5d 41 5e 41 5f c3 48 c7 c7 9f 0a 99 84 4c 89 fe 4c 89 e2 4c 89 f1 31 c0 e8 22 dc 30 ff <0f> 0b 48 c7 c7 ea 09 99 84 4c 89 e6 4c 89 f1 31 c0 e8 0c dc 30 ff RSP: 0018:ffff8881d7b2f390 EFLAGS: 00010046 RAX: 0000000000000058 RBX: ffff8881cac6a700 RCX: f9492ab25a397c00 RDX: ffffc90002af2000 RSI: 000000000000621c RDI: 000000000000621d RBP: ffff8881d7b2f4b0 R08: ffffffff812ba15e R09: ffffed103b725e00 R10: ffffed103b725e00 R11: 0000000000000000 R12: ffff8881c8d1eae8 R13: dffffc0000000000 R14: ffff8881cac6a6f8 R15: ffff8881cac6a6f8 FS: 00007f222e394700(0000) GS:ffff8881db900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000118c000 CR3: 00000001d0006003 CR4: 00000000001606e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __list_add include/linux/list.h:60 [inline] list_add include/linux/list.h:79 [inline] io_queue_async_work fs/io_uring.c:520 [inline] io_poll_wake+0x6f6/0xb90 fs/io_uring.c:1864 __wake_up_common+0x27a/0x450 kernel/sched/wait.c:93 __wake_up_common_lock kernel/sched/wait.c:123 [inline] __wake_up+0x145/0x210 kernel/sched/wait.c:142 fsnotify_add_event+0x2dc/0x370 fs/notify/notification.c:126 inotify_handle_event+0x3d2/0x5f0 fs/notify/inotify/inotify_fsnotify.c:129 inotify_ignored_and_remove_idr+0xd9/0x170 fs/notify/inotify/inotify_user.c:493 inotify_handle_event+0x436/0x5f0 fs/notify/inotify/inotify_fsnotify.c:136 send_to_group fs/notify/fsnotify.c:234 [inline] fsnotify+0xe67/0x1460 fs/notify/fsnotify.c:372 fsnotify_dirent include/linux/fsnotify.h:29 [inline] fsnotify_create include/linux/fsnotify.h:175 [inline] lookup_open fs/namei.c:3313 [inline] do_last fs/namei.c:3401 [inline] path_openat+0x289f/0x4270 fs/namei.c:3612 do_filp_open+0x1f7/0x430 fs/namei.c:3642 do_sys_open+0x343/0x620 fs/open.c:1094 do_syscall_64+0xcb/0x150 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x45de59 Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f222e393c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000002 RAX: ffffffffffffffda RBX: 0000000000022180 RCX: 000000000045de59 RDX: 0000000000000000 RSI: 000000000008027e RDI: 0000000020000040 RBP: 000000000118bf60 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000118bf2c R13: 00007ffd626cb46f R14: 00007f222e3949c0 R15: 000000000118bf2c Modules linked in: ---[ end trace ec1028a4916a99a6 ]--- RIP: 0010:__list_add_valid+0x8a/0xc0 lib/list_debug.c:29 Code: 74 11 4d 39 f7 74 0c b0 01 5b 41 5c 41 5d 41 5e 41 5f c3 48 c7 c7 9f 0a 99 84 4c 89 fe 4c 89 e2 4c 89 f1 31 c0 e8 22 dc 30 ff <0f> 0b 48 c7 c7 ea 09 99 84 4c 89 e6 4c 89 f1 31 c0 e8 0c dc 30 ff RSP: 0018:ffff8881d7b2f390 EFLAGS: 00010046 RAX: 0000000000000058 RBX: ffff8881cac6a700 RCX: f9492ab25a397c00 RDX: ffffc90002af2000 RSI: 000000000000621c RDI: 000000000000621d RBP: ffff8881d7b2f4b0 R08: ffffffff812ba15e R09: ffffed103b725e00 R10: ffffed103b725e00 R11: 0000000000000000 R12: ffff8881c8d1eae8 R13: dffffc0000000000 R14: ffff8881cac6a6f8 R15: ffff8881cac6a6f8 FS: 00007f222e394700(0000) GS:ffff8881db900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000118c000 CR3: 00000001d0006003 CR4: 00000000001606e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400