list_add corruption. prev->next should be next (ffffffff89fd0da0), but was ffff8881bdf52270. (prev=ffff8881d13882b0). ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:28! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 21584 Comm: blkid Not tainted 4.20.0-rc4+ #334 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__list_add_valid.cold.2+0x23/0x2a lib/list_debug.c:26 Code: e8 90 fd d1 fd 0f 0b 48 89 d9 48 c7 c7 a0 d8 60 88 e8 7f fd d1 fd 0f 0b 48 89 f1 48 c7 c7 20 d9 60 88 48 89 de e8 6b fd d1 fd <0f> 0b 90 90 90 90 90 55 48 89 e5 41 57 41 56 49 be 00 00 00 00 00 RSP: 0018:ffff8881dae06cf0 EFLAGS: 00010282 RAX: 0000000000000075 RBX: ffffffff89fd0da0 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff8165eae5 RDI: 0000000000000005 kobject: 'loop2' (00000000800bb691): kobject_uevent_env RBP: ffff8881dae06d08 R08: ffff8881c113c200 R09: ffffed103b5c5020 kobject: 'loop2' (00000000800bb691): fill_kobj_path: path = '/devices/virtual/block/loop2' R10: ffffed103b5c5020 R11: ffff8881dae28107 R12: ffff8881b3c542b0 R13: ffff8881b3c54040 R14: ffffffff89fd0b60 R15: ffffffff89fd0df0 FS: 00007f91780d9740(0000) GS:ffff8881dae00000(0000) knlGS:0000000000000000 kobject: 'loop5' (0000000080c68fea): kobject_uevent_env CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 kobject: 'loop5' (0000000080c68fea): fill_kobj_path: path = '/devices/virtual/block/loop5' CR2: 00007f9177ec0000 CR3: 00000001cb9c9000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: kobject: 'loop0' (0000000019b8930c): kobject_uevent_env __list_add include/linux/list.h:60 [inline] list_add_tail include/linux/list.h:93 [inline] neigh_alloc net/core/neighbour.c:395 [inline] ___neigh_create+0x14b7/0x2600 net/core/neighbour.c:553 kobject: 'loop0' (0000000019b8930c): fill_kobj_path: path = '/devices/virtual/block/loop0' kobject: 'loop0' (0000000019b8930c): kobject_uevent_env kobject: 'loop0' (0000000019b8930c): fill_kobj_path: path = '/devices/virtual/block/loop0' kobject: 'loop4' (000000002ba5206f): kobject_uevent_env __neigh_create+0x30/0x40 net/core/neighbour.c:640 ip6_finish_output2+0xa59/0x27a0 net/ipv6/ip6_output.c:117 kobject: 'loop4' (000000002ba5206f): fill_kobj_path: path = '/devices/virtual/block/loop4' kobject: 'loop0' (0000000019b8930c): kobject_uevent_env kobject: 'loop0' (0000000019b8930c): fill_kobj_path: path = '/devices/virtual/block/loop0' kobject: 'loop3' (0000000053a5558a): kobject_uevent_env ip6_finish_output+0x58c/0xc60 net/ipv6/ip6_output.c:154 kobject: 'loop3' (0000000053a5558a): fill_kobj_path: path = '/devices/virtual/block/loop3' kobject: 'loop2' (00000000800bb691): kobject_uevent_env NF_HOOK_COND include/linux/netfilter.h:278 [inline] ip6_output+0x232/0x9d0 net/ipv6/ip6_output.c:171 dst_output include/net/dst.h:444 [inline] NF_HOOK include/linux/netfilter.h:289 [inline] ndisc_send_skb+0x1005/0x1560 net/ipv6/ndisc.c:491 kobject: 'loop2' (00000000800bb691): fill_kobj_path: path = '/devices/virtual/block/loop2' ndisc_send_rs+0x134/0x6e0 net/ipv6/ndisc.c:685 addrconf_rs_timer+0x314/0x690 net/ipv6/addrconf.c:3840 call_timer_fn+0x272/0x920 kernel/time/timer.c:1326 kobject: 'loop5' (0000000080c68fea): kobject_uevent_env kobject: 'loop5' (0000000080c68fea): fill_kobj_path: path = '/devices/virtual/block/loop5' kobject: 'loop3' (0000000053a5558a): kobject_uevent_env expire_timers kernel/time/timer.c:1363 [inline] __run_timers+0x7e5/0xc70 kernel/time/timer.c:1682 kobject: 'loop3' (0000000053a5558a): fill_kobj_path: path = '/devices/virtual/block/loop3' kobject: 'loop5' (0000000080c68fea): kobject_uevent_env kobject: 'loop5' (0000000080c68fea): fill_kobj_path: path = '/devices/virtual/block/loop5' run_timer_softirq+0x52/0xb0 kernel/time/timer.c:1695 kobject: 'loop3' (0000000053a5558a): kobject_uevent_env __do_softirq+0x308/0xb7e kernel/softirq.c:292 kobject: 'loop3' (0000000053a5558a): fill_kobj_path: path = '/devices/virtual/block/loop3' kobject: 'loop5' (0000000080c68fea): kobject_uevent_env kobject: 'loop5' (0000000080c68fea): fill_kobj_path: path = '/devices/virtual/block/loop5' invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0x17f/0x1c0 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x1cb/0x760 arch/x86/kernel/apic/apic.c:1061 kobject: 'loop3' (0000000053a5558a): kobject_uevent_env kobject: 'loop3' (0000000053a5558a): fill_kobj_path: path = '/devices/virtual/block/loop3' kobject: 'loop0' (0000000019b8930c): kobject_uevent_env kobject: 'loop0' (0000000019b8930c): fill_kobj_path: path = '/devices/virtual/block/loop0' kobject: 'loop2' (00000000800bb691): kobject_uevent_env apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:804 kobject: 'loop2' (00000000800bb691): fill_kobj_path: path = '/devices/virtual/block/loop2' RIP: 0010:anon_vma_clone+0x304/0x710 mm/rmap.c:289 Code: 48 ff ff ff c6 00 f8 e8 ba 08 c7 ff 49 8d b5 98 00 00 00 4c 89 e7 e8 1b 86 f7 ff 48 8b 85 40 ff ff ff 48 c1 e8 03 80 3c 18 00 <0f> 85 f9 02 00 00 48 8b 85 70 ff ff ff 48 83 b8 88 00 00 00 00 0f kobject: 'loop3' (0000000053a5558a): kobject_uevent_env RSP: 0018:ffff8881b3107a40 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13 RAX: 1ffff110399aa0df RBX: dffffc0000000000 RCX: 0000000000000000 RDX: ffffed1036620ec2 RSI: dffffc0000000000 RDI: ffffed1036620f32 kobject: 'loop3' (0000000053a5558a): fill_kobj_path: path = '/devices/virtual/block/loop3' RBP: ffff8881b3107b18 R08: ffffffff81afe930 R09: ffff8881bdfa1bb8 R10: 000000000000723c R11: ffff8881c113c200 R12: ffff8881cdbbae00 R13: ffff8881bdfa1b20 R14: ffff8881bc183460 R15: ffff8881cdbbae10 kobject: 'loop2' (00000000800bb691): kobject_uevent_env kobject: 'loop2' (00000000800bb691): fill_kobj_path: path = '/devices/virtual/block/loop2' __split_vma+0x183/0x570 mm/mmap.c:2663 kobject: 'loop0' (0000000019b8930c): kobject_uevent_env split_vma+0xa3/0xe0 mm/mmap.c:2706 kobject: 'loop0' (0000000019b8930c): fill_kobj_path: path = '/devices/virtual/block/loop0' mprotect_fixup+0x97a/0xc60 mm/mprotect.c:417 kobject: 'loop4' (000000002ba5206f): kobject_uevent_env kobject: 'loop4' (000000002ba5206f): fill_kobj_path: path = '/devices/virtual/block/loop4' kobject: 'loop3' (0000000053a5558a): kobject_uevent_env do_mprotect_pkey+0x5d2/0xa60 mm/mprotect.c:555 kobject: 'loop3' (0000000053a5558a): fill_kobj_path: path = '/devices/virtual/block/loop3' __do_sys_mprotect mm/mprotect.c:580 [inline] __se_sys_mprotect mm/mprotect.c:577 [inline] __x64_sys_mprotect+0x78/0xb0 mm/mprotect.c:577 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 kobject: 'loop4' (000000002ba5206f): kobject_uevent_env kobject: 'loop4' (000000002ba5206f): fill_kobj_path: path = '/devices/virtual/block/loop4' entry_SYSCALL_64_after_hwframe+0x49/0xbe kobject: 'loop3' (0000000053a5558a): kobject_uevent_env RIP: 0033:0x7f9177ed9447 Code: 73 01 c3 48 8d 0d 5d ad 20 00 31 d2 48 29 c2 89 11 48 83 c8 ff eb eb 90 90 90 90 90 90 90 90 90 90 90 90 b8 0a 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8d 0d 2d ad 20 00 31 d2 48 29 c2 89 RSP: 002b:00007fffe61dd2d8 EFLAGS: 00000206 ORIG_RAX: 000000000000000a kobject: 'loop3' (0000000053a5558a): fill_kobj_path: path = '/devices/virtual/block/loop3' RAX: ffffffffffffffda RBX: 00007f91780e41c8 RCX: 00007f9177ed9447 RDX: 0000000000000001 RSI: 0000000000001000 RDI: 0000000000606000 RBP: 00007fffe61dd3d0 R08: 0000000000000001 R09: 0000000000000039 R10: 0000000000401f88 R11: 0000000000000206 R12: 0000000000000000 R13: 00000000006072c8 R14: 0000000000401f88 R15: 0000000000607330 kobject: 'loop0' (0000000019b8930c): kobject_uevent_env Modules linked in: kobject: 'loop0' (0000000019b8930c): fill_kobj_path: path = '/devices/virtual/block/loop0' ---[ end trace 8f928e2f9dbedfa0 ]--- cgroup: fork rejected by pids controller in /syz1 RIP: 0010:__list_add_valid.cold.2+0x23/0x2a lib/list_debug.c:26 Code: e8 90 fd d1 fd 0f 0b 48 89 d9 48 c7 c7 a0 d8 60 88 e8 7f fd d1 fd 0f 0b 48 89 f1 48 c7 c7 20 d9 60 88 48 89 de e8 6b fd d1 fd <0f> 0b 90 90 90 90 90 55 48 89 e5 41 57 41 56 49 be 00 00 00 00 00 RSP: 0018:ffff8881dae06cf0 EFLAGS: 00010282 kobject: 'loop2' (00000000800bb691): kobject_uevent_env RAX: 0000000000000075 RBX: ffffffff89fd0da0 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff8165eae5 RDI: 0000000000000005 RBP: ffff8881dae06d08 R08: ffff8881c113c200 R09: ffffed103b5c5020 R10: ffffed103b5c5020 R11: ffff8881dae28107 R12: ffff8881b3c542b0 R13: ffff8881b3c54040 R14: ffffffff89fd0b60 R15: ffffffff89fd0df0 FS: 00007f91780d9740(0000) GS:ffff8881dae00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f9177ec0000 CR3: 00000001cb9c9000 CR4: 00000000001406f0 kobject: 'loop2' (00000000800bb691): fill_kobj_path: path = '/devices/virtual/block/loop2' DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400