================================================================== BUG: KASAN: use-after-free in task_css include/linux/cgroup.h:455 [inline] BUG: KASAN: use-after-free in task_ca kernel/sched/cpuacct.c:53 [inline] BUG: KASAN: use-after-free in cpuacct_charge+0x328/0x360 kernel/sched/cpuacct.c:359 Read of size 8 at addr ffff8801cf4a62e0 by task syz-executor2/3838 CPU: 0 PID: 3838 Comm: syz-executor2 Not tainted 4.9.122-g54068d6 #78 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801b1e97a08 ffffffff81eb8829 ffffea00073d2980 ffff8801cf4a62e0 0000000000000000 ffff8801cf4a62e0 0000000000000000 ffff8801b1e97a40 ffffffff8156b6be ffff8801cf4a62e0 0000000000000008 0000000000000000 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] print_address_description+0x6c/0x234 mm/kasan/report.c:256 [] kasan_report_error mm/kasan/report.c:355 [inline] [] kasan_report.cold.6+0x242/0x2fe mm/kasan/report.c:412 [] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433 [] task_css include/linux/cgroup.h:455 [inline] [] task_ca kernel/sched/cpuacct.c:53 [inline] [] cpuacct_charge+0x328/0x360 kernel/sched/cpuacct.c:359 [] update_curr+0x28b/0x680 kernel/sched/fair.c:874 [] dequeue_entity kernel/sched/fair.c:3721 [inline] [] dequeue_task_fair+0xe3/0x1000 kernel/sched/fair.c:4903 [] dequeue_task kernel/sched/core.c:782 [inline] [] deactivate_task+0xfb/0x2e0 kernel/sched/core.c:798 [] __schedule+0x981/0x1bd0 kernel/sched/core.c:3458 [] schedule+0x7f/0x1b0 kernel/sched/core.c:3553 [] freezable_schedule include/linux/freezer.h:171 [inline] [] do_nanosleep+0x1f5/0x4d0 kernel/time/hrtimer.c:1497 [] hrtimer_nanosleep+0x210/0x540 kernel/time/hrtimer.c:1566 [] SYSC_nanosleep kernel/time/hrtimer.c:1604 [inline] [] SyS_nanosleep+0xcc/0x120 kernel/time/hrtimer.c:1593 [] do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282 [] entry_SYSCALL_64_after_swapgs+0x5d/0xdb Allocated by task 3838: save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57 save_stack+0x43/0xd0 mm/kasan/kasan.c:505 set_track mm/kasan/kasan.c:517 [inline] kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:609 kmem_cache_alloc_trace+0xfd/0x2b0 mm/slub.c:2742 kmalloc include/linux/slab.h:490 [inline] kzalloc include/linux/slab.h:636 [inline] find_css_set kernel/cgroup.c:1087 [inline] cgroup_migrate_prepare_dst+0x779/0x1810 kernel/cgroup.c:2723 cgroup_attach_task+0x2b3/0x6f0 kernel/cgroup.c:2833 __cgroup_procs_write.constprop.40+0x61f/0xba0 kernel/cgroup.c:2939 cgroup_procs_write+0x2a/0x40 kernel/cgroup.c:2997 cgroup_file_write+0x10d/0x550 kernel/cgroup.c:3517 kernfs_fop_write+0x2ae/0x460 fs/kernfs/file.c:316 __vfs_write+0x115/0x580 fs/read_write.c:507 vfs_write+0x187/0x530 fs/read_write.c:557 SYSC_write fs/read_write.c:604 [inline] SyS_write+0xd9/0x1c0 fs/read_write.c:596 do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282 entry_SYSCALL_64_after_swapgs+0x5d/0xdb Freed by task 3: save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57 save_stack+0x43/0xd0 mm/kasan/kasan.c:505 set_track mm/kasan/kasan.c:517 [inline] kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:582 slab_free_hook mm/slub.c:1355 [inline] slab_free_freelist_hook mm/slub.c:1377 [inline] slab_free mm/slub.c:2958 [inline] kfree+0xfb/0x310 mm/slub.c:3878 __rcu_reclaim kernel/rcu/rcu.h:113 [inline] rcu_do_batch kernel/rcu/tree.c:2789 [inline] invoke_rcu_callbacks kernel/rcu/tree.c:3053 [inline] __rcu_process_callbacks kernel/rcu/tree.c:3020 [inline] rcu_process_callbacks+0x9d5/0x12b0 kernel/rcu/tree.c:3037 __do_softirq+0x210/0x940 kernel/softirq.c:288 The buggy address belongs to the object at ffff8801cf4a6280 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 96 bytes inside of 512-byte region [ffff8801cf4a6280, ffff8801cf4a6480) The buggy address belongs to the page: page:ffffea00073d2980 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0 flags: 0x8000000000004080(slab|head) page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8801cf4a6180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8801cf4a6200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff8801cf4a6280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8801cf4a6300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8801cf4a6380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================