==================================================================
BUG: KASAN: use-after-free in __lock_acquire+0x77/0x1f80 kernel/locking/lockdep.c:4925
Read of size 8 at addr ffff888020cec3f0 by task swapper/0/0
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.2.0-rc8-syzkaller-00083-g3ac88fa4605e #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:306 [inline]
print_report+0x163/0x4f0 mm/kasan/report.c:417
kasan_report+0x13a/0x170 mm/kasan/report.c:517
__lock_acquire+0x77/0x1f80 kernel/locking/lockdep.c:4925
lock_acquire+0x235/0x630 kernel/locking/lockdep.c:5668
__raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
_raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162
try_to_wake_up+0xb6/0x12b0 kernel/sched/core.c:4149
call_timer_fn+0x1ed/0x820 kernel/time/timer.c:1700
expire_timers kernel/time/timer.c:1751 [inline]
__run_timers+0x64f/0x860 kernel/time/timer.c:2022
run_timer_softirq+0x67/0xf0 kernel/time/timer.c:2035
__do_softirq+0x308/0xb15 kernel/softirq.c:571
invoke_softirq kernel/softirq.c:445 [inline]
__irq_exit_rcu+0x159/0x250 kernel/softirq.c:650
irq_exit_rcu+0x9/0x20 kernel/softirq.c:662
sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1107
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:22 [inline]
RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:70 [inline]
RIP: 0010:arch_irqs_disabled arch/x86/include/asm/irqflags.h:130 [inline]
RIP: 0010:acpi_safe_halt drivers/acpi/processor_idle.c:113 [inline]
RIP: 0010:acpi_idle_do_entry+0x113/0x350 drivers/acpi/processor_idle.c:570
Code: 0d da f6 48 83 e3 08 0f 85 0b 01 00 00 4c 8d 74 24 20 e8 60 bd e0 f6 0f 1f 44 00 00 e8 66 09 da f6 0f 00 2d af b6 8f 00 fb f4 <4c> 89 f3 48 c1 eb 03 42 80 3c 3b 00 74 08 4c 89 f7 e8 37 43 2f f7
RSP: 0018:ffffffff8cc07b40 EFLAGS: 000002d3
RAX: ffffffff8ab1c8ea RBX: 0000000000000000 RCX: ffffffff8ccbb780
RDX: 0000000000000000 RSI: ffffffff8aea6f40 RDI: ffffffff8b382400
RBP: ffffffff8cc07bd0 R08: ffffffff8ab1c8cc R09: fffffbfff19976f1
R10: 0000000000000000 R11: dffffc0000000001 R12: 1ffffffff1980f68
R13: ffff888018d77004 R14: ffffffff8cc07b60 R15: dffffc0000000000
acpi_idle_enter+0x356/0x500 drivers/acpi/processor_idle.c:707
cpuidle_enter_state+0x51a/0xf80 drivers/cpuidle/cpuidle.c:239
cpuidle_enter+0x5d/0x90 drivers/cpuidle/cpuidle.c:356
call_cpuidle kernel/sched/idle.c:155 [inline]
cpuidle_idle_call kernel/sched/idle.c:236 [inline]
do_idle+0x3d2/0x680 kernel/sched/idle.c:303
cpu_startup_entry+0x18/0x20 kernel/sched/idle.c:400
rest_init+0x242/0x260 init/main.c:732
arch_call_rest_init+0xe/0x10 init/main.c:894
start_kernel+0x47a/0x530 init/main.c:1148
secondary_startup_64_no_verify+0xcf/0xdb
Allocated by task 2:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4f/0x80 mm/kasan/common.c:52
__kasan_slab_alloc+0x69/0x80 mm/kasan/common.c:328
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook+0x68/0x390 mm/slab.h:761
slab_alloc_node mm/slub.c:3452 [inline]
kmem_cache_alloc_node+0x158/0x2c0 mm/slub.c:3497
alloc_task_struct_node kernel/fork.c:171 [inline]
dup_task_struct+0x57/0x6d0 kernel/fork.c:979
copy_process+0x5c9/0x3f50 kernel/fork.c:2097
kernel_clone+0x22d/0x990 kernel/fork.c:2681
kernel_thread+0x156/0x1d0 kernel/fork.c:2741
create_kthread kernel/kthread.c:399 [inline]
kthreadd+0x583/0x750 kernel/kthread.c:746
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
Freed by task 0:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4f/0x80 mm/kasan/common.c:52
kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:523
____kasan_slab_free+0xd6/0x120 mm/kasan/common.c:236
kasan_slab_free include/linux/kasan.h:177 [inline]
slab_free_hook mm/slub.c:1781 [inline]
slab_free_freelist_hook mm/slub.c:1807 [inline]
slab_free mm/slub.c:3787 [inline]
kmem_cache_free+0x2b5/0x580 mm/slub.c:3809
rcu_do_batch kernel/rcu/tree.c:2246 [inline]
rcu_core+0xa9e/0x17a0 kernel/rcu/tree.c:2506
__do_softirq+0x308/0xb15 kernel/softirq.c:571
Last potentially related work creation:
kasan_save_stack+0x3f/0x60 mm/kasan/common.c:45
__kasan_record_aux_stack+0xb0/0xc0 mm/kasan/generic.c:493
__call_rcu_common kernel/rcu/tree.c:2755 [inline]
call_rcu+0x167/0xac0 kernel/rcu/tree.c:2868
context_switch kernel/sched/core.c:5296 [inline]
__schedule+0x1411/0x43f0 kernel/sched/core.c:6606
schedule_idle+0x4e/0x90 kernel/sched/core.c:6710
do_idle+0x631/0x680 kernel/sched/idle.c:331
cpu_startup_entry+0x18/0x20 kernel/sched/idle.c:400
start_secondary+0xe8/0xf0 arch/x86/kernel/smpboot.c:264
secondary_startup_64_no_verify+0xcf/0xdb
Second to last potentially related work creation:
kasan_save_stack+0x3f/0x60 mm/kasan/common.c:45
__kasan_record_aux_stack+0xb0/0xc0 mm/kasan/generic.c:493
__call_rcu_common kernel/rcu/tree.c:2755 [inline]
call_rcu+0x167/0xac0 kernel/rcu/tree.c:2868
context_switch kernel/sched/core.c:5296 [inline]
__schedule+0x1411/0x43f0 kernel/sched/core.c:6606
schedule_idle+0x4e/0x90 kernel/sched/core.c:6710
do_idle+0x631/0x680 kernel/sched/idle.c:331
cpu_startup_entry+0x18/0x20 kernel/sched/idle.c:400
rest_init+0x242/0x260 init/main.c:732
arch_call_rest_init+0xe/0x10 init/main.c:894
start_kernel+0x47a/0x530 init/main.c:1148
secondary_startup_64_no_verify+0xcf/0xdb
The buggy address belongs to the object at ffff888020ceba80
which belongs to the cache task_struct of size 7232
The buggy address is located 2416 bytes inside of
7232-byte region [ffff888020ceba80, ffff888020ced6c0)
The buggy address belongs to the physical page:
page:ffffea0000833a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x20ce8
head:ffffea0000833a00 order:3 compound_mapcount:0 subpages_mapcount:0 compound_pincount:0
ksm flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 ffff888140007500 ffffea0000a00e00 dead000000000003
raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 11, tgid 11 (kworker/u4:1), ts 8592049277, free_ts 0
prep_new_page mm/page_alloc.c:2531 [inline]
get_page_from_freelist+0x3449/0x35c0 mm/page_alloc.c:4283
__alloc_pages+0x291/0x7e0 mm/page_alloc.c:5549
alloc_slab_page+0x6a/0x160 mm/slub.c:1851
allocate_slab mm/slub.c:1998 [inline]
new_slab+0x84/0x2f0 mm/slub.c:2051
___slab_alloc+0xa85/0x10a0 mm/slub.c:3193
__slab_alloc mm/slub.c:3292 [inline]
__slab_alloc_node mm/slub.c:3345 [inline]
slab_alloc_node mm/slub.c:3442 [inline]
kmem_cache_alloc_node+0x1dc/0x2c0 mm/slub.c:3497
alloc_task_struct_node kernel/fork.c:171 [inline]
dup_task_struct+0x57/0x6d0 kernel/fork.c:979
copy_process+0x5c9/0x3f50 kernel/fork.c:2097
kernel_clone+0x22d/0x990 kernel/fork.c:2681
user_mode_thread+0x132/0x190 kernel/fork.c:2757
call_usermodehelper_exec_work+0x5c/0x220 kernel/umh.c:175
process_one_work+0x8fa/0x1370 kernel/workqueue.c:2289
worker_thread+0xa63/0x1210 kernel/workqueue.c:2436
kthread+0x270/0x300 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308
page_owner free stack trace missing
Memory state around the buggy address:
ffff888020cec280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888020cec300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888020cec380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888020cec400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888020cec480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess):
0: 0d da f6 48 83 or $0x8348f6da,%eax
5: e3 08 jrcxz 0xf
7: 0f 85 0b 01 00 00 jne 0x118
d: 4c 8d 74 24 20 lea 0x20(%rsp),%r14
12: e8 60 bd e0 f6 callq 0xf6e0bd77
17: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
1c: e8 66 09 da f6 callq 0xf6da0987
21: 0f 00 2d af b6 8f 00 verw 0x8fb6af(%rip) # 0x8fb6d7
28: fb sti
29: f4 hlt
* 2a: 4c 89 f3 mov %r14,%rbx <-- trapping instruction
2d: 48 c1 eb 03 shr $0x3,%rbx
31: 42 80 3c 3b 00 cmpb $0x0,(%rbx,%r15,1)
36: 74 08 je 0x40
38: 4c 89 f7 mov %r14,%rdi
3b: e8 37 43 2f f7 callq 0xf72f4377