================================================================== BUG: KASAN: use-after-free in disk_unblock_events+0x55/0x60 block/genhd.c:1543 Read of size 8 at addr ffff8801d2093868 by task blkid/25756 CPU: 0 PID: 25756 Comm: blkid Not tainted 4.4.174+ #4 0000000000000000 cbe62a8d0f1cc387 ffff8800b70c7730 ffffffff81aad1a1 0000000000000000 ffffea0007482400 ffff8801d2093868 0000000000000008 0000000000000000 ffff8800b70c7768 ffffffff81490120 0000000000000000 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x120 lib/dump_stack.c:51 [] print_address_description+0x6f/0x21b mm/kasan/report.c:252 [] kasan_report_error mm/kasan/report.c:351 [inline] [] kasan_report mm/kasan/report.c:408 [inline] [] kasan_report.cold+0x8c/0x2be mm/kasan/report.c:393 [] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:429 [] disk_unblock_events+0x55/0x60 block/genhd.c:1543 [] __blkdev_get+0x70c/0xdf0 fs/block_dev.c:1297 [] blkdev_get+0x2e8/0x920 fs/block_dev.c:1353 [] blkdev_open+0x1aa/0x250 fs/block_dev.c:1508 [] do_dentry_open+0x38f/0xbd0 fs/open.c:749 [] vfs_open+0x10b/0x210 fs/open.c:862 [] do_last fs/namei.c:3269 [inline] [] path_openat+0x136f/0x4470 fs/namei.c:3406 [] do_filp_open+0x1a1/0x270 fs/namei.c:3440 [] do_sys_open+0x2f8/0x600 fs/open.c:1038 [] SYSC_open fs/open.c:1056 [inline] [] SyS_open+0x2d/0x40 fs/open.c:1051 [] entry_SYSCALL_64_fastpath+0x1e/0x9a Allocated by task 25745: [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63 [] save_stack mm/kasan/kasan.c:512 [inline] [] set_track mm/kasan/kasan.c:524 [inline] [] kasan_kmalloc.part.0+0x62/0xf0 mm/kasan/kasan.c:616 [] kasan_kmalloc+0xb7/0xd0 mm/kasan/kasan.c:601 [] kmem_cache_alloc_trace+0x123/0x2d0 mm/slub.c:2642 [] kmem_cache_alloc_node_trace include/linux/slab.h:367 [inline] [] kmalloc_node include/linux/slab.h:514 [inline] [] kzalloc_node include/linux/slab.h:631 [inline] [] alloc_disk_node+0x50/0x3c0 block/genhd.c:1282 [] alloc_disk+0x1b/0x20 block/genhd.c:1274 [] loop_add+0x380/0x830 drivers/block/loop.c:1857 [] loop_probe+0x154/0x180 drivers/block/loop.c:1963 [] kobj_lookup+0x221/0x410 drivers/base/map.c:124 [] get_gendisk+0x3c/0x2e0 block/genhd.c:689 [] __blkdev_get+0x39c/0xdf0 fs/block_dev.c:1193 [] blkdev_get+0x2e8/0x920 fs/block_dev.c:1353 [] blkdev_open+0x1aa/0x250 fs/block_dev.c:1508 [] do_dentry_open+0x38f/0xbd0 fs/open.c:749 [] vfs_open+0x10b/0x210 fs/open.c:862 [] do_last fs/namei.c:3269 [inline] [] path_openat+0x136f/0x4470 fs/namei.c:3406 [] do_filp_open+0x1a1/0x270 fs/namei.c:3440 [] do_sys_open+0x2f8/0x600 fs/open.c:1038 [] SYSC_open fs/open.c:1056 [inline] [] SyS_open+0x2d/0x40 fs/open.c:1051 [] entry_SYSCALL_64_fastpath+0x1e/0x9a Freed by task 25756: [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63 [] save_stack mm/kasan/kasan.c:512 [inline] [] set_track mm/kasan/kasan.c:524 [inline] [] kasan_slab_free+0xb0/0x190 mm/kasan/kasan.c:589 [] slab_free_hook mm/slub.c:1383 [inline] [] slab_free_freelist_hook mm/slub.c:1405 [inline] [] slab_free mm/slub.c:2859 [inline] [] kfree+0xf4/0x310 mm/slub.c:3749 [] disk_release+0x255/0x330 block/genhd.c:1118 [] device_release+0x7d/0x220 drivers/base/core.c:247 [] kobject_cleanup lib/kobject.c:643 [inline] [] kobject_release lib/kobject.c:672 [inline] [] kref_sub include/linux/kref.h:73 [inline] [] kref_put include/linux/kref.h:98 [inline] [] kobject_put+0x14c/0x260 lib/kobject.c:689 [] put_disk+0x23/0x30 block/genhd.c:1346 [] __blkdev_get+0x66c/0xdf0 fs/block_dev.c:1290 [] blkdev_get+0x2e8/0x920 fs/block_dev.c:1353 [] blkdev_open+0x1aa/0x250 fs/block_dev.c:1508 [] do_dentry_open+0x38f/0xbd0 fs/open.c:749 [] vfs_open+0x10b/0x210 fs/open.c:862 [] do_last fs/namei.c:3269 [inline] [] path_openat+0x136f/0x4470 fs/namei.c:3406 [] do_filp_open+0x1a1/0x270 fs/namei.c:3440 [] do_sys_open+0x2f8/0x600 fs/open.c:1038 [] SYSC_open fs/open.c:1056 [inline] [] SyS_open+0x2d/0x40 fs/open.c:1051 [] entry_SYSCALL_64_fastpath+0x1e/0x9a The buggy address belongs to the object at ffff8801d2093300 which belongs to the cache kmalloc-2048 of size 2048 The buggy address is located 1384 bytes inside of 2048-byte region [ffff8801d2093300, ffff8801d2093b00) The buggy address belongs to the page: INFO: trying to register non-static key. the code is fine but needs lockdep annotation. turning off the locking correctness validator. CPU: 1 PID: 2136 Comm: syz-executor.1 Not tainted 4.4.174+ #4 0000000000000000 2ded84984b172031 ffff8800a6d279a0 ffffffff81aad1a1 ffffffff83a78820 ffff8800b7ffdf00 0000000000000000 0000000000000001 0000000000000000 ffff8800a6d27b28 ffffffff8120393e 0000000000000286 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x120 lib/dump_stack.c:51 [ sd 0:0:1:0: [sda] 4096-byte physical blocks tsc: Refined TSC clocksource calibration: 2300.004 MHz clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x212738e3f90, max_idle_ns: 440795225370 ns sd 0:0:1:0: [sda] Write Protect is off sd 0:0:1:0: [sda] Write cache: enabled, read cache: enabled, doesn't support DPO or FUA e1000: Intel(R) PRO/1000 Network Driver - version 7.3.21-k8-NAPI e1000: Copyright (c) 1999-2006 Intel Corporation. PPP generic driver version 2.4.2 PPP BSD Compression module registered PPP Deflate Compression module registered PPP MPPE Compression module registered NET: Registered protocol family 24 usbcore: registered new interface driver asix usbcore: registered new interface driver ax88179_178a usbcore: registered new interface driver cdc_ether sda: sda1 usbcore: registered new interface driver net1080 usbcore: registered new interface driver cdc_subset usbcore: registered new interface driver zaurus usbcore: registered new interface driver cdc_ncm ehci_hcd: USB 2.0 'Enhanced' Host Controller (EHCI) Driver ehci-pci: EHCI PCI platform driver i8042: PNP: PS/2 Controller [PNP0303:KBD,PNP0f13:MOU] at 0x60,0x64 irq 1,12 sd 0:0:1:0: [sda] Attached SCSI disk i8042: Warning: Keylock active serio: i8042 KBD port at 0x60,0x64 irq 1 serio: i8042 AUX port at 0x60,0x64 irq 12 mousedev: PS/2 mouse device common for all mice usbcore: registered new interface driver xpad usbcore: registered new interface driver usb_acecad usbcore: registered new interface driver aiptek usbcore: registered new interface driver gtco usbcore: registered new interface driver hanwang usbcore: registered new interface driver kbtab rtc_cmos 00:00: RTC can wake from S4 rtc_cmos 00:00: rtc core: registered rtc_cmos as rtc0 rtc_cmos 00:00: alarms up to one day, 114 bytes nvram device-mapper: uevent: version 1.0.3 device-mapper: ioctl: 4.34.0-ioctl (2015-10-28) initialised: dm-devel@redhat.com hidraw: raw HID events driver (C) Jiri Kosina usbcore: registered new interface driver usbhid usbhid: USB HID core driver ashmem: initialized u32 classifier Actions configured Netfilter messages via NETLINK v0.30. nf_conntrack version 0.5.0 (65536 buckets, 262144 max) ctnetlink v0.93: registering with nfnetlink. xt_time: kernel timezone is -0000 IPv4 over IPsec tunneling driver ip_tables: (C) 2000-2006 Netfilter Core Team arp_tables: (C) 2002 David S. Miller Initializing XFRM netlink socket NET: Registered protocol family 10 mip6: Mobile IPv6 ip6_tables: (C) 2000-2006 Netfilter Core Team sit: IPv6 over IPv4 tunneling driver NET: Registered protocol family 17 NET: Registered protocol family 15 registered taskstats version 1 rtc_cmos 00:00: setting system clock to 2019-02-25 14:12:05 UTC (1551103925) ALSA device list: No soundcards found. input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input2 EXT4-fs (sda1): couldn't mount as ext3 due to feature incompatibilities EXT4-fs (sda1): couldn't mount as ext2 due to feature incompatibilities EXT4-fs (sda1): mounted filesystem without journal. Opts: (null) VFS: Mounted root (ext4 filesystem) readonly on device 8:1. devtmpfs: mounted Freeing unused kernel memory: 1320K Kernel memory protection disabled. SELinux: Permission module_load in class system not defined in policy. SELinux: Class netlink_iscsi_socket not defined in policy. SELinux: Class netlink_fib_lookup_socket not defined in policy. SELinux: Class netlink_connector_socket not defined in policy. SELinux: Class netlink_netfilter_socket not defined in policy. SELinux: Class netlink_generic_socket not defined in policy. SELinux: Class netlink_scsitransport_socket not defined in policy. SELinux: Class netlink_rdma_socket not defined in policy. SELinux: Class netlink_crypto_socket not defined in policy. SELinux: Permission wake_alarm in class capability2 not defined in policy. SELinux: Permission block_suspend in class capability2 not defined in policy. SELinux: Permission audit_read in class capability2 not defined in policy. SELinux: Permission attach_queue in class tun_socket not defined in policy. SELinux: Class binder not defined in policy. SELinux: the above unknown classes and permissions will be denied audit: type=1403 audit(1551103927.110:2): policy loaded auid=4294967295 ses=4294967295 stty (356) used greatest stack depth: 25440 bytes left