------------[ cut here ]------------
ODEBUG: activate active (active state 1) object: ffff88803d28e118 object type: rcu_head hint: 0x0
WARNING: CPU: 1 PID: 6208 at lib/debugobjects.c:612 debug_print_object+0x1a2/0x2b0 lib/debugobjects.c:612
Modules linked in:
CPU: 1 UID: 0 PID: 6208 Comm: udevd Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:debug_print_object+0x1a2/0x2b0 lib/debugobjects.c:612
Code: fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 54 41 56 48 8b 14 dd 60 41 16 8c 4c 89 e6 48 c7 c7 e0 35 16 8c e8 3f 23 8f fc 90 <0f> 0b 90 90 58 83 05 a6 86 c0 0b 01 48 83 c4 18 5b 5d 41 5c 41 5d
RSP: 0018:ffffc900006a0ad8 EFLAGS: 00010286
RAX: 0000000000000000 RBX: 0000000000000003 RCX: ffffffff817a4388
RDX: ffff888024be0000 RSI: ffffffff817a4395 RDI: 0000000000000001
RBP: 0000000000000001 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff8c163c00
R13: ffffffff8baeb920 R14: 0000000000000000 R15: ffffc900006a0b98
FS: 00007f5e464ae880(0000) GS:ffff8880d67b3000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f23079aad58 CR3: 00000000563b8000 CR4: 0000000000352ef0
Call Trace:
debug_object_activate+0x2bc/0x4c0 lib/debugobjects.c:842
debug_rcu_head_queue kernel/rcu/rcu.h:236 [inline]
__call_rcu_common.constprop.0+0x35/0xa10 kernel/rcu/tree.c:3108
radix_tree_node_free lib/radix-tree.c:310 [inline]
delete_node+0x1fc/0x8d0 lib/radix-tree.c:573
__radix_tree_delete+0x193/0x3d0 lib/radix-tree.c:1379
radix_tree_delete_item+0xea/0x230 lib/radix-tree.c:1430
afs_cell_destroy+0x1db/0x310 fs/afs/cell.c:523
rcu_do_batch kernel/rcu/tree.c:2605 [inline]
rcu_core+0x799/0x1530 kernel/rcu/tree.c:2861
handle_softirqs+0x219/0x8e0 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1050
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__kasan_check_byte+0xa/0x50 mm/kasan/common.c:566
Code: 48 0f 45 da e9 9c fe ff ff 0f 1f 80 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 66 0f 1f 00 41 54 49 89 f4 55 <48> 89 fd 53 e8 6d 24 00 00 89 c3 84 c0 74 0b 89 d8 5b 5d 41 5c c3
RSP: 0018:ffffc900016df268 EFLAGS: 00000202
RAX: 0000000000000001 RBX: ffffffff8e5c15a0 RCX: 0000000000000002
RDX: 0000000000000000 RSI: ffffffff816af581 RDI: ffffffff8e5c15a0
RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000001 R11: 000000000003a26d R12: ffffffff816af581
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
kasan_check_byte include/linux/kasan.h:399 [inline]
lock_acquire kernel/locking/lockdep.c:5842 [inline]
lock_acquire+0xfc/0x350 kernel/locking/lockdep.c:5825
rcu_lock_acquire include/linux/rcupdate.h:331 [inline]
rcu_read_lock include/linux/rcupdate.h:841 [inline]
class_rcu_constructor include/linux/rcupdate.h:1155 [inline]
unwind_next_frame+0xd1/0x20a0 arch/x86/kernel/unwind_orc.c:479
arch_stack_walk+0x94/0x100 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x8e/0xc0 kernel/stacktrace.c:122
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:388 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:405
kasan_kmalloc include/linux/kasan.h:260 [inline]
__do_kmalloc_node mm/slub.c:4376 [inline]
__kmalloc_noprof+0x223/0x510 mm/slub.c:4388
kmalloc_noprof include/linux/slab.h:909 [inline]
tomoyo_realpath_from_path+0xc2/0x6e0 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_check_open_permission+0x2ab/0x3c0 security/tomoyo/file.c:771
tomoyo_file_open+0x6b/0x90 security/tomoyo/tomoyo.c:334
security_file_open+0x84/0x1e0 security/security.c:3144
do_dentry_open+0x596/0x1530 fs/open.c:942
vfs_open+0x82/0x3f0 fs/open.c:1095
do_open fs/namei.c:3887 [inline]
path_openat+0x1de4/0x2cb0 fs/namei.c:4046
do_filp_open+0x20b/0x470 fs/namei.c:4073
do_sys_openat2+0x11b/0x1d0 fs/open.c:1435
do_sys_open fs/open.c:1450 [inline]
__do_sys_openat fs/open.c:1466 [inline]
__se_sys_openat fs/open.c:1461 [inline]
__x64_sys_openat+0x174/0x210 fs/open.c:1461
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x4e0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f5e45ca7407
Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
RSP: 002b:00007fff18ab30d0 EFLAGS: 00000202 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00007f5e464ae880 RCX: 00007f5e45ca7407
RDX: 0000000000080000 RSI: 00007fff18ab3250 RDI: ffffffffffffff9c
RBP: 0000000000000008 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 000055864425c7f5
R13: 000055864425c7f5 R14: 0000000000000001 R15: 0000558644277140
----------------
Code disassembly (best guess):
0: 48 0f 45 da cmovne %rdx,%rbx
4: e9 9c fe ff ff jmp 0xfffffea5
9: 0f 1f 80 00 00 00 00 nopl 0x0(%rax)
10: 90 nop
11: 90 nop
12: 90 nop
13: 90 nop
14: 90 nop
15: 90 nop
16: 90 nop
17: 90 nop
18: 90 nop
19: 90 nop
1a: 90 nop
1b: 90 nop
1c: 90 nop
1d: 90 nop
1e: 90 nop
1f: 90 nop
20: 66 0f 1f 00 nopw (%rax)
24: 41 54 push %r12
26: 49 89 f4 mov %rsi,%r12
29: 55 push %rbp
* 2a: 48 89 fd mov %rdi,%rbp <-- trapping instruction
2d: 53 push %rbx
2e: e8 6d 24 00 00 call 0x24a0
33: 89 c3 mov %eax,%ebx
35: 84 c0 test %al,%al
37: 74 0b je 0x44
39: 89 d8 mov %ebx,%eax
3b: 5b pop %rbx
3c: 5d pop %rbp
3d: 41 5c pop %r12
3f: c3 ret