================================================================== BUG: KASAN: use-after-free in disk_unblock_events+0x55/0x60 block/genhd.c:1543 Read of size 8 at addr ffff8800b2b9eb68 by task blkid/4693 CPU: 1 PID: 4693 Comm: blkid Not tainted 4.4.174+ #17 0000000000000000 6c684c160ca9a063 ffff8801d8fc7730 ffffffff81aad1a1 0000000000000000 ffffea0002cae600 ffff8800b2b9eb68 0000000000000008 0000000000000000 ffff8801d8fc7768 ffffffff81490120 0000000000000000 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x120 lib/dump_stack.c:51 [] print_address_description+0x6f/0x21b mm/kasan/report.c:252 [] kasan_report_error mm/kasan/report.c:351 [inline] [] kasan_report mm/kasan/report.c:408 [inline] [] kasan_report.cold+0x8c/0x2be mm/kasan/report.c:393 [] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:429 [] disk_unblock_events+0x55/0x60 block/genhd.c:1543 [] __blkdev_get+0x70c/0xdf0 fs/block_dev.c:1297 [] blkdev_get+0x2e8/0x920 fs/block_dev.c:1353 [] blkdev_open+0x1aa/0x250 fs/block_dev.c:1508 [] do_dentry_open+0x38f/0xbd0 fs/open.c:749 [] vfs_open+0x10b/0x210 fs/open.c:862 [] do_last fs/namei.c:3269 [inline] [] path_openat+0x136f/0x4470 fs/namei.c:3406 [] do_filp_open+0x1a1/0x270 fs/namei.c:3440 [] do_sys_open+0x2f8/0x600 fs/open.c:1038 [] SYSC_open fs/open.c:1056 [inline] [] SyS_open+0x2d/0x40 fs/open.c:1051 [] entry_SYSCALL_64_fastpath+0x1e/0x9a Allocated by task 4683: [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63 [] save_stack mm/kasan/kasan.c:512 [inline] [] set_track mm/kasan/kasan.c:524 [inline] [] kasan_kmalloc.part.0+0x62/0xf0 mm/kasan/kasan.c:616 [] kasan_kmalloc+0xb7/0xd0 mm/kasan/kasan.c:601 [] kmem_cache_alloc_trace+0x123/0x2d0 mm/slub.c:2642 [] kmem_cache_alloc_node_trace include/linux/slab.h:367 [inline] [] kmalloc_node include/linux/slab.h:514 [inline] [] kzalloc_node include/linux/slab.h:631 [inline] [] alloc_disk_node+0x50/0x3c0 block/genhd.c:1282 [] alloc_disk+0x1b/0x20 block/genhd.c:1274 [] loop_add+0x380/0x830 drivers/block/loop.c:1857 [] loop_control_ioctl+0x138/0x2f0 drivers/block/loop.c:1988 [] C_SYSC_ioctl fs/compat_ioctl.c:1592 [inline] [] compat_SyS_ioctl+0x403/0x2210 fs/compat_ioctl.c:1544 [] do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline] [] do_fast_syscall_32+0x32d/0xa90 arch/x86/entry/common.c:397 [] sysenter_flags_fixed+0xd/0x1a Freed by task 4693: [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63 [] save_stack mm/kasan/kasan.c:512 [inline] [] set_track mm/kasan/kasan.c:524 [inline] [] kasan_slab_free+0xb0/0x190 mm/kasan/kasan.c:589 [] slab_free_hook mm/slub.c:1383 [inline] [] slab_free_freelist_hook mm/slub.c:1405 [inline] [] slab_free mm/slub.c:2859 [inline] [] kfree+0xf4/0x310 mm/slub.c:3749 [] disk_release+0x255/0x330 block/genhd.c:1118 [] device_release+0x7d/0x220 drivers/base/core.c:247 [] kobject_cleanup lib/kobject.c:643 [inline] [] kobject_release lib/kobject.c:672 [inline] [] kref_sub include/linux/kref.h:73 [inline] [] kref_put include/linux/kref.h:98 [inline] [] kobject_put+0x14c/0x260 lib/kobject.c:689 [] put_disk+0x23/0x30 block/genhd.c:1346 [] __blkdev_get+0x66c/0xdf0 fs/block_dev.c:1290 [] blkdev_get+0x2e8/0x920 fs/block_dev.c:1353 Dead loop on virtual device ip6tnl0, fix it urgently! Dead loop on virtual device ip6tnl0, fix it urgently! Dead loop on virtual device ip6tnl0, fix it urgently! Dead loop on virtual device ip6tnl0, fix it urgently! Dead loop on virtual device ip6tnl0, fix it urgently! Dead loop on virtual device ip6tnl0, fix it urgently! [] blkdev_open+0x1aa/0x250 fs/block_dev.c:1508 [] do_dentry_open+0x38f/0xbd0 fs/open.c:749 [] vfs_open+0x10b/0x210 fs/open.c:862 [] do_last fs/namei.c:3269 [inline] [] path_openat+0x136f/0x4470 fs/namei.c:3406 [] do_filp_open+0x1a1/0x270 fs/namei.c:3440 [] do_sys_open+0x2f8/0x600 fs/open.c:1038 [] SYSC_open fs/open.c:1056 [inline] [] SyS_open+0x2d/0x40 fs/open.c:1051 [] entry_SYSCALL_64_fastpath+0x1e/0x9a The buggy address belongs to the object at ffff8800b2b9e600 which belongs to the cache kmalloc-2048 of size 2048 The buggy address is located 1384 bytes inside of 2048-byte region [ffff8800b2b9e600, ffff8800b2b9ee00) The buggy address belongs to the page: BUG: sleeping function called from invalid context at arch/x86/mm/fault.c:1196 BUG: spinlock bad magic on CPU#0, syz-executor.1/2145 lock: 0xffff8801d8b99620, .magic: ffffea00, .owner: °¹ØˆÿÿP¬Bÿÿÿÿ/-1296439808, .owner_cpu: -2104943648 CPU: 0 PID: -2126336944 Comm: Not tainted 4.4.174+ #17 0000000000000000 437f401f648c4597 ffff8800a7787a80 ffffffff81aad1a1 ffff8801d8b99d90 ffff8801d8b99620 00000000b2b9e600 0000000082891be0 ffff8800a7787ca8 ffff8800a7787ab8 ffffffff813ae1ce 0000000000000046 Call Trace: double fault: 0000 [#1] PREEMPT SMP KASAN Modules linked in: CPU: 1 PID: -2126336944 Comm: Not tainted 4.4.174+ #17 task: ffff8801ce9317c0 task.stack: ffffffff82891be0 RIP: 0010:[] [] constant_test_bit arch/x86/include/asm/bitops.h:311 [inline] RIP: 0010:[] [] PageSlab include/linux/page-flags.h:217 [inline] RIP: 0010:[] [] page_mapcount include/linux/mm.h:464 [inline] RIP: 0010:[] [] dump_page_badflags+0x1a/0x70 mm/debug.c:85 RSP: 0018:ffff880100000000 EFLAGS: 00010086 RAX: ffff8801ce9317c0 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff82891be0 RDI: ffffea0002cae600 RBP: ffff880100000030 R08: 0000000000000026 R09: 0000000000000000 R10: 0000000000000001 R11: ffffffff83fdf174 R12: ffffea0002cae600 R13: ffffffff82891be0 R14: ffff8800b2b9ee00 R15: ffff8800b2b9e600 FS: 00007fecad8d3740(0000) GS:ffff8801db700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff8800fffffff8 CR3: 00000000b8a95000 CR4: 00000000001606b0 Stack: Call Trace: Code: [ 147.625926] ------------[ cut here ]------------ WARNING: CPU: 1 PID: -2126336944 at include/linux/uaccess.h:18 pagefault_disabled_dec include/linux/uaccess.h:18 [inline]() WARNING: CPU: 1 PID: -2126336944 at include/linux/uaccess.h:18 pagefault_enable include/linux/uaccess.h:45 [inline]() WARNING: CPU: 1 PID: -2126336944 at include/linux/uaccess.h:18 __probe_kernel_read+0x1ee/0x230 mm/maccess.c:35()