================================================================== BUG: KASAN: use-after-free in disk_unblock_events+0x51/0x60 block/genhd.c:1543 Read of size 8 at addr ffff8800b9ce2768 by task syz-executor0/2160 CPU: 0 PID: 2160 Comm: syz-executor0 Not tainted 4.4.169+ #7 0000000000000000 7302ef7ca8839fd7 ffff8800b58076d0 ffffffff81aa635d ffffea0002e73800 ffff8800b9ce2768 0000000000000000 ffff8800b9ce2768 0000000000000000 ffff8800b5807708 ffffffff8148b15b ffff8800b9ce2768 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x124 lib/dump_stack.c:51 [] print_address_description+0x6c/0x217 mm/kasan/report.c:252 [] kasan_report_error mm/kasan/report.c:351 [inline] [] kasan_report.cold.6+0x175/0x2f7 mm/kasan/report.c:408 [] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:429 [] disk_unblock_events+0x51/0x60 block/genhd.c:1543 [] __blkdev_get+0x70c/0xdf0 fs/block_dev.c:1297 [] blkdev_get+0x2da/0x920 fs/block_dev.c:1353 [] blkdev_open+0x1a5/0x250 fs/block_dev.c:1508 [] do_dentry_open+0x38d/0xbd0 fs/open.c:749 [] vfs_open+0x12a/0x210 fs/open.c:862 [] do_last fs/namei.c:3269 [inline] [] path_openat+0xc10/0x3f10 fs/namei.c:3406 [] do_filp_open+0x197/0x270 fs/namei.c:3440 [] do_sys_open+0x31c/0x610 fs/open.c:1038 [] SYSC_open fs/open.c:1056 [inline] [] SyS_open+0x2d/0x40 fs/open.c:1051 [] entry_SYSCALL_64_fastpath+0x1e/0x9a Allocated by task 5334: [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63 [] save_stack mm/kasan/kasan.c:512 [inline] [] set_track mm/kasan/kasan.c:524 [inline] [] kasan_kmalloc.part.1+0x62/0xf0 mm/kasan/kasan.c:616 [] kasan_kmalloc+0xaf/0xc0 mm/kasan/kasan.c:601 [] kmem_cache_alloc_trace+0x117/0x2d0 mm/slub.c:2642 [] kmem_cache_alloc_node_trace include/linux/slab.h:367 [inline] [] kmalloc_node include/linux/slab.h:514 [inline] [] kzalloc_node include/linux/slab.h:631 [inline] [] alloc_disk_node+0x54/0x3a0 block/genhd.c:1282 [] alloc_disk+0x18/0x20 block/genhd.c:1274 [] loop_add+0x36b/0x7c0 drivers/block/loop.c:1824 [] loop_probe+0x14f/0x180 drivers/block/loop.c:1931 [] kobj_lookup+0x223/0x410 drivers/base/map.c:124 [] get_gendisk+0x39/0x2d0 block/genhd.c:689 [] bd_start_claiming fs/block_dev.c:851 [inline] [] blkdev_get+0xf6/0x920 fs/block_dev.c:1346 [] blkdev_open+0x1a5/0x250 fs/block_dev.c:1508 [] do_dentry_open+0x38d/0xbd0 fs/open.c:749 [] vfs_open+0x12a/0x210 fs/open.c:862 [] do_last fs/namei.c:3269 [inline] [] path_openat+0xc10/0x3f10 fs/namei.c:3406 [] do_filp_open+0x197/0x270 fs/namei.c:3440 [] do_sys_open+0x31c/0x610 fs/open.c:1038 [] SYSC_open fs/open.c:1056 [inline] [] SyS_open+0x2d/0x40 fs/open.c:1051 [] entry_SYSCALL_64_fastpath+0x1e/0x9a Freed by task 2160: [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63 [] save_stack mm/kasan/kasan.c:512 [inline] [] set_track mm/kasan/kasan.c:524 [inline] [] kasan_slab_free+0xac/0x190 mm/kasan/kasan.c:589 [] slab_free_hook mm/slub.c:1383 [inline] [] slab_free_freelist_hook mm/slub.c:1405 [inline] [] slab_free mm/slub.c:2859 [inline] [] kfree+0xf4/0x310 mm/slub.c:3749 [] disk_release+0x259/0x330 block/genhd.c:1118 [] device_release+0x7e/0x220 drivers/base/core.c:247 [] kobject_cleanup lib/kobject.c:643 [inline] [] kobject_release lib/kobject.c:672 [inline] [] kref_sub include/linux/kref.h:73 [inline] [] kref_put include/linux/kref.h:98 [inline] [] kobject_put+0x144/0x260 lib/kobject.c:689 [] put_disk+0x23/0x30 block/genhd.c:1346 [] __blkdev_get+0x66c/0xdf0 fs/block_dev.c:1290 [] blkdev_get+0x2da/0x920 fs/block_dev.c:1353 [] blkdev_open+0x1a5/0x250 fs/block_dev.c:1508 [] do_dentry_open+0x38d/0xbd0 fs/open.c:749 [] vfs_open+0x12a/0x210 fs/open.c:862 [] do_last fs/namei.c:3269 [inline] [] path_openat+0xc10/0x3f10 fs/namei.c:3406 [] do_filp_open+0x197/0x270 fs/namei.c:3440 [] do_sys_open+0x31c/0x610 fs/open.c:1038 [] SYSC_open fs/open.c:1056 [inline] [] SyS_open+0x2d/0x40 fs/open.c:1051 [] entry_SYSCALL_64_fastpath+0x1e/0x9a The buggy address belongs to the object at ffff8800b9ce2200 which belongs to the cache kmalloc-2048 of size 2048 The buggy address is located 1384 bytes inside of 2048-byte region [ffff8800b9ce2200, ffff8800b9ce2a00) The buggy address belongs to the page: ------------[ cut here ]------------ WARNING: CPU: 1 PID: -2104946528 at lib/debugobjects.c:263 debug_print_object+0x181/0x210 lib/debugobjects.c:260() ODEBUG: deactivate not available (active state 0) object type: hrtimer hint: 0xffff8800b9ce2200