EXT4-fs (loop4): re-mounted. Opts: (null) EXT4-fs (loop1): re-mounted. Opts: (null) EXT4-fs (loop1): re-mounted. Opts: (null) EXT4-fs (loop0): re-mounted. Opts: (null) ================================================================== BUG: KASAN: use-after-free in atomic_inc include/asm-generic/atomic-instrumented.h:102 [inline] BUG: KASAN: use-after-free in kthread_stop+0x44/0x550 kernel/kthread.c:543 Write of size 4 at addr ffff8800adb0e320 by task syz-executor208/18256 CPU: 1 PID: 18256 Comm: syz-executor208 Not tainted 4.18.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x15a/0x20d lib/dump_stack.c:113 print_address_description.cold.6+0x9/0x244 mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report mm/kasan/report.c:412 [inline] kasan_report.cold.7+0x242/0x305 mm/kasan/report.c:396 check_memory_region_inline mm/kasan/kasan.c:260 [inline] check_memory_region+0x13c/0x1b0 mm/kasan/kasan.c:267 EXT4-fs (loop3): re-mounted. Opts: (null) kasan_check_write+0x14/0x20 mm/kasan/kasan.c:278 atomic_inc include/asm-generic/atomic-instrumented.h:102 [inline] kthread_stop+0x44/0x550 kernel/kthread.c:543 ext4_put_super+0x6a9/0xb90 fs/ext4/super.c:981 generic_shutdown_super+0x12d/0x330 fs/super.c:453 kill_block_super+0x96/0xe0 fs/super.c:1201 deactivate_locked_super+0x77/0xd0 fs/super.c:326 deactivate_super fs/super.c:357 [inline] deactivate_super+0x8a/0xa0 fs/super.c:353 cleanup_mnt+0x9f/0x130 fs/namespace.c:1183 __cleanup_mnt+0xd/0x10 fs/namespace.c:1190 task_work_run+0x111/0x180 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:192 [inline] exit_to_usermode_loop+0x180/0x1e0 arch/x86/entry/common.c:166 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline] syscall_return_slowpath arch/x86/entry/common.c:268 [inline] do_syscall_64+0x47a/0x540 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x44bf67 Code: ff d0 48 89 c7 b8 3c 00 00 00 0f 05 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffcb6c198a8 EFLAGS: 00000202 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000074d11 RCX: 000000000044bf67 RDX: 00007ffcb6c1996b RSI: 0000000000000002 RDI: 00007ffcb6c19960 RBP: 00007ffcb6c19960 R08: 00000000ffffffff R09: 00007ffcb6c19740 R10: 0000000000708663 R11: 0000000000000202 R12: 00007ffcb6c1aa20 R13: 00000000007085f0 R14: 00007ffcb6c198d0 R15: 00007ffcb6c1aa40 Allocated by task 2: save_stack mm/kasan/kasan.c:448 [inline] set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc.part.1+0x62/0xf0 mm/kasan/kasan.c:553 kasan_kmalloc+0xaf/0xc0 mm/kasan/kasan.c:538 kasan_slab_alloc+0x11/0x20 mm/kasan/kasan.c:490 slab_post_alloc_hook mm/slab.h:444 [inline] slab_alloc_node mm/slub.c:2708 [inline] kmem_cache_alloc_node+0xfa/0x380 mm/slub.c:2744 alloc_task_struct_node kernel/fork.c:157 [inline] dup_task_struct kernel/fork.c:802 [inline] copy_process.part.5+0x1313/0x6b70 kernel/fork.c:1664 copy_process kernel/fork.c:1639 [inline] _do_fork+0x159/0xb70 kernel/fork.c:2122 kernel_thread+0x24/0x30 kernel/fork.c:2181 create_kthread kernel/kthread.c:269 [inline] kthreadd+0x4d7/0x730 kernel/kthread.c:585 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:412 Freed by task 9: save_stack mm/kasan/kasan.c:448 [inline] set_track mm/kasan/kasan.c:460 [inline] __kasan_slab_free+0x167/0x240 mm/kasan/kasan.c:521 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528 slab_free_hook mm/slub.c:1373 [inline] slab_free_freelist_hook mm/slub.c:1400 [inline] slab_free mm/slub.c:2955 [inline] kmem_cache_free+0xdd/0x370 mm/slub.c:2971 free_task_struct kernel/fork.c:162 [inline] free_task+0xa5/0xd0 kernel/fork.c:415 __put_task_struct+0x247/0x2e0 kernel/fork.c:689 put_task_struct include/linux/sched/task.h:96 [inline] delayed_put_task_struct+0x1b4/0x260 kernel/exit.c:180 __rcu_reclaim kernel/rcu/rcu.h:178 [inline] rcu_do_batch kernel/rcu/tree.c:2558 [inline] invoke_rcu_callbacks kernel/rcu/tree.c:2818 [inline] __rcu_process_callbacks kernel/rcu/tree.c:2785 [inline] rcu_process_callbacks+0x86c/0x1350 kernel/rcu/tree.c:2802 __do_softirq+0x25c/0x986 kernel/softirq.c:292 The buggy address belongs to the object at ffff8800adb0e300 which belongs to the cache task_struct of size 6080 The buggy address is located 32 bytes inside of 6080-byte region [ffff8800adb0e300, ffff8800adb0fac0) The buggy address belongs to the page: page:ffffea0002b6c200 count:1 mapcount:0 mapping:ffff8800b602bc00 index:0x0 compound_mapcount: 0 EXT4-fs warning (device loop2): ext4_multi_mount_protect:386: Unable to create kmmpd thread for loop2. flags: 0xfff00000008100(slab|head) raw: 00fff00000008100 0000000000000000 0000000100000001 ffff8800b602bc00 raw: 0000000000000000 0000000000050005 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8800adb0e200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8800adb0e280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff8800adb0e300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8800adb0e380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8800adb0e400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== EXT4-fs (loop0): re-mounted. Opts: (null)