================================================================== BUG: KASAN: use-after-free in instrument_atomic_write include/linux/instrumented.h:71 [inline] BUG: KASAN: use-after-free in atomic64_sub_return include/asm-generic/atomic-instrumented.h:970 [inline] BUG: KASAN: use-after-free in atomic_long_sub_return include/asm-generic/atomic-long.h:113 [inline] BUG: KASAN: use-after-free in page_counter_cancel+0x1c/0x70 mm/page_counter.c:54 Write of size 8 at addr ffff88804ad14148 by task syz-executor.5/2783 CPU: 1 PID: 2783 Comm: syz-executor.5 Not tainted 5.8.0-next-20200814-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x18f/0x20d lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xae/0x497 mm/kasan/report.c:383 __kasan_report mm/kasan/report.c:513 [inline] kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530 check_memory_region_inline mm/kasan/generic.c:186 [inline] check_memory_region+0x13d/0x180 mm/kasan/generic.c:192 instrument_atomic_write include/linux/instrumented.h:71 [inline] atomic64_sub_return include/asm-generic/atomic-instrumented.h:970 [inline] atomic_long_sub_return include/asm-generic/atomic-long.h:113 [inline] page_counter_cancel+0x1c/0x70 mm/page_counter.c:54 page_counter_uncharge+0x2e/0x60 mm/page_counter.c:156 uncharge_batch+0x67/0x450 mm/memcontrol.c:6764 uncharge_page+0xfd/0x560 mm/memcontrol.c:6796 uncharge_list mm/memcontrol.c:6835 [inline] mem_cgroup_uncharge_list+0xf6/0x180 mm/memcontrol.c:6877 release_pages+0x637/0x17a0 mm/swap.c:912 tlb_batch_pages_flush mm/mmu_gather.c:49 [inline] tlb_flush_mmu_free mm/mmu_gather.c:242 [inline] tlb_flush_mmu mm/mmu_gather.c:249 [inline] tlb_finish_mmu+0x165/0x8c0 mm/mmu_gather.c:328 exit_mmap+0x2d1/0x530 mm/mmap.c:3200 __mmput+0x122/0x470 kernel/fork.c:1075 mmput+0x53/0x60 kernel/fork.c:1096 exit_mm kernel/exit.c:483 [inline] do_exit+0xa8b/0x29f0 kernel/exit.c:793 do_group_exit+0x125/0x310 kernel/exit.c:903 __do_sys_exit_group kernel/exit.c:914 [inline] __se_sys_exit_group kernel/exit.c:912 [inline] __x64_sys_exit_group+0x3a/0x50 kernel/exit.c:912 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x45d239 Code: Bad RIP value. RSP: 002b:00007ffdf9f90358 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 000000000000001e RCX: 000000000045d239 RDX: 0000000000416b81 RSI: fffffffffffffff7 RDI: 0000000000000000 RBP: 0000000000000000 R08: 00000000c426f42b R09: 00007ffdf9f903b0 R10: 00000000c426f427 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffdf9f903b0 R14: 0000000000000000 R15: 00007ffdf9f903c0 Allocated by task 2685: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48 kasan_set_track mm/kasan/common.c:56 [inline] __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:461 __do_kmalloc mm/slab.c:3655 [inline] __kmalloc+0x1a8/0x320 mm/slab.c:3664 kmalloc include/linux/slab.h:559 [inline] kzalloc include/linux/slab.h:666 [inline] mem_cgroup_alloc mm/memcontrol.c:5210 [inline] mem_cgroup_css_alloc+0xc1/0x1bd0 mm/memcontrol.c:5278 css_create kernel/cgroup/cgroup.c:5128 [inline] cgroup_apply_control_enable+0x478/0xc00 kernel/cgroup/cgroup.c:3059 cgroup_apply_control kernel/cgroup/cgroup.c:3141 [inline] cgroup_subtree_control_write+0x7fc/0xcc0 kernel/cgroup/cgroup.c:3299 cgroup_file_write+0x211/0x750 kernel/cgroup/cgroup.c:3697 kernfs_fop_write+0x268/0x490 fs/kernfs/file.c:315 vfs_write+0x2b0/0x730 fs/read_write.c:576 ksys_write+0x12d/0x250 fs/read_write.c:631 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Freed by task 20465: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48 kasan_set_track+0x1c/0x30 mm/kasan/common.c:56 kasan_set_free_info+0x1b/0x30 mm/kasan/generic.c:355 __kasan_slab_free+0xd8/0x120 mm/kasan/common.c:422 __cache_free mm/slab.c:3418 [inline] kfree+0x103/0x2c0 mm/slab.c:3756 css_free_rwork_fn+0xf2/0x10c0 kernel/cgroup/cgroup.c:4941 process_one_work+0x94c/0x1670 kernel/workqueue.c:2269 worker_thread+0x64c/0x1120 kernel/workqueue.c:2415 kthread+0x3b5/0x4a0 kernel/kthread.c:292 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294 Last call_rcu(): kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48 kasan_record_aux_stack+0x82/0xb0 mm/kasan/generic.c:346 __call_rcu kernel/rcu/tree.c:2894 [inline] call_rcu+0x14f/0x7e0 kernel/rcu/tree.c:2968 queue_rcu_work+0x82/0xa0 kernel/workqueue.c:1747 process_one_work+0x94c/0x1670 kernel/workqueue.c:2269 worker_thread+0x64c/0x1120 kernel/workqueue.c:2415 kthread+0x3b5/0x4a0 kernel/kthread.c:292 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294 Second to last call_rcu(): kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48 kasan_record_aux_stack+0x82/0xb0 mm/kasan/generic.c:346 __call_rcu kernel/rcu/tree.c:2894 [inline] call_rcu+0x14f/0x7e0 kernel/rcu/tree.c:2968 __percpu_ref_switch_to_atomic lib/percpu-refcount.c:192 [inline] __percpu_ref_switch_mode+0x365/0x700 lib/percpu-refcount.c:237 percpu_ref_kill_and_confirm+0x94/0x350 lib/percpu-refcount.c:350 kill_css+0x115/0x340 kernel/cgroup/cgroup.c:5451 cgroup_apply_control_disable+0x3d8/0x500 kernel/cgroup/cgroup.c:3108 cgroup_finalize_control kernel/cgroup/cgroup.c:3171 [inline] cgroup_subtree_control_write+0x83e/0xcc0 kernel/cgroup/cgroup.c:3300 cgroup_file_write+0x211/0x750 kernel/cgroup/cgroup.c:3697 kernfs_fop_write+0x268/0x490 fs/kernfs/file.c:315 vfs_write+0x2b0/0x730 fs/read_write.c:576 ksys_write+0x12d/0x250 fs/read_write.c:631 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 The buggy address belongs to the object at ffff88804ad14000 which belongs to the cache kmalloc-4k of size 4096 The buggy address is located 328 bytes inside of 4096-byte region [ffff88804ad14000, ffff88804ad15000) The buggy address belongs to the page: page:000000002f31f80d refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4ad14 head:000000002f31f80d order:1 compound_mapcount:0 flags: 0xfffe0000010200(slab|head) raw: 00fffe0000010200 ffffea0001274388 ffffea00023b4188 ffff8880aa040900 raw: 0000000000000000 ffff88804ad14000 0000000100000001 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88804ad14000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88804ad14080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88804ad14100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88804ad14180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88804ad14200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================