================================================================== BUG: KASAN: double-free or invalid-free in slab_free mm/slub.c:3157 [inline] BUG: KASAN: double-free or invalid-free in kfree+0xdb/0x3c0 mm/slub.c:4194 CPU: 1 PID: 13852 Comm: syz-executor.0 Not tainted 5.10.0-rc7-next-20201210-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x107/0x163 lib/dump_stack.c:120 print_address_description.constprop.0.cold+0x5b/0x2f8 mm/kasan/report.c:230 kasan_report_invalid_free+0x51/0x80 mm/kasan/report.c:355 ____kasan_slab_free.part.0+0xfd/0x110 mm/kasan/common.c:345 kasan_slab_free include/linux/kasan.h:188 [inline] slab_free_hook mm/slub.c:1548 [inline] slab_free_freelist_hook+0x82/0x1d0 mm/slub.c:1586 slab_free mm/slub.c:3157 [inline] kfree+0xdb/0x3c0 mm/slub.c:4194 bdev_free_inode+0x57/0x80 fs/block_dev.c:788 i_callback+0x3f/0x70 fs/inode.c:222 rcu_do_batch kernel/rcu/tree.c:2502 [inline] rcu_core+0x735/0x1020 kernel/rcu/tree.c:2737 __do_softirq+0x2b7/0xa76 kernel/softirq.c:343 asm_call_irq_on_stack+0xf/0x20 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline] run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline] do_softirq_own_stack+0xaa/0xd0 arch/x86/kernel/irq_64.c:77 invoke_softirq kernel/softirq.c:226 [inline] __irq_exit_rcu kernel/softirq.c:424 [inline] irq_exit_rcu+0x194/0x210 kernel/softirq.c:436 sysvec_apic_timer_interrupt+0x4d/0x100 arch/x86/kernel/apic/apic.c:1096 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:628 RIP: 0010:preempt_count arch/x86/include/asm/preempt.h:26 [inline] RIP: 0010:check_kcov_mode kernel/kcov.c:163 [inline] RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x60 kernel/kcov.c:197 Code: 00 00 00 4d 8b 0b 48 0f bd c8 49 8b 14 24 48 63 c9 e9 66 ff ff ff 4c 01 ca 49 89 13 e9 00 fd ff ff 66 0f 1f 84 00 00 00 00 00 <65> 8b 05 a9 52 8f 7e 89 c1 48 8b 34 24 81 e1 00 01 00 00 65 48 8b RSP: 0018:ffffc900029cfa40 EFLAGS: 00000202 RAX: 0000000000000000 RBX: 0000000000000001 RCX: ffff88801f050000 RDX: 0000000000000000 RSI: ffff88801f050000 RDI: 0000000000000003 RBP: ffffea0000f6fd80 R08: 0000000000000000 R09: 0000000000000001 R10: ffffffff819a31a4 R11: 0000000000000000 R12: ffffea0000f6fd88 R13: 0000000000000000 R14: ffffea0000d6ad48 R15: ffff88807e0833a0 compound_head include/linux/page-flags.h:184 [inline] PageUnevictable include/linux/page-flags.h:410 [inline] mark_page_accessed+0x293/0x1bd0 mm/swap.c:420 touch_buffer fs/buffer.c:63 [inline] __find_get_block+0x2c8/0xd50 fs/buffer.c:1369 sb_find_get_block include/linux/buffer_head.h:338 [inline] recently_deleted fs/ext4/ialloc.c:686 [inline] find_inode_bit+0x224/0x570 fs/ext4/ialloc.c:728 __ext4_new_inode+0xc54/0x56b0 fs/ext4/ialloc.c:1062 ext4_symlink+0x3c9/0xd40 fs/ext4/namei.c:3334 vfs_symlink fs/namei.c:3960 [inline] vfs_symlink+0x101/0x260 fs/namei.c:3946 do_symlinkat+0x258/0x2c0 fs/namei.c:3987 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x45de87 Code: 0f 1f 00 b8 5c 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 cd b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 58 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 ad b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fff09ce7f18 EFLAGS: 00000206 ORIG_RAX: 0000000000000058 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 000000000045de87 RDX: 00007fff09ce7fb7 RSI: 00000000004c3b99 RDI: 00007fff09ce7fa0 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000017 R10: 0000000000000075 R11: 0000000000000206 R12: 0000000000000001 R13: 00007fff09ce7f50 R14: 00007fff09ce7f60 R15: 0000000000000001 Allocated by task 13277: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:39 kasan_set_track mm/kasan/common.c:47 [inline] set_alloc_info mm/kasan/common.c:405 [inline] ____kasan_kmalloc mm/kasan/common.c:436 [inline] ____kasan_kmalloc.constprop.0+0xa0/0xd0 mm/kasan/common.c:408 kmalloc include/linux/slab.h:570 [inline] kzalloc include/linux/slab.h:695 [inline] __register_sysctl_table+0x112/0x1090 fs/proc/proc_sysctl.c:1314 sysctl_route_net_init+0xe9/0x240 net/ipv4/route.c:3508 ops_init+0xaf/0x490 net/core/net_namespace.c:152 setup_net+0x2de/0x850 net/core/net_namespace.c:342 copy_net_ns+0x376/0x7b0 net/core/net_namespace.c:483 create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0xbd/0x230 kernel/nsproxy.c:231 ksys_unshare+0x445/0x8e0 kernel/fork.c:2958 __do_sys_unshare kernel/fork.c:3026 [inline] __se_sys_unshare kernel/fork.c:3024 [inline] __x64_sys_unshare+0x2d/0x40 kernel/fork.c:3024 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Freed by task 3864: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:39 kasan_set_track+0x1c/0x30 mm/kasan/common.c:47 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:355 ____kasan_slab_free.part.0+0xe1/0x110 mm/kasan/common.c:366 kasan_slab_free include/linux/kasan.h:188 [inline] slab_free_hook mm/slub.c:1548 [inline] slab_free_freelist_hook+0x82/0x1d0 mm/slub.c:1586 slab_free mm/slub.c:3157 [inline] kmem_cache_free_bulk mm/slub.c:3290 [inline] kmem_cache_free_bulk+0x26a/0xbb0 mm/slub.c:3277 kfree_bulk include/linux/slab.h:422 [inline] kfree_rcu_work+0x4cd/0x860 kernel/rcu/tree.c:3250 process_one_work+0x98d/0x1630 kernel/workqueue.c:2275 worker_thread+0x64c/0x1120 kernel/workqueue.c:2421 kthread+0x3b1/0x4a0 kernel/kthread.c:292 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296 Last potentially related work creation: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:39 kasan_record_aux_stack+0xdc/0x100 mm/kasan/generic.c:343 kvfree_call_rcu+0x80/0x980 kernel/rcu/tree.c:3539 drop_sysctl_table+0x3c0/0x4e0 fs/proc/proc_sysctl.c:1643 unregister_sysctl_table fs/proc/proc_sysctl.c:1681 [inline] unregister_sysctl_table+0xbd/0x190 fs/proc/proc_sysctl.c:1656 sysctl_route_net_exit+0x58/0x90 net/ipv4/route.c:3525 ops_exit_list+0xb0/0x160 net/core/net_namespace.c:187 cleanup_net+0x4ea/0xb10 net/core/net_namespace.c:604 process_one_work+0x98d/0x1630 kernel/workqueue.c:2275 worker_thread+0x64c/0x1120 kernel/workqueue.c:2421 kthread+0x3b1/0x4a0 kernel/kthread.c:292 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296 The buggy address belongs to the object at ffff88801b066700 which belongs to the cache kmalloc-128 of size 128 The buggy address is located 0 bytes inside of 128-byte region [ffff88801b066700, ffff88801b066780) The buggy address belongs to the page: page:00000000e189e588 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1b066 flags: 0xfff00000000200(slab) raw: 00fff00000000200 ffffea0000530100 0000000200000002 ffff888010841640 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88801b066600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff88801b066680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88801b066700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88801b066780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88801b066800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================