netlink: 8 bytes leftover after parsing attributes in process `syz-executor4'.
device lo entered promiscuous mode
==================================================================
BUG: KASAN: use-after-free in __list_del_entry+0x182/0x1c0 lib/list_debug.c:48
Read of size 8 at addr ffff8801be793960 by task udevd/2349

CPU: 1 PID: 2349 Comm: udevd Not tainted 4.9.103-g0cecdf8 #38
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801db307b70 ffffffff81eb34a9 ffffea0006f9e4c0 ffff8801be793960
 0000000000000000 ffff8801be793960 ffff8801b9aaa280 ffff8801db307ba8
 ffffffff815676bb ffff8801be793960 0000000000000008 0000000000000000
Call Trace:
 <IRQ> 
 [<ffffffff81eb34a9>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81eb34a9>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff815676bb>] print_address_description+0x6c/0x234 mm/kasan/report.c:256
 [<ffffffff81567ac5>] kasan_report_error mm/kasan/report.c:355 [inline]
 [<ffffffff81567ac5>] kasan_report.cold.6+0x242/0x2fe mm/kasan/report.c:412
 [<ffffffff8153b744>] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
 [<ffffffff81f1b3c2>] __list_del_entry+0x182/0x1c0 lib/list_debug.c:48
 [<ffffffff82ee419e>] list_del_init include/linux/list.h:145 [inline]
 [<ffffffff82ee419e>] snd_timer_interrupt+0x4fe/0xc40 sound/core/timer.c:791
 [<ffffffff82ee499d>] snd_timer_s_function+0xbd/0x120 sound/core/timer.c:1028
 [<ffffffff81298b23>] call_timer_fn+0x163/0x6e0 kernel/time/timer.c:1319
 [<ffffffff8129fc87>] expire_timers kernel/time/timer.c:1359 [inline]
 [<ffffffff8129fc87>] __run_timers kernel/time/timer.c:1658 [inline]
 [<ffffffff8129fc87>] run_timer_softirq+0x1047/0x1590 kernel/time/timer.c:1684
 [<ffffffff839febfb>] __do_softirq+0x20b/0x937 kernel/softirq.c:284
 [<ffffffff8114b0b7>] invoke_softirq kernel/softirq.c:364 [inline]
 [<ffffffff8114b0b7>] irq_exit+0x147/0x190 kernel/softirq.c:405
 [<ffffffff839fd7e1>] exiting_irq arch/x86/include/asm/apic.h:659 [inline]
 [<ffffffff839fd7e1>] smp_apic_timer_interrupt+0x81/0xa0 arch/x86/kernel/apic/apic.c:960
 [<ffffffff839f9970>] apic_timer_interrupt+0xa0/0xb0 arch/x86/entry/entry_64.S:648
 <EOI> 
 [<ffffffff81cf80c0>] avc_has_perm_noaudit+0x220/0x450 security/selinux/avc.c:1116
 [<ffffffff81d005fd>] selinux_inode_permission+0x32d/0x4b0 security/selinux/hooks.c:3038
 [<ffffffff81cef049>] security_inode_permission+0xb9/0x100 security/security.c:611
 [<ffffffff815928f3>] __inode_permission2+0x93/0x2d0 fs/namei.c:435
 [<ffffffff81592b8f>] inode_permission2+0x2f/0x110 fs/namei.c:485
 [<ffffffff815a2c00>] may_lookup fs/namei.c:1689 [inline]
 [<ffffffff815a2c00>] link_path_walk+0x950/0x1200 fs/namei.c:2064
 [<ffffffff815a37a4>] path_lookupat.isra.41+0x1b4/0x410 fs/namei.c:2282
 [<ffffffff815a9227>] filename_lookup.part.55+0x177/0x370 fs/namei.c:2317
 [<ffffffff815a95e3>] filename_lookup fs/namei.c:2310 [inline]
 [<ffffffff815a95e3>] user_path_at_empty+0x53/0x70 fs/namei.c:2578
 [<ffffffff815805c6>] user_path_at include/linux/namei.h:55 [inline]
 [<ffffffff815805c6>] vfs_fstatat+0xc6/0x170 fs/stat.c:106
 [<ffffffff81581776>] vfs_stat fs/stat.c:123 [inline]
 [<ffffffff81581776>] SYSC_newstat+0x86/0xf0 fs/stat.c:270
 [<ffffffff81581b7d>] SyS_newstat+0x1d/0x30 fs/stat.c:266
 [<ffffffff81006316>] do_syscall_64+0x1a6/0x490 arch/x86/entry/common.c:282
 [<ffffffff839f8013>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Allocated by task 7200:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack+0x43/0xd0 mm/kasan/kasan.c:505
 set_track mm/kasan/kasan.c:517 [inline]
 kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:609
 kmem_cache_alloc_trace+0xfd/0x2b0 mm/slub.c:2742
 kmalloc include/linux/slab.h:490 [inline]
 kzalloc include/linux/slab.h:636 [inline]
 snd_timer_instance_new+0x52/0x3a0 sound/core/timer.c:107
 snd_timer_open+0x500/0xdd0 sound/core/timer.c:290
 snd_timer_user_tselect sound/core/timer.c:1621 [inline]
 __snd_timer_user_ioctl.isra.23+0x675/0x22c0 sound/core/timer.c:1914
 __snd_timer_user_ioctl_compat sound/core/timer_compat.c:157 [inline]
 snd_timer_user_ioctl_compat+0x563/0x760 sound/core/timer_compat.c:179
 C_SYSC_ioctl fs/compat_ioctl.c:1602 [inline]
 compat_SyS_ioctl+0x126/0x1fe0 fs/compat_ioctl.c:1549
 do_syscall_32_irqs_on arch/x86/entry/common.c:325 [inline]
 do_fast_syscall_32+0x2f7/0x870 arch/x86/entry/common.c:387
 entry_SYSENTER_compat+0x90/0xa2 arch/x86/entry/entry_64_compat.S:137

Freed by task 7200:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack+0x43/0xd0 mm/kasan/kasan.c:505
 set_track mm/kasan/kasan.c:517 [inline]
 kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:582
 slab_free_hook mm/slub.c:1355 [inline]
 slab_free_freelist_hook mm/slub.c:1377 [inline]
 slab_free mm/slub.c:2958 [inline]
 kfree+0xfb/0x310 mm/slub.c:3878
 snd_timer_close+0x36d/0x660 sound/core/timer.c:372
 snd_timer_user_release+0x97/0x130 sound/core/timer.c:1365
 __fput+0x263/0x700 fs/file_table.c:208
 ____fput+0x15/0x20 fs/file_table.c:244
 task_work_run+0x10c/0x180 kernel/task_work.c:116
 exit_task_work include/linux/task_work.h:21 [inline]
 do_exit+0x9e1/0x27c0 kernel/exit.c:837
 do_group_exit+0x111/0x340 kernel/exit.c:941
 get_signal+0x4cf/0x1450 kernel/signal.c:2317
 do_signal+0x87/0x19f0 arch/x86/kernel/signal.c:807
 exit_to_usermode_loop+0xe1/0x120 arch/x86/entry/common.c:157
 prepare_exit_to_usermode arch/x86/entry/common.c:191 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:260 [inline]
 do_syscall_32_irqs_on arch/x86/entry/common.c:331 [inline]
 do_fast_syscall_32+0x5c3/0x870 arch/x86/entry/common.c:387
 entry_SYSENTER_compat+0x90/0xa2 arch/x86/entry/entry_64_compat.S:137

The buggy address belongs to the object at ffff8801be7938c0
 which belongs to the cache kmalloc-256 of size 256
The buggy address is located 160 bytes inside of
 256-byte region [ffff8801be7938c0, ffff8801be7939c0)
The buggy address belongs to the page:
page:ffffea0006f9e4c0 count:1 mapcount:0 mapping:          (null) index:0x0
flags: 0x8000000000000080(slab)
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801be793800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8801be793880: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
>ffff8801be793900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                       ^
 ffff8801be793980: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
 ffff8801be793a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================