================================================================== BUG: KFENCE: use-after-free read in __lock_acquire+0xd8d/0x56d0 kernel/locking/lockdep.c:4925 Use-after-free read at 0xffff88823bc94e18 (in kfence-#73): __lock_acquire+0xd8d/0x56d0 kernel/locking/lockdep.c:4925 lock_acquire kernel/locking/lockdep.c:5668 [inline] lock_acquire+0x1e3/0x630 kernel/locking/lockdep.c:5633 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3d/0x60 kernel/locking/spinlock.c:162 put_pmu_ctx kernel/events/core.c:4913 [inline] put_pmu_ctx+0xad/0x390 kernel/events/core.c:4893 _free_event+0x3c5/0x13d0 kernel/events/core.c:5196 free_event+0x58/0xc0 kernel/events/core.c:5224 __do_sys_perf_event_open+0x66d/0x2980 kernel/events/core.c:12701 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd kfence-#73: 0xffff88823bc94e00-0xffff88823bc94f87, size=392, cache=kmalloc-512 allocated by task 32111 on cpu 1 at 1605.984832s: kfence_alloc include/linux/kfence.h:128 [inline] slab_alloc_node mm/slub.c:3438 [inline] __kmem_cache_alloc_node+0x29c/0x430 mm/slub.c:3491 kmalloc_trace+0x26/0x60 mm/slab_common.c:1062 kmalloc include/linux/slab.h:580 [inline] kzalloc include/linux/slab.h:720 [inline] alloc_perf_context kernel/events/core.c:4693 [inline] find_get_context+0xcc/0x810 kernel/events/core.c:4763 __do_sys_perf_event_open+0x963/0x2980 kernel/events/core.c:12476 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd freed by task 46 on cpu 1 at 1606.010120s: rcu_do_batch kernel/rcu/tree.c:2244 [inline] rcu_core+0x81f/0x1980 kernel/rcu/tree.c:2504 __do_softirq+0x1fb/0xadc kernel/softirq.c:571 invoke_softirq kernel/softirq.c:445 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650 irq_exit_rcu+0x9/0x20 kernel/softirq.c:662 sysvec_apic_timer_interrupt+0x97/0xc0 arch/x86/kernel/apic/apic.c:1107 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:649 should_resched arch/x86/include/asm/preempt.h:103 [inline] __local_bh_enable_ip+0xac/0x130 kernel/softirq.c:403 spin_unlock_bh include/linux/spinlock.h:395 [inline] batadv_nc_purge_paths+0x2a5/0x3a0 net/batman-adv/network-coding.c:471 batadv_nc_worker+0x934/0xfa0 net/batman-adv/network-coding.c:722 process_one_work+0x9bf/0x1710 kernel/workqueue.c:2289 worker_thread+0x669/0x1090 kernel/workqueue.c:2436 kthread+0x2e8/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 CPU: 1 PID: 32111 Comm: syz-executor.0 Not tainted 6.1.0-syzkaller-09694-gfcbb408a1aaf #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 RIP: 0010:__lock_acquire+0xd8d/0x56d0 kernel/locking/lockdep.c:4925 Code: c8 00 00 00 89 05 53 ad 3c 0f e9 bd 00 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89 f2 48 c1 ea 03 80 3c 02 00 0f 85 4e 31 00 00 <49> 81 3e 20 a5 f6 8f 0f 84 4c f3 ff ff 41 83 fc 01 0f 87 54 f3 ff RSP: 0018:ffffc90004b0fa98 EFLAGS: 00010046 RAX: dffffc0000000000 RBX: 1ffff92000961f83 RCX: 0000000000000000 RDX: 1ffff110477929c3 RSI: 0000000000000000 RDI: 0000000000000001 RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000001 R10: fffffbfff1ce7982 R11: 0000000000000000 R12: 0000000000000000 R13: ffff88802617d7c0 R14: ffff88823bc94e18 R15: 0000000000000000 FS: 00007f6f5c2a5700(0000) GS:ffff8880b9900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff88823bc94e18 CR3: 0000000021551000 CR4: 00000000003506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: lock_acquire kernel/locking/lockdep.c:5668 [inline] lock_acquire+0x1e3/0x630 kernel/locking/lockdep.c:5633 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3d/0x60 kernel/locking/spinlock.c:162 put_pmu_ctx kernel/events/core.c:4913 [inline] put_pmu_ctx+0xad/0x390 kernel/events/core.c:4893 _free_event+0x3c5/0x13d0 kernel/events/core.c:5196 free_event+0x58/0xc0 kernel/events/core.c:5224 __do_sys_perf_event_open+0x66d/0x2980 kernel/events/core.c:12701 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f6f5b48c0a9 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f6f5c2a5168 EFLAGS: 00000246 ORIG_RAX: 000000000000012a RAX: ffffffffffffffda RBX: 00007f6f5b5ac050 RCX: 00007f6f5b48c0a9 RDX: 0000000000000000 RSI: 0000000000000fe2 RDI: 0000000020000200 RBP: 00007f6f5b4e7ae9 R08: 0000000000000000 R09: 0000000000000000 R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffe7dd6c33f R14: 00007f6f5c2a5300 R15: 0000000000022000 ================================================================== ---------------- Code disassembly (best guess): 0: c8 00 00 00 enterq $0x0,$0x0 4: 89 05 53 ad 3c 0f mov %eax,0xf3cad53(%rip) # 0xf3cad5d a: e9 bd 00 00 00 jmpq 0xcc f: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 16: fc ff df 19: 4c 89 f2 mov %r14,%rdx 1c: 48 c1 ea 03 shr $0x3,%rdx 20: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) 24: 0f 85 4e 31 00 00 jne 0x3178 * 2a: 49 81 3e 20 a5 f6 8f cmpq $0xffffffff8ff6a520,(%r14) <-- trapping instruction 31: 0f 84 4c f3 ff ff je 0xfffff383 37: 41 83 fc 01 cmp $0x1,%r12d 3b: 0f .byte 0xf 3c: 87 54 f3 ff xchg %edx,-0x1(%rbx,%rsi,8)