================================================================== BUG: KASAN: use-after-free in __lock_acquire+0x3b1e/0x48a0 kernel/locking/lockdep.c:4250 Read of size 8 at addr ffff88801fefb940 by task kworker/u16:3/9895 CPU: 0 PID: 9895 Comm: kworker/u16:3 Not tainted 5.7.0-syzkaller #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.12.0-59-gc9ba5276e321-prebuilt.qemu.org 04/01/2014 Workqueue: bat_events batadv_dat_purge Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x188/0x20d lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xd3/0x413 mm/kasan/report.c:383 __kasan_report mm/kasan/report.c:513 [inline] kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530 __lock_acquire+0x3b1e/0x48a0 kernel/locking/lockdep.c:4250 lock_acquire+0x1f2/0x8f0 kernel/locking/lockdep.c:4959 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x8c/0xbf kernel/locking/spinlock.c:159 usblp_bulk_read+0x211/0x270 drivers/usb/class/usblp.c:303 __usb_hcd_giveback_urb+0x2af/0x4b0 drivers/usb/core/hcd.c:1650 usb_hcd_giveback_urb+0x368/0x420 drivers/usb/core/hcd.c:1716 __skb_queue_head_init include/linux/skbuff.h:1854 [inline] skbpoolfree drivers/block/aoe/aoedev.c:435 [inline] freedev drivers/block/aoe/aoedev.c:290 [inline] dummy_timer+0x1243/0x2fe1 drivers/block/aoe/aoedev.c:366 call_timer_fn+0x1ac/0x780 kernel/time/timer.c:1404 expire_timers kernel/time/timer.c:1449 [inline] __run_timers kernel/time/timer.c:1773 [inline] __run_timers kernel/time/timer.c:1740 [inline] run_timer_softirq+0x623/0x1600 kernel/time/timer.c:1786 __do_softirq+0x26c/0x9f7 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0x192/0x1d0 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:546 [inline] smp_apic_timer_interrupt+0x19e/0x600 arch/x86/kernel/apic/apic.c:1107 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829 RIP: 0010:__batadv_dat_purge.isra.0.part.0+0x230/0x350 net/batman-adv/distributed-arp-table.c:169 Code: de 48 89 ef 48 89 45 20 e8 3d fd ff ff e8 28 0c b4 f9 4d 85 e4 0f 85 f7 fe ff ff e8 1a 0c b4 f9 48 8b 7c 24 10 e8 20 5b 1e 00 <48> 8b 44 24 20 83 44 24 0c 01 80 38 00 0f 85 aa 00 00 00 48 8b 44 RSP: 0018:ffffc90000c9fca8 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13 RAX: 0000000080000000 RBX: dffffc0000000000 RCX: 1ffffffff15174b2 RDX: dffffc0000000000 RSI: 0000000000000000 RDI: ffff88807328d480 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001 R10: ffffffff8c349a97 R11: fffffbfff1869352 R12: ffff88805ec00c40 R13: ffff888014fc4188 R14: ffffffff87bfe330 R15: 0000000000000031 __batadv_dat_purge net/batman-adv/distributed-arp-table.c:166 [inline] batadv_dat_purge+0x49/0x70 net/batman-adv/distributed-arp-table.c:204 process_one_work+0x965/0x16a0 kernel/workqueue.c:2268 worker_thread+0x96/0xe20 kernel/workqueue.c:2414 kthread+0x388/0x470 kernel/kthread.c:268 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:351 Allocated by task 13: save_stack+0x1b/0x40 mm/kasan/common.c:48 set_track mm/kasan/common.c:56 [inline] __kasan_kmalloc mm/kasan/common.c:494 [inline] __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:467 kmem_cache_alloc_trace+0x153/0x7d0 mm/slab.c:3551 kmalloc include/linux/slab.h:555 [inline] kzalloc include/linux/slab.h:669 [inline] usblp_probe+0xed/0x1120 drivers/usb/class/usblp.c:1104 usb_probe_interface+0x305/0x7a0 drivers/usb/core/driver.c:374 really_probe+0x281/0x6d0 drivers/base/dd.c:520 driver_probe_device+0x104/0x210 drivers/base/dd.c:697 __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:804 bus_for_each_drv+0x162/0x1e0 drivers/base/bus.c:431 __device_attach+0x21a/0x360 drivers/base/dd.c:870 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:491 device_add+0x132d/0x1c10 drivers/base/core.c:2557 usb_set_configuration+0xec5/0x1740 drivers/usb/core/message.c:2032 usb_generic_driver_probe+0x9d/0xe0 drivers/usb/core/generic.c:241 usb_probe_device+0xc6/0x1f0 drivers/usb/core/driver.c:272 really_probe+0x281/0x6d0 drivers/base/dd.c:520 driver_probe_device+0x104/0x210 drivers/base/dd.c:697 __device_attach_driver+0x1c2/0x220 drivers/base/dd.c:804 bus_for_each_drv+0x162/0x1e0 drivers/base/bus.c:431 __device_attach+0x21a/0x360 drivers/base/dd.c:870 bus_probe_device+0x1e4/0x290 drivers/base/bus.c:491 device_add+0x132d/0x1c10 drivers/base/core.c:2557 usb_new_device.cold+0x753/0x103d drivers/usb/core/hub.c:2554 hub_port_connect drivers/usb/core/hub.c:5208 [inline] hub_port_connect_change drivers/usb/core/hub.c:5348 [inline] port_event drivers/usb/core/hub.c:5494 [inline] hub_event+0x1eca/0x38f0 drivers/usb/core/hub.c:5576 process_one_work+0x965/0x16a0 kernel/workqueue.c:2268 worker_thread+0x96/0xe20 kernel/workqueue.c:2414 kthread+0x388/0x470 kernel/kthread.c:268 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:351 Freed by task 10232: save_stack+0x1b/0x40 mm/kasan/common.c:48 set_track mm/kasan/common.c:56 [inline] kasan_set_free_info mm/kasan/common.c:316 [inline] __kasan_slab_free+0xf7/0x140 mm/kasan/common.c:455 __cache_free mm/slab.c:3426 [inline] kfree+0x109/0x2b0 mm/slab.c:3757 usblp_disconnect.cold+0x24/0x29 drivers/usb/class/usblp.c:1380 usb_unbind_interface+0x1bd/0x8a0 drivers/usb/core/driver.c:436 __device_release_driver drivers/base/dd.c:1110 [inline] device_release_driver_internal+0x432/0x500 drivers/base/dd.c:1141 bus_remove_device+0x2dc/0x4a0 drivers/base/bus.c:533 device_del+0x481/0xd30 drivers/base/core.c:2734 usb_disable_device+0x211/0x690 drivers/usb/core/message.c:1245 usb_disconnect+0x284/0x8d0 drivers/usb/core/hub.c:2217 hub_port_connect drivers/usb/core/hub.c:5059 [inline] hub_port_connect_change drivers/usb/core/hub.c:5348 [inline] port_event drivers/usb/core/hub.c:5494 [inline] hub_event+0x17ca/0x38f0 drivers/usb/core/hub.c:5576 process_one_work+0x965/0x16a0 kernel/workqueue.c:2268 worker_thread+0x96/0xe20 kernel/workqueue.c:2414 kthread+0x388/0x470 kernel/kthread.c:268 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:351 The buggy address belongs to the object at ffff88801fefb800 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 320 bytes inside of 1024-byte region [ffff88801fefb800, ffff88801fefbc00) The buggy address belongs to the page: page:ffffea00007fbec0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 flags: 0xfffe0000000200(slab) raw: 00fffe0000000200 ffffea00007fbe08 ffffea0000a99888 ffff88802c800c40 raw: 0000000000000000 ffff88801fefb000 0000000100000002 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88801fefb800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88801fefb880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88801fefb900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88801fefb980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88801fefba00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================