bisecting cause commit starting from 687dec9b94599b19e218f89fd034d6449c3ff57c
building syzkaller on d973f52833e0e3cec5406aa9cdf606a463d85c46
testing commit 687dec9b94599b19e218f89fd034d6449c3ff57c with gcc (GCC) 8.1.0
kernel signature: 51aa10e2b214d1f7076567f68ca5a16dae82230e
run #0: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #1: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #2: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #3: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #4: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #5: crashed: INFO: task hung in paste_selection
run #6: crashed: INFO: task hung in paste_selection
run #7: crashed: INFO: task hung in paste_selection
run #8: crashed: INFO: task hung in paste_selection
run #9: crashed: INFO: task hung in paste_selection
testing release v5.4
testing commit 219d54332a09e8d8741c1e1982f5eae56099de85 with gcc (GCC) 8.1.0
kernel signature: c2dd340c360a96b99953a717484737c00bc3d9b0
run #0: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #1: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #2: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #3: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #4: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #5: crashed: INFO: task hung in paste_selection
run #6: crashed: INFO: task hung in paste_selection
run #7: crashed: INFO: task hung in paste_selection
run #8: crashed: INFO: task hung in paste_selection
run #9: crashed: INFO: task hung in paste_selection
testing release v5.3
testing commit 4d856f72c10ecb060868ed10ff1b1453943fc6c8 with gcc (GCC) 8.1.0
kernel signature: 2dd68ab3d9e59ac8279e09ae87b77978e50f3882
run #0: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #1: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #2: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #3: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #4: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #5: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #6: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #7: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #8: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #9: crashed: INFO: task hung in paste_selection
testing release v5.2
testing commit 0ecfebd2b52404ae0c54a878c872bb93363ada36 with gcc (GCC) 8.1.0
kernel signature: d933da1bbf3f9f40cddcfe7e37d9fcc23219ad7b
run #0: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #1: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #2: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #3: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #4: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #5: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #6: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #7: crashed: INFO: task hung in paste_selection
run #8: crashed: INFO: task hung in paste_selection
run #9: crashed: INFO: task hung in paste_selection
testing release v5.1
testing commit e93c9c99a629c61837d5a7fc2120cd2b6c70dbdd with gcc (GCC) 8.1.0
kernel signature: 963e07d53dd08800eb4a44f71a9f0cc67e671022
run #0: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #1: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #2: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #3: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #4: crashed: INFO: task hung in paste_selection
run #5: crashed: INFO: task hung in paste_selection
run #6: crashed: INFO: task hung in paste_selection
run #7: crashed: INFO: task hung in paste_selection
run #8: crashed: INFO: task hung in paste_selection
run #9: crashed: INFO: task hung in paste_selection
testing release v5.0
testing commit 1c163f4c7b3f621efff9b28a47abb36f7378d783 with gcc (GCC) 8.1.0
kernel signature: 5473126519579c812125893a3dabf31257637bab
run #0: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #1: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #2: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #3: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #4: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #5: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #6: crashed: INFO: task hung in paste_selection
run #7: crashed: INFO: task hung in paste_selection
run #8: crashed: INFO: task hung in paste_selection
run #9: crashed: INFO: task hung in paste_selection
testing release v4.20
testing commit 8fe28cb58bcb235034b64cbbb7550a8a43fd88be with gcc (GCC) 8.1.0
kernel signature: acea14a492cf738c8d471679ba26ee70fc8d9ca9
run #0: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #1: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #2: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #3: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #4: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #5: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #6: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #7: crashed: INFO: task hung in paste_selection
run #8: crashed: INFO: task hung in paste_selection
run #9: crashed: INFO: task hung in paste_selection
testing release v4.19
testing commit 84df9525b0c27f3ebc2ebb1864fa62a97fdedb7d with gcc (GCC) 8.1.0
kernel signature: 338a155e61f13d0e6dbe775751da0e42b8d2219a
run #0: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #1: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #2: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #3: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #4: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #5: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #6: crashed: INFO: task hung in paste_selection
run #7: crashed: INFO: task hung in paste_selection
run #8: crashed: INFO: task hung in paste_selection
run #9: crashed: INFO: task hung in paste_selection
testing release v4.18
testing commit 94710cac0ef4ee177a63b5227664b38c95bbf703 with gcc (GCC) 8.1.0
kernel signature: af63d2a9471cd47f6804f16fe5c8547107c694d4
run #0: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #1: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #2: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #3: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #4: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #5: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #6: crashed: INFO: task hung in paste_selection
run #7: crashed: INFO: task hung in paste_selection
run #8: crashed: INFO: task hung in paste_selection
run #9: crashed: INFO: task hung in paste_selection
testing release v4.17
testing commit 29dcea88779c856c7dc92040a0c01233263101d4 with gcc (GCC) 8.1.0
kernel signature: 0cdcf473d2b7e530cc80eecc7a663c58d4502568
run #0: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #1: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #2: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #3: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #4: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #5: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #6: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #7: crashed: INFO: task hung in paste_selection
run #8: crashed: INFO: task hung in paste_selection
run #9: crashed: INFO: task hung in paste_selection
testing release v4.16
testing commit 0adb32858b0bddf4ada5f364a84ed60b196dbcda with gcc (GCC) 8.1.0
kernel signature: 31193cba07b3834ef56bb934e3b3102331d90a28
run #0: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #1: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #2: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #3: crashed: INFO: task hung in paste_selection
run #4: crashed: INFO: task hung in paste_selection
run #5: crashed: INFO: task hung in paste_selection
run #6: crashed: INFO: task hung in paste_selection
run #7: crashed: INFO: task hung in paste_selection
run #8: crashed: INFO: task hung in paste_selection
run #9: crashed: INFO: task hung in paste_selection
testing release v4.15
testing commit d8a5b80568a9cb66810e75b182018e9edb68e8ff with gcc (GCC) 8.1.0
kernel signature: 5dd4ca22ef16d2d87a08fa4a1a27ae196cf1ea85
run #0: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #1: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #2: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #3: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #4: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #5: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #6: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #7: crashed: INFO: task hung in paste_selection
run #8: crashed: INFO: task hung in paste_selection
run #9: crashed: INFO: task hung in paste_selection
testing release v4.14
testing commit bebc6082da0a9f5d47a1ea2edc099bf671058bd4 with gcc (GCC) 8.1.0
kernel signature: 5ba4318054c64f8aa17ce2e64f9ece4b7ee4eb77
run #0: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #1: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #2: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #3: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #4: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #5: crashed: INFO: task hung in paste_selection
run #6: crashed: INFO: task hung in paste_selection
run #7: crashed: INFO: task hung in paste_selection
run #8: crashed: INFO: task hung in paste_selection
run #9: crashed: INFO: task hung in paste_selection
testing release v4.13
testing commit 569dbb88e80deb68974ef6fdd6a13edb9d686261 with gcc (GCC) 8.1.0
kernel signature: 18d28feda57397c12822a6ee4d4a92133eea5100
run #0: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #1: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #2: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #3: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #4: crashed: INFO: task hung in paste_selection
run #5: crashed: INFO: task hung in paste_selection
run #6: crashed: INFO: task hung in paste_selection
run #7: crashed: INFO: task hung in paste_selection
run #8: crashed: INFO: task hung in paste_selection
run #9: crashed: INFO: task hung in paste_selection
testing release v4.12
testing commit 6f7da290413ba713f0cdd9ff1a2a9bb129ef4f6c with gcc (GCC) 8.1.0
kernel signature: 22352b7248b8d838786f6276a899455e9ca8125e
run #0: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #1: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #2: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #3: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #4: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #5: crashed: INFO: task hung in paste_selection
run #6: crashed: INFO: task hung in paste_selection
run #7: crashed: INFO: task hung in paste_selection
run #8: crashed: INFO: task hung in paste_selection
run #9: crashed: INFO: task hung in paste_selection
testing release v4.11
testing commit a351e9b9fc24e982ec2f0e76379a49826036da12 with gcc (GCC) 7.3.0
kernel signature: d1a5b34396d79154b09f31ac43354017fca3fad6
run #0: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #1: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #2: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #3: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #4: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #5: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #6: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #7: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #8: crashed: INFO: task hung in paste_selection
run #9: crashed: INFO: task hung in paste_selection
testing release v4.10
testing commit c470abd4fde40ea6a0846a2beab642a578c0b8cd with gcc (GCC) 5.5.0
kernel signature: 050b4111184a35f8203f500d28ea2ac36b59576c
run #0: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #1: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #2: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #3: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #4: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #5: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #6: crashed: INFO: task hung in paste_selection
run #7: crashed: INFO: task hung in paste_selection
run #8: crashed: INFO: task hung in paste_selection
run #9: crashed: INFO: task hung in paste_selection
testing release v4.9
testing commit 69973b830859bc6529a7a0468ba0d80ee5117826 with gcc (GCC) 5.5.0
kernel signature: 6aaeb5a3cff1e26374fddae2c9aea5bf641d20bb
run #0: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #1: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #2: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #3: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #4: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #5: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #6: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #7: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #8: crashed: INFO: task hung in paste_selection
run #9: crashed: INFO: task hung in paste_selection
testing release v4.8
testing commit c8d2bc9bc39ebea8437fd974fdbc21847bb897a3 with gcc (GCC) 5.5.0
kernel signature: f6a2f4d3ef4978883ded7f492565a84b7e871bcf
all runs: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
testing release v4.7
testing commit 523d939ef98fd712632d93a5a2b588e477a7565e with gcc (GCC) 5.5.0
kernel signature: 9ceb2ba3346ca9b0f7f4c1cefe8810c3221e5a8f
run #0: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #1: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #2: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #3: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #4: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #5: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #6: OK
run #7: OK
run #8: OK
run #9: OK
testing release v4.6
testing commit 2dcd0af568b0cf583645c8a317dd12e344b1c72a with gcc (GCC) 5.5.0
kernel signature: 08da93c1faa4c8d5cdc25cfcb85c5c7174a223ce
run #0: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #1: crashed: KASAN: slab-out-of-bounds Read in n_tty_receive_buf_common
run #2: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #3: crashed: KASAN: slab-out-of-bounds Read in n_tty_receive_buf_common
run #4: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #5: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #6: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #7: crashed: KASAN: out-of-bounds Read in n_tty_receive_buf_common
run #8: crashed: KASAN: use-after-free Read in n_tty_receive_buf_common
run #9: OK
revisions tested: 21, total time: 4h35m0.878685767s (build: 1h53m8.855007176s, test: 2h39m37.000752367s)
the crash already happened on the oldest tested release
commit msg: Linux 4.6
crash: KASAN: use-after-free Read in n_tty_receive_buf_common
==================================================================
BUG: KASAN: use-after-free in n_tty_receive_buf_fast drivers/tty/n_tty.c:1575 [inline] at addr ffff8800b7a54580
BUG: KASAN: use-after-free in __receive_buf drivers/tty/n_tty.c:1613 [inline] at addr ffff8800b7a54580
BUG: KASAN: use-after-free in n_tty_receive_buf_common+0x2cf1/0x2d80 drivers/tty/n_tty.c:1711 at addr ffff8800b7a54580
Read of size 1 by task syz-executor.0/8720
CPU: 0 PID: 8720 Comm: syz-executor.0 Not tainted 4.6.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 1ffffffff0d9577e ffff8800af4f7698 ffffffff82c4dd46 0000000000000001
 ffff8800af4f7728 ffff8800b7a54580 ffff88012bc00100 ffff8800af4f7718
 ffffffff81740207 ffff8800af4f7840 ffffffff85b70879 0000000000000286
Call Trace:
 [<ffffffff82c4dd46>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff82c4dd46>] dump_stack+0xe6/0x120 lib/dump_stack.c:51
 [<ffffffff81740207>] object_err mm/kasan/report.c:139 [inline]
 [<ffffffff81740207>] print_address_description mm/kasan/report.c:179 [inline]
 [<ffffffff81740207>] kasan_report_error+0x1e7/0x5c0 mm/kasan/report.c:275
 [<ffffffff8174061e>] kasan_report mm/kasan/report.c:297 [inline]
 [<ffffffff8174061e>] __asan_report_load1_noabort+0x3e/0x40 mm/kasan/report.c:315
 [<ffffffff82f92e81>] n_tty_receive_buf_fast drivers/tty/n_tty.c:1575 [inline]
 [<ffffffff82f92e81>] __receive_buf drivers/tty/n_tty.c:1613 [inline]
 [<ffffffff82f92e81>] n_tty_receive_buf_common+0x2cf1/0x2d80 drivers/tty/n_tty.c:1711
 [<ffffffff82f92f1f>] n_tty_receive_buf2+0xf/0x20 drivers/tty/n_tty.c:1746
 [<ffffffff82f98933>] tty_ldisc_receive_buf+0x83/0x1e0 drivers/tty/tty_buffer.c:454
 [<ffffffff82fb9525>] paste_selection+0x245/0x390 drivers/tty/vt/selection.c:363
 [<ffffffff82fd5b49>] tioclinux+0xf9/0x360 drivers/tty/vt/vt.c:2684
 [<ffffffff82fb3aa7>] vt_ioctl+0x337/0x24e0 drivers/tty/vt/vt_ioctl.c:365
 [<ffffffff82f81da4>] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988
 [<ffffffff817d312f>] vfs_ioctl fs/ioctl.c:43 [inline]
 [<ffffffff817d312f>] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674
 [<ffffffff817d3e94>] SYSC_ioctl fs/ioctl.c:689 [inline]
 [<ffffffff817d3e94>] SyS_ioctl+0x74/0x80 fs/ioctl.c:680
 [<ffffffff85b6fe80>] entry_SYSCALL_64_fastpath+0x23/0xc1
Object at ffff8800b7a54580, in cache kmalloc-32
Object freed, allocated with size 3 bytes
Allocation:
PID = 8715
 [<ffffffff81205056>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67
 [<ffffffff8173f3e6>] save_stack+0x46/0xd0 mm/kasan/kasan.c:450
 [<ffffffff8173f7a9>] set_track mm/kasan/kasan.c:462 [inline]
 [<ffffffff8173f7a9>] kasan_kmalloc+0xc9/0xe0 mm/kasan/kasan.c:532
 [<ffffffff8173bb09>] __do_kmalloc mm/slab.c:3545 [inline]
 [<ffffffff8173bb09>] __kmalloc+0x169/0x6d0 mm/slab.c:3554
 [<ffffffff82fb8ae0>] kmalloc include/linux/slab.h:483 [inline]
 [<ffffffff82fb8ae0>] set_selection+0x4e0/0xce0 drivers/tty/vt/selection.c:298
 [<ffffffff82fd5b36>] tioclinux+0xe6/0x360 drivers/tty/vt/vt.c:2680
 [<ffffffff82fb3aa7>] vt_ioctl+0x337/0x24e0 drivers/tty/vt/vt_ioctl.c:365
 [<ffffffff82f81da4>] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988
 [<ffffffff817d312f>] vfs_ioctl fs/ioctl.c:43 [inline]
 [<ffffffff817d312f>] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674
 [<ffffffff817d3e94>] SYSC_ioctl fs/ioctl.c:689 [inline]
 [<ffffffff817d3e94>] SyS_ioctl+0x74/0x80 fs/ioctl.c:680
 [<ffffffff85b6fe80>] entry_SYSCALL_64_fastpath+0x23/0xc1
Deallocation:
PID = 8718
 [<ffffffff81205056>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67
 [<ffffffff8173f3e6>] save_stack+0x46/0xd0 mm/kasan/kasan.c:450
 [<ffffffff8173fc8b>] set_track mm/kasan/kasan.c:462 [inline]
 [<ffffffff8173fc8b>] kasan_slab_free+0x9b/0xb0 mm/kasan/kasan.c:501
 [<ffffffff81739f02>] __cache_free mm/slab.c:3332 [inline]
 [<ffffffff81739f02>] kfree+0xe2/0x460 mm/slab.c:3640
 [<ffffffff82fb8b05>] set_selection+0x505/0xce0 drivers/tty/vt/selection.c:304
 [<ffffffff82fd5b36>] tioclinux+0xe6/0x360 drivers/tty/vt/vt.c:2680
 [<ffffffff82fb3aa7>] vt_ioctl+0x337/0x24e0 drivers/tty/vt/vt_ioctl.c:365
 [<ffffffff82f81da4>] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988
 [<ffffffff817d312f>] vfs_ioctl fs/ioctl.c:43 [inline]
 [<ffffffff817d312f>] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674
 [<ffffffff817d3e94>] SYSC_ioctl fs/ioctl.c:689 [inline]
 [<ffffffff817d3e94>] SyS_ioctl+0x74/0x80 fs/ioctl.c:680
 [<ffffffff85b6fe80>] entry_SYSCALL_64_fastpath+0x23/0xc1
Memory state around the buggy address:
 ffff8800b7a54480: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
 ffff8800b7a54500: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
>ffff8800b7a54580: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
                   ^
 ffff8800b7a54600: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
 ffff8800b7a54680: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
==================================================================