bisecting fixing commit since c6db52a88798e5a0dfef80041ad4d33cc8cf04eb
building syzkaller on 2420d1bcbcd9f5d5893c1aab8096cce81721dac2
testing commit c6db52a88798e5a0dfef80041ad4d33cc8cf04eb with gcc (GCC) 8.4.1 20210217
kernel signature: b27336bf7347929ccc70d844a3676569e2b11128d81860fdb704261b528bd23d
run #0: crashed: KASAN: use-after-free Read in tasklet_action
run #1: crashed: KASAN: use-after-free Read in tasklet_action
run #2: crashed: KASAN: use-after-free Read in tasklet_action
run #3: crashed: KASAN: use-after-free Read in bcm_can_tx
run #4: crashed: KASAN: use-after-free Read in tasklet_action
run #5: crashed: KASAN: use-after-free Read in tasklet_action
run #6: crashed: KASAN: use-after-free Read in tasklet_action
run #7: crashed: KASAN: use-after-free Read in bcm_can_tx
run #8: crashed: KASAN: use-after-free Read in bcm_can_tx
run #9: crashed: KASAN: use-after-free Read in bcm_can_tx
run #10: crashed: KASAN: use-after-free Read in bcm_can_tx
run #11: crashed: KASAN: use-after-free Read in tasklet_action
run #12: crashed: KASAN: use-after-free Read in bcm_can_tx
run #13: crashed: KASAN: use-after-free Read in bcm_can_tx
run #14: crashed: KASAN: use-after-free Read in bcm_can_tx
run #15: crashed: KASAN: use-after-free Read in tasklet_action
run #16: crashed: KASAN: use-after-free Read in bcm_can_tx
run #17: crashed: KASAN: use-after-free Read in tasklet_action
run #18: crashed: KASAN: use-after-free Read in bcm_tx_start_timer
run #19: crashed: KASAN: use-after-free Read in bcm_can_tx
testing current HEAD cf256fbcbe347b7d0ff58fe2dfa382a156bd3694
testing commit cf256fbcbe347b7d0ff58fe2dfa382a156bd3694 with gcc (GCC) 8.4.1 20210217
kernel signature: 24b4fdbeda9999df3375a3bb31f32a90bc06e549f8577b699fb38c57ecdfee27
run #0: crashed: KASAN: use-after-free Read in bcm_can_tx
run #1: crashed: KASAN: use-after-free Read in tasklet_action
run #2: crashed: KASAN: use-after-free Read in bcm_can_tx
run #3: crashed: KASAN: use-after-free Read in tasklet_action
run #4: crashed: KASAN: use-after-free Read in lock_hrtimer_base
run #5: crashed: KASAN: use-after-free Read in bcm_can_tx
run #6: crashed: KASAN: use-after-free Read in bcm_can_tx
run #7: crashed: WARNING: ODEBUG bug in enqueue_hrtimer
run #8: crashed: WARNING: ODEBUG bug in bcm_remove_op
run #9: crashed: KASAN: use-after-free Read in bcm_can_tx
revisions tested: 2, total time: 33m45.469017872s (build: 15m33.239880113s, test: 17m31.804657098s)
the crash still happens on HEAD
commit msg: Linux 4.14.231
crash: KASAN: use-after-free Read in bcm_can_tx
==================================================================
BUG: KASAN: use-after-free in bcm_can_tx+0x5cc/0x6e0 net/can/bcm.c:304
Read of size 4 at addr ffff8881dc6cbc44 by task syz-executor.1/14074
CPU: 1 PID: 14074 Comm: syz-executor.1 Not tainted 4.14.231-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:17 [inline]
dump_stack+0x14b/0x1e7 lib/dump_stack.c:58
print_address_description.cold.6+0x9/0x1ca mm/kasan/report.c:252
kasan_report_error mm/kasan/report.c:351 [inline]
kasan_report mm/kasan/report.c:409 [inline]
kasan_report.cold.7+0x11a/0x2d3 mm/kasan/report.c:393
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:429
bcm_can_tx+0x5cc/0x6e0 net/can/bcm.c:304
bcm_tx_timeout_tsklet+0xed/0x260 net/can/bcm.c:422
tasklet_action+0x19e/0x360 kernel/softirq.c:513
__do_softirq+0x247/0x9a2 kernel/softirq.c:288
invoke_softirq kernel/softirq.c:368 [inline]
irq_exit+0x15f/0x1a0 kernel/softirq.c:409
exiting_irq arch/x86/include/asm/apic.h:638 [inline]
smp_apic_timer_interrupt+0x149/0x5d0 arch/x86/kernel/apic/apic.c:1106
apic_timer_interrupt+0x9a/0xa0 arch/x86/entry/entry_64.S:793
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:779 [inline]
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xaf/0xd0 kernel/locking/spinlock.c:192
RSP: 0018:ffff8881f33f73a8 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff10
RAX: dffffc0000000000 RBX: 0000000000000286 RCX: 0000000000000000
RDX: 1ffffffff0fe2bd1 RSI: 0000000000000001 RDI: 0000000000000286
RBP: ffff8881f33f73b8 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff89b68848
R13: ffffffff89b68848 R14: 0000000000000000 R15: dffffc0000000000
__debug_check_no_obj_freed lib/debugobjects.c:760 [inline]
debug_check_no_obj_freed+0x2d5/0x890 lib/debugobjects.c:776
free_pages_prepare mm/page_alloc.c:1064 [inline]
__free_pages_ok+0x20f/0xe50 mm/page_alloc.c:1262
free_compound_page+0x5e/0x70 mm/page_alloc.c:600
free_transhuge_page+0x1d9/0x290 mm/huge_memory.c:2735
__put_compound_page+0x67/0xa0 mm/swap.c:95
release_pages+0x777/0xd70 mm/swap.c:788
free_pages_and_swap_cache+0x138/0x200 mm/swap_state.c:323
tlb_flush_mmu_free+0xb3/0x150 mm/memory.c:272
zap_pte_range mm/memory.c:1421 [inline]
zap_pmd_range mm/memory.c:1456 [inline]
zap_pud_range mm/memory.c:1485 [inline]
zap_p4d_range mm/memory.c:1506 [inline]
unmap_page_range+0x1397/0x1d10 mm/memory.c:1527
unmap_single_vma+0x121/0x300 mm/memory.c:1572
unmap_vmas+0xe2/0x190 mm/memory.c:1602
exit_mmap+0x242/0x460 mm/mmap.c:3058
__mmput kernel/fork.c:930 [inline]
mmput kernel/fork.c:951 [inline]
mmput+0xe6/0x360 kernel/fork.c:946
exit_mm kernel/exit.c:548 [inline]
do_exit+0x8ee/0x2c90 kernel/exit.c:855
do_group_exit+0xf8/0x2c0 kernel/exit.c:965
get_signal+0x2f6/0x1a90 kernel/signal.c:2423
do_signal+0x7f/0x18b0 arch/x86/kernel/signal.c:792
exit_to_usermode_loop+0x11e/0x190 arch/x86/entry/common.c:160
prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline]
syscall_return_slowpath arch/x86/entry/common.c:270 [inline]
do_syscall_64+0x416/0x5b0 arch/x86/entry/common.c:297
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x464319
RSP: 002b:00007f21906f2218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 000000000055bf08 RCX: 0000000000464319
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000055bf08
RBP: 000000000055bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000055bf0c
R13: 00007ffe715a32bf R14: 00007f21906f2300 R15: 0000000000022000
Allocated by task 14075:
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
save_stack mm/kasan/kasan.c:447 [inline]
set_track mm/kasan/kasan.c:459 [inline]
kasan_kmalloc.part.1+0x62/0xf0 mm/kasan/kasan.c:551
kasan_kmalloc+0xaf/0xc0 mm/kasan/kasan.c:536
kmem_cache_alloc_trace+0x152/0x3f0 mm/slab.c:3618
kmalloc include/linux/slab.h:488 [inline]
kzalloc include/linux/slab.h:661 [inline]
bcm_tx_setup net/can/bcm.c:952 [inline]
bcm_sendmsg+0x1a3a/0x4680 net/can/bcm.c:1388
sock_sendmsg_nosec net/socket.c:646 [inline]
sock_sendmsg+0xac/0xf0 net/socket.c:656
___sys_sendmsg+0x625/0x920 net/socket.c:2062
__sys_sendmsg+0xc1/0x140 net/socket.c:2096
SYSC_sendmsg net/socket.c:2107 [inline]
SyS_sendmsg+0xd/0x20 net/socket.c:2103
do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
Freed by task 14070:
save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59
save_stack mm/kasan/kasan.c:447 [inline]
set_track mm/kasan/kasan.c:459 [inline]
kasan_slab_free+0xab/0x190 mm/kasan/kasan.c:524
__cache_free mm/slab.c:3496 [inline]
kfree+0xcc/0x270 mm/slab.c:3815
bcm_remove_op+0x1cd/0x240 net/can/bcm.c:781
bcm_release+0xe7/0x500 net/can/bcm.c:1540
__sock_release+0xc2/0x2a0 net/socket.c:602
sock_close+0x10/0x20 net/socket.c:1139
__fput+0x232/0x740 fs/file_table.c:210
____fput+0x9/0x10 fs/file_table.c:244
task_work_run+0xe5/0x170 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:191 [inline]
exit_to_usermode_loop+0x14a/0x190 arch/x86/entry/common.c:164
prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline]
syscall_return_slowpath arch/x86/entry/common.c:270 [inline]
do_syscall_64+0x416/0x5b0 arch/x86/entry/common.c:297
entry_SYSCALL_64_after_hwframe+0x46/0xbb
The buggy address belongs to the object at ffff8881dc6cbb00
which belongs to the cache kmalloc-1024 of size 1024
The buggy address is located 324 bytes inside of
1024-byte region [ffff8881dc6cbb00, ffff8881dc6cbf00)
The buggy address belongs to the page:
page:ffffea000771b280 count:1 mapcount:0 mapping:ffff8881dc6ca000 index:0x0 compound_mapcount: 0
flags: 0x17ffe0000008100(slab|head)
raw: 017ffe0000008100 ffff8881dc6ca000 0000000000000000 0000000100000007
raw: ffffea00078bf820 ffffea000780b4a0 ffff8881f6000ac0 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8881dc6cbb00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881dc6cbb80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8881dc6cbc00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881dc6cbc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881dc6cbd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
ODEBUG: activate not available (active state 0) object type: hrtimer hint: bcm_tx_timeout_handler+0x0/0x30 include/net/sock.h:2300
------------[ cut here ]------------
WARNING: CPU: 1 PID: 14074 at lib/debugobjects.c:290 debug_print_object.cold.8+0xa7/0xdb lib/debugobjects.c:287
Modules linked in:
CPU: 1 PID: 14074 Comm: syz-executor.1 Tainted: G B 4.14.231-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8881d95ba680 task.stack: ffff8881f33f0000
RIP: 0010:debug_print_object.cold.8+0xa7/0xdb lib/debugobjects.c:287
RSP: 0018:ffff8881f6707be8 EFLAGS: 00010082
RAX: 000000000000006a RBX: 0000000000000005 RCX: 0000000000000000
RDX: 000000000000006a RSI: ffffffff86cbeca0 RDI: ffffed103ece0f74
RBP: ffff8881f6707c10 R08: 0000000000000000 R09: 0000000000000000
R10: fffffbfff13434cb R11: dffffc0000000000 R12: ffffffff86cba540
R13: ffffffff85ab71b0 R14: 0000000000000000 R15: ffffffff89bbb3c8
FS: 0000000000000000(0000) GS:ffff8881f6700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000051a4b0 CR3: 0000000007e6a005 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
debug_object_activate+0x26d/0x4b0 lib/debugobjects.c:477
debug_hrtimer_activate kernel/time/hrtimer.c:401 [inline]
debug_activate kernel/time/hrtimer.c:447 [inline]
enqueue_hrtimer+0x1f/0x330 kernel/time/hrtimer.c:844
hrtimer_start_range_ns+0x4d5/0x1040 kernel/time/hrtimer.c:970
hrtimer_start include/linux/hrtimer.h:377 [inline]
bcm_tx_start_timer+0xd4/0x150 net/can/bcm.c:393
bcm_tx_timeout_tsklet+0x125/0x260 net/can/bcm.c:424
tasklet_action+0x19e/0x360 kernel/softirq.c:513
__do_softirq+0x247/0x9a2 kernel/softirq.c:288
invoke_softirq kernel/softirq.c:368 [inline]
irq_exit+0x15f/0x1a0 kernel/softirq.c:409
exiting_irq arch/x86/include/asm/apic.h:638 [inline]
smp_apic_timer_interrupt+0x149/0x5d0 arch/x86/kernel/apic/apic.c:1106
apic_timer_interrupt+0x9a/0xa0 arch/x86/entry/entry_64.S:793
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:779 [inline]
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xaf/0xd0 kernel/locking/spinlock.c:192
RSP: 0018:ffff8881f33f73a8 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff10
RAX: dffffc0000000000 RBX: 0000000000000286 RCX: 0000000000000000
RDX: 1ffffffff0fe2bd1 RSI: 0000000000000001 RDI: 0000000000000286
RBP: ffff8881f33f73b8 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff89b68848
R13: ffffffff89b68848 R14: 0000000000000000 R15: dffffc0000000000
__debug_check_no_obj_freed lib/debugobjects.c:760 [inline]
debug_check_no_obj_freed+0x2d5/0x890 lib/debugobjects.c:776
free_pages_prepare mm/page_alloc.c:1064 [inline]
__free_pages_ok+0x20f/0xe50 mm/page_alloc.c:1262
free_compound_page+0x5e/0x70 mm/page_alloc.c:600
free_transhuge_page+0x1d9/0x290 mm/huge_memory.c:2735
__put_compound_page+0x67/0xa0 mm/swap.c:95
release_pages+0x777/0xd70 mm/swap.c:788
free_pages_and_swap_cache+0x138/0x200 mm/swap_state.c:323
tlb_flush_mmu_free+0xb3/0x150 mm/memory.c:272
zap_pte_range mm/memory.c:1421 [inline]
zap_pmd_range mm/memory.c:1456 [inline]
zap_pud_range mm/memory.c:1485 [inline]
zap_p4d_range mm/memory.c:1506 [inline]
unmap_page_range+0x1397/0x1d10 mm/memory.c:1527
unmap_single_vma+0x121/0x300 mm/memory.c:1572
unmap_vmas+0xe2/0x190 mm/memory.c:1602
exit_mmap+0x242/0x460 mm/mmap.c:3058
__mmput kernel/fork.c:930 [inline]
mmput kernel/fork.c:951 [inline]
mmput+0xe6/0x360 kernel/fork.c:946
exit_mm kernel/exit.c:548 [inline]
do_exit+0x8ee/0x2c90 kernel/exit.c:855
do_group_exit+0xf8/0x2c0 kernel/exit.c:965
get_signal+0x2f6/0x1a90 kernel/signal.c:2423
do_signal+0x7f/0x18b0 arch/x86/kernel/signal.c:792
exit_to_usermode_loop+0x11e/0x190 arch/x86/entry/common.c:160
prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline]
syscall_return_slowpath arch/x86/entry/common.c:270 [inline]
do_syscall_64+0x416/0x5b0 arch/x86/entry/common.c:297
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x464319
RSP: 002b:00007f21906f2218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 000000000055bf08 RCX: 0000000000464319
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000055bf08
RBP: 000000000055bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000055bf0c
R13: 00007ffe715a32bf R14: 00007f21906f2300 R15: 0000000000022000
Code: 87 48 89 fa 48 c1 ea 03 80 3c 02 00 75 42 48 8b 14 dd e0 2c 04 87 4d 89 e9 4d 89 e0 44 89 f1 48 c7 c7 00 23 04 87 e8 18 82 f9 ff <0f> 0b e9 46 1f a8 fc 48 89 75 d8 e8 5a fe 28 fb 48 8b 75 d8 eb
---[ end trace 951d7d42a9aee83e ]---
ODEBUG: deactivate not available (active state 0) object type: hrtimer hint: bcm_tx_timeout_handler+0x0/0x30 include/net/sock.h:2300
------------[ cut here ]------------
WARNING: CPU: 1 PID: 14074 at lib/debugobjects.c:290 debug_print_object.cold.8+0xa7/0xdb lib/debugobjects.c:287
Modules linked in:
CPU: 1 PID: 14074 Comm: syz-executor.1 Tainted: G B W 4.14.231-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8881d95ba680 task.stack: ffff8881f33f0000
RIP: 0010:debug_print_object.cold.8+0xa7/0xdb lib/debugobjects.c:287
RSP: 0018:ffff8881f6707978 EFLAGS: 00010086
RAX: 000000000000006c RBX: 0000000000000005 RCX: 0000000000000000
RDX: 000000000000006c RSI: ffffffff87041ee0 RDI: ffffed103ece0f26
RBP: ffff8881f67079a0 R08: 0000000000000000 R09: 0000000000000000
R10: fffffbfff13434cb R11: dffffc0000000000 R12: ffffffff86cba540
R13: ffffffff85ab71b0 R14: 0000000000000000 R15: ffff8881f6707a50
FS: 0000000000000000(0000) GS:ffff8881f6700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000051a4b0 CR3: 0000000007e6a005 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
debug_object_deactivate lib/debugobjects.c:527 [inline]
debug_object_deactivate+0x1eb/0x300 lib/debugobjects.c:491
debug_hrtimer_deactivate kernel/time/hrtimer.c:406 [inline]
debug_deactivate kernel/time/hrtimer.c:453 [inline]
__run_hrtimer kernel/time/hrtimer.c:1193 [inline]
__hrtimer_run_queues+0x1ba/0xad0 kernel/time/hrtimer.c:1287
hrtimer_interrupt+0x1ae/0x600 kernel/time/hrtimer.c:1321
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1079 [inline]
smp_apic_timer_interrupt+0x11f/0x5d0 arch/x86/kernel/apic/apic.c:1104
apic_timer_interrupt+0x9a/0xa0 arch/x86/entry/entry_64.S:793
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:779 [inline]
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xaf/0xd0 kernel/locking/spinlock.c:192
RSP: 0018:ffff8881f6707d18 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff10
RAX: dffffc0000000000 RBX: 0000000000000286 RCX: ffffffff814cd43b
RDX: 1ffffffff0fe2bd1 RSI: 0000000000000001 RDI: 0000000000000286
RBP: ffff8881f6707d28 R08: 0000000000000000 R09: 0000000000000000
R10: ffffed1047fff009 R11: 00000042ed4a137a R12: ffff8881f6725b80
R13: 00000041632502f2 R14: 0000000000000000 R15: ffff8881f6725c40
unlock_hrtimer_base kernel/time/hrtimer.c:778 [inline]
hrtimer_start_range_ns+0x5b7/0x1040 kernel/time/hrtimer.c:985
hrtimer_start include/linux/hrtimer.h:377 [inline]
bcm_tx_start_timer+0xd4/0x150 net/can/bcm.c:393
bcm_tx_timeout_tsklet+0x125/0x260 net/can/bcm.c:424
tasklet_action+0x19e/0x360 kernel/softirq.c:513
__do_softirq+0x247/0x9a2 kernel/softirq.c:288
invoke_softirq kernel/softirq.c:368 [inline]
irq_exit+0x15f/0x1a0 kernel/softirq.c:409
exiting_irq arch/x86/include/asm/apic.h:638 [inline]
smp_apic_timer_interrupt+0x149/0x5d0 arch/x86/kernel/apic/apic.c:1106
apic_timer_interrupt+0x9a/0xa0 arch/x86/entry/entry_64.S:793
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:779 [inline]
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xaf/0xd0 kernel/locking/spinlock.c:192
RSP: 0018:ffff8881f33f73a8 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff10
RAX: dffffc0000000000 RBX: 0000000000000286 RCX: 0000000000000000
RDX: 1ffffffff0fe2bd1 RSI: 0000000000000001 RDI: 0000000000000286
RBP: ffff8881f33f73b8 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff89b68848
R13: ffffffff89b68848 R14: 0000000000000000 R15: dffffc0000000000
__debug_check_no_obj_freed lib/debugobjects.c:760 [inline]
debug_check_no_obj_freed+0x2d5/0x890 lib/debugobjects.c:776
free_pages_prepare mm/page_alloc.c:1064 [inline]
__free_pages_ok+0x20f/0xe50 mm/page_alloc.c:1262
free_compound_page+0x5e/0x70 mm/page_alloc.c:600
free_transhuge_page+0x1d9/0x290 mm/huge_memory.c:2735
__put_compound_page+0x67/0xa0 mm/swap.c:95
release_pages+0x777/0xd70 mm/swap.c:788
free_pages_and_swap_cache+0x138/0x200 mm/swap_state.c:323
tlb_flush_mmu_free+0xb3/0x150 mm/memory.c:272
zap_pte_range mm/memory.c:1421 [inline]
zap_pmd_range mm/memory.c:1456 [inline]
zap_pud_range mm/memory.c:1485 [inline]
zap_p4d_range mm/memory.c:1506 [inline]
unmap_page_range+0x1397/0x1d10 mm/memory.c:1527
unmap_single_vma+0x121/0x300 mm/memory.c:1572
unmap_vmas+0xe2/0x190 mm/memory.c:1602
exit_mmap+0x242/0x460 mm/mmap.c:3058
__mmput kernel/fork.c:930 [inline]
mmput kernel/fork.c:951 [inline]
mmput+0xe6/0x360 kernel/fork.c:946
exit_mm kernel/exit.c:548 [inline]
do_exit+0x8ee/0x2c90 kernel/exit.c:855
do_group_exit+0xf8/0x2c0 kernel/exit.c:965
get_signal+0x2f6/0x1a90 kernel/signal.c:2423
do_signal+0x7f/0x18b0 arch/x86/kernel/signal.c:792
exit_to_usermode_loop+0x11e/0x190 arch/x86/entry/common.c:160
prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline]
syscall_return_slowpath arch/x86/entry/common.c:270 [inline]
do_syscall_64+0x416/0x5b0 arch/x86/entry/common.c:297
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x464319
RSP: 002b:00007f21906f2218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 000000000055bf08 RCX: 0000000000464319
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000055bf08
RBP: 000000000055bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000055bf0c
R13: 00007ffe715a32bf R14: 00007f21906f2300 R15: 0000000000022000
Code: 87 48 89 fa 48 c1 ea 03 80 3c 02 00 75 42 48 8b 14 dd e0 2c 04 87 4d 89 e9 4d 89 e0 44 89 f1 48 c7 c7 00 23 04 87 e8 18 82 f9 ff <0f> 0b e9 46 1f a8 fc 48 89 75 d8 e8 5a fe 28 fb 48 8b 75 d8 eb
---[ end trace 951d7d42a9aee83f ]---
ODEBUG: activate not available (active state 0) object type: hrtimer hint: bcm_tx_timeout_handler+0x0/0x30 include/net/sock.h:2300
------------[ cut here ]------------
WARNING: CPU: 1 PID: 17 at lib/debugobjects.c:290 debug_print_object.cold.8+0xa7/0xdb lib/debugobjects.c:287
Modules linked in:
CPU: 1 PID: 17 Comm: ksoftirqd/1 Tainted: G B W 4.14.231-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8881f53f2480 task.stack: ffff8881f4c00000
RIP: 0010:debug_print_object.cold.8+0xa7/0xdb lib/debugobjects.c:287
RSP: 0018:ffff8881f4c07a88 EFLAGS: 00010082
RAX: 000000000000006a RBX: 0000000000000005 RCX: 0000000000000000
RDX: 000000000000006a RSI: ffffffff86cbeca0 RDI: ffffed103e980f48
RBP: ffff8881f4c07ab0 R08: 0000000000000000 R09: 0000000000000000
R10: fffffbfff13434cb R11: dffffc0000000000 R12: ffffffff86cba540
R13: ffffffff85ab71b0 R14: 0000000000000000 R15: ffffffff89bbb3c8
FS: 0000000000000000(0000) GS:ffff8881f6700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000051a4b0 CR3: 0000000007e6a005 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
debug_object_activate+0x26d/0x4b0 lib/debugobjects.c:477
debug_hrtimer_activate kernel/time/hrtimer.c:401 [inline]
debug_activate kernel/time/hrtimer.c:447 [inline]
enqueue_hrtimer+0x1f/0x330 kernel/time/hrtimer.c:844
hrtimer_start_range_ns+0x4d5/0x1040 kernel/time/hrtimer.c:970
hrtimer_start include/linux/hrtimer.h:377 [inline]
bcm_tx_start_timer+0xd4/0x150 net/can/bcm.c:393
bcm_tx_timeout_tsklet+0x125/0x260 net/can/bcm.c:424
tasklet_action+0x19e/0x360 kernel/softirq.c:513
__do_softirq+0x247/0x9a2 kernel/softirq.c:288
run_ksoftirqd+0x57/0x1a0 kernel/softirq.c:670
smpboot_thread_fn+0x553/0x850 kernel/smpboot.c:164
kthread+0x338/0x400 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
Code: 87 48 89 fa 48 c1 ea 03 80 3c 02 00 75 42 48 8b 14 dd e0 2c 04 87 4d 89 e9 4d 89 e0 44 89 f1 48 c7 c7 00 23 04 87 e8 18 82 f9 ff <0f> 0b e9 46 1f a8 fc 48 89 75 d8 e8 5a fe 28 fb 48 8b 75 d8 eb
---[ end trace 951d7d42a9aee840 ]---
ODEBUG: deactivate not available (active state 0) object type: hrtimer hint: bcm_tx_timeout_handler+0x0/0x30 include/net/sock.h:2300
------------[ cut here ]------------
WARNING: CPU: 1 PID: 17 at lib/debugobjects.c:290 debug_print_object.cold.8+0xa7/0xdb lib/debugobjects.c:287
Modules linked in:
CPU: 1 PID: 17 Comm: ksoftirqd/1 Tainted: G B W 4.14.231-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8881f53f2480 task.stack: ffff8881f4c00000
RIP: 0010:debug_print_object.cold.8+0xa7/0xdb lib/debugobjects.c:287
RSP: 0018:ffff8881f6707d08 EFLAGS: 00010086
RAX: 000000000000006c RBX: 0000000000000005 RCX: 0000000000000000
RDX: 000000000000006c RSI: ffffffff87041ee0 RDI: ffffed103ece0f98
RBP: ffff8881f6707d30 R08: 0000000000000000 R09: 0000000000000000
R10: fffffbfff13434cb R11: dffffc0000000000 R12: ffffffff86cba540
R13: ffffffff85ab71b0 R14: 0000000000000000 R15: ffff8881f6707de0
FS: 0000000000000000(0000) GS:ffff8881f6700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000051a4b0 CR3: 0000000007e6a005 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
debug_object_deactivate lib/debugobjects.c:527 [inline]
debug_object_deactivate+0x1eb/0x300 lib/debugobjects.c:491
debug_hrtimer_deactivate kernel/time/hrtimer.c:406 [inline]
debug_deactivate kernel/time/hrtimer.c:453 [inline]
__run_hrtimer kernel/time/hrtimer.c:1193 [inline]
__hrtimer_run_queues+0x1ba/0xad0 kernel/time/hrtimer.c:1287
hrtimer_interrupt+0x1ae/0x600 kernel/time/hrtimer.c:1321
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1079 [inline]
smp_apic_timer_interrupt+0x11f/0x5d0 arch/x86/kernel/apic/apic.c:1104
apic_timer_interrupt+0x9a/0xa0 arch/x86/entry/entry_64.S:793
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:779 [inline]
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xaf/0xd0 kernel/locking/spinlock.c:192
RSP: 0018:ffff8881f4c07bb0 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff10
RAX: dffffc0000000000 RBX: 0000000000000286 RCX: ffffffff814cd43b
RDX: 1ffffffff0fe2bd1 RSI: 0000000000000001 RDI: 0000000000000286
RBP: ffff8881f4c07bc0 R08: 0000000000000000 R09: 0000000000000000
R10: ffffed1047fff009 R11: 0000004320bac208 R12: ffff8881f6725b80
R13: 00000041a5392091 R14: 0000000000000000 R15: ffff8881f6725c40
unlock_hrtimer_base kernel/time/hrtimer.c:778 [inline]
hrtimer_start_range_ns+0x5b7/0x1040 kernel/time/hrtimer.c:985
hrtimer_start include/linux/hrtimer.h:377 [inline]
bcm_tx_start_timer+0xd4/0x150 net/can/bcm.c:393
bcm_tx_timeout_tsklet+0x125/0x260 net/can/bcm.c:424
tasklet_action+0x19e/0x360 kernel/softirq.c:513
__do_softirq+0x247/0x9a2 kernel/softirq.c:288
run_ksoftirqd+0x57/0x1a0 kernel/softirq.c:670
smpboot_thread_fn+0x553/0x850 kernel/smpboot.c:164
kthread+0x338/0x400 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
Code: 87 48 89 fa 48 c1 ea 03 80 3c 02 00 75 42 48 8b 14 dd e0 2c 04 87 4d 89 e9 4d 89 e0 44 89 f1 48 c7 c7 00 23 04 87 e8 18 82 f9 ff <0f> 0b e9 46 1f a8 fc 48 89 75 d8 e8 5a fe 28 fb 48 8b 75 d8 eb
---[ end trace 951d7d42a9aee841 ]---
ODEBUG: activate not available (active state 0) object type: hrtimer hint: bcm_tx_timeout_handler+0x0/0x30 include/net/sock.h:2300
------------[ cut here ]------------
WARNING: CPU: 1 PID: 18 at lib/debugobjects.c:290 debug_print_object.cold.8+0xa7/0xdb lib/debugobjects.c:287
Modules linked in:
CPU: 1 PID: 18 Comm: kworker/1:0 Tainted: G B W 4.14.231-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: events defense_work_handler
task: ffff8881f53f44c0 task.stack: ffff8881f4c08000
RIP: 0010:debug_print_object.cold.8+0xa7/0xdb lib/debugobjects.c:287
RSP: 0018:ffff8881f6707c38 EFLAGS: 00010082
RAX: 000000000000006a RBX: 0000000000000005 RCX: 0000000000000000
RDX: 000000000000006a RSI: ffffffff86cbeca0 RDI: ffffed103ece0f7e
RBP: ffff8881f6707c60 R08: 0000000000000000 R09: 0000000000000000
R10: fffffbfff13434cb R11: dffffc0000000000 R12: ffffffff86cba540
R13: ffffffff85ab71b0 R14: 0000000000000000 R15: ffffffff89bbb3c8
FS: 0000000000000000(0000) GS:ffff8881f6700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000051a4b0 CR3: 0000000007e6a005 CR4: 00000000001606e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
debug_object_activate+0x26d/0x4b0 lib/debugobjects.c:477
debug_hrtimer_activate kernel/time/hrtimer.c:401 [inline]
debug_activate kernel/time/hrtimer.c:447 [inline]
enqueue_hrtimer+0x1f/0x330 kernel/time/hrtimer.c:844
hrtimer_start_range_ns+0x4d5/0x1040 kernel/time/hrtimer.c:970
hrtimer_start include/linux/hrtimer.h:377 [inline]
bcm_tx_start_timer+0xd4/0x150 net/can/bcm.c:393
bcm_tx_timeout_tsklet+0x125/0x260 net/can/bcm.c:424
tasklet_action+0x19e/0x360 kernel/softirq.c:513
__do_softirq+0x247/0x9a2 kernel/softirq.c:288
do_softirq_own_stack+0x2a/0x40 arch/x86/entry/entry_64.S:1016
do_softirq kernel/softirq.c:332 [inline]
do_softirq+0xee/0x160 kernel/softirq.c:319
__local_bh_enable_ip+0x130/0x150 kernel/softirq.c:185
local_bh_enable include/linux/bottom_half.h:32 [inline]
update_defense_level+0x307/0xe00 net/netfilter/ipvs/ip_vs_ctl.c:215
defense_work_handler+0x19/0xb0 net/netfilter/ipvs/ip_vs_ctl.c:229
process_one_work+0x74f/0x1620 kernel/workqueue.c:2116
worker_thread+0xcc/0xee0 kernel/workqueue.c:2250
kthread+0x338/0x400 kernel/kthread.c:232
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404
Code: 87 48 89 fa 48 c1 ea 03 80 3c 02 00 75 42 48 8b 14 dd e0 2c 04 87 4d 89 e9 4d 89 e0 44 89 f1 48 c7 c7 00 23 04 87 e8 18 82 f9 ff <0f> 0b e9 46 1f a8 fc 48 89 75 d8 e8 5a fe 28 fb 48 8b 75 d8 eb
---[ end trace 951d7d42a9aee842 ]---
BUG: unable to handle kernel NULL pointer dereference at (null)
IP: (null)
PGD 1dc1a5067 P4D 1dc1a5067 PUD 1e2e27067 PMD 0
Oops: 0010 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 14669 Comm: syz-executor.1 Tainted: G B W 4.14.231-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8881db208400 task.stack: ffff8881e3008000
RIP: 0010: (null)
RSP: 0018:ffff8881f6607e18 EFLAGS: 00010086
RAX: 0000000000000000 RBX: ffff8881dc6cbb50 RCX: 0000000000000000
RDX: 0000000000000004 RSI: ffffffff88b28218 RDI: ffff8881dc6cbb50
RBP: ffff8881f6607f08 R08: 0000000000000000 R09: 0000000000000000
R10: ffffed1047fff001 R11: ffff8881db208400 R12: 0000000000000000
R13: ffff8881f6625b80 R14: dffffc0000000000 R15: ffff8881f6625b80
FS: 000000000262a400(0000) GS:ffff8881f6600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000001cf84d004 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__run_hrtimer kernel/time/hrtimer.c:1223 [inline]
__hrtimer_run_queues+0x279/0xad0 kernel/time/hrtimer.c:1287
hrtimer_interrupt+0x1ae/0x600 kernel/time/hrtimer.c:1321
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1079 [inline]
smp_apic_timer_interrupt+0x11f/0x5d0 arch/x86/kernel/apic/apic.c:1104
apic_timer_interrupt+0x9a/0xa0 arch/x86/entry/entry_64.S:793
RIP: 0010:recently_deleted fs/ext4/ialloc.c:709 [inline]
RIP: 0010:find_inode_bit.isra.1+0x262/0x4b0 fs/ext4/ialloc.c:733
RSP: 0018:ffff8881e300fa60 EFLAGS: 00000a03 ORIG_RAX: ffffffffffffff10
RAX: ffff8881caa3e000 RBX: dffffc0000000000 RCX: 0000000000000000
RDX: 1ffff11039547c02 RSI: ffffffff87041ee0 RDI: ffff8881caa3e014
RBP: ffff8881e300fac0 R08: 0000000000000000 R09: 0000000000000000
R10: 1ffffffff0fe2bd3 R11: ffffea00072a8f80 R12: ffff8881e4722240
R13: ffff8881e300fca8 R14: ffff8881c8cea348 R15: ffffed103c601f95
__ext4_new_inode+0xb93/0x47f0 fs/ext4/ialloc.c:925
ext4_symlink+0x2a8/0xb90 fs/ext4/namei.c:3174
vfs_symlink+0x2f8/0x520 fs/namei.c:4156
SYSC_symlinkat fs/namei.c:4183 [inline]
SyS_symlinkat+0x181/0x1c0 fs/namei.c:4163
SYSC_symlink fs/namei.c:4196 [inline]
SyS_symlink+0x11/0x20 fs/namei.c:4194
do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292
entry_SYSCALL_64_after_hwframe+0x46/0xbb
RIP: 0033:0x463cc7
RSP: 002b:00007ffe715a34e8 EFLAGS: 00000206 ORIG_RAX: 0000000000000058
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000463cc7
RDX: 00007ffe715a35b7 RSI: 00000000004ae03c RDI: 00007ffe715a35a0
RBP: 0000000000000001 R08: 0000000000000000 R09: 00007ffe715a3380
R10: 00007ffe715a3237 R11: 0000000000000206 R12: 00007ffe715a35a0
R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000001
Code: Bad RIP value.
RIP: (null) RSP: ffff8881f6607e18
CR2: 0000000000000000
---[ end trace 951d7d42a9aee843 ]---