[ 469.580635] devpts: called with bogus options [ 469.588275] devpts: called with bogus options [ 469.596381] devpts: called with bogus options [ 469.631234] devpts: called with bogus options [ 469.634413] devpts: called with bogus options [ 469.700967] devpts: called with bogus options [ 469.706130] devpts: called with bogus options [ 469.714937] devpts: called with bogus options [ 469.728149] devpts: called with bogus options [ 469.736916] devpts: called with bogus options [ 469.750383] devpts: called with bogus options [ 469.787112] devpts: called with bogus options [ 469.801512] devpts: called with bogus options [ 469.813954] devpts: called with bogus options [ 469.827132] devpts: called with bogus options [ 469.834824] devpts: called with bogus options [ 469.846782] devpts: called with bogus options [ 469.889789] devpts: called with bogus options [ 469.925154] devpts: called with bogus options [ 469.925682] devpts: called with bogus options [ 469.969441] devpts: called with bogus options [ 469.979716] devpts: called with bogus options [ 469.981994] devpts: called with bogus options [ 469.989468] devpts: called with bogus options [ 470.009147] devpts: called with bogus options [ 470.042436] devpts: called with bogus options [ 470.067922] devpts: called with bogus options [ 470.122921] devpts: called with bogus options [ 470.139246] devpts: called with bogus options [ 470.144669] devpts: called with bogus options [ 470.149846] devpts: called with bogus options [ 470.157159] devpts: called with bogus options [ 470.210937] devpts: called with bogus options [ 470.228785] devpts: called with bogus options [ 470.235727] devpts: called with bogus options [ 470.245686] devpts: called with bogus options [ 470.283190] devpts: called with bogus options [ 470.288815] devpts: called with bogus options [ 470.302849] devpts: called with bogus options [ 470.325126] devpts: called with bogus options [ 470.343398] devpts: called with bogus options [ 470.345340] devpts: called with bogus options [ 470.368683] devpts: called with bogus options [ 470.392572] devpts: called with bogus options [ 470.411749] devpts: called with bogus options [ 470.421071] devpts: called with bogus options [ 470.437996] devpts: called with bogus options [ 470.477259] devpts: called with bogus options [ 470.492266] devpts: called with bogus options [ 470.529964] devpts: called with bogus options [ 470.530590] devpts: called with bogus options [ 470.562593] devpts: called with bogus options [ 470.568164] devpts: called with bogus options [ 470.573194] devpts: called with bogus options [ 470.638973] devpts: called with bogus options [ 470.643305] devpts: called with bogus options [ 470.663572] devpts: called with bogus options [ 470.678238] devpts: called with bogus options [ 470.685154] devpts: called with bogus options [ 471.448713] device bridge_slave_1 left promiscuous mode [ 471.454558] bridge0: port 2(bridge_slave_1) entered disabled state [ 471.510242] device bridge_slave_0 left promiscuous mode [ 471.515721] bridge0: port 1(bridge_slave_0) entered disabled state [ 471.639079] device hsr_slave_1 left promiscuous mode [ 471.689949] device hsr_slave_0 left promiscuous mode [ 471.731774] team0 (unregistering): Port device team_slave_1 removed [ 471.741195] team0 (unregistering): Port device team_slave_0 removed [ 471.752131] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 471.799077] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 471.872422] bond0 (unregistering): Released all slaves [ 473.999250] device bridge_slave_1 left promiscuous mode [ 474.004779] bridge0: port 2(bridge_slave_1) entered disabled state [ 474.046935] device bridge_slave_0 left promiscuous mode [ 474.052391] bridge0: port 1(bridge_slave_0) entered disabled state [ 474.087610] device bridge_slave_1 left promiscuous mode [ 474.093049] bridge0: port 2(bridge_slave_1) entered disabled state [ 474.126987] device bridge_slave_0 left promiscuous mode [ 474.132501] bridge0: port 1(bridge_slave_0) entered disabled state [ 474.177345] device bridge_slave_1 left promiscuous mode [ 474.182792] bridge0: port 2(bridge_slave_1) entered disabled state [ 474.236754] device bridge_slave_0 left promiscuous mode [ 474.242213] bridge0: port 1(bridge_slave_0) entered disabled state [ 474.307728] device bridge_slave_1 left promiscuous mode [ 474.313340] bridge0: port 2(bridge_slave_1) entered disabled state [ 474.357196] device bridge_slave_0 left promiscuous mode [ 474.362650] bridge0: port 1(bridge_slave_0) entered disabled state [ 474.437140] device bridge_slave_1 left promiscuous mode [ 474.442601] bridge0: port 2(bridge_slave_1) entered disabled state [ 474.496741] device bridge_slave_0 left promiscuous mode [ 474.502273] bridge0: port 1(bridge_slave_0) entered disabled state [ 474.718060] device hsr_slave_1 left promiscuous mode [ 474.758535] device hsr_slave_0 left promiscuous mode [ 474.798913] team0 (unregistering): Port device team_slave_1 removed [ 474.808785] team0 (unregistering): Port device team_slave_0 removed [ 474.818160] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 474.859221] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 474.959311] bond0 (unregistering): Released all slaves [ 475.059375] device hsr_slave_1 left promiscuous mode [ 475.120533] device hsr_slave_0 left promiscuous mode [ 475.159911] team0 (unregistering): Port device team_slave_1 removed [ 475.169027] team0 (unregistering): Port device team_slave_0 removed [ 475.178267] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 475.219108] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 475.296784] bond0 (unregistering): Released all slaves [ 475.397661] device hsr_slave_1 left promiscuous mode [ 475.438384] device hsr_slave_0 left promiscuous mode [ 475.510700] team0 (unregistering): Port device team_slave_1 removed [ 475.519875] team0 (unregistering): Port device team_slave_0 removed [ 475.530022] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 475.559204] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 475.636467] bond0 (unregistering): Released all slaves [ 475.748349] device hsr_slave_1 left promiscuous mode [ 475.789731] device hsr_slave_0 left promiscuous mode [ 475.829830] team0 (unregistering): Port device team_slave_1 removed [ 475.838993] team0 (unregistering): Port device team_slave_0 removed [ 475.848559] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 475.890423] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 475.967273] bond0 (unregistering): Released all slaves [ 476.077676] device hsr_slave_1 left promiscuous mode [ 476.129757] device hsr_slave_0 left promiscuous mode [ 476.170085] team0 (unregistering): Port device team_slave_1 removed [ 476.179080] team0 (unregistering): Port device team_slave_0 removed [ 476.188335] bond0 (unregistering): Releasing backup interface bond_slave_1 [ 476.220592] bond0 (unregistering): Releasing backup interface bond_slave_0 [ 476.297851] bond0 (unregistering): Released all slaves Warning: Permanently added '10.128.10.51' (ECDSA) to the list of known hosts. [ 476.514478] IPVS: ftp: loaded support on port[0] = 21 [ 476.515039] IPVS: ftp: loaded support on port[0] = 21 [ 476.528645] IPVS: ftp: loaded support on port[0] = 21 [ 476.529095] IPVS: ftp: loaded support on port[0] = 21 [ 476.543171] IPVS: ftp: loaded support on port[0] = 21 [ 476.545725] IPVS: ftp: loaded support on port[0] = 21 [ 476.636413] audit: type=1400 audit(1576319940.140:41): avc: denied { write } for pid=21657 comm="syz-executor103" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 476.689347] devpts: called with bogus options [ 476.700271] devpts: called with bogus options [ 476.721347] audit: type=1400 audit(1576319940.160:42): avc: denied { read } for pid=21657 comm="syz-executor103" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 [ 476.723760] devpts: called with bogus options [ 476.773259] devpts: called with bogus options [ 476.785205] devpts: called with bogus options [ 476.799730] devpts: called with bogus options [ 476.801489] devpts: called with bogus options [ 476.810931] devpts: called with bogus options [ 476.824272] devpts: called with bogus options [ 476.930087] devpts: called with bogus options [ 477.090017] devpts: called with bogus options [ 477.169664] devpts: called with bogus options [ 477.268554] devpts: called with bogus options [ 477.736336] devpts: called with bogus options [ 477.737030] devpts: called with bogus options [ 477.758178] devpts: called with bogus options [ 477.804330] devpts: called with bogus options [ 477.819408] devpts: called with bogus options [ 477.826851] devpts: called with bogus options [ 477.881900] devpts: called with bogus options [ 477.889748] devpts: called with bogus options [ 477.910832] devpts: called with bogus options [ 477.940612] devpts: called with bogus options [ 477.960687] devpts: called with bogus options [ 477.994067] devpts: called with bogus options [ 478.015022] devpts: called with bogus options [ 478.036397] devpts: called with bogus options [ 478.058515] devpts: called with bogus options [ 478.080858] devpts: called with bogus options [ 478.098433] devpts: called with bogus options [ 478.303657] devpts: called with bogus options [ 478.419820] devpts: called with bogus options [ 478.751559] devpts: called with bogus options [ 478.837033] devpts: called with bogus options [ 479.305428] devpts: called with bogus options [ 479.305429] devpts: called with bogus options [ 479.320404] devpts: called with bogus options [ 479.352184] devpts: called with bogus options [ 479.362877] devpts: called with bogus options [ 479.365669] devpts: called with bogus options [ 479.386374] devpts: called with bogus options [ 479.388343] devpts: called with bogus options [ 479.502942] devpts: called with bogus options [ 479.859844] devpts: called with bogus options [ 480.013128] devpts: called with bogus options [ 480.022266] devpts: called with bogus options [ 480.039581] devpts: called with bogus options [ 480.041620] devpts: called with bogus options [ 480.047667] devpts: called with bogus options [ 480.508573] devpts: called with bogus options [ 480.520110] devpts: called with bogus options [ 480.530897] devpts: called with bogus options [ 480.536154] devpts: called with bogus options [ 480.600432] devpts: called with bogus options [ 480.608170] devpts: called with bogus options [ 480.772303] devpts: called with bogus options [ 480.920286] devpts: called with bogus options [ 480.999364] devpts: called with bogus options [ 481.112562] devpts: called with bogus options [ 481.120015] devpts: called with bogus options [ 481.122796] devpts: called with bogus options [ 481.282550] devpts: called with bogus options [ 481.521913] devpts: called with bogus options [ 481.527336] devpts: called with bogus options [ 481.605442] devpts: called with bogus options [ 481.616933] devpts: called with bogus options [ 481.619519] devpts: called with bogus options [ 481.633468] devpts: called with bogus options [ 481.741552] devpts: called with bogus options [ 482.061671] devpts: called with bogus options [ 482.068446] devpts: called with bogus options [ 482.167854] devpts: called with bogus options [ 482.170212] devpts: called with bogus options [ 482.182700] devpts: called with bogus options [ 482.193230] devpts: called with bogus options [ 482.206630] devpts: called with bogus options [ 482.319904] devpts: called with bogus options [ 482.645118] devpts: called with bogus options [ 482.650879] devpts: called with bogus options [ 482.794348] devpts: called with bogus options [ 482.794366] devpts: called with bogus options [ 482.804331] devpts: called with bogus options [ 482.813634] devpts: called with bogus options [ 482.921954] devpts: called with bogus options [ 482.923727] devpts: called with bogus options [ 482.937450] devpts: called with bogus options [ 483.186151] devpts: called with bogus options [ 483.192668] devpts: called with bogus options [ 483.420544] devpts: called with bogus options [ 483.428082] devpts: called with bogus options [ 483.584260] devpts: called with bogus options [ 483.592655] devpts: called with bogus options [ 483.765724] devpts: called with bogus options [ 483.768295] devpts: called with bogus options [ 483.782982] devpts: called with bogus options [ 483.934113] devpts: called with bogus options [ 483.936327] devpts: called with bogus options [ 484.107306] devpts: called with bogus options [ 484.109762] devpts: called with bogus options [ 484.125123] devpts: called with bogus options [ 484.169736] devpts: called with bogus options [ 484.461249] devpts: called with bogus options [ 484.640542] devpts: called with bogus options [ 484.653738] devpts: called with bogus options [ 484.660266] devpts: called with bogus options [ 484.663460] devpts: called with bogus options [ 484.735598] devpts: called with bogus options [ 485.134656] devpts: called with bogus options [ 485.142294] devpts: called with bogus options [ 485.150086] devpts: called with bogus options [ 485.151057] devpts: called with bogus options [ 485.166985] devpts: called with bogus options [ 485.174825] devpts: called with bogus options [ 485.218096] ================================================================== [ 485.225697] BUG: KASAN: use-after-free in debugfs_remove+0xd3/0xf0 [ 485.225704] Read of size 8 at addr ffff88806e6bc640 by task kworker/0:1/14 [ 485.239003] [ 485.239010] CPU: 0 PID: 14 Comm: kworker/0:1 Not tainted 4.19.89-syzkaller #0 [ 485.239014] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 485.239072] Workqueue: events __blk_release_queue [ 485.247934] Call Trace: [ 485.247992] dump_stack+0x123/0x177 [ 485.248022] print_address_description.cold.8+0x9/0x1ff [ 485.262163] kasan_report.cold.9+0x242/0x309 [ 485.262182] ? debugfs_remove+0xd3/0xf0 [ 485.262190] __asan_report_load8_noabort+0x14/0x20 [ 485.262195] debugfs_remove+0xd3/0xf0 [ 485.262252] blk_trace_free+0x30/0x130 [ 485.262258] __blk_trace_remove+0x57/0x80 [ 485.268429] blk_trace_shutdown+0x54/0x70 [ 485.268436] __blk_release_queue+0x1f7/0x490 [ 485.268446] process_one_work+0x830/0x1670 [ 485.268459] ? pwq_dec_nr_in_flight+0x2c0/0x2c0 [ 485.268465] ? lock_acquire+0x173/0x3d0 [ 485.268472] ? kasan_check_write+0x14/0x20 [ 485.268478] ? do_raw_spin_lock+0xc1/0x230 [ 485.268487] worker_thread+0x85/0xb60 [ 485.268492] ? __kthread_parkme+0x47/0x190 [ 485.268503] kthread+0x324/0x3e0 [ 485.273977] kobject: 'loop0' (00000000fc331af2): fill_kobj_path: path = '/devices/virtual/block/loop0' [ 485.278224] ? process_one_work+0x1670/0x1670 [ 485.278229] ? kthread_cancel_delayed_work_sync+0x10/0x10 [ 485.278289] ret_from_fork+0x24/0x30 [ 485.278301] [ 485.282696] kobject: 'queue' (000000002536938f): kobject_add_internal: parent: 'loop0', set: '' [ 485.287153] Allocated by task 21897: [ 485.287163] save_stack+0x43/0xd0 [ 485.287167] kasan_kmalloc+0xc7/0xe0 [ 485.287171] kasan_slab_alloc+0x12/0x20 [ 485.287175] kmem_cache_alloc+0x12e/0x730 [ 485.287219] __d_alloc+0x28/0x9d0 [ 485.287223] d_alloc+0x42/0x220 [ 485.287227] d_alloc_parallel+0xf3/0x1750 [ 485.291584] kobject: 'mq' (00000000301f5ceb): kobject_add_internal: parent: 'loop0', set: '' [ 485.295021] __lookup_slow+0x18d/0x400 [ 485.295026] lookup_one_len+0x132/0x160 [ 485.295033] start_creating+0x91/0x190 [ 485.295037] __debugfs_create_file+0x37/0x390 [ 485.295042] debugfs_create_file+0x24/0x30 [ 485.299316] kobject: 'mq' (00000000301f5ceb): kobject_uevent_env [ 485.303288] do_blk_trace_setup+0x31e/0xa70 [ 485.303292] __blk_trace_setup+0xb4/0x130 [ 485.303297] blk_trace_ioctl+0x155/0x2a0 [ 485.303330] blkdev_ioctl+0x6ca/0x16d0 [ 485.303353] block_ioctl+0xd7/0x130 [ 485.307855] kobject: 'mq' (00000000301f5ceb): kobject_uevent_env: filter function caused the event to drop! [ 485.311930] do_vfs_ioctl+0x196/0x10c0 [ 485.311934] ksys_ioctl+0x62/0x90 [ 485.311937] __x64_sys_ioctl+0x6e/0xb0 [ 485.311943] do_syscall_64+0xd0/0x4e0 [ 485.311950] entry_SYSCALL_64_after_hwframe+0x49/0xbe [ 485.311952] [ 485.311955] Freed by task 9: [ 485.311961] save_stack+0x43/0xd0 [ 485.311965] __kasan_slab_free+0x102/0x150 [ 485.311969] kasan_slab_free+0xe/0x10 [ 485.311973] kmem_cache_free+0x83/0x290 [ 485.311977] __d_free+0x17/0x20 [ 485.311982] rcu_process_callbacks+0xbcd/0x19a0 [ 485.311988] __do_softirq+0x260/0x92d [ 485.316855] kobject: '0' (0000000074bdc5b8): kobject_add_internal: parent: 'mq', set: '' [ 485.320662] [ 485.320666] The buggy address belongs to the object at ffff88806e6bc600 [ 485.320666] which belongs to the cache dentry(97:syz1) of size 288 [ 485.320670] The buggy address is located 64 bytes inside of [ 485.320670] 288-byte region [ffff88806e6bc600, ffff88806e6bc720) [ 485.320673] The buggy address belongs to the page: [ 485.320678] page:ffffea0001b9af00 count:1 mapcount:0 mapping:ffff88808f872240 index:0x0 [ 485.320683] flags: 0x1fffc0000000100(slab) [ 485.320691] raw: 01fffc0000000100 ffffea0001b9c008 ffffea0001b9c348 ffff88808f872240 [ 485.320696] raw: 0000000000000000 ffff88806e6bc080 000000010000000b ffff8880a00540c0 [ 485.320698] page dumped because: kasan: bad access detected [ 485.320701] page->mem_cgroup:ffff8880a00540c0 [ 485.320703] [ 485.320706] Memory state around the buggy address: [ 485.320710] ffff88806e6bc500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 485.320714] ffff88806e6bc580: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 485.320717] >ffff88806e6bc600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 485.320720] ^ [ 485.325242] kobject: 'cpu0' (00000000d32c7373): kobject_add_internal: parent: '0', set: '' [ 485.329274] ffff88806e6bc680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 485.329278] ffff88806e6bc700: fb fb fb fb fc fc fc fc fc fc fc fc fb fb fb fb [ 485.329280] ================================================================== [ 485.329283] Disabling lock debugging due to kernel taint [ 485.333297] Kernel panic - not syncing: panic_on_warn set ... [ 485.333297] [ 485.337554] kobject: 'cpu1' (00000000c79408e4): kobject_add_internal: parent: '0', set: '' [ 485.340684] CPU: 0 PID: 14 Comm: kworker/0:1 Tainted: G B 4.19.89-syzkaller #0 [ 485.340687] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 485.340698] Workqueue: events __blk_release_queue [ 485.340701] Call Trace: [ 485.340709] dump_stack+0x123/0x177 [ 485.340718] panic+0x1cd/0x375 [ 485.351579] kobject: 'queue' (000000002536938f): kobject_uevent_env [ 485.354608] ? __warn_printk+0xd6/0xd6 [ 485.354617] ? ___preempt_schedule+0x16/0x18 [ 485.354625] kasan_end_report+0x47/0x4f [ 485.354631] kasan_report.cold.9+0x76/0x309 [ 485.360227] kobject: 'queue' (000000002536938f): kobject_uevent_env: filter function caused the event to drop! [ 485.363834] ? debugfs_remove+0xd3/0xf0 [ 485.363841] __asan_report_load8_noabort+0x14/0x20 [ 485.363845] debugfs_remove+0xd3/0xf0 [ 485.363852] blk_trace_free+0x30/0x130 [ 485.363857] __blk_trace_remove+0x57/0x80 [ 485.365547] kobject: 'iosched' (00000000a86fdea9): kobject_add_internal: parent: 'queue', set: '' [ 485.374798] blk_trace_shutdown+0x54/0x70 [ 485.374804] __blk_release_queue+0x1f7/0x490 [ 485.374811] process_one_work+0x830/0x1670 [ 485.374818] ? pwq_dec_nr_in_flight+0x2c0/0x2c0 [ 485.374823] ? lock_acquire+0x173/0x3d0 [ 485.374829] ? kasan_check_write+0x14/0x20 [ 485.374835] ? do_raw_spin_lock+0xc1/0x230 [ 485.374841] worker_thread+0x85/0xb60 [ 485.378672] kobject: 'iosched' (00000000a86fdea9): kobject_uevent_env [ 485.381957] ? __kthread_parkme+0x47/0x190 [ 485.381965] kthread+0x324/0x3e0 [ 485.381970] ? process_one_work+0x1670/0x1670 [ 485.381974] ? kthread_cancel_delayed_work_sync+0x10/0x10 [ 485.381980] ret_from_fork+0x24/0x30 [ 485.387003] Kernel Offset: disabled [ 485.847859] Rebooting in 86400 seconds..