==================================================================
BUG: KASAN: use-after-free in instrument_atomic_write include/linux/instrumented.h:71 [inline]
BUG: KASAN: use-after-free in atomic_inc include/asm-generic/atomic-instrumented.h:240 [inline]
BUG: KASAN: use-after-free in usb_anchor_suspend_wakeups drivers/usb/core/urb.c:891 [inline]
BUG: KASAN: use-after-free in usb_anchor_suspend_wakeups+0x1a/0x30 drivers/usb/core/urb.c:888
Write of size 4 at addr ffff8881e3923110 by task swapper/0/0
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.8.0-rc1-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x7c/0xb0 lib/dump_stack.c:118
print_address_description.constprop.8.cold.10+0x9/0x455 mm/kasan/report.c:383
__kasan_report mm/kasan/report.c:513 [inline]
kasan_report.cold.11+0x1f/0x37 mm/kasan/report.c:530
check_memory_region_inline mm/kasan/generic.c:186 [inline]
check_memory_region+0x1c1/0x1e0 mm/kasan/generic.c:192
instrument_atomic_write include/linux/instrumented.h:71 [inline]
atomic_inc include/asm-generic/atomic-instrumented.h:240 [inline]
usb_anchor_suspend_wakeups drivers/usb/core/urb.c:891 [inline]
usb_anchor_suspend_wakeups+0x1a/0x30 drivers/usb/core/urb.c:888
__usb_hcd_giveback_urb+0x14e/0x3e0 drivers/usb/core/hcd.c:1642
dummy_timer+0xfe6/0x2c1c drivers/usb/gadget/udc/dummy_hcd.c:1967
call_timer_fn+0x165/0x400 kernel/time/timer.c:1404
expire_timers kernel/time/timer.c:1449 [inline]
__run_timers kernel/time/timer.c:1773 [inline]
__run_timers kernel/time/timer.c:1740 [inline]
run_timer_softirq+0x555/0xf90 kernel/time/timer.c:1786
__do_softirq+0x19b/0x625 kernel/softirq.c:292
asm_call_on_stack+0xf/0x20 arch/x86/entry/entry_64.S:711
__run_on_irqstack arch/x86/include/asm/irq_stack.h:22 [inline]
run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:48 [inline]
do_softirq_own_stack+0x34/0x40 arch/x86/kernel/irq_64.c:77
invoke_softirq kernel/softirq.c:387 [inline]
__irq_exit_rcu kernel/softirq.c:417 [inline]
irq_exit_rcu+0x110/0x130 kernel/softirq.c:429
sysvec_apic_timer_interrupt+0x52/0xb0 arch/x86/kernel/apic/apic.c:1091
asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:596
RIP: 0010:native_irq_disable arch/x86/include/asm/irqflags.h:49 [inline]
RIP: 0010:arch_local_irq_disable arch/x86/include/asm/irqflags.h:89 [inline]
RIP: 0010:acpi_safe_halt drivers/acpi/processor_idle.c:112 [inline]
RIP: 0010:acpi_safe_halt+0x43/0x50 drivers/acpi/processor_idle.c:108
Code: da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 75 18 48 8b 03 a8 08 75 0f e9 07 00 00 00 0f 00 2d 2f 43 84 00 fb f4 5b c3 48 89 df e8 12 c4 7b fd eb de 48 b8 00 00 00 00 00 fc ff
RSP: 0018:ffffffff85207c78 EFLAGS: 00000246
RAX: 0000000000004000 RBX: ffffffff8522fd40 RCX: ffffffff84017567
RDX: 1ffffffff0a45fa8 RSI: 0000000000000008 RDI: ffffffff8522fd40
RBP: ffff8881f0ffa064 R08: fffffbfff0a45fa9 R09: fffffbfff0a45fa9
R10: ffffffff8522fd47 R11: fffffbfff0a45fa8 R12: 1ffffffff0a40f95
R13: ffff8881f0ffa270 R14: 0000000000000001 R15: 0000000000000001
acpi_idle_enter+0x3b5/0xb50 drivers/acpi/processor_idle.c:651
cpuidle_enter_state+0xac/0x9e0 drivers/cpuidle/cpuidle.c:234
cpuidle_enter+0x45/0xa0 drivers/cpuidle/cpuidle.c:345
cpuidle_idle_call kernel/sched/idle.c:207 [inline]
do_idle+0x31f/0x390 kernel/sched/idle.c:269
cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:365
start_kernel+0x517/0x558 init/main.c:1043
secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:243
Allocated by task 4153:
save_stack+0x19/0x40 mm/kasan/common.c:48
set_track mm/kasan/common.c:56 [inline]
__kasan_kmalloc mm/kasan/common.c:494 [inline]
__kasan_kmalloc.constprop.16+0xc1/0xd0 mm/kasan/common.c:467
kmalloc include/linux/slab.h:555 [inline]
kzalloc include/linux/slab.h:669 [inline]
usbtmc_open+0x9c/0x930 drivers/usb/class/usbtmc.c:175
usb_open+0x1b3/0x240 drivers/usb/core/file.c:48
chrdev_open+0x1d8/0x4e0 fs/char_dev.c:414
do_dentry_open+0x439/0xf70 fs/open.c:828
do_open fs/namei.c:3243 [inline]
path_openat+0x1712/0x21b0 fs/namei.c:3360
do_filp_open+0x171/0x240 fs/namei.c:3387
do_sys_openat2+0x2db/0x500 fs/open.c:1179
do_sys_open+0x85/0xd0 fs/open.c:1195
do_syscall_64+0x41/0x80 arch/x86/entry/common.c:359
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Freed by task 4153:
save_stack+0x19/0x40 mm/kasan/common.c:48
set_track mm/kasan/common.c:56 [inline]
kasan_set_free_info mm/kasan/common.c:316 [inline]
__kasan_slab_free+0x124/0x170 mm/kasan/common.c:455
slab_free_hook mm/slub.c:1474 [inline]
slab_free_freelist_hook mm/slub.c:1507 [inline]
slab_free mm/slub.c:3072 [inline]
kfree+0xd3/0x2e0 mm/slub.c:4063
usbtmc_release+0x22f/0x300 drivers/usb/class/usbtmc.c:261
__fput+0x206/0x6a0 fs/file_table.c:281
task_work_run+0xba/0x140 kernel/task_work.c:123
tracehook_notify_resume include/linux/tracehook.h:188 [inline]
exit_to_usermode_loop arch/x86/entry/common.c:216 [inline]
__prepare_exit_to_usermode+0x14a/0x150 arch/x86/entry/common.c:246
do_syscall_64+0x4d/0x80 arch/x86/entry/common.c:368
entry_SYSCALL_64_after_hwframe+0x44/0xa9
The buggy address belongs to the object at ffff8881e3923000
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 272 bytes inside of
1024-byte region [ffff8881e3923000, ffff8881e3923400)
The buggy address belongs to the page:
page:ffffea00078e4800 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 head:ffffea00078e4800 order:3 compound_mapcount:0 compound_pincount:0
flags: 0x200000000010200(slab|head)
raw: 0200000000010200 ffffea0007895400 0000000400000003 ffff8881f6002280
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL)
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook mm/page_alloc.c:2218 [inline]
prep_new_page+0x21e/0x320 mm/page_alloc.c:2224
get_page_from_freelist+0x111d/0x4f00 mm/page_alloc.c:3794
__alloc_pages_nodemask+0x278/0x710 mm/page_alloc.c:4844
alloc_pages include/linux/gfp.h:545 [inline]
alloc_slab_page+0x2cf/0x4e0 mm/slub.c:1545
allocate_slab mm/slub.c:1690 [inline]
new_slab+0x81/0x3d0 mm/slub.c:1756
new_slab_objects mm/slub.c:2513 [inline]
___slab_alloc+0x58b/0x860 mm/slub.c:2674
__slab_alloc+0x9/0x10 mm/slub.c:2714
slab_alloc_node mm/slub.c:2788 [inline]
__kmalloc_node_track_caller+0xc5/0x340 mm/slub.c:4472
__kmalloc_reserve.isra.57+0x29/0xa0 net/core/skbuff.c:142
__alloc_skb+0xbd/0x510 net/core/skbuff.c:210
alloc_skb include/linux/skbuff.h:1083 [inline]
nlmsg_new include/net/netlink.h:940 [inline]
inet6_rt_notify+0xd2/0x260 net/ipv6/route.c:6009
fib6_del_route net/ipv6/ip6_fib.c:1987 [inline]
fib6_del+0x798/0xf20 net/ipv6/ip6_fib.c:2017
fib6_clean_node+0x29d/0x420 net/ipv6/ip6_fib.c:2179
fib6_walk_continue+0x217/0x3e0 net/ipv6/ip6_fib.c:2101
fib6_walk+0x8b/0xd0 net/ipv6/ip6_fib.c:2149
fib6_clean_tree+0x9d/0xd0 net/ipv6/ip6_fib.c:2229
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1213 [inline]
__free_pages_ok+0x617/0xcb0 mm/page_alloc.c:1470
unfreeze_partials.isra.75+0x267/0x2d0 mm/slub.c:2294
put_cpu_partial+0x87/0xd0 mm/slub.c:2330
qlink_free mm/kasan/quarantine.c:148 [inline]
qlist_free_all+0x47/0xb0 mm/kasan/quarantine.c:167
quarantine_reduce+0x136/0x170 mm/kasan/quarantine.c:260
__kasan_kmalloc.constprop.16+0x98/0xd0 mm/kasan/common.c:475
slab_post_alloc_hook mm/slab.h:586 [inline]
slab_alloc_node mm/slub.c:2824 [inline]
slab_alloc mm/slub.c:2832 [inline]
kmem_cache_alloc+0xc9/0x230 mm/slub.c:2837
getname_flags fs/namei.c:138 [inline]
getname_flags+0xb5/0x510 fs/namei.c:128
getname fs/namei.c:209 [inline]
do_renameat2+0x142/0x940 fs/namei.c:4368
__do_sys_rename fs/namei.c:4496 [inline]
__se_sys_rename fs/namei.c:4494 [inline]
__x64_sys_rename+0x55/0x80 fs/namei.c:4494
do_syscall_64+0x41/0x80 arch/x86/entry/common.c:359
entry_SYSCALL_64_after_hwframe+0x44/0xa9
Memory state around the buggy address:
ffff8881e3923000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881e3923080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8881e3923100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881e3923180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881e3923200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
7: fc ff df
a: 48 c1 ea 03 shr $0x3,%rdx
e: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
12: 75 18 jne 0x2c
14: 48 8b 03 mov (%rbx),%rax
17: a8 08 test $0x8,%al
19: 75 0f jne 0x2a
1b: e9 07 00 00 00 jmp 0x27
20: 0f 00 2d 2f 43 84 00 verw 0x84432f(%rip) # 0x844356
27: fb sti
28: f4 hlt
* 29: fa cli <-- trapping instruction
2a: 5b pop %rbx
2b: c3 ret
2c: 48 89 df mov %rbx,%rdi
2f: e8 12 c4 7b fd call 0xfd7bc446
34: eb de jmp 0x14
36: 48 rex.W
37: b8 00 00 00 00 mov $0x0,%eax
3c: 00 fc add %bh,%ah
3e: ff .byte 0xff