BUG: KASAN: slab-use-after-free in __list_del_entry_valid_or_report+0x33/0x140 lib/list_debug.c:49
Read of size 8 at addr ffff888116a00a88 by task kworker/0:2/57
CPU: 0 UID: 0 PID: 57 Comm: kworker/0:2 Not tainted 6.12.0-rc1-syzkaller-g9852d85ec9d4 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: events binder_deferred_func
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x188/0x200 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x163/0x550 mm/kasan/report.c:488
kasan_report+0x14f/0x190 mm/kasan/report.c:601
__asan_report_load8_noabort+0x18/0x20 mm/kasan/report_generic.c:381
__list_del_entry_valid_or_report+0x33/0x140 lib/list_debug.c:49
__list_del_entry_valid include/linux/list.h:124 [inline]
__list_del_entry include/linux/list.h:215 [inline]
list_del_init include/linux/list.h:287 [inline]
binder_dequeue_work_head_ilocked drivers/android/binder.c:540 [inline]
binder_release_work+0xcc/0x4c0 drivers/android/binder.c:5110
binder_deferred_release drivers/android/binder.c:6261 [inline]
binder_deferred_func+0x1308/0x14e0 drivers/android/binder.c:6296
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0x766/0x1040 kernel/workqueue.c:3310
worker_thread+0x974/0xdc0 kernel/workqueue.c:3391
kthread+0x2e7/0x380 kernel/kthread.c:389
ret_from_fork+0x55/0x90 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Allocated by task 473:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_alloc_info+0x3c/0x50 mm/kasan/generic.c:565
poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
__kasan_kmalloc+0x9d/0xb0 mm/kasan/common.c:394
kasan_kmalloc include/linux/kasan.h:257 [inline]
__kmalloc_cache_noprof+0x17c/0x300 mm/slub.c:4296
kmalloc_noprof include/linux/slab.h:878 [inline]
kzalloc_noprof include/linux/slab.h:1014 [inline]
binder_request_freeze_notification drivers/android/binder.c:3855 [inline]
binder_thread_write drivers/android/binder.c:4485 [inline]
binder_ioctl_write_read+0xd3c/0xa890 drivers/android/binder.c:5387
binder_ioctl+0x3a2/0x1ab0 drivers/android/binder.c:5718
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:907 [inline]
__se_sys_ioctl+0x118/0x1a0 fs/ioctl.c:893
__x64_sys_ioctl+0x7f/0x90 fs/ioctl.c:893
x64_sys_call+0x15e4/0x2d80 arch/x86/include/generated/asm/syscalls_64.h:17
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x54/0xf0 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x76/0x7e
Freed by task 57:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x44/0x50 mm/kasan/generic.c:579
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x57/0x70 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:230 [inline]
slab_free_hook mm/slub.c:2343 [inline]
slab_free mm/slub.c:4580 [inline]
kfree+0x143/0x370 mm/slub.c:4728
binder_free_ref drivers/android/binder.c:1355 [inline]
binder_deferred_release drivers/android/binder.c:6256 [inline]
binder_deferred_func+0x1275/0x14e0 drivers/android/binder.c:6296
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0x766/0x1040 kernel/workqueue.c:3310
worker_thread+0x974/0xdc0 kernel/workqueue.c:3391
kthread+0x2e7/0x380 kernel/kthread.c:389
ret_from_fork+0x55/0x90 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
The buggy address belongs to the object at ffff888116a00a80
which belongs to the cache kmalloc-64 of size 64
The buggy address is located 8 bytes inside of
freed 64-byte region [ffff888116a00a80, ffff888116a00ac0)
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x116a00
flags: 0x4000000000000000(zone=1)
page_type: f5(slab)
raw: 4000000000000000 ffff8881000418c0 dead000000000122 0000000000000000
raw: 0000000000000000 0000000080200020 00000001f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 100, tgid 100 (udevd), ts 55882326083, free_ts 55878695710
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x234/0x260 mm/page_alloc.c:1537
prep_new_page mm/page_alloc.c:1545 [inline]
get_page_from_freelist+0x42b5/0x4340 mm/page_alloc.c:3457
__alloc_pages_noprof+0x3e6/0x8a0 mm/page_alloc.c:4733
allocate_slab+0xbb/0x4a0 mm/slub.c:2579
new_slab mm/slub.c:2632 [inline]
___slab_alloc+0x7ce/0xce0 mm/slub.c:3819
__slab_alloc+0x5d/0xb0 mm/slub.c:3909
__slab_alloc_node mm/slub.c:3962 [inline]
slab_alloc_node mm/slub.c:4123 [inline]
__do_kmalloc_node mm/slub.c:4264 [inline]
__kmalloc_noprof+0x221/0x420 mm/slub.c:4277
kmalloc_noprof include/linux/slab.h:882 [inline]
kmalloc_array_noprof include/linux/slab.h:923 [inline]
security_inode_init_security+0x127/0x4a0 security/security.c:1823
shmem_mknod+0xd2/0x200 mm/shmem.c:3580
shmem_create+0x38/0x50 mm/shmem.c:3644
lookup_open fs/namei.c:3595 [inline]
open_last_lookups fs/namei.c:3694 [inline]
path_openat+0x1c15/0x3540 fs/namei.c:3930
do_filp_open+0x235/0x490 fs/namei.c:3960
do_sys_openat2+0x13e/0x1d0 fs/open.c:1415
do_sys_open fs/open.c:1430 [inline]
__do_sys_openat fs/open.c:1446 [inline]
__se_sys_openat fs/open.c:1441 [inline]
__x64_sys_openat+0x247/0x2a0 fs/open.c:1441
x64_sys_call+0x1031/0x2d80 arch/x86/include/generated/asm/syscalls_64.h:258
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x54/0xf0 arch/x86/entry/common.c:83
page last free pid 468 tgid 468 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1108 [inline]
free_unref_page+0x8c1/0x950 mm/page_alloc.c:2638
__free_pages+0x5f/0xe0 mm/page_alloc.c:4820
__free_slab+0xc8/0x110 mm/slub.c:2649
free_slab+0x24/0xe0 mm/slub.c:2672
discard_slab mm/slub.c:2678 [inline]
__put_partials+0x115/0x130 mm/slub.c:3146
put_cpu_partial+0xa9/0x100 mm/slub.c:3221
__slab_free+0x24f/0x310 mm/slub.c:4450
do_slab_free mm/slub.c:4532 [inline]
___cache_free+0xd5/0xf0 mm/slub.c:4638
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0xb7/0x130 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x154/0x180 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x28/0x80 mm/kasan/common.c:329
kasan_slab_alloc include/linux/kasan.h:247 [inline]
slab_post_alloc_hook mm/slub.c:4086 [inline]
slab_alloc_node mm/slub.c:4135 [inline]
__kmalloc_cache_node_noprof+0x12c/0x310 mm/slub.c:4304
kmalloc_node_noprof include/linux/slab.h:901 [inline]
__get_vm_area_node+0x119/0x260 mm/vmalloc.c:3106
__vmalloc_node_range_noprof+0x2f5/0x1470 mm/vmalloc.c:3788
__vmalloc_node_noprof mm/vmalloc.c:3893 [inline]
vzalloc_noprof+0x7c/0x90 mm/vmalloc.c:3966
alloc_counters+0x69/0x4a0 net/ipv4/netfilter/arp_tables.c:660
Memory state around the buggy address:
ffff888116a00980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888116a00a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888116a00a80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
^
ffff888116a00b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888116a00b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Oops: general protection fault, probably for non-canonical address 0xe04c7c3360000007: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: maybe wild-memory-access in range [0x0264019b00000038-0x0264019b0000003f]
CPU: 0 UID: 0 PID: 57 Comm: kworker/0:2 Tainted: G B 6.12.0-rc1-syzkaller-g9852d85ec9d4 #0
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Workqueue: events binder_deferred_func
RIP: 0010:__list_del_entry_valid_or_report+0x7d/0x140 lib/list_debug.c:62
Code: 74 70 48 85 db 74 7c 48 ba 00 01 00 00 00 00 ad de 49 39 d6 74 7e 48 83 c2 22 48 39 d3 0f 84 82 00 00 00 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 74 18 3c ff 48 8b 13 4c 39 fa 75
RSP: 0018:ffffc900008d7b80 EFLAGS: 00010202
RAX: 004c803360000007 RBX: 0264019b00000039 RCX: ffffffff82979b8d
RDX: dead000000000122 RSI: 0000000000000008 RDI: ffff888116a00a80
RBP: ffffc900008d7ba0 R08: ffffffff8147d897 R09: 1ffffffff0fe5330
R10: fffffbfff0fe5331 R11: fffffbfff0fe5331 R12: dffffc0000000000
R13: ffff888116a00a80 R14: ffff888115f2a100 R15: ffff888116a00a80
FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b30f5ffff CR3: 000000011628e000 CR4: 00000000003526b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
__list_del_entry_valid include/linux/list.h:124 [inline]
__list_del_entry include/linux/list.h:215 [inline]
list_del_init include/linux/list.h:287 [inline]
binder_dequeue_work_head_ilocked drivers/android/binder.c:540 [inline]
binder_release_work+0xcc/0x4c0 drivers/android/binder.c:5110
binder_deferred_release drivers/android/binder.c:6261 [inline]
binder_deferred_func+0x1308/0x14e0 drivers/android/binder.c:6296
process_one_work kernel/workqueue.c:3229 [inline]
process_scheduled_works+0x766/0x1040 kernel/workqueue.c:3310
worker_thread+0x974/0xdc0 kernel/workqueue.c:3391
kthread+0x2e7/0x380 kernel/kthread.c:389
ret_from_fork+0x55/0x90 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__list_del_entry_valid_or_report+0x7d/0x140 lib/list_debug.c:62
Code: 74 70 48 85 db 74 7c 48 ba 00 01 00 00 00 00 ad de 49 39 d6 74 7e 48 83 c2 22 48 39 d3 0f 84 82 00 00 00 48 89 d8 48 c1 e8 03 <42> 80 3c 20 00 74 08 48 89 df e8 74 18 3c ff 48 8b 13 4c 39 fa 75
RSP: 0018:ffffc900008d7b80 EFLAGS: 00010202
RAX: 004c803360000007 RBX: 0264019b00000039 RCX: ffffffff82979b8d
RDX: dead000000000122 RSI: 0000000000000008 RDI: ffff888116a00a80
RBP: ffffc900008d7ba0 R08: ffffffff8147d897 R09: 1ffffffff0fe5330
R10: fffffbfff0fe5331 R11: fffffbfff0fe5331 R12: dffffc0000000000
R13: ffff888116a00a80 R14: ffff888115f2a100 R15: ffff888116a00a80
FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b30f5ffff CR3: 0000000006aa8000 CR4: 00000000003526b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 74 70 je 0x72
2: 48 85 db test %rbx,%rbx
5: 74 7c je 0x83
7: 48 ba 00 01 00 00 00 movabs $0xdead000000000100,%rdx
e: 00 ad de
11: 49 39 d6 cmp %rdx,%r14
14: 74 7e je 0x94
16: 48 83 c2 22 add $0x22,%rdx
1a: 48 39 d3 cmp %rdx,%rbx
1d: 0f 84 82 00 00 00 je 0xa5
23: 48 89 d8 mov %rbx,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1) <-- trapping instruction
2f: 74 08 je 0x39
31: 48 89 df mov %rbx,%rdi
34: e8 74 18 3c ff call 0xff3c18ad
39: 48 8b 13 mov (%rbx),%rdx
3c: 4c 39 fa cmp %r15,%rdx
3f: 75 .byte 0x75