================================================================== BUG: KASAN: use-after-free in __hlist_del include/linux/list.h:858 [inline] BUG: KASAN: use-after-free in detach_timer+0x148/0x3c8 kernel/time/timer.c:827 Write of size 8 at addr ffff0000ec345a40 by task udevd/3661 CPU: 1 PID: 3661 Comm: udevd Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025 Call trace: dump_backtrace+0x0/0x43c arch/arm64/kernel/stacktrace.c:152 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216 __dump_stack+0x30/0x40 lib/dump_stack.c:88 dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106 print_address_description+0x78/0x30c mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:434 [inline] kasan_report+0xec/0x15c mm/kasan/report.c:451 __asan_report_store8_noabort+0x44/0x50 mm/kasan/report_generic.c:314 __hlist_del include/linux/list.h:858 [inline] detach_timer+0x148/0x3c8 kernel/time/timer.c:827 expire_timers kernel/time/timer.c:1485 [inline] __run_timers+0x414/0x6c4 kernel/time/timer.c:1767 run_timer_softirq+0x7c/0x114 kernel/time/timer.c:1780 handle_softirqs+0x344/0xbf0 kernel/softirq.c:576 __do_softirq kernel/softirq.c:610 [inline] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline] invoke_softirq kernel/softirq.c:457 [inline] __irq_exit_rcu+0x240/0x440 kernel/softirq.c:659 irq_exit+0x14/0x88 kernel/softirq.c:683 handle_domain_irq+0x14c/0x1fc kernel/irq/irqdesc.c:711 gic_handle_irq+0x78/0x1c8 drivers/irqchip/irq-gic-v3.c:765 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:903 do_interrupt_handler+0x6c/0x88 arch/arm64/kernel/entry-common.c:267 el1_interrupt+0x30/0x58 arch/arm64/kernel/entry-common.c:454 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:470 el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:522 qlink_free+0x44/0xa4 mm/kasan/quarantine.c:155 qlist_free_all+0x40/0xa8 mm/kasan/quarantine.c:176 kasan_quarantine_reduce+0x124/0x130 mm/kasan/quarantine.c:283 __kasan_slab_alloc+0x34/0xcc mm/kasan/common.c:444 kasan_slab_alloc include/linux/kasan.h:254 [inline] slab_post_alloc_hook+0x74/0x408 mm/slab.h:519 slab_alloc_node mm/slub.c:3225 [inline] slab_alloc mm/slub.c:3233 [inline] __kmalloc+0x208/0x44c mm/slub.c:4408 kmalloc include/linux/slab.h:612 [inline] tomoyo_realpath_from_path+0xcc/0x510 security/tomoyo/realpath.c:254 tomoyo_get_realpath security/tomoyo/file.c:151 [inline] tomoyo_path_perm+0x1b4/0x440 security/tomoyo/file.c:822 tomoyo_inode_getattr+0x28/0x38 security/tomoyo/tomoyo.c:122 security_inode_getattr+0xd8/0x124 security/security.c:1348 vfs_getattr fs/stat.c:157 [inline] vfs_fstat fs/stat.c:182 [inline] __do_sys_newfstat fs/stat.c:421 [inline] __se_sys_newfstat fs/stat.c:418 [inline] __arm64_sys_newfstat+0xe8/0x1d0 fs/stat.c:418 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 The buggy address belongs to the page: page:000000009abb2a58 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12c345 flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000000000 0000000000000000 ffffffff03b00201 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000ec345900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff0000ec345980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff0000ec345a00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff0000ec345a80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff0000ec345b00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== Unable to handle kernel paging request at virtual address dfff800000000038 Mem abort info: ESR = 0x0000000096000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x06: level 2 translation fault Data abort info: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 [dfff800000000038] address between user and kernel address ranges Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 3661 Comm: udevd Tainted: G B syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025 pstate: 424000c5 (nZcv daIF +PAN -UAO +TCO -DIT -SSBS BTYPE=--) pc : __queue_work+0x1c0/0x1054 kernel/workqueue.c:1452 lr : __queue_work+0x118/0x1054 kernel/workqueue.c:1448 sp : ffff800008017a10 x29: ffff800008017a50 x28: 1fffe0001aee8001 x27: 0000000000000000 x26: 0000000000000008 x25: dfff800000000000 x24: 00000000000001c0 x23: 0000000000000038 x22: 0000000000000000 x21: 0000000000000008 x20: 0000000000000000 x19: ffff0000ec3457c0 x18: 0000000000000103 x17: 0000000000000000 x16: ffff8000111ceed0 x15: 00000000ffffffff x14: 0000000000ff0100 x13: 0000000000000000 x12: 0000000000ff0100 x11: 0000000000000100 x10: 0000000000000000 x9 : ffff8000081e7240 x8 : ffff0000d7740000 x7 : 0000000000000000 x6 : ffff80000837f9ec x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000081e7034 x2 : ffff0000ec3457c0 x1 : 0000000000000000 x0 : 0000000000000000 Call trace: __queue_work+0x1c0/0x1054 kernel/workqueue.c:1452 queue_work_on+0xc4/0x17c kernel/workqueue.c:1559 queue_work include/linux/workqueue.h:512 [inline] ieee80211_queue_work+0xb4/0x138 net/mac80211/util.c:924 ieee80211_ibss_timer+0x44/0x54 net/mac80211/ibss.c:1729 call_timer_fn+0x19c/0x858 kernel/time/timer.c:1451 expire_timers kernel/time/timer.c:1496 [inline] __run_timers+0x46c/0x6c4 kernel/time/timer.c:1767 run_timer_softirq+0x7c/0x114 kernel/time/timer.c:1780 handle_softirqs+0x344/0xbf0 kernel/softirq.c:576 __do_softirq kernel/softirq.c:610 [inline] do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline] invoke_softirq kernel/softirq.c:457 [inline] __irq_exit_rcu+0x240/0x440 kernel/softirq.c:659 irq_exit+0x14/0x88 kernel/softirq.c:683 handle_domain_irq+0x14c/0x1fc kernel/irq/irqdesc.c:711 gic_handle_irq+0x78/0x1c8 drivers/irqchip/irq-gic-v3.c:765 call_on_irq_stack+0x30/0x48 arch/arm64/kernel/entry.S:903 do_interrupt_handler+0x6c/0x88 arch/arm64/kernel/entry-common.c:267 el1_interrupt+0x30/0x58 arch/arm64/kernel/entry-common.c:454 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:470 el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:522 qlink_free+0x44/0xa4 mm/kasan/quarantine.c:155 qlist_free_all+0x40/0xa8 mm/kasan/quarantine.c:176 kasan_quarantine_reduce+0x124/0x130 mm/kasan/quarantine.c:283 __kasan_slab_alloc+0x34/0xcc mm/kasan/common.c:444 kasan_slab_alloc include/linux/kasan.h:254 [inline] slab_post_alloc_hook+0x74/0x408 mm/slab.h:519 slab_alloc_node mm/slub.c:3225 [inline] slab_alloc mm/slub.c:3233 [inline] __kmalloc+0x208/0x44c mm/slub.c:4408 kmalloc include/linux/slab.h:612 [inline] tomoyo_realpath_from_path+0xcc/0x510 security/tomoyo/realpath.c:254 tomoyo_get_realpath security/tomoyo/file.c:151 [inline] tomoyo_path_perm+0x1b4/0x440 security/tomoyo/file.c:822 tomoyo_inode_getattr+0x28/0x38 security/tomoyo/tomoyo.c:122 security_inode_getattr+0xd8/0x124 security/security.c:1348 vfs_getattr fs/stat.c:157 [inline] vfs_fstat fs/stat.c:182 [inline] __do_sys_newfstat fs/stat.c:421 [inline] __se_sys_newfstat fs/stat.c:418 [inline] __arm64_sys_newfstat+0xe8/0x1d0 fs/stat.c:418 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 Code: 350055d7 940a484f 91070378 d343ff17 (38f96ae8) ---[ end trace 80690a926fc505da ]--- ---------------- Code disassembly (best guess): 0: 350055d7 cbnz w23, 0xab8 4: 940a484f bl 0x292140 8: 91070378 add x24, x27, #0x1c0 c: d343ff17 lsr x23, x24, #3 * 10: 38f96ae8 ldrsb w8, [x23, x25] <-- trapping instruction