loop5: detected capacity change from 0 to 136
==================================================================
BUG: KASAN: use-after-free in __queue_work+0x10b5/0x1240
Read of size 8 at addr ffff88801e05ffff by task syz-executor.5/4252
CPU: 0 UID: 0 PID: 4252 Comm: syz-executor.5 Tainted: G W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary)
Tainted: [W]=WARN
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Call Trace:
dump_stack_lvl+0xca/0x120
print_report+0xcb/0x610
kasan_report+0xca/0x100
__queue_work+0x10b5/0x1240
queue_work_on+0xd0/0xe0
loop_queue_rq+0x5c8/0x1180
__blk_mq_issue_directly+0xd5/0x260
blk_mq_request_issue_directly+0x11c/0x1e0
blk_mq_issue_direct+0x192/0x640
blk_mq_dispatch_queue_requests+0x4b0/0x7c0
blk_mq_flush_plug_list+0x1ec/0x5b0
__blk_flush_plug+0x25c/0x460
__submit_bio+0x480/0x5b0
submit_bio_noacct_nocheck+0x68e/0xcb0
submit_bio_noacct+0x359/0x1350
__bread_gfp+0x18b/0x3c0
isofs_fill_super+0x582/0x2bd0
get_tree_bdev_flags+0x38a/0x620
vfs_get_tree+0x93/0x340
path_mount+0x132d/0x1dd0
__x64_sys_mount+0x27b/0x300
do_syscall_64+0xbf/0x360
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f295eb2c04a
Code: 48 c7 c2 bc ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f295c09ffa8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000020000200 RCX: 00007f295eb2c04a
RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f295c0a0000
RBP: 00007f295c0a0040 R08: 00007f295c0a0040 R09: 0000000020000000
R10: 0000000000000001 R11: 0000000000000206 R12: 0000000020000000
R13: 0000000020000100 R14: 00007f295c0a0000 R15: 0000000020012200
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1e05f
flags: 0x100000000000000(node=0|zone=1)
raw: 0100000000000000 0000000000000000 00000000ffffffff 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88801e05fe80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88801e05ff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88801e05ff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff88801e060000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88801e060080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
Oops: general protection fault, probably for non-canonical address 0xfff10c0119aa0000: 0000 [#1] SMP KASAN NOPTI
KASAN: maybe wild-memory-access in range [0xff888008cd500000-0xff888008cd500007]
CPU: 0 UID: 0 PID: 4252 Comm: syz-executor.5 Tainted: G B W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary)
Tainted: [B]=BAD_PAGE, [W]=WARN
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:do_raw_spin_lock+0x5e/0x260
Code: ee 74 74 85 48 c1 ed 03 48 c7 44 24 18 00 20 52 81 48 8d 54 05 00 c7 02 f1 f1 f1 f1 c7 42 04 04 f3 f3 f3 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 65 48 8b 0d 9b 0f 32 06 48 89 4c 24 60 31 c9
RSP: 0018:ffff88801627f408 EFLAGS: 00010017
RAX: dffffc0000000000 RBX: ff888008cd500000 RCX: 0000000000000000
RDX: 1ff1100119aa0000 RSI: 0000000000000000 RDI: ff888008cd500004
RBP: 1ffff11002c4fe82 R08: 0000000000000001 R09: 0000000000000000
R10: 000000007fffffff R11: 0000000000000001 R12: dffffc0000000000
R13: 0000000000000000 R14: ff888008cd500000 R15: ffff88801725c000
FS: 00007f295c0a0700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa77d7216f4 CR3: 000000000ed79000 CR4: 0000000000350ef0
Call Trace:
__queue_work+0x27d/0x1240
queue_work_on+0xd0/0xe0
loop_queue_rq+0x5c8/0x1180
__blk_mq_issue_directly+0xd5/0x260
blk_mq_request_issue_directly+0x11c/0x1e0
blk_mq_issue_direct+0x192/0x640
blk_mq_dispatch_queue_requests+0x4b0/0x7c0
blk_mq_flush_plug_list+0x1ec/0x5b0
__blk_flush_plug+0x25c/0x460
__submit_bio+0x480/0x5b0
submit_bio_noacct_nocheck+0x68e/0xcb0
submit_bio_noacct+0x359/0x1350
__bread_gfp+0x18b/0x3c0
isofs_fill_super+0x582/0x2bd0
get_tree_bdev_flags+0x38a/0x620
vfs_get_tree+0x93/0x340
path_mount+0x132d/0x1dd0
__x64_sys_mount+0x27b/0x300
do_syscall_64+0xbf/0x360
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f295eb2c04a
Code: 48 c7 c2 bc ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f295c09ffa8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000020000200 RCX: 00007f295eb2c04a
RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f295c0a0000
RBP: 00007f295c0a0040 R08: 00007f295c0a0040 R09: 0000000020000000
R10: 0000000000000001 R11: 0000000000000206 R12: 0000000020000000
R13: 0000000020000100 R14: 00007f295c0a0000 R15: 0000000020012200
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:do_raw_spin_lock+0x5e/0x260
Code: ee 74 74 85 48 c1 ed 03 48 c7 44 24 18 00 20 52 81 48 8d 54 05 00 c7 02 f1 f1 f1 f1 c7 42 04 04 f3 f3 f3 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 65 48 8b 0d 9b 0f 32 06 48 89 4c 24 60 31 c9
RSP: 0018:ffff88801627f408 EFLAGS: 00010017
RAX: dffffc0000000000 RBX: ff888008cd500000 RCX: 0000000000000000
RDX: 1ff1100119aa0000 RSI: 0000000000000000 RDI: ff888008cd500004
RBP: 1ffff11002c4fe82 R08: 0000000000000001 R09: 0000000000000000
R10: 000000007fffffff R11: 0000000000000001 R12: dffffc0000000000
R13: 0000000000000000 R14: ff888008cd500000 R15: ffff88801725c000
FS: 00007f295c0a0700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa77d7216f4 CR3: 000000000ed79000 CR4: 0000000000350ef0
note: syz-executor.5[4252] exited with irqs disabled
note: syz-executor.5[4252] exited with preempt_count 2
------------[ cut here ]------------
WARNING: kernel/exit.c:898 at do_exit+0x1c36/0x2970, CPU#0: syz-executor.5/4252
Modules linked in:
CPU: 0 UID: 0 PID: 4252 Comm: syz-executor.5 Tainted: G B D W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary)
Tainted: [B]=BAD_PAGE, [D]=DIE, [W]=WARN
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
RIP: 0010:do_exit+0x1c36/0x2970
Code: 96 0a 00 00 c7 43 18 00 00 00 00 e9 21 e6 ff ff e8 bf a4 38 00 bf 02 24 00 00 e8 f5 ab 0b 00 e9 41 ff ff ff e8 ab a4 38 00 90 <0f> 0b 90 e9 87 e4 ff ff e8 9d a4 38 00 4c 89 e6 bf 05 06 00 00 e8
RSP: 0018:ffff88801627fe40 EFLAGS: 00010246
RAX: 0000000000040000 RBX: 0000000000000200 RCX: ffffc9000d67c000
RDX: 0000000000040000 RSI: ffffffff813b42d5 RDI: ffff888015f3c8e8
RBP: ffff888015f3b700 R08: 0000000000000001 R09: fffffbfff0f11cd8
R10: 0000000000000200 R11: 0000000000000001 R12: 000000000000000b
R13: 0000000000002710 R14: fff10c0119aa0000 R15: 0000000000000000
FS: 00007f295c0a0700(0000) GS:ffff8880e55dd000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa77d7216f4 CR3: 000000000ed79000 CR4: 0000000000350ef0
Call Trace:
make_task_dead+0x174/0x3b0
rewind_stack_and_make_dead+0x16/0x20
RIP: 0033:0x7f295eb2c04a
Code: 48 c7 c2 bc ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f295c09ffa8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000020000200 RCX: 00007f295eb2c04a
RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f295c0a0000
RBP: 00007f295c0a0040 R08: 00007f295c0a0040 R09: 0000000020000000
R10: 0000000000000001 R11: 0000000000000206 R12: 0000000020000000
R13: 0000000020000100 R14: 00007f295c0a0000 R15: 0000000020012200
irq event stamp: 806
hardirqs last enabled at (805): [] _raw_spin_unlock_irqrestore+0x2c/0x50
hardirqs last disabled at (806): [] _raw_spin_lock_irq+0x42/0x50
softirqs last enabled at (678): [] handle_softirqs+0x50c/0x770
softirqs last disabled at (613): [] __irq_exit_rcu+0xc4/0x100
---[ end trace 0000000000000000 ]---
BUG: sleeping function called from invalid context at ./include/linux/percpu-rwsem.h:51
in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 4252, name: syz-executor.5
preempt_count: 0, expected: 0
RCU nest depth: 2, expected: 0
INFO: lockdep is turned off.
CPU: 0 UID: 0 PID: 4252 Comm: syz-executor.5 Tainted: G B D W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary)
Tainted: [B]=BAD_PAGE, [D]=DIE, [W]=WARN
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Call Trace:
dump_stack_lvl+0xfa/0x120
__might_resched+0x2f3/0x510
exit_signals+0x25/0x940
do_exit+0x2db/0x2970
make_task_dead+0x174/0x3b0
rewind_stack_and_make_dead+0x16/0x20
RIP: 0033:0x7f295eb2c04a
Code: 48 c7 c2 bc ff ff ff f7 d8 64 89 02 b8 ff ff ff ff eb d2 e8 b8 04 00 00 0f 1f 84 00 00 00 00 00 49 89 ca b8 a5 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f295c09ffa8 EFLAGS: 00000206 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 0000000020000200 RCX: 00007f295eb2c04a
RDX: 0000000020000000 RSI: 0000000020000100 RDI: 00007f295c0a0000
RBP: 00007f295c0a0040 R08: 00007f295c0a0040 R09: 0000000020000000
R10: 0000000000000001 R11: 0000000000000206 R12: 0000000020000000
R13: 0000000020000100 R14: 00007f295c0a0000 R15: 0000000020012200
mac80211_hwsim hwsim3 wlan1: entered promiscuous mode
EXT4-fs warning (device sda): ext4_group_extend:1862: can't shrink FS - resize aborted
mac80211_hwsim hwsim3 wlan1: left promiscuous mode
mac80211_hwsim hwsim3 wlan1: entered promiscuous mode
mac80211_hwsim hwsim3 wlan1: left promiscuous mode
audit: type=1400 audit(1756542641.466:13): avc: denied { write } for pid=4255 comm="syz-executor.1" scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:system_r:kernel_t:s0 tclass=perf_event permissive=1
EXT4-fs warning (device sda): ext4_group_extend:1862: can't shrink FS - resize aborted
kmemleak: Found object by alias at 0x607f1a639a4c
CPU: 0 UID: 0 PID: 4248 Comm: syz-executor.6 Tainted: G B D W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary)
Tainted: [B]=BAD_PAGE, [D]=DIE, [W]=WARN
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Call Trace:
dump_stack_lvl+0xca/0x120
__lookup_object+0x94/0xb0
delete_object_full+0x27/0x70
free_percpu+0x30/0x1160
futex_hash_free+0x38/0xc0
mmput+0x2d3/0x390
do_exit+0x79d/0x2970
do_group_exit+0xd3/0x2a0
get_signal+0x2315/0x2340
arch_do_signal_or_restart+0x80/0x790
exit_to_user_mode_loop+0x8b/0x110
do_syscall_64+0x2f7/0x360
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa10fc9eb19
Code: Unable to access opcode bytes at 0x7fa10fc9eaef.
RSP: 002b:00007fa10d214218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007fa10fdb1f68 RCX: 00007fa10fc9eb19
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fa10fdb1f68
RBP: 00007fa10fdb1f60 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa10fdb1f6c
R13: 00007ffded8a7fff R14: 00007fa10d214300 R15: 0000000000022000
kmemleak: Object (percpu) 0x607f1a639a48 (size 8):
kmemleak: comm "syz-executor.5", pid 4252, jiffies 4294857309
kmemleak: min_count = 1
kmemleak: count = 0
kmemleak: flags = 0x21
kmemleak: checksum = 0
kmemleak: backtrace:
pcpu_alloc_noprof+0x87a/0x1170
__alloc_workqueue+0x74b/0x1820
alloc_workqueue_noprof+0xc7/0x200
loop_configure+0xf73/0x1590
lo_ioctl+0x66d/0x1c70
blkdev_ioctl+0x27c/0x6c0
__x64_sys_ioctl+0x18f/0x210
do_syscall_64+0xbf/0x360
entry_SYSCALL_64_after_hwframe+0x77/0x7f
mac80211_hwsim hwsim3 wlan1: entered promiscuous mode
mac80211_hwsim hwsim3 wlan1: left promiscuous mode
kmemleak: Found object by alias at 0x607f1a639a4c
CPU: 1 UID: 0 PID: 4279 Comm: syz-executor.6 Tainted: G B D W 6.17.0-rc3-next-20250829 #1 PREEMPT(voluntary)
Tainted: [B]=BAD_PAGE, [D]=DIE, [W]=WARN
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014
Call Trace:
dump_stack_lvl+0xca/0x120
__lookup_object+0x94/0xb0
delete_object_full+0x27/0x70
free_percpu+0x30/0x1160
futex_hash_free+0x38/0xc0
mmput+0x2d3/0x390
do_exit+0x79d/0x2970
do_group_exit+0xd3/0x2a0
get_signal+0x2315/0x2340
arch_do_signal_or_restart+0x80/0x790
exit_to_user_mode_loop+0x8b/0x110
do_syscall_64+0x2f7/0x360
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fa10fc9eb19
Code: Unable to access opcode bytes at 0x7fa10fc9eaef.
RSP: 002b:00007fa10d214218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007fa10fdb1f68 RCX: 00007fa10fc9eb19
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fa10fdb1f68
RBP: 00007fa10fdb1f60 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa10fdb1f6c
R13: 00007ffded8a7fff R14: 00007fa10d214300 R15: 0000000000022000
kmemleak: Object (percpu) 0x607f1a639a48 (size 8):
kmemleak: comm "syz-executor.5", pid 4252, jiffies 4294857309
kmemleak: min_count = 1
kmemleak: count = 0
kmemleak: flags = 0x21
kmemleak: checksum = 0
kmemleak: backtrace:
pcpu_alloc_noprof+0x87a/0x1170
__alloc_workqueue+0x74b/0x1820
alloc_workqueue_noprof+0xc7/0x200
loop_configure+0xf73/0x1590
lo_ioctl+0x66d/0x1c70
blkdev_ioctl+0x27c/0x6c0
__x64_sys_ioctl+0x18f/0x210
do_syscall_64+0xbf/0x360
entry_SYSCALL_64_after_hwframe+0x77/0x7f
----------------
Code disassembly (best guess):
0: ee out %al,(%dx)
1: 74 74 je 0x77
3: 85 48 c1 test %ecx,-0x3f(%rax)
6: ed in (%dx),%eax
7: 03 48 c7 add -0x39(%rax),%ecx
a: 44 24 18 rex.R and $0x18,%al
d: 00 20 add %ah,(%rax)
f: 52 push %rdx
10: 81 48 8d 54 05 00 c7 orl $0xc7000554,-0x73(%rax)
17: 02 f1 add %cl,%dh
19: f1 icebp
1a: f1 icebp
1b: f1 icebp
1c: c7 42 04 04 f3 f3 f3 movl $0xf3f3f304,0x4(%rdx)
23: 48 89 fa mov %rdi,%rdx
26: 48 c1 ea 03 shr $0x3,%rdx
* 2a: 0f b6 14 02 movzbl (%rdx,%rax,1),%edx <-- trapping instruction
2e: 48 89 f8 mov %rdi,%rax
31: 65 48 8b 0d 9b 0f 32 mov %gs:0x6320f9b(%rip),%rcx # 0x6320fd4
38: 06
39: 48 89 4c 24 60 mov %rcx,0x60(%rsp)
3e: 31 c9 xor %ecx,%ecx