==================================================================
BUG: KASAN: use-after-free in __kernfs_remove+0x9dd/0xb30
Read of size 2 at addr ffff88800b06d180 by task syz-executor.4/5674
CPU: 1 PID: 5674 Comm: syz-executor.4 Not tainted 6.0.0-rc3-next-20220829 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
dump_stack_lvl+0x8b/0xb3
print_report.cold+0x5e/0x5e5
kasan_report+0xb1/0x1c0
__kernfs_remove+0x9dd/0xb30
kernfs_remove_by_name_ns+0xa8/0x110
sysfs_slab_add+0x142/0x1f0
__kmem_cache_create+0x49d/0x600
kmem_cache_create_usercopy+0x1fd/0x2e0
p9_client_create+0xc85/0x1050
v9fs_session_init+0x1dd/0x1670
v9fs_mount+0xb9/0xbd0
legacy_get_tree+0x105/0x220
vfs_get_tree+0x8e/0x300
path_mount+0x1310/0x1e20
__x64_sys_mount+0x282/0x300
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f5b11b3cb19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f5b0f0b2188 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f5b11c4ff60 RCX: 00007f5b11b3cb19
RDX: 0000000020000040 RSI: 0000000020000000 RDI: 0000000000000000
RBP: 00007f5b11b96f6d R08: 0000000020000240 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fff8bfb0d7f R14: 00007f5b0f0b2300 R15: 0000000000022000
Allocated by task 5666:
kasan_save_stack+0x1e/0x40
__kasan_slab_alloc+0x66/0x80
kmem_cache_alloc+0x1b1/0x3e0
__kernfs_new_node+0xd4/0x8c0
kernfs_create_dir_ns+0x9c/0x230
sysfs_create_dir_ns+0x127/0x290
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'.
kobject_add_internal+0x24c/0x8e0
kobject_init_and_add+0x101/0x160
sysfs_slab_add+0x165/0x1f0
__kmem_cache_create+0x49d/0x600
kmem_cache_create_usercopy+0x1fd/0x2e0
p9_client_create+0xc85/0x1050
v9fs_session_init+0x1dd/0x1670
v9fs_mount+0xb9/0xbd0
legacy_get_tree+0x105/0x220
vfs_get_tree+0x8e/0x300
path_mount+0x1310/0x1e20
__x64_sys_mount+0x282/0x300
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Freed by task 5674:
kasan_save_stack+0x1e/0x40
kasan_set_track+0x21/0x30
kasan_set_free_info+0x20/0x40
__kasan_slab_free+0x108/0x190
kmem_cache_free+0xf7/0x610
kernfs_put.part.0+0x2c7/0x540
kernfs_put+0x42/0x50
__kernfs_remove+0x7d4/0xb30
kernfs_remove_by_name_ns+0xa8/0x110
sysfs_slab_add+0x142/0x1f0
__kmem_cache_create+0x49d/0x600
kmem_cache_create_usercopy+0x1fd/0x2e0
p9_client_create+0xc85/0x1050
v9fs_session_init+0x1dd/0x1670
v9fs_mount+0xb9/0xbd0
legacy_get_tree+0x105/0x220
vfs_get_tree+0x8e/0x300
path_mount+0x1310/0x1e20
__x64_sys_mount+0x282/0x300
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
The buggy address belongs to the object at ffff88800b06d0e8
which belongs to the cache kernfs_node_cache of size 168
The buggy address is located 152 bytes inside of
168-byte region [ffff88800b06d0e8, ffff88800b06d190)
The buggy address belongs to the physical page:
page:000000003cf817b2 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xb06d
flags: 0x100000000000200(slab|node=0|zone=1)
raw: 0100000000000200 ffffea000033dbc0 dead000000000007 ffff88800847b8c0
raw: 0000000000000000 0000000000110011 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88800b06d080: fb fb fb fb fb fc fc fc fc fc fc fc fc fa fb fb
ffff88800b06d100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88800b06d180: fb fb fc fc fc fc fc fc fc fc fa fb fb fb fb fb
^
ffff88800b06d200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc
ffff88800b06d280: fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb fb
==================================================================
------------[ cut here ]------------
WARNING: CPU: 1 PID: 5674 at fs/kernfs/dir.c:504 kernfs_get.part.0+0x6d/0x80
Modules linked in:
CPU: 1 PID: 5674 Comm: syz-executor.4 Tainted: G B 6.0.0-rc3-next-20220829 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
RIP: 0010:kernfs_get.part.0+0x6d/0x80
Code: e8 b8 d9 a6 ff 85 ed 74 1c e8 ff dc a6 ff be 04 00 00 00 48 89 df e8 22 d6 d9 ff f0 ff 03 5b 5d e9 08 3d c1 02 e8 e3 dc a6 ff <0f> 0b eb db 48 89 df e8 97 d2 d9 ff eb c2 0f 1f 44 00 00 55 48 89
RSP: 0018:ffff888045bdf780 EFLAGS: 00010246
RAX: 0000000000040000 RBX: ffff88800b06d0e8 RCX: ffffc90003be7000
RDX: 0000000000040000 RSI: ffffffff819efdfd RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
R13: dffffc0000000000 R14: ffff88800fc75c08 R15: ffff88800b06d0e8
FS: 00007f5b0f0b2700(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f42f1b993a4 CR3: 000000000e5d8000 CR4: 0000000000350ee0
Call Trace:
__kernfs_remove+0x34a/0xb30
kernfs_remove_by_name_ns+0xa8/0x110
sysfs_slab_add+0x142/0x1f0
__kmem_cache_create+0x49d/0x600
kmem_cache_create_usercopy+0x1fd/0x2e0
p9_client_create+0xc85/0x1050
v9fs_session_init+0x1dd/0x1670
v9fs_mount+0xb9/0xbd0
legacy_get_tree+0x105/0x220
vfs_get_tree+0x8e/0x300
path_mount+0x1310/0x1e20
__x64_sys_mount+0x282/0x300
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f5b11b3cb19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f5b0f0b2188 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f5b11c4ff60 RCX: 00007f5b11b3cb19
RDX: 0000000020000040 RSI: 0000000020000000 RDI: 0000000000000000
RBP: 00007f5b11b96f6d R08: 0000000020000240 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fff8bfb0d7f R14: 00007f5b0f0b2300 R15: 0000000000022000
irq event stamp: 1977
hardirqs last enabled at (1977): [] asm_sysvec_apic_timer_interrupt+0x16/0x20
hardirqs last disabled at (1976): [] __do_softirq+0x6be/0x8d0
softirqs last enabled at (1452): [] fpu_clone+0x3c2/0xb00
softirqs last disabled at (1450): [] fpu_clone+0x335/0xb00
---[ end trace 0000000000000000 ]---
loop0: detected capacity change from 0 to 256
netlink: 4 bytes leftover after parsing attributes in process `syz-executor.6'.
FAT-fs (loop0): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1)
loop0: detected capacity change from 0 to 264192
general protection fault, probably for non-canonical address 0xabebdc22005fc8: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 1 PID: 5718 Comm: systemd-udevd Tainted: G B W 6.0.0-rc3-next-20220829 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
RIP: 0010:qlist_free_all+0xaf/0x1a0
Code: 80 4c 01 c2 0f 82 f8 00 00 00 48 c7 c0 00 00 00 80 48 2b 05 f3 3c 9b 03 48 01 d0 48 c1 e8 0c 48 c1 e0 06 48 03 05 d1 3c 9b 03 <48> 8b 48 08 48 89 c2 f6 c1 01 0f 85 ba 00 00 00 0f 1f 44 00 00 48
RSP: 0018:ffff8880473afaa8 EFLAGS: 00010207
RAX: 00abebdc22005fc0 RBX: 2affff888017f80a RCX: 0000000000000000
RDX: 2affff890017f80a RSI: 0000000000000004 RDI: 0000000000000001
RBP: 0000000000000000 R08: 2affff888017f80a R09: 0000000000000000
R10: ffffed1000f89d20 R11: 0000000000000001 R12: dffffc0000000000
R13: ffff8880473afae8 R14: 0000000000000000 R15: ffff888008ad2001
FS: 00007f0946c208c0(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fffb41d2ff8 CR3: 000000002070e000 CR4: 0000000000350ee0
Call Trace:
kasan_quarantine_reduce+0x184/0x210
__kasan_slab_alloc+0x7c/0x80
kmem_cache_alloc+0x1b1/0x3e0
flock_lock_inode+0x16f/0x11f0
flock_lock_inode_wait+0xf9/0x240
__do_sys_flock+0x49e/0x510
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f09470d0427
Code: e9 72 ff ff ff 48 8b 15 67 ea 0c 00 f7 d8 64 89 02 b8 ff ff ff ff eb da e8 06 e2 01 00 66 0f 1f 44 00 00 b8 49 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 39 ea 0c 00 f7 d8 64 89 01 48
RSP: 002b:00007fffb41d5358 EFLAGS: 00000202 ORIG_RAX: 0000000000000049
RAX: ffffffffffffffda RBX: 00007fffb41d5414 RCX: 00007f09470d0427
RDX: 00000000000a0800 RSI: 0000000000000005 RDI: 0000000000000007
RBP: 0000000000000007 R08: 000055cbf946b820 R09: 00007fffb41ef080
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fffb41d5370 R15: 00007fffb41d5414
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:qlist_free_all+0xaf/0x1a0
Code: 80 4c 01 c2 0f 82 f8 00 00 00 48 c7 c0 00 00 00 80 48 2b 05 f3 3c 9b 03 48 01 d0 48 c1 e8 0c 48 c1 e0 06 48 03 05 d1 3c 9b 03 <48> 8b 48 08 48 89 c2 f6 c1 01 0f 85 ba 00 00 00 0f 1f 44 00 00 48
RSP: 0018:ffff8880473afaa8 EFLAGS: 00010207
RAX: 00abebdc22005fc0 RBX: 2affff888017f80a RCX: 0000000000000000
RDX: 2affff890017f80a RSI: 0000000000000004 RDI: 0000000000000001
RBP: 0000000000000000 R08: 2affff888017f80a R09: 0000000000000000
R10: ffffed1000f89d20 R11: 0000000000000001 R12: dffffc0000000000
R13: ffff8880473afae8 R14: 0000000000000000 R15: ffff888008ad2001
FS: 00007f0946c208c0(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fffb41d2ff8 CR3: 000000002070e000 CR4: 0000000000350ee0
------------[ cut here ]------------
WARNING: CPU: 1 PID: 128 at mm/kasan/shadow.c:134 kasan_unpoison+0x46/0x50
Modules linked in:
CPU: 1 PID: 128 Comm: systemd-udevd Tainted: G B D W 6.0.0-rc3-next-20220829 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
RIP: 0010:kasan_unpoison+0x46/0x50
Code: c6 01 e8 4d fe ff ff 48 89 e8 83 e0 07 74 14 48 ba 00 00 00 00 00 fc ff df 48 01 eb 48 c1 eb 03 88 04 13 5b 5d e9 0a 65 e7 02 <0f> 0b e9 03 65 e7 02 0f 1f 00 41 57 48 89 f8 41 56 48 c1 e8 03 41
RSP: 0018:ffff8880103ef988 EFLAGS: 00010202
RAX: 0000000003102900 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000170 RDI: ffff888008ad2001
RBP: ffff888007c4f780 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: ffff888008ad2001
R13: 0000000000092cc0 R14: 0000000000092cc0 R15: 0000000000092cc0
FS: 00007f0946c208c0(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fffb41d2ff8 CR3: 000000000f87a000 CR4: 0000000000350ee0
Call Trace:
__kasan_slab_alloc+0x2c/0x80
kmem_cache_alloc+0x1b1/0x3e0
__create_object.isra.0+0x3d/0xc10
kmem_cache_alloc+0x23c/0x3e0
__alloc_file+0x21/0x240
alloc_empty_file+0x6d/0x170
path_openat+0xd4/0x2800
do_filp_open+0x1b6/0x410
do_sys_openat2+0x171/0x4c0
__x64_sys_openat+0x13f/0x1f0
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f09470cfbe7
Code: 25 00 00 41 00 3d 00 00 41 00 74 47 64 8b 04 25 18 00 00 00 85 c0 75 6b 44 89 e2 48 89 ee bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 95 00 00 00 48 8b 4c 24 28 64 48 2b 0c 25
RSP: 002b:00007fffb41d5170 EFLAGS: 00000246 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 000055cbfbc1c7f0 RCX: 00007f09470cfbe7
RDX: 0000000000080000 RSI: 00007fffb41d53b0 RDI: 00000000ffffff9c
RBP: 00007fffb41d53b0 R08: 0000000000000008 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000080000
R13: 000055cbfbc1c7f0 R14: 0000000000000001 R15: 000055cbfbc5a7d0
irq event stamp: 1655174
hardirqs last enabled at (1655173): [] asm_sysvec_apic_timer_interrupt+0x16/0x20
hardirqs last disabled at (1655174): [] __schedule+0x11dd/0x24a0
softirqs last enabled at (1655172): [] __irq_exit_rcu+0x11b/0x180
softirqs last disabled at (1655163): [] __irq_exit_rcu+0x11b/0x180
---[ end trace 0000000000000000 ]---
general protection fault, probably for non-canonical address 0xfff10c030ca91b1f: 0000 [#2] PREEMPT SMP KASAN NOPTI
KASAN: maybe wild-memory-access in range [0xff8880186548d8f8-0xff8880186548d8ff]
CPU: 1 PID: 19 Comm: ksoftirqd/1 Tainted: G B D W 6.0.0-rc3-next-20220829 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
RIP: 0010:rb_erase+0x3b1/0x1140
Code: 89 ee 48 89 c5 e9 01 ff ff ff 48 8d 7d 10 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 aa 0c 00 00 4c 8b 65 10 4c 89 e0 48 c1 e8 03 <80> 3c 18 00 0f 85 9f 0c 00 00 49 8d 7c 24 08 49 8b 04 24 48 89 fa
RSP: 0018:ffff8880086bfc70 EFLAGS: 00010013
RAX: 1ff110030ca91b1f RBX: dffffc0000000000 RCX: ffffffff821dac05
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff888008ad2078
RBP: ffff888008ad2068 R08: 0000000000000001 R09: ffffffff854cc763
R10: fffffbfff0a998ec R11: 0000000000000001 R12: ff8880186548d8ff
R13: fffffbfff0e0c2d0 R14: 0000000000000000 R15: ffffffff87061680
FS: 0000000000000000(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fffb41d2ff8 CR3: 000000000f87a000 CR4: 0000000000350ee0
Call Trace:
find_and_remove_object+0x81/0x170
kmemleak_free+0x21/0x40
kmem_cache_free+0xbd/0x610
rcu_core+0x7e2/0x2080
__do_softirq+0x1c8/0x8d0
run_ksoftirqd+0x31/0x60
smpboot_thread_fn+0x66f/0xa10
kthread+0x2ed/0x3a0
ret_from_fork+0x22/0x30
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:qlist_free_all+0xaf/0x1a0
Code: 80 4c 01 c2 0f 82 f8 00 00 00 48 c7 c0 00 00 00 80 48 2b 05 f3 3c 9b 03 48 01 d0 48 c1 e8 0c 48 c1 e0 06 48 03 05 d1 3c 9b 03 <48> 8b 48 08 48 89 c2 f6 c1 01 0f 85 ba 00 00 00 0f 1f 44 00 00 48
RSP: 0018:ffff8880473afaa8 EFLAGS: 00010207
RAX: 00abebdc22005fc0 RBX: 2affff888017f80a RCX: 0000000000000000
RDX: 2affff890017f80a RSI: 0000000000000004 RDI: 0000000000000001
RBP: 0000000000000000 R08: 2affff888017f80a R09: 0000000000000000
R10: ffffed1000f89d20 R11: 0000000000000001 R12: dffffc0000000000
R13: ffff8880473afae8 R14: 0000000000000000 R15: ffff888008ad2001
FS: 0000000000000000(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fffb41d2ff8 CR3: 000000000f87a000 CR4: 0000000000350ee0
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 4c 01 c2 add %r8,%rdx
3: 0f 82 f8 00 00 00 jb 0x101
9: 48 c7 c0 00 00 00 80 mov $0xffffffff80000000,%rax
10: 48 2b 05 f3 3c 9b 03 sub 0x39b3cf3(%rip),%rax # 0x39b3d0a
17: 48 01 d0 add %rdx,%rax
1a: 48 c1 e8 0c shr $0xc,%rax
1e: 48 c1 e0 06 shl $0x6,%rax
22: 48 03 05 d1 3c 9b 03 add 0x39b3cd1(%rip),%rax # 0x39b3cfa
* 29: 48 8b 48 08 mov 0x8(%rax),%rcx <-- trapping instruction
2d: 48 89 c2 mov %rax,%rdx
30: f6 c1 01 test $0x1,%cl
33: 0f 85 ba 00 00 00 jne 0xf3
39: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
3e: 48 rex.W