==================================================================
BUG: KASAN: use-after-free in __kernfs_remove+0x9dd/0xb30
Read of size 2 at addr ffff888043107520 by task syz-executor.6/7493
CPU: 0 PID: 7493 Comm: syz-executor.6 Not tainted 6.0.0-rc3-next-20220829 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
dump_stack_lvl+0x8b/0xb3
print_report.cold+0x5e/0x5e5
kasan_report+0xb1/0x1c0
__kernfs_remove+0x9dd/0xb30
kernfs_remove_by_name_ns+0xa8/0x110
sysfs_slab_add+0x142/0x1f0
__kmem_cache_create+0x49d/0x600
kmem_cache_create_usercopy+0x1fd/0x2e0
p9_client_create+0xc85/0x1050
v9fs_session_init+0x1dd/0x1670
v9fs_mount+0xb9/0xbd0
legacy_get_tree+0x105/0x220
vfs_get_tree+0x8e/0x300
path_mount+0x1310/0x1e20
__x64_sys_mount+0x282/0x300
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fef5fee4b19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fef5d439188 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fef5fff8020 RCX: 00007fef5fee4b19
RDX: 0000000020000080 RSI: 0000000020000000 RDI: 0000000000000000
RBP: 00007fef5ff3ef6d R08: 0000000020000300 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc7fa4ceef R14: 00007fef5d439300 R15: 0000000000022000
Allocated by task 7492:
kasan_save_stack+0x1e/0x40
__kasan_slab_alloc+0x66/0x80
kmem_cache_alloc+0x1b1/0x3e0
__kernfs_new_node+0xd4/0x8c0
kernfs_create_dir_ns+0x9c/0x230
sysfs_create_dir_ns+0x127/0x290
kobject_add_internal+0x24c/0x8e0
kobject_init_and_add+0x101/0x160
sysfs_slab_add+0x165/0x1f0
__kmem_cache_create+0x49d/0x600
kmem_cache_create_usercopy+0x1fd/0x2e0
p9_client_create+0xc85/0x1050
v9fs_session_init+0x1dd/0x1670
v9fs_mount+0xb9/0xbd0
legacy_get_tree+0x105/0x220
vfs_get_tree+0x8e/0x300
path_mount+0x1310/0x1e20
__x64_sys_mount+0x282/0x300
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Freed by task 7493:
kasan_save_stack+0x1e/0x40
kasan_set_track+0x21/0x30
kasan_set_free_info+0x20/0x40
__kasan_slab_free+0x108/0x190
kmem_cache_free+0xf7/0x610
kernfs_put.part.0+0x2c7/0x540
kernfs_put+0x42/0x50
__kernfs_remove+0x7d4/0xb30
kernfs_remove_by_name_ns+0xa8/0x110
sysfs_slab_add+0x142/0x1f0
__kmem_cache_create+0x49d/0x600
kmem_cache_create_usercopy+0x1fd/0x2e0
p9_client_create+0xc85/0x1050
v9fs_session_init+0x1dd/0x1670
v9fs_mount+0xb9/0xbd0
legacy_get_tree+0x105/0x220
vfs_get_tree+0x8e/0x300
path_mount+0x1310/0x1e20
__x64_sys_mount+0x282/0x300
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
The buggy address belongs to the object at ffff888043107488
which belongs to the cache kernfs_node_cache of size 168
The buggy address is located 152 bytes inside of
168-byte region [ffff888043107488, ffff888043107530)
The buggy address belongs to the physical page:
page:0000000083be8492 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x43107
flags: 0x100000000000200(slab|node=0|zone=1)
raw: 0100000000000200 ffffea0000391400 dead000000000007 ffff88800847b8c0
raw: 0000000000000000 0000000000110011 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888043107400: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc
ffff888043107480: fc fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888043107500: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fa fb
^
ffff888043107580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888043107600: fb fb fb fc fc fc fc fc fc fc fc fa fb fb fb fb
==================================================================
------------[ cut here ]------------
WARNING: CPU: 0 PID: 7493 at fs/kernfs/dir.c:504 kernfs_get.part.0+0x6d/0x80
Modules linked in:
CPU: 0 PID: 7493 Comm: syz-executor.6 Tainted: G B 6.0.0-rc3-next-20220829 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
RIP: 0010:kernfs_get.part.0+0x6d/0x80
Code: e8 b8 d9 a6 ff 85 ed 74 1c e8 ff dc a6 ff be 04 00 00 00 48 89 df e8 22 d6 d9 ff f0 ff 03 5b 5d e9 08 3d c1 02 e8 e3 dc a6 ff <0f> 0b eb db 48 89 df e8 97 d2 d9 ff eb c2 0f 1f 44 00 00 55 48 89
RSP: 0018:ffff8880469d7780 EFLAGS: 00010246
RAX: 0000000000040000 RBX: ffff888043107488 RCX: ffffc9000760e000
RDX: 0000000000040000 RSI: ffffffff819efdfd RDI: 0000000000000005
RBP: 0000000000000000 R08: 0000000000000005 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
R13: dffffc0000000000 R14: ffff8880431075b0 R15: ffff888043107488
FS: 00007fef5d439700(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f2afdcc43a4 CR3: 000000000ff4c000 CR4: 0000000000350ef0
Call Trace:
__kernfs_remove+0x34a/0xb30
kernfs_remove_by_name_ns+0xa8/0x110
sysfs_slab_add+0x142/0x1f0
__kmem_cache_create+0x49d/0x600
kmem_cache_create_usercopy+0x1fd/0x2e0
p9_client_create+0xc85/0x1050
v9fs_session_init+0x1dd/0x1670
v9fs_mount+0xb9/0xbd0
legacy_get_tree+0x105/0x220
vfs_get_tree+0x8e/0x300
path_mount+0x1310/0x1e20
__x64_sys_mount+0x282/0x300
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fef5fee4b19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fef5d439188 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fef5fff8020 RCX: 00007fef5fee4b19
RDX: 0000000020000080 RSI: 0000000020000000 RDI: 0000000000000000
RBP: 00007fef5ff3ef6d R08: 0000000020000300 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc7fa4ceef R14: 00007fef5d439300 R15: 0000000000022000
irq event stamp: 403
hardirqs last enabled at (403): [] asm_sysvec_apic_timer_interrupt+0x16/0x20
hardirqs last disabled at (402): [] __do_softirq+0x6be/0x8d0
softirqs last enabled at (238): [] __irq_exit_rcu+0x11b/0x180
softirqs last disabled at (217): [] __irq_exit_rcu+0x11b/0x180
---[ end trace 0000000000000000 ]---
blktrace: Concurrent blktraces are not allowed on sg0
general protection fault, probably for non-canonical address 0x117ebdc220076c8: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 1 PID: 112 Comm: systemd-journal Tainted: G B W 6.0.0-rc3-next-20220829 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
RIP: 0010:qlist_free_all+0xaf/0x1a0
Code: 80 4c 01 c2 0f 82 f8 00 00 00 48 c7 c0 00 00 00 80 48 2b 05 f3 3c 9b 03 48 01 d0 48 c1 e8 0c 48 c1 e0 06 48 03 05 d1 3c 9b 03 <48> 8b 48 08 48 89 c2 f6 c1 01 0f 85 ba 00 00 00 0f 1f 44 00 00 48
RSP: 0018:ffff88801873fc70 EFLAGS: 00010207
RAX: 0117ebdc220076c0 RBX: 45ffff88801db992 RCX: 1ffffffff0b5eca1
RDX: 45ffff89001db992 RSI: 0000000000000008 RDI: ffffffff81784601
RBP: 0000000000000000 R08: 45ffff88801db992 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000
R13: ffff88801873fcb0 R14: 0000000000000000 R15: ffff88800e93b801
FS: 00007fbf305b9900(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fbf2fbd3000 CR3: 000000000ec70000 CR4: 0000000000350ee0
Call Trace:
kasan_quarantine_reduce+0x184/0x210
__kasan_slab_alloc+0x7c/0x80
kmem_cache_alloc+0x1b1/0x3e0
getname_flags.part.0+0x50/0x4f0
getname+0x8e/0xd0
do_sys_openat2+0xf9/0x4c0
__x64_sys_openat+0x13f/0x1f0
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fbf30e72c64
Code: 84 00 00 00 00 00 44 89 54 24 0c e8 36 61 f9 ff 44 8b 54 24 0c 44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 89 44 24 0c e8 68 61 f9 ff 8b 44
RSP: 002b:00007ffcc62da020 EFLAGS: 00000293 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 000055d6bf48b2f0 RCX: 00007fbf30e72c64
RDX: 0000000000080000 RSI: 00007ffcc62da380 RDI: 00000000ffffff9c
RBP: 00007ffcc62da380 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000080000
R13: 000055d6bf48b2f0 R14: 0000000000000001 R15: 0000000000000014
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:qlist_free_all+0xaf/0x1a0
Code: 80 4c 01 c2 0f 82 f8 00 00 00 48 c7 c0 00 00 00 80 48 2b 05 f3 3c 9b 03 48 01 d0 48 c1 e8 0c 48 c1 e0 06 48 03 05 d1 3c 9b 03 <48> 8b 48 08 48 89 c2 f6 c1 01 0f 85 ba 00 00 00 0f 1f 44 00 00 48
RSP: 0018:ffff88801873fc70 EFLAGS: 00010207
RAX: 0117ebdc220076c0 RBX: 45ffff88801db992 RCX: 1ffffffff0b5eca1
RDX: 45ffff89001db992 RSI: 0000000000000008 RDI: ffffffff81784601
RBP: 0000000000000000 R08: 45ffff88801db992 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000
R13: ffff88801873fcb0 R14: 0000000000000000 R15: ffff88800e93b801
FS: 00007fbf305b9900(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fbf2fbd3000 CR3: 000000000ec70000 CR4: 0000000000350ee0
------------[ cut here ]------------
WARNING: CPU: 1 PID: 1 at mm/kasan/shadow.c:134 kasan_unpoison+0x46/0x50
Modules linked in:
CPU: 1 PID: 1 Comm: systemd Tainted: G B D W 6.0.0-rc3-next-20220829 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
RIP: 0010:kasan_unpoison+0x46/0x50
Code: c6 01 e8 4d fe ff ff 48 89 e8 83 e0 07 74 14 48 ba 00 00 00 00 00 fc ff df 48 01 eb 48 c1 eb 03 88 04 13 5b 5d e9 0a 65 e7 02 <0f> 0b e9 03 65 e7 02 0f 1f 00 41 57 48 89 f8 41 56 48 c1 e8 03 41
RSP: 0018:ffff8880085bf980 EFLAGS: 00010202
RAX: 0000000003102900 RBX: 0000000000000001 RCX: 0000000000000001
RDX: 0000000000000001 RSI: 0000000000000200 RDI: ffff88800e93b801
RBP: ffff888007c41c80 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: ffff88800e93b801
R13: 0000000000000dc0 R14: 0000000000000001 R15: 0000000000000000
FS: 00007f4055e55900(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fbf2fbd3000 CR3: 0000000009726000 CR4: 0000000000350ee0
Call Trace:
__kasan_slab_alloc+0x2c/0x80
__kmem_cache_alloc_node+0x1b8/0x3c0
kmalloc_trace+0x22/0x60
kernfs_fop_open+0x2fa/0xec0
do_dentry_open+0x6ca/0x12b0
path_openat+0x19e1/0x2800
do_filp_open+0x1b6/0x410
do_sys_openat2+0x171/0x4c0
__x64_sys_openat+0x13f/0x1f0
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f4056622c64
Code: 84 00 00 00 00 00 44 89 54 24 0c e8 36 61 f9 ff 44 8b 54 24 0c 44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 89 44 24 0c e8 68 61 f9 ff 8b 44
RSP: 002b:00007ffe00d31fb0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 000055b684e31bf0 RCX: 00007f4056622c64
RDX: 0000000000080000 RSI: 000055b684efb4e0 RDI: 00000000ffffff9c
RBP: 000055b684efb4e0 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000080000
R13: 000055b684e31bf0 R14: 0000000000000001 R15: 00007ffe00d32360
irq event stamp: 7161962
hardirqs last enabled at (7161961): [] _raw_write_unlock_irq+0x1f/0x50
hardirqs last disabled at (7161962): [] __schedule+0x11dd/0x24a0
softirqs last enabled at (7161792): [] __irq_exit_rcu+0x11b/0x180
softirqs last disabled at (7161645): [] __irq_exit_rcu+0x11b/0x180
---[ end trace 0000000000000000 ]---
systemd[1]: systemd-journald.service: Scheduled restart job, restart counter is at 1.
systemd[1]: Stopping Flush Journal to Persistent Storage...
systemd[1]: systemd-journal-flush.service: Succeeded.
systemd[1]: Stopped Flush Journal to Persistent Storage.
systemd[1]: Stopped Journal Service.
systemd[1]: systemd-journald.service: Consumed 8.951s CPU time.
systemd[1]: Starting Journal Service...
systemd-journald[7527]: File /var/log/journal/7e681e5076844de4a5cfa8606a84b008/system.journal corrupted or uncleanly shut down, renaming and replacing.
systemd[1]: Started Journal Service.
systemd-journald[7527]: Received client request to flush runtime journal.
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 4c 01 c2 add %r8,%rdx
3: 0f 82 f8 00 00 00 jb 0x101
9: 48 c7 c0 00 00 00 80 mov $0xffffffff80000000,%rax
10: 48 2b 05 f3 3c 9b 03 sub 0x39b3cf3(%rip),%rax # 0x39b3d0a
17: 48 01 d0 add %rdx,%rax
1a: 48 c1 e8 0c shr $0xc,%rax
1e: 48 c1 e0 06 shl $0x6,%rax
22: 48 03 05 d1 3c 9b 03 add 0x39b3cd1(%rip),%rax # 0x39b3cfa
* 29: 48 8b 48 08 mov 0x8(%rax),%rcx <-- trapping instruction
2d: 48 89 c2 mov %rax,%rdx
30: f6 c1 01 test $0x1,%cl
33: 0f 85 ba 00 00 00 jne 0xf3
39: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
3e: 48 rex.W