netlink: 60 bytes leftover after parsing attributes in process `syz-executor.6'.
==================================================================
BUG: KASAN: use-after-free in __kernfs_remove+0x9dd/0xb30
Read of size 2 at addr ffff888008c2e520 by task syz-executor.1/8364
CPU: 1 PID: 8364 Comm: syz-executor.1 Not tainted 6.0.0-rc3-next-20220829 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
dump_stack_lvl+0x8b/0xb3
print_report.cold+0x5e/0x5e5
kasan_report+0xb1/0x1c0
__kernfs_remove+0x9dd/0xb30
kernfs_remove_by_name_ns+0xa8/0x110
sysfs_slab_add+0x142/0x1f0
__kmem_cache_create+0x49d/0x600
kmem_cache_create_usercopy+0x1fd/0x2e0
p9_client_create+0xc85/0x1050
v9fs_session_init+0x1dd/0x1670
v9fs_mount+0xb9/0xbd0
legacy_get_tree+0x105/0x220
vfs_get_tree+0x8e/0x300
path_mount+0x1310/0x1e20
__x64_sys_mount+0x282/0x300
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f4827e8ab19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f4825400188 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007f4827f9df60 RCX: 00007f4827e8ab19
RDX: 0000000020000040 RSI: 0000000020000000 RDI: 0000000020100908
RBP: 00007f4827ee4f6d R08: 0000000020000240 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffffaf6652f R14: 00007f4825400300 R15: 0000000000022000
Allocated by task 8363:
kasan_save_stack+0x1e/0x40
__kasan_slab_alloc+0x66/0x80
kmem_cache_alloc+0x1b1/0x3e0
__kernfs_new_node+0xd4/0x8c0
kernfs_create_dir_ns+0x9c/0x230
sysfs_create_dir_ns+0x127/0x290
kobject_add_internal+0x24c/0x8e0
kobject_init_and_add+0x101/0x160
sysfs_slab_add+0x165/0x1f0
__kmem_cache_create+0x49d/0x600
kmem_cache_create_usercopy+0x1fd/0x2e0
p9_client_create+0xc85/0x1050
v9fs_session_init+0x1dd/0x1670
v9fs_mount+0xb9/0xbd0
legacy_get_tree+0x105/0x220
vfs_get_tree+0x8e/0x300
path_mount+0x1310/0x1e20
__x64_sys_mount+0x282/0x300
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Freed by task 8364:
kasan_save_stack+0x1e/0x40
kasan_set_track+0x21/0x30
kasan_set_free_info+0x20/0x40
__kasan_slab_free+0x108/0x190
kmem_cache_free+0xf7/0x610
kernfs_put.part.0+0x2c7/0x540
kernfs_put+0x42/0x50
__kernfs_remove+0x7d4/0xb30
kernfs_remove_by_name_ns+0xa8/0x110
sysfs_slab_add+0x142/0x1f0
__kmem_cache_create+0x49d/0x600
kmem_cache_create_usercopy+0x1fd/0x2e0
p9_client_create+0xc85/0x1050
v9fs_session_init+0x1dd/0x1670
v9fs_mount+0xb9/0xbd0
legacy_get_tree+0x105/0x220
vfs_get_tree+0x8e/0x300
path_mount+0x1310/0x1e20
__x64_sys_mount+0x282/0x300
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
The buggy address belongs to the object at ffff888008c2e488
which belongs to the cache kernfs_node_cache of size 168
The buggy address is located 152 bytes inside of
168-byte region [ffff888008c2e488, ffff888008c2e530)
The buggy address belongs to the physical page:
page:00000000654f489e refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888008c2e658 pfn:0x8c2e
netlink: 60 bytes leftover after parsing attributes in process `syz-executor.6'.
flags: 0x100000000000200(slab|node=0|zone=1)
raw: 0100000000000200 ffffea000038f8c0 dead00000000000e ffff88800847b8c0
raw: ffff888008c2e658 000000008011000f 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff888008c2e400: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc
ffff888008c2e480: fc fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888008c2e500: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fa fb
^
ffff888008c2e580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888008c2e600: fb fb fb fc fc fc fc fc fc fc fc fb fb fb fb fb
==================================================================
general protection fault, probably for non-canonical address 0x2b3ebdc220038c8: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 PID: 300 Comm: syz-executor.5 Tainted: G B 6.0.0-rc3-next-20220829 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
RIP: 0010:qlist_free_all+0xaf/0x1a0
Code: 80 4c 01 c2 0f 82 f8 00 00 00 48 c7 c0 00 00 00 80 48 2b 05 f3 3c 9b 03 48 01 d0 48 c1 e8 0c 48 c1 e0 06 48 03 05 d1 3c 9b 03 <48> 8b 48 08 48 89 c2 f6 c1 01 0f 85 ba 00 00 00 0f 1f 44 00 00 48
RSP: 0018:ffff888015437df8 EFLAGS: 00010207
RAX: 02b3ebdc220038c0 RBX: acffff88800e3197 RCX: 1ffffffff0b5eca1
RDX: acffff89000e3197 RSI: 0000000000000008 RDI: ffffffff81784601
RBP: 0000000000000000 R08: acffff88800e3197 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000
R13: ffff888015437e38 R14: 0000000000000000 R15: ffff888008c13951
FS: 0000555555c27400(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555555c30c58 CR3: 000000002340e000 CR4: 0000000000350ef0
Call Trace:
kasan_quarantine_reduce+0x184/0x210
__kasan_slab_alloc+0x7c/0x80
kmem_cache_alloc+0x1b1/0x3e0
getname_flags.part.0+0x50/0x4f0
__x64_sys_unlink+0xb1/0x110
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f0994096457
Code: 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 b8 57 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fffc2114af8 EFLAGS: 00000206 ORIG_RAX: 0000000000000057
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f0994096457
RDX: 00007fffc2114b30 RSI: 00007fffc2114b30 RDI: 00007fffc2114bc0
RBP: 00007fffc2114bc0 R08: 0000000000000001 R09: 00007fffc2114990
R10: 0000555555c28cdb R11: 0000000000000206 R12: 00007f09940f0105
R13: 00007fffc2115c80 R14: 0000555555c28c20 R15: 00007fffc2115cc0
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:qlist_free_all+0xaf/0x1a0
Code: 80 4c 01 c2 0f 82 f8 00 00 00 48 c7 c0 00 00 00 80 48 2b 05 f3 3c 9b 03 48 01 d0 48 c1 e8 0c 48 c1 e0 06 48 03 05 d1 3c 9b 03 <48> 8b 48 08 48 89 c2 f6 c1 01 0f 85 ba 00 00 00 0f 1f 44 00 00 48
RSP: 0018:ffff888015437df8 EFLAGS: 00010207
RAX: 02b3ebdc220038c0 RBX: acffff88800e3197 RCX: 1ffffffff0b5eca1
RDX: acffff89000e3197 RSI: 0000000000000008 RDI: ffffffff81784601
RBP: 0000000000000000 R08: acffff88800e3197 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000
R13: ffff888015437e38 R14: 0000000000000000 R15: ffff888008c13951
FS: 0000555555c27400(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555555c30c58 CR3: 000000002340e000 CR4: 0000000000350ef0
------------[ cut here ]------------
WARNING: CPU: 0 PID: 298 at mm/kasan/shadow.c:134 kasan_unpoison+0x46/0x50
Modules linked in:
CPU: 0 PID: 298 Comm: syz-executor.0 Tainted: G B D 6.0.0-rc3-next-20220829 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
RIP: 0010:kasan_unpoison+0x46/0x50
Code: c6 01 e8 4d fe ff ff 48 89 e8 83 e0 07 74 14 48 ba 00 00 00 00 00 fc ff df 48 01 eb 48 c1 eb 03 88 04 13 5b 5d e9 0a 65 e7 02 <0f> 0b e9 03 65 e7 02 0f 1f 00 41 57 48 89 f8 41 56 48 c1 e8 03 41
RSP: 0018:ffff88803ff67988 EFLAGS: 00010202
RAX: 0000000003102900 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000170 RDI: ffff888008c13951
RBP: ffff888007c4f780 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: ffff888008c13951
R13: 0000000000092cc0 R14: 0000000000092cc0 R15: 0000000000092cc0
FS: 00005555570e1400(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fff5eadec3c CR3: 0000000018b56000 CR4: 0000000000350ef0
Call Trace:
__kasan_slab_alloc+0x2c/0x80
kmem_cache_alloc+0x1b1/0x3e0
__create_object.isra.0+0x3d/0xc10
kmem_cache_alloc+0x23c/0x3e0
__alloc_file+0x21/0x240
alloc_empty_file+0x6d/0x170
path_openat+0xd4/0x2800
do_filp_open+0x1b6/0x410
do_sys_openat2+0x171/0x4c0
__x64_sys_openat+0x13f/0x1f0
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fbc303dd658
Code: 24 18 31 c0 41 83 e2 40 75 40 89 f0 25 00 00 41 00 3d 00 00 41 00 74 32 44 89 c2 4c 89 ce bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 40 48 8b 4c 24 18 64 48 2b 0c 25 28 00 00 00
RSP: 002b:00007fff5eadebb0 EFLAGS: 00000287 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 000000000000020d RCX: 00007fbc303dd658
RDX: 0000000000090800 RSI: 00007fff5eadfda0 RDI: 00000000ffffff9c
RBP: 00007fff5eadfd7c R08: 0000000000090800 R09: 00007fff5eadfda0
R10: 0000000000000000 R11: 0000000000000287 R12: 00007fbc30437105
R13: 00007fff5eadfda0 R14: 000000000000000b R15: 00007fff5eadfde0
irq event stamp: 1255166
hardirqs last enabled at (1255165): [] _raw_spin_unlock_irqrestore+0x28/0x60
hardirqs last disabled at (1255166): [] __schedule+0x11dd/0x24a0
softirqs last enabled at (1254644): [] fpu_clone+0x3c2/0xb00
softirqs last disabled at (1254642): [] fpu_clone+0x335/0xb00
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
WARNING: CPU: 0 PID: 8377 at kernel/rcu/tree.c:2779 call_rcu+0x6d2/0xa30
Modules linked in:
CPU: 0 PID: 8377 Comm: systemd-udevd Tainted: G B D W 6.0.0-rc3-next-20220829 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
RIP: 0010:call_rcu+0x6d2/0xa30
Code: c1 ea 03 80 3c 02 00 0f 85 c0 02 00 00 48 8b 85 a0 00 00 00 48 85 c0 0f 85 2b fa ff ff 4c 89 ff e8 d3 d6 00 00 e9 1e fa ff ff <0f> 0b e9 44 f9 ff ff e8 02 20 ff ff e9 f9 fb ff ff e8 d8 b7 46 00
RSP: 0000:ffff88806ce09db8 EFLAGS: 00010202
RAX: 0000000000000000 RBX: ffff888008c139d1 RCX: ffffffff817c1ff8
RDX: 0000000000000000 RSI: ffffffff817c1880 RDI: 0000000000000001
RBP: ffff88806ce09e40 R08: 0000000000000001 R09: ffff888008c139e4
R10: ffffed100118273c R11: 0000000000000001 R12: ffffffff817c1880
R13: ffffffff81329032 R14: ffff888018b26580 R15: ffff88800847b640
FS: 00007f4ca9d1b8c0(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555f3c555e78 CR3: 00000000102f0000 CR4: 0000000000350ef0
Call Trace:
kmem_cache_free+0xbd/0x610
rcu_core+0x7e2/0x2080
__do_softirq+0x1c8/0x8d0
__irq_exit_rcu+0x11b/0x180
irq_exit_rcu+0x5/0x20
sysvec_apic_timer_interrupt+0x8e/0xc0
asm_sysvec_apic_timer_interrupt+0x16/0x20
RIP: 0010:do_user_addr_fault+0x78f/0x1300
Code: 67 f4 ff ff 48 83 c4 38 5b 5d 41 5c 41 5d 41 5e 41 5f e9 14 a1 33 00 e8 0f a1 33 00 e8 4a 7a 3a 00 fb c7 44 24 0c 54 02 00 00 f8 fa ff ff e8 f7 a0 33 00 0f 0b eb cc e8 ee a0 33 00 e8 29 7a
RSP: 0000:ffff888017c87eb8 EFLAGS: 00000246
RAX: 0000000000000007 RBX: 0000000000000003 RCX: 1ffffffff0b5eca1
RDX: 0000000000000000 RSI: ffffffff811239d1 RDI: ffffffff811239d6
RBP: ffff888017c87f58 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000003 R11: 0000000000000001 R12: 0000000000000007
R13: 0000555f3c555e78 R14: 0000555f3c555e78 R15: ffff88801bba6200
exc_page_fault+0x98/0x1a0
asm_exc_page_fault+0x22/0x30
RIP: 0033:0x555f39f7ffbf
Code: 4e 08 48 89 fb 48 89 4c 24 28 48 89 44 24 10 48 85 c0 0f 84 d2 01 00 00 48 8b 44 24 10 48 89 43 20 48 8b 48 10 48 89 4c 24 08 <48> 89 48 08 48 85 c9 0f 84 9c 01 00 00 0f 1f 40 00 48 8b 44 24 08
RSP: 002b:00007ffe7c8e6a30 EFLAGS: 00010202
RAX: 0000555f3c555e70 RBX: 0000555f3c549d60 RCX: 0000555f3c555ee0
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000009 R08: f0eff435bd54a40c R09: 0000000000000000
R10: fad360dddfdcc239 R11: 0000000000000000 R12: 0000000000000000
R13: 0000555f3c597aa0 R14: 0000000000000000 R15: 0000555f3c5794d0
irq event stamp: 0
hardirqs last enabled at (0): [<0000000000000000>] 0x0
hardirqs last disabled at (0): [] copy_process+0x1dba/0x6dd0
softirqs last enabled at (0): [] copy_process+0x1dfe/0x6dd0
softirqs last disabled at (0): [<0000000000000000>] 0x0
---[ end trace 0000000000000000 ]---
general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#2] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
CPU: 0 PID: 13 Comm: ksoftirqd/0 Tainted: G B D W 6.0.0-rc3-next-20220829 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
RIP: 0010:rb_erase+0x3b1/0x1140
Code: 89 ee 48 89 c5 e9 01 ff ff ff 48 8d 7d 10 48 89 f8 48 c1 e8 03 80 3c 18 00 0f 85 aa 0c 00 00 4c 8b 65 10 4c 89 e0 48 c1 e8 03 <80> 3c 18 00 0f 85 9f 0c 00 00 49 8d 7c 24 08 49 8b 04 24 48 89 fa
RSP: 0018:ffff888008667c70 EFLAGS: 00010056
RAX: 0000000000000000 RBX: dffffc0000000000 RCX: ffffffff812a95a1
RDX: 1ffff11002ea4697 RSI: ffffffff87061680 RDI: ffff8880175234b8
RBP: ffff8880175234a8 R08: 0000000000000001 R09: ffff888008667c33
R10: ffffed10010ccf86 R11: 0000000000000001 R12: 0000000000000000
R13: fffffbfff0e0c2d0 R14: 0000000000000000 R15: ffffffff87061680
FS: 0000000000000000(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555f3c555e78 CR3: 00000000189ac000 CR4: 0000000000350ef0
Call Trace:
find_and_remove_object+0x81/0x170
kmemleak_free+0x21/0x40
kmem_cache_free+0xbd/0x610
rcu_core+0x7e2/0x2080
__do_softirq+0x1c8/0x8d0
run_ksoftirqd+0x31/0x60
smpboot_thread_fn+0x66f/0xa10
kthread+0x2ed/0x3a0
ret_from_fork+0x22/0x30
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:qlist_free_all+0xaf/0x1a0
Code: 80 4c 01 c2 0f 82 f8 00 00 00 48 c7 c0 00 00 00 80 48 2b 05 f3 3c 9b 03 48 01 d0 48 c1 e8 0c 48 c1 e0 06 48 03 05 d1 3c 9b 03 <48> 8b 48 08 48 89 c2 f6 c1 01 0f 85 ba 00 00 00 0f 1f 44 00 00 48
RSP: 0018:ffff888015437df8 EFLAGS: 00010207
RAX: 02b3ebdc220038c0 RBX: acffff88800e3197 RCX: 1ffffffff0b5eca1
RDX: acffff89000e3197 RSI: 0000000000000008 RDI: ffffffff81784601
RBP: 0000000000000000 R08: acffff88800e3197 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: dffffc0000000000
R13: ffff888015437e38 R14: 0000000000000000 R15: ffff888008c13951
FS: 0000000000000000(0000) GS:ffff88806ce00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000555f3c555e78 CR3: 00000000189ac000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 4c 01 c2 add %r8,%rdx
3: 0f 82 f8 00 00 00 jb 0x101
9: 48 c7 c0 00 00 00 80 mov $0xffffffff80000000,%rax
10: 48 2b 05 f3 3c 9b 03 sub 0x39b3cf3(%rip),%rax # 0x39b3d0a
17: 48 01 d0 add %rdx,%rax
1a: 48 c1 e8 0c shr $0xc,%rax
1e: 48 c1 e0 06 shl $0x6,%rax
22: 48 03 05 d1 3c 9b 03 add 0x39b3cd1(%rip),%rax # 0x39b3cfa
* 29: 48 8b 48 08 mov 0x8(%rax),%rcx <-- trapping instruction
2d: 48 89 c2 mov %rax,%rdx
30: f6 c1 01 test $0x1,%cl
33: 0f 85 ba 00 00 00 jne 0xf3
39: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
3e: 48 rex.W