==================================================================
BUG: KASAN: use-after-free in __kernfs_remove+0x9dd/0xb30
Read of size 2 at addr ffff88803d0c3e30 by task syz-executor.1/66719
CPU: 0 PID: 66719 Comm: syz-executor.1 Not tainted 6.0.0-rc3-next-20220829 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
dump_stack_lvl+0x8b/0xb3
print_report.cold+0x5e/0x5e5
kasan_report+0xb1/0x1c0
__kernfs_remove+0x9dd/0xb30
kernfs_remove_by_name_ns+0xa8/0x110
sysfs_slab_add+0x142/0x1f0
__kmem_cache_create+0x49d/0x600
kmem_cache_create_usercopy+0x1fd/0x2e0
p9_client_create+0xc85/0x1050
v9fs_session_init+0x1dd/0x1670
v9fs_mount+0xb9/0xbd0
legacy_get_tree+0x105/0x220
vfs_get_tree+0x8e/0x300
path_mount+0x1310/0x1e20
__x64_sys_mount+0x282/0x300
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fd115282b19
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fd1127f8188 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5
RAX: ffffffffffffffda RBX: 00007fd115395f60 RCX: 00007fd115282b19
RDX: 0000000020000100 RSI: 00000000200000c0 RDI: 0000000000000000
RBP: 00007fd1152dcf6d R08: 00000000200001c0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffc8621db7f R14: 00007fd1127f8300 R15: 0000000000022000
Allocated by task 66671:
kasan_save_stack+0x1e/0x40
__kasan_slab_alloc+0x66/0x80
kmem_cache_alloc+0x1b1/0x3e0
__kernfs_new_node+0xd4/0x8c0
kernfs_create_dir_ns+0x9c/0x230
sysfs_create_dir_ns+0x127/0x290
kobject_add_internal+0x24c/0x8e0
kobject_init_and_add+0x101/0x160
sysfs_slab_add+0x165/0x1f0
__kmem_cache_create+0x49d/0x600
kmem_cache_create_usercopy+0x1fd/0x2e0
p9_client_create+0xc85/0x1050
v9fs_session_init+0x1dd/0x1670
v9fs_mount+0xb9/0xbd0
legacy_get_tree+0x105/0x220
vfs_get_tree+0x8e/0x300
path_mount+0x1310/0x1e20
__x64_sys_mount+0x282/0x300
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Freed by task 66719:
kasan_save_stack+0x1e/0x40
kasan_set_track+0x21/0x30
kasan_set_free_info+0x20/0x40
__kasan_slab_free+0x108/0x190
kmem_cache_free+0xf7/0x610
kernfs_put.part.0+0x2c7/0x540
kernfs_put+0x42/0x50
__kernfs_remove+0x7d4/0xb30
kernfs_remove_by_name_ns+0xa8/0x110
sysfs_slab_add+0x142/0x1f0
__kmem_cache_create+0x49d/0x600
kmem_cache_create_usercopy+0x1fd/0x2e0
p9_client_create+0xc85/0x1050
v9fs_session_init+0x1dd/0x1670
v9fs_mount+0xb9/0xbd0
legacy_get_tree+0x105/0x220
vfs_get_tree+0x8e/0x300
path_mount+0x1310/0x1e20
__x64_sys_mount+0x282/0x300
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
The buggy address belongs to the object at ffff88803d0c3d98
which belongs to the cache kernfs_node_cache of size 168
The buggy address is located 152 bytes inside of
168-byte region [ffff88803d0c3d98, ffff88803d0c3e40)
The buggy address belongs to the physical page:
page:00000000be6c23b5 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3d0c3
flags: 0x100000000000200(slab|node=0|zone=1)
raw: 0100000000000200 ffffea0000ed2040 dead000000000008 ffff88800847b8c0
raw: 0000000000000000 0000000000110011 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88803d0c3d00: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc
ffff88803d0c3d80: fc fc fc fa fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88803d0c3e00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
^
ffff88803d0c3e80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88803d0c3f00: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Process accounting resumed
general protection fault, probably for non-canonical address 0x27febdc22003788: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 1 PID: 256 Comm: sshd Tainted: G B 6.0.0-rc3-next-20220829 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
RIP: 0010:qlist_free_all+0xaf/0x1a0
Code: 80 4c 01 c2 0f 82 f8 00 00 00 48 c7 c0 00 00 00 80 48 2b 05 f3 3c 9b 03 48 01 d0 48 c1 e8 0c 48 c1 e0 06 48 03 05 d1 3c 9b 03 <48> 8b 48 08 48 89 c2 f6 c1 01 0f 85 ba 00 00 00 0f 1f 44 00 00 48
RSP: 0018:ffff888018587838 EFLAGS: 00010203
RAX: 027febdc22003780 RBX: 9fffff88800de6b0 RCX: 00000000000c0008
RDX: 9fffff89000de6b0 RSI: ffffea0000e37a00 RDI: 0000000040000000
RBP: 0000000000000000 R08: 9fffff88800de6b0 R09: 00000000000c0008
R10: ffffea0000e37a00 R11: 0000000000000000 R12: dffffc0000000000
R13: ffff888018587878 R14: 0000000000000000 R15: ffff888038de8141
FS: 00007fad0dd13900(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa76c188b11 CR3: 000000001ecbe000 CR4: 0000000000350ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff4ff0 DR7: 0000000000000400
Call Trace:
kasan_quarantine_reduce+0x184/0x210
__kasan_slab_alloc+0x7c/0x80
kmem_cache_alloc+0x1b1/0x3e0
__create_object.isra.0+0x3d/0xc10
kmem_cache_alloc_node+0x246/0x3e0
__alloc_skb+0x210/0x300
tcp_stream_alloc_skb+0x38/0x580
tcp_sendmsg_locked+0xc10/0x3030
tcp_sendmsg+0x2b/0x50
inet_sendmsg+0xb5/0x140
sock_sendmsg+0x13c/0x190
sock_write_iter+0x299/0x3e0
vfs_write+0x9c3/0xd90
ksys_write+0x1f0/0x250
do_syscall_64+0x3b/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fad0e1f5f33
Code: 8b 15 61 ef 0c 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b7 0f 1f 00 64 8b 04 25 18 00 00 00 85 c0 75 14 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 55 c3 0f 1f 40 00 48 83 ec 28 48 89 54 24 18
RSP: 002b:00007fff517937b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 000000000000004c RCX: 00007fad0e1f5f33
RDX: 000000000000004c RSI: 0000556173845b80 RDI: 0000000000000004
RBP: 00005561738120f0 R08: 0000000000000277 R09: 00007fff517f1080
R10: 00007fff517f10f0 R11: 0000000000000246 R12: 0000556171904768
R13: 0000000000000000 R14: 0000000000000004 R15: 00005561718b9a80
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:qlist_free_all+0xaf/0x1a0
Code: 80 4c 01 c2 0f 82 f8 00 00 00 48 c7 c0 00 00 00 80 48 2b 05 f3 3c 9b 03 48 01 d0 48 c1 e8 0c 48 c1 e0 06 48 03 05 d1 3c 9b 03 <48> 8b 48 08 48 89 c2 f6 c1 01 0f 85 ba 00 00 00 0f 1f 44 00 00 48
RSP: 0018:ffff888018587838 EFLAGS: 00010203
RAX: 027febdc22003780 RBX: 9fffff88800de6b0 RCX: 00000000000c0008
RDX: 9fffff89000de6b0 RSI: ffffea0000e37a00 RDI: 0000000040000000
RBP: 0000000000000000 R08: 9fffff88800de6b0 R09: 00000000000c0008
R10: ffffea0000e37a00 R11: 0000000000000000 R12: dffffc0000000000
R13: ffff888018587878 R14: 0000000000000000 R15: ffff888038de8141
FS: 00007fad0dd13900(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa76c188b11 CR3: 000000001ecbe000 CR4: 0000000000350ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff4ff0 DR7: 0000000000000400
------------[ cut here ]------------
WARNING: CPU: 1 PID: 6236 at mm/kasan/shadow.c:134 kasan_unpoison+0x46/0x50
Modules linked in:
CPU: 1 PID: 6236 Comm: syz-executor.3 Tainted: G B D 6.0.0-rc3-next-20220829 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
RIP: 0010:kasan_unpoison+0x46/0x50
Code: c6 01 e8 4d fe ff ff 48 89 e8 83 e0 07 74 14 48 ba 00 00 00 00 00 fc ff df 48 01 eb 48 c1 eb 03 88 04 13 5b 5d e9 0a 65 e7 02 <0f> 0b e9 03 65 e7 02 0f 1f 00 41 57 48 89 f8 41 56 48 c1 e8 03 41
RSP: 0018:ffff88803bf3f700 EFLAGS: 00010202
RAX: 0000000003102900 RBX: 0000000000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 00000000000000f0 RDI: ffff888038de8141
RBP: ffff888008480dc0 R08: 0000000000000000 R09: ffffffff85af5517
R10: 0000000000000000 R11: 0000000000000001 R12: ffff888038de8141
R13: 0000000000000cc0 R14: 0000000000000cc0 R15: 0000000000000cc0
FS: 0000000000000000(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000564cc2c6a000 CR3: 000000000dc6a000 CR4: 0000000000350ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff4ff0 DR7: 0000000000000400
Call Trace:
__kasan_slab_alloc+0x2c/0x80
kmem_cache_alloc+0x1b1/0x3e0
skb_clone+0x16e/0x3c0
netlink_broadcast+0x88b/0xd90
kobject_uevent_env+0xa6f/0xfb0
device_del+0x9dd/0xfd0
rfkill_unregister+0xd1/0x240
hci_unregister_dev+0x1e9/0x380
vhci_release+0x7c/0xf0
__fput+0x263/0xa40
task_work_run+0x170/0x280
do_exit+0xc37/0x2940
do_group_exit+0xd0/0x2a0
get_signal+0x2205/0x24b0
arch_do_signal_or_restart+0x89/0x1be0
exit_to_user_mode_prepare+0x131/0x1a0
syscall_exit_to_user_mode+0x19/0x40
do_syscall_64+0x48/0x90
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fa76c1e1b19
Code: Unable to access opcode bytes at RIP 0x7fa76c1e1aef.
RSP: 002b:00007fa769757218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007fa76c2f4f68 RCX: 00007fa76c1e1b19
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fa76c2f4f68
RBP: 00007fa76c2f4f60 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fa76c2f4f6c
R13: 00007ffd6d7455df R14: 00007fa769757300 R15: 0000000000022000
irq event stamp: 202
hardirqs last enabled at (201): [] syscall_enter_from_user_mode+0x1d/0x50
hardirqs last disabled at (202): [] __schedule+0x11dd/0x24a0
softirqs last enabled at (0): [] copy_process+0x1dfe/0x6dd0
softirqs last disabled at (0): [<0000000000000000>] 0x0
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 4c 01 c2 add %r8,%rdx
3: 0f 82 f8 00 00 00 jb 0x101
9: 48 c7 c0 00 00 00 80 mov $0xffffffff80000000,%rax
10: 48 2b 05 f3 3c 9b 03 sub 0x39b3cf3(%rip),%rax # 0x39b3d0a
17: 48 01 d0 add %rdx,%rax
1a: 48 c1 e8 0c shr $0xc,%rax
1e: 48 c1 e0 06 shl $0x6,%rax
22: 48 03 05 d1 3c 9b 03 add 0x39b3cd1(%rip),%rax # 0x39b3cfa
* 29: 48 8b 48 08 mov 0x8(%rax),%rcx <-- trapping instruction
2d: 48 89 c2 mov %rax,%rdx
30: f6 c1 01 test $0x1,%cl
33: 0f 85 ba 00 00 00 jne 0xf3
39: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
3e: 48 rex.W