Debian GNU/Linux 11 syzkaller ttyS0
Warning: Permanently added '[localhost]:29520' (ECDSA) to the list of known hosts.
2021/12/06 11:40:02 fuzzer started
2021/12/06 11:40:02 dialing manager at localhost:35719
2021/12/06 11:40:02 checking machine...
2021/12/06 11:40:02 checking revisions...
syzkaller login: [ 28.241169] kmemleak: Automatic memory scanning thread ended
2021/12/06 11:40:02 testing simple program...
[ 28.280517] cgroup: Unknown subsys name 'net'
[ 28.282964] cgroup: Unknown subsys name 'net_prio'
[ 28.284915] cgroup: Unknown subsys name 'devices'
[ 28.286247] cgroup: Unknown subsys name 'blkio'
[ 28.315336]
[ 28.315766] =========================
[ 28.316611] WARNING: held lock freed!
[ 28.317160] 5.16.0-rc3-next-20211203 #1 Not tainted
[ 28.317877] -------------------------
[ 28.318604] kworker/1:3/84 is freeing memory ffff88800f839800-ffff88800f8399ff, with a lock still held there!
[ 28.320930] ffff88800f839948 (&root->kernfs_rwsem){++++}-{3:3}, at: __kernfs_remove+0x627/0xb00
[ 28.322291] 3 locks held by kworker/1:3/84:
[ 28.322943] #0: ffff8880080a6138 ((wq_completion)cgroup_destroy){+.+.}-{0:0}, at: process_one_work+0x929/0x1710
[ 28.324532] #1: ffff88800f8d7da8 ((work_completion)(&(&css->destroy_rwork)->work)){+.+.}-{0:0}, at: process_one_work+0x95d/0x1710
[ 28.326351] #2: ffff88800f839948 (&root->kernfs_rwsem){++++}-{3:3}, at: __kernfs_remove+0x627/0xb00
[ 28.327767]
[ 28.327767] stack backtrace:
[ 28.328455] CPU: 1 PID: 84 Comm: kworker/1:3 Not tainted 5.16.0-rc3-next-20211203 #1
[ 28.329636] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
[ 28.331390] Workqueue: cgroup_destroy css_free_rwork_fn
[ 28.332221] Call Trace:
[ 28.332610]
[ 28.332949] dump_stack_lvl+0x8b/0xb3
[ 28.333533] debug_check_no_locks_freed.cold+0xa5/0xb1
[ 28.334337] ? kernfs_put.part.0+0x334/0x540
[ 28.335022] kfree+0xb3/0x5a0
[ 28.335488] ? kmem_cache_free+0xce/0x640
[ 28.336104] kernfs_put.part.0+0x334/0x540
[ 28.336764] kernfs_put+0x42/0x50
[ 28.337290] __kernfs_remove+0x7ce/0xb00
[ 28.337918] ? lock_is_held_type+0xd7/0x130
[ 28.338586] ? kernfs_next_descendant_post+0x2f0/0x2f0
[ 28.339392] ? down_write+0xde/0x150
[ 28.339959] ? down_write_killable_nested+0x180/0x180
[ 28.340758] kernfs_destroy_root+0x89/0xb0
[ 28.341416] css_free_rwork_fn+0xa28/0xf40
[ 28.342086] process_one_work+0xa30/0x1710
[ 28.342732] ? pwq_dec_nr_in_flight+0x2a0/0x2a0
[ 28.343457] ? rwlock_bug.part.0+0x90/0x90
[ 28.344101] ? _raw_spin_lock_irq+0x41/0x50
[ 28.344770] worker_thread+0x62a/0x13e0
[ 28.345390] ? process_one_work+0x1710/0x1710
[ 28.346088] kthread+0x40c/0x500
[ 28.346605] ? set_kthread_struct+0x130/0x130
[ 28.347281] ret_from_fork+0x22/0x30
[ 28.347865]
[ 28.348333] ==================================================================
[ 28.349439] BUG: KASAN: use-after-free in up_write+0x3ac/0x460
[ 28.350337] Read of size 8 at addr ffff88800f839940 by task kworker/1:3/84
[ 28.351405]
[ 28.351655] CPU: 1 PID: 84 Comm: kworker/1:3 Not tainted 5.16.0-rc3-next-20211203 #1
[ 28.352875] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
[ 28.354634] Workqueue: cgroup_destroy css_free_rwork_fn
[ 28.355429] Call Trace:
[ 28.355804]
[ 28.356142] dump_stack_lvl+0x8b/0xb3
[ 28.356712] print_address_description.constprop.0+0x1f/0x180
[ 28.357581] ? up_write+0x3ac/0x460
[ 28.358125] ? up_write+0x3ac/0x460
[ 28.358657] kasan_report.cold+0x7f/0x11b
[ 28.359262] ? up_write+0x3ac/0x460
[ 28.359812] up_write+0x3ac/0x460
[ 28.360354] css_free_rwork_fn+0xa28/0xf40
[ 28.360984] process_one_work+0xa30/0x1710
[ 28.361600] ? pwq_dec_nr_in_flight+0x2a0/0x2a0
[ 28.362265] ? rwlock_bug.part.0+0x90/0x90
[ 28.362851] ? _raw_spin_lock_irq+0x41/0x50
[ 28.363460] worker_thread+0x62a/0x13e0
[ 28.364024] ? process_one_work+0x1710/0x1710
[ 28.364655] kthread+0x40c/0x500
[ 28.365135] ? set_kthread_struct+0x130/0x130
[ 28.365767] ret_from_fork+0x22/0x30
[ 28.366328]
[ 28.366675]
[ 28.366914] Allocated by task 281:
[ 28.367435] kasan_save_stack+0x1e/0x40
[ 28.368019] __kasan_kmalloc+0x81/0xa0
[ 28.368605] kernfs_create_root+0x4c/0x410
[ 28.369227] cgroup_setup_root+0x346/0xb60
[ 28.369866] cgroup1_get_tree+0xc1b/0x1370
[ 28.370503] vfs_get_tree+0x8e/0x2f0
[ 28.371056] path_mount+0x131b/0x1f80
[ 28.371630] __x64_sys_mount+0x27e/0x300
[ 28.372247] do_syscall_64+0x3b/0x90
[ 28.372795] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 28.373571]
[ 28.373810] Freed by task 84:
[ 28.374272] kasan_save_stack+0x1e/0x40
[ 28.374866] kasan_set_track+0x21/0x30
[ 28.375436] kasan_set_free_info+0x20/0x30
[ 28.376064] __kasan_slab_free+0x108/0x170
[ 28.376706] kfree+0xc5/0x5a0
[ 28.377158] kernfs_put.part.0+0x334/0x540
[ 28.377779] kernfs_put+0x42/0x50
[ 28.378295] __kernfs_remove+0x7ce/0xb00
[ 28.378903] kernfs_destroy_root+0x89/0xb0
[ 28.379521] css_free_rwork_fn+0xa28/0xf40
[ 28.380157] process_one_work+0xa30/0x1710
[ 28.380777] worker_thread+0x62a/0x13e0
[ 28.381349] kthread+0x40c/0x500
[ 28.381846] ret_from_fork+0x22/0x30
[ 28.382400]
[ 28.382642] The buggy address belongs to the object at ffff88800f839800
[ 28.382642] which belongs to the cache kmalloc-512 of size 512
[ 28.384471] The buggy address is located 320 bytes inside of
[ 28.384471] 512-byte region [ffff88800f839800, ffff88800f839a00)
[ 28.386218] The buggy address belongs to the page:
[ 28.386918] page:00000000a82fed62 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xf838
[ 28.388318] head:00000000a82fed62 order:2 compound_mapcount:0 compound_pincount:0
[ 28.389426] flags: 0x100000000010200(slab|head|node=0|zone=1)
[ 28.390285] raw: 0100000000010200 ffffea00003a0b00 dead000000000002 ffff888007841c80
[ 28.391438] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
[ 28.392579] page dumped because: kasan: bad access detected
[ 28.393406]
[ 28.393642] Memory state around the buggy address:
[ 28.394352] ffff88800f839800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 28.395420] ffff88800f839880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 28.396494] >ffff88800f839900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 28.397536] ^
[ 28.398326] ffff88800f839980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 28.399396] ffff88800f839a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 28.400477] ==================================================================
[ 28.429969] cgroup: Unknown subsys name 'hugetlb'
[ 28.433003] cgroup: Unknown subsys name 'rlimit'
executing program
executing program
executing program
VM DIAGNOSIS:
11:40:02 Registers:
info registers vcpu 0
RAX=ffffc90000660000 RBX=ffff888008468c00 RCX=1ffff1100108d260 RDX=1ffff1100108d1c6
RSI=0000000000000004 RDI=ffff888008469300 RBP=1ffff1100102cf75 RSP=ffff888008167b30
R8 =0000000000000001 R9 =ffff888008167aa3 R10=ffffed100102cf54 R11=0000000000000001
R12=ffff888008468e18 R13=0000000000000000 R14=ffff888008468000 R15=ffff888008468c00
RIP=ffffffff82cd298e RFL=00000046 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 0000000000000000 00000000 00000000
GS =0000 ffff88806ce00000 00000000 00000000
LDT=0000 fffffe0000000000 00000000 00000000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000001000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00007f3906f93670 CR3=000000000db5e000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
YMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM01=0000000000000000 0000000000000000 2750f9f7e697c1b5 9e4760a53afb441e
YMM02=0000000000000000 0000000000000000 1210b8ba71c28343 0000000000115bf0
YMM03=0000000000000000 0000000000000000 fb95278e6d9742a2 000000000012bbb8
YMM04=0000000000000000 0000000000000000 829992bedefcecb9 00000000000ae980
YMM05=0000000000000000 0000000000000000 9ebfcf3a7e7141ea 000000000012bc28
YMM06=0000000000000000 0000000000000000 698e0f81b0932b79 000000000012bb60
YMM07=0000000000000000 0000000000000000 e45775b7bd281a64 0000000000115b90
YMM08=0000000000000000 0000000000000000 e2de77aa903facfa 0000000000115ae0
YMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM10=0000000000000000 0000000000000000 2020000000002020 2020202020200000
YMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000
info registers vcpu 1
RAX=0000000000000066 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8
RSI=ffffffff823640e1 RDI=ffffffff87381a60 RBP=ffffffff87381a20 RSP=ffff88800f8d7648
R8 =0000000000000000 R9 =0000000000000066 R10=ffffffff82365d23 R11=000000000000000a
R12=0000000000000066 R13=0000000000000066 R14=ffffffff87381a20 R15=dffffc0000000000
RIP=ffffffff82364138 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 0000000000000000 00000000 00000000
GS =0000 ffff88806cf00000 00000000 00000000
LDT=0000 fffffe0000000000 00000000 00000000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000048000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=000000c00076a000 CR3=000000000e70a000 CR4=00350ee0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
YMM00=0000000000000000 0000000000000000 2032303a30343a31 3120362020636544
YMM01=0000000000000000 0000000000000000 2d70756f7267637a 7973203a5d315b64
YMM02=0000000000000000 0000000000000000 6f6d2e74656e2d70 756f7267637a7973
YMM03=0000000000000000 0000000000000000 6c616b7a79732032 303a30343a313120
YMM04=0000000000000000 0000000000000000 6966206863757320 6f4e203a656c6163
YMM05=0000000000000000 0000000000000000 3a656c696620766e 65206e65706f206f
YMM06=0000000000000000 0000000000000000 65733a6468737328 766e655f6d617020
YMM07=0000000000000000 0000000000000000 6b7a79732032303a 30343a3131203620
YMM08=0000000000000000 0000000000000000 3d656e696c646d63 2022656369767265
YMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000