Warning: Permanently added '[localhost]:60283' (ECDSA) to the list of known hosts.
2021/12/06 11:39:30 fuzzer started
2021/12/06 11:39:30 dialing manager at localhost:35719
2021/12/06 11:39:30 checking machine...
2021/12/06 11:39:30 checking revisions...
syzkaller login: [ 36.806874] kmemleak: Automatic memory scanning thread ended
2021/12/06 11:39:30 testing simple program...
[ 36.847438] cgroup: Unknown subsys name 'net'
[ 36.848637] cgroup: Unknown subsys name 'net_prio'
[ 36.850340] cgroup: Unknown subsys name 'devices'
[ 36.851650] cgroup: Unknown subsys name 'blkio'
[ 36.872067]
[ 36.872447] =========================
[ 36.873178] WARNING: held lock freed!
[ 36.873906] 5.16.0-rc3-next-20211203 #1 Not tainted
[ 36.875077] -------------------------
[ 36.876178] kworker/0:1/10 is freeing memory ffff888017ca3400-ffff888017ca35ff, with a lock still held there!
[ 36.878353] ffff888017ca3548 (&root->kernfs_rwsem){++++}-{3:3}, at: __kernfs_remove+0x627/0xb00
[ 36.880074] 3 locks held by kworker/0:1/10:
[ 36.880895] #0: ffff8880080a6138 ((wq_completion)cgroup_destroy){+.+.}-{0:0}, at: process_one_work+0x929/0x1710
[ 36.882894] #1: ffff888008197da8 ((work_completion)(&(&css->destroy_rwork)->work)){+.+.}-{0:0}, at: process_one_work+0x95d/0x1710
[ 36.885174] #2: ffff888017ca3548 (&root->kernfs_rwsem){++++}-{3:3}, at: __kernfs_remove+0x627/0xb00
[ 36.886971]
[ 36.886971] stack backtrace:
[ 36.887827] CPU: 0 PID: 10 Comm: kworker/0:1 Not tainted 5.16.0-rc3-next-20211203 #1
[ 36.889314] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
[ 36.891487] Workqueue: cgroup_destroy css_free_rwork_fn
[ 36.892515] Call Trace:
[ 36.893010]
[ 36.893438] dump_stack_lvl+0x8b/0xb3
[ 36.894165] debug_check_no_locks_freed.cold+0xa5/0xb1
[ 36.895192] ? kernfs_put.part.0+0x334/0x540
[ 36.896042] kfree+0xb3/0x5a0
[ 36.896638] ? kmem_cache_free+0xce/0x640
[ 36.897441] kernfs_put.part.0+0x334/0x540
[ 36.898258] kernfs_put+0x42/0x50
[ 36.898921] __kernfs_remove+0x7ce/0xb00
[ 36.899704] ? lock_is_held_type+0xd7/0x130
[ 36.900532] ? kernfs_next_descendant_post+0x2f0/0x2f0
[ 36.901548] ? down_write+0xde/0x150
[ 36.902267] ? down_write_killable_nested+0x180/0x180
[ 36.903258] kernfs_destroy_root+0x89/0xb0
[ 36.904070] css_free_rwork_fn+0xa28/0xf40
[ 36.904897] process_one_work+0xa30/0x1710
[ 36.905713] ? pwq_dec_nr_in_flight+0x2a0/0x2a0
[ 36.906638] ? rwlock_bug.part.0+0x90/0x90
[ 36.907458] ? _raw_spin_lock_irq+0x41/0x50
[ 36.908313] worker_thread+0x62a/0x13e0
[ 36.909095] ? process_one_work+0x1710/0x1710
[ 36.909968] kthread+0x40c/0x500
[ 36.910631] ? set_kthread_struct+0x130/0x130
[ 36.911508] ret_from_fork+0x22/0x30
[ 36.912236]
[ 36.912742] ==================================================================
[ 36.914126] BUG: KASAN: use-after-free in up_write+0x3ac/0x460
[ 36.915282] Read of size 8 at addr ffff888017ca3540 by task kworker/0:1/10
[ 36.916609]
[ 36.916918] CPU: 0 PID: 10 Comm: kworker/0:1 Not tainted 5.16.0-rc3-next-20211203 #1
[ 36.918416] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
[ 36.920651] Workqueue: cgroup_destroy css_free_rwork_fn
[ 36.921715] Call Trace:
[ 36.922229]
[ 36.922699] dump_stack_lvl+0x8b/0xb3
[ 36.923469] print_address_description.constprop.0+0x1f/0x180
[ 36.924649] ? up_write+0x3ac/0x460
[ 36.925371] ? up_write+0x3ac/0x460
[ 36.926090] kasan_report.cold+0x7f/0x11b
[ 36.926929] ? up_write+0x3ac/0x460
[ 36.927660] up_write+0x3ac/0x460
[ 36.928343] css_free_rwork_fn+0xa28/0xf40
[ 36.929181] process_one_work+0xa30/0x1710
[ 36.930018] ? pwq_dec_nr_in_flight+0x2a0/0x2a0
[ 36.930953] ? rwlock_bug.part.0+0x90/0x90
[ 36.931793] ? _raw_spin_lock_irq+0x41/0x50
[ 36.932644] worker_thread+0x62a/0x13e0
[ 36.933433] ? process_one_work+0x1710/0x1710
[ 36.934338] kthread+0x40c/0x500
[ 36.935004] ? set_kthread_struct+0x130/0x130
[ 36.935883] ret_from_fork+0x22/0x30
[ 36.936625]
[ 36.937081]
[ 36.937401] Allocated by task 282:
[ 36.938089] kasan_save_stack+0x1e/0x40
[ 36.938877] __kasan_kmalloc+0x81/0xa0
[ 36.939638] kernfs_create_root+0x4c/0x410
[ 36.940470] cgroup_setup_root+0x346/0xb60
[ 36.941302] cgroup1_get_tree+0xc1b/0x1370
[ 36.942135] vfs_get_tree+0x8e/0x2f0
[ 36.942881] path_mount+0x131b/0x1f80
[ 36.943627] __x64_sys_mount+0x27e/0x300
[ 36.944425] do_syscall_64+0x3b/0x90
[ 36.945159] entry_SYSCALL_64_after_hwframe+0x44/0xae
[ 36.946176]
[ 36.946502] Freed by task 10:
[ 36.947102] kasan_save_stack+0x1e/0x40
[ 36.947890] kasan_set_track+0x21/0x30
[ 36.948656] kasan_set_free_info+0x20/0x30
[ 36.949483] __kasan_slab_free+0x108/0x170
[ 36.950328] kfree+0xc5/0x5a0
[ 36.950941] kernfs_put.part.0+0x334/0x540
[ 36.951775] kernfs_put+0x42/0x50
[ 36.952454] __kernfs_remove+0x7ce/0xb00
[ 36.953235] kernfs_destroy_root+0x89/0xb0
[ 36.954064] css_free_rwork_fn+0xa28/0xf40
[ 36.954905] process_one_work+0xa30/0x1710
[ 36.955734] worker_thread+0x62a/0x13e0
[ 36.956514] kthread+0x40c/0x500
[ 36.957176] ret_from_fork+0x22/0x30
[ 36.957910]
[ 36.958223] The buggy address belongs to the object at ffff888017ca3400
[ 36.958223] which belongs to the cache kmalloc-512 of size 512
[ 36.960667] The buggy address is located 320 bytes inside of
[ 36.960667] 512-byte region [ffff888017ca3400, ffff888017ca3600)
[ 36.962942] The buggy address belongs to the page:
[ 36.963886] page:00000000dc58761c refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x17ca0
[ 36.965710] head:00000000dc58761c order:2 compound_mapcount:0 compound_pincount:0
[ 36.967204] flags: 0x100000000010200(slab|head|node=0|zone=1)
[ 36.968360] raw: 0100000000010200 0000000000000000 dead000000000122 ffff888007841c80
[ 36.969872] raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
[ 36.971392] page dumped because: kasan: bad access detected
[ 36.972492]
[ 36.972806] Memory state around the buggy address:
[ 36.973755] ffff888017ca3400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 36.975181] ffff888017ca3480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 36.976601] >ffff888017ca3500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 36.978013] ^
[ 36.979078] ffff888017ca3580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 36.980500] ffff888017ca3600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 36.981908] ==================================================================
[ 37.011904] cgroup: Unknown subsys name 'hugetlb'
[ 37.013090] cgroup: Unknown subsys name 'rlimit'
executing program
executing program
executing program
VM DIAGNOSIS:
11:39:31 Registers:
info registers vcpu 0
RAX=000000000000002d RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8
RSI=ffffffff823640e1 RDI=ffffffff87381a60 RBP=ffffffff87381a20 RSP=ffff888008197648
R8 =0000000000000000 R9 =000000000000002d R10=ffffffff82365d23 R11=000000000000000a
R12=000000000000002d R13=000000000000002d R14=ffffffff87381a20 R15=dffffc0000000000
RIP=ffffffff82364138 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 0000000000000000 00000000 00000000
GS =0000 ffff88806ce00000 00000000 00000000
LDT=0000 fffffe0000000000 00000000 00000000
TR =0040 fffffe0000003000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000001000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00007f5cfd2aa6d0 CR3=000000000d594000 CR4=00350ef0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001fa0
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
YMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM02=0000000000000000 0000000000000000 0000000000000000 bfe62e42fefa39ef
YMM03=0000000000000000 0000000000000000 0000ff0000000000 0000000000000000
YMM04=0000000000000000 0000000000000000 732f6c61636f6c2f 7273752f3d485441
YMM05=0000000000000000 0000000000000000 622f6c61636f6c2f 7273752f3a6e6962
YMM06=0000000000000000 0000000000000000 73752f3a6e696273 2f7273752f3a6e69
YMM07=0000000000000000 0000000000000000 6e69622f3a6e6962 732f3a6e69622f72
YMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000
info registers vcpu 1
RAX=ffffffff84078af0 RBX=ffff8880081a9ac0 RCX=ffffffff8405abe1 RDX=ffffed100d9e7143
RSI=0000000000000001 RDI=ffffffff84078eaf RBP=0000000000000001 RSP=ffff888008207e78
R8 =0000000000000000 R9 =ffff88806cf38a13 R10=ffffed100d9e7142 R11=0000000000000001
R12=ffffed1001035358 R13=ffffffff858bd8d0 R14=0000000000000000 R15=dffffc0000000000
RIP=ffffffff84078afb RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=1
ES =0000 0000000000000000 00000000 00000000
CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA]
SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA]
DS =0000 0000000000000000 00000000 00000000
FS =0000 0000000000000000 00000000 00000000
GS =0000 ffff88806cf00000 00000000 00000000
LDT=0000 fffffe0000000000 00000000 00000000
TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy
GDT= fffffe0000048000 0000007f
IDT= fffffe0000000000 00000fff
CR0=80050033 CR2=00007fff17b80e88 CR3=000000000d594000 CR4=00350ee0
DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000
DR6=00000000ffff0ff0 DR7=0000000000000400
EFER=0000000000000d01
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001fa0
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
YMM00=0000000000000000 0000000000000000 0000000000000000 41434d3df2e6836b
YMM01=0000000000000000 0000000000000000 0000000000000000 3f847ae147ae147b
YMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000
YMM03=0000000000000000 0000000000000000 0000000000000000 3f73e80e496c8eee
YMM04=0000000000000000 0000000000000000 00007ffa70c37c00 0000000000415710
YMM05=0000000000000000 0000000000000000 000000c0000922b0 000000c000095668
YMM06=0000000000000000 0000000000000000 0000000000505007 000000c0002587c0
YMM07=0000000000000000 0000000000000000 000000c000094780 000000c0000922e0
YMM08=0000000000000000 0000000000000000 000000c000092310 000000c0000922f0
YMM09=0000000000000000 0000000000000000 00000000004643c1 0000000000000000
YMM10=0000000000000000 0000000000000000 000000c000084e00 000000c00018a6e0
YMM11=0000000000000000 0000000000000000 000000c0000947c0 000000c000092370
YMM12=0000000000000000 0000000000000000 000000c0000947d0 000000c0000947c8
YMM13=0000000000000000 0000000000000000 000000c00001c210 000000c00001c200
YMM14=0000000000000000 0000000000000000 000000c00001c1d0 000000c00001c1e0
YMM15=0000000000000000 0000000000000000 000000c000528000 000000c00001c4c0