================================================================== BUG: KASAN: slab-use-after-free in kernfs_test_super+0x120/0x140 Read of size 8 at addr ffff88800b7edf88 by task syz-executor.1/67372 CPU: 1 PID: 67372 Comm: syz-executor.1 Not tainted 6.5.0-rc7-next-20230824 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.12.0-1 04/01/2014 Call Trace: dump_stack_lvl+0x91/0xf0 print_report+0xcc/0x620 kasan_report+0xbe/0xf0 kernfs_test_super+0x120/0x140 sget_fc+0x1e0/0x920 kernfs_get_tree+0x196/0x950 sysfs_get_tree+0x41/0x140 vfs_get_tree+0x96/0x380 path_mount+0x133c/0x1e50 __x64_sys_mount+0x286/0x310 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 RIP: 0033:0x7fc10860bb19 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fc105b81188 EFLAGS: 00000246 ORIG_RAX: 00000000000000a5 RAX: ffffffffffffffda RBX: 00007fc10871ef60 RCX: 00007fc10860bb19 RDX: 0000000020000a00 RSI: 0000000020000840 RDI: 0000000000000000 RBP: 00007fc108665f6d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffd6231136f R14: 00007fc105b81300 R15: 0000000000022000 Allocated by task 67318: kasan_save_stack+0x22/0x50 kasan_set_track+0x25/0x30 __kasan_kmalloc+0x7f/0x90 kernfs_get_tree+0x78/0x950 sysfs_get_tree+0x41/0x140 vfs_get_tree+0x96/0x380 path_mount+0x133c/0x1e50 __x64_sys_mount+0x286/0x310 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Freed by task 37085: kasan_save_stack+0x22/0x50 kasan_set_track+0x25/0x30 kasan_save_free_info+0x2b/0x50 __kasan_slab_free+0x10a/0x190 __kmem_cache_free+0xe1/0x330 sysfs_kill_sb+0x22/0x40 deactivate_locked_super+0xa3/0x2d0 deactivate_super+0xb1/0xd0 cleanup_mnt+0x2ae/0x3d0 task_work_run+0x174/0x280 exit_to_user_mode_prepare+0x17d/0x180 syscall_exit_to_user_mode+0x1d/0x50 do_syscall_64+0x4c/0x90 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Last potentially related work creation: kasan_save_stack+0x22/0x50 __kasan_record_aux_stack+0x8e/0xa0 __call_rcu_common.constprop.0+0x6a/0xbd0 tracepoint_probe_unregister+0x4fc/0xc60 trace_event_reg+0x185/0x350 perf_trace_event_unreg.isra.0+0xae/0x1e0 perf_trace_destroy+0xc8/0x1c0 _free_event+0x207/0x1190 perf_event_release_kernel+0x5b8/0x7a0 perf_release+0x37/0x50 __fput+0x400/0xa70 __fput_sync+0x45/0x50 __x64_sys_close+0x8c/0x120 do_syscall_64+0x3f/0x90 entry_SYSCALL_64_after_hwframe+0x6e/0xd8 Second to last potentially related work creation: kasan_save_stack+0x22/0x50 __kasan_record_aux_stack+0x8e/0xa0 kvfree_call_rcu+0x29/0x900 cfg80211_update_known_bss+0x822/0xa70 __cfg80211_bss_update+0xd5/0x20b0 cfg80211_inform_single_bss_frame_data+0x73d/0xf90 cfg80211_inform_bss_frame_data+0xc2/0x290 ieee80211_bss_info_update+0x371/0x9b0 ieee80211_ibss_rx_queued_mgmt+0x198e/0x2e70 ieee80211_iface_work+0x9bf/0xcb0 cfg80211_wiphy_work+0x1f7/0x290 process_one_work+0x7c8/0x1450 worker_thread+0x80e/0x1190 kthread+0x33f/0x440 ret_from_fork+0x48/0x80 ret_from_fork_asm+0x1b/0x30 The buggy address belongs to the object at ffff88800b7edf80 which belongs to the cache kmalloc-64 of size 64 The buggy address is located 8 bytes inside of freed 64-byte region [ffff88800b7edf80, ffff88800b7edfc0) The buggy address belongs to the physical page: page:000000006c6f8bf0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xb7ed anon flags: 0x100000000000800(slab|node=0|zone=1) page_type: 0xffffffff() raw: 0100000000000800 ffff888008441640 ffffea0000561140 dead000000000003 raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88800b7ede80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff88800b7edf00: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc >ffff88800b7edf80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ^ ffff88800b7ee000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff88800b7ee080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc ================================================================== EXT4-fs warning (device sda): verify_group_input:150: Cannot add at group 1280 (only 16 groups) EXT4-fs warning (device sda): verify_group_input:150: Cannot add at group 1280 (only 16 groups) EXT4-fs warning (device sda): verify_group_input:150: Cannot add at group 1280 (only 16 groups) EXT4-fs warning (device sda): verify_group_input:150: Cannot add at group 1280 (only 16 groups) sr 1:0:0:0: [sr0] tag#0 unaligned transfer blk_print_req_error: 104 callbacks suppressed I/O error, dev sr0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 buffer_io_error: 174 callbacks suppressed Buffer I/O error on dev sr0, logical block 0, async page read sr 1:0:0:0: [sr0] tag#0 unaligned transfer I/O error, dev sr0, sector 1 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 Buffer I/O error on dev sr0, logical block 1, async page read sr 1:0:0:0: [sr0] tag#0 unaligned transfer I/O error, dev sr0, sector 2 op 0x0:(READ) flags 0x0 phys_seg 6 prio class 2 Buffer I/O error on dev sr0, logical block 2, async page read Buffer I/O error on dev sr0, logical block 3, async page read Buffer I/O error on dev sr0, logical block 4, async page read Buffer I/O error on dev sr0, logical block 5, async page read Buffer I/O error on dev sr0, logical block 6, async page read Buffer I/O error on dev sr0, logical block 7, async page read sr 1:0:0:0: [sr0] tag#0 unaligned transfer I/O error, dev sr0, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 Buffer I/O error on dev sr0, logical block 0, async page read sr 1:0:0:0: [sr0] tag#0 unaligned transfer I/O error, dev sr0, sector 1 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 Buffer I/O error on dev sr0, logical block 1, async page read sr 1:0:0:0: [sr0] tag#0 unaligned transfer I/O error, dev sr0, sector 2 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 sr 1:0:0:0: [sr0] tag#0 unaligned transfer I/O error, dev sr0, sector 3 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 sr 1:0:0:0: [sr0] tag#0 unaligned transfer I/O error, dev sr0, sector 4 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 sr 1:0:0:0: [sr0] tag#0 unaligned transfer I/O error, dev sr0, sector 5 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 sr 1:0:0:0: [sr0] tag#0 unaligned transfer I/O error, dev sr0, sector 6 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s sr 1:0:0:0: [sr0] tag#0 Sense Key : Not Ready [current] sr 1:0:0:0: [sr0] tag#0 Add. Sense: Medium not present sr 1:0:0:0: [sr0] tag#0 CDB: Read(10) 28 00 00 00 00 00 00 00 02 00 sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer EXT4-fs warning (device sda): verify_group_input:150: Cannot add at group 1280 (only 16 groups) EXT4-fs warning (device sda): verify_group_input:150: Cannot add at group 1280 (only 16 groups) EXT4-fs warning (device sda): verify_group_input:150: Cannot add at group 1280 (only 16 groups) sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer EXT4-fs warning (device sda): verify_group_input:150: Cannot add at group 1280 (only 16 groups) sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer EXT4-fs warning (device sda): verify_group_input:150: Cannot add at group 1280 (only 16 groups) sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s sr 1:0:0:0: [sr0] tag#0 Sense Key : Not Ready [current] sr 1:0:0:0: [sr0] tag#0 Add. Sense: Medium not present sr 1:0:0:0: [sr0] tag#0 CDB: Read(10) 28 00 00 00 00 01 00 00 01 00 sr 1:0:0:0: [sr0] tag#0 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s sr 1:0:0:0: [sr0] tag#0 Sense Key : Not Ready [current] sr 1:0:0:0: [sr0] tag#0 Add. Sense: Medium not present sr 1:0:0:0: [sr0] tag#0 CDB: Read(10) 28 00 00 00 00 00 00 00 02 00 sr 1:0:0:0: [sr0] tag#0 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s sr 1:0:0:0: [sr0] tag#0 Sense Key : Not Ready [current] sr 1:0:0:0: [sr0] tag#0 Add. Sense: Medium not present sr 1:0:0:0: [sr0] tag#0 CDB: Read(10) 28 00 00 00 00 00 00 00 02 00 sr 1:0:0:0: [sr0] tag#0 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s sr 1:0:0:0: [sr0] tag#0 Sense Key : Not Ready [current] sr 1:0:0:0: [sr0] tag#0 Add. Sense: Medium not present sr 1:0:0:0: [sr0] tag#0 CDB: Read(10) 28 00 00 00 00 00 00 00 02 00 sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 unaligned transfer sr 1:0:0:0: [sr0] tag#0 FAILED Result: hostbyte=DID_OK driverbyte=DRIVER_OK cmd_age=0s sr 1:0:0:0: [sr0] tag#0 Sense Key : Not Ready [current] sr 1:0:0:0: [sr0] tag#0 Add. Sense: Medium not present sr 1:0:0:0: [sr0] tag#0 CDB: Read(10) 28 00 00 00 00 00 00 00 02 00 netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. netlink: 4 bytes leftover after parsing attributes in process `syz-executor.4'. __do_sys_memfd_create: 1 callbacks suppressed syz-executor.4[69117]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set syz-executor.4[69117]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set syz-executor.4[69342]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set syz-executor.0[69348]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set syz-executor.4[69355]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set syz-executor.0[69371]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set syz-executor.4[69373]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set syz-executor.0[69386]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set syz-executor.4[69391]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set syz-executor.4[69409]: memfd_create() called without MFD_EXEC or MFD_NOEXEC_SEAL set