serio: Serial port tty30 process 'syzkaller-testdir227899362/syzkaller.qccBdO/55/file0' started with executable stack ================================================================== BUG: KASAN: use-after-free in cpu_timer_getexpires include/linux/posix-timers.h:95 [inline] BUG: KASAN: use-after-free in collect_timerqueue kernel/time/posix-cpu-timers.c:779 [inline] BUG: KASAN: use-after-free in collect_posix_cputimers+0x30b/0x340 kernel/time/posix-cpu-timers.c:799 Read of size 8 at addr ffff8880544dc0c8 by task file1/7332 CPU: 1 PID: 7332 Comm: file1 Not tainted 5.10.109 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x107/0x163 lib/dump_stack.c:118 print_address_description.constprop.0+0x1c/0x210 mm/kasan/report.c:385 __kasan_report mm/kasan/report.c:545 [inline] kasan_report.cold+0x37/0x7c mm/kasan/report.c:562 cpu_timer_getexpires include/linux/posix-timers.h:95 [inline] collect_timerqueue kernel/time/posix-cpu-timers.c:779 [inline] collect_posix_cputimers+0x30b/0x340 kernel/time/posix-cpu-timers.c:799 check_thread_timers kernel/time/posix-cpu-timers.c:845 [inline] handle_posix_cpu_timers kernel/time/posix-cpu-timers.c:1229 [inline] posix_cpu_timers_work+0x26c/0xfb0 kernel/time/posix-cpu-timers.c:1100 task_work_run+0xe2/0x1a0 kernel/task_work.c:151 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop kernel/entry/common.c:164 [inline] exit_to_user_mode_prepare+0x155/0x160 kernel/entry/common.c:191 syscall_exit_to_user_mode+0x38/0x230 kernel/entry/common.c:266 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0023:0x0 Code: Unable to access opcode bytes at RIP 0xffffffffffffffd6. RSP: 002b:00000000ff9b3aa0 EFLAGS: 00000200 ORIG_RAX: 000000000000000b RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Allocated by task 7335: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48 kasan_set_track mm/kasan/common.c:56 [inline] __kasan_kmalloc.constprop.0+0xc2/0xd0 mm/kasan/common.c:461 slab_post_alloc_hook mm/slab.h:532 [inline] slab_alloc_node mm/slub.c:2896 [inline] slab_alloc mm/slub.c:2904 [inline] kmem_cache_alloc+0x13b/0x350 mm/slub.c:2909 kmem_cache_zalloc include/linux/slab.h:654 [inline] alloc_posix_timer kernel/time/posix-timers.c:458 [inline] do_timer_create+0x150/0x14c0 kernel/time/posix-timers.c:511 __do_sys_timer_create kernel/time/posix-timers.c:586 [inline] __se_sys_timer_create kernel/time/posix-timers.c:577 [inline] __x64_sys_timer_create+0x16f/0x1b0 kernel/time/posix-timers.c:577 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Freed by task 16: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48 kasan_set_track+0x1c/0x30 mm/kasan/common.c:56 kasan_set_free_info+0x1b/0x30 mm/kasan/generic.c:355 __kasan_slab_free+0x110/0x150 mm/kasan/common.c:422 slab_free_hook mm/slub.c:1542 [inline] slab_free_freelist_hook+0xa9/0x180 mm/slub.c:1576 slab_free mm/slub.c:3149 [inline] kmem_cache_free+0xa7/0x310 mm/slub.c:3165 rcu_do_batch kernel/rcu/tree.c:2485 [inline] rcu_core+0x52d/0x1660 kernel/rcu/tree.c:2722 __do_softirq+0x1b8/0x867 kernel/softirq.c:298 Last call_rcu(): kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48 kasan_record_aux_stack+0x9e/0xb0 mm/kasan/generic.c:346 __call_rcu kernel/rcu/tree.c:2963 [inline] call_rcu+0x8a/0xa00 kernel/rcu/tree.c:3037 itimer_delete kernel/time/posix-timers.c:1050 [inline] exit_itimers+0x1a5/0x270 kernel/time/posix-timers.c:1063 begin_new_exec+0xe19/0x2a10 fs/exec.c:1283 load_elf_binary+0x168d/0x5660 fs/binfmt_elf.c:998 search_binary_handler fs/exec.c:1703 [inline] exec_binprm fs/exec.c:1744 [inline] bprm_execve+0x9bd/0x1b00 fs/exec.c:1820 do_execveat_common+0x621/0x7c0 fs/exec.c:1915 do_execveat fs/exec.c:1994 [inline] __do_sys_execveat fs/exec.c:2070 [inline] __se_sys_execveat fs/exec.c:2062 [inline] __x64_sys_execveat+0xed/0x130 fs/exec.c:2062 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 The buggy address belongs to the object at ffff8880544dc000 which belongs to the cache posix_timers_cache of size 312 The buggy address is located 200 bytes inside of 312-byte region [ffff8880544dc000, ffff8880544dc138) The buggy address belongs to the page: page:000000000f63363e refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x544dc head:000000000f63363e order:1 compound_mapcount:0 flags: 0x100000000010200(slab|head) raw: 0100000000010200 dead000000000100 dead000000000122 ffff88800ba7a140 raw: 0000000000000000 0000000080150015 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880544dbf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8880544dc000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8880544dc080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880544dc100: fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc ffff8880544dc180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== serio: Serial port tty30 kmemleak: 25 new suspected memory leaks (see /sys/kernel/debug/kmemleak)