From: Mathias Krause <minipli@grsecurity.net>
To: Steven Rostedt <rostedt@goodmis.org>
Cc: "Ajay Kaher" <ajay.kaher@broadcom.com>,
"Masami Hiramatsu" <mhiramat@kernel.org>,
"Ilkka Naulapää" <digirigawa@gmail.com>,
"Linus Torvalds" <torvalds@linux-foundation.org>,
"Al Viro" <viro@zeniv.linux.org.uk>,
linux-trace-kernel@vger.kernel.org, linux-kernel@vger.kernel.org,
regressions@leemhuis.info,
"Dan Carpenter" <dan.carpenter@linaro.org>,
"Vasavi Sirnapalli" <vasavi.sirnapalli@broadcom.com>,
"Alexey Makhalov" <alexey.makhalov@broadcom.com>,
"Florian Fainelli" <florian.fainelli@broadcom.com>,
"Beau Belgrave" <beaub@linux.microsoft.com>
Subject: Re: tracing: user events UAF crash report
Date: Thu, 25 Jul 2024 23:32:30 +0200 [thread overview]
Message-ID: <a7d66736-80d3-4f3d-9cca-ec46e019b4cb@grsecurity.net> (raw)
In-Reply-To: <20240725171459.598d9500@gandalf.local.home>
[-- Attachment #1: Type: text/plain, Size: 3232 bytes --]
On 25.07.24 23:14, Steven Rostedt wrote:
> On Thu, 25 Jul 2024 22:41:23 +0200
> Mathias Krause <minipli@grsecurity.net> wrote:
>
>>> diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
>>> index 6ef29eba90ce..5fbfa1c885de 100644
>>> --- a/kernel/trace/trace_events.c
>>> +++ b/kernel/trace/trace_events.c
>>> @@ -1627,12 +1627,14 @@ static int f_show(struct seq_file *m, void *v)
>>>
>>> static void *f_start(struct seq_file *m, loff_t *pos)
>>> {
>>> + struct trace_event_file *file;
>>> void *p = (void *)FORMAT_HEADER;
>>> loff_t l = 0;
>>>
>>> /* ->stop() is called even if ->start() fails */
>>> mutex_lock(&event_mutex);
>>> - if (!event_file_data(m->private))
>>> + file = event_file_data(m->private);
>>> + if (!file || (file->flags & EVENT_FILE_FL_FREED))
>>> return ERR_PTR(-ENODEV);
>>>
>>> while (l < *pos && p)
>>>
>>>
>>
>> Nope, still the same splats.
>
> Can you reshow the splats. Because I'm now confused.
Sure, see attached serial.log.
That was for a single run of
tools/testing/selftests/user_events/ftrace_test with the read loop of
/sys/kernel/tracing/events/user_events/__test_event/format in a
different shell.
>
> destroy_user_event() which is under event_mutex calls
> user_event_set_call_visible() with false, that will then call:
>
> trace_remove_event_call() -> probe_remove_event_call() ->
> __trace_remove_event_call() -> event_remove() ->
> remove_event_from_tracers()
>
> Where remove_event_from_tracers() loops over all the instances and will set
> each of the file pointers flags associated to the event: EVENT_FILE_FL_FREED
>
> Then it returns back to destroy_user_event() that would free the event.
>
> The f_start() that was in your crash, with the new patch, should take the
> event_mutex before referencing the event that was freed. And with that flag
> being set, it should exit out.
Looking at the very first report:
[ 76.306946] BUG: KASAN: slab-use-after-free in f_start+0x36e/0x3d0
That's what faddr2line gives me:
f_start+0x36e/0x3d0:
f_start at kernel/trace/trace_events.c:1637 (discriminator 1)
Which is:
1635 mutex_lock(&event_mutex);
1636 file = event_file_data(m->private);
1637 if (!file || (file->flags & EVENT_FILE_FL_FREED))
1638 return ERR_PTR(-ENODEV);
Apparently, 'file' was free'd now and reading the 'flags' member
triggers KASAN.
Second report is:
[ 76.367688] BUG: KASAN: slab-use-after-free in f_start+0x2e4/0x3d0
which faddr2line says is:
f_start+0x2e4/0x3d0:
trace_get_fields at include/linux/trace_events.h:482
(inlined by) f_next at kernel/trace/trace_events.c:1545
(inlined by) f_start at kernel/trace/trace_events.c:1641
480 trace_get_fields(struct trace_event_call *event_call)
481 {
482 if (!event_call->class->get_fields)
483 return &event_call->class->fields;
The one we ran into first.
So still something doesn't match up with how lifetimes of objects are
managed.
>
> Did you remove all the other patches before applying this one?
Sure. That's what I have on top of v6.10:
minipli@nuc:~/src/linux (tracefs)$ git diff v6.10 > ~/6.10-tracefs_dbg.diff
Please ignore the WARN()s. They're left-overs from earlier debug
attempts of mine.
Thanks,
Mathias
[-- Attachment #2: serial.log --]
[-- Type: text/x-log, Size: 448173 bytes --]
[ 0.000000] Linux version 6.10.0-vanilla+ (minipli@nuc) (gcc (Debian 13.3.0-3) 13.3.0, GNU ld (GNU Binutils for Debian) 2.42.50.20240710) #34 SMP PREEMPT_DYNAMIC Thu Jul 25 22:37:17 CEST 2024
[ 0.000000] Command line: console=ttyS0 console=tty root=/dev/vda kasan_multi_shot
[ 0.000000] KERNEL supported cpus:
[ 0.000000] Intel GenuineIntel
[ 0.000000] BIOS-provided physical RAM map:
[ 0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable
[ 0.000000] BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] reserved
[ 0.000000] BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] reserved
[ 0.000000] BIOS-e820: [mem 0x0000000000100000-0x000000007ffdbfff] usable
[ 0.000000] BIOS-e820: [mem 0x000000007ffdc000-0x000000007fffffff] reserved
[ 0.000000] BIOS-e820: [mem 0x00000000feffc000-0x00000000feffffff] reserved
[ 0.000000] BIOS-e820: [mem 0x00000000fffc0000-0x00000000ffffffff] reserved
[ 0.000000] NX (Execute Disable) protection: active
[ 0.000000] APIC: Static calls initialized
[ 0.000000] SMBIOS 2.8 present.
[ 0.000000] DMI: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 0.000000] DMI: Memory slots populated: 1/1
[ 0.000000] tsc: Fast TSC calibration using PIT
[ 0.000000] tsc: Detected 2495.993 MHz processor
[ 0.000355] last_pfn = 0x7ffdc max_arch_pfn = 0x400000000
[ 0.000368] MTRR map: 4 entries (3 fixed + 1 variable; max 19), built from 8 variable MTRRs
[ 0.000371] x86/PAT: Configuration [0-7]: WB WC UC- UC WB WP UC- WT
[ 0.002582] found SMP MP-table at [mem 0x000f5450-0x000f545f]
[ 0.002591] Using GB pages for direct mapping
[ 0.002592] Incomplete global flushes, disabling PCID
[ 0.002771] ACPI: Early table checksum verification disabled
[ 0.002774] ACPI: RSDP 0x00000000000F5270 000014 (v00 BOCHS )
[ 0.002780] ACPI: RSDT 0x000000007FFE1D75 000034 (v01 BOCHS BXPC 00000001 BXPC 00000001)
[ 0.002787] ACPI: FACP 0x000000007FFE1C11 000074 (v01 BOCHS BXPC 00000001 BXPC 00000001)
[ 0.002794] ACPI: DSDT 0x000000007FFE0040 001BD1 (v01 BOCHS BXPC 00000001 BXPC 00000001)
[ 0.002799] ACPI: FACS 0x000000007FFE0000 000040
[ 0.002803] ACPI: APIC 0x000000007FFE1C85 000090 (v03 BOCHS BXPC 00000001 BXPC 00000001)
[ 0.002807] ACPI: HPET 0x000000007FFE1D15 000038 (v01 BOCHS BXPC 00000001 BXPC 00000001)
[ 0.002811] ACPI: WAET 0x000000007FFE1D4D 000028 (v01 BOCHS BXPC 00000001 BXPC 00000001)
[ 0.002815] ACPI: Reserving FACP table memory at [mem 0x7ffe1c11-0x7ffe1c84]
[ 0.002817] ACPI: Reserving DSDT table memory at [mem 0x7ffe0040-0x7ffe1c10]
[ 0.002818] ACPI: Reserving FACS table memory at [mem 0x7ffe0000-0x7ffe003f]
[ 0.002819] ACPI: Reserving APIC table memory at [mem 0x7ffe1c85-0x7ffe1d14]
[ 0.002821] ACPI: Reserving HPET table memory at [mem 0x7ffe1d15-0x7ffe1d4c]
[ 0.002822] ACPI: Reserving WAET table memory at [mem 0x7ffe1d4d-0x7ffe1d74]
[ 0.002847] Zone ranges:
[ 0.002848] DMA32 [mem 0x0000000000001000-0x000000007ffdbfff]
[ 0.002851] Normal empty
[ 0.002853] Movable zone start for each node
[ 0.002854] Early memory node ranges
[ 0.002855] node 0: [mem 0x0000000000001000-0x000000000009efff]
[ 0.002857] node 0: [mem 0x0000000000100000-0x000000007ffdbfff]
[ 0.002858] Initmem setup node 0 [mem 0x0000000000001000-0x000000007ffdbfff]
[ 0.003061] On node 0, zone DMA32: 1 pages in unavailable ranges
[ 0.003943] On node 0, zone DMA32: 97 pages in unavailable ranges
[ 0.004154] On node 0, zone DMA32: 36 pages in unavailable ranges
[ 0.038408] kasan: KernelAddressSanitizer initialized
[ 0.038620] ACPI: PM-Timer IO Port: 0x608
[ 0.038628] ACPI: LAPIC_NMI (acpi_id[0xff] dfl dfl lint[0x1])
[ 0.038654] IOAPIC[0]: apic_id 0, version 17, address 0xfec00000, GSI 0-23
[ 0.038657] ACPI: INT_SRC_OVR (bus 0 bus_irq 0 global_irq 2 dfl dfl)
[ 0.038659] ACPI: INT_SRC_OVR (bus 0 bus_irq 5 global_irq 5 high level)
[ 0.038661] ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 9 high level)
[ 0.038662] ACPI: INT_SRC_OVR (bus 0 bus_irq 10 global_irq 10 high level)
[ 0.038664] ACPI: INT_SRC_OVR (bus 0 bus_irq 11 global_irq 11 high level)
[ 0.038667] ACPI: Using ACPI (MADT) for SMP configuration information
[ 0.038668] ACPI: HPET id: 0x8086a201 base: 0xfed00000
[ 0.038671] TSC deadline timer available
[ 0.038673] CPU topo: Max. logical packages: 1
[ 0.038674] CPU topo: Max. logical dies: 1
[ 0.038675] CPU topo: Max. dies per package: 1
[ 0.038678] CPU topo: Max. threads per core: 1
[ 0.038679] CPU topo: Num. cores per package: 4
[ 0.038680] CPU topo: Num. threads per package: 4
[ 0.038681] CPU topo: Allowing 4 present CPUs plus 0 hotplug CPUs
[ 0.038688] [mem 0x80000000-0xfeffbfff] available for PCI devices
[ 0.038691] clocksource: refined-jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645519600211568 ns
[ 0.045504] setup_percpu: NR_CPUS:64 nr_cpumask_bits:4 nr_cpu_ids:4 nr_node_ids:1
[ 0.045825] percpu: Embedded 72 pages/cpu s257888 r8192 d28832 u524288
[ 0.045846] Kernel command line: pax_size_overflow_report_only pax_kstack_report_only panic=10 console=ttyS0 console=tty root=/dev/vda kasan_multi_shot
[ 0.045885] Unknown kernel command line parameters "pax_size_overflow_report_only pax_kstack_report_only", will be passed to user space.
[ 0.045903] random: crng init done
[ 0.046168] Dentry cache hash table entries: 262144 (order: 9, 2097152 bytes, linear)
[ 0.046406] Inode-cache hash table entries: 131072 (order: 8, 1048576 bytes, linear)
[ 0.046485] Built 1 zonelists, mobility grouping on. Total pages: 524154
[ 0.046493] mem auto-init: stack:off, heap alloc:off, heap free:off
[ 0.046494] stackdepot: allocating hash table via alloc_large_system_hash
[ 0.046496] stackdepot hash table entries: 1048576 (order: 12, 16777216 bytes, linear)
[ 0.057424] Memory: 260864K/2096616K available (34816K kernel code, 7149K rwdata, 8696K rodata, 4408K init, 13448K bss, 401800K reserved, 0K cma-reserved)
[ 0.057806] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=4, Nodes=1
[ 0.057983] Dynamic Preempt: full
[ 0.058146] Running RCU self tests
[ 0.058147] Running RCU synchronous self tests
[ 0.058153] rcu: Preemptible hierarchical RCU implementation.
[ 0.058154] rcu: RCU lockdep checking is enabled.
[ 0.058155] rcu: RCU restricting CPUs from NR_CPUS=64 to nr_cpu_ids=4.
[ 0.058157] Trampoline variant of Tasks RCU enabled.
[ 0.058158] Tracing variant of Tasks RCU enabled.
[ 0.058159] rcu: RCU calculated value of scheduler-enlistment delay is 25 jiffies.
[ 0.058160] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=4
[ 0.058191] Running RCU synchronous self tests
[ 0.058194] RCU Tasks: Setting shift to 2 and lim to 1 rcu_task_cb_adjust=1.
[ 0.058196] RCU Tasks Trace: Setting shift to 2 and lim to 1 rcu_task_cb_adjust=1.
[ 0.065493] NR_IRQS: 4352, nr_irqs: 456, preallocated irqs: 16
[ 0.065750] rcu: srcu_init: Setting srcu_struct sizes based on contention.
[ 0.068232] Console: colour VGA+ 80x25
[ 0.068252] printk: legacy console [tty0] enabled
[ 0.083161] printk: legacy console [ttyS0] enabled
[ 0.117494] Lock dependency validator: Copyright (c) 2006 Red Hat, Inc., Ingo Molnar
[ 0.118161] ... MAX_LOCKDEP_SUBCLASSES: 8
[ 0.118539] ... MAX_LOCK_DEPTH: 48
[ 0.118923] ... MAX_LOCKDEP_KEYS: 8192
[ 0.119317] ... CLASSHASH_SIZE: 4096
[ 0.119716] ... MAX_LOCKDEP_ENTRIES: 32768
[ 0.120119] ... MAX_LOCKDEP_CHAINS: 65536
[ 0.120522] ... CHAINHASH_SIZE: 32768
[ 0.120922] memory used by lock dependency info: 6429 kB
[ 0.121390] memory used for stack traces: 4224 kB
[ 0.121816] per task-struct memory footprint: 1920 bytes
[ 0.122293] ACPI: Core revision 20240322
[ 0.122927] clocksource: hpet: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604467 ns
[ 0.123828] APIC: Switch to symmetric I/O mode setup
[ 0.124375] x2apic: IRQ remapping doesn't support X2APIC mode
[ 0.125743] ..TIMER: vector=0x30 apic1=0 pin1=2 apic2=-1 pin2=-1
[ 0.143767] clocksource: tsc-early: mask: 0xffffffffffffffff max_cycles: 0x23fa7089fe7, max_idle_ns: 440795281784 ns
[ 0.144656] Calibrating delay loop (skipped), value calculated using timer frequency.. 4991.98 BogoMIPS (lpj=9983972)
[ 0.145597] x86/cpu: User Mode Instruction Prevention (UMIP) activated
[ 0.146207] Last level iTLB entries: 4KB 0, 2MB 0, 4MB 0
[ 0.146680] Last level dTLB entries: 4KB 0, 2MB 0, 4MB 0, 1GB 0
[ 0.147204] Spectre V1 : Mitigation: usercopy/swapgs barriers and __user pointer sanitization
[ 0.148648] Spectre V2 : Spectre BHI mitigation: SW BHB clearing on vm exit
[ 0.149307] Spectre V2 : Spectre BHI mitigation: SW BHB clearing on syscall
[ 0.149963] Spectre V2 : Mitigation: Enhanced / Automatic IBRS
[ 0.150529] Spectre V2 : Spectre v2 / SpectreRSB mitigation: Filling RSB on context switch
[ 0.151311] Spectre V2 : Spectre v2 / PBRSB-eIBRS: Retire a single CALL on VMEXIT
[ 0.152037] Spectre V2 : mitigation: Enabling conditional Indirect Branch Prediction Barrier
[ 0.152647] Speculative Store Bypass: Mitigation: Speculative Store Bypass disabled via prctl
[ 0.153466] Register File Data Sampling: Vulnerable: No microcode
[ 0.154074] x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers'
[ 0.154837] x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers'
[ 0.155468] x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers'
[ 0.156121] x86/fpu: Supporting XSAVE feature 0x200: 'Protection Keys User registers'
[ 0.157174] x86/fpu: xstate_offset[2]: 576, xstate_sizes[2]: 256
[ 0.157778] x86/fpu: xstate_offset[9]: 832, xstate_sizes[9]: 8
[ 0.158306] x86/fpu: Enabled xstate features 0x207, context size is 840 bytes, using 'compacted' format.
[ 0.171418] Freeing SMP alternatives memory: 32K
[ 0.171910] pid_max: default: 32768 minimum: 301
[ 0.172577] Mount-cache hash table entries: 4096 (order: 3, 32768 bytes, linear)
[ 0.173077] Mountpoint-cache hash table entries: 4096 (order: 3, 32768 bytes, linear)
[ 0.174790] Running RCU synchronous self tests
[ 0.175267] Running RCU synchronous self tests
[ 0.175886] smpboot: CPU0: 12th Gen Intel(R) Core(TM) i7-1260P (family: 0x6, model: 0x9a, stepping: 0x3)
[ 0.177102] Running RCU Tasks wait API self tests
[ 0.280729] Running RCU Tasks Trace wait API self tests
[ 0.281337] Performance Events: unsupported p6 CPU model 154 no PMU driver, software events only.
[ 0.282149] signal: max sigframe size: 3632
[ 0.282659] rcu: Hierarchical SRCU implementation.
[ 0.283110] rcu: Max phase no-delay instances is 1000.
[ 0.284577] smp: Bringing up secondary CPUs ...
[ 0.285270] smpboot: x86: Booting SMP configuration:
[ 0.285735] .... node #0, CPUs: #1 #2 #3
[ 0.286419] smp: Brought up 1 node, 4 CPUs
[ 0.286419] smpboot: Total of 4 processors activated (19967.94 BogoMIPS)
[ 0.293153] node 0 deferred pages initialised in 4ms
[ 0.293685] allocated 4194304 bytes of page_ext
[ 0.296883] devtmpfs: initialized
[ 0.296995] Running RCU synchronous self tests
[ 0.297305] Running RCU synchronous self tests
[ 0.297827] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 7645041785100000 ns
[ 0.297827] futex hash table entries: 1024 (order: 5, 131072 bytes, linear)
[ 0.298506] pinctrl core: initialized pinctrl subsystem
[ 0.301124] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[ 0.302181] audit: initializing netlink subsys (disabled)
[ 0.304709] audit: type=2000 audit(1721942138.184:1): state=initialized audit_enabled=0 res=1
[ 0.305058] thermal_sys: Registered thermal governor 'step_wise'
[ 0.305903] thermal_sys: Registered thermal governor 'user_space'
[ 0.305903] cpuidle: using governor ladder
[ 0.308705] cpuidle: using governor menu
[ 0.308661] Callback from call_rcu_tasks_trace() invoked.
[ 0.309162] PCI: Using configuration type 1 for base access
[ 0.310258] kprobes: kprobe jump-optimization is enabled. All kprobes are optimized if possible.
[ 0.310258] HugeTLB: registered 2.00 MiB page size, pre-allocated 0 pages
[ 0.310258] HugeTLB: 28 KiB vmemmap can be freed for a 2.00 MiB page
[ 0.312889] ACPI: Added _OSI(Module Device)
[ 0.313407] ACPI: Added _OSI(Processor Device)
[ 0.313407] ACPI: Added _OSI(3.0 _SCP Extensions)
[ 0.313501] ACPI: Added _OSI(Processor Aggregator Device)
[ 0.323555] ACPI: 1 ACPI AML tables successfully acquired and loaded
[ 0.328941] ACPI: _OSC evaluation for CPUs failed, trying _PDC
[ 0.330898] ACPI: Interpreter enabled
[ 0.332687] ACPI: PM: (supports S0 S5)
[ 0.333069] ACPI: Using IOAPIC for interrupt routing
[ 0.333569] PCI: Using host bridge windows from ACPI; if necessary, use "pci=nocrs" and report a bug
[ 0.334342] PCI: Using E820 reservations for host bridge windows
[ 0.335771] ACPI: Enabled 2 GPEs in block 00 to 0F
[ 0.355109] ACPI: PCI Root Bridge [PCI0] (domain 0000 [bus 00-ff])
[ 0.355688] acpi PNP0A03:00: _OSC: OS supports [ASPM ClockPM Segments MSI HPX-Type3]
[ 0.356400] acpi PNP0A03:00: PCIe port services disabled; not requesting _OSC control
[ 0.356700] acpi PNP0A03:00: fail to add MMCONFIG information, can't access extended configuration space under this bridge
[ 0.358214] PCI host bridge to bus 0000:00
[ 0.358641] pci_bus 0000:00: root bus resource [io 0x0000-0x0cf7 window]
[ 0.359223] pci_bus 0000:00: root bus resource [io 0x0d00-0xffff window]
[ 0.359845] pci_bus 0000:00: root bus resource [mem 0x000a0000-0x000bffff window]
[ 0.360498] pci_bus 0000:00: root bus resource [mem 0x80000000-0xfebfffff window]
[ 0.361111] pci_bus 0000:00: root bus resource [mem 0x100000000-0x17fffffff window]
[ 0.361776] pci_bus 0000:00: root bus resource [bus 00-ff]
[ 0.362394] pci 0000:00:00.0: [8086:1237] type 00 class 0x060000 conventional PCI endpoint
[ 0.363671] pci 0000:00:01.0: [8086:7000] type 00 class 0x060100 conventional PCI endpoint
[ 0.364931] pci 0000:00:01.1: [8086:7010] type 00 class 0x010180 conventional PCI endpoint
[ 0.367143] pci 0000:00:01.1: BAR 4 [io 0xc100-0xc10f]
[ 0.368191] pci 0000:00:01.1: BAR 0 [io 0x01f0-0x01f7]: legacy IDE quirk
[ 0.368650] pci 0000:00:01.1: BAR 1 [io 0x03f6]: legacy IDE quirk
[ 0.369225] pci 0000:00:01.1: BAR 2 [io 0x0170-0x0177]: legacy IDE quirk
[ 0.369849] pci 0000:00:01.1: BAR 3 [io 0x0376]: legacy IDE quirk
[ 0.370770] pci 0000:00:01.3: [8086:7113] type 00 class 0x068000 conventional PCI endpoint
[ 0.371734] pci 0000:00:01.3: quirk: [io 0x0600-0x063f] claimed by PIIX4 ACPI
[ 0.372372] pci 0000:00:01.3: quirk: [io 0x0700-0x070f] claimed by PIIX4 SMB
[ 0.373011] pci 0000:00:02.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint
[ 0.374503] pci 0000:00:02.0: BAR 0 [mem 0xfd000000-0xfdffffff pref]
[ 0.377607] pci 0000:00:02.0: BAR 2 [mem 0xfebd4000-0xfebd4fff]
[ 0.380655] pci 0000:00:02.0: ROM [mem 0xfebc0000-0xfebcffff pref]
[ 0.381397] pci 0000:00:02.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff]
[ 0.382772] pci 0000:00:03.0: [1af4:1000] type 00 class 0x020000 conventional PCI endpoint
[ 0.384174] pci 0000:00:03.0: BAR 0 [io 0xc0c0-0xc0df]
[ 0.386193] pci 0000:00:03.0: BAR 4 [mem 0xfe000000-0xfe003fff 64bit pref]
[ 0.387331] pci 0000:00:03.0: ROM [mem 0xfeb80000-0xfebbffff pref]
[ 0.394270] pci 0000:00:04.0: [8086:2668] type 00 class 0x040300 conventional PCI endpoint
[ 0.395290] pci 0000:00:04.0: BAR 0 [mem 0xfebd0000-0xfebd3fff]
[ 0.402817] pci 0000:00:05.0: [1af4:1005] type 00 class 0x00ff00 conventional PCI endpoint
[ 0.404113] pci 0000:00:05.0: BAR 0 [io 0xc0e0-0xc0ff]
[ 0.405086] pci 0000:00:05.0: BAR 1 [mem 0xfebd5000-0xfebd5fff]
[ 0.406912] pci 0000:00:05.0: BAR 4 [mem 0xfe004000-0xfe007fff 64bit pref]
[ 0.415068] pci 0000:00:06.0: [8086:24cd] type 00 class 0x0c0320 conventional PCI endpoint
[ 0.416110] pci 0000:00:06.0: BAR 0 [mem 0xfebd6000-0xfebd6fff]
[ 0.423458] pci 0000:00:07.0: [1af4:1004] type 00 class 0x010000 conventional PCI endpoint
[ 0.424647] pci 0000:00:07.0: BAR 0 [io 0xc080-0xc0bf]
[ 0.425839] pci 0000:00:07.0: BAR 1 [mem 0xfebd7000-0xfebd7fff]
[ 0.427749] pci 0000:00:07.0: BAR 4 [mem 0xfe008000-0xfe00bfff 64bit pref]
[ 0.435984] pci 0000:00:08.0: [1af4:1001] type 00 class 0x010000 conventional PCI endpoint
[ 0.437799] pci 0000:00:08.0: BAR 0 [io 0xc000-0xc07f]
[ 0.438967] pci 0000:00:08.0: BAR 1 [mem 0xfebd8000-0xfebd8fff]
[ 0.440891] pci 0000:00:08.0: BAR 4 [mem 0xfe00c000-0xfe00ffff 64bit pref]
[ 0.449570] ACPI: PCI: Interrupt link LNKA configured for IRQ 10
[ 0.450638] ACPI: PCI: Interrupt link LNKB configured for IRQ 10
[ 0.451743] ACPI: PCI: Interrupt link LNKC configured for IRQ 11
[ 0.452768] ACPI: PCI: Interrupt link LNKD configured for IRQ 11
[ 0.453498] ACPI: PCI: Interrupt link LNKS configured for IRQ 9
[ 0.457155] SCSI subsystem initialized
[ 0.457562] PCI: Using ACPI for IRQ routing
[ 0.457957] pci 0000:00:02.0: vgaarb: setting as boot VGA device
[ 0.457957] pci 0000:00:02.0: vgaarb: bridge control possible
[ 0.457957] pci 0000:00:02.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none
[ 0.460651] vgaarb: loaded
[ 0.461270] hpet0: at MMIO 0xfed00000, IRQs 2, 8, 0
[ 0.461270] hpet0: 3 comparators, 64-bit 100.000000 MHz counter
[ 0.465810] clocksource: Switched to clocksource tsc-early
[ 0.469843] pnp: PnP ACPI init
[ 0.471489] pnp: PnP ACPI: found 6 devices
[ 0.482949] clocksource: acpi_pm: mask: 0xffffff max_cycles: 0xffffff, max_idle_ns: 2085701024 ns
[ 0.484130] NET: Registered PF_INET protocol family
[ 0.484853] IP idents hash table entries: 32768 (order: 6, 262144 bytes, linear)
[ 0.486025] tcp_listen_portaddr_hash hash table entries: 1024 (order: 4, 73728 bytes, linear)
[ 0.486791] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[ 0.487497] TCP established hash table entries: 16384 (order: 5, 131072 bytes, linear)
[ 0.488383] TCP bind hash table entries: 16384 (order: 9, 2359296 bytes, linear)
[ 0.490248] TCP: Hash tables configured (established 16384 bind 16384)
[ 0.490935] UDP hash table entries: 1024 (order: 5, 163840 bytes, linear)
[ 0.491574] UDP-Lite hash table entries: 1024 (order: 5, 163840 bytes, linear)
[ 0.492344] NET: Registered PF_UNIX/PF_LOCAL protocol family
[ 0.492953] pci_bus 0000:00: resource 4 [io 0x0000-0x0cf7 window]
[ 0.493031] Callback from call_rcu_tasks() invoked.
[ 0.493138] pci_bus 0000:00: resource 5 [io 0x0d00-0xffff window]
[ 0.493140] pci_bus 0000:00: resource 6 [mem 0x000a0000-0x000bffff window]
[ 0.493142] pci_bus 0000:00: resource 7 [mem 0x80000000-0xfebfffff window]
[ 0.495718] pci_bus 0000:00: resource 8 [mem 0x100000000-0x17fffffff window]
[ 0.496516] pci 0000:00:01.0: PIIX3: Enabling Passive Release
[ 0.497083] pci 0000:00:00.0: Limiting direct PCI/PCI transfers
[ 0.497663] PCI: CLS 0 bytes, default 64
[ 0.498803] RAPL PMU: API unit is 2^-32 Joules, 0 fixed counters, 10737418240 ms ovfl timer
[ 0.509824] workingset: timestamp_bits=46 max_order=19 bucket_order=0
[ 0.520358] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 249)
[ 0.521217] io scheduler mq-deadline registered
[ 0.521666] io scheduler kyber registered
[ 0.522082] io scheduler bfq registered
[ 0.524587] input: Power Button as /devices/LNXSYSTM:00/LNXPWRBN:00/input/input0
[ 0.525341] ACPI: button: Power Button [PWRF]
[ 0.938087] ACPI: \_SB_.LNKC: Enabled at IRQ 11
[ 1.374598] ACPI: \_SB_.LNKA: Enabled at IRQ 10
[ 1.530932] tsc: Refined TSC clocksource calibration: 2495.994 MHz
[ 1.531533] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x23fa717cb36, max_idle_ns: 440795237972 ns
[ 1.532645] clocksource: Switched to clocksource tsc
[ 2.244617] ACPI: \_SB_.LNKD: Enabled at IRQ 11
[ 2.278009] Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled
[ 2.279001] 00:04: ttyS0 at I/O 0x3f8 (irq = 4, base_baud = 115200) is a 16550A
[ 2.285092] Non-volatile memory driver v1.3
[ 2.291277] loop: module loaded
[ 2.291728] virtio_blk virtio3: 4/0/0 default/read/poll queues
[ 2.293551] virtio_blk virtio3: [vda] 41943040 512-byte logical blocks (21.5 GB/20.0 GiB)
[ 2.296152] lkdtm: No crash points registered, enable through debugfs
[ 2.297434] virtio_scsi virtio2: 4/0/0 default/read/poll queues
[ 2.299201] scsi host0: Virtio SCSI HBA
[ 2.349103] scsi host1: ata_piix
[ 2.350017] scsi host2: ata_piix
[ 2.350535] ata1: PATA max MWDMA2 cmd 0x1f0 ctl 0x3f6 bmdma 0xc100 irq 14 lpm-pol 0
[ 2.351278] ata2: PATA max MWDMA2 cmd 0x170 ctl 0x376 bmdma 0xc108 irq 15 lpm-pol 0
[ 2.353507] Intel(R) 2.5G Ethernet Linux Driver
[ 2.354033] Copyright(c) 2018 Intel Corporation.
[ 2.354938] i8042: PNP: PS/2 Controller [PNP0303:KBD,PNP0f13:MOU] at 0x60,0x64 irq 1,12
[ 2.356353] serio: i8042 KBD port at 0x60,0x64 irq 1
[ 2.357098] serio: i8042 AUX port at 0x60,0x64 irq 12
[ 2.358004] intel_pstate: CPU model not supported
[ 2.359133] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input1
[ 2.361104] NET: Registered PF_PACKET protocol family
[ 2.361842] 9pnet: Installing 9P2000 support
[ 2.362357] Key type dns_resolver registered
[ 2.363844] IPI shorthand broadcast: enabled
[ 2.375523] sched_clock: Marking stable (2320003287, 54850684)->(2421857485, -47003514)
[ 2.376679] Timer migration: 1 hierarchy levels; 8 children per group; 1 crossnode level
[ 2.377823] registered taskstats version 1
[ 2.390705] Key type .fscrypt registered
[ 2.391111] Key type fscrypt-provisioning registered
[ 2.414546] clk: Disabling unused clocks
[ 2.415070] KTAP version 1
[ 2.415413] 1..11
[ 2.415953] KTAP version 1
[ 2.416331] # Subtest: binfmt_elf
[ 2.416762] # module: binfmt_elf
[ 2.416770] 1..1
[ 2.417789] ok 1 total_mapping_size_test
[ 2.417799] ok 1 binfmt_elf
[ 2.418675] KTAP version 1
[ 2.419071] # Subtest: compat_binfmt_elf
[ 2.419490] # module: compat_binfmt_elf
[ 2.419494] 1..1
[ 2.420524] ok 1 total_mapping_size_test
[ 2.420530] ok 2 compat_binfmt_elf
[ 2.421325] KTAP version 1
[ 2.421641] # Subtest: kunit_executor_test
[ 2.422058] # module: kunit
[ 2.422062] 1..8
[ 2.422993] ok 1 parse_filter_test
[ 2.423257] ok 2 filter_suites_test
[ 2.423995] ok 3 filter_suites_test_glob_test
[ 2.424673] ok 4 filter_suites_to_empty_test
[ 2.425383] ok 5 parse_filter_attr_test
[ 2.426328] ok 6 filter_attr_test
[ 2.427147] ok 7 filter_attr_empty_test
[ 2.428019] ok 8 filter_attr_skip_test
[ 2.428491] # kunit_executor_test: pass:8 fail:0 skip:0 total:8
[ 2.428968] # Totals: pass:8 fail:0 skip:0 total:8
[ 2.429586] ok 3 kunit_executor_test
[ 2.430531] KTAP version 1
[ 2.430914] # Subtest: kunit-try-catch-test
[ 2.431362] # module: kunit_test
[ 2.431366] 1..2
[ 2.432446] ok 1 kunit_test_try_catch_successful_try_no_catch
[ 2.432656] ok 2 kunit_test_try_catch_unsuccessful_try_does_catch
[ 2.433296] # kunit-try-catch-test: pass:2 fail:0 skip:0 total:2
[ 2.433955] # Totals: pass:2 fail:0 skip:0 total:2
[ 2.434577] ok 4 kunit-try-catch-test
[ 2.435497] KTAP version 1
[ 2.435810] # Subtest: kunit-resource-test
[ 2.436228] # module: kunit_test
[ 2.436232] 1..12
[ 2.437277] ok 1 kunit_resource_test_init_resources
[ 2.437424] ok 2 kunit_resource_test_alloc_resource
[ 2.438192] ok 3 kunit_resource_test_destroy_resource
[ 2.439154] ok 4 kunit_resource_test_remove_resource
[ 2.439917] ok 5 kunit_resource_test_cleanup_resources
[ 2.440705] ok 6 kunit_resource_test_proper_free_ordering
[ 2.441451] ok 7 kunit_resource_test_static
[ 2.442215] ok 8 kunit_resource_test_named
[ 2.442944] ok 9 kunit_resource_test_action
[ 2.444121] ok 10 kunit_resource_test_remove_action
[ 2.444781] ok 11 kunit_resource_test_release_action
[ 2.445435] action_order_2
[ 2.446020] action_order_2
[ 2.446358] action_order_1
[ 2.446813] ok 12 kunit_resource_test_action_ordering
[ 2.447174] # kunit-resource-test: pass:12 fail:0 skip:0 total:12
[ 2.447774] # Totals: pass:12 fail:0 skip:0 total:12
[ 2.448465] ok 5 kunit-resource-test
[ 2.449442] KTAP version 1
[ 2.449804] # Subtest: kunit-log-test
[ 2.450251] # module: kunit_test
[ 2.450256] 1..2
[ 2.451059] put this in log.
[ 2.451064] this too.
[ 2.451432] add to suite log.
[ 2.451729] along with this.
[ 2.452359] ok 1 kunit_log_test
[ 2.452867] # kunit_log_newline_test: Add newline
[ 2.454072] ok 2 kunit_log_newline_test
[ 2.454077] # kunit-log-test: pass:2 fail:0 skip:0 total:2
[ 2.454570] # Totals: pass:2 fail:0 skip:0 total:2
[ 2.455176] ok 6 kunit-log-test
[ 2.456076] KTAP version 1
[ 2.456441] # Subtest: kunit_status
[ 2.456889] # module: kunit_test
[ 2.456893] 1..2
[ 2.457866] ok 1 kunit_status_set_failure_test
[ 2.458008] ok 2 kunit_status_mark_skipped_test
[ 2.458569] # kunit_status: pass:2 fail:0 skip:0 total:2
[ 2.459128] # Totals: pass:2 fail:0 skip:0 total:2
[ 2.459689] ok 7 kunit_status
[ 2.460585] KTAP version 1
[ 2.460961] # Subtest: kunit_current
[ 2.461400] # module: kunit_test
[ 2.461404] 1..2
[ 2.462440] ok 1 kunit_current_test
[ 2.462501] # fake test: lib/kunit/kunit-test.c:722: This should make `fake` test fail.
[ 2.463083] ok 2 kunit_current_fail_test
[ 2.463940] # kunit_current: pass:2 fail:0 skip:0 total:2
[ 2.464411] # Totals: pass:2 fail:0 skip:0 total:2
[ 2.464996] ok 8 kunit_current
[ 2.465913] KTAP version 1
[ 2.466279] # Subtest: kunit_device
[ 2.466717] # module: kunit_test
[ 2.466721] 1..3
[ 2.468024] ok 1 kunit_device_test
[ 2.468380] ok 2 kunit_device_cleanup_test
[ 2.469562] ok 3 kunit_device_driver_test
[ 2.470078] # kunit_device: pass:3 fail:0 skip:0 total:3
[ 2.470582] # Totals: pass:3 fail:0 skip:0 total:3
[ 2.471169] ok 9 kunit_device
[ 2.472061] KTAP version 1
[ 2.472424] # Subtest: kunit_fault
[ 2.472847] # module: kunit_test
[ 2.472850] 1..1
[ 2.473835] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] PREEMPT SMP KASAN NOPTI
[ 2.475044] KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
[ 2.475808] CPU: 0 PID: 173 Comm: kunit_try_catch Tainted: G N 6.10.0-vanilla+ #34
[ 2.476729] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 2.477695] RIP: 0010:kunit_test_null_dereference+0x4a/0x130
[ 2.478210] Code: b5 41 48 c7 44 24 08 db 23 9d a5 48 c1 ed 03 48 c7 44 24 10 f0 7e 20 a4 48 8d 54 05 00 c7 02 f1 f1 f1 f1 c7 42 04 01 f3 f3 f3 <0f> b6 00 84 c0 74 08 3c 03 0f 8e bb 00 00 00 48 8d bb b0 01 00 00
[ 2.479756] RSP: 0000:ffff888000f37e80 EFLAGS: 00010a02
[ 2.480238] RAX: dffffc0000000000 RBX: ffff888000967bd8 RCX: ffffffffa339836b
[ 2.480873] RDX: ffffed10001e6fd0 RSI: 0000000000000008 RDI: ffff888000967bd8
[ 2.481496] RBP: 1ffff110001e6fd0 R08: 0000000000000000 R09: ffffed1000d6b240
[ 2.482111] R10: ffff888006b59207 R11: 0000000000000000 R12: ffffffffa4207ef0
[ 2.482727] R13: ffff88800383fbb0 R14: ffffffffa41fed30 R15: ffff8880037f7980
[ 2.483366] FS: 0000000000000000(0000) GS:ffff88806d400000(0000) knlGS:0000000000000000
[ 2.484078] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 2.484597] CR2: ffff888069a01000 CR3: 0000000067cb0000 CR4: 0000000000750ef0
[ 2.485237] PKRU: 55555554
[ 2.485521] Call Trace:
[ 2.485783] <TASK>
[ 2.486023] ? die_addr+0x3b/0xa0
[ 2.486353] ? exc_general_protection+0x138/0x1f0
[ 2.486786] ? asm_exc_general_protection+0x26/0x30
[ 2.487247] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[ 2.487780] ? __pfx_kunit_test_null_dereference+0x10/0x10
[ 2.488269] ? __kthread_parkme+0xab/0x1c0
[ 2.488661] ? kunit_test_null_dereference+0x4a/0x130
[ 2.489132] ? __pfx_kunit_test_null_dereference+0x10/0x10
[ 2.489620] ? __kthread_parkme+0xab/0x1c0
[ 2.490006] ? __pfx_kunit_generic_run_threadfn_adapter+0x10/0x10
[ 2.490539] kunit_generic_run_threadfn_adapter+0x78/0xe0
[ 2.491040] kthread+0x2be/0x3b0
[ 2.494508] ? __pfx_kthread+0x10/0x10
[ 2.494871] ret_from_fork+0x2c/0x70
[ 2.495240] ? __pfx_kthread+0x10/0x10
[ 2.495601] ret_from_fork_asm+0x1a/0x30
[ 2.495976] </TASK>
[ 2.496218] Modules linked in:
[ 2.496540] ---[ end trace 0000000000000000 ]---
[ 2.497000] RIP: 0010:kunit_test_null_dereference+0x4a/0x130
[ 2.497499] Code: b5 41 48 c7 44 24 08 db 23 9d a5 48 c1 ed 03 48 c7 44 24 10 f0 7e 20 a4 48 8d 54 05 00 c7 02 f1 f1 f1 f1 c7 42 04 01 f3 f3 f3 <0f> b6 00 84 c0 74 08 3c 03 0f 8e bb 00 00 00 48 8d bb b0 01 00 00
[ 2.499348] RSP: 0000:ffff888000f37e80 EFLAGS: 00010a02
[ 2.499828] RAX: dffffc0000000000 RBX: ffff888000967bd8 RCX: ffffffffa339836b
[ 2.500436] RDX: ffffed10001e6fd0 RSI: 0000000000000008 RDI: ffff888000967bd8
[ 2.501072] RBP: 1ffff110001e6fd0 R08: 0000000000000000 R09: ffffed1000d6b240
[ 2.501681] R10: ffff888006b59207 R11: 0000000000000000 R12: ffffffffa4207ef0
[ 2.502289] R13: ffff88800383fbb0 R14: ffffffffa41fed30 R15: ffff8880037f7980
[ 2.502907] FS: 0000000000000000(0000) GS:ffff88806d400000(0000) knlGS:0000000000000000
[ 2.503631] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 2.504139] CR2: ffff888069a01000 CR3: 0000000067cb0000 CR4: 0000000000750ef0
[ 2.504768] PKRU: 55555554
[ 2.505176] # kunit_test_fault_null_dereference: try faulted: last line seen lib/kunit/kunit-test.c:95
[ 2.506362] ok 1 kunit_test_fault_null_dereference
[ 2.506370] ok 10 kunit_fault
[ 2.507273] KTAP version 1
[ 2.507581] # Subtest: string-stream-test
[ 2.507985] # module: string_stream_test
[ 2.507989] 1..12
[ 2.509366] ok 1 string_stream_managed_init_test
[ 2.509907] ok 2 string_stream_unmanaged_init_test
[ 2.510708] ok 3 string_stream_managed_free_test
[ 2.511941] ok 4 string_stream_resource_free_test
[ 2.513526] ok 5 string_stream_line_add_test
[ 2.514881] ok 6 string_stream_variable_length_line_test
[ 2.514949] ata2: found unknown device (class 0)
[ 2.515376] ok 7 string_stream_append_test
[ 2.516051] ata2.00: ATAPI: QEMU DVD-ROM, 2.5+, max UDMA/100
[ 2.516539] ok 8 string_stream_append_auto_newline_test
[ 2.517759] scsi 2:0:0:0: CD-ROM QEMU QEMU DVD-ROM 2.5+ PQ: 0 ANSI: 5
[ 2.518020] ok 9 string_stream_append_empty_string_test
[ 2.519621] ok 10 string_stream_no_auto_newline_test
[ 2.520445] ok 11 string_stream_auto_newline_test
[ 2.536854] # string_stream_performance_test: Time elapsed: 15184 us
[ 2.537967] # string_stream_performance_test: Total string length: 573890
[ 2.538617] # string_stream_performance_test: Bytes requested: 823986
[ 2.539420] # string_stream_performance_test: Actual bytes allocated: 1048344
[ 2.553418] ok 12 string_stream_performance_test
[ 2.553752] # string-stream-test: pass:12 fail:0 skip:0 total:12
[ 2.554218] # Totals: pass:12 fail:0 skip:0 total:12
[ 2.554740] ok 11 string-stream-test
[ 2.976573] input: ImExPS/2 Generic Explorer Mouse as /devices/platform/i8042/serio1/input/input3
[ 2.991513] EXT4-fs (vda): mounted filesystem 5255db7c-90ed-48a0-bf5e-4bdaecca5594 ro with ordered data mode. Quota mode: disabled.
[ 2.993490] VFS: Mounted root (ext4 filesystem) readonly on device 254:0.
[ 2.995746] devtmpfs: mounted
[ 2.997598] Freeing unused kernel image (initmem) memory: 4408K
[ 2.998534] Write protecting the kernel read-only data: 45056k
[ 3.000002] Freeing unused kernel image (rodata/data gap) memory: 1544K
[ 3.000699] rodata_test: all tests were successful
[ 3.001177] Run /sbin/init as init process
[ 3.001571] with arguments:
[ 3.001880] /sbin/init
[ 3.002163] pax_size_overflow_report_only
[ 3.002567] pax_kstack_report_only
[ 3.002936] with environment:
[ 3.003254] HOME=/
[ 3.003511] TERM=linux
[ 3.163672] systemd[1]: systemd 247.3-7+deb11u5 running in system mode. (+PAM +AUDIT +SELINUX +IMA +APPARMOR +SMACK +SYSVINIT +UTMP +LIBCRYPTSETUP +GCRYPT +GNUTLS +ACL +XZ +LZ4 +ZSTD +SECCOMP +BLKID +ELFUTILS +KMOD +IDN2 -IDN +PCRE2 default-hierarchy=unified)
[ 3.169206] systemd[1]: Detected virtualization kvm.
[ 3.170078] systemd[1]: Detected architecture x86-64.
[ 3.174098] systemd[1]: Set hostname to <deb11-amd64>.
[ 3.272838] systemd[1]: Queued start job for default target Graphical Interface.
[ 3.275085] systemd[1]: Created slice system-getty.slice.
[ 3.276420] systemd[1]: Created slice system-modprobe.slice.
[ 3.277628] systemd[1]: Created slice system-serial\x2dgetty.slice.
[ 3.278826] systemd[1]: Created slice User and Session Slice.
[ 3.279959] systemd[1]: Started Dispatch Password Requests to Console Directory Watch.
[ 3.281018] systemd[1]: Started Forward Password Requests to Wall Directory Watch.
[ 3.281971] systemd[1]: Condition check resulted in Arbitrary Executable File Formats File System Automount Point being skipped.
[ 3.282868] systemd[1]: Reached target Local Encrypted Volumes.
[ 3.283649] systemd[1]: Reached target Paths.
[ 3.284289] systemd[1]: Reached target Remote File Systems.
[ 3.284999] systemd[1]: Reached target Slices.
[ 3.286149] systemd[1]: Listening on Syslog Socket.
[ 3.286872] systemd[1]: Listening on fsck to fsckd communication Socket.
[ 3.287716] systemd[1]: Listening on initctl Compatibility Named Pipe.
[ 3.288558] systemd[1]: Listening on Journal Audit Socket.
[ 3.289341] systemd[1]: Listening on Journal Socket (/dev/log).
[ 3.290136] systemd[1]: Listening on Journal Socket.
[ 3.291218] systemd[1]: Listening on udev Control Socket.
[ 3.291958] systemd[1]: Listening on udev Kernel Socket.
[ 3.294098] systemd[1]: Mounting Huge Pages File System...
[ 3.296274] systemd[1]: Mounting POSIX Message Queue File System...
[ 3.298691] systemd[1]: Mounting Kernel Debug File System...
[ 3.300747] systemd[1]: Mounting Kernel Trace File System...
[ 3.301749] systemd[1]: Condition check resulted in Create list of static device nodes for the current kernel being skipped.
[ 3.304381] systemd[1]: Starting Load Kernel Module configfs...
[ 3.307334] systemd[1]: Starting Load Kernel Module drm...
[ 3.309753] systemd[1]: Starting Load Kernel Module fuse...
[ 3.311119] systemd[1]: Condition check resulted in Set Up Additional Binary Formats being skipped.
[ 3.313441] systemd[1]: Starting File System Check on Root Device...
[ 3.317495] systemd[1]: Starting Journal Service...
[ 3.320347] systemd[1]: Starting Load Kernel Modules...
[ 3.323639] systemd[1]: Starting Coldplug All udev Devices...
[ 3.326234] systemd[1]: Mounted Huge Pages File System.
[ 3.327322] systemd[1]: Mounted POSIX Message Queue File System.
[ 3.328304] systemd[1]: Mounted Kernel Debug File System.
[ 3.329962] systemd[1]: Mounted Kernel Trace File System.
[ 3.331447] systemd[1]: modprobe@configfs.service: Succeeded.
[ 3.332655] systemd[1]: Finished Load Kernel Module configfs.
[ 3.334251] systemd[1]: modprobe@drm.service: Succeeded.
[ 3.335371] systemd[1]: Finished Load Kernel Module drm.
[ 3.336701] systemd[1]: modprobe@fuse.service: Succeeded.
[ 3.337942] systemd[1]: Finished Load Kernel Module fuse.
[ 3.339785] systemd[1]: Finished Load Kernel Modules.
[ 3.341547] systemd[1]: Condition check resulted in FUSE Control File System being skipped.
[ 3.342380] systemd[1]: Condition check resulted in Kernel Configuration File System being skipped.
[ 3.344894] systemd[1]: Started File System Check Daemon to report status.
[ 3.348909] systemd[1]: Starting Apply Kernel Variables...
[ 3.355924] systemd[1]: Finished File System Check on Root Device.
[ 3.359096] systemd[1]: Starting Remount Root and Kernel File Systems...
[ 3.360505] systemd[1]: Started Journal Service.
[ 3.388746] EXT4-fs (vda): re-mounted 5255db7c-90ed-48a0-bf5e-4bdaecca5594 r/w. Quota mode: disabled.
[ 3.404765] systemd-journald[226]: Received client request to flush runtime journal.
[ 3.405917] Adding 655356k swap on /swapfile. Priority:-2 extents:6 across:860156k
[ 3.505148] virtio_net virtio0 enp0s3: renamed from eth0
Debian GNU/Linux 11 deb11-amd64 ttyS0
deb11-amd64 login: [ 76.304034] ==================================================================
[ 76.306946] BUG: KASAN: slab-use-after-free in f_start+0x36e/0x3d0
[ 76.308724] Read of size 8 at addr ffff8880044988a8 by task cat/4361
[ 76.310122]
[ 76.310543] CPU: 3 PID: 4361 Comm: cat Tainted: G D N 6.10.0-vanilla+ #34
[ 76.311927] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 76.313437] Call Trace:
[ 76.313845] <TASK>
[ 76.314163] dump_stack_lvl+0x66/0xa0
[ 76.314650] print_report+0xd0/0x630
[ 76.315070] ? f_start+0x36e/0x3d0
[ 76.315450] ? __virt_addr_valid+0x208/0x3f0
[ 76.315927] ? f_start+0x36e/0x3d0
[ 76.316336] kasan_report+0xd8/0x110
[ 76.316759] ? f_start+0x36e/0x3d0
[ 76.317161] f_start+0x36e/0x3d0
[ 76.317545] seq_read_iter+0x268/0x11e0
[ 76.317990] ? lock_release+0x453/0x600
[ 76.318410] seq_read+0x261/0x350
[ 76.318835] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 76.319341] ? __pfx_seq_read+0x10/0x10
[ 76.319775] ? trace_irq_enable.constprop.0+0xce/0x110
[ 76.320346] vfs_read+0x171/0x9e0
[ 76.320744] ? lock_acquire+0x408/0x4b0
[ 76.321187] ? __pfx_vfs_read+0x10/0x10
[ 76.321628] ? do_raw_spin_lock+0x119/0x240
[ 76.322130] ? __pfx_task_mm_cid_work+0x10/0x10
[ 76.322667] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 76.323203] ksys_read+0xdd/0x1a0
[ 76.323629] ? __pfx_ksys_read+0x10/0x10
[ 76.324080] ? trace_irq_enable.constprop.0+0xce/0x110
[ 76.324665] do_syscall_64+0x66/0x130
[ 76.325121] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 76.325693] RIP: 0033:0x7f9b5d95140e
[ 76.326146] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 76.328019] RSP: 002b:00007ffd50ab1618 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 76.329045] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f9b5d95140e
[ 76.329820] RDX: 0000000000020000 RSI: 00007f9b5d845000 RDI: 0000000000000003
[ 76.330545] RBP: 00007f9b5d845000 R08: 00007f9b5d844010 R09: 0000000000000000
[ 76.331291] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 76.332052] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 76.332782] </TASK>
[ 76.333064]
[ 76.333304] Allocated by task 4363:
[ 76.333744] kasan_save_stack+0x20/0x40
[ 76.334215] kasan_save_track+0x14/0x30
[ 76.334686] __kasan_kmalloc+0x8f/0xa0
[ 76.335154] user_event_parse_cmd+0x55e/0x25a0
[ 76.335682] user_events_ioctl+0xa52/0x17f0
[ 76.336184] __x64_sys_ioctl+0x133/0x190
[ 76.336634] do_syscall_64+0x66/0x130
[ 76.337063] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 76.337643]
[ 76.337877] Freed by task 341:
[ 76.338251] kasan_save_stack+0x20/0x40
[ 76.338697] kasan_save_track+0x14/0x30
[ 76.339177] kasan_save_free_info+0x3b/0x60
[ 76.339628] poison_slab_object+0x10a/0x170
[ 76.340109] __kasan_slab_free+0x14/0x30
[ 76.340568] kfree+0xe0/0x2f0
[ 76.340951] destroy_user_event+0x305/0x450
[ 76.341426] delayed_destroy_user_event+0x5c/0xe0
[ 76.341949] process_one_work+0x81c/0x1970
[ 76.342382] worker_thread+0x608/0x1160
[ 76.342798] kthread+0x2be/0x3b0
[ 76.343150] ret_from_fork+0x2c/0x70
[ 76.343572] ret_from_fork_asm+0x1a/0x30
[ 76.343998]
[ 76.344246] Last potentially related work creation:
[ 76.344747] kasan_save_stack+0x20/0x40
[ 76.345162] __kasan_record_aux_stack+0x8e/0xa0
[ 76.345672] insert_work+0x20/0x1b0
[ 76.346093] __queue_work+0x67a/0xc60
[ 76.346524] queue_work_on+0x63/0x90
[ 76.346926] user_event_put+0x1f9/0x390
[ 76.347345] user_events_release+0x124/0x200
[ 76.347828] __fput+0x361/0xa60
[ 76.348191] __x64_sys_close+0x77/0xd0
[ 76.348610] do_syscall_64+0x66/0x130
[ 76.349033] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 76.349545]
[ 76.349780] The buggy address belongs to the object at ffff888004498800
[ 76.349780] which belongs to the cache kmalloc-cg-512 of size 512
[ 76.351007] The buggy address is located 168 bytes inside of
[ 76.351007] freed 512-byte region [ffff888004498800, ffff888004498a00)
[ 76.352185]
[ 76.352436] The buggy address belongs to the physical page:
[ 76.353049] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4498
[ 76.353867] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 76.354677] memcg:ffff888003f75301
[ 76.355090] flags: 0x40(head|zone=0)
[ 76.355484] page_type: 0xffffefff(slab)
[ 76.355925] raw: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 76.356684] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 76.357498] head: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 76.358259] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 76.359183] head: 0000000000000002 ffffea0000112601 ffffffffffffffff 0000000000000000
[ 76.359945] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 76.360707] page dumped because: kasan: bad access detected
[ 76.361264]
[ 76.361521] Memory state around the buggy address:
[ 76.362051] ffff888004498780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 76.362755] ffff888004498800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.363529] >ffff888004498880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.364263] ^
[ 76.364773] ffff888004498900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.365536] ffff888004498980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.366246] ==================================================================
[ 76.367021] ==================================================================
[ 76.367688] BUG: KASAN: slab-use-after-free in f_start+0x2e4/0x3d0
[ 76.368210] Read of size 8 at addr ffff888004498870 by task cat/4361
[ 76.368751]
[ 76.368961] CPU: 3 PID: 4361 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 76.369628] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 76.370527] Call Trace:
[ 76.370794] <TASK>
[ 76.371043] dump_stack_lvl+0x66/0xa0
[ 76.371436] print_report+0xd0/0x630
[ 76.371824] ? f_start+0x2e4/0x3d0
[ 76.372237] ? __virt_addr_valid+0x208/0x3f0
[ 76.372678] ? f_start+0x2e4/0x3d0
[ 76.373073] kasan_report+0xd8/0x110
[ 76.373465] ? f_start+0x2e4/0x3d0
[ 76.373878] f_start+0x2e4/0x3d0
[ 76.374245] seq_read_iter+0x268/0x11e0
[ 76.374666] ? lock_release+0x453/0x600
[ 76.375073] seq_read+0x261/0x350
[ 76.375467] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 76.375967] ? __pfx_seq_read+0x10/0x10
[ 76.376378] ? trace_irq_enable.constprop.0+0xce/0x110
[ 76.376928] vfs_read+0x171/0x9e0
[ 76.377328] ? lock_acquire+0x408/0x4b0
[ 76.377770] ? __pfx_vfs_read+0x10/0x10
[ 76.378191] ? do_raw_spin_lock+0x119/0x240
[ 76.378670] ? __pfx_task_mm_cid_work+0x10/0x10
[ 76.379144] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 76.379624] ksys_read+0xdd/0x1a0
[ 76.379999] ? __pfx_ksys_read+0x10/0x10
[ 76.380415] ? trace_irq_enable.constprop.0+0xce/0x110
[ 76.380962] do_syscall_64+0x66/0x130
[ 76.381345] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 76.381854] RIP: 0033:0x7f9b5d95140e
[ 76.382244] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 76.383788] RSP: 002b:00007ffd50ab1618 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 76.384527] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f9b5d95140e
[ 76.385247] RDX: 0000000000020000 RSI: 00007f9b5d845000 RDI: 0000000000000003
[ 76.385923] RBP: 00007f9b5d845000 R08: 00007f9b5d844010 R09: 0000000000000000
[ 76.386593] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 76.387277] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 76.387949] </TASK>
[ 76.388262]
[ 76.388513] Allocated by task 4363:
[ 76.389074] kasan_save_stack+0x20/0x40
[ 76.389489] kasan_save_track+0x14/0x30
[ 76.389900] __kasan_kmalloc+0x8f/0xa0
[ 76.390325] user_event_parse_cmd+0x55e/0x25a0
[ 76.390741] user_events_ioctl+0xa52/0x17f0
[ 76.391153] __x64_sys_ioctl+0x133/0x190
[ 76.391571] do_syscall_64+0x66/0x130
[ 76.391963] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 76.392473]
[ 76.392699] Freed by task 341:
[ 76.393085] kasan_save_stack+0x20/0x40
[ 76.393533] kasan_save_track+0x14/0x30
[ 76.393945] kasan_save_free_info+0x3b/0x60
[ 76.394387] poison_slab_object+0x10a/0x170
[ 76.394857] __kasan_slab_free+0x14/0x30
[ 76.395288] kfree+0xe0/0x2f0
[ 76.395648] destroy_user_event+0x305/0x450
[ 76.396033] delayed_destroy_user_event+0x5c/0xe0
[ 76.396454] process_one_work+0x81c/0x1970
[ 76.396840] worker_thread+0x608/0x1160
[ 76.397202] kthread+0x2be/0x3b0
[ 76.397524] ret_from_fork+0x2c/0x70
[ 76.397874] ret_from_fork_asm+0x1a/0x30
[ 76.402063]
[ 76.402271] Last potentially related work creation:
[ 76.402698] kasan_save_stack+0x20/0x40
[ 76.403064] __kasan_record_aux_stack+0x8e/0xa0
[ 76.403481] insert_work+0x20/0x1b0
[ 76.403825] __queue_work+0x67a/0xc60
[ 76.404175] queue_work_on+0x63/0x90
[ 76.404520] user_event_put+0x1f9/0x390
[ 76.404892] user_events_release+0x124/0x200
[ 76.405288] __fput+0x361/0xa60
[ 76.405604] __x64_sys_close+0x77/0xd0
[ 76.405965] do_syscall_64+0x66/0x130
[ 76.406319] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 76.406819]
[ 76.407069] The buggy address belongs to the object at ffff888004498800
[ 76.407069] which belongs to the cache kmalloc-cg-512 of size 512
[ 76.408209] The buggy address is located 112 bytes inside of
[ 76.408209] freed 512-byte region [ffff888004498800, ffff888004498a00)
[ 76.409302]
[ 76.409531] The buggy address belongs to the physical page:
[ 76.410082] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4498
[ 76.410888] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 76.411676] memcg:ffff888003f75301
[ 76.412048] flags: 0x40(head|zone=0)
[ 76.412440] page_type: 0xffffefff(slab)
[ 76.412860] raw: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 76.413671] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 76.414472] head: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 76.415214] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 76.415962] head: 0000000000000002 ffffea0000112601 ffffffffffffffff 0000000000000000
[ 76.416715] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 76.417538] page dumped because: kasan: bad access detected
[ 76.418122]
[ 76.418351] Memory state around the buggy address:
[ 76.419059] ffff888004498700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 76.419820] ffff888004498780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 76.420593] >ffff888004498800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.421353] ^
[ 76.422015] ffff888004498880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.422781] ffff888004498900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.423545] ==================================================================
[ 76.424274] ==================================================================
[ 76.424987] BUG: KASAN: slab-use-after-free in f_start+0x2cb/0x3d0
[ 76.425579] Read of size 8 at addr ffff888004498908 by task cat/4361
[ 76.426221]
[ 76.426475] CPU: 3 PID: 4361 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 76.427249] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 76.428362] Call Trace:
[ 76.428664] <TASK>
[ 76.428967] dump_stack_lvl+0x66/0xa0
[ 76.429376] print_report+0xd0/0x630
[ 76.429798] ? f_start+0x2cb/0x3d0
[ 76.430176] ? __virt_addr_valid+0x208/0x3f0
[ 76.430665] ? f_start+0x2cb/0x3d0
[ 76.431078] kasan_report+0xd8/0x110
[ 76.431506] ? f_start+0x2cb/0x3d0
[ 76.431920] f_start+0x2cb/0x3d0
[ 76.432284] seq_read_iter+0x268/0x11e0
[ 76.432699] ? lock_release+0x453/0x600
[ 76.433119] seq_read+0x261/0x350
[ 76.433492] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 76.433978] ? __pfx_seq_read+0x10/0x10
[ 76.434424] ? trace_irq_enable.constprop.0+0xce/0x110
[ 76.434984] vfs_read+0x171/0x9e0
[ 76.435394] ? lock_acquire+0x408/0x4b0
[ 76.435812] ? __pfx_vfs_read+0x10/0x10
[ 76.436259] ? do_raw_spin_lock+0x119/0x240
[ 76.436741] ? __pfx_task_mm_cid_work+0x10/0x10
[ 76.437254] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 76.437762] ksys_read+0xdd/0x1a0
[ 76.438163] ? __pfx_ksys_read+0x10/0x10
[ 76.438620] ? trace_irq_enable.constprop.0+0xce/0x110
[ 76.439174] do_syscall_64+0x66/0x130
[ 76.439598] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 76.440099] RIP: 0033:0x7f9b5d95140e
[ 76.440525] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 76.442267] RSP: 002b:00007ffd50ab1618 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 76.443058] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f9b5d95140e
[ 76.443726] RDX: 0000000000020000 RSI: 00007f9b5d845000 RDI: 0000000000000003
[ 76.444407] RBP: 00007f9b5d845000 R08: 00007f9b5d844010 R09: 0000000000000000
[ 76.445133] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 76.445861] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 76.446590] </TASK>
[ 76.446873]
[ 76.447123] Allocated by task 4363:
[ 76.447540] kasan_save_stack+0x20/0x40
[ 76.447956] kasan_save_track+0x14/0x30
[ 76.448399] __kasan_kmalloc+0x8f/0xa0
[ 76.449012] user_event_parse_cmd+0x55e/0x25a0
[ 76.449471] user_events_ioctl+0xa52/0x17f0
[ 76.449948] __x64_sys_ioctl+0x133/0x190
[ 76.450406] do_syscall_64+0x66/0x130
[ 76.450841] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 76.451363]
[ 76.451615] Freed by task 341:
[ 76.451970] kasan_save_stack+0x20/0x40
[ 76.452416] kasan_save_track+0x14/0x30
[ 76.452870] kasan_save_free_info+0x3b/0x60
[ 76.453349] poison_slab_object+0x10a/0x170
[ 76.453825] __kasan_slab_free+0x14/0x30
[ 76.454273] kfree+0xe0/0x2f0
[ 76.454619] destroy_user_event+0x305/0x450
[ 76.455094] delayed_destroy_user_event+0x5c/0xe0
[ 76.455611] process_one_work+0x81c/0x1970
[ 76.456050] worker_thread+0x608/0x1160
[ 76.456466] kthread+0x2be/0x3b0
[ 76.456834] ret_from_fork+0x2c/0x70
[ 76.457255] ret_from_fork_asm+0x1a/0x30
[ 76.457709]
[ 76.457937] Last potentially related work creation:
[ 76.458430] kasan_save_stack+0x20/0x40
[ 76.458845] __kasan_record_aux_stack+0x8e/0xa0
[ 76.459350] insert_work+0x20/0x1b0
[ 76.459771] __queue_work+0x67a/0xc60
[ 76.460172] queue_work_on+0x63/0x90
[ 76.460596] user_event_put+0x1f9/0x390
[ 76.461042] user_events_release+0x124/0x200
[ 76.461524] __fput+0x361/0xa60
[ 76.461884] __x64_sys_close+0x77/0xd0
[ 76.462292] do_syscall_64+0x66/0x130
[ 76.462721] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 76.463230]
[ 76.463482] The buggy address belongs to the object at ffff888004498800
[ 76.463482] which belongs to the cache kmalloc-cg-512 of size 512
[ 76.464701] The buggy address is located 264 bytes inside of
[ 76.464701] freed 512-byte region [ffff888004498800, ffff888004498a00)
[ 76.465896]
[ 76.466143] The buggy address belongs to the physical page:
[ 76.466694] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4498
[ 76.467502] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 76.468309] memcg:ffff888003f75301
[ 76.468684] flags: 0x40(head|zone=0)
[ 76.469080] page_type: 0xffffefff(slab)
[ 76.469496] raw: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 76.470244] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 76.471003] head: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 76.471806] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 76.472572] head: 0000000000000002 ffffea0000112601 ffffffffffffffff 0000000000000000
[ 76.473333] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 76.474148] page dumped because: kasan: bad access detected
[ 76.474695]
[ 76.474920] Memory state around the buggy address:
[ 76.475399] ffff888004498800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.476096] ffff888004498880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.476851] >ffff888004498900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.477611] ^
[ 76.478029] ffff888004498980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.478944] ffff888004498a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 76.483263] ==================================================================
[ 76.483991] ==================================================================
[ 76.484763] BUG: KASAN: slab-use-after-free in user_event_get_fields+0x38/0x40
[ 76.485519] Read of size 8 at addr ffff8880044988b8 by task cat/4361
[ 76.486135]
[ 76.486360] CPU: 3 PID: 4361 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 76.487165] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 76.488183] Call Trace:
[ 76.488474] <TASK>
[ 76.488754] dump_stack_lvl+0x66/0xa0
[ 76.489158] print_report+0xd0/0x630
[ 76.489507] ? user_event_get_fields+0x38/0x40
[ 76.489985] ? __virt_addr_valid+0x208/0x3f0
[ 76.490417] ? user_event_get_fields+0x38/0x40
[ 76.490919] kasan_report+0xd8/0x110
[ 76.491315] ? user_event_get_fields+0x38/0x40
[ 76.491806] user_event_get_fields+0x38/0x40
[ 76.492284] f_start+0x175/0x3d0
[ 76.492655] seq_read_iter+0x268/0x11e0
[ 76.493061] ? lock_release+0x453/0x600
[ 76.493505] seq_read+0x261/0x350
[ 76.493878] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 76.494392] ? __pfx_seq_read+0x10/0x10
[ 76.494837] ? trace_irq_enable.constprop.0+0xce/0x110
[ 76.495351] vfs_read+0x171/0x9e0
[ 76.495730] ? lock_acquire+0x408/0x4b0
[ 76.496148] ? __pfx_vfs_read+0x10/0x10
[ 76.496597] ? do_raw_spin_lock+0x119/0x240
[ 76.497041] ? __pfx_task_mm_cid_work+0x10/0x10
[ 76.497542] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 76.498011] ksys_read+0xdd/0x1a0
[ 76.498381] ? __pfx_ksys_read+0x10/0x10
[ 76.498802] ? trace_irq_enable.constprop.0+0xce/0x110
[ 76.499324] do_syscall_64+0x66/0x130
[ 76.499725] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 76.500274] RIP: 0033:0x7f9b5d95140e
[ 76.500698] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 76.502358] RSP: 002b:00007ffd50ab1618 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 76.503108] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f9b5d95140e
[ 76.503832] RDX: 0000000000020000 RSI: 00007f9b5d845000 RDI: 0000000000000003
[ 76.504548] RBP: 00007f9b5d845000 R08: 00007f9b5d844010 R09: 0000000000000000
[ 76.505259] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 76.505935] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 76.506623] </TASK>
[ 76.506934]
[ 76.507159] Allocated by task 4363:
[ 76.507541] kasan_save_stack+0x20/0x40
[ 76.507954] kasan_save_track+0x14/0x30
[ 76.508401] __kasan_kmalloc+0x8f/0xa0
[ 76.509038] user_event_parse_cmd+0x55e/0x25a0
[ 76.509536] user_events_ioctl+0xa52/0x17f0
[ 76.509978] __x64_sys_ioctl+0x133/0x190
[ 76.510402] do_syscall_64+0x66/0x130
[ 76.510832] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 76.511342]
[ 76.511565] Freed by task 341:
[ 76.511911] kasan_save_stack+0x20/0x40
[ 76.512353] kasan_save_track+0x14/0x30
[ 76.512765] kasan_save_free_info+0x3b/0x60
[ 76.513193] poison_slab_object+0x10a/0x170
[ 76.513600] __kasan_slab_free+0x14/0x30
[ 76.513972] kfree+0xe0/0x2f0
[ 76.514285] destroy_user_event+0x305/0x450
[ 76.514684] delayed_destroy_user_event+0x5c/0xe0
[ 76.515113] process_one_work+0x81c/0x1970
[ 76.515501] worker_thread+0x608/0x1160
[ 76.515871] kthread+0x2be/0x3b0
[ 76.516200] ret_from_fork+0x2c/0x70
[ 76.516549] ret_from_fork_asm+0x1a/0x30
[ 76.516930]
[ 76.517140] Last potentially related work creation:
[ 76.517572] kasan_save_stack+0x20/0x40
[ 76.517941] __kasan_record_aux_stack+0x8e/0xa0
[ 76.518360] insert_work+0x20/0x1b0
[ 76.518704] __queue_work+0x67a/0xc60
[ 76.519062] queue_work_on+0x63/0x90
[ 76.519414] user_event_put+0x1f9/0x390
[ 76.519781] user_events_release+0x124/0x200
[ 76.520175] __fput+0x361/0xa60
[ 76.520500] __x64_sys_close+0x77/0xd0
[ 76.520864] do_syscall_64+0x66/0x130
[ 76.521219] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 76.521672]
[ 76.521883] The buggy address belongs to the object at ffff888004498800
[ 76.521883] which belongs to the cache kmalloc-cg-512 of size 512
[ 76.522881] The buggy address is located 184 bytes inside of
[ 76.522881] freed 512-byte region [ffff888004498800, ffff888004498a00)
[ 76.523840]
[ 76.524050] The buggy address belongs to the physical page:
[ 76.524544] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4498
[ 76.525213] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 76.525876] memcg:ffff888003f75301
[ 76.526217] flags: 0x40(head|zone=0)
[ 76.526568] page_type: 0xffffefff(slab)
[ 76.526937] raw: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 76.527594] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 76.528253] head: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 76.528923] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 76.529583] head: 0000000000000002 ffffea0000112601 ffffffffffffffff 0000000000000000
[ 76.530251] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 76.530921] page dumped because: kasan: bad access detected
[ 76.531406]
[ 76.531621] Memory state around the buggy address:
[ 76.532052] ffff888004498780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 76.532677] ffff888004498800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.533306] >ffff888004498880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.533929] ^
[ 76.534373] ffff888004498900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.534999] ffff888004498980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.535619] ==================================================================
[ 76.536267] ==================================================================
[ 76.536912] BUG: KASAN: slab-use-after-free in f_start+0x2e4/0x3d0
[ 76.537441] Read of size 8 at addr ffff888004498870 by task cat/4361
[ 76.537981]
[ 76.538191] CPU: 3 PID: 4361 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 76.539128] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 76.540060] Call Trace:
[ 76.540335] <TASK>
[ 76.540587] dump_stack_lvl+0x66/0xa0
[ 76.540953] print_report+0xd0/0x630
[ 76.541302] ? f_start+0x2e4/0x3d0
[ 76.541647] ? __virt_addr_valid+0x208/0x3f0
[ 76.542045] ? f_start+0x2e4/0x3d0
[ 76.542386] kasan_report+0xd8/0x110
[ 76.542740] ? f_start+0x2e4/0x3d0
[ 76.543084] f_start+0x2e4/0x3d0
[ 76.543412] seq_read_iter+0x268/0x11e0
[ 76.543782] ? lock_release+0x453/0x600
[ 76.544154] seq_read+0x261/0x350
[ 76.544489] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 76.544918] ? __pfx_seq_read+0x10/0x10
[ 76.545289] ? trace_irq_enable.constprop.0+0xce/0x110
[ 76.545750] vfs_read+0x171/0x9e0
[ 76.546088] ? lock_acquire+0x408/0x4b0
[ 76.546460] ? __pfx_vfs_read+0x10/0x10
[ 76.546832] ? do_raw_spin_lock+0x119/0x240
[ 76.547227] ? __pfx_task_mm_cid_work+0x10/0x10
[ 76.547644] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 76.548059] ksys_read+0xdd/0x1a0
[ 76.548394] ? __pfx_ksys_read+0x10/0x10
[ 76.548773] ? trace_irq_enable.constprop.0+0xce/0x110
[ 76.549234] do_syscall_64+0x66/0x130
[ 76.549595] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 76.550055] RIP: 0033:0x7f9b5d95140e
[ 76.550407] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 76.551836] RSP: 002b:00007ffd50ab1618 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 76.552486] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f9b5d95140e
[ 76.553083] RDX: 0000000000020000 RSI: 00007f9b5d845000 RDI: 0000000000000003
[ 76.553673] RBP: 00007f9b5d845000 R08: 00007f9b5d844010 R09: 0000000000000000
[ 76.554262] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 76.554854] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 76.559263] </TASK>
[ 76.559521]
[ 76.559729] Allocated by task 4363:
[ 76.560075] kasan_save_stack+0x20/0x40
[ 76.560442] kasan_save_track+0x14/0x30
[ 76.560811] __kasan_kmalloc+0x8f/0xa0
[ 76.561175] user_event_parse_cmd+0x55e/0x25a0
[ 76.561587] user_events_ioctl+0xa52/0x17f0
[ 76.561978] __x64_sys_ioctl+0x133/0x190
[ 76.562350] do_syscall_64+0x66/0x130
[ 76.562710] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 76.563162]
[ 76.563367] Freed by task 341:
[ 76.563683] kasan_save_stack+0x20/0x40
[ 76.564048] kasan_save_track+0x14/0x30
[ 76.564416] kasan_save_free_info+0x3b/0x60
[ 76.564812] poison_slab_object+0x10a/0x170
[ 76.565204] __kasan_slab_free+0x14/0x30
[ 76.565578] kfree+0xe0/0x2f0
[ 76.565888] destroy_user_event+0x305/0x450
[ 76.566281] delayed_destroy_user_event+0x5c/0xe0
[ 76.566711] process_one_work+0x81c/0x1970
[ 76.567096] worker_thread+0x608/0x1160
[ 76.567462] kthread+0x2be/0x3b0
[ 76.567792] ret_from_fork+0x2c/0x70
[ 76.568147] ret_from_fork_asm+0x1a/0x30
[ 76.568518]
[ 76.568730] Last potentially related work creation:
[ 76.569408] kasan_save_stack+0x20/0x40
[ 76.569788] __kasan_record_aux_stack+0x8e/0xa0
[ 76.570209] insert_work+0x20/0x1b0
[ 76.570556] __queue_work+0x67a/0xc60
[ 76.570920] queue_work_on+0x63/0x90
[ 76.571270] user_event_put+0x1f9/0x390
[ 76.571640] user_events_release+0x124/0x200
[ 76.572038] __fput+0x361/0xa60
[ 76.572358] __x64_sys_close+0x77/0xd0
[ 76.572724] do_syscall_64+0x66/0x130
[ 76.573091] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 76.573538]
[ 76.573751] The buggy address belongs to the object at ffff888004498800
[ 76.573751] which belongs to the cache kmalloc-cg-512 of size 512
[ 76.574753] The buggy address is located 112 bytes inside of
[ 76.574753] freed 512-byte region [ffff888004498800, ffff888004498a00)
[ 76.575713]
[ 76.575920] The buggy address belongs to the physical page:
[ 76.576407] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4498
[ 76.577077] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 76.577731] memcg:ffff888003f75301
[ 76.578067] flags: 0x40(head|zone=0)
[ 76.578417] page_type: 0xffffefff(slab)
[ 76.578787] raw: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 76.579446] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 76.580106] head: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 76.580771] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 76.581439] head: 0000000000000002 ffffea0000112601 ffffffffffffffff 0000000000000000
[ 76.582101] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 76.582766] page dumped because: kasan: bad access detected
[ 76.583248]
[ 76.583457] Memory state around the buggy address:
[ 76.583889] ffff888004498700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 76.584508] ffff888004498780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 76.585137] >ffff888004498800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.585758] ^
[ 76.586333] ffff888004498880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.586964] ffff888004498900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.587585] ==================================================================
[ 76.588224] ==================================================================
[ 76.588861] BUG: KASAN: slab-use-after-free in f_start+0x2cb/0x3d0
[ 76.589382] Read of size 8 at addr ffff888004498908 by task cat/4361
[ 76.589915]
[ 76.590128] CPU: 3 PID: 4361 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 76.590809] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 76.591724] Call Trace:
[ 76.592000] <TASK>
[ 76.592248] dump_stack_lvl+0x66/0xa0
[ 76.592601] print_report+0xd0/0x630
[ 76.592953] ? f_start+0x2cb/0x3d0
[ 76.593292] ? __virt_addr_valid+0x208/0x3f0
[ 76.593692] ? f_start+0x2cb/0x3d0
[ 76.594032] kasan_report+0xd8/0x110
[ 76.594382] ? f_start+0x2cb/0x3d0
[ 76.594722] f_start+0x2cb/0x3d0
[ 76.595056] seq_read_iter+0x268/0x11e0
[ 76.595428] ? lock_release+0x453/0x600
[ 76.595793] seq_read+0x261/0x350
[ 76.596127] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 76.596550] ? __pfx_seq_read+0x10/0x10
[ 76.596917] ? trace_irq_enable.constprop.0+0xce/0x110
[ 76.597375] vfs_read+0x171/0x9e0
[ 76.597711] ? lock_acquire+0x408/0x4b0
[ 76.598080] ? __pfx_vfs_read+0x10/0x10
[ 76.598446] ? do_raw_spin_lock+0x119/0x240
[ 76.599092] ? __pfx_task_mm_cid_work+0x10/0x10
[ 76.599529] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 76.599944] ksys_read+0xdd/0x1a0
[ 76.600274] ? __pfx_ksys_read+0x10/0x10
[ 76.600648] ? trace_irq_enable.constprop.0+0xce/0x110
[ 76.601116] do_syscall_64+0x66/0x130
[ 76.601471] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 76.601926] RIP: 0033:0x7f9b5d95140e
[ 76.602284] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 76.603708] RSP: 002b:00007ffd50ab1618 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 76.604356] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f9b5d95140e
[ 76.604953] RDX: 0000000000020000 RSI: 00007f9b5d845000 RDI: 0000000000000003
[ 76.605544] RBP: 00007f9b5d845000 R08: 00007f9b5d844010 R09: 0000000000000000
[ 76.606135] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 76.606727] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 76.607319] </TASK>
[ 76.607574]
[ 76.607782] Allocated by task 4363:
[ 76.608127] kasan_save_stack+0x20/0x40
[ 76.608495] kasan_save_track+0x14/0x30
[ 76.608863] __kasan_kmalloc+0x8f/0xa0
[ 76.609228] user_event_parse_cmd+0x55e/0x25a0
[ 76.609641] user_events_ioctl+0xa52/0x17f0
[ 76.610031] __x64_sys_ioctl+0x133/0x190
[ 76.610407] do_syscall_64+0x66/0x130
[ 76.610763] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 76.611211]
[ 76.611420] Freed by task 341:
[ 76.611737] kasan_save_stack+0x20/0x40
[ 76.612105] kasan_save_track+0x14/0x30
[ 76.612472] kasan_save_free_info+0x3b/0x60
[ 76.612872] poison_slab_object+0x10a/0x170
[ 76.613263] __kasan_slab_free+0x14/0x30
[ 76.613635] kfree+0xe0/0x2f0
[ 76.613946] destroy_user_event+0x305/0x450
[ 76.614339] delayed_destroy_user_event+0x5c/0xe0
[ 76.614766] process_one_work+0x81c/0x1970
[ 76.615150] worker_thread+0x608/0x1160
[ 76.615518] kthread+0x2be/0x3b0
[ 76.615848] ret_from_fork+0x2c/0x70
[ 76.616199] ret_from_fork_asm+0x1a/0x30
[ 76.616576]
[ 76.616794] Last potentially related work creation:
[ 76.617233] kasan_save_stack+0x20/0x40
[ 76.617599] __kasan_record_aux_stack+0x8e/0xa0
[ 76.618017] insert_work+0x20/0x1b0
[ 76.618366] __queue_work+0x67a/0xc60
[ 76.618720] queue_work_on+0x63/0x90
[ 76.619073] user_event_put+0x1f9/0x390
[ 76.619440] user_events_release+0x124/0x200
[ 76.619836] __fput+0x361/0xa60
[ 76.620159] __x64_sys_close+0x77/0xd0
[ 76.620520] do_syscall_64+0x66/0x130
[ 76.620878] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 76.621330]
[ 76.621539] The buggy address belongs to the object at ffff888004498800
[ 76.621539] which belongs to the cache kmalloc-cg-512 of size 512
[ 76.622533] The buggy address is located 264 bytes inside of
[ 76.622533] freed 512-byte region [ffff888004498800, ffff888004498a00)
[ 76.623483]
[ 76.623691] The buggy address belongs to the physical page:
[ 76.624177] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4498
[ 76.624844] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 76.625498] memcg:ffff888003f75301
[ 76.625834] flags: 0x40(head|zone=0)
[ 76.630239] page_type: 0xffffefff(slab)
[ 76.630608] raw: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 76.631275] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 76.631929] head: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 76.632596] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 76.633266] head: 0000000000000002 ffffea0000112601 ffffffffffffffff 0000000000000000
[ 76.633933] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 76.634596] page dumped because: kasan: bad access detected
[ 76.635086]
[ 76.635295] Memory state around the buggy address:
[ 76.635724] ffff888004498800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.636349] ffff888004498880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.636974] >ffff888004498900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.637595] ^
[ 76.637936] ffff888004498980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.638563] ffff888004498a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 76.639186] ==================================================================
[ 76.639824] ==================================================================
[ 76.640455] BUG: KASAN: slab-use-after-free in user_event_get_fields+0x38/0x40
[ 76.641084] Read of size 8 at addr ffff8880044988b8 by task cat/4361
[ 76.641623]
[ 76.641835] CPU: 3 PID: 4361 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 76.642504] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 76.643419] Call Trace:
[ 76.643691] <TASK>
[ 76.643939] dump_stack_lvl+0x66/0xa0
[ 76.644295] print_report+0xd0/0x630
[ 76.644645] ? user_event_get_fields+0x38/0x40
[ 76.645058] ? __virt_addr_valid+0x208/0x3f0
[ 76.645456] ? user_event_get_fields+0x38/0x40
[ 76.645867] kasan_report+0xd8/0x110
[ 76.646218] ? user_event_get_fields+0x38/0x40
[ 76.646626] user_event_get_fields+0x38/0x40
[ 76.647027] f_start+0x175/0x3d0
[ 76.647362] seq_read_iter+0x268/0x11e0
[ 76.647731] ? lock_release+0x453/0x600
[ 76.648103] seq_read+0x261/0x350
[ 76.648439] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 76.648865] ? __pfx_seq_read+0x10/0x10
[ 76.649229] ? trace_irq_enable.constprop.0+0xce/0x110
[ 76.649691] vfs_read+0x171/0x9e0
[ 76.650025] ? lock_acquire+0x408/0x4b0
[ 76.650392] ? __pfx_vfs_read+0x10/0x10
[ 76.650758] ? do_raw_spin_lock+0x119/0x240
[ 76.651153] ? __pfx_task_mm_cid_work+0x10/0x10
[ 76.651566] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 76.651986] ksys_read+0xdd/0x1a0
[ 76.652316] ? __pfx_ksys_read+0x10/0x10
[ 76.652691] ? trace_irq_enable.constprop.0+0xce/0x110
[ 76.653153] do_syscall_64+0x66/0x130
[ 76.653510] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 76.653961] RIP: 0033:0x7f9b5d95140e
[ 76.654313] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 76.655735] RSP: 002b:00007ffd50ab1618 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 76.656378] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f9b5d95140e
[ 76.656974] RDX: 0000000000020000 RSI: 00007f9b5d845000 RDI: 0000000000000003
[ 76.657563] RBP: 00007f9b5d845000 R08: 00007f9b5d844010 R09: 0000000000000000
[ 76.658154] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 76.658746] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 76.659594] </TASK>
[ 76.659851]
[ 76.660064] Allocated by task 4363:
[ 76.660407] kasan_save_stack+0x20/0x40
[ 76.660783] kasan_save_track+0x14/0x30
[ 76.661156] __kasan_kmalloc+0x8f/0xa0
[ 76.661519] user_event_parse_cmd+0x55e/0x25a0
[ 76.661930] user_events_ioctl+0xa52/0x17f0
[ 76.662325] __x64_sys_ioctl+0x133/0x190
[ 76.662701] do_syscall_64+0x66/0x130
[ 76.663056] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 76.663506]
[ 76.663717] Freed by task 341:
[ 76.664030] kasan_save_stack+0x20/0x40
[ 76.664394] kasan_save_track+0x14/0x30
[ 76.664773] kasan_save_free_info+0x3b/0x60
[ 76.665168] poison_slab_object+0x10a/0x170
[ 76.665557] __kasan_slab_free+0x14/0x30
[ 76.665929] kfree+0xe0/0x2f0
[ 76.666242] destroy_user_event+0x305/0x450
[ 76.666632] delayed_destroy_user_event+0x5c/0xe0
[ 76.667072] process_one_work+0x81c/0x1970
[ 76.667459] worker_thread+0x608/0x1160
[ 76.667827] kthread+0x2be/0x3b0
[ 76.668157] ret_from_fork+0x2c/0x70
[ 76.668507] ret_from_fork_asm+0x1a/0x30
[ 76.668885]
[ 76.669093] Last potentially related work creation:
[ 76.669530] kasan_save_stack+0x20/0x40
[ 76.669899] __kasan_record_aux_stack+0x8e/0xa0
[ 76.670319] insert_work+0x20/0x1b0
[ 76.670661] __queue_work+0x67a/0xc60
[ 76.671020] queue_work_on+0x63/0x90
[ 76.671373] user_event_put+0x1f9/0x390
[ 76.671742] user_events_release+0x124/0x200
[ 76.672139] __fput+0x361/0xa60
[ 76.672458] __x64_sys_close+0x77/0xd0
[ 76.672824] do_syscall_64+0x66/0x130
[ 76.673185] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 76.673637]
[ 76.673848] The buggy address belongs to the object at ffff888004498800
[ 76.673848] which belongs to the cache kmalloc-cg-512 of size 512
[ 76.674835] The buggy address is located 184 bytes inside of
[ 76.674835] freed 512-byte region [ffff888004498800, ffff888004498a00)
[ 76.675795]
[ 76.676007] The buggy address belongs to the physical page:
[ 76.676490] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4498
[ 76.677154] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 76.677812] memcg:ffff888003f75301
[ 76.678150] flags: 0x40(head|zone=0)
[ 76.678502] page_type: 0xffffefff(slab)
[ 76.678868] raw: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 76.679521] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 76.680182] head: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 76.680844] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 76.681509] head: 0000000000000002 ffffea0000112601 ffffffffffffffff 0000000000000000
[ 76.682178] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 76.682842] page dumped because: kasan: bad access detected
[ 76.683323]
[ 76.683535] Memory state around the buggy address:
[ 76.683965] ffff888004498780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 76.684588] ffff888004498800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.685213] >ffff888004498880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.685835] ^
[ 76.686285] ffff888004498900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.686909] ffff888004498980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.687531] ==================================================================
[ 76.688181] ==================================================================
[ 76.689048] BUG: KASAN: slab-use-after-free in f_start+0x2e4/0x3d0
[ 76.689590] Read of size 8 at addr ffff888004498870 by task cat/4361
[ 76.690131]
[ 76.690343] CPU: 3 PID: 4361 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 76.691022] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 76.691927] Call Trace:
[ 76.692200] <TASK>
[ 76.692453] dump_stack_lvl+0x66/0xa0
[ 76.692817] print_report+0xd0/0x630
[ 76.693163] ? f_start+0x2e4/0x3d0
[ 76.693507] ? __virt_addr_valid+0x208/0x3f0
[ 76.693905] ? f_start+0x2e4/0x3d0
[ 76.694245] kasan_report+0xd8/0x110
[ 76.694597] ? f_start+0x2e4/0x3d0
[ 76.694941] f_start+0x2e4/0x3d0
[ 76.695267] seq_read_iter+0x268/0x11e0
[ 76.695635] ? lock_release+0x453/0x600
[ 76.699823] seq_read+0x261/0x350
[ 76.700154] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 76.700578] ? __pfx_seq_read+0x10/0x10
[ 76.700952] ? trace_irq_enable.constprop.0+0xce/0x110
[ 76.701409] vfs_read+0x171/0x9e0
[ 76.701740] ? lock_acquire+0x408/0x4b0
[ 76.702109] ? __pfx_vfs_read+0x10/0x10
[ 76.702476] ? do_raw_spin_lock+0x119/0x240
[ 76.702871] ? __pfx_task_mm_cid_work+0x10/0x10
[ 76.703283] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 76.703704] ksys_read+0xdd/0x1a0
[ 76.704037] ? __pfx_ksys_read+0x10/0x10
[ 76.704411] ? trace_irq_enable.constprop.0+0xce/0x110
[ 76.704871] do_syscall_64+0x66/0x130
[ 76.705235] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 76.705686] RIP: 0033:0x7f9b5d95140e
[ 76.706034] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 76.707474] RSP: 002b:00007ffd50ab1618 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 76.708126] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f9b5d95140e
[ 76.708721] RDX: 0000000000020000 RSI: 00007f9b5d845000 RDI: 0000000000000003
[ 76.709322] RBP: 00007f9b5d845000 R08: 00007f9b5d844010 R09: 0000000000000000
[ 76.709921] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 76.710513] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 76.711112] </TASK>
[ 76.711374]
[ 76.711584] Allocated by task 4363:
[ 76.711928] kasan_save_stack+0x20/0x40
[ 76.712296] kasan_save_track+0x14/0x30
[ 76.712659] __kasan_kmalloc+0x8f/0xa0
[ 76.713027] user_event_parse_cmd+0x55e/0x25a0
[ 76.713439] user_events_ioctl+0xa52/0x17f0
[ 76.713829] __x64_sys_ioctl+0x133/0x190
[ 76.714202] do_syscall_64+0x66/0x130
[ 76.714558] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 76.715009]
[ 76.715216] Freed by task 341:
[ 76.715534] kasan_save_stack+0x20/0x40
[ 76.715900] kasan_save_track+0x14/0x30
[ 76.716272] kasan_save_free_info+0x3b/0x60
[ 76.716667] poison_slab_object+0x10a/0x170
[ 76.717060] __kasan_slab_free+0x14/0x30
[ 76.717432] kfree+0xe0/0x2f0
[ 76.717742] destroy_user_event+0x305/0x450
[ 76.718135] delayed_destroy_user_event+0x5c/0xe0
[ 76.718568] process_one_work+0x81c/0x1970
[ 76.719177] worker_thread+0x608/0x1160
[ 76.719558] kthread+0x2be/0x3b0
[ 76.719887] ret_from_fork+0x2c/0x70
[ 76.720242] ret_from_fork_asm+0x1a/0x30
[ 76.720615]
[ 76.720836] Last potentially related work creation:
[ 76.721269] kasan_save_stack+0x20/0x40
[ 76.721634] __kasan_record_aux_stack+0x8e/0xa0
[ 76.722050] insert_work+0x20/0x1b0
[ 76.722396] __queue_work+0x67a/0xc60
[ 76.722761] queue_work_on+0x63/0x90
[ 76.723110] user_event_put+0x1f9/0x390
[ 76.723478] user_events_release+0x124/0x200
[ 76.723875] __fput+0x361/0xa60
[ 76.724194] __x64_sys_close+0x77/0xd0
[ 76.724558] do_syscall_64+0x66/0x130
[ 76.724919] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 76.725368]
[ 76.725575] The buggy address belongs to the object at ffff888004498800
[ 76.725575] which belongs to the cache kmalloc-cg-512 of size 512
[ 76.726579] The buggy address is located 112 bytes inside of
[ 76.726579] freed 512-byte region [ffff888004498800, ffff888004498a00)
[ 76.727537]
[ 76.727744] The buggy address belongs to the physical page:
[ 76.728231] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4498
[ 76.728904] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 76.729555] memcg:ffff888003f75301
[ 76.729892] flags: 0x40(head|zone=0)
[ 76.730242] page_type: 0xffffefff(slab)
[ 76.730615] raw: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 76.731272] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 76.731932] head: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 76.732591] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 76.733270] head: 0000000000000002 ffffea0000112601 ffffffffffffffff 0000000000000000
[ 76.733929] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 76.734595] page dumped because: kasan: bad access detected
[ 76.735079]
[ 76.735289] Memory state around the buggy address:
[ 76.735725] ffff888004498700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 76.736343] ffff888004498780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 76.736971] >ffff888004498800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.737592] ^
[ 76.738166] ffff888004498880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.738792] ffff888004498900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.739422] ==================================================================
[ 76.740061] ==================================================================
[ 76.740694] BUG: KASAN: slab-use-after-free in f_start+0x2cb/0x3d0
[ 76.741224] Read of size 8 at addr ffff888004498908 by task cat/4361
[ 76.741764]
[ 76.741974] CPU: 3 PID: 4361 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 76.742650] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 76.743573] Call Trace:
[ 76.743850] <TASK>
[ 76.744102] dump_stack_lvl+0x66/0xa0
[ 76.744462] print_report+0xd0/0x630
[ 76.744822] ? f_start+0x2cb/0x3d0
[ 76.745160] ? __virt_addr_valid+0x208/0x3f0
[ 76.745559] ? f_start+0x2cb/0x3d0
[ 76.745898] kasan_report+0xd8/0x110
[ 76.746246] ? f_start+0x2cb/0x3d0
[ 76.746584] f_start+0x2cb/0x3d0
[ 76.746916] seq_read_iter+0x268/0x11e0
[ 76.747282] ? lock_release+0x453/0x600
[ 76.747644] seq_read+0x261/0x350
[ 76.747980] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 76.748399] ? __pfx_seq_read+0x10/0x10
[ 76.748771] ? trace_irq_enable.constprop.0+0xce/0x110
[ 76.749384] vfs_read+0x171/0x9e0
[ 76.749719] ? lock_acquire+0x408/0x4b0
[ 76.750089] ? __pfx_vfs_read+0x10/0x10
[ 76.750454] ? do_raw_spin_lock+0x119/0x240
[ 76.750845] ? __pfx_task_mm_cid_work+0x10/0x10
[ 76.751259] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 76.751672] ksys_read+0xdd/0x1a0
[ 76.752002] ? __pfx_ksys_read+0x10/0x10
[ 76.752375] ? trace_irq_enable.constprop.0+0xce/0x110
[ 76.752843] do_syscall_64+0x66/0x130
[ 76.753205] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 76.753649] RIP: 0033:0x7f9b5d95140e
[ 76.754004] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 76.755433] RSP: 002b:00007ffd50ab1618 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 76.756074] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f9b5d95140e
[ 76.756666] RDX: 0000000000020000 RSI: 00007f9b5d845000 RDI: 0000000000000003
[ 76.757258] RBP: 00007f9b5d845000 R08: 00007f9b5d844010 R09: 0000000000000000
[ 76.757850] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 76.758437] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 76.759032] </TASK>
[ 76.759286]
[ 76.759497] Allocated by task 4363:
[ 76.759841] kasan_save_stack+0x20/0x40
[ 76.760207] kasan_save_track+0x14/0x30
[ 76.760571] __kasan_kmalloc+0x8f/0xa0
[ 76.760936] user_event_parse_cmd+0x55e/0x25a0
[ 76.761343] user_events_ioctl+0xa52/0x17f0
[ 76.761732] __x64_sys_ioctl+0x133/0x190
[ 76.762107] do_syscall_64+0x66/0x130
[ 76.762468] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 76.762918]
[ 76.763129] Freed by task 341:
[ 76.763444] kasan_save_stack+0x20/0x40
[ 76.763810] kasan_save_track+0x14/0x30
[ 76.764174] kasan_save_free_info+0x3b/0x60
[ 76.764560] poison_slab_object+0x10a/0x170
[ 76.764958] __kasan_slab_free+0x14/0x30
[ 76.765329] kfree+0xe0/0x2f0
[ 76.765640] destroy_user_event+0x305/0x450
[ 76.766030] delayed_destroy_user_event+0x5c/0xe0
[ 76.766456] process_one_work+0x81c/0x1970
[ 76.766839] worker_thread+0x608/0x1160
[ 76.767208] kthread+0x2be/0x3b0
[ 76.767538] ret_from_fork+0x2c/0x70
[ 76.767885] ret_from_fork_asm+0x1a/0x30
[ 76.771545]
[ 76.771751] Last potentially related work creation:
[ 76.772180] kasan_save_stack+0x20/0x40
[ 76.772545] __kasan_record_aux_stack+0x8e/0xa0
[ 76.772965] insert_work+0x20/0x1b0
[ 76.773306] __queue_work+0x67a/0xc60
[ 76.773665] queue_work_on+0x63/0x90
[ 76.774010] user_event_put+0x1f9/0x390
[ 76.774371] user_events_release+0x124/0x200
[ 76.774766] __fput+0x361/0xa60
[ 76.775088] __x64_sys_close+0x77/0xd0
[ 76.775449] do_syscall_64+0x66/0x130
[ 76.775800] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 76.776248]
[ 76.776461] The buggy address belongs to the object at ffff888004498800
[ 76.776461] which belongs to the cache kmalloc-cg-512 of size 512
[ 76.777456] The buggy address is located 264 bytes inside of
[ 76.777456] freed 512-byte region [ffff888004498800, ffff888004498a00)
[ 76.778409]
[ 76.778620] The buggy address belongs to the physical page:
[ 76.779272] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4498
[ 76.779933] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 76.780577] memcg:ffff888003f75301
[ 76.780921] flags: 0x40(head|zone=0)
[ 76.781271] page_type: 0xffffefff(slab)
[ 76.781635] raw: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 76.782296] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 76.782948] head: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 76.783607] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 76.784264] head: 0000000000000002 ffffea0000112601 ffffffffffffffff 0000000000000000
[ 76.784929] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 76.785587] page dumped because: kasan: bad access detected
[ 76.786070]
[ 76.786282] Memory state around the buggy address:
[ 76.786712] ffff888004498800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.787332] ffff888004498880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.787953] >ffff888004498900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.788574] ^
[ 76.788919] ffff888004498980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.789535] ffff888004498a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 76.790152] ==================================================================
[ 76.790790] ==================================================================
[ 76.791412] BUG: KASAN: slab-use-after-free in user_event_get_fields+0x38/0x40
[ 76.792037] Read of size 8 at addr ffff8880044988b8 by task cat/4361
[ 76.792575]
[ 76.792791] CPU: 3 PID: 4361 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 76.793464] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 76.794366] Call Trace:
[ 76.794637] <TASK>
[ 76.794882] dump_stack_lvl+0x66/0xa0
[ 76.795237] print_report+0xd0/0x630
[ 76.795589] ? user_event_get_fields+0x38/0x40
[ 76.796001] ? __virt_addr_valid+0x208/0x3f0
[ 76.796401] ? user_event_get_fields+0x38/0x40
[ 76.796820] kasan_report+0xd8/0x110
[ 76.797175] ? user_event_get_fields+0x38/0x40
[ 76.797585] user_event_get_fields+0x38/0x40
[ 76.797986] f_start+0x175/0x3d0
[ 76.798320] seq_read_iter+0x268/0x11e0
[ 76.798686] ? lock_release+0x453/0x600
[ 76.799057] seq_read+0x261/0x350
[ 76.799391] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 76.799808] ? __pfx_seq_read+0x10/0x10
[ 76.800176] ? trace_irq_enable.constprop.0+0xce/0x110
[ 76.800631] vfs_read+0x171/0x9e0
[ 76.800968] ? lock_acquire+0x408/0x4b0
[ 76.801331] ? __pfx_vfs_read+0x10/0x10
[ 76.801695] ? do_raw_spin_lock+0x119/0x240
[ 76.802087] ? __pfx_task_mm_cid_work+0x10/0x10
[ 76.802498] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 76.802914] ksys_read+0xdd/0x1a0
[ 76.803248] ? __pfx_ksys_read+0x10/0x10
[ 76.803621] ? trace_irq_enable.constprop.0+0xce/0x110
[ 76.804076] do_syscall_64+0x66/0x130
[ 76.804428] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 76.804883] RIP: 0033:0x7f9b5d95140e
[ 76.805234] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 76.806649] RSP: 002b:00007ffd50ab1618 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 76.807294] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f9b5d95140e
[ 76.807885] RDX: 0000000000020000 RSI: 00007f9b5d845000 RDI: 0000000000000003
[ 76.808473] RBP: 00007f9b5d845000 R08: 00007f9b5d844010 R09: 0000000000000000
[ 76.809250] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 76.809840] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 76.810428] </TASK>
[ 76.810680]
[ 76.810891] Allocated by task 4363:
[ 76.811230] kasan_save_stack+0x20/0x40
[ 76.811595] kasan_save_track+0x14/0x30
[ 76.811961] __kasan_kmalloc+0x8f/0xa0
[ 76.812321] user_event_parse_cmd+0x55e/0x25a0
[ 76.812725] user_events_ioctl+0xa52/0x17f0
[ 76.813123] __x64_sys_ioctl+0x133/0x190
[ 76.813496] do_syscall_64+0x66/0x130
[ 76.813849] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 76.814301]
[ 76.814511] Freed by task 341:
[ 76.814824] kasan_save_stack+0x20/0x40
[ 76.815193] kasan_save_track+0x14/0x30
[ 76.815561] kasan_save_free_info+0x3b/0x60
[ 76.815953] poison_slab_object+0x10a/0x170
[ 76.816341] __kasan_slab_free+0x14/0x30
[ 76.816714] kfree+0xe0/0x2f0
[ 76.817030] destroy_user_event+0x305/0x450
[ 76.817421] delayed_destroy_user_event+0x5c/0xe0
[ 76.817848] process_one_work+0x81c/0x1970
[ 76.818236] worker_thread+0x608/0x1160
[ 76.818604] kthread+0x2be/0x3b0
[ 76.818929] ret_from_fork+0x2c/0x70
[ 76.819279] ret_from_fork_asm+0x1a/0x30
[ 76.819651]
[ 76.819859] Last potentially related work creation:
[ 76.820292] kasan_save_stack+0x20/0x40
[ 76.820656] __kasan_record_aux_stack+0x8e/0xa0
[ 76.821074] insert_work+0x20/0x1b0
[ 76.821418] __queue_work+0x67a/0xc60
[ 76.821771] queue_work_on+0x63/0x90
[ 76.822121] user_event_put+0x1f9/0x390
[ 76.822492] user_events_release+0x124/0x200
[ 76.822889] __fput+0x361/0xa60
[ 76.823213] __x64_sys_close+0x77/0xd0
[ 76.823570] do_syscall_64+0x66/0x130
[ 76.823925] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 76.824375]
[ 76.824583] The buggy address belongs to the object at ffff888004498800
[ 76.824583] which belongs to the cache kmalloc-cg-512 of size 512
[ 76.825572] The buggy address is located 184 bytes inside of
[ 76.825572] freed 512-byte region [ffff888004498800, ffff888004498a00)
[ 76.826529]
[ 76.826741] The buggy address belongs to the physical page:
[ 76.827220] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4498
[ 76.827877] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 76.828529] memcg:ffff888003f75301
[ 76.828878] flags: 0x40(head|zone=0)
[ 76.829230] page_type: 0xffffefff(slab)
[ 76.829595] raw: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 76.830251] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 76.830914] head: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 76.831580] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 76.832242] head: 0000000000000002 ffffea0000112601 ffffffffffffffff 0000000000000000
[ 76.832916] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 76.833579] page dumped because: kasan: bad access detected
[ 76.834064]
[ 76.834274] Memory state around the buggy address:
[ 76.834702] ffff888004498780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 76.835322] ffff888004498800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.835942] >ffff888004498880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.836565] ^
[ 76.837014] ffff888004498900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.841610] ffff888004498980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.842230] ==================================================================
[ 76.842864] ==================================================================
[ 76.843516] BUG: KASAN: slab-use-after-free in f_start+0x2e4/0x3d0
[ 76.844044] Read of size 8 at addr ffff888004498870 by task cat/4361
[ 76.844582]
[ 76.844793] CPU: 3 PID: 4361 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 76.845474] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 76.846383] Call Trace:
[ 76.846657] <TASK>
[ 76.846906] dump_stack_lvl+0x66/0xa0
[ 76.847261] print_report+0xd0/0x630
[ 76.847611] ? f_start+0x2e4/0x3d0
[ 76.847950] ? __virt_addr_valid+0x208/0x3f0
[ 76.848346] ? f_start+0x2e4/0x3d0
[ 76.848689] kasan_report+0xd8/0x110
[ 76.849043] ? f_start+0x2e4/0x3d0
[ 76.849380] f_start+0x2e4/0x3d0
[ 76.849712] seq_read_iter+0x268/0x11e0
[ 76.850080] ? lock_release+0x453/0x600
[ 76.850450] seq_read+0x261/0x350
[ 76.850784] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 76.851207] ? __pfx_seq_read+0x10/0x10
[ 76.851575] ? trace_irq_enable.constprop.0+0xce/0x110
[ 76.852036] vfs_read+0x171/0x9e0
[ 76.852368] ? lock_acquire+0x408/0x4b0
[ 76.852741] ? __pfx_vfs_read+0x10/0x10
[ 76.853110] ? do_raw_spin_lock+0x119/0x240
[ 76.853501] ? __pfx_task_mm_cid_work+0x10/0x10
[ 76.853921] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 76.854341] ksys_read+0xdd/0x1a0
[ 76.854670] ? __pfx_ksys_read+0x10/0x10
[ 76.855044] ? trace_irq_enable.constprop.0+0xce/0x110
[ 76.855504] do_syscall_64+0x66/0x130
[ 76.855861] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 76.856311] RIP: 0033:0x7f9b5d95140e
[ 76.856657] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 76.858096] RSP: 002b:00007ffd50ab1618 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 76.858740] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f9b5d95140e
[ 76.859332] RDX: 0000000000020000 RSI: 00007f9b5d845000 RDI: 0000000000000003
[ 76.859923] RBP: 00007f9b5d845000 R08: 00007f9b5d844010 R09: 0000000000000000
[ 76.860515] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 76.861112] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 76.861704] </TASK>
[ 76.861960]
[ 76.862165] Allocated by task 4363:
[ 76.862513] kasan_save_stack+0x20/0x40
[ 76.862883] kasan_save_track+0x14/0x30
[ 76.863246] __kasan_kmalloc+0x8f/0xa0
[ 76.863608] user_event_parse_cmd+0x55e/0x25a0
[ 76.864020] user_events_ioctl+0xa52/0x17f0
[ 76.864410] __x64_sys_ioctl+0x133/0x190
[ 76.864788] do_syscall_64+0x66/0x130
[ 76.865145] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 76.865594]
[ 76.865803] Freed by task 341:
[ 76.866120] kasan_save_stack+0x20/0x40
[ 76.866489] kasan_save_track+0x14/0x30
[ 76.866855] kasan_save_free_info+0x3b/0x60
[ 76.867246] poison_slab_object+0x10a/0x170
[ 76.867637] __kasan_slab_free+0x14/0x30
[ 76.868011] kfree+0xe0/0x2f0
[ 76.868322] destroy_user_event+0x305/0x450
[ 76.868714] delayed_destroy_user_event+0x5c/0xe0
[ 76.869318] process_one_work+0x81c/0x1970
[ 76.869709] worker_thread+0x608/0x1160
[ 76.870074] kthread+0x2be/0x3b0
[ 76.870404] ret_from_fork+0x2c/0x70
[ 76.870756] ret_from_fork_asm+0x1a/0x30
[ 76.871131]
[ 76.871343] Last potentially related work creation:
[ 76.871781] kasan_save_stack+0x20/0x40
[ 76.872146] __kasan_record_aux_stack+0x8e/0xa0
[ 76.872564] insert_work+0x20/0x1b0
[ 76.872917] __queue_work+0x67a/0xc60
[ 76.873274] queue_work_on+0x63/0x90
[ 76.873622] user_event_put+0x1f9/0x390
[ 76.873997] user_events_release+0x124/0x200
[ 76.874397] __fput+0x361/0xa60
[ 76.874717] __x64_sys_close+0x77/0xd0
[ 76.875080] do_syscall_64+0x66/0x130
[ 76.875439] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 76.875892]
[ 76.876100] The buggy address belongs to the object at ffff888004498800
[ 76.876100] which belongs to the cache kmalloc-cg-512 of size 512
[ 76.877105] The buggy address is located 112 bytes inside of
[ 76.877105] freed 512-byte region [ffff888004498800, ffff888004498a00)
[ 76.878060]
[ 76.878268] The buggy address belongs to the physical page:
[ 76.878755] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4498
[ 76.879421] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 76.880079] memcg:ffff888003f75301
[ 76.880414] flags: 0x40(head|zone=0)
[ 76.880767] page_type: 0xffffefff(slab)
[ 76.881138] raw: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 76.881796] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 76.882455] head: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 76.883112] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 76.883777] head: 0000000000000002 ffffea0000112601 ffffffffffffffff 0000000000000000
[ 76.884436] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 76.885104] page dumped because: kasan: bad access detected
[ 76.885583]
[ 76.885793] Memory state around the buggy address:
[ 76.886226] ffff888004498700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 76.886851] ffff888004498780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 76.887471] >ffff888004498800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.888092] ^
[ 76.888667] ffff888004498880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.889296] ffff888004498900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.889920] ==================================================================
[ 76.890561] ==================================================================
[ 76.891216] BUG: KASAN: slab-use-after-free in f_start+0x2cb/0x3d0
[ 76.891740] Read of size 8 at addr ffff888004498908 by task cat/4361
[ 76.892276]
[ 76.892488] CPU: 3 PID: 4361 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 76.893168] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 76.894078] Call Trace:
[ 76.894352] <TASK>
[ 76.894599] dump_stack_lvl+0x66/0xa0
[ 76.894956] print_report+0xd0/0x630
[ 76.895306] ? f_start+0x2cb/0x3d0
[ 76.895641] ? __virt_addr_valid+0x208/0x3f0
[ 76.896044] ? f_start+0x2cb/0x3d0
[ 76.896381] kasan_report+0xd8/0x110
[ 76.896737] ? f_start+0x2cb/0x3d0
[ 76.897076] f_start+0x2cb/0x3d0
[ 76.897402] seq_read_iter+0x268/0x11e0
[ 76.897769] ? lock_release+0x453/0x600
[ 76.898138] seq_read+0x261/0x350
[ 76.898473] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 76.899108] ? __pfx_seq_read+0x10/0x10
[ 76.899484] ? trace_irq_enable.constprop.0+0xce/0x110
[ 76.899944] vfs_read+0x171/0x9e0
[ 76.900282] ? lock_acquire+0x408/0x4b0
[ 76.900652] ? __pfx_vfs_read+0x10/0x10
[ 76.901022] ? do_raw_spin_lock+0x119/0x240
[ 76.901414] ? __pfx_task_mm_cid_work+0x10/0x10
[ 76.901831] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 76.902246] ksys_read+0xdd/0x1a0
[ 76.902578] ? __pfx_ksys_read+0x10/0x10
[ 76.902957] ? trace_irq_enable.constprop.0+0xce/0x110
[ 76.903411] do_syscall_64+0x66/0x130
[ 76.903766] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 76.904209] RIP: 0033:0x7f9b5d95140e
[ 76.904566] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 76.905997] RSP: 002b:00007ffd50ab1618 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 76.906638] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f9b5d95140e
[ 76.907233] RDX: 0000000000020000 RSI: 00007f9b5d845000 RDI: 0000000000000003
[ 76.907823] RBP: 00007f9b5d845000 R08: 00007f9b5d844010 R09: 0000000000000000
[ 76.908410] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 76.908997] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 76.913376] </TASK>
[ 76.913621]
[ 76.913829] Allocated by task 4363:
[ 76.914160] kasan_save_stack+0x20/0x40
[ 76.914533] kasan_save_track+0x14/0x30
[ 76.914889] __kasan_kmalloc+0x8f/0xa0
[ 76.915244] user_event_parse_cmd+0x55e/0x25a0
[ 76.915650] user_events_ioctl+0xa52/0x17f0
[ 76.916041] __x64_sys_ioctl+0x133/0x190
[ 76.916408] do_syscall_64+0x66/0x130
[ 76.916765] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 76.917215]
[ 76.917427] Freed by task 341:
[ 76.917738] kasan_save_stack+0x20/0x40
[ 76.918104] kasan_save_track+0x14/0x30
[ 76.918472] kasan_save_free_info+0x3b/0x60
[ 76.918858] poison_slab_object+0x10a/0x170
[ 76.919246] __kasan_slab_free+0x14/0x30
[ 76.919616] kfree+0xe0/0x2f0
[ 76.919928] destroy_user_event+0x305/0x450
[ 76.920313] delayed_destroy_user_event+0x5c/0xe0
[ 76.920744] process_one_work+0x81c/0x1970
[ 76.921130] worker_thread+0x608/0x1160
[ 76.921493] kthread+0x2be/0x3b0
[ 76.921815] ret_from_fork+0x2c/0x70
[ 76.922170] ret_from_fork_asm+0x1a/0x30
[ 76.922545]
[ 76.922754] Last potentially related work creation:
[ 76.923198] kasan_save_stack+0x20/0x40
[ 76.923565] __kasan_record_aux_stack+0x8e/0xa0
[ 76.923977] insert_work+0x20/0x1b0
[ 76.924320] __queue_work+0x67a/0xc60
[ 76.924678] queue_work_on+0x63/0x90
[ 76.925031] user_event_put+0x1f9/0x390
[ 76.925396] user_events_release+0x124/0x200
[ 76.925793] __fput+0x361/0xa60
[ 76.926116] __x64_sys_close+0x77/0xd0
[ 76.926476] do_syscall_64+0x66/0x130
[ 76.926833] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 76.927282]
[ 76.927490] The buggy address belongs to the object at ffff888004498800
[ 76.927490] which belongs to the cache kmalloc-cg-512 of size 512
[ 76.928484] The buggy address is located 264 bytes inside of
[ 76.928484] freed 512-byte region [ffff888004498800, ffff888004498a00)
[ 76.929572]
[ 76.929784] The buggy address belongs to the physical page:
[ 76.930267] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4498
[ 76.930928] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 76.931576] memcg:ffff888003f75301
[ 76.931916] flags: 0x40(head|zone=0)
[ 76.932266] page_type: 0xffffefff(slab)
[ 76.932632] raw: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 76.933302] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 76.933958] head: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 76.934619] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 76.935280] head: 0000000000000002 ffffea0000112601 ffffffffffffffff 0000000000000000
[ 76.935945] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 76.936601] page dumped because: kasan: bad access detected
[ 76.937082]
[ 76.937293] Memory state around the buggy address:
[ 76.937721] ffff888004498800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.938344] ffff888004498880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.938964] >ffff888004498900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.939582] ^
[ 76.939924] ffff888004498980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.940555] ffff888004498a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 76.941177] ==================================================================
[ 76.941823] ==================================================================
[ 76.942447] BUG: KASAN: slab-use-after-free in user_event_get_fields+0x38/0x40
[ 76.943071] Read of size 8 at addr ffff8880044988b8 by task cat/4361
[ 76.943610]
[ 76.943822] CPU: 3 PID: 4361 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 76.944488] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 76.945394] Call Trace:
[ 76.945664] <TASK>
[ 76.945912] dump_stack_lvl+0x66/0xa0
[ 76.946266] print_report+0xd0/0x630
[ 76.946619] ? user_event_get_fields+0x38/0x40
[ 76.947029] ? __virt_addr_valid+0x208/0x3f0
[ 76.947436] ? user_event_get_fields+0x38/0x40
[ 76.947850] kasan_report+0xd8/0x110
[ 76.948201] ? user_event_get_fields+0x38/0x40
[ 76.948610] user_event_get_fields+0x38/0x40
[ 76.949016] f_start+0x175/0x3d0
[ 76.949346] seq_read_iter+0x268/0x11e0
[ 76.949712] ? lock_release+0x453/0x600
[ 76.950081] seq_read+0x261/0x350
[ 76.950417] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 76.950837] ? __pfx_seq_read+0x10/0x10
[ 76.951203] ? trace_irq_enable.constprop.0+0xce/0x110
[ 76.951663] vfs_read+0x171/0x9e0
[ 76.952000] ? lock_acquire+0x408/0x4b0
[ 76.952366] ? __pfx_vfs_read+0x10/0x10
[ 76.952739] ? do_raw_spin_lock+0x119/0x240
[ 76.953136] ? __pfx_task_mm_cid_work+0x10/0x10
[ 76.953551] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 76.953969] ksys_read+0xdd/0x1a0
[ 76.954302] ? __pfx_ksys_read+0x10/0x10
[ 76.954675] ? trace_irq_enable.constprop.0+0xce/0x110
[ 76.955129] do_syscall_64+0x66/0x130
[ 76.955485] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 76.955938] RIP: 0033:0x7f9b5d95140e
[ 76.956290] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 76.957711] RSP: 002b:00007ffd50ab1618 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 76.958356] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f9b5d95140e
[ 76.959211] RDX: 0000000000020000 RSI: 00007f9b5d845000 RDI: 0000000000000003
[ 76.959810] RBP: 00007f9b5d845000 R08: 00007f9b5d844010 R09: 0000000000000000
[ 76.960398] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 76.960994] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 76.961598] </TASK>
[ 76.961851]
[ 76.962064] Allocated by task 4363:
[ 76.962410] kasan_save_stack+0x20/0x40
[ 76.962779] kasan_save_track+0x14/0x30
[ 76.963154] __kasan_kmalloc+0x8f/0xa0
[ 76.963517] user_event_parse_cmd+0x55e/0x25a0
[ 76.963924] user_events_ioctl+0xa52/0x17f0
[ 76.964316] __x64_sys_ioctl+0x133/0x190
[ 76.964691] do_syscall_64+0x66/0x130
[ 76.965053] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 76.965506]
[ 76.965719] Freed by task 341:
[ 76.966036] kasan_save_stack+0x20/0x40
[ 76.966409] kasan_save_track+0x14/0x30
[ 76.966780] kasan_save_free_info+0x3b/0x60
[ 76.967170] poison_slab_object+0x10a/0x170
[ 76.967556] __kasan_slab_free+0x14/0x30
[ 76.967935] kfree+0xe0/0x2f0
[ 76.968251] destroy_user_event+0x305/0x450
[ 76.968643] delayed_destroy_user_event+0x5c/0xe0
[ 76.969071] process_one_work+0x81c/0x1970
[ 76.969459] worker_thread+0x608/0x1160
[ 76.969833] kthread+0x2be/0x3b0
[ 76.970160] ret_from_fork+0x2c/0x70
[ 76.970514] ret_from_fork_asm+0x1a/0x30
[ 76.970889]
[ 76.971100] Last potentially related work creation:
[ 76.971541] kasan_save_stack+0x20/0x40
[ 76.971910] __kasan_record_aux_stack+0x8e/0xa0
[ 76.972332] insert_work+0x20/0x1b0
[ 76.972676] __queue_work+0x67a/0xc60
[ 76.973038] queue_work_on+0x63/0x90
[ 76.973390] user_event_put+0x1f9/0x390
[ 76.973758] user_events_release+0x124/0x200
[ 76.974157] __fput+0x361/0xa60
[ 76.974480] __x64_sys_close+0x77/0xd0
[ 76.974839] do_syscall_64+0x66/0x130
[ 76.975194] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 76.975655]
[ 76.975870] The buggy address belongs to the object at ffff888004498800
[ 76.975870] which belongs to the cache kmalloc-cg-512 of size 512
[ 76.976871] The buggy address is located 184 bytes inside of
[ 76.976871] freed 512-byte region [ffff888004498800, ffff888004498a00)
[ 76.977837]
[ 76.978046] The buggy address belongs to the physical page:
[ 76.978539] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4498
[ 76.979204] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 76.983681] memcg:ffff888003f75301
[ 76.984030] flags: 0x40(head|zone=0)
[ 76.984382] page_type: 0xffffefff(slab)
[ 76.984756] raw: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 76.985416] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 76.986075] head: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 76.986746] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 76.987412] head: 0000000000000002 ffffea0000112601 ffffffffffffffff 0000000000000000
[ 76.988077] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 76.988750] page dumped because: kasan: bad access detected
[ 76.989462]
[ 76.989676] Memory state around the buggy address:
[ 76.990115] ffff888004498780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 76.990742] ffff888004498800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.991362] >ffff888004498880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.991985] ^
[ 76.992440] ffff888004498900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.993072] ffff888004498980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 76.993700] ==================================================================
[ 76.994361] ==================================================================
[ 76.994995] BUG: KASAN: slab-use-after-free in f_start+0x2e4/0x3d0
[ 76.995525] Read of size 8 at addr ffff888004498870 by task cat/4361
[ 76.996073]
[ 76.996284] CPU: 3 PID: 4361 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 76.996977] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 76.997889] Call Trace:
[ 76.998166] <TASK>
[ 76.998419] dump_stack_lvl+0x66/0xa0
[ 76.998783] print_report+0xd0/0x630
[ 76.999142] ? f_start+0x2e4/0x3d0
[ 76.999480] ? __virt_addr_valid+0x208/0x3f0
[ 76.999881] ? f_start+0x2e4/0x3d0
[ 77.000224] kasan_report+0xd8/0x110
[ 77.000576] ? f_start+0x2e4/0x3d0
[ 77.000921] f_start+0x2e4/0x3d0
[ 77.001256] seq_read_iter+0x268/0x11e0
[ 77.001625] ? lock_release+0x453/0x600
[ 77.001995] seq_read+0x261/0x350
[ 77.002332] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 77.002752] ? __pfx_seq_read+0x10/0x10
[ 77.003127] ? trace_irq_enable.constprop.0+0xce/0x110
[ 77.003587] vfs_read+0x171/0x9e0
[ 77.003922] ? lock_acquire+0x408/0x4b0
[ 77.004290] ? __pfx_vfs_read+0x10/0x10
[ 77.004662] ? do_raw_spin_lock+0x119/0x240
[ 77.005051] ? __pfx_task_mm_cid_work+0x10/0x10
[ 77.005472] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 77.005898] ksys_read+0xdd/0x1a0
[ 77.006229] ? __pfx_ksys_read+0x10/0x10
[ 77.006609] ? trace_irq_enable.constprop.0+0xce/0x110
[ 77.007071] do_syscall_64+0x66/0x130
[ 77.007428] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.007882] RIP: 0033:0x7f9b5d95140e
[ 77.008234] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 77.009668] RSP: 002b:00007ffd50ab1618 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 77.010313] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f9b5d95140e
[ 77.010907] RDX: 0000000000020000 RSI: 00007f9b5d845000 RDI: 0000000000000003
[ 77.011507] RBP: 00007f9b5d845000 R08: 00007f9b5d844010 R09: 0000000000000000
[ 77.012107] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 77.012702] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 77.013301] </TASK>
[ 77.013555]
[ 77.013763] Allocated by task 4363:
[ 77.014112] kasan_save_stack+0x20/0x40
[ 77.014478] kasan_save_track+0x14/0x30
[ 77.014842] __kasan_kmalloc+0x8f/0xa0
[ 77.015205] user_event_parse_cmd+0x55e/0x25a0
[ 77.015615] user_events_ioctl+0xa52/0x17f0
[ 77.016005] __x64_sys_ioctl+0x133/0x190
[ 77.016382] do_syscall_64+0x66/0x130
[ 77.016753] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.017202]
[ 77.017407] Freed by task 341:
[ 77.017723] kasan_save_stack+0x20/0x40
[ 77.018090] kasan_save_track+0x14/0x30
[ 77.018457] kasan_save_free_info+0x3b/0x60
[ 77.019058] poison_slab_object+0x10a/0x170
[ 77.019464] __kasan_slab_free+0x14/0x30
[ 77.019835] kfree+0xe0/0x2f0
[ 77.020145] destroy_user_event+0x305/0x450
[ 77.020538] delayed_destroy_user_event+0x5c/0xe0
[ 77.020977] process_one_work+0x81c/0x1970
[ 77.021360] worker_thread+0x608/0x1160
[ 77.021728] kthread+0x2be/0x3b0
[ 77.022060] ret_from_fork+0x2c/0x70
[ 77.022406] ret_from_fork_asm+0x1a/0x30
[ 77.022778]
[ 77.022995] Last potentially related work creation:
[ 77.023429] kasan_save_stack+0x20/0x40
[ 77.023791] __kasan_record_aux_stack+0x8e/0xa0
[ 77.024205] insert_work+0x20/0x1b0
[ 77.024552] __queue_work+0x67a/0xc60
[ 77.024908] queue_work_on+0x63/0x90
[ 77.025258] user_event_put+0x1f9/0x390
[ 77.025631] user_events_release+0x124/0x200
[ 77.026036] __fput+0x361/0xa60
[ 77.026354] __x64_sys_close+0x77/0xd0
[ 77.026719] do_syscall_64+0x66/0x130
[ 77.027075] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.027520]
[ 77.027734] The buggy address belongs to the object at ffff888004498800
[ 77.027734] which belongs to the cache kmalloc-cg-512 of size 512
[ 77.028729] The buggy address is located 112 bytes inside of
[ 77.028729] freed 512-byte region [ffff888004498800, ffff888004498a00)
[ 77.029690]
[ 77.029899] The buggy address belongs to the physical page:
[ 77.030382] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4498
[ 77.031039] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 77.031689] memcg:ffff888003f75301
[ 77.032021] flags: 0x40(head|zone=0)
[ 77.032372] page_type: 0xffffefff(slab)
[ 77.032748] raw: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 77.033405] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 77.034064] head: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 77.034722] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 77.035386] head: 0000000000000002 ffffea0000112601 ffffffffffffffff 0000000000000000
[ 77.036054] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 77.036715] page dumped because: kasan: bad access detected
[ 77.037199]
[ 77.037409] Memory state around the buggy address:
[ 77.037838] ffff888004498700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 77.038461] ffff888004498780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 77.039085] >ffff888004498800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.039703] ^
[ 77.040279] ffff888004498880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.040909] ffff888004498900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.041547] ==================================================================
[ 77.042194] ==================================================================
[ 77.042827] BUG: KASAN: slab-use-after-free in f_start+0x2cb/0x3d0
[ 77.043358] Read of size 8 at addr ffff888004498908 by task cat/4361
[ 77.043898]
[ 77.044213] CPU: 3 PID: 4361 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 77.045094] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 77.046284] Call Trace:
[ 77.046631] <TASK>
[ 77.046942] dump_stack_lvl+0x66/0xa0
[ 77.047399] print_report+0xd0/0x630
[ 77.047846] ? f_start+0x2cb/0x3d0
[ 77.048276] ? __virt_addr_valid+0x208/0x3f0
[ 77.048942] ? f_start+0x2cb/0x3d0
[ 77.049374] kasan_report+0xd8/0x110
[ 77.049820] ? f_start+0x2cb/0x3d0
[ 77.050251] f_start+0x2cb/0x3d0
[ 77.050642] seq_read_iter+0x268/0x11e0
[ 77.051088] ? lock_release+0x453/0x600
[ 77.055344] seq_read+0x261/0x350
[ 77.055768] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 77.056308] ? __pfx_seq_read+0x10/0x10
[ 77.056783] ? trace_irq_enable.constprop.0+0xce/0x110
[ 77.057377] vfs_read+0x171/0x9e0
[ 77.057802] ? lock_acquire+0x408/0x4b0
[ 77.058270] ? __pfx_vfs_read+0x10/0x10
[ 77.058742] ? do_raw_spin_lock+0x119/0x240
[ 77.059241] ? __pfx_task_mm_cid_work+0x10/0x10
[ 77.059772] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 77.060308] ksys_read+0xdd/0x1a0
[ 77.060738] ? __pfx_ksys_read+0x10/0x10
[ 77.061216] ? trace_irq_enable.constprop.0+0xce/0x110
[ 77.061802] do_syscall_64+0x66/0x130
[ 77.062262] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.062807] RIP: 0033:0x7f9b5d95140e
[ 77.063252] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 77.065067] RSP: 002b:00007ffd50ab1618 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 77.065904] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f9b5d95140e
[ 77.066666] RDX: 0000000000020000 RSI: 00007f9b5d845000 RDI: 0000000000000003
[ 77.067430] RBP: 00007f9b5d845000 R08: 00007f9b5d844010 R09: 0000000000000000
[ 77.068192] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 77.068960] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 77.069725] </TASK>
[ 77.070050]
[ 77.070289] Allocated by task 4363:
[ 77.070699] kasan_save_stack+0x20/0x40
[ 77.071140] kasan_save_track+0x14/0x30
[ 77.071610] __kasan_kmalloc+0x8f/0xa0
[ 77.072071] user_event_parse_cmd+0x55e/0x25a0
[ 77.072566] user_events_ioctl+0xa52/0x17f0
[ 77.073036] __x64_sys_ioctl+0x133/0x190
[ 77.073511] do_syscall_64+0x66/0x130
[ 77.073963] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.074543]
[ 77.074804] Freed by task 341:
[ 77.075203] kasan_save_stack+0x20/0x40
[ 77.075672] kasan_save_track+0x14/0x30
[ 77.076142] kasan_save_free_info+0x3b/0x60
[ 77.076640] poison_slab_object+0x10a/0x170
[ 77.077112] __kasan_slab_free+0x14/0x30
[ 77.077591] kfree+0xe0/0x2f0
[ 77.077983] destroy_user_event+0x305/0x450
[ 77.078481] delayed_destroy_user_event+0x5c/0xe0
[ 77.079180] process_one_work+0x81c/0x1970
[ 77.079676] worker_thread+0x608/0x1160
[ 77.080143] kthread+0x2be/0x3b0
[ 77.080555] ret_from_fork+0x2c/0x70
[ 77.081011] ret_from_fork_asm+0x1a/0x30
[ 77.081457]
[ 77.081693] Last potentially related work creation:
[ 77.082222] kasan_save_stack+0x20/0x40
[ 77.082693] __kasan_record_aux_stack+0x8e/0xa0
[ 77.083224] insert_work+0x20/0x1b0
[ 77.083663] __queue_work+0x67a/0xc60
[ 77.084119] queue_work_on+0x63/0x90
[ 77.084562] user_event_put+0x1f9/0x390
[ 77.085003] user_events_release+0x124/0x200
[ 77.085513] __fput+0x361/0xa60
[ 77.085924] __x64_sys_close+0x77/0xd0
[ 77.086353] do_syscall_64+0x66/0x130
[ 77.086809] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.087389]
[ 77.087649] The buggy address belongs to the object at ffff888004498800
[ 77.087649] which belongs to the cache kmalloc-cg-512 of size 512
[ 77.088957] The buggy address is located 264 bytes inside of
[ 77.088957] freed 512-byte region [ffff888004498800, ffff888004498a00)
[ 77.090214]
[ 77.090451] The buggy address belongs to the physical page:
[ 77.091036] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4498
[ 77.091902] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 77.092747] memcg:ffff888003f75301
[ 77.093179] flags: 0x40(head|zone=0)
[ 77.093624] page_type: 0xffffefff(slab)
[ 77.094092] raw: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 77.094945] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 77.095790] head: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 77.096611] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 77.097423] head: 0000000000000002 ffffea0000112601 ffffffffffffffff 0000000000000000
[ 77.098287] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 77.099151] page dumped because: kasan: bad access detected
[ 77.099740]
[ 77.099980] Memory state around the buggy address:
[ 77.100505] ffff888004498800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.101266] ffff888004498880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.102066] >ffff888004498900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.102872] ^
[ 77.103311] ffff888004498980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.104118] ffff888004498a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 77.104926] ==================================================================
[ 77.105758] ==================================================================
[ 77.106576] BUG: KASAN: slab-use-after-free in user_event_get_fields+0x38/0x40
[ 77.107386] Read of size 8 at addr ffff8880044988b8 by task cat/4361
[ 77.108041]
[ 77.108304] CPU: 3 PID: 4361 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 77.109346] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 77.110482] Call Trace:
[ 77.110827] <TASK>
[ 77.111143] dump_stack_lvl+0x66/0xa0
[ 77.111601] print_report+0xd0/0x630
[ 77.112017] ? user_event_get_fields+0x38/0x40
[ 77.112514] ? __virt_addr_valid+0x208/0x3f0
[ 77.113000] ? user_event_get_fields+0x38/0x40
[ 77.113523] kasan_report+0xd8/0x110
[ 77.113970] ? user_event_get_fields+0x38/0x40
[ 77.114497] user_event_get_fields+0x38/0x40
[ 77.115003] f_start+0x175/0x3d0
[ 77.115422] seq_read_iter+0x268/0x11e0
[ 77.115894] ? lock_release+0x453/0x600
[ 77.116365] seq_read+0x261/0x350
[ 77.116794] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 77.117333] ? __pfx_seq_read+0x10/0x10
[ 77.117804] ? trace_irq_enable.constprop.0+0xce/0x110
[ 77.118398] vfs_read+0x171/0x9e0
[ 77.118821] ? lock_acquire+0x408/0x4b0
[ 77.119291] ? __pfx_vfs_read+0x10/0x10
[ 77.119763] ? do_raw_spin_lock+0x119/0x240
[ 77.120266] ? __pfx_task_mm_cid_work+0x10/0x10
[ 77.120773] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 77.121306] ksys_read+0xdd/0x1a0
[ 77.121731] ? __pfx_ksys_read+0x10/0x10
[ 77.122211] ? trace_irq_enable.constprop.0+0xce/0x110
[ 77.122795] do_syscall_64+0x66/0x130
[ 77.123250] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.123829] RIP: 0033:0x7f9b5d95140e
[ 77.124276] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 77.126142] RSP: 002b:00007ffd50ab1618 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 77.126984] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f9b5d95140e
[ 77.127706] RDX: 0000000000020000 RSI: 00007f9b5d845000 RDI: 0000000000000003
[ 77.128467] RBP: 00007f9b5d845000 R08: 00007f9b5d844010 R09: 0000000000000000
[ 77.129236] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 77.129961] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 77.130724] </TASK>
[ 77.131044]
[ 77.131305] Allocated by task 4363:
[ 77.131714] kasan_save_stack+0x20/0x40
[ 77.132154] kasan_save_track+0x14/0x30
[ 77.132624] __kasan_kmalloc+0x8f/0xa0
[ 77.133086] user_event_parse_cmd+0x55e/0x25a0
[ 77.133609] user_events_ioctl+0xa52/0x17f0
[ 77.134111] __x64_sys_ioctl+0x133/0x190
[ 77.134587] do_syscall_64+0x66/0x130
[ 77.135041] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.135621]
[ 77.135861] Freed by task 341:
[ 77.136258] kasan_save_stack+0x20/0x40
[ 77.136728] kasan_save_track+0x14/0x30
[ 77.137204] kasan_save_free_info+0x3b/0x60
[ 77.137703] poison_slab_object+0x10a/0x170
[ 77.138200] __kasan_slab_free+0x14/0x30
[ 77.138678] kfree+0xe0/0x2f0
[ 77.139209] destroy_user_event+0x305/0x450
[ 77.139705] delayed_destroy_user_event+0x5c/0xe0
[ 77.140251] process_one_work+0x81c/0x1970
[ 77.140749] worker_thread+0x608/0x1160
[ 77.141187] kthread+0x2be/0x3b0
[ 77.145785] ret_from_fork+0x2c/0x70
[ 77.146201] ret_from_fork_asm+0x1a/0x30
[ 77.146675]
[ 77.146938] Last potentially related work creation:
[ 77.147498] kasan_save_stack+0x20/0x40
[ 77.147934] __kasan_record_aux_stack+0x8e/0xa0
[ 77.148440] insert_work+0x20/0x1b0
[ 77.148850] __queue_work+0x67a/0xc60
[ 77.149299] queue_work_on+0x63/0x90
[ 77.149742] user_event_put+0x1f9/0x390
[ 77.150209] user_events_release+0x124/0x200
[ 77.150716] __fput+0x361/0xa60
[ 77.151120] __x64_sys_close+0x77/0xd0
[ 77.151579] do_syscall_64+0x66/0x130
[ 77.152032] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.152605]
[ 77.152866] The buggy address belongs to the object at ffff888004498800
[ 77.152866] which belongs to the cache kmalloc-cg-512 of size 512
[ 77.154158] The buggy address is located 184 bytes inside of
[ 77.154158] freed 512-byte region [ffff888004498800, ffff888004498a00)
[ 77.155394]
[ 77.155651] The buggy address belongs to the physical page:
[ 77.156271] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4498
[ 77.157112] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 77.157952] memcg:ffff888003f75301
[ 77.158357] flags: 0x40(head|zone=0)
[ 77.158770] page_type: 0xffffefff(slab)
[ 77.159241] raw: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 77.160046] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 77.160847] head: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 77.161702] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 77.162506] head: 0000000000000002 ffffea0000112601 ffffffffffffffff 0000000000000000
[ 77.163361] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 77.164217] page dumped because: kasan: bad access detected
[ 77.164835]
[ 77.165050] Memory state around the buggy address:
[ 77.165484] ffff888004498780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 77.166123] ffff888004498800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.166757] >ffff888004498880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.167387] ^
[ 77.167845] ffff888004498900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.168479] ffff888004498980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.169287] ==================================================================
[ 77.169935] ==================================================================
[ 77.170564] BUG: KASAN: slab-use-after-free in f_start+0x2e4/0x3d0
[ 77.171098] Read of size 8 at addr ffff888004498870 by task cat/4361
[ 77.171647]
[ 77.171861] CPU: 3 PID: 4361 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 77.172545] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 77.173471] Call Trace:
[ 77.173750] <TASK>
[ 77.174000] dump_stack_lvl+0x66/0xa0
[ 77.174361] print_report+0xd0/0x630
[ 77.174717] ? f_start+0x2e4/0x3d0
[ 77.175055] ? __virt_addr_valid+0x208/0x3f0
[ 77.175459] ? f_start+0x2e4/0x3d0
[ 77.175800] kasan_report+0xd8/0x110
[ 77.176153] ? f_start+0x2e4/0x3d0
[ 77.176498] f_start+0x2e4/0x3d0
[ 77.176836] seq_read_iter+0x268/0x11e0
[ 77.177207] ? lock_release+0x453/0x600
[ 77.177574] seq_read+0x261/0x350
[ 77.177918] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 77.178351] ? __pfx_seq_read+0x10/0x10
[ 77.178719] ? trace_irq_enable.constprop.0+0xce/0x110
[ 77.179184] vfs_read+0x171/0x9e0
[ 77.179525] ? lock_acquire+0x408/0x4b0
[ 77.179895] ? __pfx_vfs_read+0x10/0x10
[ 77.180266] ? do_raw_spin_lock+0x119/0x240
[ 77.180661] ? __pfx_task_mm_cid_work+0x10/0x10
[ 77.181086] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 77.181503] ksys_read+0xdd/0x1a0
[ 77.181837] ? __pfx_ksys_read+0x10/0x10
[ 77.182216] ? trace_irq_enable.constprop.0+0xce/0x110
[ 77.182676] do_syscall_64+0x66/0x130
[ 77.183034] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.183485] RIP: 0033:0x7f9b5d95140e
[ 77.183841] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 77.185290] RSP: 002b:00007ffd50ab1618 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 77.185939] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f9b5d95140e
[ 77.186536] RDX: 0000000000020000 RSI: 00007f9b5d845000 RDI: 0000000000000003
[ 77.187132] RBP: 00007f9b5d845000 R08: 00007f9b5d844010 R09: 0000000000000000
[ 77.187731] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 77.188327] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 77.188928] </TASK>
[ 77.189185]
[ 77.189396] Allocated by task 4363:
[ 77.189745] kasan_save_stack+0x20/0x40
[ 77.190119] kasan_save_track+0x14/0x30
[ 77.190490] __kasan_kmalloc+0x8f/0xa0
[ 77.190856] user_event_parse_cmd+0x55e/0x25a0
[ 77.191268] user_events_ioctl+0xa52/0x17f0
[ 77.191658] __x64_sys_ioctl+0x133/0x190
[ 77.192039] do_syscall_64+0x66/0x130
[ 77.192401] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.192860]
[ 77.193067] Freed by task 341:
[ 77.193386] kasan_save_stack+0x20/0x40
[ 77.193754] kasan_save_track+0x14/0x30
[ 77.194124] kasan_save_free_info+0x3b/0x60
[ 77.194519] poison_slab_object+0x10a/0x170
[ 77.194916] __kasan_slab_free+0x14/0x30
[ 77.195290] kfree+0xe0/0x2f0
[ 77.195607] destroy_user_event+0x305/0x450
[ 77.196000] delayed_destroy_user_event+0x5c/0xe0
[ 77.196433] process_one_work+0x81c/0x1970
[ 77.196826] worker_thread+0x608/0x1160
[ 77.197196] kthread+0x2be/0x3b0
[ 77.197525] ret_from_fork+0x2c/0x70
[ 77.197878] ret_from_fork_asm+0x1a/0x30
[ 77.198256]
[ 77.198468] Last potentially related work creation:
[ 77.199117] kasan_save_stack+0x20/0x40
[ 77.199490] __kasan_record_aux_stack+0x8e/0xa0
[ 77.199910] insert_work+0x20/0x1b0
[ 77.200257] __queue_work+0x67a/0xc60
[ 77.200614] queue_work_on+0x63/0x90
[ 77.200974] user_event_put+0x1f9/0x390
[ 77.201347] user_events_release+0x124/0x200
[ 77.201749] __fput+0x361/0xa60
[ 77.202071] __x64_sys_close+0x77/0xd0
[ 77.202437] do_syscall_64+0x66/0x130
[ 77.202796] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.203252]
[ 77.203462] The buggy address belongs to the object at ffff888004498800
[ 77.203462] which belongs to the cache kmalloc-cg-512 of size 512
[ 77.204463] The buggy address is located 112 bytes inside of
[ 77.204463] freed 512-byte region [ffff888004498800, ffff888004498a00)
[ 77.205433]
[ 77.205645] The buggy address belongs to the physical page:
[ 77.206135] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4498
[ 77.206806] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 77.207463] memcg:ffff888003f75301
[ 77.207805] flags: 0x40(head|zone=0)
[ 77.208158] page_type: 0xffffefff(slab)
[ 77.208533] raw: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 77.209202] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 77.209870] head: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 77.210535] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 77.211204] head: 0000000000000002 ffffea0000112601 ffffffffffffffff 0000000000000000
[ 77.211870] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 77.212543] page dumped because: kasan: bad access detected
[ 77.213074]
[ 77.213284] Memory state around the buggy address:
[ 77.213717] ffff888004498700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 77.214345] ffff888004498780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 77.214976] >ffff888004498800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.215601] ^
[ 77.216176] ffff888004498880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.220640] ffff888004498900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.221269] ==================================================================
[ 77.221913] ==================================================================
[ 77.222542] BUG: KASAN: slab-use-after-free in f_start+0x2cb/0x3d0
[ 77.223077] Read of size 8 at addr ffff888004498908 by task cat/4361
[ 77.223620]
[ 77.223831] CPU: 3 PID: 4361 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 77.224520] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 77.225446] Call Trace:
[ 77.225719] <TASK>
[ 77.225973] dump_stack_lvl+0x66/0xa0
[ 77.226337] print_report+0xd0/0x630
[ 77.226688] ? f_start+0x2cb/0x3d0
[ 77.227034] ? __virt_addr_valid+0x208/0x3f0
[ 77.227433] ? f_start+0x2cb/0x3d0
[ 77.227777] kasan_report+0xd8/0x110
[ 77.228134] ? f_start+0x2cb/0x3d0
[ 77.228476] f_start+0x2cb/0x3d0
[ 77.228975] seq_read_iter+0x268/0x11e0
[ 77.229349] ? lock_release+0x453/0x600
[ 77.229722] seq_read+0x261/0x350
[ 77.230057] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 77.230479] ? __pfx_seq_read+0x10/0x10
[ 77.230850] ? trace_irq_enable.constprop.0+0xce/0x110
[ 77.231312] vfs_read+0x171/0x9e0
[ 77.231647] ? lock_acquire+0x408/0x4b0
[ 77.232018] ? __pfx_vfs_read+0x10/0x10
[ 77.232392] ? do_raw_spin_lock+0x119/0x240
[ 77.232792] ? __pfx_task_mm_cid_work+0x10/0x10
[ 77.233211] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 77.233631] ksys_read+0xdd/0x1a0
[ 77.233970] ? __pfx_ksys_read+0x10/0x10
[ 77.234346] ? trace_irq_enable.constprop.0+0xce/0x110
[ 77.234807] do_syscall_64+0x66/0x130
[ 77.235169] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.235627] RIP: 0033:0x7f9b5d95140e
[ 77.235978] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 77.237418] RSP: 002b:00007ffd50ab1618 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 77.238071] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f9b5d95140e
[ 77.238665] RDX: 0000000000020000 RSI: 00007f9b5d845000 RDI: 0000000000000003
[ 77.239259] RBP: 00007f9b5d845000 R08: 00007f9b5d844010 R09: 0000000000000000
[ 77.239851] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 77.240449] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 77.241053] </TASK>
[ 77.241313]
[ 77.241521] Allocated by task 4363:
[ 77.241865] kasan_save_stack+0x20/0x40
[ 77.242237] kasan_save_track+0x14/0x30
[ 77.242605] __kasan_kmalloc+0x8f/0xa0
[ 77.242973] user_event_parse_cmd+0x55e/0x25a0
[ 77.243389] user_events_ioctl+0xa52/0x17f0
[ 77.243784] __x64_sys_ioctl+0x133/0x190
[ 77.244160] do_syscall_64+0x66/0x130
[ 77.244517] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.244981]
[ 77.245192] Freed by task 341:
[ 77.245507] kasan_save_stack+0x20/0x40
[ 77.245880] kasan_save_track+0x14/0x30
[ 77.246255] kasan_save_free_info+0x3b/0x60
[ 77.246647] poison_slab_object+0x10a/0x170
[ 77.247046] __kasan_slab_free+0x14/0x30
[ 77.247423] kfree+0xe0/0x2f0
[ 77.247735] destroy_user_event+0x305/0x450
[ 77.248124] delayed_destroy_user_event+0x5c/0xe0
[ 77.248560] process_one_work+0x81c/0x1970
[ 77.248958] worker_thread+0x608/0x1160
[ 77.249328] kthread+0x2be/0x3b0
[ 77.249659] ret_from_fork+0x2c/0x70
[ 77.250015] ret_from_fork_asm+0x1a/0x30
[ 77.250391]
[ 77.250601] Last potentially related work creation:
[ 77.251045] kasan_save_stack+0x20/0x40
[ 77.251413] __kasan_record_aux_stack+0x8e/0xa0
[ 77.251830] insert_work+0x20/0x1b0
[ 77.252179] __queue_work+0x67a/0xc60
[ 77.252539] queue_work_on+0x63/0x90
[ 77.252895] user_event_put+0x1f9/0x390
[ 77.253267] user_events_release+0x124/0x200
[ 77.253668] __fput+0x361/0xa60
[ 77.253989] __x64_sys_close+0x77/0xd0
[ 77.254351] do_syscall_64+0x66/0x130
[ 77.254712] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.255167]
[ 77.255376] The buggy address belongs to the object at ffff888004498800
[ 77.255376] which belongs to the cache kmalloc-cg-512 of size 512
[ 77.256382] The buggy address is located 264 bytes inside of
[ 77.256382] freed 512-byte region [ffff888004498800, ffff888004498a00)
[ 77.257358]
[ 77.257566] The buggy address belongs to the physical page:
[ 77.258055] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4498
[ 77.258729] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 77.259456] memcg:ffff888003f75301
[ 77.259798] flags: 0x40(head|zone=0)
[ 77.260149] page_type: 0xffffefff(slab)
[ 77.260518] raw: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 77.261191] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 77.261865] head: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 77.262537] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 77.263201] head: 0000000000000002 ffffea0000112601 ffffffffffffffff 0000000000000000
[ 77.263872] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 77.264538] page dumped because: kasan: bad access detected
[ 77.265032]
[ 77.265240] Memory state around the buggy address:
[ 77.265676] ffff888004498800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.266303] ffff888004498880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.266932] >ffff888004498900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.267556] ^
[ 77.267903] ffff888004498980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.268532] ffff888004498a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 77.269160] ==================================================================
[ 77.269801] ==================================================================
[ 77.270437] BUG: KASAN: slab-use-after-free in user_event_get_fields+0x38/0x40
[ 77.271064] Read of size 8 at addr ffff8880044988b8 by task cat/4361
[ 77.271605]
[ 77.271816] CPU: 3 PID: 4361 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 77.272492] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 77.273419] Call Trace:
[ 77.273694] <TASK>
[ 77.273948] dump_stack_lvl+0x66/0xa0
[ 77.274309] print_report+0xd0/0x630
[ 77.274660] ? user_event_get_fields+0x38/0x40
[ 77.275077] ? __virt_addr_valid+0x208/0x3f0
[ 77.275481] ? user_event_get_fields+0x38/0x40
[ 77.275893] kasan_report+0xd8/0x110
[ 77.276248] ? user_event_get_fields+0x38/0x40
[ 77.276665] user_event_get_fields+0x38/0x40
[ 77.277071] f_start+0x175/0x3d0
[ 77.277401] seq_read_iter+0x268/0x11e0
[ 77.277773] ? lock_release+0x453/0x600
[ 77.278144] seq_read+0x261/0x350
[ 77.278480] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 77.278904] ? __pfx_seq_read+0x10/0x10
[ 77.279277] ? trace_irq_enable.constprop.0+0xce/0x110
[ 77.279741] vfs_read+0x171/0x9e0
[ 77.280076] ? lock_acquire+0x408/0x4b0
[ 77.280447] ? __pfx_vfs_read+0x10/0x10
[ 77.280824] ? do_raw_spin_lock+0x119/0x240
[ 77.281219] ? __pfx_task_mm_cid_work+0x10/0x10
[ 77.281635] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 77.282057] ksys_read+0xdd/0x1a0
[ 77.282393] ? __pfx_ksys_read+0x10/0x10
[ 77.282766] ? trace_irq_enable.constprop.0+0xce/0x110
[ 77.283224] do_syscall_64+0x66/0x130
[ 77.283582] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.284038] RIP: 0033:0x7f9b5d95140e
[ 77.284393] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 77.285836] RSP: 002b:00007ffd50ab1618 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 77.286491] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f9b5d95140e
[ 77.287084] RDX: 0000000000020000 RSI: 00007f9b5d845000 RDI: 0000000000000003
[ 77.287678] RBP: 00007f9b5d845000 R08: 00007f9b5d844010 R09: 0000000000000000
[ 77.292386] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 77.292996] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 77.293599] </TASK>
[ 77.293857]
[ 77.294069] Allocated by task 4363:
[ 77.294418] kasan_save_stack+0x20/0x40
[ 77.294786] kasan_save_track+0x14/0x30
[ 77.295156] __kasan_kmalloc+0x8f/0xa0
[ 77.295523] user_event_parse_cmd+0x55e/0x25a0
[ 77.295939] user_events_ioctl+0xa52/0x17f0
[ 77.296330] __x64_sys_ioctl+0x133/0x190
[ 77.296703] do_syscall_64+0x66/0x130
[ 77.297072] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.297530]
[ 77.297739] Freed by task 341:
[ 77.298059] kasan_save_stack+0x20/0x40
[ 77.298429] kasan_save_track+0x14/0x30
[ 77.298797] kasan_save_free_info+0x3b/0x60
[ 77.299195] poison_slab_object+0x10a/0x170
[ 77.299589] __kasan_slab_free+0x14/0x30
[ 77.299965] kfree+0xe0/0x2f0
[ 77.300279] destroy_user_event+0x305/0x450
[ 77.300674] delayed_destroy_user_event+0x5c/0xe0
[ 77.301113] process_one_work+0x81c/0x1970
[ 77.301500] worker_thread+0x608/0x1160
[ 77.301868] kthread+0x2be/0x3b0
[ 77.302201] ret_from_fork+0x2c/0x70
[ 77.302555] ret_from_fork_asm+0x1a/0x30
[ 77.302934]
[ 77.303145] Last potentially related work creation:
[ 77.303584] kasan_save_stack+0x20/0x40
[ 77.303952] __kasan_record_aux_stack+0x8e/0xa0
[ 77.304373] insert_work+0x20/0x1b0
[ 77.304725] __queue_work+0x67a/0xc60
[ 77.305086] queue_work_on+0x63/0x90
[ 77.305437] user_event_put+0x1f9/0x390
[ 77.305813] user_events_release+0x124/0x200
[ 77.306216] __fput+0x361/0xa60
[ 77.306542] __x64_sys_close+0x77/0xd0
[ 77.306912] do_syscall_64+0x66/0x130
[ 77.307275] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.307729]
[ 77.307937] The buggy address belongs to the object at ffff888004498800
[ 77.307937] which belongs to the cache kmalloc-cg-512 of size 512
[ 77.308945] The buggy address is located 184 bytes inside of
[ 77.308945] freed 512-byte region [ffff888004498800, ffff888004498a00)
[ 77.309905]
[ 77.310113] The buggy address belongs to the physical page:
[ 77.310602] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4498
[ 77.311271] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 77.311925] memcg:ffff888003f75301
[ 77.312263] flags: 0x40(head|zone=0)
[ 77.312615] page_type: 0xffffefff(slab)
[ 77.312994] raw: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 77.313659] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 77.314325] head: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 77.314992] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 77.315664] head: 0000000000000002 ffffea0000112601 ffffffffffffffff 0000000000000000
[ 77.316333] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 77.317009] page dumped because: kasan: bad access detected
[ 77.317496]
[ 77.317704] Memory state around the buggy address:
[ 77.318143] ffff888004498780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 77.318771] ffff888004498800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.319590] >ffff888004498880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.320217] ^
[ 77.320674] ffff888004498900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.321304] ffff888004498980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.321932] ==================================================================
[ 77.322577] ==================================================================
[ 77.323215] BUG: KASAN: slab-use-after-free in f_start+0x2f8/0x3d0
[ 77.323743] Read of size 8 at addr ffff888004498958 by task cat/4361
[ 77.324281]
[ 77.324498] CPU: 3 PID: 4361 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 77.325182] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 77.326108] Call Trace:
[ 77.326383] <TASK>
[ 77.326634] dump_stack_lvl+0x66/0xa0
[ 77.326996] print_report+0xd0/0x630
[ 77.327354] ? f_start+0x2f8/0x3d0
[ 77.327695] ? __virt_addr_valid+0x208/0x3f0
[ 77.328098] ? f_start+0x2f8/0x3d0
[ 77.328442] kasan_report+0xd8/0x110
[ 77.328801] ? f_start+0x2f8/0x3d0
[ 77.329147] f_start+0x2f8/0x3d0
[ 77.329481] seq_read_iter+0x268/0x11e0
[ 77.329851] ? lock_release+0x453/0x600
[ 77.330222] seq_read+0x261/0x350
[ 77.330560] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 77.330988] ? __pfx_seq_read+0x10/0x10
[ 77.331355] ? trace_irq_enable.constprop.0+0xce/0x110
[ 77.331820] vfs_read+0x171/0x9e0
[ 77.332157] ? lock_acquire+0x408/0x4b0
[ 77.332530] ? __pfx_vfs_read+0x10/0x10
[ 77.332907] ? do_raw_spin_lock+0x119/0x240
[ 77.333306] ? __pfx_task_mm_cid_work+0x10/0x10
[ 77.333725] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 77.334144] ksys_read+0xdd/0x1a0
[ 77.334477] ? __pfx_ksys_read+0x10/0x10
[ 77.334855] ? trace_irq_enable.constprop.0+0xce/0x110
[ 77.335319] do_syscall_64+0x66/0x130
[ 77.335677] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.336131] RIP: 0033:0x7f9b5d95140e
[ 77.336488] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 77.337933] RSP: 002b:00007ffd50ab1618 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 77.338585] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f9b5d95140e
[ 77.339185] RDX: 0000000000020000 RSI: 00007f9b5d845000 RDI: 0000000000000003
[ 77.339781] RBP: 00007f9b5d845000 R08: 00007f9b5d844010 R09: 0000000000000000
[ 77.340384] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 77.340984] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 77.341582] </TASK>
[ 77.341837]
[ 77.342048] Allocated by task 4363:
[ 77.342394] kasan_save_stack+0x20/0x40
[ 77.342763] kasan_save_track+0x14/0x30
[ 77.343138] __kasan_kmalloc+0x8f/0xa0
[ 77.343503] user_event_parse_cmd+0x55e/0x25a0
[ 77.343916] user_events_ioctl+0xa52/0x17f0
[ 77.344308] __x64_sys_ioctl+0x133/0x190
[ 77.344689] do_syscall_64+0x66/0x130
[ 77.345058] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.345511]
[ 77.345721] Freed by task 341:
[ 77.346039] kasan_save_stack+0x20/0x40
[ 77.346406] kasan_save_track+0x14/0x30
[ 77.346779] kasan_save_free_info+0x3b/0x60
[ 77.347173] poison_slab_object+0x10a/0x170
[ 77.347566] __kasan_slab_free+0x14/0x30
[ 77.347944] kfree+0xe0/0x2f0
[ 77.348259] destroy_user_event+0x305/0x450
[ 77.348655] delayed_destroy_user_event+0x5c/0xe0
[ 77.349341] process_one_work+0x81c/0x1970
[ 77.349735] worker_thread+0x608/0x1160
[ 77.350108] kthread+0x2be/0x3b0
[ 77.350441] ret_from_fork+0x2c/0x70
[ 77.350797] ret_from_fork_asm+0x1a/0x30
[ 77.351176]
[ 77.351391] Last potentially related work creation:
[ 77.351832] kasan_save_stack+0x20/0x40
[ 77.352211] __kasan_record_aux_stack+0x8e/0xa0
[ 77.352636] insert_work+0x20/0x1b0
[ 77.352990] __queue_work+0x67a/0xc60
[ 77.353350] queue_work_on+0x63/0x90
[ 77.353706] user_event_put+0x1f9/0x390
[ 77.354081] user_events_release+0x124/0x200
[ 77.354482] __fput+0x361/0xa60
[ 77.354809] __x64_sys_close+0x77/0xd0
[ 77.355175] do_syscall_64+0x66/0x130
[ 77.355534] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.355990]
[ 77.356204] The buggy address belongs to the object at ffff888004498800
[ 77.356204] which belongs to the cache kmalloc-cg-512 of size 512
[ 77.357253] The buggy address is located 344 bytes inside of
[ 77.357253] freed 512-byte region [ffff888004498800, ffff888004498a00)
[ 77.358222]
[ 77.358435] The buggy address belongs to the physical page:
[ 77.358921] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4498
[ 77.359588] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 77.364077] memcg:ffff888003f75301
[ 77.364422] flags: 0x40(head|zone=0)
[ 77.364784] page_type: 0xffffefff(slab)
[ 77.365155] raw: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 77.365826] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 77.366486] head: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 77.367160] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 77.367827] head: 0000000000000002 ffffea0000112601 ffffffffffffffff 0000000000000000
[ 77.368500] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 77.369174] page dumped because: kasan: bad access detected
[ 77.369667]
[ 77.369874] Memory state around the buggy address:
[ 77.370312] ffff888004498800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.370944] ffff888004498880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.371568] >ffff888004498900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.372196] ^
[ 77.372717] ffff888004498980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.373352] ffff888004498a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 77.373978] ==================================================================
[ 77.374636] ==================================================================
[ 77.375275] BUG: KASAN: slab-use-after-free in f_start+0x2e4/0x3d0
[ 77.375809] Read of size 8 at addr ffff888004498870 by task cat/4361
[ 77.376349]
[ 77.376558] CPU: 3 PID: 4361 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 77.377255] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 77.378169] Call Trace:
[ 77.378443] <TASK>
[ 77.378695] dump_stack_lvl+0x66/0xa0
[ 77.379218] print_report+0xd0/0x630
[ 77.379572] ? f_start+0x2e4/0x3d0
[ 77.379915] ? __virt_addr_valid+0x208/0x3f0
[ 77.380317] ? f_start+0x2e4/0x3d0
[ 77.380658] kasan_report+0xd8/0x110
[ 77.381020] ? f_start+0x2e4/0x3d0
[ 77.381362] f_start+0x2e4/0x3d0
[ 77.381698] seq_read_iter+0x268/0x11e0
[ 77.382073] ? lock_release+0x453/0x600
[ 77.382446] seq_read+0x261/0x350
[ 77.382780] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 77.383208] ? __pfx_seq_read+0x10/0x10
[ 77.383581] ? trace_irq_enable.constprop.0+0xce/0x110
[ 77.384044] vfs_read+0x171/0x9e0
[ 77.384381] ? lock_acquire+0x408/0x4b0
[ 77.384759] ? __pfx_vfs_read+0x10/0x10
[ 77.385133] ? do_raw_spin_lock+0x119/0x240
[ 77.385526] ? __pfx_task_mm_cid_work+0x10/0x10
[ 77.385947] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 77.386371] ksys_read+0xdd/0x1a0
[ 77.386709] ? __pfx_ksys_read+0x10/0x10
[ 77.387085] ? trace_irq_enable.constprop.0+0xce/0x110
[ 77.387546] do_syscall_64+0x66/0x130
[ 77.387906] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.388358] RIP: 0033:0x7f9b5d95140e
[ 77.388712] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 77.390171] RSP: 002b:00007ffd50ab1618 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 77.390824] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f9b5d95140e
[ 77.391417] RDX: 0000000000020000 RSI: 00007f9b5d845000 RDI: 0000000000000003
[ 77.392010] RBP: 00007f9b5d845000 R08: 00007f9b5d844010 R09: 0000000000000000
[ 77.392607] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 77.393210] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 77.393808] </TASK>
[ 77.394066]
[ 77.394275] Allocated by task 4363:
[ 77.394622] kasan_save_stack+0x20/0x40
[ 77.394996] kasan_save_track+0x14/0x30
[ 77.395363] __kasan_kmalloc+0x8f/0xa0
[ 77.395728] user_event_parse_cmd+0x55e/0x25a0
[ 77.396141] user_events_ioctl+0xa52/0x17f0
[ 77.396531] __x64_sys_ioctl+0x133/0x190
[ 77.396916] do_syscall_64+0x66/0x130
[ 77.397276] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.397736]
[ 77.397946] Freed by task 341:
[ 77.398262] kasan_save_stack+0x20/0x40
[ 77.398633] kasan_save_track+0x14/0x30
[ 77.399001] kasan_save_free_info+0x3b/0x60
[ 77.399391] poison_slab_object+0x10a/0x170
[ 77.399786] __kasan_slab_free+0x14/0x30
[ 77.400164] kfree+0xe0/0x2f0
[ 77.400477] destroy_user_event+0x305/0x450
[ 77.400880] delayed_destroy_user_event+0x5c/0xe0
[ 77.401312] process_one_work+0x81c/0x1970
[ 77.401702] worker_thread+0x608/0x1160
[ 77.402071] kthread+0x2be/0x3b0
[ 77.402404] ret_from_fork+0x2c/0x70
[ 77.402758] ret_from_fork_asm+0x1a/0x30
[ 77.403131]
[ 77.403341] Last potentially related work creation:
[ 77.403780] kasan_save_stack+0x20/0x40
[ 77.404149] __kasan_record_aux_stack+0x8e/0xa0
[ 77.404567] insert_work+0x20/0x1b0
[ 77.404921] __queue_work+0x67a/0xc60
[ 77.405288] queue_work_on+0x63/0x90
[ 77.405639] user_event_put+0x1f9/0x390
[ 77.406010] user_events_release+0x124/0x200
[ 77.406414] __fput+0x361/0xa60
[ 77.406736] __x64_sys_close+0x77/0xd0
[ 77.407099] do_syscall_64+0x66/0x130
[ 77.407461] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.407911]
[ 77.408120] The buggy address belongs to the object at ffff888004498800
[ 77.408120] which belongs to the cache kmalloc-cg-512 of size 512
[ 77.409389] The buggy address is located 112 bytes inside of
[ 77.409389] freed 512-byte region [ffff888004498800, ffff888004498a00)
[ 77.410368]
[ 77.410578] The buggy address belongs to the physical page:
[ 77.411068] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4498
[ 77.411740] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 77.412391] memcg:ffff888003f75301
[ 77.412734] flags: 0x40(head|zone=0)
[ 77.413098] page_type: 0xffffefff(slab)
[ 77.413469] raw: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 77.414134] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 77.414792] head: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 77.415464] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 77.416132] head: 0000000000000002 ffffea0000112601 ffffffffffffffff 0000000000000000
[ 77.416802] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 77.417470] page dumped because: kasan: bad access detected
[ 77.417956]
[ 77.418166] Memory state around the buggy address:
[ 77.418605] ffff888004498700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 77.419237] ffff888004498780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 77.419865] >ffff888004498800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.420496] ^
[ 77.421077] ffff888004498880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.421708] ffff888004498900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.422332] ==================================================================
[ 77.423004] ==================================================================
[ 77.423654] BUG: KASAN: slab-use-after-free in f_start+0x2cb/0x3d0
[ 77.424183] Read of size 8 at addr ffff888004498908 by task cat/4361
[ 77.424723]
[ 77.424936] CPU: 1 PID: 4361 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 77.425620] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 77.426525] Call Trace:
[ 77.426798] <TASK>
[ 77.427051] dump_stack_lvl+0x66/0xa0
[ 77.427410] print_report+0xd0/0x630
[ 77.427763] ? f_start+0x2cb/0x3d0
[ 77.428100] ? __virt_addr_valid+0x208/0x3f0
[ 77.428498] ? f_start+0x2cb/0x3d0
[ 77.428849] kasan_report+0xd8/0x110
[ 77.429202] ? f_start+0x2cb/0x3d0
[ 77.429543] f_start+0x2cb/0x3d0
[ 77.429873] seq_read_iter+0x268/0x11e0
[ 77.430244] ? lock_release+0x453/0x600
[ 77.434456] seq_read+0x261/0x350
[ 77.434793] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 77.435214] ? __pfx_seq_read+0x10/0x10
[ 77.435586] ? trace_irq_enable.constprop.0+0xce/0x110
[ 77.436049] vfs_read+0x171/0x9e0
[ 77.436385] ? lock_acquire+0x408/0x4b0
[ 77.436759] ? __pfx_vfs_read+0x10/0x10
[ 77.437128] ? do_raw_spin_lock+0x119/0x240
[ 77.437523] ? __pfx_task_mm_cid_work+0x10/0x10
[ 77.437938] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 77.438356] ksys_read+0xdd/0x1a0
[ 77.438690] ? __pfx_ksys_read+0x10/0x10
[ 77.439222] ? trace_irq_enable.constprop.0+0xce/0x110
[ 77.439679] do_syscall_64+0x66/0x130
[ 77.440033] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.440487] RIP: 0033:0x7f9b5d95140e
[ 77.440848] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 77.442275] RSP: 002b:00007ffd50ab1618 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 77.442920] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f9b5d95140e
[ 77.443512] RDX: 0000000000020000 RSI: 00007f9b5d845000 RDI: 0000000000000003
[ 77.444102] RBP: 00007f9b5d845000 R08: 00007f9b5d844010 R09: 0000000000000000
[ 77.444695] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 77.445285] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 77.445880] </TASK>
[ 77.446135]
[ 77.446344] Allocated by task 4363:
[ 77.446687] kasan_save_stack+0x20/0x40
[ 77.447053] kasan_save_track+0x14/0x30
[ 77.447423] __kasan_kmalloc+0x8f/0xa0
[ 77.447790] user_event_parse_cmd+0x55e/0x25a0
[ 77.448199] user_events_ioctl+0xa52/0x17f0
[ 77.448592] __x64_sys_ioctl+0x133/0x190
[ 77.448972] do_syscall_64+0x66/0x130
[ 77.449330] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.449785]
[ 77.449994] Freed by task 341:
[ 77.450310] kasan_save_stack+0x20/0x40
[ 77.450676] kasan_save_track+0x14/0x30
[ 77.451043] kasan_save_free_info+0x3b/0x60
[ 77.451433] poison_slab_object+0x10a/0x170
[ 77.451826] __kasan_slab_free+0x14/0x30
[ 77.452198] kfree+0xe0/0x2f0
[ 77.452512] destroy_user_event+0x305/0x450
[ 77.452905] delayed_destroy_user_event+0x5c/0xe0
[ 77.453331] process_one_work+0x81c/0x1970
[ 77.453723] worker_thread+0x608/0x1160
[ 77.454092] kthread+0x2be/0x3b0
[ 77.454419] ret_from_fork+0x2c/0x70
[ 77.454768] ret_from_fork_asm+0x1a/0x30
[ 77.455143]
[ 77.455353] Last potentially related work creation:
[ 77.455790] kasan_save_stack+0x20/0x40
[ 77.456160] __kasan_record_aux_stack+0x8e/0xa0
[ 77.456575] insert_work+0x20/0x1b0
[ 77.456922] __queue_work+0x67a/0xc60
[ 77.457279] queue_work_on+0x63/0x90
[ 77.457630] user_event_put+0x1f9/0x390
[ 77.457999] user_events_release+0x124/0x200
[ 77.458395] __fput+0x361/0xa60
[ 77.458721] __x64_sys_close+0x77/0xd0
[ 77.459086] do_syscall_64+0x66/0x130
[ 77.459441] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.459895]
[ 77.460105] The buggy address belongs to the object at ffff888004498800
[ 77.460105] which belongs to the cache kmalloc-cg-512 of size 512
[ 77.461107] The buggy address is located 264 bytes inside of
[ 77.461107] freed 512-byte region [ffff888004498800, ffff888004498a00)
[ 77.462067]
[ 77.462278] The buggy address belongs to the physical page:
[ 77.462760] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4498
[ 77.463422] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 77.464078] memcg:ffff888003f75301
[ 77.464415] flags: 0x40(head|zone=0)
[ 77.464771] page_type: 0xffffefff(slab)
[ 77.465138] raw: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 77.465790] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 77.466450] head: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 77.467115] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 77.467783] head: 0000000000000002 ffffea0000112601 ffffffffffffffff 0000000000000000
[ 77.468446] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 77.469262] page dumped because: kasan: bad access detected
[ 77.469749]
[ 77.469961] Memory state around the buggy address:
[ 77.470392] ffff888004498800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.471015] ffff888004498880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.471635] >ffff888004498900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.472259] ^
[ 77.472600] ffff888004498980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.473230] ffff888004498a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 77.473849] ==================================================================
[ 77.474492] ==================================================================
[ 77.475144] BUG: KASAN: slab-use-after-free in user_event_get_fields+0x38/0x40
[ 77.475765] Read of size 8 at addr ffff8880044988b8 by task cat/4361
[ 77.476301]
[ 77.476514] CPU: 1 PID: 4361 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 77.477198] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 77.478108] Call Trace:
[ 77.478380] <TASK>
[ 77.478631] dump_stack_lvl+0x66/0xa0
[ 77.478990] print_report+0xd0/0x630
[ 77.479344] ? user_event_get_fields+0x38/0x40
[ 77.479753] ? __virt_addr_valid+0x208/0x3f0
[ 77.480149] ? user_event_get_fields+0x38/0x40
[ 77.480558] kasan_report+0xd8/0x110
[ 77.480915] ? user_event_get_fields+0x38/0x40
[ 77.481322] user_event_get_fields+0x38/0x40
[ 77.481719] f_start+0x175/0x3d0
[ 77.482048] seq_read_iter+0x268/0x11e0
[ 77.482418] ? lock_release+0x453/0x600
[ 77.482788] seq_read+0x261/0x350
[ 77.483130] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 77.483554] ? __pfx_seq_read+0x10/0x10
[ 77.483922] ? trace_irq_enable.constprop.0+0xce/0x110
[ 77.484378] vfs_read+0x171/0x9e0
[ 77.484713] ? lock_acquire+0x408/0x4b0
[ 77.485088] ? __pfx_vfs_read+0x10/0x10
[ 77.485453] ? do_raw_spin_lock+0x119/0x240
[ 77.485847] ? __pfx_task_mm_cid_work+0x10/0x10
[ 77.486266] ? __pfx_do_raw_spin_lock+0x10/0x10
[ 77.486681] ksys_read+0xdd/0x1a0
[ 77.487017] ? __pfx_ksys_read+0x10/0x10
[ 77.487392] ? trace_irq_enable.constprop.0+0xce/0x110
[ 77.487849] do_syscall_64+0x66/0x130
[ 77.488204] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.488655] RIP: 0033:0x7f9b5d95140e
[ 77.489010] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 77.490438] RSP: 002b:00007ffd50ab1618 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 77.491085] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007f9b5d95140e
[ 77.491678] RDX: 0000000000020000 RSI: 00007f9b5d845000 RDI: 0000000000000003
[ 77.492271] RBP: 00007f9b5d845000 R08: 00007f9b5d844010 R09: 0000000000000000
[ 77.492867] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 77.493461] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 77.494056] </TASK>
[ 77.494309]
[ 77.494522] Allocated by task 4363:
[ 77.494869] kasan_save_stack+0x20/0x40
[ 77.495239] kasan_save_track+0x14/0x30
[ 77.495607] __kasan_kmalloc+0x8f/0xa0
[ 77.495972] user_event_parse_cmd+0x55e/0x25a0
[ 77.496378] user_events_ioctl+0xa52/0x17f0
[ 77.496772] __x64_sys_ioctl+0x133/0x190
[ 77.497147] do_syscall_64+0x66/0x130
[ 77.497503] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.497954]
[ 77.498160] Freed by task 341:
[ 77.498478] kasan_save_stack+0x20/0x40
[ 77.499043] kasan_save_track+0x14/0x30
[ 77.499412] kasan_save_free_info+0x3b/0x60
[ 77.499801] poison_slab_object+0x10a/0x170
[ 77.500189] __kasan_slab_free+0x14/0x30
[ 77.500561] kfree+0xe0/0x2f0
[ 77.500881] destroy_user_event+0x305/0x450
[ 77.501272] delayed_destroy_user_event+0x5c/0xe0
[ 77.501695] process_one_work+0x81c/0x1970
[ 77.502080] worker_thread+0x608/0x1160
[ 77.502448] kthread+0x2be/0x3b0
[ 77.506625] ret_from_fork+0x2c/0x70
[ 77.506981] ret_from_fork_asm+0x1a/0x30
[ 77.507354]
[ 77.507565] Last potentially related work creation:
[ 77.508002] kasan_save_stack+0x20/0x40
[ 77.508372] __kasan_record_aux_stack+0x8e/0xa0
[ 77.508786] insert_work+0x20/0x1b0
[ 77.509131] __queue_work+0x67a/0xc60
[ 77.509489] queue_work_on+0x63/0x90
[ 77.509836] user_event_put+0x1f9/0x390
[ 77.510203] user_events_release+0x124/0x200
[ 77.510606] __fput+0x361/0xa60
[ 77.510931] __x64_sys_close+0x77/0xd0
[ 77.511292] do_syscall_64+0x66/0x130
[ 77.511650] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.512101]
[ 77.512309] The buggy address belongs to the object at ffff888004498800
[ 77.512309] which belongs to the cache kmalloc-cg-512 of size 512
[ 77.513314] The buggy address is located 184 bytes inside of
[ 77.513314] freed 512-byte region [ffff888004498800, ffff888004498a00)
[ 77.514281]
[ 77.514490] The buggy address belongs to the physical page:
[ 77.514974] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4498
[ 77.515641] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 77.516288] memcg:ffff888003f75301
[ 77.516625] flags: 0x40(head|zone=0)
[ 77.516980] page_type: 0xffffefff(slab)
[ 77.517345] raw: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 77.518007] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 77.518663] head: 0000000000000040 ffff88800014cdc0 dead000000000100 dead000000000122
[ 77.519329] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888003f75301
[ 77.519991] head: 0000000000000002 ffffea0000112601 ffffffffffffffff 0000000000000000
[ 77.520655] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 77.521320] page dumped because: kasan: bad access detected
[ 77.521807]
[ 77.522014] Memory state around the buggy address:
[ 77.522444] ffff888004498780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 77.523074] ffff888004498800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.523694] >ffff888004498880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.524318] ^
[ 77.524770] ffff888004498900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.525391] ffff888004498980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.526009] ==================================================================
[ 77.739011] ==================================================================
[ 77.739796] BUG: KASAN: slab-use-after-free in f_start+0x36e/0x3d0
[ 77.740445] Read of size 8 at addr ffff88800473eca8 by task cat/4434
[ 77.741149]
[ 77.741415] CPU: 2 PID: 4434 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 77.742323] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 77.743516] Call Trace:
[ 77.743867] <TASK>
[ 77.744185] dump_stack_lvl+0x66/0xa0
[ 77.744644] print_report+0xd0/0x630
[ 77.745106] ? f_start+0x36e/0x3d0
[ 77.745544] ? __virt_addr_valid+0x208/0x3f0
[ 77.746066] ? f_start+0x36e/0x3d0
[ 77.746502] kasan_report+0xd8/0x110
[ 77.746958] ? f_start+0x36e/0x3d0
[ 77.747373] f_start+0x36e/0x3d0
[ 77.747795] seq_read_iter+0x268/0x11e0
[ 77.748278] ? lock_release+0x453/0x600
[ 77.748759] seq_read+0x261/0x350
[ 77.749174] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 77.749723] ? __pfx_seq_read+0x10/0x10
[ 77.750202] ? trace_irq_enable.constprop.0+0xce/0x110
[ 77.750800] vfs_read+0x171/0x9e0
[ 77.751229] ? lock_acquire+0x408/0x4b0
[ 77.751708] ? __pfx_vfs_read+0x10/0x10
[ 77.752187] ? lock_release+0x453/0x600
[ 77.752662] ? __pfx___up_read+0x10/0x10
[ 77.753153] ksys_read+0xdd/0x1a0
[ 77.753585] ? __pfx_ksys_read+0x10/0x10
[ 77.754068] ? trace_irq_enable.constprop.0+0xce/0x110
[ 77.754662] do_syscall_64+0x66/0x130
[ 77.755126] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.755715] RIP: 0033:0x7fa23454940e
[ 77.756169] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 77.758092] RSP: 002b:00007fff3bf6c2d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 77.758959] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fa23454940e
[ 77.759740] RDX: 0000000000020000 RSI: 00007fa23443d000 RDI: 0000000000000003
[ 77.760520] RBP: 00007fa23443d000 R08: 00007fa23443c010 R09: 0000000000000000
[ 77.761303] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 77.762080] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 77.762870] </TASK>
[ 77.763198]
[ 77.763461] Allocated by task 4436:
[ 77.763910] kasan_save_stack+0x20/0x40
[ 77.764394] kasan_save_track+0x14/0x30
[ 77.764874] __kasan_kmalloc+0x8f/0xa0
[ 77.765326] user_event_parse_cmd+0x55e/0x25a0
[ 77.765826] user_events_ioctl+0xa52/0x17f0
[ 77.766331] __x64_sys_ioctl+0x133/0x190
[ 77.766810] do_syscall_64+0x66/0x130
[ 77.767267] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.767847]
[ 77.768111] Freed by task 50:
[ 77.768507] kasan_save_stack+0x20/0x40
[ 77.769209] kasan_save_track+0x14/0x30
[ 77.769635] kasan_save_free_info+0x3b/0x60
[ 77.770101] poison_slab_object+0x10a/0x170
[ 77.770564] __kasan_slab_free+0x14/0x30
[ 77.770987] kfree+0xe0/0x2f0
[ 77.771334] destroy_user_event+0x305/0x450
[ 77.771778] delayed_destroy_user_event+0x5c/0xe0
[ 77.772251] process_one_work+0x81c/0x1970
[ 77.772636] worker_thread+0x608/0x1160
[ 77.773058] kthread+0x2be/0x3b0
[ 77.773434] ret_from_fork+0x2c/0x70
[ 77.773789] ret_from_fork_asm+0x1a/0x30
[ 77.774243]
[ 77.774493] Last potentially related work creation:
[ 77.774995] kasan_save_stack+0x20/0x40
[ 77.775432] __kasan_record_aux_stack+0x8e/0xa0
[ 77.775875] insert_work+0x20/0x1b0
[ 77.776268] __queue_work+0x67a/0xc60
[ 77.776698] queue_work_on+0x63/0x90
[ 77.777093] user_event_put+0x1f9/0x390
[ 77.777541] user_events_ioctl+0x11ed/0x17f0
[ 77.777975] __x64_sys_ioctl+0x133/0x190
[ 77.778345] do_syscall_64+0x66/0x130
[ 77.778693] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.779136]
[ 77.779344] The buggy address belongs to the object at ffff88800473ec00
[ 77.779344] which belongs to the cache kmalloc-cg-512 of size 512
[ 77.780320] The buggy address is located 168 bytes inside of
[ 77.780320] freed 512-byte region [ffff88800473ec00, ffff88800473ee00)
[ 77.781287]
[ 77.781496] The buggy address belongs to the physical page:
[ 77.781974] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800473d800 pfn:0x473c
[ 77.782718] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 77.783365] memcg:ffff88800102a301
[ 77.783701] flags: 0x40(head|zone=0)
[ 77.784052] page_type: 0xffffefff(slab)
[ 77.784420] raw: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 77.785078] raw: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 77.785823] head: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 77.786612] head: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 77.787411] head: 0000000000000002 ffffea000011cf01 ffffffffffffffff 0000000000000000
[ 77.788156] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 77.788914] page dumped because: kasan: bad access detected
[ 77.789454]
[ 77.789680] Memory state around the buggy address:
[ 77.790171] ffff88800473eb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 77.790870] ffff88800473ec00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.791573] >ffff88800473ec80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.792201] ^
[ 77.792658] ffff88800473ed00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.793342] ffff88800473ed80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.797858] ==================================================================
[ 77.798675] ==================================================================
[ 77.799536] BUG: KASAN: slab-use-after-free in f_start+0x2e4/0x3d0
[ 77.800118] Read of size 8 at addr ffff88800473ec70 by task cat/4434
[ 77.800694]
[ 77.800951] CPU: 2 PID: 4434 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 77.801692] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 77.802700] Call Trace:
[ 77.803007] <TASK>
[ 77.803254] dump_stack_lvl+0x66/0xa0
[ 77.803609] print_report+0xd0/0x630
[ 77.804007] ? f_start+0x2e4/0x3d0
[ 77.804361] ? __virt_addr_valid+0x208/0x3f0
[ 77.804760] ? f_start+0x2e4/0x3d0
[ 77.805127] kasan_report+0xd8/0x110
[ 77.805541] ? f_start+0x2e4/0x3d0
[ 77.805877] f_start+0x2e4/0x3d0
[ 77.806240] seq_read_iter+0x268/0x11e0
[ 77.806665] ? lock_release+0x453/0x600
[ 77.807084] seq_read+0x261/0x350
[ 77.807455] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 77.807968] ? __pfx_seq_read+0x10/0x10
[ 77.808385] ? trace_irq_enable.constprop.0+0xce/0x110
[ 77.808858] vfs_read+0x171/0x9e0
[ 77.809235] ? lock_acquire+0x408/0x4b0
[ 77.809680] ? __pfx_vfs_read+0x10/0x10
[ 77.810123] ? lock_release+0x453/0x600
[ 77.810526] ? __pfx___up_read+0x10/0x10
[ 77.810940] ksys_read+0xdd/0x1a0
[ 77.811305] ? __pfx_ksys_read+0x10/0x10
[ 77.811671] ? trace_irq_enable.constprop.0+0xce/0x110
[ 77.812121] do_syscall_64+0x66/0x130
[ 77.812500] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.813013] RIP: 0033:0x7fa23454940e
[ 77.813363] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 77.815024] RSP: 002b:00007fff3bf6c2d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 77.815707] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fa23454940e
[ 77.816342] RDX: 0000000000020000 RSI: 00007fa23443d000 RDI: 0000000000000003
[ 77.816967] RBP: 00007fa23443d000 R08: 00007fa23443c010 R09: 0000000000000000
[ 77.817599] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 77.818209] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 77.818817] </TASK>
[ 77.819073]
[ 77.819279] Allocated by task 4436:
[ 77.819645] kasan_save_stack+0x20/0x40
[ 77.820031] kasan_save_track+0x14/0x30
[ 77.820440] __kasan_kmalloc+0x8f/0xa0
[ 77.820851] user_event_parse_cmd+0x55e/0x25a0
[ 77.821318] user_events_ioctl+0xa52/0x17f0
[ 77.821704] __x64_sys_ioctl+0x133/0x190
[ 77.822089] do_syscall_64+0x66/0x130
[ 77.822438] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.822887]
[ 77.823095] Freed by task 50:
[ 77.823417] kasan_save_stack+0x20/0x40
[ 77.823821] kasan_save_track+0x14/0x30
[ 77.824218] kasan_save_free_info+0x3b/0x60
[ 77.824643] poison_slab_object+0x10a/0x170
[ 77.825033] __kasan_slab_free+0x14/0x30
[ 77.825436] kfree+0xe0/0x2f0
[ 77.825815] destroy_user_event+0x305/0x450
[ 77.826285] delayed_destroy_user_event+0x5c/0xe0
[ 77.826727] process_one_work+0x81c/0x1970
[ 77.827136] worker_thread+0x608/0x1160
[ 77.827549] kthread+0x2be/0x3b0
[ 77.827898] ret_from_fork+0x2c/0x70
[ 77.828270] ret_from_fork_asm+0x1a/0x30
[ 77.828697]
[ 77.829080] Last potentially related work creation:
[ 77.829533] kasan_save_stack+0x20/0x40
[ 77.829932] __kasan_record_aux_stack+0x8e/0xa0
[ 77.830351] insert_work+0x20/0x1b0
[ 77.830705] __queue_work+0x67a/0xc60
[ 77.831103] queue_work_on+0x63/0x90
[ 77.831447] user_event_put+0x1f9/0x390
[ 77.831818] user_events_ioctl+0x11ed/0x17f0
[ 77.832213] __x64_sys_ioctl+0x133/0x190
[ 77.832612] do_syscall_64+0x66/0x130
[ 77.833031] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.833485]
[ 77.833741] The buggy address belongs to the object at ffff88800473ec00
[ 77.833741] which belongs to the cache kmalloc-cg-512 of size 512
[ 77.834766] The buggy address is located 112 bytes inside of
[ 77.834766] freed 512-byte region [ffff88800473ec00, ffff88800473ee00)
[ 77.835771]
[ 77.836023] The buggy address belongs to the physical page:
[ 77.836545] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800473d800 pfn:0x473c
[ 77.837376] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 77.838015] memcg:ffff88800102a301
[ 77.838345] flags: 0x40(head|zone=0)
[ 77.838691] page_type: 0xffffefff(slab)
[ 77.839052] raw: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 77.839692] raw: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 77.840344] head: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 77.840999] head: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 77.841651] head: 0000000000000002 ffffea000011cf01 ffffffffffffffff 0000000000000000
[ 77.842308] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 77.842956] page dumped because: kasan: bad access detected
[ 77.843432]
[ 77.843639] Memory state around the buggy address:
[ 77.844062] ffff88800473eb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 77.844671] ffff88800473eb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 77.845284] >ffff88800473ec00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.845894] ^
[ 77.846451] ffff88800473ec80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.847062] ffff88800473ed00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.847751] ==================================================================
[ 77.848384] ==================================================================
[ 77.849071] BUG: KASAN: slab-use-after-free in f_start+0x2cb/0x3d0
[ 77.849674] Read of size 8 at addr ffff88800473ed08 by task cat/4434
[ 77.850268]
[ 77.850481] CPU: 2 PID: 4434 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 77.851215] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 77.852306] Call Trace:
[ 77.852591] <TASK>
[ 77.852855] dump_stack_lvl+0x66/0xa0
[ 77.853255] print_report+0xd0/0x630
[ 77.853646] ? f_start+0x2cb/0x3d0
[ 77.854048] ? __virt_addr_valid+0x208/0x3f0
[ 77.854495] ? f_start+0x2cb/0x3d0
[ 77.854875] kasan_report+0xd8/0x110
[ 77.855265] ? f_start+0x2cb/0x3d0
[ 77.855674] f_start+0x2cb/0x3d0
[ 77.856024] seq_read_iter+0x268/0x11e0
[ 77.856437] ? lock_release+0x453/0x600
[ 77.856873] seq_read+0x261/0x350
[ 77.857248] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 77.857724] ? __pfx_seq_read+0x10/0x10
[ 77.858138] ? trace_irq_enable.constprop.0+0xce/0x110
[ 77.858703] vfs_read+0x171/0x9e0
[ 77.859265] ? lock_acquire+0x408/0x4b0
[ 77.859679] ? __pfx_vfs_read+0x10/0x10
[ 77.860098] ? lock_release+0x453/0x600
[ 77.860521] ? __pfx___up_read+0x10/0x10
[ 77.860960] ksys_read+0xdd/0x1a0
[ 77.861361] ? __pfx_ksys_read+0x10/0x10
[ 77.861787] ? trace_irq_enable.constprop.0+0xce/0x110
[ 77.862264] do_syscall_64+0x66/0x130
[ 77.862701] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.863169] RIP: 0033:0x7fa23454940e
[ 77.863552] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 77.865213] RSP: 002b:00007fff3bf6c2d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 77.866001] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fa23454940e
[ 77.866674] RDX: 0000000000020000 RSI: 00007fa23443d000 RDI: 0000000000000003
[ 77.867342] RBP: 00007fa23443d000 R08: 00007fa23443c010 R09: 0000000000000000
[ 77.868019] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 77.868735] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 77.869417] </TASK>
[ 77.869696]
[ 77.869920] Allocated by task 4436:
[ 77.870305] kasan_save_stack+0x20/0x40
[ 77.870743] kasan_save_track+0x14/0x30
[ 77.875118] __kasan_kmalloc+0x8f/0xa0
[ 77.875526] user_event_parse_cmd+0x55e/0x25a0
[ 77.876021] user_events_ioctl+0xa52/0x17f0
[ 77.876502] __x64_sys_ioctl+0x133/0x190
[ 77.876956] do_syscall_64+0x66/0x130
[ 77.877353] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.877867]
[ 77.878093] Freed by task 50:
[ 77.878442] kasan_save_stack+0x20/0x40
[ 77.878889] kasan_save_track+0x14/0x30
[ 77.879304] kasan_save_free_info+0x3b/0x60
[ 77.879779] poison_slab_object+0x10a/0x170
[ 77.880259] __kasan_slab_free+0x14/0x30
[ 77.880681] kfree+0xe0/0x2f0
[ 77.881063] destroy_user_event+0x305/0x450
[ 77.881496] delayed_destroy_user_event+0x5c/0xe0
[ 77.881987] process_one_work+0x81c/0x1970
[ 77.882457] worker_thread+0x608/0x1160
[ 77.882877] kthread+0x2be/0x3b0
[ 77.883245] ret_from_fork+0x2c/0x70
[ 77.883642] ret_from_fork_asm+0x1a/0x30
[ 77.884063]
[ 77.884312] Last potentially related work creation:
[ 77.884808] kasan_save_stack+0x20/0x40
[ 77.885251] __kasan_record_aux_stack+0x8e/0xa0
[ 77.885761] insert_work+0x20/0x1b0
[ 77.886181] __queue_work+0x67a/0xc60
[ 77.886617] queue_work_on+0x63/0x90
[ 77.887010] user_event_put+0x1f9/0x390
[ 77.887454] user_events_ioctl+0x11ed/0x17f0
[ 77.887908] __x64_sys_ioctl+0x133/0x190
[ 77.888364] do_syscall_64+0x66/0x130
[ 77.888981] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.889491]
[ 77.889704] The buggy address belongs to the object at ffff88800473ec00
[ 77.889704] which belongs to the cache kmalloc-cg-512 of size 512
[ 77.890810] The buggy address is located 264 bytes inside of
[ 77.890810] freed 512-byte region [ffff88800473ec00, ffff88800473ee00)
[ 77.891990]
[ 77.892242] The buggy address belongs to the physical page:
[ 77.892824] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800473d800 pfn:0x473c
[ 77.893735] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 77.894526] memcg:ffff88800102a301
[ 77.894935] flags: 0x40(head|zone=0)
[ 77.895325] page_type: 0xffffefff(slab)
[ 77.895739] raw: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 77.896484] raw: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 77.897247] head: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 77.897993] head: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 77.898793] head: 0000000000000002 ffffea000011cf01 ffffffffffffffff 0000000000000000
[ 77.899601] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 77.900418] page dumped because: kasan: bad access detected
[ 77.900979]
[ 77.901231] Memory state around the buggy address:
[ 77.901718] ffff88800473ec00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.902426] ffff88800473ec80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.903195] >ffff88800473ed00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.903914] ^
[ 77.904300] ffff88800473ed80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.905025] ffff88800473ee00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 77.905751] ==================================================================
[ 77.906527] ==================================================================
[ 77.907246] BUG: KASAN: slab-use-after-free in user_event_get_fields+0x38/0x40
[ 77.908017] Read of size 8 at addr ffff88800473ecb8 by task cat/4434
[ 77.908670]
[ 77.908928] CPU: 2 PID: 4434 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 77.909707] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 77.910814] Call Trace:
[ 77.911149] <TASK>
[ 77.911453] dump_stack_lvl+0x66/0xa0
[ 77.911883] print_report+0xd0/0x630
[ 77.912281] ? user_event_get_fields+0x38/0x40
[ 77.912750] ? __virt_addr_valid+0x208/0x3f0
[ 77.913234] ? user_event_get_fields+0x38/0x40
[ 77.913693] kasan_report+0xd8/0x110
[ 77.914096] ? user_event_get_fields+0x38/0x40
[ 77.914595] user_event_get_fields+0x38/0x40
[ 77.915084] f_start+0x175/0x3d0
[ 77.915479] seq_read_iter+0x268/0x11e0
[ 77.915901] ? lock_release+0x453/0x600
[ 77.916347] seq_read+0x261/0x350
[ 77.916756] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 77.917233] ? __pfx_seq_read+0x10/0x10
[ 77.917684] ? trace_irq_enable.constprop.0+0xce/0x110
[ 77.918209] vfs_read+0x171/0x9e0
[ 77.918588] ? lock_acquire+0x408/0x4b0
[ 77.919156] ? __pfx_vfs_read+0x10/0x10
[ 77.919562] ? lock_release+0x453/0x600
[ 77.919986] ? __pfx___up_read+0x10/0x10
[ 77.920447] ksys_read+0xdd/0x1a0
[ 77.920857] ? __pfx_ksys_read+0x10/0x10
[ 77.921314] ? trace_irq_enable.constprop.0+0xce/0x110
[ 77.921838] do_syscall_64+0x66/0x130
[ 77.922232] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.922772] RIP: 0033:0x7fa23454940e
[ 77.923164] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 77.924825] RSP: 002b:00007fff3bf6c2d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 77.925567] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fa23454940e
[ 77.926299] RDX: 0000000000020000 RSI: 00007fa23443d000 RDI: 0000000000000003
[ 77.927018] RBP: 00007fa23443d000 R08: 00007fa23443c010 R09: 0000000000000000
[ 77.927749] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 77.928429] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 77.929180] </TASK>
[ 77.929487]
[ 77.929724] Allocated by task 4436:
[ 77.930136] kasan_save_stack+0x20/0x40
[ 77.930604] kasan_save_track+0x14/0x30
[ 77.931075] __kasan_kmalloc+0x8f/0xa0
[ 77.931537] user_event_parse_cmd+0x55e/0x25a0
[ 77.932064] user_events_ioctl+0xa52/0x17f0
[ 77.932532] __x64_sys_ioctl+0x133/0x190
[ 77.933025] do_syscall_64+0x66/0x130
[ 77.933486] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.934063]
[ 77.934325] Freed by task 50:
[ 77.934724] kasan_save_stack+0x20/0x40
[ 77.935181] kasan_save_track+0x14/0x30
[ 77.935615] kasan_save_free_info+0x3b/0x60
[ 77.936079] poison_slab_object+0x10a/0x170
[ 77.936542] __kasan_slab_free+0x14/0x30
[ 77.936969] kfree+0xe0/0x2f0
[ 77.937280] destroy_user_event+0x305/0x450
[ 77.937673] delayed_destroy_user_event+0x5c/0xe0
[ 77.938105] process_one_work+0x81c/0x1970
[ 77.938490] worker_thread+0x608/0x1160
[ 77.938861] kthread+0x2be/0x3b0
[ 77.939194] ret_from_fork+0x2c/0x70
[ 77.939546] ret_from_fork_asm+0x1a/0x30
[ 77.939920]
[ 77.940133] Last potentially related work creation:
[ 77.940572] kasan_save_stack+0x20/0x40
[ 77.940958] __kasan_record_aux_stack+0x8e/0xa0
[ 77.941380] insert_work+0x20/0x1b0
[ 77.941730] __queue_work+0x67a/0xc60
[ 77.942086] queue_work_on+0x63/0x90
[ 77.942436] user_event_put+0x1f9/0x390
[ 77.942810] user_events_ioctl+0x11ed/0x17f0
[ 77.943212] __x64_sys_ioctl+0x133/0x190
[ 77.943590] do_syscall_64+0x66/0x130
[ 77.943950] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.944404]
[ 77.944612] The buggy address belongs to the object at ffff88800473ec00
[ 77.944612] which belongs to the cache kmalloc-cg-512 of size 512
[ 77.945624] The buggy address is located 184 bytes inside of
[ 77.945624] freed 512-byte region [ffff88800473ec00, ffff88800473ee00)
[ 77.946605]
[ 77.946818] The buggy address belongs to the physical page:
[ 77.947304] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800473d800 pfn:0x473c
[ 77.948064] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 77.948718] memcg:ffff88800102a301
[ 77.949212] flags: 0x40(head|zone=0)
[ 77.949565] page_type: 0xffffefff(slab)
[ 77.949936] raw: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 77.950641] raw: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 77.951300] head: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 77.955807] head: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 77.956479] head: 0000000000000002 ffffea000011cf01 ffffffffffffffff 0000000000000000
[ 77.957146] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 77.957816] page dumped because: kasan: bad access detected
[ 77.958300]
[ 77.958508] Memory state around the buggy address:
[ 77.958949] ffff88800473eb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 77.959577] ffff88800473ec00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.960224] >ffff88800473ec80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.960854] ^
[ 77.961311] ffff88800473ed00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.961938] ffff88800473ed80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 77.962568] ==================================================================
[ 77.963225] ==================================================================
[ 77.963857] BUG: KASAN: slab-use-after-free in f_start+0x2e4/0x3d0
[ 77.964386] Read of size 8 at addr ffff88800473ec70 by task cat/4434
[ 77.964937]
[ 77.965152] CPU: 2 PID: 4434 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 77.965831] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 77.966754] Call Trace:
[ 77.967028] <TASK>
[ 77.967276] dump_stack_lvl+0x66/0xa0
[ 77.967637] print_report+0xd0/0x630
[ 77.967989] ? f_start+0x2e4/0x3d0
[ 77.968327] ? __virt_addr_valid+0x208/0x3f0
[ 77.968732] ? f_start+0x2e4/0x3d0
[ 77.969086] kasan_report+0xd8/0x110
[ 77.969437] ? f_start+0x2e4/0x3d0
[ 77.969777] f_start+0x2e4/0x3d0
[ 77.970111] seq_read_iter+0x268/0x11e0
[ 77.970483] ? lock_release+0x453/0x600
[ 77.970852] seq_read+0x261/0x350
[ 77.971191] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 77.971622] ? __pfx_seq_read+0x10/0x10
[ 77.971993] ? trace_irq_enable.constprop.0+0xce/0x110
[ 77.972453] vfs_read+0x171/0x9e0
[ 77.972792] ? lock_acquire+0x408/0x4b0
[ 77.973170] ? __pfx_vfs_read+0x10/0x10
[ 77.973558] ? lock_release+0x453/0x600
[ 77.973932] ? __pfx___up_read+0x10/0x10
[ 77.974310] ksys_read+0xdd/0x1a0
[ 77.974644] ? __pfx_ksys_read+0x10/0x10
[ 77.975023] ? trace_irq_enable.constprop.0+0xce/0x110
[ 77.975484] do_syscall_64+0x66/0x130
[ 77.975845] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.976300] RIP: 0033:0x7fa23454940e
[ 77.976652] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 77.978101] RSP: 002b:00007fff3bf6c2d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 77.978753] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fa23454940e
[ 77.979538] RDX: 0000000000020000 RSI: 00007fa23443d000 RDI: 0000000000000003
[ 77.980137] RBP: 00007fa23443d000 R08: 00007fa23443c010 R09: 0000000000000000
[ 77.980748] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 77.981346] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 77.981944] </TASK>
[ 77.982203]
[ 77.982412] Allocated by task 4436:
[ 77.982761] kasan_save_stack+0x20/0x40
[ 77.983132] kasan_save_track+0x14/0x30
[ 77.983504] __kasan_kmalloc+0x8f/0xa0
[ 77.983869] user_event_parse_cmd+0x55e/0x25a0
[ 77.984283] user_events_ioctl+0xa52/0x17f0
[ 77.984674] __x64_sys_ioctl+0x133/0x190
[ 77.985054] do_syscall_64+0x66/0x130
[ 77.985421] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.985879]
[ 77.986089] Freed by task 50:
[ 77.986399] kasan_save_stack+0x20/0x40
[ 77.986769] kasan_save_track+0x14/0x30
[ 77.987139] kasan_save_free_info+0x3b/0x60
[ 77.987535] poison_slab_object+0x10a/0x170
[ 77.987929] __kasan_slab_free+0x14/0x30
[ 77.988305] kfree+0xe0/0x2f0
[ 77.988614] destroy_user_event+0x305/0x450
[ 77.989016] delayed_destroy_user_event+0x5c/0xe0
[ 77.989448] process_one_work+0x81c/0x1970
[ 77.989835] worker_thread+0x608/0x1160
[ 77.990214] kthread+0x2be/0x3b0
[ 77.990546] ret_from_fork+0x2c/0x70
[ 77.990901] ret_from_fork_asm+0x1a/0x30
[ 77.991279]
[ 77.991493] Last potentially related work creation:
[ 77.991938] kasan_save_stack+0x20/0x40
[ 77.992311] __kasan_record_aux_stack+0x8e/0xa0
[ 77.992734] insert_work+0x20/0x1b0
[ 77.993086] __queue_work+0x67a/0xc60
[ 77.993444] queue_work_on+0x63/0x90
[ 77.993802] user_event_put+0x1f9/0x390
[ 77.994176] user_events_ioctl+0x11ed/0x17f0
[ 77.994574] __x64_sys_ioctl+0x133/0x190
[ 77.994971] do_syscall_64+0x66/0x130
[ 77.995408] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 77.995990]
[ 77.996247] The buggy address belongs to the object at ffff88800473ec00
[ 77.996247] which belongs to the cache kmalloc-cg-512 of size 512
[ 77.997540] The buggy address is located 112 bytes inside of
[ 77.997540] freed 512-byte region [ffff88800473ec00, ffff88800473ee00)
[ 77.998787]
[ 77.999047] The buggy address belongs to the physical page:
[ 77.999662] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800473d800 pfn:0x473c
[ 78.000629] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 78.001471] memcg:ffff88800102a301
[ 78.001901] flags: 0x40(head|zone=0)
[ 78.002347] page_type: 0xffffefff(slab)
[ 78.002815] raw: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 78.003692] raw: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 78.004468] head: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 78.005133] head: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 78.005800] head: 0000000000000002 ffffea000011cf01 ffffffffffffffff 0000000000000000
[ 78.006468] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 78.007233] page dumped because: kasan: bad access detected
[ 78.007853]
[ 78.008111] Memory state around the buggy address:
[ 78.008658] ffff88800473eb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 78.009586] ffff88800473eb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 78.010367] >ffff88800473ec00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.011150] ^
[ 78.011859] ffff88800473ec80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.012642] ffff88800473ed00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.013426] ==================================================================
[ 78.014353] ==================================================================
[ 78.015141] BUG: KASAN: slab-use-after-free in f_start+0x2cb/0x3d0
[ 78.015798] Read of size 8 at addr ffff88800473ed08 by task cat/4434
[ 78.016465]
[ 78.016716] CPU: 2 PID: 4434 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 78.017572] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 78.018713] Call Trace:
[ 78.019044] <TASK>
[ 78.019348] dump_stack_lvl+0x66/0xa0
[ 78.019788] print_report+0xd0/0x630
[ 78.020216] ? f_start+0x2cb/0x3d0
[ 78.020612] ? __virt_addr_valid+0x208/0x3f0
[ 78.021109] ? f_start+0x2cb/0x3d0
[ 78.021527] kasan_report+0xd8/0x110
[ 78.021966] ? f_start+0x2cb/0x3d0
[ 78.022386] f_start+0x2cb/0x3d0
[ 78.022789] seq_read_iter+0x268/0x11e0
[ 78.023249] ? lock_release+0x453/0x600
[ 78.023705] seq_read+0x261/0x350
[ 78.024087] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 78.024611] ? __pfx_seq_read+0x10/0x10
[ 78.025071] ? trace_irq_enable.constprop.0+0xce/0x110
[ 78.025619] vfs_read+0x171/0x9e0
[ 78.026027] ? lock_acquire+0x408/0x4b0
[ 78.026482] ? __pfx_vfs_read+0x10/0x10
[ 78.026969] ? lock_release+0x453/0x600
[ 78.027363] ? __pfx___up_read+0x10/0x10
[ 78.027734] ksys_read+0xdd/0x1a0
[ 78.031921] ? __pfx_ksys_read+0x10/0x10
[ 78.032320] ? trace_irq_enable.constprop.0+0xce/0x110
[ 78.032884] do_syscall_64+0x66/0x130
[ 78.033290] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.033796] RIP: 0033:0x7fa23454940e
[ 78.034209] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 78.035866] RSP: 002b:00007fff3bf6c2d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 78.036642] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fa23454940e
[ 78.037338] RDX: 0000000000020000 RSI: 00007fa23443d000 RDI: 0000000000000003
[ 78.038024] RBP: 00007fa23443d000 R08: 00007fa23443c010 R09: 0000000000000000
[ 78.038761] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 78.039708] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 78.040397] </TASK>
[ 78.040711]
[ 78.040961] Allocated by task 4436:
[ 78.041384] kasan_save_stack+0x20/0x40
[ 78.041794] kasan_save_track+0x14/0x30
[ 78.042218] __kasan_kmalloc+0x8f/0xa0
[ 78.042648] user_event_parse_cmd+0x55e/0x25a0
[ 78.043116] user_events_ioctl+0xa52/0x17f0
[ 78.043561] __x64_sys_ioctl+0x133/0x190
[ 78.044008] do_syscall_64+0x66/0x130
[ 78.044400] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.044919]
[ 78.045148] Freed by task 50:
[ 78.045522] kasan_save_stack+0x20/0x40
[ 78.045921] kasan_save_track+0x14/0x30
[ 78.046337] kasan_save_free_info+0x3b/0x60
[ 78.046810] poison_slab_object+0x10a/0x170
[ 78.047288] __kasan_slab_free+0x14/0x30
[ 78.047736] kfree+0xe0/0x2f0
[ 78.048077] destroy_user_event+0x305/0x450
[ 78.048517] delayed_destroy_user_event+0x5c/0xe0
[ 78.049044] process_one_work+0x81c/0x1970
[ 78.049505] worker_thread+0x608/0x1160
[ 78.049931] kthread+0x2be/0x3b0
[ 78.050328] ret_from_fork+0x2c/0x70
[ 78.050756] ret_from_fork_asm+0x1a/0x30
[ 78.051182]
[ 78.051431] Last potentially related work creation:
[ 78.051929] kasan_save_stack+0x20/0x40
[ 78.052370] __kasan_record_aux_stack+0x8e/0xa0
[ 78.052851] insert_work+0x20/0x1b0
[ 78.053243] __queue_work+0x67a/0xc60
[ 78.053638] queue_work_on+0x63/0x90
[ 78.054024] user_event_put+0x1f9/0x390
[ 78.054435] user_events_ioctl+0x11ed/0x17f0
[ 78.054913] __x64_sys_ioctl+0x133/0x190
[ 78.055363] do_syscall_64+0x66/0x130
[ 78.055755] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.056264]
[ 78.056516] The buggy address belongs to the object at ffff88800473ec00
[ 78.056516] which belongs to the cache kmalloc-cg-512 of size 512
[ 78.057669] The buggy address is located 264 bytes inside of
[ 78.057669] freed 512-byte region [ffff88800473ec00, ffff88800473ee00)
[ 78.058783]
[ 78.059037] The buggy address belongs to the physical page:
[ 78.059612] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800473d800 pfn:0x473c
[ 78.060523] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 78.061314] memcg:ffff88800102a301
[ 78.061697] flags: 0x40(head|zone=0)
[ 78.062123] page_type: 0xffffefff(slab)
[ 78.062528] raw: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 78.063333] raw: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 78.064085] head: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 78.064867] head: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 78.065628] head: 0000000000000002 ffffea000011cf01 ffffffffffffffff 0000000000000000
[ 78.066378] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 78.067118] page dumped because: kasan: bad access detected
[ 78.067710]
[ 78.067930] Memory state around the buggy address:
[ 78.068421] ffff88800473ec00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.069328] ffff88800473ec80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.070036] >ffff88800473ed00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.070728] ^
[ 78.071115] ffff88800473ed80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.071811] ffff88800473ee00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 78.072552] ==================================================================
[ 78.073331] ==================================================================
[ 78.074073] BUG: KASAN: slab-use-after-free in user_event_get_fields+0x38/0x40
[ 78.074796] Read of size 8 at addr ffff88800473ecb8 by task cat/4434
[ 78.075445]
[ 78.075672] CPU: 2 PID: 4434 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 78.076432] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 78.077485] Call Trace:
[ 78.077781] <TASK>
[ 78.078083] dump_stack_lvl+0x66/0xa0
[ 78.078520] print_report+0xd0/0x630
[ 78.078944] ? user_event_get_fields+0x38/0x40
[ 78.079442] ? __virt_addr_valid+0x208/0x3f0
[ 78.079884] ? user_event_get_fields+0x38/0x40
[ 78.080341] kasan_report+0xd8/0x110
[ 78.080733] ? user_event_get_fields+0x38/0x40
[ 78.081192] user_event_get_fields+0x38/0x40
[ 78.081668] f_start+0x175/0x3d0
[ 78.082036] seq_read_iter+0x268/0x11e0
[ 78.082442] ? lock_release+0x453/0x600
[ 78.082863] seq_read+0x261/0x350
[ 78.083236] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 78.083691] ? __pfx_seq_read+0x10/0x10
[ 78.084098] ? trace_irq_enable.constprop.0+0xce/0x110
[ 78.084661] vfs_read+0x171/0x9e0
[ 78.085064] ? lock_acquire+0x408/0x4b0
[ 78.085475] ? __pfx_vfs_read+0x10/0x10
[ 78.085887] ? lock_release+0x453/0x600
[ 78.086305] ? __pfx___up_read+0x10/0x10
[ 78.086760] ksys_read+0xdd/0x1a0
[ 78.087126] ? __pfx_ksys_read+0x10/0x10
[ 78.087547] ? trace_irq_enable.constprop.0+0xce/0x110
[ 78.088106] do_syscall_64+0x66/0x130
[ 78.088498] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.089045] RIP: 0033:0x7fa23454940e
[ 78.089431] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 78.091092] RSP: 002b:00007fff3bf6c2d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 78.091856] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fa23454940e
[ 78.092570] RDX: 0000000000020000 RSI: 00007fa23443d000 RDI: 0000000000000003
[ 78.093250] RBP: 00007fa23443d000 R08: 00007fa23443c010 R09: 0000000000000000
[ 78.093922] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 78.094630] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 78.095300] </TASK>
[ 78.095575]
[ 78.095827] Allocated by task 4436:
[ 78.096244] kasan_save_stack+0x20/0x40
[ 78.096686] kasan_save_track+0x14/0x30
[ 78.097124] __kasan_kmalloc+0x8f/0xa0
[ 78.097500] user_event_parse_cmd+0x55e/0x25a0
[ 78.097911] user_events_ioctl+0xa52/0x17f0
[ 78.098303] __x64_sys_ioctl+0x133/0x190
[ 78.098680] do_syscall_64+0x66/0x130
[ 78.099192] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.099644]
[ 78.099855] Freed by task 50:
[ 78.100168] kasan_save_stack+0x20/0x40
[ 78.100536] kasan_save_track+0x14/0x30
[ 78.100918] kasan_save_free_info+0x3b/0x60
[ 78.101313] poison_slab_object+0x10a/0x170
[ 78.101704] __kasan_slab_free+0x14/0x30
[ 78.102081] kfree+0xe0/0x2f0
[ 78.102396] destroy_user_event+0x305/0x450
[ 78.102793] delayed_destroy_user_event+0x5c/0xe0
[ 78.103220] process_one_work+0x81c/0x1970
[ 78.103606] worker_thread+0x608/0x1160
[ 78.103977] kthread+0x2be/0x3b0
[ 78.104307] ret_from_fork+0x2c/0x70
[ 78.104658] ret_from_fork_asm+0x1a/0x30
[ 78.105039]
[ 78.105251] Last potentially related work creation:
[ 78.105692] kasan_save_stack+0x20/0x40
[ 78.106062] __kasan_record_aux_stack+0x8e/0xa0
[ 78.106486] insert_work+0x20/0x1b0
[ 78.106834] __queue_work+0x67a/0xc60
[ 78.107190] queue_work_on+0x63/0x90
[ 78.107548] user_event_put+0x1f9/0x390
[ 78.107917] user_events_ioctl+0x11ed/0x17f0
[ 78.108322] __x64_sys_ioctl+0x133/0x190
[ 78.108703] do_syscall_64+0x66/0x130
[ 78.112915] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.113391]
[ 78.113615] The buggy address belongs to the object at ffff88800473ec00
[ 78.113615] which belongs to the cache kmalloc-cg-512 of size 512
[ 78.114612] The buggy address is located 184 bytes inside of
[ 78.114612] freed 512-byte region [ffff88800473ec00, ffff88800473ee00)
[ 78.115580]
[ 78.115791] The buggy address belongs to the physical page:
[ 78.116279] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800473d800 pfn:0x473c
[ 78.117038] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 78.117691] memcg:ffff88800102a301
[ 78.118029] flags: 0x40(head|zone=0)
[ 78.118385] page_type: 0xffffefff(slab)
[ 78.118759] raw: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 78.119420] raw: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 78.120085] head: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 78.120751] head: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 78.121422] head: 0000000000000002 ffffea000011cf01 ffffffffffffffff 0000000000000000
[ 78.122090] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 78.122778] page dumped because: kasan: bad access detected
[ 78.123261]
[ 78.123472] Memory state around the buggy address:
[ 78.123907] ffff88800473eb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 78.124530] ffff88800473ec00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.125172] >ffff88800473ec80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.125803] ^
[ 78.126258] ffff88800473ed00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.126887] ffff88800473ed80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.127518] ==================================================================
[ 78.128178] ==================================================================
[ 78.129013] BUG: KASAN: slab-use-after-free in f_start+0x2e4/0x3d0
[ 78.129556] Read of size 8 at addr ffff88800473ec70 by task cat/4434
[ 78.130100]
[ 78.130313] CPU: 2 PID: 4434 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 78.130996] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 78.131916] Call Trace:
[ 78.132192] <TASK>
[ 78.132445] dump_stack_lvl+0x66/0xa0
[ 78.132814] print_report+0xd0/0x630
[ 78.133165] ? f_start+0x2e4/0x3d0
[ 78.133509] ? __virt_addr_valid+0x208/0x3f0
[ 78.133914] ? f_start+0x2e4/0x3d0
[ 78.134265] kasan_report+0xd8/0x110
[ 78.134621] ? f_start+0x2e4/0x3d0
[ 78.135011] f_start+0x2e4/0x3d0
[ 78.135402] seq_read_iter+0x268/0x11e0
[ 78.135875] ? lock_release+0x453/0x600
[ 78.136322] seq_read+0x261/0x350
[ 78.136713] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 78.137137] ? __pfx_seq_read+0x10/0x10
[ 78.137504] ? trace_irq_enable.constprop.0+0xce/0x110
[ 78.137961] vfs_read+0x171/0x9e0
[ 78.138294] ? lock_acquire+0x408/0x4b0
[ 78.138656] ? __pfx_vfs_read+0x10/0x10
[ 78.139025] ? lock_release+0x453/0x600
[ 78.139398] ? __pfx___up_read+0x10/0x10
[ 78.139771] ksys_read+0xdd/0x1a0
[ 78.140104] ? __pfx_ksys_read+0x10/0x10
[ 78.140478] ? trace_irq_enable.constprop.0+0xce/0x110
[ 78.140942] do_syscall_64+0x66/0x130
[ 78.141298] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.141747] RIP: 0033:0x7fa23454940e
[ 78.142107] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 78.143530] RSP: 002b:00007fff3bf6c2d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 78.144178] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fa23454940e
[ 78.144773] RDX: 0000000000020000 RSI: 00007fa23443d000 RDI: 0000000000000003
[ 78.145369] RBP: 00007fa23443d000 R08: 00007fa23443c010 R09: 0000000000000000
[ 78.145959] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 78.146546] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 78.147145] </TASK>
[ 78.147398]
[ 78.147611] Allocated by task 4436:
[ 78.147955] kasan_save_stack+0x20/0x40
[ 78.148322] kasan_save_track+0x14/0x30
[ 78.148695] __kasan_kmalloc+0x8f/0xa0
[ 78.149064] user_event_parse_cmd+0x55e/0x25a0
[ 78.149475] user_events_ioctl+0xa52/0x17f0
[ 78.149866] __x64_sys_ioctl+0x133/0x190
[ 78.150246] do_syscall_64+0x66/0x130
[ 78.150606] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.151056]
[ 78.151266] Freed by task 50:
[ 78.151575] kasan_save_stack+0x20/0x40
[ 78.151946] kasan_save_track+0x14/0x30
[ 78.152315] kasan_save_free_info+0x3b/0x60
[ 78.152711] poison_slab_object+0x10a/0x170
[ 78.153105] __kasan_slab_free+0x14/0x30
[ 78.153481] kfree+0xe0/0x2f0
[ 78.153795] destroy_user_event+0x305/0x450
[ 78.154191] delayed_destroy_user_event+0x5c/0xe0
[ 78.154620] process_one_work+0x81c/0x1970
[ 78.155008] worker_thread+0x608/0x1160
[ 78.155376] kthread+0x2be/0x3b0
[ 78.155700] ret_from_fork+0x2c/0x70
[ 78.156052] ret_from_fork_asm+0x1a/0x30
[ 78.156427]
[ 78.156638] Last potentially related work creation:
[ 78.157082] kasan_save_stack+0x20/0x40
[ 78.157457] __kasan_record_aux_stack+0x8e/0xa0
[ 78.157876] insert_work+0x20/0x1b0
[ 78.158224] __queue_work+0x67a/0xc60
[ 78.158579] queue_work_on+0x63/0x90
[ 78.159106] user_event_put+0x1f9/0x390
[ 78.159495] user_events_ioctl+0x11ed/0x17f0
[ 78.159893] __x64_sys_ioctl+0x133/0x190
[ 78.160270] do_syscall_64+0x66/0x130
[ 78.160633] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.161090]
[ 78.161302] The buggy address belongs to the object at ffff88800473ec00
[ 78.161302] which belongs to the cache kmalloc-cg-512 of size 512
[ 78.162307] The buggy address is located 112 bytes inside of
[ 78.162307] freed 512-byte region [ffff88800473ec00, ffff88800473ee00)
[ 78.163284]
[ 78.163494] The buggy address belongs to the physical page:
[ 78.163981] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800473d800 pfn:0x473c
[ 78.164751] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 78.165408] memcg:ffff88800102a301
[ 78.165749] flags: 0x40(head|zone=0)
[ 78.166098] page_type: 0xffffefff(slab)
[ 78.166477] raw: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 78.167143] raw: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 78.167808] head: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 78.168478] head: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 78.169145] head: 0000000000000002 ffffea000011cf01 ffffffffffffffff 0000000000000000
[ 78.169805] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 78.170469] page dumped because: kasan: bad access detected
[ 78.170953]
[ 78.171161] Memory state around the buggy address:
[ 78.171595] ffff88800473eb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 78.172223] ffff88800473eb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 78.172852] >ffff88800473ec00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.173472] ^
[ 78.174054] ffff88800473ec80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.174681] ffff88800473ed00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.175302] ==================================================================
[ 78.175958] ==================================================================
[ 78.176587] BUG: KASAN: slab-use-after-free in f_start+0x2cb/0x3d0
[ 78.177121] Read of size 8 at addr ffff88800473ed08 by task cat/4434
[ 78.177662]
[ 78.177874] CPU: 2 PID: 4434 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 78.178557] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 78.179472] Call Trace:
[ 78.179745] <TASK>
[ 78.183854] dump_stack_lvl+0x66/0xa0
[ 78.184216] print_report+0xd0/0x630
[ 78.184566] ? f_start+0x2cb/0x3d0
[ 78.184910] ? __virt_addr_valid+0x208/0x3f0
[ 78.185312] ? f_start+0x2cb/0x3d0
[ 78.185654] kasan_report+0xd8/0x110
[ 78.186008] ? f_start+0x2cb/0x3d0
[ 78.186356] f_start+0x2cb/0x3d0
[ 78.186689] seq_read_iter+0x268/0x11e0
[ 78.187065] ? lock_release+0x453/0x600
[ 78.187440] seq_read+0x261/0x350
[ 78.187779] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 78.188208] ? __pfx_seq_read+0x10/0x10
[ 78.188577] ? trace_irq_enable.constprop.0+0xce/0x110
[ 78.189266] vfs_read+0x171/0x9e0
[ 78.189617] ? lock_acquire+0x408/0x4b0
[ 78.189989] ? __pfx_vfs_read+0x10/0x10
[ 78.190358] ? lock_release+0x453/0x600
[ 78.190730] ? __pfx___up_read+0x10/0x10
[ 78.191107] ksys_read+0xdd/0x1a0
[ 78.191441] ? __pfx_ksys_read+0x10/0x10
[ 78.191817] ? trace_irq_enable.constprop.0+0xce/0x110
[ 78.192281] do_syscall_64+0x66/0x130
[ 78.192642] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.193102] RIP: 0033:0x7fa23454940e
[ 78.193456] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 78.194893] RSP: 002b:00007fff3bf6c2d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 78.195547] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fa23454940e
[ 78.196144] RDX: 0000000000020000 RSI: 00007fa23443d000 RDI: 0000000000000003
[ 78.196749] RBP: 00007fa23443d000 R08: 00007fa23443c010 R09: 0000000000000000
[ 78.197349] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 78.197940] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 78.198534] </TASK>
[ 78.198792]
[ 78.199006] Allocated by task 4436:
[ 78.199355] kasan_save_stack+0x20/0x40
[ 78.199723] kasan_save_track+0x14/0x30
[ 78.200099] __kasan_kmalloc+0x8f/0xa0
[ 78.200468] user_event_parse_cmd+0x55e/0x25a0
[ 78.200885] user_events_ioctl+0xa52/0x17f0
[ 78.201277] __x64_sys_ioctl+0x133/0x190
[ 78.201658] do_syscall_64+0x66/0x130
[ 78.202020] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.202466]
[ 78.202667] Freed by task 50:
[ 78.202965] kasan_save_stack+0x20/0x40
[ 78.203316] kasan_save_track+0x14/0x30
[ 78.203673] kasan_save_free_info+0x3b/0x60
[ 78.204046] poison_slab_object+0x10a/0x170
[ 78.204420] __kasan_slab_free+0x14/0x30
[ 78.204782] kfree+0xe0/0x2f0
[ 78.205090] destroy_user_event+0x305/0x450
[ 78.205467] delayed_destroy_user_event+0x5c/0xe0
[ 78.205878] process_one_work+0x81c/0x1970
[ 78.206242] worker_thread+0x608/0x1160
[ 78.206599] kthread+0x2be/0x3b0
[ 78.206916] ret_from_fork+0x2c/0x70
[ 78.207248] ret_from_fork_asm+0x1a/0x30
[ 78.207604]
[ 78.207806] Last potentially related work creation:
[ 78.208225] kasan_save_stack+0x20/0x40
[ 78.208579] __kasan_record_aux_stack+0x8e/0xa0
[ 78.208992] insert_work+0x20/0x1b0
[ 78.209320] __queue_work+0x67a/0xc60
[ 78.209659] queue_work_on+0x63/0x90
[ 78.209995] user_event_put+0x1f9/0x390
[ 78.210344] user_events_ioctl+0x11ed/0x17f0
[ 78.210725] __x64_sys_ioctl+0x133/0x190
[ 78.211082] do_syscall_64+0x66/0x130
[ 78.211425] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.211853]
[ 78.212051] The buggy address belongs to the object at ffff88800473ec00
[ 78.212051] which belongs to the cache kmalloc-cg-512 of size 512
[ 78.213019] The buggy address is located 264 bytes inside of
[ 78.213019] freed 512-byte region [ffff88800473ec00, ffff88800473ee00)
[ 78.213935]
[ 78.214133] The buggy address belongs to the physical page:
[ 78.214597] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800473d800 pfn:0x473c
[ 78.215323] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 78.215944] memcg:ffff88800102a301
[ 78.216270] flags: 0x40(head|zone=0)
[ 78.216601] page_type: 0xffffefff(slab)
[ 78.216970] raw: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 78.217606] raw: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 78.218234] head: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 78.219075] head: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 78.219723] head: 0000000000000002 ffffea000011cf01 ffffffffffffffff 0000000000000000
[ 78.220358] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 78.221014] page dumped because: kasan: bad access detected
[ 78.221496]
[ 78.221706] Memory state around the buggy address:
[ 78.222139] ffff88800473ec00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.222763] ffff88800473ec80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.223384] >ffff88800473ed00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.224004] ^
[ 78.224350] ffff88800473ed80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.224973] ffff88800473ee00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 78.225568] ==================================================================
[ 78.226194] ==================================================================
[ 78.226828] BUG: KASAN: slab-use-after-free in user_event_get_fields+0x38/0x40
[ 78.227473] Read of size 8 at addr ffff88800473ecb8 by task cat/4434
[ 78.228021]
[ 78.228232] CPU: 2 PID: 4434 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 78.228917] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 78.229833] Call Trace:
[ 78.230105] <TASK>
[ 78.230365] dump_stack_lvl+0x66/0xa0
[ 78.230730] print_report+0xd0/0x630
[ 78.231080] ? user_event_get_fields+0x38/0x40
[ 78.231475] ? __virt_addr_valid+0x208/0x3f0
[ 78.231855] ? user_event_get_fields+0x38/0x40
[ 78.232254] kasan_report+0xd8/0x110
[ 78.232588] ? user_event_get_fields+0x38/0x40
[ 78.233013] user_event_get_fields+0x38/0x40
[ 78.233393] f_start+0x175/0x3d0
[ 78.233712] seq_read_iter+0x268/0x11e0
[ 78.234071] ? lock_release+0x453/0x600
[ 78.234425] seq_read+0x261/0x350
[ 78.234745] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 78.235164] ? __pfx_seq_read+0x10/0x10
[ 78.235519] ? trace_irq_enable.constprop.0+0xce/0x110
[ 78.235965] vfs_read+0x171/0x9e0
[ 78.236284] ? lock_acquire+0x408/0x4b0
[ 78.236636] ? __pfx_vfs_read+0x10/0x10
[ 78.237014] ? lock_release+0x453/0x600
[ 78.237381] ? __pfx___up_read+0x10/0x10
[ 78.237747] ksys_read+0xdd/0x1a0
[ 78.238067] ? __pfx_ksys_read+0x10/0x10
[ 78.238431] ? trace_irq_enable.constprop.0+0xce/0x110
[ 78.238876] do_syscall_64+0x66/0x130
[ 78.239232] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.239665] RIP: 0033:0x7fa23454940e
[ 78.240006] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 78.241427] RSP: 002b:00007fff3bf6c2d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 78.242080] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fa23454940e
[ 78.242675] RDX: 0000000000020000 RSI: 00007fa23443d000 RDI: 0000000000000003
[ 78.243271] RBP: 00007fa23443d000 R08: 00007fa23443c010 R09: 0000000000000000
[ 78.243867] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 78.244464] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 78.245061] </TASK>
[ 78.245318]
[ 78.245528] Allocated by task 4436:
[ 78.245875] kasan_save_stack+0x20/0x40
[ 78.246252] kasan_save_track+0x14/0x30
[ 78.246628] __kasan_kmalloc+0x8f/0xa0
[ 78.246994] user_event_parse_cmd+0x55e/0x25a0
[ 78.247404] user_events_ioctl+0xa52/0x17f0
[ 78.247801] __x64_sys_ioctl+0x133/0x190
[ 78.248180] do_syscall_64+0x66/0x130
[ 78.248544] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.249266]
[ 78.249492] Freed by task 50:
[ 78.249802] kasan_save_stack+0x20/0x40
[ 78.250174] kasan_save_track+0x14/0x30
[ 78.250551] kasan_save_free_info+0x3b/0x60
[ 78.250946] poison_slab_object+0x10a/0x170
[ 78.255191] __kasan_slab_free+0x14/0x30
[ 78.255572] kfree+0xe0/0x2f0
[ 78.255885] destroy_user_event+0x305/0x450
[ 78.256285] delayed_destroy_user_event+0x5c/0xe0
[ 78.256715] process_one_work+0x81c/0x1970
[ 78.257109] worker_thread+0x608/0x1160
[ 78.257480] kthread+0x2be/0x3b0
[ 78.257811] ret_from_fork+0x2c/0x70
[ 78.258169] ret_from_fork_asm+0x1a/0x30
[ 78.258544]
[ 78.258761] Last potentially related work creation:
[ 78.259201] kasan_save_stack+0x20/0x40
[ 78.259571] __kasan_record_aux_stack+0x8e/0xa0
[ 78.259995] insert_work+0x20/0x1b0
[ 78.260344] __queue_work+0x67a/0xc60
[ 78.260702] queue_work_on+0x63/0x90
[ 78.261058] user_event_put+0x1f9/0x390
[ 78.261428] user_events_ioctl+0x11ed/0x17f0
[ 78.261833] __x64_sys_ioctl+0x133/0x190
[ 78.262207] do_syscall_64+0x66/0x130
[ 78.262566] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.263068]
[ 78.263279] The buggy address belongs to the object at ffff88800473ec00
[ 78.263279] which belongs to the cache kmalloc-cg-512 of size 512
[ 78.264288] The buggy address is located 184 bytes inside of
[ 78.264288] freed 512-byte region [ffff88800473ec00, ffff88800473ee00)
[ 78.265262]
[ 78.265474] The buggy address belongs to the physical page:
[ 78.265960] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800473d800 pfn:0x473c
[ 78.266724] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 78.267383] memcg:ffff88800102a301
[ 78.267723] flags: 0x40(head|zone=0)
[ 78.268078] page_type: 0xffffefff(slab)
[ 78.268445] raw: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 78.269154] raw: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 78.269900] head: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 78.270574] head: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 78.271246] head: 0000000000000002 ffffea000011cf01 ffffffffffffffff 0000000000000000
[ 78.271918] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 78.272581] page dumped because: kasan: bad access detected
[ 78.273076]
[ 78.273287] Memory state around the buggy address:
[ 78.273727] ffff88800473eb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 78.274358] ffff88800473ec00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.274981] >ffff88800473ec80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.275609] ^
[ 78.276060] ffff88800473ed00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.276688] ffff88800473ed80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.277314] ==================================================================
[ 78.277962] ==================================================================
[ 78.278589] BUG: KASAN: slab-use-after-free in f_start+0x2e4/0x3d0
[ 78.279375] Read of size 8 at addr ffff88800473ec70 by task cat/4434
[ 78.279928]
[ 78.280139] CPU: 2 PID: 4434 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 78.280833] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 78.281752] Call Trace:
[ 78.282025] <TASK>
[ 78.282284] dump_stack_lvl+0x66/0xa0
[ 78.282641] print_report+0xd0/0x630
[ 78.282993] ? f_start+0x2e4/0x3d0
[ 78.283338] ? __virt_addr_valid+0x208/0x3f0
[ 78.283741] ? f_start+0x2e4/0x3d0
[ 78.284084] kasan_report+0xd8/0x110
[ 78.284440] ? f_start+0x2e4/0x3d0
[ 78.284790] f_start+0x2e4/0x3d0
[ 78.285120] seq_read_iter+0x268/0x11e0
[ 78.285492] ? lock_release+0x453/0x600
[ 78.285866] seq_read+0x261/0x350
[ 78.286205] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 78.286630] ? __pfx_seq_read+0x10/0x10
[ 78.287005] ? trace_irq_enable.constprop.0+0xce/0x110
[ 78.287468] vfs_read+0x171/0x9e0
[ 78.287802] ? lock_acquire+0x408/0x4b0
[ 78.288173] ? __pfx_vfs_read+0x10/0x10
[ 78.288545] ? lock_release+0x453/0x600
[ 78.288918] ? __pfx___up_read+0x10/0x10
[ 78.289294] ksys_read+0xdd/0x1a0
[ 78.289638] ? __pfx_ksys_read+0x10/0x10
[ 78.290017] ? trace_irq_enable.constprop.0+0xce/0x110
[ 78.290480] do_syscall_64+0x66/0x130
[ 78.290841] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.291303] RIP: 0033:0x7fa23454940e
[ 78.291658] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 78.293095] RSP: 002b:00007fff3bf6c2d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 78.293756] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fa23454940e
[ 78.294350] RDX: 0000000000020000 RSI: 00007fa23443d000 RDI: 0000000000000003
[ 78.294945] RBP: 00007fa23443d000 R08: 00007fa23443c010 R09: 0000000000000000
[ 78.295537] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 78.296133] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 78.296741] </TASK>
[ 78.297001]
[ 78.297213] Allocated by task 4436:
[ 78.297557] kasan_save_stack+0x20/0x40
[ 78.297931] kasan_save_track+0x14/0x30
[ 78.298304] __kasan_kmalloc+0x8f/0xa0
[ 78.298671] user_event_parse_cmd+0x55e/0x25a0
[ 78.299085] user_events_ioctl+0xa52/0x17f0
[ 78.299482] __x64_sys_ioctl+0x133/0x190
[ 78.299865] do_syscall_64+0x66/0x130
[ 78.300223] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.300679]
[ 78.300897] Freed by task 50:
[ 78.301211] kasan_save_stack+0x20/0x40
[ 78.301584] kasan_save_track+0x14/0x30
[ 78.301956] kasan_save_free_info+0x3b/0x60
[ 78.302349] poison_slab_object+0x10a/0x170
[ 78.302747] __kasan_slab_free+0x14/0x30
[ 78.303123] kfree+0xe0/0x2f0
[ 78.303422] destroy_user_event+0x305/0x450
[ 78.303795] delayed_destroy_user_event+0x5c/0xe0
[ 78.304208] process_one_work+0x81c/0x1970
[ 78.304576] worker_thread+0x608/0x1160
[ 78.304950] kthread+0x2be/0x3b0
[ 78.305270] ret_from_fork+0x2c/0x70
[ 78.305614] ret_from_fork_asm+0x1a/0x30
[ 78.305975]
[ 78.306177] Last potentially related work creation:
[ 78.306597] kasan_save_stack+0x20/0x40
[ 78.306950] __kasan_record_aux_stack+0x8e/0xa0
[ 78.307351] insert_work+0x20/0x1b0
[ 78.307681] __queue_work+0x67a/0xc60
[ 78.308024] queue_work_on+0x63/0x90
[ 78.308362] user_event_put+0x1f9/0x390
[ 78.308712] user_events_ioctl+0x11ed/0x17f0
[ 78.309299] __x64_sys_ioctl+0x133/0x190
[ 78.309662] do_syscall_64+0x66/0x130
[ 78.310008] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.310437]
[ 78.310639] The buggy address belongs to the object at ffff88800473ec00
[ 78.310639] which belongs to the cache kmalloc-cg-512 of size 512
[ 78.311601] The buggy address is located 112 bytes inside of
[ 78.311601] freed 512-byte region [ffff88800473ec00, ffff88800473ee00)
[ 78.312539]
[ 78.312747] The buggy address belongs to the physical page:
[ 78.313222] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800473d800 pfn:0x473c
[ 78.313943] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 78.314570] memcg:ffff88800102a301
[ 78.314893] flags: 0x40(head|zone=0)
[ 78.315228] page_type: 0xffffefff(slab)
[ 78.315582] raw: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 78.316211] raw: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 78.316855] head: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 78.317492] head: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 78.318138] head: 0000000000000002 ffffea000011cf01 ffffffffffffffff 0000000000000000
[ 78.318771] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 78.319413] page dumped because: kasan: bad access detected
[ 78.319877]
[ 78.320078] Memory state around the buggy address:
[ 78.320494] ffff88800473eb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 78.321102] ffff88800473eb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 78.325365] >ffff88800473ec00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.325964] ^
[ 78.326513] ffff88800473ec80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.327107] ffff88800473ed00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.327706] ==================================================================
[ 78.328322] ==================================================================
[ 78.329070] BUG: KASAN: slab-use-after-free in f_start+0x2cb/0x3d0
[ 78.329609] Read of size 8 at addr ffff88800473ed08 by task cat/4434
[ 78.330154]
[ 78.330365] CPU: 2 PID: 4434 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 78.331053] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 78.331968] Call Trace:
[ 78.332245] <TASK>
[ 78.332500] dump_stack_lvl+0x66/0xa0
[ 78.332863] print_report+0xd0/0x630
[ 78.333215] ? f_start+0x2cb/0x3d0
[ 78.333564] ? __virt_addr_valid+0x208/0x3f0
[ 78.333966] ? f_start+0x2cb/0x3d0
[ 78.334306] kasan_report+0xd8/0x110
[ 78.334661] ? f_start+0x2cb/0x3d0
[ 78.335006] f_start+0x2cb/0x3d0
[ 78.335337] seq_read_iter+0x268/0x11e0
[ 78.335714] ? lock_release+0x453/0x600
[ 78.336084] seq_read+0x261/0x350
[ 78.336419] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 78.336848] ? __pfx_seq_read+0x10/0x10
[ 78.337224] ? trace_irq_enable.constprop.0+0xce/0x110
[ 78.337691] vfs_read+0x171/0x9e0
[ 78.338031] ? lock_acquire+0x408/0x4b0
[ 78.338407] ? __pfx_vfs_read+0x10/0x10
[ 78.338940] ? lock_release+0x453/0x600
[ 78.339311] ? __pfx___up_read+0x10/0x10
[ 78.339689] ksys_read+0xdd/0x1a0
[ 78.340027] ? __pfx_ksys_read+0x10/0x10
[ 78.340408] ? trace_irq_enable.constprop.0+0xce/0x110
[ 78.340871] do_syscall_64+0x66/0x130
[ 78.341230] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.341689] RIP: 0033:0x7fa23454940e
[ 78.342046] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 78.343484] RSP: 002b:00007fff3bf6c2d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 78.344144] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fa23454940e
[ 78.344740] RDX: 0000000000020000 RSI: 00007fa23443d000 RDI: 0000000000000003
[ 78.345335] RBP: 00007fa23443d000 R08: 00007fa23443c010 R09: 0000000000000000
[ 78.345933] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 78.346529] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 78.347133] </TASK>
[ 78.347390]
[ 78.347602] Allocated by task 4436:
[ 78.347947] kasan_save_stack+0x20/0x40
[ 78.348324] kasan_save_track+0x14/0x30
[ 78.348699] __kasan_kmalloc+0x8f/0xa0
[ 78.349064] user_event_parse_cmd+0x55e/0x25a0
[ 78.349472] user_events_ioctl+0xa52/0x17f0
[ 78.349869] __x64_sys_ioctl+0x133/0x190
[ 78.350247] do_syscall_64+0x66/0x130
[ 78.350604] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.351056]
[ 78.351268] Freed by task 50:
[ 78.351580] kasan_save_stack+0x20/0x40
[ 78.351951] kasan_save_track+0x14/0x30
[ 78.352322] kasan_save_free_info+0x3b/0x60
[ 78.352714] poison_slab_object+0x10a/0x170
[ 78.353112] __kasan_slab_free+0x14/0x30
[ 78.353491] kfree+0xe0/0x2f0
[ 78.353807] destroy_user_event+0x305/0x450
[ 78.354200] delayed_destroy_user_event+0x5c/0xe0
[ 78.354630] process_one_work+0x81c/0x1970
[ 78.355020] worker_thread+0x608/0x1160
[ 78.355390] kthread+0x2be/0x3b0
[ 78.355718] ret_from_fork+0x2c/0x70
[ 78.356076] ret_from_fork_asm+0x1a/0x30
[ 78.356455]
[ 78.356666] Last potentially related work creation:
[ 78.357111] kasan_save_stack+0x20/0x40
[ 78.357484] __kasan_record_aux_stack+0x8e/0xa0
[ 78.357902] insert_work+0x20/0x1b0
[ 78.358251] __queue_work+0x67a/0xc60
[ 78.358612] queue_work_on+0x63/0x90
[ 78.358968] user_event_put+0x1f9/0x390
[ 78.359338] user_events_ioctl+0x11ed/0x17f0
[ 78.359741] __x64_sys_ioctl+0x133/0x190
[ 78.360122] do_syscall_64+0x66/0x130
[ 78.360479] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.360938]
[ 78.361148] The buggy address belongs to the object at ffff88800473ec00
[ 78.361148] which belongs to the cache kmalloc-cg-512 of size 512
[ 78.362155] The buggy address is located 264 bytes inside of
[ 78.362155] freed 512-byte region [ffff88800473ec00, ffff88800473ee00)
[ 78.363119]
[ 78.363328] The buggy address belongs to the physical page:
[ 78.363816] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800473d800 pfn:0x473c
[ 78.364573] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 78.365234] memcg:ffff88800102a301
[ 78.365572] flags: 0x40(head|zone=0)
[ 78.365935] page_type: 0xffffefff(slab)
[ 78.366309] raw: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 78.366970] raw: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 78.367639] head: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 78.368305] head: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 78.369168] head: 0000000000000002 ffffea000011cf01 ffffffffffffffff 0000000000000000
[ 78.369839] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 78.370510] page dumped because: kasan: bad access detected
[ 78.370996]
[ 78.371209] Memory state around the buggy address:
[ 78.371646] ffff88800473ec00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.372277] ffff88800473ec80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.372914] >ffff88800473ed00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.373538] ^
[ 78.373890] ffff88800473ed80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.374517] ffff88800473ee00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 78.375150] ==================================================================
[ 78.375801] ==================================================================
[ 78.376429] BUG: KASAN: slab-use-after-free in user_event_get_fields+0x38/0x40
[ 78.377060] Read of size 8 at addr ffff88800473ecb8 by task cat/4434
[ 78.377600]
[ 78.377809] CPU: 2 PID: 4434 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 78.378496] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 78.379417] Call Trace:
[ 78.379693] <TASK>
[ 78.379945] dump_stack_lvl+0x66/0xa0
[ 78.380302] print_report+0xd0/0x630
[ 78.380656] ? user_event_get_fields+0x38/0x40
[ 78.381074] ? __virt_addr_valid+0x208/0x3f0
[ 78.381475] ? user_event_get_fields+0x38/0x40
[ 78.381892] kasan_report+0xd8/0x110
[ 78.382247] ? user_event_get_fields+0x38/0x40
[ 78.382664] user_event_get_fields+0x38/0x40
[ 78.383063] f_start+0x175/0x3d0
[ 78.383395] seq_read_iter+0x268/0x11e0
[ 78.383771] ? lock_release+0x453/0x600
[ 78.384144] seq_read+0x261/0x350
[ 78.384484] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 78.384916] ? __pfx_seq_read+0x10/0x10
[ 78.385291] ? trace_irq_enable.constprop.0+0xce/0x110
[ 78.385753] vfs_read+0x171/0x9e0
[ 78.386088] ? lock_acquire+0x408/0x4b0
[ 78.386464] ? __pfx_vfs_read+0x10/0x10
[ 78.386834] ? lock_release+0x453/0x600
[ 78.387205] ? __pfx___up_read+0x10/0x10
[ 78.387584] ksys_read+0xdd/0x1a0
[ 78.387920] ? __pfx_ksys_read+0x10/0x10
[ 78.388295] ? trace_irq_enable.constprop.0+0xce/0x110
[ 78.388763] do_syscall_64+0x66/0x130
[ 78.389123] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.389578] RIP: 0033:0x7fa23454940e
[ 78.389928] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 78.391367] RSP: 002b:00007fff3bf6c2d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 78.392020] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fa23454940e
[ 78.392617] RDX: 0000000000020000 RSI: 00007fa23443d000 RDI: 0000000000000003
[ 78.397058] RBP: 00007fa23443d000 R08: 00007fa23443c010 R09: 0000000000000000
[ 78.397663] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 78.398262] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 78.399113] </TASK>
[ 78.399375]
[ 78.399582] Allocated by task 4436:
[ 78.399927] kasan_save_stack+0x20/0x40
[ 78.400292] kasan_save_track+0x14/0x30
[ 78.400657] __kasan_kmalloc+0x8f/0xa0
[ 78.401030] user_event_parse_cmd+0x55e/0x25a0
[ 78.401437] user_events_ioctl+0xa52/0x17f0
[ 78.401825] __x64_sys_ioctl+0x133/0x190
[ 78.402198] do_syscall_64+0x66/0x130
[ 78.402558] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.403008]
[ 78.403213] Freed by task 50:
[ 78.403522] kasan_save_stack+0x20/0x40
[ 78.403886] kasan_save_track+0x14/0x30
[ 78.404248] kasan_save_free_info+0x3b/0x60
[ 78.404638] poison_slab_object+0x10a/0x170
[ 78.405032] __kasan_slab_free+0x14/0x30
[ 78.405401] kfree+0xe0/0x2f0
[ 78.405710] destroy_user_event+0x305/0x450
[ 78.406100] delayed_destroy_user_event+0x5c/0xe0
[ 78.406523] process_one_work+0x81c/0x1970
[ 78.406904] worker_thread+0x608/0x1160
[ 78.407270] kthread+0x2be/0x3b0
[ 78.407599] ret_from_fork+0x2c/0x70
[ 78.407947] ret_from_fork_asm+0x1a/0x30
[ 78.408318]
[ 78.408529] Last potentially related work creation:
[ 78.408968] kasan_save_stack+0x20/0x40
[ 78.409332] __kasan_record_aux_stack+0x8e/0xa0
[ 78.409748] insert_work+0x20/0x1b0
[ 78.410092] __queue_work+0x67a/0xc60
[ 78.410445] queue_work_on+0x63/0x90
[ 78.410793] user_event_put+0x1f9/0x390
[ 78.411160] user_events_ioctl+0x11ed/0x17f0
[ 78.411556] __x64_sys_ioctl+0x133/0x190
[ 78.411927] do_syscall_64+0x66/0x130
[ 78.412283] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.412733]
[ 78.412948] The buggy address belongs to the object at ffff88800473ec00
[ 78.412948] which belongs to the cache kmalloc-cg-512 of size 512
[ 78.413944] The buggy address is located 184 bytes inside of
[ 78.413944] freed 512-byte region [ffff88800473ec00, ffff88800473ee00)
[ 78.414900]
[ 78.415106] The buggy address belongs to the physical page:
[ 78.415588] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800473d800 pfn:0x473c
[ 78.416340] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 78.416998] memcg:ffff88800102a301
[ 78.417336] flags: 0x40(head|zone=0)
[ 78.417682] page_type: 0xffffefff(slab)
[ 78.418048] raw: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 78.418707] raw: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 78.419363] head: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 78.420039] head: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 78.420697] head: 0000000000000002 ffffea000011cf01 ffffffffffffffff 0000000000000000
[ 78.421363] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 78.422022] page dumped because: kasan: bad access detected
[ 78.422505]
[ 78.422711] Memory state around the buggy address:
[ 78.423140] ffff88800473eb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 78.423758] ffff88800473ec00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.424373] >ffff88800473ec80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.424995] ^
[ 78.425443] ffff88800473ed00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.426063] ffff88800473ed80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.426680] ==================================================================
[ 78.427360] ==================================================================
[ 78.427982] BUG: KASAN: slab-use-after-free in f_start+0x2e4/0x3d0
[ 78.428506] Read of size 8 at addr ffff88800473ec70 by task cat/4434
[ 78.429201]
[ 78.429408] CPU: 2 PID: 4434 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 78.430086] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 78.431028] Call Trace:
[ 78.431300] <TASK>
[ 78.431549] dump_stack_lvl+0x66/0xa0
[ 78.431903] print_report+0xd0/0x630
[ 78.432252] ? f_start+0x2e4/0x3d0
[ 78.432590] ? __virt_addr_valid+0x208/0x3f0
[ 78.432989] ? f_start+0x2e4/0x3d0
[ 78.433325] kasan_report+0xd8/0x110
[ 78.433674] ? f_start+0x2e4/0x3d0
[ 78.434010] f_start+0x2e4/0x3d0
[ 78.434334] seq_read_iter+0x268/0x11e0
[ 78.434703] ? lock_release+0x453/0x600
[ 78.435068] seq_read+0x261/0x350
[ 78.435400] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 78.435820] ? __pfx_seq_read+0x10/0x10
[ 78.436186] ? trace_irq_enable.constprop.0+0xce/0x110
[ 78.436641] vfs_read+0x171/0x9e0
[ 78.436981] ? lock_acquire+0x408/0x4b0
[ 78.437347] ? __pfx_vfs_read+0x10/0x10
[ 78.437710] ? lock_release+0x453/0x600
[ 78.438073] ? __pfx___up_read+0x10/0x10
[ 78.438446] ksys_read+0xdd/0x1a0
[ 78.438779] ? __pfx_ksys_read+0x10/0x10
[ 78.439148] ? trace_irq_enable.constprop.0+0xce/0x110
[ 78.439601] do_syscall_64+0x66/0x130
[ 78.439956] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.440406] RIP: 0033:0x7fa23454940e
[ 78.440757] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 78.442175] RSP: 002b:00007fff3bf6c2d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 78.442817] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fa23454940e
[ 78.443402] RDX: 0000000000020000 RSI: 00007fa23443d000 RDI: 0000000000000003
[ 78.443987] RBP: 00007fa23443d000 R08: 00007fa23443c010 R09: 0000000000000000
[ 78.444571] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 78.445163] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 78.445751] </TASK>
[ 78.446005]
[ 78.446212] Allocated by task 4436:
[ 78.446554] kasan_save_stack+0x20/0x40
[ 78.446919] kasan_save_track+0x14/0x30
[ 78.447283] __kasan_kmalloc+0x8f/0xa0
[ 78.447640] user_event_parse_cmd+0x55e/0x25a0
[ 78.448048] user_events_ioctl+0xa52/0x17f0
[ 78.448437] __x64_sys_ioctl+0x133/0x190
[ 78.448811] do_syscall_64+0x66/0x130
[ 78.449162] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.449610]
[ 78.449818] Freed by task 50:
[ 78.450124] kasan_save_stack+0x20/0x40
[ 78.450492] kasan_save_track+0x14/0x30
[ 78.450855] kasan_save_free_info+0x3b/0x60
[ 78.451239] poison_slab_object+0x10a/0x170
[ 78.451628] __kasan_slab_free+0x14/0x30
[ 78.452000] kfree+0xe0/0x2f0
[ 78.452306] destroy_user_event+0x305/0x450
[ 78.452691] delayed_destroy_user_event+0x5c/0xe0
[ 78.453121] process_one_work+0x81c/0x1970
[ 78.453503] worker_thread+0x608/0x1160
[ 78.453864] kthread+0x2be/0x3b0
[ 78.454189] ret_from_fork+0x2c/0x70
[ 78.454538] ret_from_fork_asm+0x1a/0x30
[ 78.454905]
[ 78.455111] Last potentially related work creation:
[ 78.455547] kasan_save_stack+0x20/0x40
[ 78.455911] __kasan_record_aux_stack+0x8e/0xa0
[ 78.456324] insert_work+0x20/0x1b0
[ 78.456669] __queue_work+0x67a/0xc60
[ 78.457030] queue_work_on+0x63/0x90
[ 78.457376] user_event_put+0x1f9/0x390
[ 78.457743] user_events_ioctl+0x11ed/0x17f0
[ 78.458140] __x64_sys_ioctl+0x133/0x190
[ 78.458511] do_syscall_64+0x66/0x130
[ 78.459060] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.459509]
[ 78.459718] The buggy address belongs to the object at ffff88800473ec00
[ 78.459718] which belongs to the cache kmalloc-cg-512 of size 512
[ 78.460703] The buggy address is located 112 bytes inside of
[ 78.460703] freed 512-byte region [ffff88800473ec00, ffff88800473ee00)
[ 78.461663]
[ 78.461872] The buggy address belongs to the physical page:
[ 78.462350] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800473d800 pfn:0x473c
[ 78.463091] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 78.463740] memcg:ffff88800102a301
[ 78.464073] flags: 0x40(head|zone=0)
[ 78.468269] page_type: 0xffffefff(slab)
[ 78.468633] raw: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 78.469296] raw: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 78.469946] head: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 78.470609] head: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 78.471267] head: 0000000000000002 ffffea000011cf01 ffffffffffffffff 0000000000000000
[ 78.471931] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 78.472590] page dumped because: kasan: bad access detected
[ 78.473074]
[ 78.473280] Memory state around the buggy address:
[ 78.473709] ffff88800473eb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 78.474327] ffff88800473eb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 78.474945] >ffff88800473ec00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.475563] ^
[ 78.476131] ffff88800473ec80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.476753] ffff88800473ed00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.477371] ==================================================================
[ 78.478004] ==================================================================
[ 78.478636] BUG: KASAN: slab-use-after-free in f_start+0x2cb/0x3d0
[ 78.479160] Read of size 8 at addr ffff88800473ed08 by task cat/4434
[ 78.479692]
[ 78.479897] CPU: 2 PID: 4434 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 78.480573] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 78.481481] Call Trace:
[ 78.481752] <TASK>
[ 78.482001] dump_stack_lvl+0x66/0xa0
[ 78.482353] print_report+0xd0/0x630
[ 78.482702] ? f_start+0x2cb/0x3d0
[ 78.483040] ? __virt_addr_valid+0x208/0x3f0
[ 78.483433] ? f_start+0x2cb/0x3d0
[ 78.483768] kasan_report+0xd8/0x110
[ 78.484116] ? f_start+0x2cb/0x3d0
[ 78.484452] f_start+0x2cb/0x3d0
[ 78.484786] seq_read_iter+0x268/0x11e0
[ 78.485154] ? lock_release+0x453/0x600
[ 78.485520] seq_read+0x261/0x350
[ 78.485849] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 78.486268] ? __pfx_seq_read+0x10/0x10
[ 78.486635] ? trace_irq_enable.constprop.0+0xce/0x110
[ 78.487089] vfs_read+0x171/0x9e0
[ 78.487420] ? lock_acquire+0x408/0x4b0
[ 78.487787] ? __pfx_vfs_read+0x10/0x10
[ 78.488154] ? lock_release+0x453/0x600
[ 78.488519] ? __pfx___up_read+0x10/0x10
[ 78.489043] ksys_read+0xdd/0x1a0
[ 78.489375] ? __pfx_ksys_read+0x10/0x10
[ 78.489743] ? trace_irq_enable.constprop.0+0xce/0x110
[ 78.490195] do_syscall_64+0x66/0x130
[ 78.490552] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.491001] RIP: 0033:0x7fa23454940e
[ 78.491347] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 78.492773] RSP: 002b:00007fff3bf6c2d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 78.493416] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fa23454940e
[ 78.494001] RDX: 0000000000020000 RSI: 00007fa23443d000 RDI: 0000000000000003
[ 78.494587] RBP: 00007fa23443d000 R08: 00007fa23443c010 R09: 0000000000000000
[ 78.495169] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 78.495754] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 78.496343] </TASK>
[ 78.496598]
[ 78.496811] Allocated by task 4436:
[ 78.497149] kasan_save_stack+0x20/0x40
[ 78.497514] kasan_save_track+0x14/0x30
[ 78.497880] __kasan_kmalloc+0x8f/0xa0
[ 78.498237] user_event_parse_cmd+0x55e/0x25a0
[ 78.498643] user_events_ioctl+0xa52/0x17f0
[ 78.499030] __x64_sys_ioctl+0x133/0x190
[ 78.499398] do_syscall_64+0x66/0x130
[ 78.499748] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.500193]
[ 78.500401] Freed by task 50:
[ 78.500704] kasan_save_stack+0x20/0x40
[ 78.501075] kasan_save_track+0x14/0x30
[ 78.501441] kasan_save_free_info+0x3b/0x60
[ 78.501823] poison_slab_object+0x10a/0x170
[ 78.502209] __kasan_slab_free+0x14/0x30
[ 78.502578] kfree+0xe0/0x2f0
[ 78.502884] destroy_user_event+0x305/0x450
[ 78.503271] delayed_destroy_user_event+0x5c/0xe0
[ 78.503695] process_one_work+0x81c/0x1970
[ 78.504078] worker_thread+0x608/0x1160
[ 78.504438] kthread+0x2be/0x3b0
[ 78.504766] ret_from_fork+0x2c/0x70
[ 78.505116] ret_from_fork_asm+0x1a/0x30
[ 78.505487]
[ 78.505695] Last potentially related work creation:
[ 78.506133] kasan_save_stack+0x20/0x40
[ 78.506496] __kasan_record_aux_stack+0x8e/0xa0
[ 78.506907] insert_work+0x20/0x1b0
[ 78.507250] __queue_work+0x67a/0xc60
[ 78.507603] queue_work_on+0x63/0x90
[ 78.507947] user_event_put+0x1f9/0x390
[ 78.508310] user_events_ioctl+0x11ed/0x17f0
[ 78.508707] __x64_sys_ioctl+0x133/0x190
[ 78.509083] do_syscall_64+0x66/0x130
[ 78.509436] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.509885]
[ 78.510095] The buggy address belongs to the object at ffff88800473ec00
[ 78.510095] which belongs to the cache kmalloc-cg-512 of size 512
[ 78.511081] The buggy address is located 264 bytes inside of
[ 78.511081] freed 512-byte region [ffff88800473ec00, ffff88800473ee00)
[ 78.512033]
[ 78.512242] The buggy address belongs to the physical page:
[ 78.512721] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800473d800 pfn:0x473c
[ 78.513470] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 78.514116] memcg:ffff88800102a301
[ 78.514449] flags: 0x40(head|zone=0)
[ 78.514797] page_type: 0xffffefff(slab)
[ 78.515161] raw: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 78.515812] raw: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 78.516468] head: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 78.517129] head: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 78.517792] head: 0000000000000002 ffffea000011cf01 ffffffffffffffff 0000000000000000
[ 78.518449] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 78.519255] page dumped because: kasan: bad access detected
[ 78.519737]
[ 78.519945] Memory state around the buggy address:
[ 78.520372] ffff88800473ec00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.520991] ffff88800473ec80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.521610] >ffff88800473ed00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.522227] ^
[ 78.522566] ffff88800473ed80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.523185] ffff88800473ee00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 78.523800] ==================================================================
[ 78.524435] ==================================================================
[ 78.525058] BUG: KASAN: slab-use-after-free in user_event_get_fields+0x38/0x40
[ 78.525686] Read of size 8 at addr ffff88800473ecb8 by task cat/4434
[ 78.526219]
[ 78.526427] CPU: 2 PID: 4434 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 78.527100] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 78.527999] Call Trace:
[ 78.528271] <TASK>
[ 78.528518] dump_stack_lvl+0x66/0xa0
[ 78.528878] print_report+0xd0/0x630
[ 78.529228] ? user_event_get_fields+0x38/0x40
[ 78.529631] ? __virt_addr_valid+0x208/0x3f0
[ 78.530025] ? user_event_get_fields+0x38/0x40
[ 78.530434] kasan_report+0xd8/0x110
[ 78.530783] ? user_event_get_fields+0x38/0x40
[ 78.531189] user_event_get_fields+0x38/0x40
[ 78.531582] f_start+0x175/0x3d0
[ 78.531910] seq_read_iter+0x268/0x11e0
[ 78.532278] ? lock_release+0x453/0x600
[ 78.532642] seq_read+0x261/0x350
[ 78.532979] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 78.537236] ? __pfx_seq_read+0x10/0x10
[ 78.537604] ? trace_irq_enable.constprop.0+0xce/0x110
[ 78.538059] vfs_read+0x171/0x9e0
[ 78.538388] ? lock_acquire+0x408/0x4b0
[ 78.538752] ? __pfx_vfs_read+0x10/0x10
[ 78.539117] ? lock_release+0x453/0x600
[ 78.539486] ? __pfx___up_read+0x10/0x10
[ 78.539856] ksys_read+0xdd/0x1a0
[ 78.540187] ? __pfx_ksys_read+0x10/0x10
[ 78.540560] ? trace_irq_enable.constprop.0+0xce/0x110
[ 78.541018] do_syscall_64+0x66/0x130
[ 78.541371] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.541820] RIP: 0033:0x7fa23454940e
[ 78.542168] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 78.543589] RSP: 002b:00007fff3bf6c2d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 78.544231] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fa23454940e
[ 78.544824] RDX: 0000000000020000 RSI: 00007fa23443d000 RDI: 0000000000000003
[ 78.545412] RBP: 00007fa23443d000 R08: 00007fa23443c010 R09: 0000000000000000
[ 78.545997] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 78.546583] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 78.547169] </TASK>
[ 78.547421]
[ 78.547630] Allocated by task 4436:
[ 78.547971] kasan_save_stack+0x20/0x40
[ 78.548335] kasan_save_track+0x14/0x30
[ 78.548703] __kasan_kmalloc+0x8f/0xa0
[ 78.549191] user_event_parse_cmd+0x55e/0x25a0
[ 78.549596] user_events_ioctl+0xa52/0x17f0
[ 78.549986] __x64_sys_ioctl+0x133/0x190
[ 78.550359] do_syscall_64+0x66/0x130
[ 78.550712] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.551160]
[ 78.551368] Freed by task 50:
[ 78.551678] kasan_save_stack+0x20/0x40
[ 78.552041] kasan_save_track+0x14/0x30
[ 78.552407] kasan_save_free_info+0x3b/0x60
[ 78.552801] poison_slab_object+0x10a/0x170
[ 78.553187] __kasan_slab_free+0x14/0x30
[ 78.553556] kfree+0xe0/0x2f0
[ 78.553865] destroy_user_event+0x305/0x450
[ 78.554251] delayed_destroy_user_event+0x5c/0xe0
[ 78.554673] process_one_work+0x81c/0x1970
[ 78.555057] worker_thread+0x608/0x1160
[ 78.555425] kthread+0x2be/0x3b0
[ 78.555750] ret_from_fork+0x2c/0x70
[ 78.556095] ret_from_fork_asm+0x1a/0x30
[ 78.556468]
[ 78.556675] Last potentially related work creation:
[ 78.557113] kasan_save_stack+0x20/0x40
[ 78.557478] __kasan_record_aux_stack+0x8e/0xa0
[ 78.557893] insert_work+0x20/0x1b0
[ 78.558234] __queue_work+0x67a/0xc60
[ 78.558586] queue_work_on+0x63/0x90
[ 78.558935] user_event_put+0x1f9/0x390
[ 78.559299] user_events_ioctl+0x11ed/0x17f0
[ 78.559691] __x64_sys_ioctl+0x133/0x190
[ 78.560063] do_syscall_64+0x66/0x130
[ 78.560418] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.560871]
[ 78.561076] The buggy address belongs to the object at ffff88800473ec00
[ 78.561076] which belongs to the cache kmalloc-cg-512 of size 512
[ 78.562068] The buggy address is located 184 bytes inside of
[ 78.562068] freed 512-byte region [ffff88800473ec00, ffff88800473ee00)
[ 78.563019]
[ 78.563225] The buggy address belongs to the physical page:
[ 78.563707] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800473d800 pfn:0x473c
[ 78.564454] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 78.565104] memcg:ffff88800102a301
[ 78.565440] flags: 0x40(head|zone=0)
[ 78.565786] page_type: 0xffffefff(slab)
[ 78.566152] raw: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 78.566808] raw: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 78.567458] head: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 78.568118] head: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 78.568788] head: 0000000000000002 ffffea000011cf01 ffffffffffffffff 0000000000000000
[ 78.569444] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 78.570110] page dumped because: kasan: bad access detected
[ 78.570591]
[ 78.570798] Memory state around the buggy address:
[ 78.571227] ffff88800473eb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 78.571849] ffff88800473ec00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.572471] >ffff88800473ec80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.573092] ^
[ 78.573541] ffff88800473ed00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.574159] ffff88800473ed80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.574776] ==================================================================
[ 78.575407] ==================================================================
[ 78.576030] BUG: KASAN: slab-use-after-free in f_start+0x2e4/0x3d0
[ 78.576554] Read of size 8 at addr ffff88800473ec70 by task cat/4434
[ 78.577096]
[ 78.577306] CPU: 2 PID: 4434 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 78.577978] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 78.579050] Call Trace:
[ 78.579322] <TASK>
[ 78.579569] dump_stack_lvl+0x66/0xa0
[ 78.579925] print_report+0xd0/0x630
[ 78.580276] ? f_start+0x2e4/0x3d0
[ 78.580612] ? __virt_addr_valid+0x208/0x3f0
[ 78.581014] ? f_start+0x2e4/0x3d0
[ 78.581353] kasan_report+0xd8/0x110
[ 78.581700] ? f_start+0x2e4/0x3d0
[ 78.582036] f_start+0x2e4/0x3d0
[ 78.582363] seq_read_iter+0x268/0x11e0
[ 78.582728] ? lock_release+0x453/0x600
[ 78.583092] seq_read+0x261/0x350
[ 78.583424] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 78.583843] ? __pfx_seq_read+0x10/0x10
[ 78.584208] ? trace_irq_enable.constprop.0+0xce/0x110
[ 78.584663] vfs_read+0x171/0x9e0
[ 78.585002] ? lock_acquire+0x408/0x4b0
[ 78.585370] ? __pfx_vfs_read+0x10/0x10
[ 78.585736] ? lock_release+0x453/0x600
[ 78.586104] ? __pfx___up_read+0x10/0x10
[ 78.586477] ksys_read+0xdd/0x1a0
[ 78.586807] ? __pfx_ksys_read+0x10/0x10
[ 78.587176] ? trace_irq_enable.constprop.0+0xce/0x110
[ 78.587631] do_syscall_64+0x66/0x130
[ 78.587986] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.588433] RIP: 0033:0x7fa23454940e
[ 78.588783] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 78.590208] RSP: 002b:00007fff3bf6c2d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 78.590849] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fa23454940e
[ 78.591438] RDX: 0000000000020000 RSI: 00007fa23443d000 RDI: 0000000000000003
[ 78.592026] RBP: 00007fa23443d000 R08: 00007fa23443c010 R09: 0000000000000000
[ 78.592614] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 78.593207] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 78.593796] </TASK>
[ 78.594050]
[ 78.594257] Allocated by task 4436:
[ 78.594599] kasan_save_stack+0x20/0x40
[ 78.594962] kasan_save_track+0x14/0x30
[ 78.595324] __kasan_kmalloc+0x8f/0xa0
[ 78.595684] user_event_parse_cmd+0x55e/0x25a0
[ 78.596092] user_events_ioctl+0xa52/0x17f0
[ 78.596479] __x64_sys_ioctl+0x133/0x190
[ 78.596854] do_syscall_64+0x66/0x130
[ 78.597208] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.597654]
[ 78.597860] Freed by task 50:
[ 78.598169] kasan_save_stack+0x20/0x40
[ 78.598532] kasan_save_track+0x14/0x30
[ 78.598896] kasan_save_free_info+0x3b/0x60
[ 78.599285] poison_slab_object+0x10a/0x170
[ 78.599673] __kasan_slab_free+0x14/0x30
[ 78.600041] kfree+0xe0/0x2f0
[ 78.600349] destroy_user_event+0x305/0x450
[ 78.600742] delayed_destroy_user_event+0x5c/0xe0
[ 78.601169] process_one_work+0x81c/0x1970
[ 78.601550] worker_thread+0x608/0x1160
[ 78.601913] kthread+0x2be/0x3b0
[ 78.602238] ret_from_fork+0x2c/0x70
[ 78.602584] ret_from_fork_asm+0x1a/0x30
[ 78.602952]
[ 78.603162] Last potentially related work creation:
[ 78.603594] kasan_save_stack+0x20/0x40
[ 78.603958] __kasan_record_aux_stack+0x8e/0xa0
[ 78.604372] insert_work+0x20/0x1b0
[ 78.608561] __queue_work+0x67a/0xc60
[ 78.609073] queue_work_on+0x63/0x90
[ 78.609423] user_event_put+0x1f9/0x390
[ 78.609786] user_events_ioctl+0x11ed/0x17f0
[ 78.610181] __x64_sys_ioctl+0x133/0x190
[ 78.610554] do_syscall_64+0x66/0x130
[ 78.610909] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.611356]
[ 78.611563] The buggy address belongs to the object at ffff88800473ec00
[ 78.611563] which belongs to the cache kmalloc-cg-512 of size 512
[ 78.612553] The buggy address is located 112 bytes inside of
[ 78.612553] freed 512-byte region [ffff88800473ec00, ffff88800473ee00)
[ 78.613511]
[ 78.613716] The buggy address belongs to the physical page:
[ 78.614199] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800473d800 pfn:0x473c
[ 78.614943] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 78.615587] memcg:ffff88800102a301
[ 78.615921] flags: 0x40(head|zone=0)
[ 78.616267] page_type: 0xffffefff(slab)
[ 78.616633] raw: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 78.617294] raw: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 78.617946] head: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 78.618603] head: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 78.619272] head: 0000000000000002 ffffea000011cf01 ffffffffffffffff 0000000000000000
[ 78.619929] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 78.620591] page dumped because: kasan: bad access detected
[ 78.621078]
[ 78.621286] Memory state around the buggy address:
[ 78.621717] ffff88800473eb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 78.622334] ffff88800473eb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 78.622953] >ffff88800473ec00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.623571] ^
[ 78.624143] ffff88800473ec80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.624766] ffff88800473ed00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.625384] ==================================================================
[ 78.626017] ==================================================================
[ 78.626639] BUG: KASAN: slab-use-after-free in f_start+0x2cb/0x3d0
[ 78.627165] Read of size 8 at addr ffff88800473ed08 by task cat/4434
[ 78.627697]
[ 78.627905] CPU: 2 PID: 4434 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 78.628579] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 78.629490] Call Trace:
[ 78.629762] <TASK>
[ 78.630010] dump_stack_lvl+0x66/0xa0
[ 78.630366] print_report+0xd0/0x630
[ 78.630716] ? f_start+0x2cb/0x3d0
[ 78.631052] ? __virt_addr_valid+0x208/0x3f0
[ 78.631446] ? f_start+0x2cb/0x3d0
[ 78.631784] kasan_report+0xd8/0x110
[ 78.632131] ? f_start+0x2cb/0x3d0
[ 78.632468] f_start+0x2cb/0x3d0
[ 78.632801] seq_read_iter+0x268/0x11e0
[ 78.633170] ? lock_release+0x453/0x600
[ 78.633535] seq_read+0x261/0x350
[ 78.633868] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 78.634287] ? __pfx_seq_read+0x10/0x10
[ 78.634651] ? trace_irq_enable.constprop.0+0xce/0x110
[ 78.635104] vfs_read+0x171/0x9e0
[ 78.635437] ? lock_acquire+0x408/0x4b0
[ 78.635802] ? __pfx_vfs_read+0x10/0x10
[ 78.636166] ? lock_release+0x453/0x600
[ 78.636530] ? __pfx___up_read+0x10/0x10
[ 78.636908] ksys_read+0xdd/0x1a0
[ 78.637239] ? __pfx_ksys_read+0x10/0x10
[ 78.637610] ? trace_irq_enable.constprop.0+0xce/0x110
[ 78.638067] do_syscall_64+0x66/0x130
[ 78.638423] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.639009] RIP: 0033:0x7fa23454940e
[ 78.639356] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 78.640789] RSP: 002b:00007fff3bf6c2d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 78.641433] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fa23454940e
[ 78.642022] RDX: 0000000000020000 RSI: 00007fa23443d000 RDI: 0000000000000003
[ 78.642610] RBP: 00007fa23443d000 R08: 00007fa23443c010 R09: 0000000000000000
[ 78.643200] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 78.643790] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 78.644381] </TASK>
[ 78.644636]
[ 78.644845] Allocated by task 4436:
[ 78.645187] kasan_save_stack+0x20/0x40
[ 78.645551] kasan_save_track+0x14/0x30
[ 78.645913] __kasan_kmalloc+0x8f/0xa0
[ 78.646275] user_event_parse_cmd+0x55e/0x25a0
[ 78.646684] user_events_ioctl+0xa52/0x17f0
[ 78.647071] __x64_sys_ioctl+0x133/0x190
[ 78.647442] do_syscall_64+0x66/0x130
[ 78.647797] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.648247]
[ 78.648453] Freed by task 50:
[ 78.648767] kasan_save_stack+0x20/0x40
[ 78.649134] kasan_save_track+0x14/0x30
[ 78.649498] kasan_save_free_info+0x3b/0x60
[ 78.649889] poison_slab_object+0x10a/0x170
[ 78.650279] __kasan_slab_free+0x14/0x30
[ 78.650648] kfree+0xe0/0x2f0
[ 78.650960] destroy_user_event+0x305/0x450
[ 78.651349] delayed_destroy_user_event+0x5c/0xe0
[ 78.651774] process_one_work+0x81c/0x1970
[ 78.652156] worker_thread+0x608/0x1160
[ 78.652520] kthread+0x2be/0x3b0
[ 78.652852] ret_from_fork+0x2c/0x70
[ 78.653199] ret_from_fork_asm+0x1a/0x30
[ 78.653567]
[ 78.653777] Last potentially related work creation:
[ 78.654211] kasan_save_stack+0x20/0x40
[ 78.654574] __kasan_record_aux_stack+0x8e/0xa0
[ 78.654988] insert_work+0x20/0x1b0
[ 78.655333] __queue_work+0x67a/0xc60
[ 78.655686] queue_work_on+0x63/0x90
[ 78.656032] user_event_put+0x1f9/0x390
[ 78.656400] user_events_ioctl+0x11ed/0x17f0
[ 78.656804] __x64_sys_ioctl+0x133/0x190
[ 78.657174] do_syscall_64+0x66/0x130
[ 78.657529] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.657980]
[ 78.658185] The buggy address belongs to the object at ffff88800473ec00
[ 78.658185] which belongs to the cache kmalloc-cg-512 of size 512
[ 78.659179] The buggy address is located 264 bytes inside of
[ 78.659179] freed 512-byte region [ffff88800473ec00, ffff88800473ee00)
[ 78.660137]
[ 78.660346] The buggy address belongs to the physical page:
[ 78.660831] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800473d800 pfn:0x473c
[ 78.661584] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 78.662230] memcg:ffff88800102a301
[ 78.662567] flags: 0x40(head|zone=0)
[ 78.662917] page_type: 0xffffefff(slab)
[ 78.663281] raw: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 78.663936] raw: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 78.664587] head: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 78.665261] head: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 78.665919] head: 0000000000000002 ffffea000011cf01 ffffffffffffffff 0000000000000000
[ 78.666583] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 78.667240] page dumped because: kasan: bad access detected
[ 78.667723]
[ 78.667932] Memory state around the buggy address:
[ 78.668362] ffff88800473ec00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.669168] ffff88800473ec80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.669783] >ffff88800473ed00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.670401] ^
[ 78.670741] ffff88800473ed80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.671364] ffff88800473ee00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 78.671980] ==================================================================
[ 78.672616] ==================================================================
[ 78.673245] BUG: KASAN: slab-use-after-free in user_event_get_fields+0x38/0x40
[ 78.673865] Read of size 8 at addr ffff88800473ecb8 by task cat/4434
[ 78.678247]
[ 78.678454] CPU: 2 PID: 4434 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 78.679127] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 78.680028] Call Trace:
[ 78.680297] <TASK>
[ 78.680547] dump_stack_lvl+0x66/0xa0
[ 78.680903] print_report+0xd0/0x630
[ 78.681251] ? user_event_get_fields+0x38/0x40
[ 78.681661] ? __virt_addr_valid+0x208/0x3f0
[ 78.682056] ? user_event_get_fields+0x38/0x40
[ 78.682461] kasan_report+0xd8/0x110
[ 78.682811] ? user_event_get_fields+0x38/0x40
[ 78.683218] user_event_get_fields+0x38/0x40
[ 78.683611] f_start+0x175/0x3d0
[ 78.683934] seq_read_iter+0x268/0x11e0
[ 78.684302] ? lock_release+0x453/0x600
[ 78.684668] seq_read+0x261/0x350
[ 78.685002] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 78.685422] ? __pfx_seq_read+0x10/0x10
[ 78.685788] ? trace_irq_enable.constprop.0+0xce/0x110
[ 78.686241] vfs_read+0x171/0x9e0
[ 78.686569] ? lock_acquire+0x408/0x4b0
[ 78.686937] ? __pfx_vfs_read+0x10/0x10
[ 78.687305] ? lock_release+0x453/0x600
[ 78.687669] ? __pfx___up_read+0x10/0x10
[ 78.688037] ksys_read+0xdd/0x1a0
[ 78.688370] ? __pfx_ksys_read+0x10/0x10
[ 78.688742] ? trace_irq_enable.constprop.0+0xce/0x110
[ 78.689195] do_syscall_64+0x66/0x130
[ 78.689550] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.690000] RIP: 0033:0x7fa23454940e
[ 78.690345] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 78.691763] RSP: 002b:00007fff3bf6c2d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 78.692404] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fa23454940e
[ 78.692994] RDX: 0000000000020000 RSI: 00007fa23443d000 RDI: 0000000000000003
[ 78.693577] RBP: 00007fa23443d000 R08: 00007fa23443c010 R09: 0000000000000000
[ 78.694163] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 78.694747] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 78.695334] </TASK>
[ 78.695588]
[ 78.695797] Allocated by task 4436:
[ 78.696137] kasan_save_stack+0x20/0x40
[ 78.696502] kasan_save_track+0x14/0x30
[ 78.696874] __kasan_kmalloc+0x8f/0xa0
[ 78.697231] user_event_parse_cmd+0x55e/0x25a0
[ 78.697640] user_events_ioctl+0xa52/0x17f0
[ 78.698029] __x64_sys_ioctl+0x133/0x190
[ 78.698398] do_syscall_64+0x66/0x130
[ 78.698751] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.699358]
[ 78.699566] Freed by task 50:
[ 78.699872] kasan_save_stack+0x20/0x40
[ 78.700238] kasan_save_track+0x14/0x30
[ 78.700605] kasan_save_free_info+0x3b/0x60
[ 78.700997] poison_slab_object+0x10a/0x170
[ 78.701384] __kasan_slab_free+0x14/0x30
[ 78.701758] kfree+0xe0/0x2f0
[ 78.702066] destroy_user_event+0x305/0x450
[ 78.702454] delayed_destroy_user_event+0x5c/0xe0
[ 78.702880] process_one_work+0x81c/0x1970
[ 78.703263] worker_thread+0x608/0x1160
[ 78.703627] kthread+0x2be/0x3b0
[ 78.703952] ret_from_fork+0x2c/0x70
[ 78.704302] ret_from_fork_asm+0x1a/0x30
[ 78.704675]
[ 78.704888] Last potentially related work creation:
[ 78.705324] kasan_save_stack+0x20/0x40
[ 78.705691] __kasan_record_aux_stack+0x8e/0xa0
[ 78.706101] insert_work+0x20/0x1b0
[ 78.706444] __queue_work+0x67a/0xc60
[ 78.706798] queue_work_on+0x63/0x90
[ 78.707143] user_event_put+0x1f9/0x390
[ 78.707506] user_events_ioctl+0x11ed/0x17f0
[ 78.707903] __x64_sys_ioctl+0x133/0x190
[ 78.708276] do_syscall_64+0x66/0x130
[ 78.708629] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.709080]
[ 78.709290] The buggy address belongs to the object at ffff88800473ec00
[ 78.709290] which belongs to the cache kmalloc-cg-512 of size 512
[ 78.710280] The buggy address is located 184 bytes inside of
[ 78.710280] freed 512-byte region [ffff88800473ec00, ffff88800473ee00)
[ 78.711238]
[ 78.711449] The buggy address belongs to the physical page:
[ 78.711928] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800473d800 pfn:0x473c
[ 78.712675] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 78.713330] memcg:ffff88800102a301
[ 78.713665] flags: 0x40(head|zone=0)
[ 78.714014] page_type: 0xffffefff(slab)
[ 78.714382] raw: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 78.715033] raw: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 78.715689] head: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 78.716346] head: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 78.717015] head: 0000000000000002 ffffea000011cf01 ffffffffffffffff 0000000000000000
[ 78.717673] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 78.718342] page dumped because: kasan: bad access detected
[ 78.718822]
[ 78.719031] Memory state around the buggy address:
[ 78.719458] ffff88800473eb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 78.720074] ffff88800473ec00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.720693] >ffff88800473ec80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.721317] ^
[ 78.721762] ffff88800473ed00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.722378] ffff88800473ed80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.722995] ==================================================================
[ 78.723628] ==================================================================
[ 78.724251] BUG: KASAN: slab-use-after-free in f_start+0x2f8/0x3d0
[ 78.724784] Read of size 8 at addr ffff88800473ed58 by task cat/4434
[ 78.725323]
[ 78.725533] CPU: 2 PID: 4434 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 78.726203] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 78.727118] Call Trace:
[ 78.727389] <TASK>
[ 78.727635] dump_stack_lvl+0x66/0xa0
[ 78.727990] print_report+0xd0/0x630
[ 78.728338] ? f_start+0x2f8/0x3d0
[ 78.728674] ? __virt_addr_valid+0x208/0x3f0
[ 78.729215] ? f_start+0x2f8/0x3d0
[ 78.729550] kasan_report+0xd8/0x110
[ 78.729897] ? f_start+0x2f8/0x3d0
[ 78.730238] f_start+0x2f8/0x3d0
[ 78.730566] seq_read_iter+0x268/0x11e0
[ 78.730931] ? lock_release+0x453/0x600
[ 78.731298] seq_read+0x261/0x350
[ 78.731631] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 78.732049] ? __pfx_seq_read+0x10/0x10
[ 78.732413] ? trace_irq_enable.constprop.0+0xce/0x110
[ 78.732876] vfs_read+0x171/0x9e0
[ 78.733208] ? lock_acquire+0x408/0x4b0
[ 78.733572] ? __pfx_vfs_read+0x10/0x10
[ 78.733940] ? lock_release+0x453/0x600
[ 78.734308] ? __pfx___up_read+0x10/0x10
[ 78.734679] ksys_read+0xdd/0x1a0
[ 78.735009] ? __pfx_ksys_read+0x10/0x10
[ 78.735382] ? trace_irq_enable.constprop.0+0xce/0x110
[ 78.735837] do_syscall_64+0x66/0x130
[ 78.736190] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.736637] RIP: 0033:0x7fa23454940e
[ 78.736993] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 78.738415] RSP: 002b:00007fff3bf6c2d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 78.739058] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fa23454940e
[ 78.739646] RDX: 0000000000020000 RSI: 00007fa23443d000 RDI: 0000000000000003
[ 78.740235] RBP: 00007fa23443d000 R08: 00007fa23443c010 R09: 0000000000000000
[ 78.740832] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 78.741418] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 78.742007] </TASK>
[ 78.742259]
[ 78.742468] Allocated by task 4436:
[ 78.742807] kasan_save_stack+0x20/0x40
[ 78.743171] kasan_save_track+0x14/0x30
[ 78.743537] __kasan_kmalloc+0x8f/0xa0
[ 78.743899] user_event_parse_cmd+0x55e/0x25a0
[ 78.744303] user_events_ioctl+0xa52/0x17f0
[ 78.744689] __x64_sys_ioctl+0x133/0x190
[ 78.745066] do_syscall_64+0x66/0x130
[ 78.745421] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.749712]
[ 78.749922] Freed by task 50:
[ 78.750225] kasan_save_stack+0x20/0x40
[ 78.750591] kasan_save_track+0x14/0x30
[ 78.750958] kasan_save_free_info+0x3b/0x60
[ 78.751342] poison_slab_object+0x10a/0x170
[ 78.751729] __kasan_slab_free+0x14/0x30
[ 78.752100] kfree+0xe0/0x2f0
[ 78.752406] destroy_user_event+0x305/0x450
[ 78.752797] delayed_destroy_user_event+0x5c/0xe0
[ 78.753223] process_one_work+0x81c/0x1970
[ 78.753606] worker_thread+0x608/0x1160
[ 78.753969] kthread+0x2be/0x3b0
[ 78.754292] ret_from_fork+0x2c/0x70
[ 78.754642] ret_from_fork_asm+0x1a/0x30
[ 78.755011]
[ 78.755216] Last potentially related work creation:
[ 78.755652] kasan_save_stack+0x20/0x40
[ 78.756019] __kasan_record_aux_stack+0x8e/0xa0
[ 78.756431] insert_work+0x20/0x1b0
[ 78.756779] __queue_work+0x67a/0xc60
[ 78.757135] queue_work_on+0x63/0x90
[ 78.757481] user_event_put+0x1f9/0x390
[ 78.757843] user_events_ioctl+0x11ed/0x17f0
[ 78.758240] __x64_sys_ioctl+0x133/0x190
[ 78.758612] do_syscall_64+0x66/0x130
[ 78.759108] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.759558]
[ 78.759767] The buggy address belongs to the object at ffff88800473ec00
[ 78.759767] which belongs to the cache kmalloc-cg-512 of size 512
[ 78.760758] The buggy address is located 344 bytes inside of
[ 78.760758] freed 512-byte region [ffff88800473ec00, ffff88800473ee00)
[ 78.761711]
[ 78.761919] The buggy address belongs to the physical page:
[ 78.762397] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800473d800 pfn:0x473c
[ 78.763147] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 78.763796] memcg:ffff88800102a301
[ 78.764129] flags: 0x40(head|zone=0)
[ 78.764478] page_type: 0xffffefff(slab)
[ 78.764846] raw: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 78.765499] raw: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 78.766158] head: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 78.766815] head: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 78.767479] head: 0000000000000002 ffffea000011cf01 ffffffffffffffff 0000000000000000
[ 78.768133] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 78.768798] page dumped because: kasan: bad access detected
[ 78.769279]
[ 78.769487] Memory state around the buggy address:
[ 78.769914] ffff88800473ec00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.770531] ffff88800473ec80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.771149] >ffff88800473ed00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.771767] ^
[ 78.772281] ffff88800473ed80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.772901] ffff88800473ee00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 78.773521] ==================================================================
[ 78.774151] ==================================================================
[ 78.774781] BUG: KASAN: slab-use-after-free in f_start+0x2e4/0x3d0
[ 78.775310] Read of size 8 at addr ffff88800473ec70 by task cat/4434
[ 78.775845]
[ 78.776054] CPU: 2 PID: 4434 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 78.776721] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 78.777637] Call Trace:
[ 78.777907] <TASK>
[ 78.778153] dump_stack_lvl+0x66/0xa0
[ 78.778510] print_report+0xd0/0x630
[ 78.778860] ? f_start+0x2e4/0x3d0
[ 78.779196] ? __virt_addr_valid+0x208/0x3f0
[ 78.779594] ? f_start+0x2e4/0x3d0
[ 78.779931] kasan_report+0xd8/0x110
[ 78.780279] ? f_start+0x2e4/0x3d0
[ 78.780618] f_start+0x2e4/0x3d0
[ 78.780950] seq_read_iter+0x268/0x11e0
[ 78.781316] ? lock_release+0x453/0x600
[ 78.781684] seq_read+0x261/0x350
[ 78.782017] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 78.782434] ? __pfx_seq_read+0x10/0x10
[ 78.782798] ? trace_irq_enable.constprop.0+0xce/0x110
[ 78.783255] vfs_read+0x171/0x9e0
[ 78.783588] ? lock_acquire+0x408/0x4b0
[ 78.783953] ? __pfx_vfs_read+0x10/0x10
[ 78.784317] ? lock_release+0x453/0x600
[ 78.784684] ? __pfx___up_read+0x10/0x10
[ 78.785057] ksys_read+0xdd/0x1a0
[ 78.785387] ? __pfx_ksys_read+0x10/0x10
[ 78.785761] ? trace_irq_enable.constprop.0+0xce/0x110
[ 78.786218] do_syscall_64+0x66/0x130
[ 78.786571] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.787019] RIP: 0033:0x7fa23454940e
[ 78.787368] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 78.788939] RSP: 002b:00007fff3bf6c2d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 78.789580] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fa23454940e
[ 78.790169] RDX: 0000000000020000 RSI: 00007fa23443d000 RDI: 0000000000000003
[ 78.790757] RBP: 00007fa23443d000 R08: 00007fa23443c010 R09: 0000000000000000
[ 78.791347] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 78.791934] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 78.792521] </TASK>
[ 78.792778]
[ 78.792987] Allocated by task 4436:
[ 78.793331] kasan_save_stack+0x20/0x40
[ 78.793694] kasan_save_track+0x14/0x30
[ 78.794060] __kasan_kmalloc+0x8f/0xa0
[ 78.794420] user_event_parse_cmd+0x55e/0x25a0
[ 78.794824] user_events_ioctl+0xa52/0x17f0
[ 78.795210] __x64_sys_ioctl+0x133/0x190
[ 78.795583] do_syscall_64+0x66/0x130
[ 78.795939] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.796384]
[ 78.796590] Freed by task 50:
[ 78.796902] kasan_save_stack+0x20/0x40
[ 78.797266] kasan_save_track+0x14/0x30
[ 78.797631] kasan_save_free_info+0x3b/0x60
[ 78.798020] poison_slab_object+0x10a/0x170
[ 78.798405] __kasan_slab_free+0x14/0x30
[ 78.798774] kfree+0xe0/0x2f0
[ 78.799084] destroy_user_event+0x305/0x450
[ 78.799473] delayed_destroy_user_event+0x5c/0xe0
[ 78.799896] process_one_work+0x81c/0x1970
[ 78.800277] worker_thread+0x608/0x1160
[ 78.800643] kthread+0x2be/0x3b0
[ 78.800976] ret_from_fork+0x2c/0x70
[ 78.801322] ret_from_fork_asm+0x1a/0x30
[ 78.801693]
[ 78.801903] Last potentially related work creation:
[ 78.802335] kasan_save_stack+0x20/0x40
[ 78.802704] __kasan_record_aux_stack+0x8e/0xa0
[ 78.803118] insert_work+0x20/0x1b0
[ 78.803460] __queue_work+0x67a/0xc60
[ 78.803812] queue_work_on+0x63/0x90
[ 78.804161] user_event_put+0x1f9/0x390
[ 78.804527] user_events_ioctl+0x11ed/0x17f0
[ 78.804926] __x64_sys_ioctl+0x133/0x190
[ 78.805298] do_syscall_64+0x66/0x130
[ 78.805653] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.806100]
[ 78.806307] The buggy address belongs to the object at ffff88800473ec00
[ 78.806307] which belongs to the cache kmalloc-cg-512 of size 512
[ 78.807300] The buggy address is located 112 bytes inside of
[ 78.807300] freed 512-byte region [ffff88800473ec00, ffff88800473ee00)
[ 78.808253]
[ 78.808459] The buggy address belongs to the physical page:
[ 78.808947] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800473d800 pfn:0x473c
[ 78.809699] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 78.810344] memcg:ffff88800102a301
[ 78.810681] flags: 0x40(head|zone=0)
[ 78.811027] page_type: 0xffffefff(slab)
[ 78.811390] raw: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 78.812046] raw: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 78.812700] head: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 78.813368] head: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 78.814026] head: 0000000000000002 ffffea000011cf01 ffffffffffffffff 0000000000000000
[ 78.814685] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 78.815350] page dumped because: kasan: bad access detected
[ 78.819845]
[ 78.820054] Memory state around the buggy address:
[ 78.820482] ffff88800473eb00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 78.821104] ffff88800473eb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 78.821724] >ffff88800473ec00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.822339] ^
[ 78.822905] ffff88800473ec80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.823522] ffff88800473ed00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.824141] ==================================================================
[ 78.824784] ==================================================================
[ 78.825410] BUG: KASAN: slab-use-after-free in f_start+0x2cb/0x3d0
[ 78.825934] Read of size 8 at addr ffff88800473ed08 by task cat/4434
[ 78.826470]
[ 78.826680] CPU: 2 PID: 4434 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 78.827349] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 78.828261] Call Trace:
[ 78.828529] <TASK>
[ 78.828783] dump_stack_lvl+0x66/0xa0
[ 78.829139] print_report+0xd0/0x630
[ 78.829487] ? f_start+0x2cb/0x3d0
[ 78.829822] ? __virt_addr_valid+0x208/0x3f0
[ 78.830218] ? f_start+0x2cb/0x3d0
[ 78.830558] kasan_report+0xd8/0x110
[ 78.830904] ? f_start+0x2cb/0x3d0
[ 78.831244] f_start+0x2cb/0x3d0
[ 78.831573] seq_read_iter+0x268/0x11e0
[ 78.831940] ? lock_release+0x453/0x600
[ 78.832307] seq_read+0x261/0x350
[ 78.832640] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 78.833070] ? __pfx_seq_read+0x10/0x10
[ 78.833435] ? trace_irq_enable.constprop.0+0xce/0x110
[ 78.833891] vfs_read+0x171/0x9e0
[ 78.834224] ? lock_acquire+0x408/0x4b0
[ 78.834587] ? __pfx_vfs_read+0x10/0x10
[ 78.834952] ? lock_release+0x453/0x600
[ 78.835318] ? __pfx___up_read+0x10/0x10
[ 78.835688] ksys_read+0xdd/0x1a0
[ 78.836019] ? __pfx_ksys_read+0x10/0x10
[ 78.836391] ? trace_irq_enable.constprop.0+0xce/0x110
[ 78.836852] do_syscall_64+0x66/0x130
[ 78.837206] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.837651] RIP: 0033:0x7fa23454940e
[ 78.838000] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 78.839424] RSP: 002b:00007fff3bf6c2d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 78.840064] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fa23454940e
[ 78.840653] RDX: 0000000000020000 RSI: 00007fa23443d000 RDI: 0000000000000003
[ 78.841247] RBP: 00007fa23443d000 R08: 00007fa23443c010 R09: 0000000000000000
[ 78.841834] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 78.842423] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 78.843011] </TASK>
[ 78.843262]
[ 78.843468] Allocated by task 4436:
[ 78.843811] kasan_save_stack+0x20/0x40
[ 78.844175] kasan_save_track+0x14/0x30
[ 78.844542] __kasan_kmalloc+0x8f/0xa0
[ 78.844906] user_event_parse_cmd+0x55e/0x25a0
[ 78.845313] user_events_ioctl+0xa52/0x17f0
[ 78.845698] __x64_sys_ioctl+0x133/0x190
[ 78.846070] do_syscall_64+0x66/0x130
[ 78.846427] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.846875]
[ 78.847080] Freed by task 50:
[ 78.847389] kasan_save_stack+0x20/0x40
[ 78.847753] kasan_save_track+0x14/0x30
[ 78.848118] kasan_save_free_info+0x3b/0x60
[ 78.848507] poison_slab_object+0x10a/0x170
[ 78.849068] __kasan_slab_free+0x14/0x30
[ 78.849438] kfree+0xe0/0x2f0
[ 78.849750] destroy_user_event+0x305/0x450
[ 78.850139] delayed_destroy_user_event+0x5c/0xe0
[ 78.850562] process_one_work+0x81c/0x1970
[ 78.850940] worker_thread+0x608/0x1160
[ 78.851306] kthread+0x2be/0x3b0
[ 78.851633] ret_from_fork+0x2c/0x70
[ 78.851982] ret_from_fork_asm+0x1a/0x30
[ 78.852353]
[ 78.852562] Last potentially related work creation:
[ 78.853000] kasan_save_stack+0x20/0x40
[ 78.853368] __kasan_record_aux_stack+0x8e/0xa0
[ 78.853782] insert_work+0x20/0x1b0
[ 78.854123] __queue_work+0x67a/0xc60
[ 78.854476] queue_work_on+0x63/0x90
[ 78.854826] user_event_put+0x1f9/0x390
[ 78.855190] user_events_ioctl+0x11ed/0x17f0
[ 78.855584] __x64_sys_ioctl+0x133/0x190
[ 78.855951] do_syscall_64+0x66/0x130
[ 78.856304] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.856754]
[ 78.856961] The buggy address belongs to the object at ffff88800473ec00
[ 78.856961] which belongs to the cache kmalloc-cg-512 of size 512
[ 78.857953] The buggy address is located 264 bytes inside of
[ 78.857953] freed 512-byte region [ffff88800473ec00, ffff88800473ee00)
[ 78.858907]
[ 78.859114] The buggy address belongs to the physical page:
[ 78.859597] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800473d800 pfn:0x473c
[ 78.860349] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 78.861001] memcg:ffff88800102a301
[ 78.861339] flags: 0x40(head|zone=0)
[ 78.861683] page_type: 0xffffefff(slab)
[ 78.862047] raw: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 78.862704] raw: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 78.863357] head: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 78.864019] head: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 78.864675] head: 0000000000000002 ffffea000011cf01 ffffffffffffffff 0000000000000000
[ 78.865349] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 78.866008] page dumped because: kasan: bad access detected
[ 78.866486]
[ 78.866692] Memory state around the buggy address:
[ 78.867122] ffff88800473ec00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.867742] ffff88800473ec80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.868359] >ffff88800473ed00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.868980] ^
[ 78.869322] ffff88800473ed80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.869941] ffff88800473ee00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 78.870559] ==================================================================
[ 78.871188] ==================================================================
[ 78.871810] BUG: KASAN: slab-use-after-free in user_event_get_fields+0x38/0x40
[ 78.872429] Read of size 8 at addr ffff88800473ecb8 by task cat/4434
[ 78.872973]
[ 78.873183] CPU: 2 PID: 4434 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 78.873853] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 78.874760] Call Trace:
[ 78.875029] <TASK>
[ 78.875278] dump_stack_lvl+0x66/0xa0
[ 78.875629] print_report+0xd0/0x630
[ 78.875978] ? user_event_get_fields+0x38/0x40
[ 78.876385] ? __virt_addr_valid+0x208/0x3f0
[ 78.876788] ? user_event_get_fields+0x38/0x40
[ 78.877194] kasan_report+0xd8/0x110
[ 78.877540] ? user_event_get_fields+0x38/0x40
[ 78.877948] user_event_get_fields+0x38/0x40
[ 78.878345] f_start+0x175/0x3d0
[ 78.878672] seq_read_iter+0x268/0x11e0
[ 78.879256] ? lock_release+0x453/0x600
[ 78.879632] seq_read+0x261/0x350
[ 78.879963] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 78.880381] ? __pfx_seq_read+0x10/0x10
[ 78.880760] ? trace_irq_enable.constprop.0+0xce/0x110
[ 78.881218] vfs_read+0x171/0x9e0
[ 78.881549] ? lock_acquire+0x408/0x4b0
[ 78.881913] ? __pfx_vfs_read+0x10/0x10
[ 78.882281] ? lock_release+0x453/0x600
[ 78.882647] ? __pfx___up_read+0x10/0x10
[ 78.883017] ksys_read+0xdd/0x1a0
[ 78.883351] ? __pfx_ksys_read+0x10/0x10
[ 78.883725] ? trace_irq_enable.constprop.0+0xce/0x110
[ 78.884178] do_syscall_64+0x66/0x130
[ 78.884532] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.884988] RIP: 0033:0x7fa23454940e
[ 78.885338] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 78.890605] RSP: 002b:00007fff3bf6c2d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 78.891252] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fa23454940e
[ 78.891838] RDX: 0000000000020000 RSI: 00007fa23443d000 RDI: 0000000000000003
[ 78.892426] RBP: 00007fa23443d000 R08: 00007fa23443c010 R09: 0000000000000000
[ 78.893021] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 78.893609] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 78.894199] </TASK>
[ 78.894455]
[ 78.894662] Allocated by task 4436:
[ 78.895006] kasan_save_stack+0x20/0x40
[ 78.895375] kasan_save_track+0x14/0x30
[ 78.895739] __kasan_kmalloc+0x8f/0xa0
[ 78.896100] user_event_parse_cmd+0x55e/0x25a0
[ 78.896510] user_events_ioctl+0xa52/0x17f0
[ 78.896901] __x64_sys_ioctl+0x133/0x190
[ 78.897271] do_syscall_64+0x66/0x130
[ 78.897626] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.898076]
[ 78.898282] Freed by task 50:
[ 78.898589] kasan_save_stack+0x20/0x40
[ 78.898955] kasan_save_track+0x14/0x30
[ 78.899320] kasan_save_free_info+0x3b/0x60
[ 78.899706] poison_slab_object+0x10a/0x170
[ 78.900095] __kasan_slab_free+0x14/0x30
[ 78.900468] kfree+0xe0/0x2f0
[ 78.900779] destroy_user_event+0x305/0x450
[ 78.901169] delayed_destroy_user_event+0x5c/0xe0
[ 78.901594] process_one_work+0x81c/0x1970
[ 78.901973] worker_thread+0x608/0x1160
[ 78.902336] kthread+0x2be/0x3b0
[ 78.902662] ret_from_fork+0x2c/0x70
[ 78.903011] ret_from_fork_asm+0x1a/0x30
[ 78.903379]
[ 78.903588] Last potentially related work creation:
[ 78.904020] kasan_save_stack+0x20/0x40
[ 78.904382] __kasan_record_aux_stack+0x8e/0xa0
[ 78.904801] insert_work+0x20/0x1b0
[ 78.905146] __queue_work+0x67a/0xc60
[ 78.905498] queue_work_on+0x63/0x90
[ 78.905844] user_event_put+0x1f9/0x390
[ 78.906210] user_events_ioctl+0x11ed/0x17f0
[ 78.906607] __x64_sys_ioctl+0x133/0x190
[ 78.906975] do_syscall_64+0x66/0x130
[ 78.907329] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.907777]
[ 78.907987] The buggy address belongs to the object at ffff88800473ec00
[ 78.907987] which belongs to the cache kmalloc-cg-512 of size 512
[ 78.909232] The buggy address is located 184 bytes inside of
[ 78.909232] freed 512-byte region [ffff88800473ec00, ffff88800473ee00)
[ 78.910205]
[ 78.910415] The buggy address belongs to the physical page:
[ 78.910897] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88800473d800 pfn:0x473c
[ 78.911649] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 78.912297] memcg:ffff88800102a301
[ 78.912634] flags: 0x40(head|zone=0)
[ 78.912995] page_type: 0xffffefff(slab)
[ 78.913359] raw: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 78.914009] raw: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 78.914662] head: 0000000000000040 ffff88800014cdc0 ffffea00000e9300 dead000000000002
[ 78.915326] head: ffff88800473d800 000000008010000f 00000001ffffefff ffff88800102a301
[ 78.915984] head: 0000000000000002 ffffea000011cf01 ffffffffffffffff 0000000000000000
[ 78.916647] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 78.917311] page dumped because: kasan: bad access detected
[ 78.917792]
[ 78.918001] Memory state around the buggy address:
[ 78.918430] ffff88800473eb80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 78.919052] ffff88800473ec00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.919668] >ffff88800473ec80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.920289] ^
[ 78.920734] ffff88800473ed00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.921358] ffff88800473ed80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.921973] ==================================================================
[ 78.924611] ==================================================================
[ 78.925274] BUG: KASAN: slab-use-after-free in f_start+0x36e/0x3d0
[ 78.925814] Read of size 8 at addr ffff888001bd4ca8 by task cat/4437
[ 78.926358]
[ 78.926570] CPU: 0 PID: 4437 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 78.927255] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 78.928173] Call Trace:
[ 78.928447] <TASK>
[ 78.928703] dump_stack_lvl+0x66/0xa0
[ 78.929065] print_report+0xd0/0x630
[ 78.929417] ? f_start+0x36e/0x3d0
[ 78.929761] ? __virt_addr_valid+0x208/0x3f0
[ 78.930164] ? f_start+0x36e/0x3d0
[ 78.930508] kasan_report+0xd8/0x110
[ 78.930864] ? f_start+0x36e/0x3d0
[ 78.931210] f_start+0x36e/0x3d0
[ 78.931544] seq_read_iter+0x268/0x11e0
[ 78.931921] ? lock_release+0x453/0x600
[ 78.932295] seq_read+0x261/0x350
[ 78.932632] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 78.933066] ? __pfx_seq_read+0x10/0x10
[ 78.933439] ? trace_irq_enable.constprop.0+0xce/0x110
[ 78.933899] vfs_read+0x171/0x9e0
[ 78.934234] ? lock_acquire+0x408/0x4b0
[ 78.934606] ? __pfx_vfs_read+0x10/0x10
[ 78.934979] ? lock_release+0x453/0x600
[ 78.935330] ? __pfx___up_read+0x10/0x10
[ 78.935685] ksys_read+0xdd/0x1a0
[ 78.936011] ? __pfx_ksys_read+0x10/0x10
[ 78.936369] ? trace_irq_enable.constprop.0+0xce/0x110
[ 78.936815] do_syscall_64+0x66/0x130
[ 78.937173] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.937630] RIP: 0033:0x7fac6e8fb40e
[ 78.937985] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 78.939553] RSP: 002b:00007ffe7b02f3a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 78.940180] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fac6e8fb40e
[ 78.940750] RDX: 0000000000020000 RSI: 00007fac6e7ef000 RDI: 0000000000000003
[ 78.941337] RBP: 00007fac6e7ef000 R08: 00007fac6e7ee010 R09: 0000000000000000
[ 78.941901] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 78.942465] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 78.943048] </TASK>
[ 78.943289]
[ 78.943661] Allocated by task 4436:
[ 78.944029] kasan_save_stack+0x20/0x40
[ 78.944494] kasan_save_track+0x14/0x30
[ 78.944884] __kasan_kmalloc+0x8f/0xa0
[ 78.945623] user_event_parse_cmd+0x55e/0x25a0
[ 78.946323] user_events_ioctl+0xa52/0x17f0
[ 78.946707] __x64_sys_ioctl+0x133/0x190
[ 78.947076] do_syscall_64+0x66/0x130
[ 78.947422] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.947861]
[ 78.948065] Freed by task 49:
[ 78.948363] kasan_save_stack+0x20/0x40
[ 78.949498] kasan_save_track+0x14/0x30
[ 78.949957] kasan_save_free_info+0x3b/0x60
[ 78.950391] poison_slab_object+0x10a/0x170
[ 78.950877] __kasan_slab_free+0x14/0x30
[ 78.951256] kfree+0xe0/0x2f0
[ 78.951569] destroy_user_event+0x305/0x450
[ 78.951961] delayed_destroy_user_event+0x5c/0xe0
[ 78.952392] process_one_work+0x81c/0x1970
[ 78.952787] worker_thread+0x608/0x1160
[ 78.953153] kthread+0x2be/0x3b0
[ 78.953478] ret_from_fork+0x2c/0x70
[ 78.953830] ret_from_fork_asm+0x1a/0x30
[ 78.954206]
[ 78.954414] Last potentially related work creation:
[ 78.954851] kasan_save_stack+0x20/0x40
[ 78.955221] __kasan_record_aux_stack+0x8e/0xa0
[ 78.955637] insert_work+0x20/0x1b0
[ 78.955980] __queue_work+0x67a/0xc60
[ 78.956340] queue_work_on+0x63/0x90
[ 78.956690] user_event_put+0x1f9/0x390
[ 78.957115] user_events_ioctl+0x11ed/0x17f0
[ 78.957516] __x64_sys_ioctl+0x133/0x190
[ 78.957893] do_syscall_64+0x66/0x130
[ 78.958252] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.958708]
[ 78.958920] The buggy address belongs to the object at ffff888001bd4c00
[ 78.958920] which belongs to the cache kmalloc-cg-512 of size 512
[ 78.959913] The buggy address is located 168 bytes inside of
[ 78.959913] freed 512-byte region [ffff888001bd4c00, ffff888001bd4e00)
[ 78.960879]
[ 78.961088] The buggy address belongs to the physical page:
[ 78.965403] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1bd4
[ 78.966070] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 78.966717] memcg:ffff888004b9e101
[ 78.967056] anon flags: 0x40(head|zone=0)
[ 78.967436] page_type: 0xffffefff(slab)
[ 78.967804] raw: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 78.968471] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 78.969286] head: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 78.969918] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 78.970544] head: 0000000000000002 ffffea000006f501 ffffffffffffffff 0000000000000000
[ 78.971184] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 78.971813] page dumped because: kasan: bad access detected
[ 78.972273]
[ 78.972472] Memory state around the buggy address:
[ 78.972891] ffff888001bd4b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 78.973484] ffff888001bd4c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.974076] >ffff888001bd4c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.974670] ^
[ 78.975070] ffff888001bd4d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.975662] ffff888001bd4d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 78.976252] ==================================================================
[ 78.976932] ==================================================================
[ 78.977551] BUG: KASAN: slab-use-after-free in f_start+0x2e4/0x3d0
[ 78.978041] Read of size 8 at addr ffff888001bd4c70 by task cat/4437
[ 78.978540]
[ 78.978731] CPU: 2 PID: 4437 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 78.979376] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 78.980217] Call Trace:
[ 78.980470] <TASK>
[ 78.980700] dump_stack_lvl+0x66/0xa0
[ 78.981044] print_report+0xd0/0x630
[ 78.981369] ? f_start+0x2e4/0x3d0
[ 78.981684] ? __virt_addr_valid+0x208/0x3f0
[ 78.982051] ? f_start+0x2e4/0x3d0
[ 78.982361] kasan_report+0xd8/0x110
[ 78.982686] ? f_start+0x2e4/0x3d0
[ 78.983009] f_start+0x2e4/0x3d0
[ 78.983314] seq_read_iter+0x268/0x11e0
[ 78.983657] ? lock_release+0x453/0x600
[ 78.983996] seq_read+0x261/0x350
[ 78.984305] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 78.984697] ? __pfx_seq_read+0x10/0x10
[ 78.985051] ? trace_irq_enable.constprop.0+0xce/0x110
[ 78.985474] vfs_read+0x171/0x9e0
[ 78.985781] ? lock_acquire+0x408/0x4b0
[ 78.986122] ? __pfx_vfs_read+0x10/0x10
[ 78.986465] ? lock_release+0x453/0x600
[ 78.986804] ? __pfx___up_read+0x10/0x10
[ 78.987162] ksys_read+0xdd/0x1a0
[ 78.987471] ? __pfx_ksys_read+0x10/0x10
[ 78.987820] ? trace_irq_enable.constprop.0+0xce/0x110
[ 78.988241] do_syscall_64+0x66/0x130
[ 78.988573] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.989013] RIP: 0033:0x7fac6e8fb40e
[ 78.989336] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 78.990661] RSP: 002b:00007ffe7b02f3a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 78.991274] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fac6e8fb40e
[ 78.991820] RDX: 0000000000020000 RSI: 00007fac6e7ef000 RDI: 0000000000000003
[ 78.992365] RBP: 00007fac6e7ef000 R08: 00007fac6e7ee010 R09: 0000000000000000
[ 78.992926] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 78.993470] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 78.994018] </TASK>
[ 78.994255]
[ 78.994448] Allocated by task 4436:
[ 78.994765] kasan_save_stack+0x20/0x40
[ 78.995117] kasan_save_track+0x14/0x30
[ 78.995455] __kasan_kmalloc+0x8f/0xa0
[ 78.995787] user_event_parse_cmd+0x55e/0x25a0
[ 78.996167] user_events_ioctl+0xa52/0x17f0
[ 78.996529] __x64_sys_ioctl+0x133/0x190
[ 78.996932] do_syscall_64+0x66/0x130
[ 78.997282] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 78.997713]
[ 78.997916] Freed by task 49:
[ 78.998207] kasan_save_stack+0x20/0x40
[ 78.998560] kasan_save_track+0x14/0x30
[ 78.999089] kasan_save_free_info+0x3b/0x60
[ 78.999458] poison_slab_object+0x10a/0x170
[ 78.999835] __kasan_slab_free+0x14/0x30
[ 79.000198] kfree+0xe0/0x2f0
[ 79.000493] destroy_user_event+0x305/0x450
[ 79.000880] delayed_destroy_user_event+0x5c/0xe0
[ 79.001305] process_one_work+0x81c/0x1970
[ 79.001695] worker_thread+0x608/0x1160
[ 79.002070] kthread+0x2be/0x3b0
[ 79.002400] ret_from_fork+0x2c/0x70
[ 79.002760] ret_from_fork_asm+0x1a/0x30
[ 79.003135]
[ 79.003344] Last potentially related work creation:
[ 79.003787] kasan_save_stack+0x20/0x40
[ 79.004157] __kasan_record_aux_stack+0x8e/0xa0
[ 79.004576] insert_work+0x20/0x1b0
[ 79.004934] __queue_work+0x67a/0xc60
[ 79.005295] queue_work_on+0x63/0x90
[ 79.005646] user_event_put+0x1f9/0x390
[ 79.006021] user_events_ioctl+0x11ed/0x17f0
[ 79.006425] __x64_sys_ioctl+0x133/0x190
[ 79.006805] do_syscall_64+0x66/0x130
[ 79.007164] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.007621]
[ 79.007833] The buggy address belongs to the object at ffff888001bd4c00
[ 79.007833] which belongs to the cache kmalloc-cg-512 of size 512
[ 79.008837] The buggy address is located 112 bytes inside of
[ 79.008837] freed 512-byte region [ffff888001bd4c00, ffff888001bd4e00)
[ 79.009802]
[ 79.010015] The buggy address belongs to the physical page:
[ 79.010507] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1bd4
[ 79.011176] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 79.011836] memcg:ffff888004b9e101
[ 79.012175] anon flags: 0x40(head|zone=0)
[ 79.012559] page_type: 0xffffefff(slab)
[ 79.012937] raw: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 79.013598] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 79.014265] head: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 79.014936] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 79.015609] head: 0000000000000002 ffffea000006f501 ffffffffffffffff 0000000000000000
[ 79.016277] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 79.016946] page dumped because: kasan: bad access detected
[ 79.017437]
[ 79.017653] Memory state around the buggy address:
[ 79.018087] ffff888001bd4b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 79.018714] ffff888001bd4b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 79.019350] >ffff888001bd4c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.019978] ^
[ 79.020552] ffff888001bd4c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.021224] ffff888001bd4d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.021853] ==================================================================
[ 79.022497] ==================================================================
[ 79.023127] BUG: KASAN: slab-use-after-free in f_start+0x2cb/0x3d0
[ 79.023650] Read of size 8 at addr ffff888001bd4d08 by task cat/4437
[ 79.024192]
[ 79.024403] CPU: 2 PID: 4437 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 79.025085] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 79.026008] Call Trace:
[ 79.026281] <TASK>
[ 79.026529] dump_stack_lvl+0x66/0xa0
[ 79.026893] print_report+0xd0/0x630
[ 79.027246] ? f_start+0x2cb/0x3d0
[ 79.027587] ? __virt_addr_valid+0x208/0x3f0
[ 79.027989] ? f_start+0x2cb/0x3d0
[ 79.028334] kasan_report+0xd8/0x110
[ 79.028690] ? f_start+0x2cb/0x3d0
[ 79.029219] f_start+0x2cb/0x3d0
[ 79.033405] seq_read_iter+0x268/0x11e0
[ 79.033780] ? lock_release+0x453/0x600
[ 79.034149] seq_read+0x261/0x350
[ 79.034483] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 79.034907] ? __pfx_seq_read+0x10/0x10
[ 79.035282] ? trace_irq_enable.constprop.0+0xce/0x110
[ 79.035745] vfs_read+0x171/0x9e0
[ 79.036082] ? lock_acquire+0x408/0x4b0
[ 79.036452] ? __pfx_vfs_read+0x10/0x10
[ 79.036833] ? lock_release+0x453/0x600
[ 79.037207] ? __pfx___up_read+0x10/0x10
[ 79.037586] ksys_read+0xdd/0x1a0
[ 79.037922] ? __pfx_ksys_read+0x10/0x10
[ 79.038282] ? trace_irq_enable.constprop.0+0xce/0x110
[ 79.038718] do_syscall_64+0x66/0x130
[ 79.039074] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.039510] RIP: 0033:0x7fac6e8fb40e
[ 79.039844] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 79.041215] RSP: 002b:00007ffe7b02f3a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 79.041835] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fac6e8fb40e
[ 79.042394] RDX: 0000000000020000 RSI: 00007fac6e7ef000 RDI: 0000000000000003
[ 79.042964] RBP: 00007fac6e7ef000 R08: 00007fac6e7ee010 R09: 0000000000000000
[ 79.043536] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 79.044108] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 79.044675] </TASK>
[ 79.044935]
[ 79.045139] Allocated by task 4436:
[ 79.045465] kasan_save_stack+0x20/0x40
[ 79.045817] kasan_save_track+0x14/0x30
[ 79.046168] __kasan_kmalloc+0x8f/0xa0
[ 79.046515] user_event_parse_cmd+0x55e/0x25a0
[ 79.046915] user_events_ioctl+0xa52/0x17f0
[ 79.047299] __x64_sys_ioctl+0x133/0x190
[ 79.047656] do_syscall_64+0x66/0x130
[ 79.047997] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.048429]
[ 79.048634] Freed by task 49:
[ 79.048942] kasan_save_stack+0x20/0x40
[ 79.049294] kasan_save_track+0x14/0x30
[ 79.049648] kasan_save_free_info+0x3b/0x60
[ 79.050021] poison_slab_object+0x10a/0x170
[ 79.050395] __kasan_slab_free+0x14/0x30
[ 79.050745] kfree+0xe0/0x2f0
[ 79.051016] destroy_user_event+0x305/0x450
[ 79.051337] delayed_destroy_user_event+0x5c/0xe0
[ 79.051689] process_one_work+0x81c/0x1970
[ 79.052011] worker_thread+0x608/0x1160
[ 79.052314] kthread+0x2be/0x3b0
[ 79.052585] ret_from_fork+0x2c/0x70
[ 79.052910] ret_from_fork_asm+0x1a/0x30
[ 79.053219]
[ 79.053389] Last potentially related work creation:
[ 79.053750] kasan_save_stack+0x20/0x40
[ 79.054054] __kasan_record_aux_stack+0x8e/0xa0
[ 79.054400] insert_work+0x20/0x1b0
[ 79.054685] __queue_work+0x67a/0xc60
[ 79.055003] queue_work_on+0x63/0x90
[ 79.055308] user_event_put+0x1f9/0x390
[ 79.055610] user_events_ioctl+0x11ed/0x17f0
[ 79.055938] __x64_sys_ioctl+0x133/0x190
[ 79.056249] do_syscall_64+0x66/0x130
[ 79.056541] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.056957]
[ 79.057163] The buggy address belongs to the object at ffff888001bd4c00
[ 79.057163] which belongs to the cache kmalloc-cg-512 of size 512
[ 79.058148] The buggy address is located 264 bytes inside of
[ 79.058148] freed 512-byte region [ffff888001bd4c00, ffff888001bd4e00)
[ 79.059344]
[ 79.059566] The buggy address belongs to the physical page:
[ 79.060055] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1bd4
[ 79.060724] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 79.061363] memcg:ffff888004b9e101
[ 79.061686] anon flags: 0x40(head|zone=0)
[ 79.062056] page_type: 0xffffefff(slab)
[ 79.062411] raw: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 79.063048] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 79.063686] head: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 79.064321] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 79.064985] head: 0000000000000002 ffffea000006f501 ffffffffffffffff 0000000000000000
[ 79.065652] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 79.066319] page dumped because: kasan: bad access detected
[ 79.066813]
[ 79.067023] Memory state around the buggy address:
[ 79.067436] ffff888001bd4c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.068032] ffff888001bd4c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.068631] >ffff888001bd4d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.069242] ^
[ 79.069570] ffff888001bd4d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.070165] ffff888001bd4e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 79.070758] ==================================================================
[ 79.071576] ==================================================================
[ 79.072197] BUG: KASAN: slab-use-after-free in user_event_get_fields+0x38/0x40
[ 79.072832] Read of size 8 at addr ffff888001bd4cb8 by task cat/4437
[ 79.073378]
[ 79.073585] CPU: 2 PID: 4437 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 79.074238] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 79.075128] Call Trace:
[ 79.075397] <TASK>
[ 79.075637] dump_stack_lvl+0x66/0xa0
[ 79.075986] print_report+0xd0/0x630
[ 79.076325] ? user_event_get_fields+0x38/0x40
[ 79.076717] ? __virt_addr_valid+0x208/0x3f0
[ 79.077113] ? user_event_get_fields+0x38/0x40
[ 79.077508] kasan_report+0xd8/0x110
[ 79.077849] ? user_event_get_fields+0x38/0x40
[ 79.078245] user_event_get_fields+0x38/0x40
[ 79.078632] f_start+0x175/0x3d0
[ 79.078955] seq_read_iter+0x268/0x11e0
[ 79.079315] ? lock_release+0x453/0x600
[ 79.079669] seq_read+0x261/0x350
[ 79.079990] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 79.080400] ? __pfx_seq_read+0x10/0x10
[ 79.080754] ? trace_irq_enable.constprop.0+0xce/0x110
[ 79.081204] vfs_read+0x171/0x9e0
[ 79.081527] ? lock_acquire+0x408/0x4b0
[ 79.081883] ? __pfx_vfs_read+0x10/0x10
[ 79.082237] ? lock_release+0x453/0x600
[ 79.082595] ? __pfx___up_read+0x10/0x10
[ 79.082967] ksys_read+0xdd/0x1a0
[ 79.083290] ? __pfx_ksys_read+0x10/0x10
[ 79.083648] ? trace_irq_enable.constprop.0+0xce/0x110
[ 79.084093] do_syscall_64+0x66/0x130
[ 79.084439] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.084898] RIP: 0033:0x7fac6e8fb40e
[ 79.085233] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 79.086619] RSP: 002b:00007ffe7b02f3a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 79.087248] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fac6e8fb40e
[ 79.087825] RDX: 0000000000020000 RSI: 00007fac6e7ef000 RDI: 0000000000000003
[ 79.088399] RBP: 00007fac6e7ef000 R08: 00007fac6e7ee010 R09: 0000000000000000
[ 79.089197] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 79.089782] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 79.090358] </TASK>
[ 79.090604]
[ 79.090806] Allocated by task 4436:
[ 79.091147] kasan_save_stack+0x20/0x40
[ 79.091499] kasan_save_track+0x14/0x30
[ 79.091854] __kasan_kmalloc+0x8f/0xa0
[ 79.092204] user_event_parse_cmd+0x55e/0x25a0
[ 79.092603] user_events_ioctl+0xa52/0x17f0
[ 79.092996] __x64_sys_ioctl+0x133/0x190
[ 79.093353] do_syscall_64+0x66/0x130
[ 79.093698] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.094133]
[ 79.094333] Freed by task 49:
[ 79.094636] kasan_save_stack+0x20/0x40
[ 79.095008] kasan_save_track+0x14/0x30
[ 79.095360] kasan_save_free_info+0x3b/0x60
[ 79.095734] poison_slab_object+0x10a/0x170
[ 79.096108] __kasan_slab_free+0x14/0x30
[ 79.096464] kfree+0xe0/0x2f0
[ 79.096768] destroy_user_event+0x305/0x450
[ 79.097151] delayed_destroy_user_event+0x5c/0xe0
[ 79.097560] process_one_work+0x81c/0x1970
[ 79.097929] worker_thread+0x608/0x1160
[ 79.098282] kthread+0x2be/0x3b0
[ 79.098595] ret_from_fork+0x2c/0x70
[ 79.102584] ret_from_fork_asm+0x1a/0x30
[ 79.102946]
[ 79.103149] Last potentially related work creation:
[ 79.103569] kasan_save_stack+0x20/0x40
[ 79.103922] __kasan_record_aux_stack+0x8e/0xa0
[ 79.104320] insert_work+0x20/0x1b0
[ 79.104651] __queue_work+0x67a/0xc60
[ 79.105009] queue_work_on+0x63/0x90
[ 79.105345] user_event_put+0x1f9/0x390
[ 79.105695] user_events_ioctl+0x11ed/0x17f0
[ 79.106074] __x64_sys_ioctl+0x133/0x190
[ 79.106435] do_syscall_64+0x66/0x130
[ 79.106781] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.107227]
[ 79.107428] The buggy address belongs to the object at ffff888001bd4c00
[ 79.107428] which belongs to the cache kmalloc-cg-512 of size 512
[ 79.108386] The buggy address is located 184 bytes inside of
[ 79.108386] freed 512-byte region [ffff888001bd4c00, ffff888001bd4e00)
[ 79.109321]
[ 79.109520] The buggy address belongs to the physical page:
[ 79.109986] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1bd4
[ 79.110622] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 79.111260] memcg:ffff888004b9e101
[ 79.111587] anon flags: 0x40(head|zone=0)
[ 79.111949] page_type: 0xffffefff(slab)
[ 79.112304] raw: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 79.112957] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 79.113612] head: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 79.114281] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 79.114951] head: 0000000000000002 ffffea000006f501 ffffffffffffffff 0000000000000000
[ 79.115619] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 79.116293] page dumped because: kasan: bad access detected
[ 79.116787]
[ 79.116996] Memory state around the buggy address:
[ 79.117436] ffff888001bd4b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 79.118063] ffff888001bd4c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.118697] >ffff888001bd4c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.119476] ^
[ 79.119935] ffff888001bd4d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.120560] ffff888001bd4d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.121208] ==================================================================
[ 79.121853] ==================================================================
[ 79.122495] BUG: KASAN: slab-use-after-free in f_start+0x2e4/0x3d0
[ 79.123031] Read of size 8 at addr ffff888001bd4c70 by task cat/4437
[ 79.123578]
[ 79.123792] CPU: 2 PID: 4437 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 79.124478] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 79.125415] Call Trace:
[ 79.125692] <TASK>
[ 79.125945] dump_stack_lvl+0x66/0xa0
[ 79.126314] print_report+0xd0/0x630
[ 79.126672] ? f_start+0x2e4/0x3d0
[ 79.127019] ? __virt_addr_valid+0x208/0x3f0
[ 79.127428] ? f_start+0x2e4/0x3d0
[ 79.127774] kasan_report+0xd8/0x110
[ 79.128132] ? f_start+0x2e4/0x3d0
[ 79.128478] f_start+0x2e4/0x3d0
[ 79.128824] seq_read_iter+0x268/0x11e0
[ 79.129196] ? lock_release+0x453/0x600
[ 79.129569] seq_read+0x261/0x350
[ 79.129908] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 79.130336] ? __pfx_seq_read+0x10/0x10
[ 79.130707] ? trace_irq_enable.constprop.0+0xce/0x110
[ 79.131173] vfs_read+0x171/0x9e0
[ 79.131520] ? lock_acquire+0x408/0x4b0
[ 79.131895] ? __pfx_vfs_read+0x10/0x10
[ 79.132265] ? lock_release+0x453/0x600
[ 79.132638] ? __pfx___up_read+0x10/0x10
[ 79.133023] ksys_read+0xdd/0x1a0
[ 79.133359] ? __pfx_ksys_read+0x10/0x10
[ 79.133743] ? trace_irq_enable.constprop.0+0xce/0x110
[ 79.134211] do_syscall_64+0x66/0x130
[ 79.134570] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.135025] RIP: 0033:0x7fac6e8fb40e
[ 79.135380] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 79.136838] RSP: 002b:00007ffe7b02f3a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 79.137493] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fac6e8fb40e
[ 79.138093] RDX: 0000000000020000 RSI: 00007fac6e7ef000 RDI: 0000000000000003
[ 79.138696] RBP: 00007fac6e7ef000 R08: 00007fac6e7ee010 R09: 0000000000000000
[ 79.139300] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 79.139904] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 79.140504] </TASK>
[ 79.140768]
[ 79.140977] Allocated by task 4436:
[ 79.141329] kasan_save_stack+0x20/0x40
[ 79.141701] kasan_save_track+0x14/0x30
[ 79.142077] __kasan_kmalloc+0x8f/0xa0
[ 79.142449] user_event_parse_cmd+0x55e/0x25a0
[ 79.142863] user_events_ioctl+0xa52/0x17f0
[ 79.143257] __x64_sys_ioctl+0x133/0x190
[ 79.143640] do_syscall_64+0x66/0x130
[ 79.144002] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.144458]
[ 79.144667] Freed by task 49:
[ 79.144985] kasan_save_stack+0x20/0x40
[ 79.145355] kasan_save_track+0x14/0x30
[ 79.145726] kasan_save_free_info+0x3b/0x60
[ 79.146123] poison_slab_object+0x10a/0x170
[ 79.146518] __kasan_slab_free+0x14/0x30
[ 79.146895] kfree+0xe0/0x2f0
[ 79.147211] destroy_user_event+0x305/0x450
[ 79.147606] delayed_destroy_user_event+0x5c/0xe0
[ 79.148040] process_one_work+0x81c/0x1970
[ 79.148431] worker_thread+0x608/0x1160
[ 79.148987] kthread+0x2be/0x3b0
[ 79.149334] ret_from_fork+0x2c/0x70
[ 79.149688] ret_from_fork_asm+0x1a/0x30
[ 79.150071]
[ 79.150285] Last potentially related work creation:
[ 79.150728] kasan_save_stack+0x20/0x40
[ 79.151099] __kasan_record_aux_stack+0x8e/0xa0
[ 79.151523] insert_work+0x20/0x1b0
[ 79.151878] __queue_work+0x67a/0xc60
[ 79.152240] queue_work_on+0x63/0x90
[ 79.152594] user_event_put+0x1f9/0x390
[ 79.152981] user_events_ioctl+0x11ed/0x17f0
[ 79.153383] __x64_sys_ioctl+0x133/0x190
[ 79.153764] do_syscall_64+0x66/0x130
[ 79.154129] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.154583]
[ 79.154791] The buggy address belongs to the object at ffff888001bd4c00
[ 79.154791] which belongs to the cache kmalloc-cg-512 of size 512
[ 79.155804] The buggy address is located 112 bytes inside of
[ 79.155804] freed 512-byte region [ffff888001bd4c00, ffff888001bd4e00)
[ 79.156783]
[ 79.156992] The buggy address belongs to the physical page:
[ 79.157481] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1bd4
[ 79.158156] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 79.158811] memcg:ffff888004b9e101
[ 79.159158] anon flags: 0x40(head|zone=0)
[ 79.159542] page_type: 0xffffefff(slab)
[ 79.159904] raw: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 79.160541] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 79.161187] head: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 79.161829] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 79.162467] head: 0000000000000002 ffffea000006f501 ffffffffffffffff 0000000000000000
[ 79.163125] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 79.163760] page dumped because: kasan: bad access detected
[ 79.164226]
[ 79.164424] Memory state around the buggy address:
[ 79.164853] ffff888001bd4b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 79.165455] ffff888001bd4b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 79.166052] >ffff888001bd4c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.166646] ^
[ 79.167210] ffff888001bd4c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.167809] ffff888001bd4d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.168405] ==================================================================
[ 79.172677] ==================================================================
[ 79.173309] BUG: KASAN: slab-use-after-free in f_start+0x2cb/0x3d0
[ 79.173841] Read of size 8 at addr ffff888001bd4d08 by task cat/4437
[ 79.174392]
[ 79.174608] CPU: 2 PID: 4437 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 79.175288] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 79.176214] Call Trace:
[ 79.176494] <TASK>
[ 79.176752] dump_stack_lvl+0x66/0xa0
[ 79.177116] print_report+0xd0/0x630
[ 79.177472] ? f_start+0x2cb/0x3d0
[ 79.177815] ? __virt_addr_valid+0x208/0x3f0
[ 79.178225] ? f_start+0x2cb/0x3d0
[ 79.178571] kasan_report+0xd8/0x110
[ 79.179179] ? f_start+0x2cb/0x3d0
[ 79.179541] f_start+0x2cb/0x3d0
[ 79.179874] seq_read_iter+0x268/0x11e0
[ 79.180247] ? lock_release+0x453/0x600
[ 79.180618] seq_read+0x261/0x350
[ 79.180970] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 79.181395] ? __pfx_seq_read+0x10/0x10
[ 79.181768] ? trace_irq_enable.constprop.0+0xce/0x110
[ 79.182234] vfs_read+0x171/0x9e0
[ 79.182574] ? lock_acquire+0x408/0x4b0
[ 79.182946] ? __pfx_vfs_read+0x10/0x10
[ 79.183323] ? lock_release+0x453/0x600
[ 79.183706] ? __pfx___up_read+0x10/0x10
[ 79.184088] ksys_read+0xdd/0x1a0
[ 79.184424] ? __pfx_ksys_read+0x10/0x10
[ 79.184808] ? trace_irq_enable.constprop.0+0xce/0x110
[ 79.185272] do_syscall_64+0x66/0x130
[ 79.185632] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.186093] RIP: 0033:0x7fac6e8fb40e
[ 79.186448] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 79.187883] RSP: 002b:00007ffe7b02f3a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 79.188533] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fac6e8fb40e
[ 79.189134] RDX: 0000000000020000 RSI: 00007fac6e7ef000 RDI: 0000000000000003
[ 79.189728] RBP: 00007fac6e7ef000 R08: 00007fac6e7ee010 R09: 0000000000000000
[ 79.190324] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 79.190923] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 79.191522] </TASK>
[ 79.191780]
[ 79.191988] Allocated by task 4436:
[ 79.192346] kasan_save_stack+0x20/0x40
[ 79.192717] kasan_save_track+0x14/0x30
[ 79.193087] __kasan_kmalloc+0x8f/0xa0
[ 79.193454] user_event_parse_cmd+0x55e/0x25a0
[ 79.193867] user_events_ioctl+0xa52/0x17f0
[ 79.194258] __x64_sys_ioctl+0x133/0x190
[ 79.194634] do_syscall_64+0x66/0x130
[ 79.194996] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.195450]
[ 79.195658] Freed by task 49:
[ 79.195971] kasan_save_stack+0x20/0x40
[ 79.196343] kasan_save_track+0x14/0x30
[ 79.196723] kasan_save_free_info+0x3b/0x60
[ 79.197123] poison_slab_object+0x10a/0x170
[ 79.197522] __kasan_slab_free+0x14/0x30
[ 79.197895] kfree+0xe0/0x2f0
[ 79.198210] destroy_user_event+0x305/0x450
[ 79.198609] delayed_destroy_user_event+0x5c/0xe0
[ 79.199043] process_one_work+0x81c/0x1970
[ 79.199426] worker_thread+0x608/0x1160
[ 79.199799] kthread+0x2be/0x3b0
[ 79.200125] ret_from_fork+0x2c/0x70
[ 79.200475] ret_from_fork_asm+0x1a/0x30
[ 79.200857]
[ 79.201067] Last potentially related work creation:
[ 79.201503] kasan_save_stack+0x20/0x40
[ 79.201871] __kasan_record_aux_stack+0x8e/0xa0
[ 79.202293] insert_work+0x20/0x1b0
[ 79.202647] __queue_work+0x67a/0xc60
[ 79.203002] queue_work_on+0x63/0x90
[ 79.203359] user_event_put+0x1f9/0x390
[ 79.203730] user_events_ioctl+0x11ed/0x17f0
[ 79.204128] __x64_sys_ioctl+0x133/0x190
[ 79.204501] do_syscall_64+0x66/0x130
[ 79.204868] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.205319]
[ 79.205525] The buggy address belongs to the object at ffff888001bd4c00
[ 79.205525] which belongs to the cache kmalloc-cg-512 of size 512
[ 79.206522] The buggy address is located 264 bytes inside of
[ 79.206522] freed 512-byte region [ffff888001bd4c00, ffff888001bd4e00)
[ 79.207485]
[ 79.207695] The buggy address belongs to the physical page:
[ 79.208183] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1bd4
[ 79.209098] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 79.209763] memcg:ffff888004b9e101
[ 79.210108] anon flags: 0x40(head|zone=0)
[ 79.210488] page_type: 0xffffefff(slab)
[ 79.210857] raw: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 79.211516] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 79.212179] head: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 79.212856] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 79.213521] head: 0000000000000002 ffffea000006f501 ffffffffffffffff 0000000000000000
[ 79.214191] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 79.214860] page dumped because: kasan: bad access detected
[ 79.215347]
[ 79.215554] Memory state around the buggy address:
[ 79.215990] ffff888001bd4c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.216617] ffff888001bd4c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.217257] >ffff888001bd4d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.217880] ^
[ 79.218224] ffff888001bd4d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.218841] ffff888001bd4e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 79.219448] ==================================================================
[ 79.220072] ==================================================================
[ 79.220700] BUG: KASAN: slab-use-after-free in user_event_get_fields+0x38/0x40
[ 79.221305] Read of size 8 at addr ffff888001bd4cb8 by task cat/4437
[ 79.221824]
[ 79.222027] CPU: 2 PID: 4437 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 79.222673] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 79.223556] Call Trace:
[ 79.223812] <TASK>
[ 79.224018] dump_stack_lvl+0x66/0xa0
[ 79.224314] print_report+0xd0/0x630
[ 79.224606] ? user_event_get_fields+0x38/0x40
[ 79.224987] ? __virt_addr_valid+0x208/0x3f0
[ 79.225324] ? user_event_get_fields+0x38/0x40
[ 79.225659] kasan_report+0xd8/0x110
[ 79.225948] ? user_event_get_fields+0x38/0x40
[ 79.226288] user_event_get_fields+0x38/0x40
[ 79.226618] f_start+0x175/0x3d0
[ 79.226894] seq_read_iter+0x268/0x11e0
[ 79.227225] ? lock_release+0x453/0x600
[ 79.227533] seq_read+0x261/0x350
[ 79.227810] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 79.228167] ? __pfx_seq_read+0x10/0x10
[ 79.228472] ? trace_irq_enable.constprop.0+0xce/0x110
[ 79.228880] vfs_read+0x171/0x9e0
[ 79.229164] ? lock_acquire+0x408/0x4b0
[ 79.229467] ? __pfx_vfs_read+0x10/0x10
[ 79.229772] ? lock_release+0x453/0x600
[ 79.230072] ? __pfx___up_read+0x10/0x10
[ 79.230387] ksys_read+0xdd/0x1a0
[ 79.230668] ? __pfx_ksys_read+0x10/0x10
[ 79.230999] ? trace_irq_enable.constprop.0+0xce/0x110
[ 79.231390] do_syscall_64+0x66/0x130
[ 79.231690] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.232066] RIP: 0033:0x7fac6e8fb40e
[ 79.232355] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 79.233595] RSP: 002b:00007ffe7b02f3a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 79.234138] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fac6e8fb40e
[ 79.234630] RDX: 0000000000020000 RSI: 00007fac6e7ef000 RDI: 0000000000000003
[ 79.235165] RBP: 00007fac6e7ef000 R08: 00007fac6e7ee010 R09: 0000000000000000
[ 79.235662] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 79.236154] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 79.236645] </TASK>
[ 79.236892]
[ 79.237073] Allocated by task 4436:
[ 79.237363] kasan_save_stack+0x20/0x40
[ 79.237671] kasan_save_track+0x14/0x30
[ 79.241368] __kasan_kmalloc+0x8f/0xa0
[ 79.241678] user_event_parse_cmd+0x55e/0x25a0
[ 79.242025] user_events_ioctl+0xa52/0x17f0
[ 79.242349] __x64_sys_ioctl+0x133/0x190
[ 79.242664] do_syscall_64+0x66/0x130
[ 79.242984] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.243380]
[ 79.243554] Freed by task 49:
[ 79.243818] kasan_save_stack+0x20/0x40
[ 79.244127] kasan_save_track+0x14/0x30
[ 79.244437] kasan_save_free_info+0x3b/0x60
[ 79.244772] poison_slab_object+0x10a/0x170
[ 79.245131] __kasan_slab_free+0x14/0x30
[ 79.245446] kfree+0xe0/0x2f0
[ 79.245705] destroy_user_event+0x305/0x450
[ 79.246035] delayed_destroy_user_event+0x5c/0xe0
[ 79.246399] process_one_work+0x81c/0x1970
[ 79.246722] worker_thread+0x608/0x1160
[ 79.247059] kthread+0x2be/0x3b0
[ 79.247332] ret_from_fork+0x2c/0x70
[ 79.247628] ret_from_fork_asm+0x1a/0x30
[ 79.247937]
[ 79.248113] Last potentially related work creation:
[ 79.248478] kasan_save_stack+0x20/0x40
[ 79.248800] __kasan_record_aux_stack+0x8e/0xa0
[ 79.249174] insert_work+0x20/0x1b0
[ 79.249466] __queue_work+0x67a/0xc60
[ 79.249767] queue_work_on+0x63/0x90
[ 79.250063] user_event_put+0x1f9/0x390
[ 79.250370] user_events_ioctl+0x11ed/0x17f0
[ 79.250704] __x64_sys_ioctl+0x133/0x190
[ 79.251055] do_syscall_64+0x66/0x130
[ 79.251354] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.251735]
[ 79.251913] The buggy address belongs to the object at ffff888001bd4c00
[ 79.251913] which belongs to the cache kmalloc-cg-512 of size 512
[ 79.252762] The buggy address is located 184 bytes inside of
[ 79.252762] freed 512-byte region [ffff888001bd4c00, ffff888001bd4e00)
[ 79.253617]
[ 79.253792] The buggy address belongs to the physical page:
[ 79.254200] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1bd4
[ 79.254756] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 79.255338] memcg:ffff888004b9e101
[ 79.255630] anon flags: 0x40(head|zone=0)
[ 79.255950] page_type: 0xffffefff(slab)
[ 79.256258] raw: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 79.256829] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 79.257461] head: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 79.258142] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 79.258809] head: 0000000000000002 ffffea000006f501 ffffffffffffffff 0000000000000000
[ 79.259482] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 79.260150] page dumped because: kasan: bad access detected
[ 79.260644]
[ 79.260859] Memory state around the buggy address:
[ 79.261294] ffff888001bd4b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 79.261926] ffff888001bd4c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.262553] >ffff888001bd4c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.263188] ^
[ 79.263639] ffff888001bd4d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.264271] ffff888001bd4d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.264901] ==================================================================
[ 79.265555] ==================================================================
[ 79.266179] BUG: KASAN: slab-use-after-free in f_start+0x2e4/0x3d0
[ 79.266711] Read of size 8 at addr ffff888001bd4c70 by task cat/4437
[ 79.267261]
[ 79.267470] CPU: 2 PID: 4437 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 79.268156] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 79.269252] Call Trace:
[ 79.269529] <TASK>
[ 79.269781] dump_stack_lvl+0x66/0xa0
[ 79.270141] print_report+0xd0/0x630
[ 79.270494] ? f_start+0x2e4/0x3d0
[ 79.270841] ? __virt_addr_valid+0x208/0x3f0
[ 79.271242] ? f_start+0x2e4/0x3d0
[ 79.271584] kasan_report+0xd8/0x110
[ 79.271943] ? f_start+0x2e4/0x3d0
[ 79.272288] f_start+0x2e4/0x3d0
[ 79.272623] seq_read_iter+0x268/0x11e0
[ 79.273004] ? lock_release+0x453/0x600
[ 79.273377] seq_read+0x261/0x350
[ 79.273714] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 79.274141] ? __pfx_seq_read+0x10/0x10
[ 79.274515] ? trace_irq_enable.constprop.0+0xce/0x110
[ 79.274977] vfs_read+0x171/0x9e0
[ 79.275316] ? lock_acquire+0x408/0x4b0
[ 79.275689] ? __pfx_vfs_read+0x10/0x10
[ 79.276064] ? lock_release+0x453/0x600
[ 79.276440] ? __pfx___up_read+0x10/0x10
[ 79.276823] ksys_read+0xdd/0x1a0
[ 79.277162] ? __pfx_ksys_read+0x10/0x10
[ 79.277541] ? trace_irq_enable.constprop.0+0xce/0x110
[ 79.278003] do_syscall_64+0x66/0x130
[ 79.278365] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.278824] RIP: 0033:0x7fac6e8fb40e
[ 79.279180] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 79.280622] RSP: 002b:00007ffe7b02f3a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 79.281284] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fac6e8fb40e
[ 79.281880] RDX: 0000000000020000 RSI: 00007fac6e7ef000 RDI: 0000000000000003
[ 79.282480] RBP: 00007fac6e7ef000 R08: 00007fac6e7ee010 R09: 0000000000000000
[ 79.283083] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 79.283680] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 79.284277] </TASK>
[ 79.284535]
[ 79.284750] Allocated by task 4436:
[ 79.285097] kasan_save_stack+0x20/0x40
[ 79.285471] kasan_save_track+0x14/0x30
[ 79.285844] __kasan_kmalloc+0x8f/0xa0
[ 79.286208] user_event_parse_cmd+0x55e/0x25a0
[ 79.286621] user_events_ioctl+0xa52/0x17f0
[ 79.287019] __x64_sys_ioctl+0x133/0x190
[ 79.287399] do_syscall_64+0x66/0x130
[ 79.287757] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.288223]
[ 79.288435] Freed by task 49:
[ 79.288751] kasan_save_stack+0x20/0x40
[ 79.289126] kasan_save_track+0x14/0x30
[ 79.289498] kasan_save_free_info+0x3b/0x60
[ 79.289892] poison_slab_object+0x10a/0x170
[ 79.290285] __kasan_slab_free+0x14/0x30
[ 79.290665] kfree+0xe0/0x2f0
[ 79.290981] destroy_user_event+0x305/0x450
[ 79.291376] delayed_destroy_user_event+0x5c/0xe0
[ 79.291808] process_one_work+0x81c/0x1970
[ 79.292200] worker_thread+0x608/0x1160
[ 79.292571] kthread+0x2be/0x3b0
[ 79.292908] ret_from_fork+0x2c/0x70
[ 79.293264] ret_from_fork_asm+0x1a/0x30
[ 79.293645]
[ 79.293853] Last potentially related work creation:
[ 79.294301] kasan_save_stack+0x20/0x40
[ 79.294674] __kasan_record_aux_stack+0x8e/0xa0
[ 79.295096] insert_work+0x20/0x1b0
[ 79.295443] __queue_work+0x67a/0xc60
[ 79.295804] queue_work_on+0x63/0x90
[ 79.296147] user_event_put+0x1f9/0x390
[ 79.296498] user_events_ioctl+0x11ed/0x17f0
[ 79.296920] __x64_sys_ioctl+0x133/0x190
[ 79.297291] do_syscall_64+0x66/0x130
[ 79.297635] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.298067]
[ 79.298271] The buggy address belongs to the object at ffff888001bd4c00
[ 79.298271] which belongs to the cache kmalloc-cg-512 of size 512
[ 79.299393] The buggy address is located 112 bytes inside of
[ 79.299393] freed 512-byte region [ffff888001bd4c00, ffff888001bd4e00)
[ 79.300313]
[ 79.300517] The buggy address belongs to the physical page:
[ 79.300997] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1bd4
[ 79.301633] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 79.302262] memcg:ffff888004b9e101
[ 79.302583] anon flags: 0x40(head|zone=0)
[ 79.302955] page_type: 0xffffefff(slab)
[ 79.303315] raw: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 79.303946] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 79.304582] head: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 79.305229] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 79.309529] head: 0000000000000002 ffffea000006f501 ffffffffffffffff 0000000000000000
[ 79.310170] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 79.310806] page dumped because: kasan: bad access detected
[ 79.311286]
[ 79.311483] Memory state around the buggy address:
[ 79.311899] ffff888001bd4b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 79.312500] ffff888001bd4b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 79.313115] >ffff888001bd4c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.313714] ^
[ 79.314261] ffff888001bd4c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.314858] ffff888001bd4d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.315465] ==================================================================
[ 79.316149] ==================================================================
[ 79.316789] BUG: KASAN: slab-use-after-free in f_start+0x2cb/0x3d0
[ 79.317327] Read of size 8 at addr ffff888001bd4d08 by task cat/4437
[ 79.317841]
[ 79.318043] CPU: 2 PID: 4437 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 79.318695] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 79.319578] Call Trace:
[ 79.319839] <TASK>
[ 79.320078] dump_stack_lvl+0x66/0xa0
[ 79.320423] print_report+0xd0/0x630
[ 79.320764] ? f_start+0x2cb/0x3d0
[ 79.321102] ? __virt_addr_valid+0x208/0x3f0
[ 79.321484] ? f_start+0x2cb/0x3d0
[ 79.321807] kasan_report+0xd8/0x110
[ 79.322148] ? f_start+0x2cb/0x3d0
[ 79.322479] f_start+0x2cb/0x3d0
[ 79.322791] seq_read_iter+0x268/0x11e0
[ 79.323159] ? lock_release+0x453/0x600
[ 79.323516] seq_read+0x261/0x350
[ 79.323838] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 79.324245] ? __pfx_seq_read+0x10/0x10
[ 79.324602] ? trace_irq_enable.constprop.0+0xce/0x110
[ 79.325060] vfs_read+0x171/0x9e0
[ 79.325379] ? lock_acquire+0x408/0x4b0
[ 79.325742] ? __pfx_vfs_read+0x10/0x10
[ 79.326099] ? lock_release+0x453/0x600
[ 79.326451] ? __pfx___up_read+0x10/0x10
[ 79.326809] ksys_read+0xdd/0x1a0
[ 79.327143] ? __pfx_ksys_read+0x10/0x10
[ 79.327503] ? trace_irq_enable.constprop.0+0xce/0x110
[ 79.327946] do_syscall_64+0x66/0x130
[ 79.328287] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.328722] RIP: 0033:0x7fac6e8fb40e
[ 79.329168] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 79.330542] RSP: 002b:00007ffe7b02f3a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 79.331173] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fac6e8fb40e
[ 79.331740] RDX: 0000000000020000 RSI: 00007fac6e7ef000 RDI: 0000000000000003
[ 79.332307] RBP: 00007fac6e7ef000 R08: 00007fac6e7ee010 R09: 0000000000000000
[ 79.332891] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 79.333462] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 79.334032] </TASK>
[ 79.334276]
[ 79.334477] Allocated by task 4436:
[ 79.334810] kasan_save_stack+0x20/0x40
[ 79.335182] kasan_save_track+0x14/0x30
[ 79.335542] __kasan_kmalloc+0x8f/0xa0
[ 79.335888] user_event_parse_cmd+0x55e/0x25a0
[ 79.336281] user_events_ioctl+0xa52/0x17f0
[ 79.336661] __x64_sys_ioctl+0x133/0x190
[ 79.337037] do_syscall_64+0x66/0x130
[ 79.337403] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.337862]
[ 79.338074] Freed by task 49:
[ 79.338384] kasan_save_stack+0x20/0x40
[ 79.338760] kasan_save_track+0x14/0x30
[ 79.339133] kasan_save_free_info+0x3b/0x60
[ 79.339524] poison_slab_object+0x10a/0x170
[ 79.339918] __kasan_slab_free+0x14/0x30
[ 79.340300] kfree+0xe0/0x2f0
[ 79.340619] destroy_user_event+0x305/0x450
[ 79.341016] delayed_destroy_user_event+0x5c/0xe0
[ 79.341448] process_one_work+0x81c/0x1970
[ 79.341842] worker_thread+0x608/0x1160
[ 79.342213] kthread+0x2be/0x3b0
[ 79.342542] ret_from_fork+0x2c/0x70
[ 79.342898] ret_from_fork_asm+0x1a/0x30
[ 79.343277]
[ 79.343485] Last potentially related work creation:
[ 79.343930] kasan_save_stack+0x20/0x40
[ 79.344306] __kasan_record_aux_stack+0x8e/0xa0
[ 79.344725] insert_work+0x20/0x1b0
[ 79.345076] __queue_work+0x67a/0xc60
[ 79.345444] queue_work_on+0x63/0x90
[ 79.345802] user_event_put+0x1f9/0x390
[ 79.346174] user_events_ioctl+0x11ed/0x17f0
[ 79.346585] __x64_sys_ioctl+0x133/0x190
[ 79.346967] do_syscall_64+0x66/0x130
[ 79.347324] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.347787]
[ 79.347999] The buggy address belongs to the object at ffff888001bd4c00
[ 79.347999] which belongs to the cache kmalloc-cg-512 of size 512
[ 79.349004] The buggy address is located 264 bytes inside of
[ 79.349004] freed 512-byte region [ffff888001bd4c00, ffff888001bd4e00)
[ 79.349971]
[ 79.350185] The buggy address belongs to the physical page:
[ 79.350673] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1bd4
[ 79.351343] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 79.352003] memcg:ffff888004b9e101
[ 79.352346] anon flags: 0x40(head|zone=0)
[ 79.352731] page_type: 0xffffefff(slab)
[ 79.353107] raw: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 79.353770] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 79.354438] head: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 79.355107] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 79.355777] head: 0000000000000002 ffffea000006f501 ffffffffffffffff 0000000000000000
[ 79.356447] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 79.357124] page dumped because: kasan: bad access detected
[ 79.357611]
[ 79.357822] Memory state around the buggy address:
[ 79.358261] ffff888001bd4c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.359125] ffff888001bd4c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.359776] >ffff888001bd4d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.360403] ^
[ 79.360764] ffff888001bd4d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.361402] ffff888001bd4e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 79.362031] ==================================================================
[ 79.362682] ==================================================================
[ 79.363310] BUG: KASAN: slab-use-after-free in user_event_get_fields+0x38/0x40
[ 79.363941] Read of size 8 at addr ffff888001bd4cb8 by task cat/4437
[ 79.364482]
[ 79.364693] CPU: 2 PID: 4437 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 79.365382] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 79.366294] Call Trace:
[ 79.366569] <TASK>
[ 79.366822] dump_stack_lvl+0x66/0xa0
[ 79.367181] print_report+0xd0/0x630
[ 79.367535] ? user_event_get_fields+0x38/0x40
[ 79.367946] ? __virt_addr_valid+0x208/0x3f0
[ 79.368351] ? user_event_get_fields+0x38/0x40
[ 79.368770] kasan_report+0xd8/0x110
[ 79.369128] ? user_event_get_fields+0x38/0x40
[ 79.369536] user_event_get_fields+0x38/0x40
[ 79.369935] f_start+0x175/0x3d0
[ 79.370269] seq_read_iter+0x268/0x11e0
[ 79.370640] ? lock_release+0x453/0x600
[ 79.371008] seq_read+0x261/0x350
[ 79.371341] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 79.371769] ? __pfx_seq_read+0x10/0x10
[ 79.372143] ? trace_irq_enable.constprop.0+0xce/0x110
[ 79.372606] vfs_read+0x171/0x9e0
[ 79.372948] ? lock_acquire+0x408/0x4b0
[ 79.373321] ? __pfx_vfs_read+0x10/0x10
[ 79.373692] ? lock_release+0x453/0x600
[ 79.374061] ? __pfx___up_read+0x10/0x10
[ 79.374440] ksys_read+0xdd/0x1a0
[ 79.378620] ? __pfx_ksys_read+0x10/0x10
[ 79.379000] ? trace_irq_enable.constprop.0+0xce/0x110
[ 79.379466] do_syscall_64+0x66/0x130
[ 79.379827] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.380282] RIP: 0033:0x7fac6e8fb40e
[ 79.380638] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 79.382084] RSP: 002b:00007ffe7b02f3a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 79.382740] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fac6e8fb40e
[ 79.383345] RDX: 0000000000020000 RSI: 00007fac6e7ef000 RDI: 0000000000000003
[ 79.383950] RBP: 00007fac6e7ef000 R08: 00007fac6e7ee010 R09: 0000000000000000
[ 79.384547] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 79.385149] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 79.385750] </TASK>
[ 79.386004]
[ 79.386216] Allocated by task 4436:
[ 79.386574] kasan_save_stack+0x20/0x40
[ 79.386946] kasan_save_track+0x14/0x30
[ 79.387320] __kasan_kmalloc+0x8f/0xa0
[ 79.387690] user_event_parse_cmd+0x55e/0x25a0
[ 79.388105] user_events_ioctl+0xa52/0x17f0
[ 79.388500] __x64_sys_ioctl+0x133/0x190
[ 79.389125] do_syscall_64+0x66/0x130
[ 79.389500] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.389956]
[ 79.390167] Freed by task 49:
[ 79.390484] kasan_save_stack+0x20/0x40
[ 79.390857] kasan_save_track+0x14/0x30
[ 79.391232] kasan_save_free_info+0x3b/0x60
[ 79.391628] poison_slab_object+0x10a/0x170
[ 79.392020] __kasan_slab_free+0x14/0x30
[ 79.392398] kfree+0xe0/0x2f0
[ 79.392712] destroy_user_event+0x305/0x450
[ 79.393118] delayed_destroy_user_event+0x5c/0xe0
[ 79.393557] process_one_work+0x81c/0x1970
[ 79.393942] worker_thread+0x608/0x1160
[ 79.394315] kthread+0x2be/0x3b0
[ 79.394650] ret_from_fork+0x2c/0x70
[ 79.395005] ret_from_fork_asm+0x1a/0x30
[ 79.395387]
[ 79.395599] Last potentially related work creation:
[ 79.396040] kasan_save_stack+0x20/0x40
[ 79.396415] __kasan_record_aux_stack+0x8e/0xa0
[ 79.396844] insert_work+0x20/0x1b0
[ 79.397192] __queue_work+0x67a/0xc60
[ 79.397550] queue_work_on+0x63/0x90
[ 79.397906] user_event_put+0x1f9/0x390
[ 79.398279] user_events_ioctl+0x11ed/0x17f0
[ 79.398684] __x64_sys_ioctl+0x133/0x190
[ 79.399063] do_syscall_64+0x66/0x130
[ 79.399428] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.399883]
[ 79.400093] The buggy address belongs to the object at ffff888001bd4c00
[ 79.400093] which belongs to the cache kmalloc-cg-512 of size 512
[ 79.401115] The buggy address is located 184 bytes inside of
[ 79.401115] freed 512-byte region [ffff888001bd4c00, ffff888001bd4e00)
[ 79.402085]
[ 79.402298] The buggy address belongs to the physical page:
[ 79.402789] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1bd4
[ 79.403469] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 79.404125] memcg:ffff888004b9e101
[ 79.404468] anon flags: 0x40(head|zone=0)
[ 79.404856] page_type: 0xffffefff(slab)
[ 79.405231] raw: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 79.405902] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 79.406567] head: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 79.407240] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 79.407913] head: 0000000000000002 ffffea000006f501 ffffffffffffffff 0000000000000000
[ 79.408582] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 79.409263] page dumped because: kasan: bad access detected
[ 79.409751]
[ 79.409961] Memory state around the buggy address:
[ 79.410399] ffff888001bd4b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 79.411039] ffff888001bd4c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.411673] >ffff888001bd4c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.412302] ^
[ 79.412764] ffff888001bd4d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.413392] ffff888001bd4d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.414021] ==================================================================
[ 79.414676] ==================================================================
[ 79.415310] BUG: KASAN: slab-use-after-free in f_start+0x2e4/0x3d0
[ 79.415842] Read of size 8 at addr ffff888001bd4c70 by task cat/4437
[ 79.416391]
[ 79.416608] CPU: 2 PID: 4437 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 79.417555] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 79.418527] Call Trace:
[ 79.419122] <TASK>
[ 79.419396] dump_stack_lvl+0x66/0xa0
[ 79.419764] print_report+0xd0/0x630
[ 79.420124] ? f_start+0x2e4/0x3d0
[ 79.420468] ? __virt_addr_valid+0x208/0x3f0
[ 79.420885] ? f_start+0x2e4/0x3d0
[ 79.421232] kasan_report+0xd8/0x110
[ 79.421588] ? f_start+0x2e4/0x3d0
[ 79.421932] f_start+0x2e4/0x3d0
[ 79.422266] seq_read_iter+0x268/0x11e0
[ 79.422639] ? lock_release+0x453/0x600
[ 79.423030] seq_read+0x261/0x350
[ 79.423374] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 79.423810] ? __pfx_seq_read+0x10/0x10
[ 79.424183] ? trace_irq_enable.constprop.0+0xce/0x110
[ 79.424644] vfs_read+0x171/0x9e0
[ 79.424996] ? lock_acquire+0x408/0x4b0
[ 79.425373] ? __pfx_vfs_read+0x10/0x10
[ 79.425746] ? lock_release+0x453/0x600
[ 79.426123] ? __pfx___up_read+0x10/0x10
[ 79.426503] ksys_read+0xdd/0x1a0
[ 79.426840] ? __pfx_ksys_read+0x10/0x10
[ 79.427232] ? trace_irq_enable.constprop.0+0xce/0x110
[ 79.427704] do_syscall_64+0x66/0x130
[ 79.428074] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.428536] RIP: 0033:0x7fac6e8fb40e
[ 79.428899] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 79.430354] RSP: 002b:00007ffe7b02f3a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 79.431008] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fac6e8fb40e
[ 79.431609] RDX: 0000000000020000 RSI: 00007fac6e7ef000 RDI: 0000000000000003
[ 79.432208] RBP: 00007fac6e7ef000 R08: 00007fac6e7ee010 R09: 0000000000000000
[ 79.432811] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 79.433411] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 79.434011] </TASK>
[ 79.434273]
[ 79.434483] Allocated by task 4436:
[ 79.434834] kasan_save_stack+0x20/0x40
[ 79.435207] kasan_save_track+0x14/0x30
[ 79.435575] __kasan_kmalloc+0x8f/0xa0
[ 79.435939] user_event_parse_cmd+0x55e/0x25a0
[ 79.436355] user_events_ioctl+0xa52/0x17f0
[ 79.436751] __x64_sys_ioctl+0x133/0x190
[ 79.437132] do_syscall_64+0x66/0x130
[ 79.437496] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.437955]
[ 79.438165] Freed by task 49:
[ 79.438483] kasan_save_stack+0x20/0x40
[ 79.438860] kasan_save_track+0x14/0x30
[ 79.439228] kasan_save_free_info+0x3b/0x60
[ 79.439624] poison_slab_object+0x10a/0x170
[ 79.440021] __kasan_slab_free+0x14/0x30
[ 79.440398] kfree+0xe0/0x2f0
[ 79.440710] destroy_user_event+0x305/0x450
[ 79.441121] delayed_destroy_user_event+0x5c/0xe0
[ 79.441554] process_one_work+0x81c/0x1970
[ 79.441951] worker_thread+0x608/0x1160
[ 79.442331] kthread+0x2be/0x3b0
[ 79.442669] ret_from_fork+0x2c/0x70
[ 79.443028] ret_from_fork_asm+0x1a/0x30
[ 79.443404]
[ 79.443621] Last potentially related work creation:
[ 79.444069] kasan_save_stack+0x20/0x40
[ 79.444448] __kasan_record_aux_stack+0x8e/0xa0
[ 79.444876] insert_work+0x20/0x1b0
[ 79.445227] __queue_work+0x67a/0xc60
[ 79.445586] queue_work_on+0x63/0x90
[ 79.445937] user_event_put+0x1f9/0x390
[ 79.446307] user_events_ioctl+0x11ed/0x17f0
[ 79.446706] __x64_sys_ioctl+0x133/0x190
[ 79.447083] do_syscall_64+0x66/0x130
[ 79.447447] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.447906]
[ 79.452265] The buggy address belongs to the object at ffff888001bd4c00
[ 79.452265] which belongs to the cache kmalloc-cg-512 of size 512
[ 79.453302] The buggy address is located 112 bytes inside of
[ 79.453302] freed 512-byte region [ffff888001bd4c00, ffff888001bd4e00)
[ 79.454274]
[ 79.454485] The buggy address belongs to the physical page:
[ 79.454994] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1bd4
[ 79.455664] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 79.456335] memcg:ffff888004b9e101
[ 79.456678] anon flags: 0x40(head|zone=0)
[ 79.457075] page_type: 0xffffefff(slab)
[ 79.457453] raw: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 79.458120] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 79.458797] head: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 79.459473] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 79.460155] head: 0000000000000002 ffffea000006f501 ffffffffffffffff 0000000000000000
[ 79.460835] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 79.461511] page dumped because: kasan: bad access detected
[ 79.462001]
[ 79.462211] Memory state around the buggy address:
[ 79.462650] ffff888001bd4b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 79.463283] ffff888001bd4b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 79.463915] >ffff888001bd4c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.464550] ^
[ 79.465137] ffff888001bd4c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.465767] ffff888001bd4d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.466393] ==================================================================
[ 79.467082] ==================================================================
[ 79.467728] BUG: KASAN: slab-use-after-free in f_start+0x2cb/0x3d0
[ 79.468267] Read of size 8 at addr ffff888001bd4d08 by task cat/4437
[ 79.468820]
[ 79.469041] CPU: 2 PID: 4437 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 79.469726] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 79.470650] Call Trace:
[ 79.470929] <TASK>
[ 79.471183] dump_stack_lvl+0x66/0xa0
[ 79.471546] print_report+0xd0/0x630
[ 79.471903] ? f_start+0x2cb/0x3d0
[ 79.472237] ? __virt_addr_valid+0x208/0x3f0
[ 79.472622] ? f_start+0x2cb/0x3d0
[ 79.472967] kasan_report+0xd8/0x110
[ 79.473303] ? f_start+0x2cb/0x3d0
[ 79.473633] f_start+0x2cb/0x3d0
[ 79.473955] seq_read_iter+0x268/0x11e0
[ 79.474312] ? lock_release+0x453/0x600
[ 79.474673] seq_read+0x261/0x350
[ 79.475020] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 79.475431] ? __pfx_seq_read+0x10/0x10
[ 79.475786] ? trace_irq_enable.constprop.0+0xce/0x110
[ 79.476223] vfs_read+0x171/0x9e0
[ 79.476551] ? lock_acquire+0x408/0x4b0
[ 79.476927] ? __pfx_vfs_read+0x10/0x10
[ 79.477282] ? lock_release+0x453/0x600
[ 79.477643] ? __pfx___up_read+0x10/0x10
[ 79.478012] ksys_read+0xdd/0x1a0
[ 79.478335] ? __pfx_ksys_read+0x10/0x10
[ 79.478697] ? trace_irq_enable.constprop.0+0xce/0x110
[ 79.479379] do_syscall_64+0x66/0x130
[ 79.479734] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.480173] RIP: 0033:0x7fac6e8fb40e
[ 79.480511] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 79.481927] RSP: 002b:00007ffe7b02f3a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 79.482554] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fac6e8fb40e
[ 79.483139] RDX: 0000000000020000 RSI: 00007fac6e7ef000 RDI: 0000000000000003
[ 79.483709] RBP: 00007fac6e7ef000 R08: 00007fac6e7ee010 R09: 0000000000000000
[ 79.484289] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 79.484891] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 79.485469] </TASK>
[ 79.485716]
[ 79.485917] Allocated by task 4436:
[ 79.486252] kasan_save_stack+0x20/0x40
[ 79.486608] kasan_save_track+0x14/0x30
[ 79.486969] __kasan_kmalloc+0x8f/0xa0
[ 79.487326] user_event_parse_cmd+0x55e/0x25a0
[ 79.487724] user_events_ioctl+0xa52/0x17f0
[ 79.488099] __x64_sys_ioctl+0x133/0x190
[ 79.488463] do_syscall_64+0x66/0x130
[ 79.488829] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.489268]
[ 79.489473] Freed by task 49:
[ 79.489772] kasan_save_stack+0x20/0x40
[ 79.490129] kasan_save_track+0x14/0x30
[ 79.490484] kasan_save_free_info+0x3b/0x60
[ 79.490862] poison_slab_object+0x10a/0x170
[ 79.491261] __kasan_slab_free+0x14/0x30
[ 79.491618] kfree+0xe0/0x2f0
[ 79.491917] destroy_user_event+0x305/0x450
[ 79.492293] delayed_destroy_user_event+0x5c/0xe0
[ 79.492711] process_one_work+0x81c/0x1970
[ 79.493095] worker_thread+0x608/0x1160
[ 79.493449] kthread+0x2be/0x3b0
[ 79.493768] ret_from_fork+0x2c/0x70
[ 79.494109] ret_from_fork_asm+0x1a/0x30
[ 79.494467]
[ 79.494674] Last potentially related work creation:
[ 79.495107] kasan_save_stack+0x20/0x40
[ 79.495459] __kasan_record_aux_stack+0x8e/0xa0
[ 79.495861] insert_work+0x20/0x1b0
[ 79.496194] __queue_work+0x67a/0xc60
[ 79.496536] queue_work_on+0x63/0x90
[ 79.496904] user_event_put+0x1f9/0x390
[ 79.497261] user_events_ioctl+0x11ed/0x17f0
[ 79.497642] __x64_sys_ioctl+0x133/0x190
[ 79.498004] do_syscall_64+0x66/0x130
[ 79.498354] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.498792]
[ 79.499015] The buggy address belongs to the object at ffff888001bd4c00
[ 79.499015] which belongs to the cache kmalloc-cg-512 of size 512
[ 79.499981] The buggy address is located 264 bytes inside of
[ 79.499981] freed 512-byte region [ffff888001bd4c00, ffff888001bd4e00)
[ 79.500921]
[ 79.501123] The buggy address belongs to the physical page:
[ 79.501584] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1bd4
[ 79.502232] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 79.502864] memcg:ffff888004b9e101
[ 79.503204] anon flags: 0x40(head|zone=0)
[ 79.503568] page_type: 0xffffefff(slab)
[ 79.503923] raw: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 79.504561] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 79.505225] head: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 79.505865] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 79.506505] head: 0000000000000002 ffffea000006f501 ffffffffffffffff 0000000000000000
[ 79.507160] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 79.507793] page dumped because: kasan: bad access detected
[ 79.508264]
[ 79.508463] Memory state around the buggy address:
[ 79.509159] ffff888001bd4c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.509773] ffff888001bd4c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.510372] >ffff888001bd4d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.510980] ^
[ 79.511314] ffff888001bd4d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.511917] ffff888001bd4e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 79.512515] ==================================================================
[ 79.513221] ==================================================================
[ 79.513836] BUG: KASAN: slab-use-after-free in user_event_get_fields+0x38/0x40
[ 79.514433] Read of size 8 at addr ffff888001bd4cb8 by task cat/4437
[ 79.514957]
[ 79.515165] CPU: 2 PID: 4437 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 79.515812] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 79.516693] Call Trace:
[ 79.516958] <TASK>
[ 79.517198] dump_stack_lvl+0x66/0xa0
[ 79.521218] print_report+0xd0/0x630
[ 79.521559] ? user_event_get_fields+0x38/0x40
[ 79.521956] ? __virt_addr_valid+0x208/0x3f0
[ 79.522340] ? user_event_get_fields+0x38/0x40
[ 79.522734] kasan_report+0xd8/0x110
[ 79.523075] ? user_event_get_fields+0x38/0x40
[ 79.523473] user_event_get_fields+0x38/0x40
[ 79.523856] f_start+0x175/0x3d0
[ 79.524175] seq_read_iter+0x268/0x11e0
[ 79.524534] ? lock_release+0x453/0x600
[ 79.524889] seq_read+0x261/0x350
[ 79.525211] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 79.525620] ? __pfx_seq_read+0x10/0x10
[ 79.525977] ? trace_irq_enable.constprop.0+0xce/0x110
[ 79.526419] vfs_read+0x171/0x9e0
[ 79.526739] ? lock_acquire+0x408/0x4b0
[ 79.527102] ? __pfx_vfs_read+0x10/0x10
[ 79.527459] ? lock_release+0x453/0x600
[ 79.527813] ? __pfx___up_read+0x10/0x10
[ 79.528176] ksys_read+0xdd/0x1a0
[ 79.528501] ? __pfx_ksys_read+0x10/0x10
[ 79.528861] ? trace_irq_enable.constprop.0+0xce/0x110
[ 79.529301] do_syscall_64+0x66/0x130
[ 79.529647] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.530083] RIP: 0033:0x7fac6e8fb40e
[ 79.530420] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 79.531796] RSP: 002b:00007ffe7b02f3a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 79.532428] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fac6e8fb40e
[ 79.533000] RDX: 0000000000020000 RSI: 00007fac6e7ef000 RDI: 0000000000000003
[ 79.533569] RBP: 00007fac6e7ef000 R08: 00007fac6e7ee010 R09: 0000000000000000
[ 79.534140] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 79.534709] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 79.535282] </TASK>
[ 79.535531]
[ 79.535730] Allocated by task 4436:
[ 79.536059] kasan_save_stack+0x20/0x40
[ 79.536414] kasan_save_track+0x14/0x30
[ 79.536783] __kasan_kmalloc+0x8f/0xa0
[ 79.537136] user_event_parse_cmd+0x55e/0x25a0
[ 79.537536] user_events_ioctl+0xa52/0x17f0
[ 79.537915] __x64_sys_ioctl+0x133/0x190
[ 79.538273] do_syscall_64+0x66/0x130
[ 79.538613] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.539330]
[ 79.539541] Freed by task 49:
[ 79.539837] kasan_save_stack+0x20/0x40
[ 79.540196] kasan_save_track+0x14/0x30
[ 79.540548] kasan_save_free_info+0x3b/0x60
[ 79.540945] poison_slab_object+0x10a/0x170
[ 79.541322] __kasan_slab_free+0x14/0x30
[ 79.541684] kfree+0xe0/0x2f0
[ 79.541983] destroy_user_event+0x305/0x450
[ 79.542356] delayed_destroy_user_event+0x5c/0xe0
[ 79.542768] process_one_work+0x81c/0x1970
[ 79.543153] worker_thread+0x608/0x1160
[ 79.543507] kthread+0x2be/0x3b0
[ 79.543819] ret_from_fork+0x2c/0x70
[ 79.544158] ret_from_fork_asm+0x1a/0x30
[ 79.544515]
[ 79.544714] Last potentially related work creation:
[ 79.545155] kasan_save_stack+0x20/0x40
[ 79.545505] __kasan_record_aux_stack+0x8e/0xa0
[ 79.545905] insert_work+0x20/0x1b0
[ 79.546240] __queue_work+0x67a/0xc60
[ 79.546580] queue_work_on+0x63/0x90
[ 79.546920] user_event_put+0x1f9/0x390
[ 79.547281] user_events_ioctl+0x11ed/0x17f0
[ 79.547665] __x64_sys_ioctl+0x133/0x190
[ 79.548025] do_syscall_64+0x66/0x130
[ 79.548367] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.548813]
[ 79.549025] The buggy address belongs to the object at ffff888001bd4c00
[ 79.549025] which belongs to the cache kmalloc-cg-512 of size 512
[ 79.549985] The buggy address is located 184 bytes inside of
[ 79.549985] freed 512-byte region [ffff888001bd4c00, ffff888001bd4e00)
[ 79.550909]
[ 79.551120] The buggy address belongs to the physical page:
[ 79.551584] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1bd4
[ 79.552219] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 79.552861] memcg:ffff888004b9e101
[ 79.553202] anon flags: 0x40(head|zone=0)
[ 79.553588] page_type: 0xffffefff(slab)
[ 79.553958] raw: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 79.554625] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 79.555296] head: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 79.555963] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 79.556635] head: 0000000000000002 ffffea000006f501 ffffffffffffffff 0000000000000000
[ 79.557307] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 79.557975] page dumped because: kasan: bad access detected
[ 79.558467]
[ 79.558679] Memory state around the buggy address:
[ 79.559115] ffff888001bd4b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 79.559749] ffff888001bd4c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.560379] >ffff888001bd4c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.561014] ^
[ 79.561468] ffff888001bd4d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.562094] ffff888001bd4d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.562724] ==================================================================
[ 79.563387] ==================================================================
[ 79.564019] BUG: KASAN: slab-use-after-free in f_start+0x2e4/0x3d0
[ 79.564554] Read of size 8 at addr ffff888001bd4c70 by task cat/4437
[ 79.565102]
[ 79.565314] CPU: 2 PID: 4437 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 79.566087] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 79.567186] Call Trace:
[ 79.567464] <TASK>
[ 79.567718] dump_stack_lvl+0x66/0xa0
[ 79.568078] print_report+0xd0/0x630
[ 79.568436] ? f_start+0x2e4/0x3d0
[ 79.569123] ? __virt_addr_valid+0x208/0x3f0
[ 79.569550] ? f_start+0x2e4/0x3d0
[ 79.569896] kasan_report+0xd8/0x110
[ 79.570252] ? f_start+0x2e4/0x3d0
[ 79.570597] f_start+0x2e4/0x3d0
[ 79.570928] seq_read_iter+0x268/0x11e0
[ 79.571303] ? lock_release+0x453/0x600
[ 79.571680] seq_read+0x261/0x350
[ 79.572015] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 79.572443] ? __pfx_seq_read+0x10/0x10
[ 79.572825] ? trace_irq_enable.constprop.0+0xce/0x110
[ 79.573290] vfs_read+0x171/0x9e0
[ 79.573627] ? lock_acquire+0x408/0x4b0
[ 79.573996] ? __pfx_vfs_read+0x10/0x10
[ 79.574377] ? lock_release+0x453/0x600
[ 79.574749] ? __pfx___up_read+0x10/0x10
[ 79.575127] ksys_read+0xdd/0x1a0
[ 79.575468] ? __pfx_ksys_read+0x10/0x10
[ 79.575849] ? trace_irq_enable.constprop.0+0xce/0x110
[ 79.576309] do_syscall_64+0x66/0x130
[ 79.576672] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.577143] RIP: 0033:0x7fac6e8fb40e
[ 79.577509] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 79.578957] RSP: 002b:00007ffe7b02f3a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 79.579611] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fac6e8fb40e
[ 79.580208] RDX: 0000000000020000 RSI: 00007fac6e7ef000 RDI: 0000000000000003
[ 79.580805] RBP: 00007fac6e7ef000 R08: 00007fac6e7ee010 R09: 0000000000000000
[ 79.581399] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 79.581997] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 79.582588] </TASK>
[ 79.582843]
[ 79.583055] Allocated by task 4436:
[ 79.583404] kasan_save_stack+0x20/0x40
[ 79.583776] kasan_save_track+0x14/0x30
[ 79.584151] __kasan_kmalloc+0x8f/0xa0
[ 79.584514] user_event_parse_cmd+0x55e/0x25a0
[ 79.584936] user_events_ioctl+0xa52/0x17f0
[ 79.585336] __x64_sys_ioctl+0x133/0x190
[ 79.585714] do_syscall_64+0x66/0x130
[ 79.586069] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.586524]
[ 79.586738] Freed by task 49:
[ 79.587051] kasan_save_stack+0x20/0x40
[ 79.587421] kasan_save_track+0x14/0x30
[ 79.587797] kasan_save_free_info+0x3b/0x60
[ 79.588197] poison_slab_object+0x10a/0x170
[ 79.588591] __kasan_slab_free+0x14/0x30
[ 79.588976] kfree+0xe0/0x2f0
[ 79.593142] destroy_user_event+0x305/0x450
[ 79.593572] delayed_destroy_user_event+0x5c/0xe0
[ 79.594014] process_one_work+0x81c/0x1970
[ 79.594413] worker_thread+0x608/0x1160
[ 79.594783] kthread+0x2be/0x3b0
[ 79.595111] ret_from_fork+0x2c/0x70
[ 79.595466] ret_from_fork_asm+0x1a/0x30
[ 79.595841]
[ 79.596052] Last potentially related work creation:
[ 79.596499] kasan_save_stack+0x20/0x40
[ 79.596873] __kasan_record_aux_stack+0x8e/0xa0
[ 79.597290] insert_work+0x20/0x1b0
[ 79.597639] __queue_work+0x67a/0xc60
[ 79.598007] queue_work_on+0x63/0x90
[ 79.598364] user_event_put+0x1f9/0x390
[ 79.598742] user_events_ioctl+0x11ed/0x17f0
[ 79.599403] __x64_sys_ioctl+0x133/0x190
[ 79.599783] do_syscall_64+0x66/0x130
[ 79.600146] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.600610]
[ 79.600842] The buggy address belongs to the object at ffff888001bd4c00
[ 79.600842] which belongs to the cache kmalloc-cg-512 of size 512
[ 79.601866] The buggy address is located 112 bytes inside of
[ 79.601866] freed 512-byte region [ffff888001bd4c00, ffff888001bd4e00)
[ 79.602855]
[ 79.603073] The buggy address belongs to the physical page:
[ 79.603569] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1bd4
[ 79.604249] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 79.604916] memcg:ffff888004b9e101
[ 79.605266] anon flags: 0x40(head|zone=0)
[ 79.605652] page_type: 0xffffefff(slab)
[ 79.606023] raw: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 79.606692] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 79.607364] head: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 79.608037] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 79.608712] head: 0000000000000002 ffffea000006f501 ffffffffffffffff 0000000000000000
[ 79.609393] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 79.610061] page dumped because: kasan: bad access detected
[ 79.610549]
[ 79.610761] Memory state around the buggy address:
[ 79.611199] ffff888001bd4b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 79.611836] ffff888001bd4b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 79.612432] >ffff888001bd4c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.613050] ^
[ 79.613603] ffff888001bd4c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.614201] ffff888001bd4d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.614801] ==================================================================
[ 79.615448] ==================================================================
[ 79.616094] BUG: KASAN: slab-use-after-free in f_start+0x2cb/0x3d0
[ 79.616632] Read of size 8 at addr ffff888001bd4d08 by task cat/4437
[ 79.617237]
[ 79.617456] CPU: 2 PID: 4437 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 79.618137] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 79.619066] Call Trace:
[ 79.619343] <TASK>
[ 79.619599] dump_stack_lvl+0x66/0xa0
[ 79.619963] print_report+0xd0/0x630
[ 79.620318] ? f_start+0x2cb/0x3d0
[ 79.620667] ? __virt_addr_valid+0x208/0x3f0
[ 79.621075] ? f_start+0x2cb/0x3d0
[ 79.621418] kasan_report+0xd8/0x110
[ 79.621774] ? f_start+0x2cb/0x3d0
[ 79.622119] f_start+0x2cb/0x3d0
[ 79.622452] seq_read_iter+0x268/0x11e0
[ 79.622835] ? lock_release+0x453/0x600
[ 79.623213] seq_read+0x261/0x350
[ 79.623559] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 79.623992] ? __pfx_seq_read+0x10/0x10
[ 79.624371] ? trace_irq_enable.constprop.0+0xce/0x110
[ 79.624852] vfs_read+0x171/0x9e0
[ 79.625196] ? lock_acquire+0x408/0x4b0
[ 79.625565] ? __pfx_vfs_read+0x10/0x10
[ 79.625939] ? lock_release+0x453/0x600
[ 79.626319] ? __pfx___up_read+0x10/0x10
[ 79.626704] ksys_read+0xdd/0x1a0
[ 79.627047] ? __pfx_ksys_read+0x10/0x10
[ 79.627432] ? trace_irq_enable.constprop.0+0xce/0x110
[ 79.627904] do_syscall_64+0x66/0x130
[ 79.628267] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.628730] RIP: 0033:0x7fac6e8fb40e
[ 79.629428] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 79.630885] RSP: 002b:00007ffe7b02f3a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 79.631541] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fac6e8fb40e
[ 79.632144] RDX: 0000000000020000 RSI: 00007fac6e7ef000 RDI: 0000000000000003
[ 79.632752] RBP: 00007fac6e7ef000 R08: 00007fac6e7ee010 R09: 0000000000000000
[ 79.633356] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 79.633958] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 79.634568] </TASK>
[ 79.634839]
[ 79.635055] Allocated by task 4436:
[ 79.635407] kasan_save_stack+0x20/0x40
[ 79.635783] kasan_save_track+0x14/0x30
[ 79.636158] __kasan_kmalloc+0x8f/0xa0
[ 79.636528] user_event_parse_cmd+0x55e/0x25a0
[ 79.636949] user_events_ioctl+0xa52/0x17f0
[ 79.637349] __x64_sys_ioctl+0x133/0x190
[ 79.637733] do_syscall_64+0x66/0x130
[ 79.638097] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.638558]
[ 79.638771] Freed by task 49:
[ 79.639085] kasan_save_stack+0x20/0x40
[ 79.639459] kasan_save_track+0x14/0x30
[ 79.639837] kasan_save_free_info+0x3b/0x60
[ 79.640234] poison_slab_object+0x10a/0x170
[ 79.640632] __kasan_slab_free+0x14/0x30
[ 79.641020] kfree+0xe0/0x2f0
[ 79.641345] destroy_user_event+0x305/0x450
[ 79.641741] delayed_destroy_user_event+0x5c/0xe0
[ 79.642174] process_one_work+0x81c/0x1970
[ 79.642571] worker_thread+0x608/0x1160
[ 79.642946] kthread+0x2be/0x3b0
[ 79.643278] ret_from_fork+0x2c/0x70
[ 79.643636] ret_from_fork_asm+0x1a/0x30
[ 79.644020]
[ 79.644231] Last potentially related work creation:
[ 79.644673] kasan_save_stack+0x20/0x40
[ 79.645048] __kasan_record_aux_stack+0x8e/0xa0
[ 79.645452] insert_work+0x20/0x1b0
[ 79.645787] __queue_work+0x67a/0xc60
[ 79.646135] queue_work_on+0x63/0x90
[ 79.646475] user_event_put+0x1f9/0x390
[ 79.646828] user_events_ioctl+0x11ed/0x17f0
[ 79.647212] __x64_sys_ioctl+0x133/0x190
[ 79.647576] do_syscall_64+0x66/0x130
[ 79.647926] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.648358]
[ 79.648561] The buggy address belongs to the object at ffff888001bd4c00
[ 79.648561] which belongs to the cache kmalloc-cg-512 of size 512
[ 79.649564] The buggy address is located 264 bytes inside of
[ 79.649564] freed 512-byte region [ffff888001bd4c00, ffff888001bd4e00)
[ 79.650489]
[ 79.650689] The buggy address belongs to the physical page:
[ 79.651162] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1bd4
[ 79.651806] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 79.652446] memcg:ffff888004b9e101
[ 79.652776] anon flags: 0x40(head|zone=0)
[ 79.653142] page_type: 0xffffefff(slab)
[ 79.653502] raw: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 79.654135] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 79.654776] head: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 79.655417] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 79.656063] head: 0000000000000002 ffffea000006f501 ffffffffffffffff 0000000000000000
[ 79.656700] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 79.657351] page dumped because: kasan: bad access detected
[ 79.657820]
[ 79.658020] Memory state around the buggy address:
[ 79.658438] ffff888001bd4c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.659317] ffff888001bd4c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.659966] >ffff888001bd4d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.664367] ^
[ 79.664698] ffff888001bd4d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.665341] ffff888001bd4e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 79.665967] ==================================================================
[ 79.666679] ==================================================================
[ 79.667320] BUG: KASAN: slab-use-after-free in user_event_get_fields+0x38/0x40
[ 79.667961] Read of size 8 at addr ffff888001bd4cb8 by task cat/4437
[ 79.668526]
[ 79.668744] CPU: 2 PID: 4437 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 79.669400] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 79.670277] Call Trace:
[ 79.670542] <TASK>
[ 79.670782] dump_stack_lvl+0x66/0xa0
[ 79.671138] print_report+0xd0/0x630
[ 79.671483] ? user_event_get_fields+0x38/0x40
[ 79.671882] ? __virt_addr_valid+0x208/0x3f0
[ 79.672264] ? user_event_get_fields+0x38/0x40
[ 79.672658] kasan_report+0xd8/0x110
[ 79.673010] ? user_event_get_fields+0x38/0x40
[ 79.673401] user_event_get_fields+0x38/0x40
[ 79.673791] f_start+0x175/0x3d0
[ 79.674107] seq_read_iter+0x268/0x11e0
[ 79.674460] ? lock_release+0x453/0x600
[ 79.674812] seq_read+0x261/0x350
[ 79.675145] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 79.675552] ? __pfx_seq_read+0x10/0x10
[ 79.675903] ? trace_irq_enable.constprop.0+0xce/0x110
[ 79.676348] vfs_read+0x171/0x9e0
[ 79.676671] ? lock_acquire+0x408/0x4b0
[ 79.677038] ? __pfx_vfs_read+0x10/0x10
[ 79.677390] ? lock_release+0x453/0x600
[ 79.677747] ? __pfx___up_read+0x10/0x10
[ 79.678114] ksys_read+0xdd/0x1a0
[ 79.678439] ? __pfx_ksys_read+0x10/0x10
[ 79.678800] ? trace_irq_enable.constprop.0+0xce/0x110
[ 79.679262] do_syscall_64+0x66/0x130
[ 79.679607] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.680040] RIP: 0033:0x7fac6e8fb40e
[ 79.680378] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 79.681773] RSP: 002b:00007ffe7b02f3a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 79.682396] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fac6e8fb40e
[ 79.682971] RDX: 0000000000020000 RSI: 00007fac6e7ef000 RDI: 0000000000000003
[ 79.683543] RBP: 00007fac6e7ef000 R08: 00007fac6e7ee010 R09: 0000000000000000
[ 79.684114] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 79.684683] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 79.685267] </TASK>
[ 79.685513]
[ 79.685712] Allocated by task 4436:
[ 79.686044] kasan_save_stack+0x20/0x40
[ 79.686398] kasan_save_track+0x14/0x30
[ 79.686748] __kasan_kmalloc+0x8f/0xa0
[ 79.687114] user_event_parse_cmd+0x55e/0x25a0
[ 79.687507] user_events_ioctl+0xa52/0x17f0
[ 79.687882] __x64_sys_ioctl+0x133/0x190
[ 79.688241] do_syscall_64+0x66/0x130
[ 79.688585] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.689230]
[ 79.689429] Freed by task 49:
[ 79.689731] kasan_save_stack+0x20/0x40
[ 79.690086] kasan_save_track+0x14/0x30
[ 79.690440] kasan_save_free_info+0x3b/0x60
[ 79.690817] poison_slab_object+0x10a/0x170
[ 79.691205] __kasan_slab_free+0x14/0x30
[ 79.691564] kfree+0xe0/0x2f0
[ 79.691859] destroy_user_event+0x305/0x450
[ 79.692238] delayed_destroy_user_event+0x5c/0xe0
[ 79.692646] process_one_work+0x81c/0x1970
[ 79.693038] worker_thread+0x608/0x1160
[ 79.693394] kthread+0x2be/0x3b0
[ 79.693714] ret_from_fork+0x2c/0x70
[ 79.694050] ret_from_fork_asm+0x1a/0x30
[ 79.694409]
[ 79.694612] Last potentially related work creation:
[ 79.695032] kasan_save_stack+0x20/0x40
[ 79.695390] __kasan_record_aux_stack+0x8e/0xa0
[ 79.695793] insert_work+0x20/0x1b0
[ 79.696128] __queue_work+0x67a/0xc60
[ 79.696468] queue_work_on+0x63/0x90
[ 79.696816] user_event_put+0x1f9/0x390
[ 79.697181] user_events_ioctl+0x11ed/0x17f0
[ 79.697562] __x64_sys_ioctl+0x133/0x190
[ 79.697918] do_syscall_64+0x66/0x130
[ 79.698265] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.698702]
[ 79.698900] The buggy address belongs to the object at ffff888001bd4c00
[ 79.698900] which belongs to the cache kmalloc-cg-512 of size 512
[ 79.699860] The buggy address is located 184 bytes inside of
[ 79.699860] freed 512-byte region [ffff888001bd4c00, ffff888001bd4e00)
[ 79.700794]
[ 79.701002] The buggy address belongs to the physical page:
[ 79.701474] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1bd4
[ 79.702117] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 79.702740] memcg:ffff888004b9e101
[ 79.703065] anon flags: 0x40(head|zone=0)
[ 79.703431] page_type: 0xffffefff(slab)
[ 79.703783] raw: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 79.704422] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 79.705064] head: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 79.705706] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 79.706339] head: 0000000000000002 ffffea000006f501 ffffffffffffffff 0000000000000000
[ 79.706983] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 79.707621] page dumped because: kasan: bad access detected
[ 79.708088]
[ 79.708286] Memory state around the buggy address:
[ 79.708704] ffff888001bd4b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 79.709320] ffff888001bd4c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.709919] >ffff888001bd4c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.710514] ^
[ 79.710947] ffff888001bd4d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.711549] ffff888001bd4d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.712145] ==================================================================
[ 79.712802] ==================================================================
[ 79.713426] BUG: KASAN: slab-use-after-free in f_start+0x2e4/0x3d0
[ 79.713932] Read of size 8 at addr ffff888001bd4c70 by task cat/4437
[ 79.714456]
[ 79.714662] CPU: 2 PID: 4437 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 79.715349] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 79.716225] Call Trace:
[ 79.716493] <TASK>
[ 79.716731] dump_stack_lvl+0x66/0xa0
[ 79.717097] print_report+0xd0/0x630
[ 79.717440] ? f_start+0x2e4/0x3d0
[ 79.717768] ? __virt_addr_valid+0x208/0x3f0
[ 79.718151] ? f_start+0x2e4/0x3d0
[ 79.718484] kasan_report+0xd8/0x110
[ 79.719151] ? f_start+0x2e4/0x3d0
[ 79.719498] f_start+0x2e4/0x3d0
[ 79.719818] seq_read_iter+0x268/0x11e0
[ 79.720177] ? lock_release+0x453/0x600
[ 79.720534] seq_read+0x261/0x350
[ 79.720877] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 79.721321] ? __pfx_seq_read+0x10/0x10
[ 79.721697] ? trace_irq_enable.constprop.0+0xce/0x110
[ 79.722166] vfs_read+0x171/0x9e0
[ 79.722507] ? lock_acquire+0x408/0x4b0
[ 79.722881] ? __pfx_vfs_read+0x10/0x10
[ 79.723256] ? lock_release+0x453/0x600
[ 79.723614] ? __pfx___up_read+0x10/0x10
[ 79.723987] ksys_read+0xdd/0x1a0
[ 79.724326] ? __pfx_ksys_read+0x10/0x10
[ 79.724708] ? trace_irq_enable.constprop.0+0xce/0x110
[ 79.725168] do_syscall_64+0x66/0x130
[ 79.725522] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.725958] RIP: 0033:0x7fac6e8fb40e
[ 79.726299] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 79.727691] RSP: 002b:00007ffe7b02f3a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 79.728330] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fac6e8fb40e
[ 79.728912] RDX: 0000000000020000 RSI: 00007fac6e7ef000 RDI: 0000000000000003
[ 79.729478] RBP: 00007fac6e7ef000 R08: 00007fac6e7ee010 R09: 0000000000000000
[ 79.730044] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 79.734429] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 79.735093] </TASK>
[ 79.735397]
[ 79.735659] Allocated by task 4436:
[ 79.736066] kasan_save_stack+0x20/0x40
[ 79.736488] kasan_save_track+0x14/0x30
[ 79.736869] __kasan_kmalloc+0x8f/0xa0
[ 79.737237] user_event_parse_cmd+0x55e/0x25a0
[ 79.737650] user_events_ioctl+0xa52/0x17f0
[ 79.738044] __x64_sys_ioctl+0x133/0x190
[ 79.738423] do_syscall_64+0x66/0x130
[ 79.738788] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.739245]
[ 79.739463] Freed by task 49:
[ 79.739778] kasan_save_stack+0x20/0x40
[ 79.740148] kasan_save_track+0x14/0x30
[ 79.740521] kasan_save_free_info+0x3b/0x60
[ 79.740920] poison_slab_object+0x10a/0x170
[ 79.741304] __kasan_slab_free+0x14/0x30
[ 79.741670] kfree+0xe0/0x2f0
[ 79.741965] destroy_user_event+0x305/0x450
[ 79.742339] delayed_destroy_user_event+0x5c/0xe0
[ 79.742744] process_one_work+0x81c/0x1970
[ 79.743111] worker_thread+0x608/0x1160
[ 79.743467] kthread+0x2be/0x3b0
[ 79.743784] ret_from_fork+0x2c/0x70
[ 79.744115] ret_from_fork_asm+0x1a/0x30
[ 79.744472]
[ 79.744675] Last potentially related work creation:
[ 79.745100] kasan_save_stack+0x20/0x40
[ 79.745451] __kasan_record_aux_stack+0x8e/0xa0
[ 79.745850] insert_work+0x20/0x1b0
[ 79.746180] __queue_work+0x67a/0xc60
[ 79.746519] queue_work_on+0x63/0x90
[ 79.746854] user_event_put+0x1f9/0x390
[ 79.747216] user_events_ioctl+0x11ed/0x17f0
[ 79.747601] __x64_sys_ioctl+0x133/0x190
[ 79.747960] do_syscall_64+0x66/0x130
[ 79.748303] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.748734]
[ 79.749193] The buggy address belongs to the object at ffff888001bd4c00
[ 79.749193] which belongs to the cache kmalloc-cg-512 of size 512
[ 79.750159] The buggy address is located 112 bytes inside of
[ 79.750159] freed 512-byte region [ffff888001bd4c00, ffff888001bd4e00)
[ 79.751112]
[ 79.751323] The buggy address belongs to the physical page:
[ 79.751814] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1bd4
[ 79.752488] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 79.753150] memcg:ffff888004b9e101
[ 79.753499] anon flags: 0x40(head|zone=0)
[ 79.753883] page_type: 0xffffefff(slab)
[ 79.754259] raw: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 79.754926] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 79.755598] head: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 79.756272] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 79.756948] head: 0000000000000002 ffffea000006f501 ffffffffffffffff 0000000000000000
[ 79.757613] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 79.758268] page dumped because: kasan: bad access detected
[ 79.758730]
[ 79.758930] Memory state around the buggy address:
[ 79.759347] ffff888001bd4b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 79.759943] ffff888001bd4b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 79.760545] >ffff888001bd4c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.761158] ^
[ 79.761715] ffff888001bd4c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.762308] ffff888001bd4d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.762901] ==================================================================
[ 79.763532] ==================================================================
[ 79.764172] BUG: KASAN: slab-use-after-free in f_start+0x2cb/0x3d0
[ 79.764707] Read of size 8 at addr ffff888001bd4d08 by task cat/4437
[ 79.765263]
[ 79.765474] CPU: 2 PID: 4437 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 79.766165] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 79.767089] Call Trace:
[ 79.767371] <TASK>
[ 79.767623] dump_stack_lvl+0x66/0xa0
[ 79.767988] print_report+0xd0/0x630
[ 79.768343] ? f_start+0x2cb/0x3d0
[ 79.768688] ? __virt_addr_valid+0x208/0x3f0
[ 79.769097] ? f_start+0x2cb/0x3d0
[ 79.769446] kasan_report+0xd8/0x110
[ 79.769812] ? f_start+0x2cb/0x3d0
[ 79.770165] f_start+0x2cb/0x3d0
[ 79.770505] seq_read_iter+0x268/0x11e0
[ 79.770884] ? lock_release+0x453/0x600
[ 79.771259] seq_read+0x261/0x350
[ 79.771599] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 79.772041] ? __pfx_seq_read+0x10/0x10
[ 79.772417] ? trace_irq_enable.constprop.0+0xce/0x110
[ 79.772889] vfs_read+0x171/0x9e0
[ 79.773233] ? lock_acquire+0x408/0x4b0
[ 79.773610] ? __pfx_vfs_read+0x10/0x10
[ 79.773984] ? lock_release+0x453/0x600
[ 79.774358] ? __pfx___up_read+0x10/0x10
[ 79.774755] ksys_read+0xdd/0x1a0
[ 79.775136] ? __pfx_ksys_read+0x10/0x10
[ 79.775539] ? trace_irq_enable.constprop.0+0xce/0x110
[ 79.776011] do_syscall_64+0x66/0x130
[ 79.776377] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.776840] RIP: 0033:0x7fac6e8fb40e
[ 79.777193] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 79.778648] RSP: 002b:00007ffe7b02f3a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 79.779572] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fac6e8fb40e
[ 79.780178] RDX: 0000000000020000 RSI: 00007fac6e7ef000 RDI: 0000000000000003
[ 79.780788] RBP: 00007fac6e7ef000 R08: 00007fac6e7ee010 R09: 0000000000000000
[ 79.781381] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 79.781956] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 79.782529] </TASK>
[ 79.782775]
[ 79.782974] Allocated by task 4436:
[ 79.783310] kasan_save_stack+0x20/0x40
[ 79.783668] kasan_save_track+0x14/0x30
[ 79.784021] __kasan_kmalloc+0x8f/0xa0
[ 79.784366] user_event_parse_cmd+0x55e/0x25a0
[ 79.784789] user_events_ioctl+0xa52/0x17f0
[ 79.785185] __x64_sys_ioctl+0x133/0x190
[ 79.785571] do_syscall_64+0x66/0x130
[ 79.785941] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.786404]
[ 79.786614] Freed by task 49:
[ 79.786931] kasan_save_stack+0x20/0x40
[ 79.787312] kasan_save_track+0x14/0x30
[ 79.787686] kasan_save_free_info+0x3b/0x60
[ 79.788085] poison_slab_object+0x10a/0x170
[ 79.788483] __kasan_slab_free+0x14/0x30
[ 79.788874] kfree+0xe0/0x2f0
[ 79.789195] destroy_user_event+0x305/0x450
[ 79.789595] delayed_destroy_user_event+0x5c/0xe0
[ 79.790034] process_one_work+0x81c/0x1970
[ 79.790422] worker_thread+0x608/0x1160
[ 79.790791] kthread+0x2be/0x3b0
[ 79.791129] ret_from_fork+0x2c/0x70
[ 79.791485] ret_from_fork_asm+0x1a/0x30
[ 79.791850]
[ 79.792051] Last potentially related work creation:
[ 79.792474] kasan_save_stack+0x20/0x40
[ 79.792853] __kasan_record_aux_stack+0x8e/0xa0
[ 79.793256] insert_work+0x20/0x1b0
[ 79.793589] __queue_work+0x67a/0xc60
[ 79.793933] queue_work_on+0x63/0x90
[ 79.794268] user_event_put+0x1f9/0x390
[ 79.794625] user_events_ioctl+0x11ed/0x17f0
[ 79.795008] __x64_sys_ioctl+0x133/0x190
[ 79.795366] do_syscall_64+0x66/0x130
[ 79.795707] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.796143]
[ 79.796344] The buggy address belongs to the object at ffff888001bd4c00
[ 79.796344] which belongs to the cache kmalloc-cg-512 of size 512
[ 79.797323] The buggy address is located 264 bytes inside of
[ 79.797323] freed 512-byte region [ffff888001bd4c00, ffff888001bd4e00)
[ 79.798244]
[ 79.798448] The buggy address belongs to the physical page:
[ 79.798912] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1bd4
[ 79.799551] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 79.800174] memcg:ffff888004b9e101
[ 79.800499] anon flags: 0x40(head|zone=0)
[ 79.800887] page_type: 0xffffefff(slab)
[ 79.801260] raw: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 79.805796] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 79.806457] head: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 79.807130] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 79.807802] head: 0000000000000002 ffffea000006f501 ffffffffffffffff 0000000000000000
[ 79.808470] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 79.809510] page dumped because: kasan: bad access detected
[ 79.810002]
[ 79.810201] Memory state around the buggy address:
[ 79.810619] ffff888001bd4c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.811220] ffff888001bd4c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.811817] >ffff888001bd4d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.812414] ^
[ 79.812756] ffff888001bd4d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.813355] ffff888001bd4e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 79.813955] ==================================================================
[ 79.814611] ==================================================================
[ 79.815240] BUG: KASAN: slab-use-after-free in user_event_get_fields+0x38/0x40
[ 79.815841] Read of size 8 at addr ffff888001bd4cb8 by task cat/4437
[ 79.816362]
[ 79.816563] CPU: 2 PID: 4437 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 79.817231] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 79.818104] Call Trace:
[ 79.818365] <TASK>
[ 79.818618] dump_stack_lvl+0x66/0xa0
[ 79.818978] print_report+0xd0/0x630
[ 79.819336] ? user_event_get_fields+0x38/0x40
[ 79.819754] ? __virt_addr_valid+0x208/0x3f0
[ 79.820161] ? user_event_get_fields+0x38/0x40
[ 79.820578] kasan_report+0xd8/0x110
[ 79.820940] ? user_event_get_fields+0x38/0x40
[ 79.821362] user_event_get_fields+0x38/0x40
[ 79.821768] f_start+0x175/0x3d0
[ 79.822105] seq_read_iter+0x268/0x11e0
[ 79.822486] ? lock_release+0x453/0x600
[ 79.822863] seq_read+0x261/0x350
[ 79.823203] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 79.823630] ? __pfx_seq_read+0x10/0x10
[ 79.824011] ? trace_irq_enable.constprop.0+0xce/0x110
[ 79.824473] vfs_read+0x171/0x9e0
[ 79.824818] ? lock_acquire+0x408/0x4b0
[ 79.825196] ? __pfx_vfs_read+0x10/0x10
[ 79.825573] ? lock_release+0x453/0x600
[ 79.825934] ? __pfx___up_read+0x10/0x10
[ 79.826292] ksys_read+0xdd/0x1a0
[ 79.826612] ? __pfx_ksys_read+0x10/0x10
[ 79.826976] ? trace_irq_enable.constprop.0+0xce/0x110
[ 79.827419] do_syscall_64+0x66/0x130
[ 79.827763] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.828199] RIP: 0033:0x7fac6e8fb40e
[ 79.828540] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 79.829912] RSP: 002b:00007ffe7b02f3a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 79.830535] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fac6e8fb40e
[ 79.831104] RDX: 0000000000020000 RSI: 00007fac6e7ef000 RDI: 0000000000000003
[ 79.831677] RBP: 00007fac6e7ef000 R08: 00007fac6e7ee010 R09: 0000000000000000
[ 79.832245] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 79.832822] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 79.833406] </TASK>
[ 79.833655]
[ 79.833858] Allocated by task 4436:
[ 79.834191] kasan_save_stack+0x20/0x40
[ 79.834548] kasan_save_track+0x14/0x30
[ 79.834903] __kasan_kmalloc+0x8f/0xa0
[ 79.835251] user_event_parse_cmd+0x55e/0x25a0
[ 79.835645] user_events_ioctl+0xa52/0x17f0
[ 79.836045] __x64_sys_ioctl+0x133/0x190
[ 79.836428] do_syscall_64+0x66/0x130
[ 79.836800] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.837273]
[ 79.837488] Freed by task 49:
[ 79.837806] kasan_save_stack+0x20/0x40
[ 79.838184] kasan_save_track+0x14/0x30
[ 79.838564] kasan_save_free_info+0x3b/0x60
[ 79.839213] poison_slab_object+0x10a/0x170
[ 79.839626] __kasan_slab_free+0x14/0x30
[ 79.840006] kfree+0xe0/0x2f0
[ 79.840326] destroy_user_event+0x305/0x450
[ 79.840722] delayed_destroy_user_event+0x5c/0xe0
[ 79.841168] process_one_work+0x81c/0x1970
[ 79.841568] worker_thread+0x608/0x1160
[ 79.841936] kthread+0x2be/0x3b0
[ 79.842263] ret_from_fork+0x2c/0x70
[ 79.842601] ret_from_fork_asm+0x1a/0x30
[ 79.842968]
[ 79.843170] Last potentially related work creation:
[ 79.843592] kasan_save_stack+0x20/0x40
[ 79.843949] __kasan_record_aux_stack+0x8e/0xa0
[ 79.844350] insert_work+0x20/0x1b0
[ 79.844682] __queue_work+0x67a/0xc60
[ 79.845030] queue_work_on+0x63/0x90
[ 79.845369] user_event_put+0x1f9/0x390
[ 79.845721] user_events_ioctl+0x11ed/0x17f0
[ 79.846103] __x64_sys_ioctl+0x133/0x190
[ 79.846467] do_syscall_64+0x66/0x130
[ 79.846808] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.847241]
[ 79.847441] The buggy address belongs to the object at ffff888001bd4c00
[ 79.847441] which belongs to the cache kmalloc-cg-512 of size 512
[ 79.848398] The buggy address is located 184 bytes inside of
[ 79.848398] freed 512-byte region [ffff888001bd4c00, ffff888001bd4e00)
[ 79.849330]
[ 79.849535] The buggy address belongs to the physical page:
[ 79.850000] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1bd4
[ 79.850641] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 79.851272] memcg:ffff888004b9e101
[ 79.851596] anon flags: 0x40(head|zone=0)
[ 79.851961] page_type: 0xffffefff(slab)
[ 79.852334] raw: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 79.853003] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 79.853677] head: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 79.854355] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 79.855040] head: 0000000000000002 ffffea000006f501 ffffffffffffffff 0000000000000000
[ 79.855720] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 79.856397] page dumped because: kasan: bad access detected
[ 79.856892]
[ 79.857109] Memory state around the buggy address:
[ 79.857547] ffff888001bd4b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 79.858176] ffff888001bd4c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.858809] >ffff888001bd4c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.859416] ^
[ 79.859842] ffff888001bd4d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.860441] ffff888001bd4d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.861043] ==================================================================
[ 79.861721] ==================================================================
[ 79.862335] BUG: KASAN: slab-use-after-free in f_start+0x2f8/0x3d0
[ 79.862847] Read of size 8 at addr ffff888001bd4d58 by task cat/4437
[ 79.863366]
[ 79.863568] CPU: 2 PID: 4437 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 79.864217] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 79.865116] Call Trace:
[ 79.865392] <TASK>
[ 79.865642] dump_stack_lvl+0x66/0xa0
[ 79.866012] print_report+0xd0/0x630
[ 79.866372] ? f_start+0x2f8/0x3d0
[ 79.866719] ? __virt_addr_valid+0x208/0x3f0
[ 79.867126] ? f_start+0x2f8/0x3d0
[ 79.867471] kasan_report+0xd8/0x110
[ 79.867826] ? f_start+0x2f8/0x3d0
[ 79.868173] f_start+0x2f8/0x3d0
[ 79.868511] seq_read_iter+0x268/0x11e0
[ 79.869069] ? lock_release+0x453/0x600
[ 79.869442] seq_read+0x261/0x350
[ 79.869780] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 79.870215] ? __pfx_seq_read+0x10/0x10
[ 79.870594] ? trace_irq_enable.constprop.0+0xce/0x110
[ 79.874930] vfs_read+0x171/0x9e0
[ 79.875275] ? lock_acquire+0x408/0x4b0
[ 79.875675] ? __pfx_vfs_read+0x10/0x10
[ 79.876125] ? lock_release+0x453/0x600
[ 79.876495] ? __pfx___up_read+0x10/0x10
[ 79.876877] ksys_read+0xdd/0x1a0
[ 79.877200] ? __pfx_ksys_read+0x10/0x10
[ 79.877558] ? trace_irq_enable.constprop.0+0xce/0x110
[ 79.878000] do_syscall_64+0x66/0x130
[ 79.878346] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.878784] RIP: 0033:0x7fac6e8fb40e
[ 79.879120] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 79.880489] RSP: 002b:00007ffe7b02f3a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 79.881128] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fac6e8fb40e
[ 79.881698] RDX: 0000000000020000 RSI: 00007fac6e7ef000 RDI: 0000000000000003
[ 79.882264] RBP: 00007fac6e7ef000 R08: 00007fac6e7ee010 R09: 0000000000000000
[ 79.882837] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 79.883405] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 79.883975] </TASK>
[ 79.884223]
[ 79.884424] Allocated by task 4436:
[ 79.884758] kasan_save_stack+0x20/0x40
[ 79.885132] kasan_save_track+0x14/0x30
[ 79.885506] __kasan_kmalloc+0x8f/0xa0
[ 79.885876] user_event_parse_cmd+0x55e/0x25a0
[ 79.886300] user_events_ioctl+0xa52/0x17f0
[ 79.886699] __x64_sys_ioctl+0x133/0x190
[ 79.887078] do_syscall_64+0x66/0x130
[ 79.887439] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.887901]
[ 79.888115] Freed by task 49:
[ 79.888430] kasan_save_stack+0x20/0x40
[ 79.888813] kasan_save_track+0x14/0x30
[ 79.889188] kasan_save_free_info+0x3b/0x60
[ 79.889584] poison_slab_object+0x10a/0x170
[ 79.889979] __kasan_slab_free+0x14/0x30
[ 79.890360] kfree+0xe0/0x2f0
[ 79.890676] destroy_user_event+0x305/0x450
[ 79.891071] delayed_destroy_user_event+0x5c/0xe0
[ 79.891505] process_one_work+0x81c/0x1970
[ 79.891897] worker_thread+0x608/0x1160
[ 79.892271] kthread+0x2be/0x3b0
[ 79.892584] ret_from_fork+0x2c/0x70
[ 79.892930] ret_from_fork_asm+0x1a/0x30
[ 79.893290]
[ 79.893491] Last potentially related work creation:
[ 79.893915] kasan_save_stack+0x20/0x40
[ 79.894268] __kasan_record_aux_stack+0x8e/0xa0
[ 79.894665] insert_work+0x20/0x1b0
[ 79.894996] __queue_work+0x67a/0xc60
[ 79.895344] queue_work_on+0x63/0x90
[ 79.895679] user_event_put+0x1f9/0x390
[ 79.896034] user_events_ioctl+0x11ed/0x17f0
[ 79.896418] __x64_sys_ioctl+0x133/0x190
[ 79.896782] do_syscall_64+0x66/0x130
[ 79.897122] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.897556]
[ 79.897756] The buggy address belongs to the object at ffff888001bd4c00
[ 79.897756] which belongs to the cache kmalloc-cg-512 of size 512
[ 79.898709] The buggy address is located 344 bytes inside of
[ 79.898709] freed 512-byte region [ffff888001bd4c00, ffff888001bd4e00)
[ 79.899830]
[ 79.900034] The buggy address belongs to the physical page:
[ 79.900498] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1bd4
[ 79.901149] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 79.901776] memcg:ffff888004b9e101
[ 79.902102] anon flags: 0x40(head|zone=0)
[ 79.902483] page_type: 0xffffefff(slab)
[ 79.902859] raw: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 79.903530] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 79.904200] head: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 79.904881] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 79.905559] head: 0000000000000002 ffffea000006f501 ffffffffffffffff 0000000000000000
[ 79.906231] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 79.906909] page dumped because: kasan: bad access detected
[ 79.907402]
[ 79.907619] Memory state around the buggy address:
[ 79.908058] ffff888001bd4c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.908691] ffff888001bd4c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.909323] >ffff888001bd4d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.909930] ^
[ 79.910429] ffff888001bd4d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.911027] ffff888001bd4e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 79.911628] ==================================================================
[ 79.912279] ==================================================================
[ 79.912920] BUG: KASAN: slab-use-after-free in f_start+0x2e4/0x3d0
[ 79.913473] Read of size 8 at addr ffff888001bd4c70 by task cat/4437
[ 79.914022]
[ 79.914237] CPU: 2 PID: 4437 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 79.914922] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 79.915843] Call Trace:
[ 79.916116] <TASK>
[ 79.916375] dump_stack_lvl+0x66/0xa0
[ 79.916743] print_report+0xd0/0x630
[ 79.917097] ? f_start+0x2e4/0x3d0
[ 79.917441] ? __virt_addr_valid+0x208/0x3f0
[ 79.917847] ? f_start+0x2e4/0x3d0
[ 79.918192] kasan_report+0xd8/0x110
[ 79.918546] ? f_start+0x2e4/0x3d0
[ 79.918893] f_start+0x2e4/0x3d0
[ 79.919229] seq_read_iter+0x268/0x11e0
[ 79.919602] ? lock_release+0x453/0x600
[ 79.919985] seq_read+0x261/0x350
[ 79.920335] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 79.920779] ? __pfx_seq_read+0x10/0x10
[ 79.921152] ? trace_irq_enable.constprop.0+0xce/0x110
[ 79.921624] vfs_read+0x171/0x9e0
[ 79.921968] ? lock_acquire+0x408/0x4b0
[ 79.922346] ? __pfx_vfs_read+0x10/0x10
[ 79.922725] ? lock_release+0x453/0x600
[ 79.923102] ? __pfx___up_read+0x10/0x10
[ 79.923483] ksys_read+0xdd/0x1a0
[ 79.923823] ? __pfx_ksys_read+0x10/0x10
[ 79.924206] ? trace_irq_enable.constprop.0+0xce/0x110
[ 79.924676] do_syscall_64+0x66/0x130
[ 79.925055] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.925523] RIP: 0033:0x7fac6e8fb40e
[ 79.925881] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 79.927336] RSP: 002b:00007ffe7b02f3a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 79.927993] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fac6e8fb40e
[ 79.928595] RDX: 0000000000020000 RSI: 00007fac6e7ef000 RDI: 0000000000000003
[ 79.929536] RBP: 00007fac6e7ef000 R08: 00007fac6e7ee010 R09: 0000000000000000
[ 79.930153] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 79.930747] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 79.931343] </TASK>
[ 79.931601]
[ 79.931813] Allocated by task 4436:
[ 79.932161] kasan_save_stack+0x20/0x40
[ 79.932532] kasan_save_track+0x14/0x30
[ 79.932912] __kasan_kmalloc+0x8f/0xa0
[ 79.933279] user_event_parse_cmd+0x55e/0x25a0
[ 79.933695] user_events_ioctl+0xa52/0x17f0
[ 79.934088] __x64_sys_ioctl+0x133/0x190
[ 79.934468] do_syscall_64+0x66/0x130
[ 79.934828] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.935286]
[ 79.935498] Freed by task 49:
[ 79.935816] kasan_save_stack+0x20/0x40
[ 79.936186] kasan_save_track+0x14/0x30
[ 79.936559] kasan_save_free_info+0x3b/0x60
[ 79.936960] poison_slab_object+0x10a/0x170
[ 79.937354] __kasan_slab_free+0x14/0x30
[ 79.937730] kfree+0xe0/0x2f0
[ 79.938046] destroy_user_event+0x305/0x450
[ 79.938446] delayed_destroy_user_event+0x5c/0xe0
[ 79.938877] process_one_work+0x81c/0x1970
[ 79.939266] worker_thread+0x608/0x1160
[ 79.939638] kthread+0x2be/0x3b0
[ 79.939973] ret_from_fork+0x2c/0x70
[ 79.940334] ret_from_fork_asm+0x1a/0x30
[ 79.940717]
[ 79.940932] Last potentially related work creation:
[ 79.941375] kasan_save_stack+0x20/0x40
[ 79.941750] __kasan_record_aux_stack+0x8e/0xa0
[ 79.942171] insert_work+0x20/0x1b0
[ 79.942518] __queue_work+0x67a/0xc60
[ 79.942876] queue_work_on+0x63/0x90
[ 79.947065] user_event_put+0x1f9/0x390
[ 79.947443] user_events_ioctl+0x11ed/0x17f0
[ 79.947845] __x64_sys_ioctl+0x133/0x190
[ 79.948226] do_syscall_64+0x66/0x130
[ 79.948584] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.949049]
[ 79.949262] The buggy address belongs to the object at ffff888001bd4c00
[ 79.949262] which belongs to the cache kmalloc-cg-512 of size 512
[ 79.950277] The buggy address is located 112 bytes inside of
[ 79.950277] freed 512-byte region [ffff888001bd4c00, ffff888001bd4e00)
[ 79.951251]
[ 79.951463] The buggy address belongs to the physical page:
[ 79.951960] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1bd4
[ 79.952628] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 79.953296] memcg:ffff888004b9e101
[ 79.953636] anon flags: 0x40(head|zone=0)
[ 79.954021] page_type: 0xffffefff(slab)
[ 79.954396] raw: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 79.955062] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 79.955732] head: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 79.956403] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 79.957081] head: 0000000000000002 ffffea000006f501 ffffffffffffffff 0000000000000000
[ 79.957757] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 79.958423] page dumped because: kasan: bad access detected
[ 79.959115]
[ 79.959329] Memory state around the buggy address:
[ 79.959768] ffff888001bd4b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 79.960394] ffff888001bd4b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 79.961030] >ffff888001bd4c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.961663] ^
[ 79.962245] ffff888001bd4c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.962873] ffff888001bd4d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 79.963504] ==================================================================
[ 79.964183] ==================================================================
[ 79.964822] BUG: KASAN: slab-use-after-free in f_start+0x2cb/0x3d0
[ 79.965353] Read of size 8 at addr ffff888001bd4d08 by task cat/4437
[ 79.965900]
[ 79.966115] CPU: 2 PID: 4437 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 79.966796] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 79.967720] Call Trace:
[ 79.967997] <TASK>
[ 79.968247] dump_stack_lvl+0x66/0xa0
[ 79.968613] print_report+0xd0/0x630
[ 79.968972] ? f_start+0x2cb/0x3d0
[ 79.969316] ? __virt_addr_valid+0x208/0x3f0
[ 79.969723] ? f_start+0x2cb/0x3d0
[ 79.970066] kasan_report+0xd8/0x110
[ 79.970419] ? f_start+0x2cb/0x3d0
[ 79.970766] f_start+0x2cb/0x3d0
[ 79.971100] seq_read_iter+0x268/0x11e0
[ 79.971471] ? lock_release+0x453/0x600
[ 79.971847] seq_read+0x261/0x350
[ 79.972189] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 79.972614] ? __pfx_seq_read+0x10/0x10
[ 79.972991] ? trace_irq_enable.constprop.0+0xce/0x110
[ 79.973458] vfs_read+0x171/0x9e0
[ 79.973797] ? lock_acquire+0x408/0x4b0
[ 79.974172] ? __pfx_vfs_read+0x10/0x10
[ 79.974547] ? lock_release+0x453/0x600
[ 79.974923] ? __pfx___up_read+0x10/0x10
[ 79.975301] ksys_read+0xdd/0x1a0
[ 79.975639] ? __pfx_ksys_read+0x10/0x10
[ 79.976020] ? trace_irq_enable.constprop.0+0xce/0x110
[ 79.976485] do_syscall_64+0x66/0x130
[ 79.976846] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.977310] RIP: 0033:0x7fac6e8fb40e
[ 79.977669] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 79.979114] RSP: 002b:00007ffe7b02f3a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 79.979772] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fac6e8fb40e
[ 79.980381] RDX: 0000000000020000 RSI: 00007fac6e7ef000 RDI: 0000000000000003
[ 79.980990] RBP: 00007fac6e7ef000 R08: 00007fac6e7ee010 R09: 0000000000000000
[ 79.981588] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 79.982191] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 79.982792] </TASK>
[ 79.983053]
[ 79.983266] Allocated by task 4436:
[ 79.983613] kasan_save_stack+0x20/0x40
[ 79.983990] kasan_save_track+0x14/0x30
[ 79.984362] __kasan_kmalloc+0x8f/0xa0
[ 79.984729] user_event_parse_cmd+0x55e/0x25a0
[ 79.985155] user_events_ioctl+0xa52/0x17f0
[ 79.985548] __x64_sys_ioctl+0x133/0x190
[ 79.985930] do_syscall_64+0x66/0x130
[ 79.986293] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.986747]
[ 79.986959] Freed by task 49:
[ 79.987276] kasan_save_stack+0x20/0x40
[ 79.987647] kasan_save_track+0x14/0x30
[ 79.988020] kasan_save_free_info+0x3b/0x60
[ 79.988419] poison_slab_object+0x10a/0x170
[ 79.989022] __kasan_slab_free+0x14/0x30
[ 79.989409] kfree+0xe0/0x2f0
[ 79.989732] destroy_user_event+0x305/0x450
[ 79.990130] delayed_destroy_user_event+0x5c/0xe0
[ 79.990562] process_one_work+0x81c/0x1970
[ 79.990953] worker_thread+0x608/0x1160
[ 79.991329] kthread+0x2be/0x3b0
[ 79.991661] ret_from_fork+0x2c/0x70
[ 79.992015] ret_from_fork_asm+0x1a/0x30
[ 79.992394]
[ 79.992606] Last potentially related work creation:
[ 79.993059] kasan_save_stack+0x20/0x40
[ 79.993439] __kasan_record_aux_stack+0x8e/0xa0
[ 79.993859] insert_work+0x20/0x1b0
[ 79.994206] __queue_work+0x67a/0xc60
[ 79.994567] queue_work_on+0x63/0x90
[ 79.994920] user_event_put+0x1f9/0x390
[ 79.995289] user_events_ioctl+0x11ed/0x17f0
[ 79.995695] __x64_sys_ioctl+0x133/0x190
[ 79.996076] do_syscall_64+0x66/0x130
[ 79.996437] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 79.996896]
[ 79.997109] The buggy address belongs to the object at ffff888001bd4c00
[ 79.997109] which belongs to the cache kmalloc-cg-512 of size 512
[ 79.998122] The buggy address is located 264 bytes inside of
[ 79.998122] freed 512-byte region [ffff888001bd4c00, ffff888001bd4e00)
[ 79.999094]
[ 79.999309] The buggy address belongs to the physical page:
[ 79.999801] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1bd4
[ 80.000475] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 80.001143] memcg:ffff888004b9e101
[ 80.001486] anon flags: 0x40(head|zone=0)
[ 80.001871] page_type: 0xffffefff(slab)
[ 80.002226] raw: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 80.002861] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 80.003490] head: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 80.004129] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 80.004774] head: 0000000000000002 ffffea000006f501 ffffffffffffffff 0000000000000000
[ 80.005417] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 80.006063] page dumped because: kasan: bad access detected
[ 80.006528]
[ 80.006727] Memory state around the buggy address:
[ 80.007148] ffff888001bd4c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 80.007754] ffff888001bd4c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 80.008353] >ffff888001bd4d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 80.008961] ^
[ 80.009295] ffff888001bd4d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 80.009893] ffff888001bd4e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 80.010494] ==================================================================
[ 80.011109] ==================================================================
[ 80.011732] BUG: KASAN: slab-use-after-free in user_event_get_fields+0x38/0x40
[ 80.012332] Read of size 8 at addr ffff888001bd4cb8 by task cat/4437
[ 80.012864]
[ 80.013069] CPU: 2 PID: 4437 Comm: cat Tainted: G B D N 6.10.0-vanilla+ #34
[ 80.017381] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.3-0-ga6ed6b701f0a-prebuilt.qemu.org 04/01/2014
[ 80.018258] Call Trace:
[ 80.018521] <TASK>
[ 80.018761] dump_stack_lvl+0x66/0xa0
[ 80.019312] print_report+0xd0/0x630
[ 80.019656] ? user_event_get_fields+0x38/0x40
[ 80.020050] ? __virt_addr_valid+0x208/0x3f0
[ 80.020433] ? user_event_get_fields+0x38/0x40
[ 80.020838] kasan_report+0xd8/0x110
[ 80.021178] ? user_event_get_fields+0x38/0x40
[ 80.021577] user_event_get_fields+0x38/0x40
[ 80.021959] f_start+0x175/0x3d0
[ 80.022278] seq_read_iter+0x268/0x11e0
[ 80.022632] ? lock_release+0x453/0x600
[ 80.022993] seq_read+0x261/0x350
[ 80.023314] ? file_tty_write.isra.0+0x4f9/0x8b0
[ 80.023721] ? __pfx_seq_read+0x10/0x10
[ 80.024075] ? trace_irq_enable.constprop.0+0xce/0x110
[ 80.024516] vfs_read+0x171/0x9e0
[ 80.024843] ? lock_acquire+0x408/0x4b0
[ 80.025196] ? __pfx_vfs_read+0x10/0x10
[ 80.025549] ? lock_release+0x453/0x600
[ 80.025906] ? __pfx___up_read+0x10/0x10
[ 80.026270] ksys_read+0xdd/0x1a0
[ 80.026589] ? __pfx_ksys_read+0x10/0x10
[ 80.026949] ? trace_irq_enable.constprop.0+0xce/0x110
[ 80.027391] do_syscall_64+0x66/0x130
[ 80.027736] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 80.028174] RIP: 0033:0x7fac6e8fb40e
[ 80.028510] Code: c0 e9 b6 fe ff ff 50 48 8d 3d 2e 08 0b 00 e8 69 01 02 00 66 0f 1f 84 00 00 00 00 00 64 8b 04 25 18 00 00 00 85 c0 75 14 0f 05 <48> 3d 00 f0 ff ff 77 5a c3 66 0f 1f 84 00 00 00 00 00 48 83 ec 28
[ 80.029885] RSP: 002b:00007ffe7b02f3a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 80.030509] RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 00007fac6e8fb40e
[ 80.031081] RDX: 0000000000020000 RSI: 00007fac6e7ef000 RDI: 0000000000000003
[ 80.031654] RBP: 00007fac6e7ef000 R08: 00007fac6e7ee010 R09: 0000000000000000
[ 80.032225] R10: fffffffffffffbc5 R11: 0000000000000246 R12: 0000000000000000
[ 80.032802] R13: 0000000000000003 R14: 0000000000020000 R15: 0000000000020000
[ 80.033376] </TASK>
[ 80.033623]
[ 80.033823] Allocated by task 4436:
[ 80.034156] kasan_save_stack+0x20/0x40
[ 80.034510] kasan_save_track+0x14/0x30
[ 80.034863] __kasan_kmalloc+0x8f/0xa0
[ 80.035212] user_event_parse_cmd+0x55e/0x25a0
[ 80.035616] user_events_ioctl+0xa52/0x17f0
[ 80.035990] __x64_sys_ioctl+0x133/0x190
[ 80.036347] do_syscall_64+0x66/0x130
[ 80.036690] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 80.037123]
[ 80.037325] Freed by task 49:
[ 80.037625] kasan_save_stack+0x20/0x40
[ 80.037977] kasan_save_track+0x14/0x30
[ 80.038330] kasan_save_free_info+0x3b/0x60
[ 80.038704] poison_slab_object+0x10a/0x170
[ 80.039080] __kasan_slab_free+0x14/0x30
[ 80.039440] kfree+0xe0/0x2f0
[ 80.039738] destroy_user_event+0x305/0x450
[ 80.040116] delayed_destroy_user_event+0x5c/0xe0
[ 80.040531] process_one_work+0x81c/0x1970
[ 80.040900] worker_thread+0x608/0x1160
[ 80.041251] kthread+0x2be/0x3b0
[ 80.041570] ret_from_fork+0x2c/0x70
[ 80.041908] ret_from_fork_asm+0x1a/0x30
[ 80.042264]
[ 80.042466] Last potentially related work creation:
[ 80.042884] kasan_save_stack+0x20/0x40
[ 80.043236] __kasan_record_aux_stack+0x8e/0xa0
[ 80.043639] insert_work+0x20/0x1b0
[ 80.043976] __queue_work+0x67a/0xc60
[ 80.044318] queue_work_on+0x63/0x90
[ 80.044653] user_event_put+0x1f9/0x390
[ 80.045012] user_events_ioctl+0x11ed/0x17f0
[ 80.045391] __x64_sys_ioctl+0x133/0x190
[ 80.045750] do_syscall_64+0x66/0x130
[ 80.046096] entry_SYSCALL_64_after_hwframe+0x71/0x79
[ 80.046533]
[ 80.046732] The buggy address belongs to the object at ffff888001bd4c00
[ 80.046732] which belongs to the cache kmalloc-cg-512 of size 512
[ 80.047689] The buggy address is located 184 bytes inside of
[ 80.047689] freed 512-byte region [ffff888001bd4c00, ffff888001bd4e00)
[ 80.048623]
[ 80.048962] The buggy address belongs to the physical page:
[ 80.049426] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1bd4
[ 80.050068] head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 80.050689] memcg:ffff888004b9e101
[ 80.051014] anon flags: 0x40(head|zone=0)
[ 80.051377] page_type: 0xffffefff(slab)
[ 80.051730] raw: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 80.052364] raw: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 80.052996] head: 0000000000000040 ffff88800014cdc0 0000000000000000 dead000000000001
[ 80.053638] head: 0000000000000000 0000000080100010 00000001ffffefff ffff888004b9e101
[ 80.054275] head: 0000000000000002 ffffea000006f501 ffffffffffffffff 0000000000000000
[ 80.054915] head: ffff888000000004 0000000000000000 00000000ffffffff 0000000000000000
[ 80.055552] page dumped because: kasan: bad access detected
[ 80.056021]
[ 80.056221] Memory state around the buggy address:
[ 80.056639] ffff888001bd4b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 80.057243] ffff888001bd4c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 80.057842] >ffff888001bd4c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 80.058438] ^
[ 80.058869] ffff888001bd4d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 80.059471] ffff888001bd4d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[ 80.060068] ==================================================================
[-- Attachment #3: 6.10-tracefs_dbg.diff --]
[-- Type: text/x-patch, Size: 1881 bytes --]
diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c
index 5d88c184f0fc..6a698b524338 100644
--- a/fs/tracefs/event_inode.c
+++ b/fs/tracefs/event_inode.c
@@ -112,7 +112,7 @@ static void release_ei(struct kref *ref)
entry->release(entry->name, ei->data);
}
- call_rcu(&ei->rcu, free_ei_rcu);
+ call_srcu(&eventfs_srcu, &ei->rcu, free_ei_rcu);
}
static inline void put_ei(struct eventfs_inode *ei)
@@ -334,6 +334,7 @@ static struct inode *eventfs_get_inode(struct dentry *dentry, struct eventfs_att
ti = get_tracefs(inode);
ti->private = ei;
+ WARN(ti->flags, "ti-flags = %lx\n", ti->flags);
ti->flags |= TRACEFS_EVENT_INODE;
/* Find the top dentry that holds the "events" directory */
@@ -736,7 +737,7 @@ struct eventfs_inode *eventfs_create_dir(const char *name, struct eventfs_inode
/* Was the parent freed? */
if (list_empty(&ei->list)) {
cleanup_ei(ei);
- ei = NULL;
+ ei = ERR_PTR(-EBUSY);
}
return ei;
}
@@ -802,6 +803,7 @@ struct eventfs_inode *eventfs_create_events_dir(const char *name, struct dentry
INIT_LIST_HEAD(&ei->list);
ti = get_tracefs(inode);
+ WARN(ti->flags, "ti-flags = %lx\n", ti->flags);
ti->flags |= TRACEFS_EVENT_INODE;
ti->private = ei;
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index 6ef29eba90ce..5fbfa1c885de 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -1627,12 +1627,14 @@ static int f_show(struct seq_file *m, void *v)
static void *f_start(struct seq_file *m, loff_t *pos)
{
+ struct trace_event_file *file;
void *p = (void *)FORMAT_HEADER;
loff_t l = 0;
/* ->stop() is called even if ->start() fails */
mutex_lock(&event_mutex);
- if (!event_file_data(m->private))
+ file = event_file_data(m->private);
+ if (!file || (file->flags & EVENT_FILE_FL_FREED))
return ERR_PTR(-ENODEV);
while (l < *pos && p)
next prev parent reply other threads:[~2024-07-25 21:32 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-07-19 20:47 tracing: user events UAF crash report Mathias Krause
2024-07-20 3:33 ` Dan Carpenter
2024-07-22 11:13 ` Ajay Kaher
2024-07-22 12:08 ` Mathias Krause
2024-07-25 13:33 ` Ajay Kaher
2024-07-25 16:15 ` Ajay Kaher
2024-07-25 16:30 ` Ajay Kaher
2024-07-25 17:10 ` Steven Rostedt
2024-07-25 17:16 ` Steven Rostedt
2024-07-25 18:12 ` Mathias Krause
2024-07-25 19:05 ` Steven Rostedt
2024-07-25 19:42 ` Mathias Krause
2024-07-25 20:15 ` Steven Rostedt
2024-07-25 20:41 ` Mathias Krause
2024-07-25 21:14 ` Steven Rostedt
2024-07-25 21:32 ` Mathias Krause [this message]
2024-07-25 23:06 ` Steven Rostedt
2024-07-26 8:25 ` Mathias Krause
2024-07-25 19:53 ` Mathias Krause
2024-07-25 16:48 ` Steven Rostedt
2024-07-23 0:11 ` Steven Rostedt
2024-07-23 12:25 ` [PATCH] eventfs: Don't return NULL in eventfs_create_dir() Mathias Krause
2024-07-23 14:43 ` tracing: user events UAF crash report Steven Rostedt
2024-07-23 20:54 ` Mathias Krause
2024-07-23 21:07 ` [PATCH] eventfs: Use SRCU for freeing eventfs_inodes Mathias Krause
2024-07-23 21:23 ` Steven Rostedt
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=a7d66736-80d3-4f3d-9cca-ec46e019b4cb@grsecurity.net \
--to=minipli@grsecurity.net \
--cc=ajay.kaher@broadcom.com \
--cc=alexey.makhalov@broadcom.com \
--cc=beaub@linux.microsoft.com \
--cc=dan.carpenter@linaro.org \
--cc=digirigawa@gmail.com \
--cc=florian.fainelli@broadcom.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-trace-kernel@vger.kernel.org \
--cc=mhiramat@kernel.org \
--cc=regressions@leemhuis.info \
--cc=rostedt@goodmis.org \
--cc=torvalds@linux-foundation.org \
--cc=vasavi.sirnapalli@broadcom.com \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.