================================================================== BUG: KASAN: invalid-access in __lse_atomic_fetch_add_release arch/arm64/include/asm/atomic_lse.h:62 [inline] BUG: KASAN: invalid-access in __lse_atomic_fetch_sub_release arch/arm64/include/asm/atomic_lse.h:76 [inline] BUG: KASAN: invalid-access in arch_atomic_fetch_sub_release arch/arm64/include/asm/atomic.h:51 [inline] BUG: KASAN: invalid-access in raw_atomic_fetch_sub_release include/linux/atomic/atomic-arch-fallback.h:944 [inline] BUG: KASAN: invalid-access in atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:401 [inline] BUG: KASAN: invalid-access in __refcount_sub_and_test include/linux/refcount.h:389 [inline] BUG: KASAN: invalid-access in __refcount_dec_and_test include/linux/refcount.h:432 [inline] BUG: KASAN: invalid-access in refcount_dec_and_test include/linux/refcount.h:450 [inline] BUG: KASAN: invalid-access in put_dev+0x18/0x94 drivers/usb/gadget/legacy/inode.c:165 Read at addr f4f000000b9fa004 by task syz.4.5964/20651 Pointer tag: [f4], memory tag: [fb] CPU: 0 UID: 0 PID: 20651 Comm: syz.4.5964 Tainted: G L syzkaller #0 PREEMPT Tainted: [L]=SOFTLOCKUP Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace arch/arm64/kernel/stacktrace.c:498 [inline] (C) show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x60/0x80 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x1c4/0x4b0 mm/kasan/report.c:482 kasan_report+0x84/0xac mm/kasan/report.c:595 report_tag_fault arch/arm64/mm/fault.c:368 [inline] do_tag_recovery arch/arm64/mm/fault.c:380 [inline] __do_kernel_fault+0x1b4/0x220 arch/arm64/mm/fault.c:424 do_bad_area+0x68/0x80 arch/arm64/mm/fault.c:529 do_tag_check_fault+0x34/0x44 arch/arm64/mm/fault.c:909 do_mem_abort+0x40/0x90 arch/arm64/mm/fault.c:985 el1_abort+0x44/0x64 arch/arm64/kernel/entry-common.c:322 el1h_64_sync_handler+0x50/0xac arch/arm64/kernel/entry-common.c:449 el1h_64_sync+0x6c/0x70 arch/arm64/kernel/entry.S:589 __lse_atomic_fetch_add_release arch/arm64/include/asm/atomic_lse.h:62 [inline] (P) __lse_atomic_fetch_sub_release arch/arm64/include/asm/atomic_lse.h:76 [inline] (P) arch_atomic_fetch_sub_release arch/arm64/include/asm/atomic.h:51 [inline] (P) raw_atomic_fetch_sub_release include/linux/atomic/atomic-arch-fallback.h:944 [inline] (P) atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:401 [inline] (P) __refcount_sub_and_test include/linux/refcount.h:389 [inline] (P) __refcount_dec_and_test include/linux/refcount.h:432 [inline] (P) refcount_dec_and_test include/linux/refcount.h:450 [inline] (P) put_dev+0x18/0x94 drivers/usb/gadget/legacy/inode.c:165 (P) gadgetfs_kill_sb+0x38/0x60 drivers/usb/gadget/legacy/inode.c:2104 deactivate_locked_super+0x44/0xf8 fs/super.c:477 deactivate_super fs/super.c:510 [inline] deactivate_super+0x84/0xa0 fs/super.c:506 cleanup_mnt+0x100/0x154 fs/namespace.c:1317 __cleanup_mnt+0x14/0x20 fs/namespace.c:1324 task_work_run+0x70/0xe0 kernel/task_work.c:233 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0x280/0x94c kernel/exit.c:1009 do_group_exit+0x34/0x90 kernel/exit.c:1152 get_signal+0x79c/0x860 kernel/signal.c:3046 arch_do_signal_or_restart+0xf4/0x3dc arch/arm64/kernel/signal.c:1665 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline] exit_to_user_mode_loop+0x114/0x19c kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] arm64_syscall_exit_to_user_mode arch/arm64/kernel/entry-common.c:88 [inline] el0_svc+0x1f0/0x1fc arch/arm64/kernel/entry-common.c:737 el0t_64_sync_handler+0xa0/0xf0 arch/arm64/kernel/entry-common.c:755 el0t_64_sync+0x1a4/0x1a8 arch/arm64/kernel/entry.S:594 The buggy address belongs to the object at fff000000b9fa000 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 4 bytes inside of 352-byte region [fff000000b9fa000, fff000000b9fa160) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4b9fa head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x1ffc00000000040(head|node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0) page_type: f5(slab) raw: 01ffc00000000040 f4f0000003401900 dead000000000100 dead000000000122 raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 head: 01ffc00000000040 f4f0000003401900 dead000000000100 dead000000000122 head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 head: 01ffc00000000001 ffffc1ffc02e7e81 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 page dumped because: kasan: bad access detected Memory state around the buggy address: fff000000b9f9e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fff000000b9f9f00: fb fb fb fe fe fe fe fe fe fe fe fe fe fe fe fe >fff000000b9fa000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ fff000000b9fa100: fb fb fb fb fb fb fe fe fe fe fe fe fe fe fe fe fff000000b9fa200: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe ================================================================== ------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: lib/refcount.c:28 at refcount_warn_saturate+0xf4/0x144 lib/refcount.c:28, CPU#0: syz.4.5964/20651 Modules linked in: CPU: 0 UID: 0 PID: 20651 Comm: syz.4.5964 Tainted: G B L syzkaller #0 PREEMPT Tainted: [B]=BAD_PAGE, [L]=SOFTLOCKUP Hardware name: linux,dummy-virt (DT) pstate: 60402009 (nZCv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : refcount_warn_saturate+0xf4/0x144 lib/refcount.c:28 lr : refcount_warn_saturate+0xf4/0x144 lib/refcount.c:28 sp : ffff800083f03b70 x29: ffff800083f03b70 x28: f0f00000505c9960 x27: 0000000000000000 x26: 0000000000000000 x25: 0000000000000001 x24: f0f00000505c9700 x23: ffff800082de13c8 x22: f0f00000505c9100 x21: f0f00000505c99cc x20: f1f0000008f02800 x19: ffff800082eac480 x18: 0000000000000014 x17: 0000000089f25411 x16: 00000000d4dd4a12 x15: 0000000063ecdf1e x14: 00000000000003d4 x13: 00000000bd08a39e x12: 000089935993ed60 x11: 00000000000000c0 x10: eab71fce230d2eed x9 : 6e03d9c486600dae x8 : f0f00000505ca178 x7 : 0000000000000004 x6 : 0000000000000000 x5 : f0f00000505c9100 x4 : fbffff3fffffffff x3 : 000000000000ffff x2 : 0000000000000000 x1 : 0000000000000000 x0 : f0f00000505c9100 Call trace: refcount_warn_saturate+0xf4/0x144 lib/refcount.c:28 (P) __refcount_sub_and_test include/linux/refcount.h:400 [inline] __refcount_dec_and_test include/linux/refcount.h:432 [inline] refcount_dec_and_test include/linux/refcount.h:450 [inline] put_dev+0x84/0x94 drivers/usb/gadget/legacy/inode.c:165 gadgetfs_kill_sb+0x38/0x60 drivers/usb/gadget/legacy/inode.c:2104 deactivate_locked_super+0x44/0xf8 fs/super.c:477 deactivate_super fs/super.c:510 [inline] deactivate_super+0x84/0xa0 fs/super.c:506 cleanup_mnt+0x100/0x154 fs/namespace.c:1317 __cleanup_mnt+0x14/0x20 fs/namespace.c:1324 task_work_run+0x70/0xe0 kernel/task_work.c:233 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0x280/0x94c kernel/exit.c:1009 do_group_exit+0x34/0x90 kernel/exit.c:1152 get_signal+0x79c/0x860 kernel/signal.c:3046 arch_do_signal_or_restart+0xf4/0x3dc arch/arm64/kernel/signal.c:1665 __exit_to_user_mode_loop kernel/entry/common.c:66 [inline] exit_to_user_mode_loop+0x114/0x19c kernel/entry/common.c:101 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:207 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:230 [inline] arm64_syscall_exit_to_user_mode arch/arm64/kernel/entry-common.c:88 [inline] el0_svc+0x1f0/0x1fc arch/arm64/kernel/entry-common.c:737 el0t_64_sync_handler+0xa0/0xf0 arch/arm64/kernel/entry-common.c:755 el0t_64_sync+0x1a4/0x1a8 arch/arm64/kernel/entry.S:594 ---[ end trace 0000000000000000 ]---