| FILE: fs/timerfd.c |
| |
| ================================================================== |
| BUG: KASAN: use-after-free in __list_add_rcu include/linux/rculist.h:57 [inline] at addr ffff8801c5b6c110 |
| BUG: KASAN: use-after-free in list_add_rcu include/linux/rculist.h:78 [inline] at addr ffff8801c5b6c110 |
| BUG: KASAN: use-after-free in timerfd_setup_cancel fs/timerfd.c:141 [inline] at addr ffff8801c5b6c110 |
| BUG: KASAN: use-after-free in do_timerfd_settime+0xd32/0xf50 fs/timerfd.c:446 at addr ffff8801c5b6c110 |
| Write of size 8 by task syz-executor5/10885 |
| CPU: 1 PID: 10885 Comm: syz-executor5 Not tainted 4.10.0+ #7 |
| Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 |
| Call Trace: |
| __dump_stack lib/dump_stack.c:15 [inline] |
| dump_stack+0x2ee/0x3ef lib/dump_stack.c:51 |
| kasan_object_err+0x1c/0x70 mm/kasan/report.c:162 |
| print_address_description mm/kasan/report.c:200 [inline] |
| kasan_report_error mm/kasan/report.c:289 [inline] |
| kasan_report.part.2+0x1e5/0x4b0 mm/kasan/report.c:311 |
| kasan_report mm/kasan/report.c:337 [inline] |
| __asan_report_store8_noabort+0x2c/0x30 mm/kasan/report.c:337 |
| __list_add_rcu include/linux/rculist.h:57 [inline] |
| list_add_rcu include/linux/rculist.h:78 [inline] |
| timerfd_setup_cancel fs/timerfd.c:141 [inline] |
| do_timerfd_settime+0xd32/0xf50 fs/timerfd.c:446 |
| SYSC_timerfd_settime fs/timerfd.c:533 [inline] |
| SyS_timerfd_settime+0xef/0x1c0 fs/timerfd.c:524 |
| entry_SYSCALL_64_fastpath+0x1f/0xc |
