1 FILE: fs/timerfd.c 2 3 ================================================================== 4 BUG: KASAN: use-after-free in __list_add_rcu include/linux/rculist.h:57 [inline] at addr ffff8801c5b6c110 5 BUG: KASAN: use-after-free in list_add_rcu include/linux/rculist.h:78 [inline] at addr ffff8801c5b6c110 6 BUG: KASAN: use-after-free in timerfd_setup_cancel fs/timerfd.c:141 [inline] at addr ffff8801c5b6c110 7 BUG: KASAN: use-after-free in do_timerfd_settime+0xd32/0xf50 fs/timerfd.c:446 at addr ffff8801c5b6c110 8 Write of size 8 by task syz-executor5/10885 9 CPU: 1 PID: 10885 Comm: syz-executor5 Not tainted 4.10.0+ #7 10 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 11 Call Trace: 12 __dump_stack lib/dump_stack.c:15 [inline] 13 dump_stack+0x2ee/0x3ef lib/dump_stack.c:51 14 kasan_object_err+0x1c/0x70 mm/kasan/report.c:162 15 print_address_description mm/kasan/report.c:200 [inline] 16 kasan_report_error mm/kasan/report.c:289 [inline] 17 kasan_report.part.2+0x1e5/0x4b0 mm/kasan/report.c:311 18 kasan_report mm/kasan/report.c:337 [inline] 19 __asan_report_store8_noabort+0x2c/0x30 mm/kasan/report.c:337 20 __list_add_rcu include/linux/rculist.h:57 [inline] 21 list_add_rcu include/linux/rculist.h:78 [inline] 22 timerfd_setup_cancel fs/timerfd.c:141 [inline] 23 do_timerfd_settime+0xd32/0xf50 fs/timerfd.c:446 24 SYSC_timerfd_settime fs/timerfd.c:533 [inline] 25 SyS_timerfd_settime+0xef/0x1c0 fs/timerfd.c:524 26 entry_SYSCALL_64_fastpath+0x1f/0xc 27
