TITLE: KASAN: use-after-free Read in selinux_inode_free_security
ALT: bad-access in selinux_inode_free_security
TYPE: KASAN-USE-AFTER-FREE-READ

[   70.363639] ==================================================================
[   70.371158] BUG: KASAN: use-after-free in do_raw_spin_lock+0x1aa/0x1e0
[   70.377908] Read of size 4 at addr ffff8801c5b1ddec by task syz-executor6/3887
[   70.385251] 
[   70.386868] CPU: 1 PID: 3887 Comm: syz-executor6 Not tainted 4.14.0-rc5+ #136
[   70.394123] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   70.403464] Call Trace:
[   70.406045]  dump_stack+0x194/0x257
[   70.409671]  ? arch_local_irq_restore+0x53/0x53
[   70.414330]  ? show_regs_print_info+0x65/0x65
[   70.418820]  ? perf_trace_lock_acquire+0xfe/0x900
[   70.423656]  ? do_raw_spin_lock+0x1aa/0x1e0
[   70.427972]  print_address_description+0x73/0x250
[   70.432808]  ? do_raw_spin_lock+0x1aa/0x1e0
[   70.437123]  kasan_report+0x25b/0x340
[   70.440924]  __asan_report_load4_noabort+0x14/0x20
[   70.445846]  do_raw_spin_lock+0x1aa/0x1e0
[   70.449994]  _raw_spin_lock+0x32/0x40
[   70.453784]  ? selinux_inode_free_security+0x12a/0x410
[   70.459044]  selinux_inode_free_security+0x12a/0x410
[   70.464125]  ? check_noncircular+0x20/0x20
[   70.468334]  ? selinux_socket_create+0x740/0x740
[   70.473073]  ? inode_has_buffers+0x60/0xd0
[   70.477280]  ? nobh_write_end+0x5d0/0x5d0
[   70.481408]  security_inode_free+0x50/0x90
[   70.485617]  __destroy_inode+0x287/0x650
[   70.489651]  ? inode_sb_list_add+0x320/0x320
[   70.494036]  ? evict+0x576/0x920
[   70.497379]  ? lock_downgrade+0x990/0x990
[   70.501507]  ? do_raw_spin_trylock+0x190/0x190
[   70.506064]  destroy_inode+0xe7/0x200
[   70.509839]  ? __destroy_inode+0x650/0x650
[   70.514061]  evict+0x57e/0x920
[   70.517234]  ? destroy_inode+0x200/0x200
[   70.521274]  ? iput+0x7b1/0xaf0
[   70.524526]  ? lock_downgrade+0x990/0x990
[   70.528655]  ? do_raw_spin_trylock+0x190/0x190
[   70.533211]  ? _atomic_dec_and_lock+0x125/0x196
[   70.537851]  ? _atomic_dec_and_lock+0xe8/0x196
[   70.542407]  ? cpumask_local_spread+0x250/0x250
[   70.547050]  ? lock_acquire+0x1d5/0x580
[   70.550993]  ? _atomic_dec_and_lock+0x125/0x196
[   70.555644]  iput+0x7b9/0xaf0
[   70.558724]  ? find_inode_nowait+0x180/0x180
[   70.563107]  ? evict_inodes+0x580/0x580
[   70.567052]  ? fsnotify_put_mark+0x4c1/0x730
[   70.571434]  ? lock_downgrade+0x990/0x990
[   70.575559]  ? do_raw_spin_trylock+0x190/0x190
[   70.580112]  ? __fsnotify_recalc_mask+0x340/0x340
[   70.584928]  ? _atomic_dec_and_lock+0xe8/0x196
[   70.589479]  ? put_ucounts+0x1ee/0x2d0
[   70.593340]  ? cpumask_local_spread+0x250/0x250
[   70.597984]  ? inotify_handle_event+0x22d/0x470
[   70.602635]  fsnotify_put_mark+0x4d0/0x730
[   70.606846]  ? fsnotify_recalc_mask+0x30/0x30
[   70.611314]  ? inotify_handle_event+0x1df/0x470
[   70.615967]  ? inotify_ignored_and_remove_idr+0x70/0x80
[   70.621305]  ? inotify_freeing_mark+0x1d/0x30
[   70.625772]  ? inotify_free_event+0x20/0x20
[   70.630071]  fsnotify_clear_marks_by_group+0x19a/0x5f0
[   70.635330]  ? fsnotify_find_mark+0x160/0x160
[   70.639794]  ? fsnotify_destroy_group+0xd1/0x3f0
[   70.644524]  ? lock_downgrade+0x990/0x990
[   70.648653]  ? do_raw_spin_trylock+0x190/0x190
[   70.653238]  fsnotify_destroy_group+0xde/0x3f0
[   70.657801]  ? fsnotify_put_group+0xa0/0xa0
[   70.662091]  ? locks_remove_file+0x3fa/0x5a0
[   70.666474]  ? fcntl_setlk+0x10c0/0x10c0
[   70.670512]  ? __fsnotify_parent+0xb4/0x3a0
[   70.674812]  ? fsnotify+0x1af0/0x1af0
[   70.678583]  ? dput.part.24+0x2a/0x740
[   70.682452]  ? idr_callback+0xc0/0xc0
[   70.686223]  inotify_release+0x37/0x50
[   70.690083]  __fput+0x327/0x7e0
[   70.693343]  ? fput+0x140/0x140
[   70.696599]  ? check_same_owner+0x320/0x320
[   70.700891]  ? _raw_spin_unlock_irq+0x27/0x70
[   70.705366]  ____fput+0x15/0x20
[   70.708617]  task_work_run+0x199/0x270
[   70.712480]  ? task_work_cancel+0x210/0x210
[   70.716772]  ? _raw_spin_unlock+0x22/0x30
[   70.720892]  ? switch_task_namespaces+0x87/0xc0
[   70.725540]  do_exit+0x9b5/0x1ad0
[   70.728961]  ? perf_trace_lock_acquire+0xfe/0x900
[   70.733785]  ? mm_update_next_owner+0x930/0x930
[   70.738432]  ? perf_trace_lock+0x860/0x860
[   70.742640]  ? check_same_owner+0x320/0x320
[   70.746935]  ? lock_acquire+0x1d5/0x580
[   70.750882]  ? futex_wait_setup+0x14a/0x3d0
[   70.755180]  ? __might_sleep+0x95/0x190
[   70.759136]  ? find_held_lock+0x35/0x1d0
[   70.763182]  ? futex_wait+0x402/0x990
[   70.766958]  ? perf_trace_lock+0xf1/0x860
[   70.771088]  ? check_noncircular+0x20/0x20
[   70.775296]  ? perf_trace_lock+0x860/0x860
[   70.779508]  ? perf_event_sync_stat+0x5c0/0x5c0
[   70.784157]  ? drop_futex_key_refs.isra.13+0x63/0xb0
[   70.789232]  ? futex_wait+0x69e/0x990
[   70.793022]  ? find_held_lock+0x35/0x1d0
[   70.797070]  ? get_signal+0x7ae/0x16d0
[   70.800929]  ? lock_downgrade+0x990/0x990
[   70.805065]  do_group_exit+0x149/0x400
[   70.808924]  ? __lock_is_held+0xb6/0x140
[   70.812954]  ? SyS_exit+0x30/0x30
[   70.816380]  ? _raw_spin_unlock_irq+0x27/0x70
[   70.820850]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   70.825844]  get_signal+0x73f/0x16d0
[   70.829547]  ? ptrace_notify+0x130/0x130
[   70.833591]  ? __schedule+0x8f3/0x2060
[   70.837460]  ? exit_robust_list+0x240/0x240
[   70.841750]  ? __sched_text_start+0x8/0x8
[   70.845872]  ? perf_trace_lock+0xf1/0x860
[   70.849990]  ? finish_task_switch+0x1aa/0x740
[   70.854470]  do_signal+0x94/0x1ee0
[   70.857989]  ? find_held_lock+0x35/0x1d0
[   70.862038]  ? setup_sigcontext+0x7d0/0x7d0
[   70.866331]  ? mntput_no_expire+0x130/0xa90
[   70.870624]  ? lock_downgrade+0x990/0x990
[   70.874751]  ? schedule+0xf5/0x430
[   70.878269]  ? __schedule+0x2060/0x2060
[   70.882227]  ? lock_downgrade+0x990/0x990
[   70.886355]  ? mntput_no_expire+0x15e/0xa90
[   70.890645]  ? check_same_owner+0x320/0x320
[   70.894936]  ? exit_to_usermode_loop+0x8c/0x310
[   70.899587]  exit_to_usermode_loop+0x214/0x310
[   70.904145]  ? trace_event_raw_event_sys_exit+0x260/0x260
[   70.909654]  ? dput.part.24+0x2a/0x740
[   70.913517]  ? dput.part.24+0x175/0x740
[   70.917479]  syscall_return_slowpath+0x42f/0x510
[   70.922209]  ? prepare_exit_to_usermode+0x2d0/0x2d0
[   70.927199]  ? entry_SYSCALL_64_fastpath+0x91/0xbe
[   70.932102]  ? trace_hardirqs_on_caller+0x421/0x5c0
[   70.937091]  ? trace_hardirqs_on_thunk+0x1a/0x1c
[   70.941831]  entry_SYSCALL_64_fastpath+0xbc/0xbe
[   70.946556] RIP: 0033:0x452779
[   70.949715] RSP: 002b:00007f6815b25ce8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[   70.957392] RAX: fffffffffffffe00 RBX: 00000000007581a0 RCX: 0000000000452779
[   70.964633] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000007581a0
[   70.971875] RBP: 00000000007581a0 R08: 000000000000018e R09: 0000000000758180
[   70.979117] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[   70.986359] R13: 0000000000a6f7ff R14: 00007f6815b269c0 R15: 000000000000001e
[   70.993627] 
[   70.995226] Allocated by task 3873:
[   70.998823]  save_stack_trace+0x16/0x20
[   71.002765]  save_stack+0x43/0xd0
[   71.006189]  kasan_kmalloc+0xad/0xe0
[   71.009872]  kmem_cache_alloc_trace+0x136/0x750
[   71.014513]  selinux_sb_alloc_security+0x93/0x2e0
[   71.019325]  security_sb_alloc+0x6d/0xa0
[   71.023354]  sget_userns+0x36a/0xe20
[   71.027036]  sget+0xd2/0x120
[   71.030028]  mount_nodev+0x37/0x100
[   71.033623]  ramfs_mount+0x2c/0x40
[   71.037131]  mount_fs+0x66/0x2d0
[   71.040467]  vfs_kern_mount.part.26+0xc6/0x4a0
[   71.045019]  do_mount+0xea1/0x2bb0
[   71.048528]  SyS_mount+0xab/0x120
[   71.051949]  entry_SYSCALL_64_fastpath+0x1f/0xbe
[   71.056670] 
[   71.058265] Freed by task 3873:
[   71.061514]  save_stack_trace+0x16/0x20
[   71.065456]  save_stack+0x43/0xd0
[   71.068896]  kasan_slab_free+0x71/0xc0
[   71.072753]  kfree+0xca/0x250
[   71.075828]  selinux_sb_free_security+0x42/0x50
[   71.080466]  security_sb_free+0x48/0x80
[   71.084408]  destroy_super+0x93/0x200
[   71.088178]  __put_super.part.6+0x1a4/0x2a0
[   71.092469]  put_super+0x53/0x70
[   71.095805]  deactivate_locked_super+0xb0/0xd0
[   71.100356]  deactivate_super+0x141/0x1b0
[   71.104473]  cleanup_mnt+0xb2/0x150
[   71.108070]  __cleanup_mnt+0x16/0x20
[   71.111754]  task_work_run+0x199/0x270
[   71.115610]  do_exit+0x9b5/0x1ad0
[   71.119032]  do_group_exit+0x149/0x400
[   71.122887]  get_signal+0x73f/0x16d0
[   71.126570]  do_signal+0x94/0x1ee0
[   71.130081]  exit_to_usermode_loop+0x214/0x310
[   71.134632]  syscall_return_slowpath+0x42f/0x510
[   71.139358]  entry_SYSCALL_64_fastpath+0xbc/0xbe
[   71.144081] 
[   71.145679] The buggy address belongs to the object at ffff8801c5b1dd40
[   71.145679]  which belongs to the cache kmalloc-256 of size 256
[   71.158305] The buggy address is located 172 bytes inside of
[   71.158305]  256-byte region [ffff8801c5b1dd40, ffff8801c5b1de40)
[   71.170148] The buggy address belongs to the page:
[   71.175046] page:ffffea000716c740 count:1 mapcount:0 mapping:ffff8801c5b1d0c0 index:0x0
[   71.183161] flags: 0x200000000000100(slab)
[   71.187369] raw: 0200000000000100 ffff8801c5b1d0c0 0000000000000000 000000010000000c
[   71.195219] raw: ffffea0007155de0 ffffea0007130ae0 ffff8801dac007c0 0000000000000000
[   71.203066] page dumped because: kasan: bad access detected
[   71.208743] 
[   71.210338] Memory state around the buggy address:
[   71.215235]  ffff8801c5b1dc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   71.222563]  ffff8801c5b1dd00: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
[   71.229892] >ffff8801c5b1dd80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   71.237217]                                                           ^
[   71.243936]  ffff8801c5b1de00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
[   71.251265]  ffff8801c5b1de80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   71.258590] ==================================================================
