From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from kanga.kvack.org (kanga.kvack.org [205.233.56.17]) by smtp.lore.kernel.org (Postfix) with ESMTP id 76D69C433EF for ; Mon, 25 Apr 2022 13:21:11 +0000 (UTC) Received: by kanga.kvack.org (Postfix) id DD15C6B0074; Mon, 25 Apr 2022 09:21:10 -0400 (EDT) Received: by kanga.kvack.org (Postfix, from userid 40) id D81FE6B0075; Mon, 25 Apr 2022 09:21:10 -0400 (EDT) X-Delivered-To: int-list-linux-mm@kvack.org Received: by kanga.kvack.org (Postfix, from userid 63042) id C237B6B0078; Mon, 25 Apr 2022 09:21:10 -0400 (EDT) X-Delivered-To: linux-mm@kvack.org Received: from relay.hostedemail.com (relay.hostedemail.com [64.99.140.25]) by kanga.kvack.org (Postfix) with ESMTP id B522C6B0074 for ; Mon, 25 Apr 2022 09:21:10 -0400 (EDT) Received: from smtpin27.hostedemail.com (a10.router.float.18 [10.200.18.1]) by unirelay07.hostedemail.com (Postfix) with ESMTP id 884B621B9B for ; Mon, 25 Apr 2022 13:21:10 +0000 (UTC) X-FDA: 79395462300.27.D2B133B Received: from mail-pl1-f177.google.com (mail-pl1-f177.google.com [209.85.214.177]) by imf13.hostedemail.com (Postfix) with ESMTP id A0D5220045 for ; Mon, 25 Apr 2022 13:21:04 +0000 (UTC) Received: by mail-pl1-f177.google.com with SMTP id c23so27020538plo.0 for ; Mon, 25 Apr 2022 06:21:09 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20210112; h=mime-version:from:date:message-id:subject:to:cc; bh=8wztI+0deNThRfI6CGosyz08ikDjwXSmBzMbJDH7foc=; b=GJsDkhEK/gnYUMRYZYNqw3PnHeJS45MpoNWM0JRGChYjH01eSCIGe3erMTi85XZaDC ec6sYceKayY6ziJX/Xuv1kUig5bryDsyKeCswOvXTvLdk/28mpXO220KWZpRX2+EEPvA qaukY0b7YujwyYJF2E8G648DfY3mH0qJhGlLn5V0m0I/MjcCqu7uc1OvIeQw9N9/MXuH Cef4JLcv6p8ozMI/1g9hy6wDxBU4r4TT+UjSipwyQ42oEkWLdpQCqeM316BS9KKNSQgS tYHQ0Jpq9aNRYmusBO6c6Dy0By+Hf7LM+UJ1pak/37FIp1miPZwTVC66bvbqtdQtQeam TdgQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:mime-version:from:date:message-id:subject:to:cc; bh=8wztI+0deNThRfI6CGosyz08ikDjwXSmBzMbJDH7foc=; b=yIIUhOPIA+oAMP4JXb9YvcmWdKk1dgmdymQ4IMiauRpm0ZEwvg4SPApVBdkvNN1A2n M9qa7T6gJVtytfmXJtZ0Dtx0tjAtm9kCm5/Rey8UJQuf2nr0JgvWeVT7ahn5uR4D9k+S XuULjLyxMs7D8a3pR1MFsy+iVDZ871/oYxRdJIjae1ee3bgD6ENDpNzAgvRfHv+ClCcz 9s1TNJaNEj4ZU3vuXptYVNF6jmVAZ4LcVVgC9kn1aR/x/NVIqSz9J59idF+0s7l4KDO5 iVJt/rHp9UZbQiyjKPqsnB6vh9x0fO5hLnl96/bn8APLbhXPaIIRg1HqMB/5a6K8F1rK 2GSA== X-Gm-Message-State: AOAM531ljVrpKRtX1SZN73gGyhC83FgO6Jg3BTw2sgKCyZAoLdpsL0pA sCYBff0tFo1ajrWteyx+ZRWBIoeL73+vmd8nY5o8zW6PQ9iPAht83h0= X-Google-Smtp-Source: ABdhPJzc6MugyBbPEwtxnhrNuVVXZ43OTW0bGOAdt5C1Clpsy9VgJ0vl8PkEsKX3ve0/4Tqo3yBOlUCTGr1sgML8I9U= X-Received: by 2002:a17:902:e548:b0:15d:26c3:852c with SMTP id n8-20020a170902e54800b0015d26c3852cmr1402617plf.34.1650892868503; Mon, 25 Apr 2022 06:21:08 -0700 (PDT) MIME-Version: 1.0 From: =?UTF-8?B?5LiA5Y+q54uX?= Date: Mon, 25 Apr 2022 21:20:57 +0800 Message-ID: Subject: KASAN: use-after-free Read in kthread_is_per_cpu To: linux-mm@kvack.org Cc: syzkaller@googlegroups.com Content-Type: multipart/alternative; boundary="000000000000fd4b1b05dd7a72e6" X-Rspamd-Queue-Id: A0D5220045 X-Stat-Signature: mo96kiar8eusbbws87xo6zmwhi8wiyfg X-Rspam-User: Authentication-Results: imf13.hostedemail.com; dkim=pass header.d=gmail.com header.s=20210112 header.b=GJsDkhEK; spf=pass (imf13.hostedemail.com: domain of chennbnbnb@gmail.com designates 209.85.214.177 as permitted sender) smtp.mailfrom=chennbnbnb@gmail.com; dmarc=pass (policy=none) header.from=gmail.com X-Rspamd-Server: rspam09 X-HE-Tag: 1650892864-585809 X-Bogosity: Ham, tests=bogofilter, spamicity=0.074709, version=1.2.4 Sender: owner-linux-mm@kvack.org Precedence: bulk X-Loop: owner-majordomo@kvack.org List-ID: --000000000000fd4b1b05dd7a72e6 Content-Type: text/plain; charset="UTF-8" enable those syscalls in syzkaller and begin to fuzz ``` "enable_syscalls": [ "openat$ptmx", "ioctl$TIOCSPTLCK", "ioctl$TIOCSETD" ], ``` I got 31 similar crashes in 14h, here is an example ``` ================================================================== BUG: KASAN: use-after-free in instrument_atomic_read include/linux/instrumented.h:71 [inline] BUG: KASAN: use-after-free in test_bit include/asm-generic/bitops/instrumented-non-atomic.h:134 [inline] BUG: KASAN: use-after-free in kthread_is_per_cpu+0x81/0xe0 kernel/kthread.c:610 Read of size 8 at addr ffff8881240ab800 by task syz-executor.1/27180 CPU: 6 PID: 27180 Comm: syz-executor.1 Not tainted 5.18.0-rc1 #5 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x4d/0x66 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:313 [inline] print_report.cold+0xb2/0x6b7 mm/kasan/report.c:429 kasan_report+0xa9/0x120 mm/kasan/report.c:491 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0x14d/0x1d0 mm/kasan/generic.c:189 instrument_atomic_read include/linux/instrumented.h:71 [inline] test_bit include/asm-generic/bitops/instrumented-non-atomic.h:134 [inline] kthread_is_per_cpu+0x81/0xe0 kernel/kthread.c:610 can_migrate_task kernel/sched/fair.c:7807 [inline] detach_tasks kernel/sched/fair.c:7971 [inline] load_balance+0x9ad/0x20d0 kernel/sched/fair.c:9960 newidle_balance.isra.0+0x520/0xc70 kernel/sched/fair.c:10969 pick_next_task_fair+0x4e/0xb20 kernel/sched/fair.c:7387 __pick_next_task kernel/sched/core.c:5695 [inline] pick_next_task kernel/sched/core.c:6198 [inline] __schedule+0x290/0x1b30 kernel/sched/core.c:6346 schedule+0xd2/0x1f0 kernel/sched/core.c:6454 freezable_schedule include/linux/freezer.h:172 [inline] futex_wait_queue+0x10e/0x290 kernel/futex/waitwake.c:355 futex_wait+0x29e/0x630 kernel/futex/waitwake.c:656 do_futex+0x2aa/0x330 kernel/futex/syscalls.c:106 __do_sys_futex kernel/futex/syscalls.c:183 [inline] __se_sys_futex kernel/futex/syscalls.c:164 [inline] __x64_sys_futex+0x1ad/0x400 kernel/futex/syscalls.c:164 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f550fc9383d Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f550f405c98 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: ffffffffffffffda RBX: 00007f550fdb2f60 RCX: 00007f550fc9383d RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f550fdb2f68 RBP: 00007f550fdb2f68 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f550fdb2f6c R13: 00007ffc93d3187f R14: 00007ffc93d31a20 R15: 00007f550f405d80 Allocated by task 29732: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:436 [inline] ____kasan_kmalloc mm/kasan/common.c:515 [inline] __kasan_kmalloc+0x81/0xa0 mm/kasan/common.c:524 kmalloc include/linux/slab.h:581 [inline] kzalloc include/linux/slab.h:714 [inline] set_kthread_struct+0xb5/0x230 kernel/kthread.c:117 copy_process+0x440c/0x6440 kernel/fork.c:2161 kernel_clone+0xc2/0x8f0 kernel/fork.c:2639 kernel_thread+0xb5/0xf0 kernel/fork.c:2691 call_usermodehelper_exec_sync kernel/umh.c:135 [inline] call_usermodehelper_exec_work+0x5b/0x160 kernel/umh.c:166 process_one_work+0x866/0x11d0 kernel/workqueue.c:2289 worker_thread+0x549/0x1130 kernel/workqueue.c:2436 kthread+0x288/0x330 kernel/kthread.c:376 ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:298 Freed by task 27184: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track+0x21/0x30 mm/kasan/common.c:45 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370 ____kasan_slab_free mm/kasan/common.c:366 [inline] ____kasan_slab_free mm/kasan/common.c:328 [inline] __kasan_slab_free+0x10c/0x170 mm/kasan/common.c:374 kasan_slab_free include/linux/kasan.h:200 [inline] slab_free_hook mm/slub.c:1728 [inline] slab_free_freelist_hook mm/slub.c:1754 [inline] slab_free mm/slub.c:3510 [inline] kfree+0x89/0x290 mm/slub.c:4552 free_kthread_struct+0xf5/0x150 kernel/kthread.c:145 begin_new_exec+0x1d1e/0x27e0 fs/exec.c:1312 load_elf_binary+0x10ce/0x4620 fs/binfmt_elf.c:1002 search_binary_handler fs/exec.c:1726 [inline] exec_binprm fs/exec.c:1767 [inline] bprm_execve fs/exec.c:1836 [inline] bprm_execve+0x69a/0x1390 fs/exec.c:1798 kernel_execve+0x328/0x430 fs/exec.c:1997 call_usermodehelper_exec_async+0x2e0/0x550 kernel/umh.c:112 ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:298 The buggy address belongs to the object at ffff8881240ab800 which belongs to the cache kmalloc-128 of size 128 The buggy address is located 0 bytes inside of 128-byte region [ffff8881240ab800, ffff8881240ab880) The buggy address belongs to the physical page: page:00000000c44cb91e refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1240aa head:00000000c44cb91e order:1 compound_mapcount:0 compound_pincount:0 flags: 0x200000000010200(slab|head|node=0|zone=2) raw: 0200000000010200 ffffea0004027980 dead000000000002 ffff8881000428c0 raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8881240ab700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8881240ab780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff8881240ab800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8881240ab880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8881240ab900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== ``` I think crash is related is `ioctl$TIOCSETD` . `ioctl$TIOCSETD` syscall use `request_module("tty-ldisc-%d", disc);` to load unknow line discipline module, it lead to kthread object being freed by `free_kthread_struct(...)` crash will happen when can_migrate_task() try to access kthread object this crash can easily be triggered in syzkaller fuzz. but hard to reproduce it. It's really strange, and I could not give a POC or explaination if it's really a security problem in kernel, I wish I can get a CVE number --000000000000fd4b1b05dd7a72e6 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
enable those syscalls in syzkaller and begin to fuzz
`= ``
"enable_syscalls"<= /span>: [ =20 "openat$ptmx", "ioctl$TIOCSPTLCK"<= /span>, "ioctl$TIOCSETD" ],
```

I got 31 similar cras= hes in 14h, here is an example
```
=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
BUG: KASAN: use-after-free in instrument_= atomic_read include/linux/instrumented.h:71 [inline]
BUG: KASAN: use-aft= er-free in test_bit include/asm-generic/bitops/instrumented-non-atomic.h:13= 4 [inline]
BUG: KASAN: use-after-free in kthread_is_per_cpu+0x81/0xe0 ke= rnel/kthread.c:610
Read of size 8 at addr ffff8881240ab800 by task syz-e= xecutor.1/27180

CPU: 6 PID: 27180 Comm: syz-executor.1 Not tainted 5= .18.0-rc1 #5
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS= 1.13.0-1ubuntu1.1 04/01/2014
Call Trace:
=C2=A0<TASK>
=C2= =A0__dump_stack lib/dump_stack.c:88 [inline]
=C2=A0dump_stack_lvl+0x4d/0= x66 lib/dump_stack.c:106
=C2=A0print_address_description mm/kasan/report= .c:313 [inline]
=C2=A0print_report.cold+0xb2/0x6b7 mm/kasan/report.c:429=
=C2=A0kasan_report+0xa9/0x120 mm/kasan/report.c:491
=C2=A0check_regi= on_inline mm/kasan/generic.c:183 [inline]
=C2=A0kasan_check_range+0x14d/= 0x1d0 mm/kasan/generic.c:189
=C2=A0instrument_atomic_read include/linux/= instrumented.h:71 [inline]
=C2=A0test_bit include/asm-generic/bitops/ins= trumented-non-atomic.h:134 [inline]
=C2=A0kthread_is_per_cpu+0x81/0xe0 k= ernel/kthread.c:610
=C2=A0can_migrate_task kernel/sched/fair.c:7807 [inl= ine]
=C2=A0detach_tasks kernel/sched/fair.c:7971 [inline]
=C2=A0load_= balance+0x9ad/0x20d0 kernel/sched/fair.c:9960
=C2=A0newidle_balance.isra= .0+0x520/0xc70 kernel/sched/fair.c:10969
=C2=A0pick_next_task_fair+0x4e/= 0xb20 kernel/sched/fair.c:7387
=C2=A0__pick_next_task kernel/sched/core.= c:5695 [inline]
=C2=A0pick_next_task kernel/sched/core.c:6198 [inline]=C2=A0__schedule+0x290/0x1b30 kernel/sched/core.c:6346
=C2=A0schedule+= 0xd2/0x1f0 kernel/sched/core.c:6454
=C2=A0freezable_schedule include/lin= ux/freezer.h:172 [inline]
=C2=A0futex_wait_queue+0x10e/0x290 kernel/fute= x/waitwake.c:355
=C2=A0futex_wait+0x29e/0x630 kernel/futex/waitwake.c:65= 6
=C2=A0do_futex+0x2aa/0x330 kernel/futex/syscalls.c:106
=C2=A0__do_s= ys_futex kernel/futex/syscalls.c:183 [inline]
=C2=A0__se_sys_futex kerne= l/futex/syscalls.c:164 [inline]
=C2=A0__x64_sys_futex+0x1ad/0x400 kernel= /futex/syscalls.c:164
=C2=A0do_syscall_x64 arch/x86/entry/common.c:50 [i= nline]
=C2=A0do_syscall_64+0x3b/0x90 arch/x86/entry/common.c:80
=C2= =A0entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7f550fc9383d
= Code: 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 f3 0f 1e fa 48 89 f8 48 89 f7 = 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f= 0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f= 550f405c98 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: ffffffffffff= ffda RBX: 00007f550fdb2f60 RCX: 00007f550fc9383d
RDX: 0000000000000000 R= SI: 0000000000000080 RDI: 00007f550fdb2f68
RBP: 00007f550fdb2f68 R08: 00= 00000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 00000000= 00000246 R12: 00007f550fdb2f6c
R13: 00007ffc93d3187f R14: 00007ffc93d31a= 20 R15: 00007f550f405d80
=C2=A0</TASK>

Allocated by task 29= 732:
=C2=A0kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
=C2=A0kasa= n_set_track mm/kasan/common.c:45 [inline]
=C2=A0set_alloc_info mm/kasan/= common.c:436 [inline]
=C2=A0____kasan_kmalloc mm/kasan/common.c:515 [inl= ine]
=C2=A0__kasan_kmalloc+0x81/0xa0 mm/kasan/common.c:524
=C2=A0kmal= loc include/linux/slab.h:581 [inline]
=C2=A0kzalloc include/linux/slab.h= :714 [inline]
=C2=A0set_kthread_struct+0xb5/0x230 kernel/kthread.c:117=C2=A0copy_process+0x440c/0x6440 kernel/fork.c:2161
=C2=A0kernel_clone= +0xc2/0x8f0 kernel/fork.c:2639
=C2=A0kernel_thread+0xb5/0xf0 kernel/fork= .c:2691
=C2=A0call_usermodehelper_exec_sync kernel/umh.c:135 [inline]=C2=A0call_usermodehelper_exec_work+0x5b/0x160 kernel/umh.c:166
=C2=A0p= rocess_one_work+0x866/0x11d0 kernel/workqueue.c:2289
=C2=A0worker_thread= +0x549/0x1130 kernel/workqueue.c:2436
=C2=A0kthread+0x288/0x330 kernel/k= thread.c:376
=C2=A0ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:298=

Freed by task 27184:
=C2=A0kasan_save_stack+0x1e/0x40 mm/kasan/c= ommon.c:38
=C2=A0kasan_set_track+0x21/0x30 mm/kasan/common.c:45
=C2= =A0kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370
=C2=A0____kasan_= slab_free mm/kasan/common.c:366 [inline]
=C2=A0____kasan_slab_free mm/ka= san/common.c:328 [inline]
=C2=A0__kasan_slab_free+0x10c/0x170 mm/kasan/c= ommon.c:374
=C2=A0kasan_slab_free include/linux/kasan.h:200 [inline]
= =C2=A0slab_free_hook mm/slub.c:1728 [inline]
=C2=A0slab_free_freelist_ho= ok mm/slub.c:1754 [inline]
=C2=A0slab_free mm/slub.c:3510 [inline]
= =C2=A0kfree+0x89/0x290 mm/slub.c:4552
=C2=A0free_kthread_struct+0xf5/0x1= 50 kernel/kthread.c:145
=C2=A0begin_new_exec+0x1d1e/0x27e0 fs/exec.c:131= 2
=C2=A0load_elf_binary+0x10ce/0x4620 fs/binfmt_elf.c:1002
=C2=A0sear= ch_binary_handler fs/exec.c:1726 [inline]
=C2=A0exec_binprm fs/exec.c:17= 67 [inline]
=C2=A0bprm_execve fs/exec.c:1836 [inline]
=C2=A0bprm_exec= ve+0x69a/0x1390 fs/exec.c:1798
=C2=A0kernel_execve+0x328/0x430 fs/exec.c= :1997
=C2=A0call_usermodehelper_exec_async+0x2e0/0x550 kernel/umh.c:112<= br>=C2=A0ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:298

The b= uggy address belongs to the object at ffff8881240ab800
=C2=A0which belon= gs to the cache kmalloc-128 of size 128
The buggy address is located 0 b= ytes inside of
=C2=A0128-byte region [ffff8881240ab800, ffff8881240ab880= )

The buggy address belongs to the physical page:
page:00000000c4= 4cb91e refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1240a= a
head:00000000c44cb91e order:1 compound_mapcount:0 compound_pincount:0<= br>flags: 0x200000000010200(slab|head|node=3D0|zone=3D2)
raw: 0200000000= 010200 ffffea0004027980 dead000000000002 ffff8881000428c0
raw: 000000000= 0000000 0000000080200020 00000001ffffffff 0000000000000000
page dumped b= ecause: kasan: bad access detected

Memory state around the buggy add= ress:
=C2=A0ffff8881240ab700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb = fb fb
=C2=A0ffff8881240ab780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc = fc fc
>ffff8881240ab800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb= fb
=C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0^
=C2=A0ffff8881240ab880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc f= c fc
=C2=A0ffff8881240ab900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb f= b fb
=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D= =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D
```=

I think crash is related is `ioctl$TIOCSETD` .=C2= =A0
`ioctl$TIOCSETD`=C2=A0=C2=A0syscall use `request_module("tty-ldisc-%d", disc);` to lo= ad unknow=C2=A0line discipline module, it lead to kthread object being free= d by=C2=A0 `free_kthread_struct(...)`=C2=A0
crash will happen whe= n=C2=A0can_migrate_task() try to access kthread object

=
this crash can easily be triggered in syzkaller fuzz.=C2=A0 but hard t= o reproduce it.
It's really strange, and I could not give a P= OC or explaination
if it's really a security problem in kerne= l, I wish I can get a CVE number
--000000000000fd4b1b05dd7a72e6--