[stable-Linux 4.4.214] BUG: KASAN: use-after-free in rcu_accelerate_cbs+0x2f3/0x3c0 at addr ffff88007e419db0

We get this bug report, the config and reproducing procedure is attached.

Any comment is appreciated.

[   69.865090] ==================================================================
[   69.866570] BUG: KASAN: use-after-free in rcu_accelerate_cbs+0x2f3/0x3c0 at addr ffff88007e419db0
[   69.868330] Read of size 8 by task syz-executor.15/2590
[   69.869361] =============================================================================
[   69.870969] BUG kmalloc-1024 (Not tainted): kasan: bad access detected
[   69.872263] -----------------------------------------------------------------------------
[   69.872263]
[   69.874137] Disabling lock debugging due to kernel taint
[   69.875208] INFO: Allocated in xfrm_policy_alloc+0x52/0x430 age=2914 cpu=1 pid=5773
[   69.876728]  ___slab_alloc+0x547/0x5b0
[   69.877499]  __slab_alloc+0x51/0x90
[   69.878201]  kmem_cache_alloc_trace+0x29c/0x370
[   69.879109]  xfrm_policy_alloc+0x52/0x430
[   69.879923]  xfrm_policy_construct+0x29/0x7a0
[   69.880797]  xfrm_add_policy+0x35e/0x7c0
[   69.881596]  xfrm_user_rcv_msg+0x2f0/0x5d0
[   69.882420]  netlink_rcv_skb+0x24a/0x350
[   69.883204]  xfrm_netlink_rcv+0x6e/0x90
[   69.883980]  netlink_unicast+0x413/0x5a0
[   69.884772]  netlink_sendmsg+0x987/0xbb0
[   69.885566]  sock_sendmsg+0xbc/0xf0
[   69.886264]  ___sys_sendmsg+0x663/0x7b0
[   69.887034]  __sys_sendmsg+0xd2/0x170
[   69.887775]  SyS_sendmsg+0x12/0x20
[   69.888473]  entry_SYSCALL_64_fastpath+0x1e/0x9a
[   69.889408] INFO: Freed in xfrm_policy_destroy_rcu+0x49/0x60 age=16 cpu=3 pid=5874
[   69.890904]  __slab_free+0x1bc/0x280
[   69.891632]  kfree+0x168/0x2e0
[   69.892250]  xfrm_policy_destroy_rcu+0x49/0x60
[   69.893149]  rcu_process_callbacks+0xc5c/0x13a0
[   69.894061]  __do_softirq+0x250/0x9a0
[   69.894807]  irq_exit+0x213/0x260
[   69.895487]  smp_apic_timer_interrupt+0x86/0xb0
[   69.896400]  apic_timer_interrupt+0xad/0xc0
[   69.897236]  finish_task_switch+0x157/0x680
[   69.898081]  __schedule+0x90a/0x1b70
[   69.898806]  schedule+0x9c/0x1b0
[   69.899467]  futex_wait_queue_me+0x2dd/0x590
[   69.900326]  futex_wait+0x1fb/0x5a0
[   69.901025]  do_futex+0x1dd/0x920
[   69.901698]  SyS_futex+0x1a4/0x280
[   69.902367]  entry_SYSCALL_64_fastpath+0x1e/0x9a
[   69.903254] INFO: Slab 0xffffea0001f90600 objects=24 used=12 fp=0xffff88007e418f90 flags=0x1fffff80004080
[   69.905140] INFO: Object 0xffff88007e4199f0 @offset=6640 fp=0xffff88007e41a980
[   69.905140]
[   69.906804] Bytes b4 ffff88007e4199e0: 03 00 00 00 ad 16 00 00 7a 68 fc ff 00 00 00 00  ........zh......
[   69.908675] Object ffff88007e4199f0: 80 a9 41 7e 00 88 ff ff 00 01 00 00 00 00 ad de  ..A~............
[   69.910474] Object ffff88007e419a00: 00 02 00 00 00 00 ad de 00 01 00 00 00 00 ad de  ................
[   69.912255] Object ffff88007e419a10: 00 02 00 00 00 00 ad de 00 00 00 00 00 00 00 00  ................
[   69.914083] Object ffff88007e419a20: ed 1e af de ff ff ff ff ff ff ff ff ff ff ff ff  ................
[   69.915920] Object ffff88007e419a30: 60 e3 6f 84 ff ff ff ff 40 a3 f7 83 ff ff ff ff  `.o.....@.......
[   69.917752] Object ffff88007e419a40: 00 00 00 00 00 00 00 00 00 d3 b6 82 ff ff ff ff  ................
[   69.919539] Object ffff88007e419a50: 00 00 00 00 00 00 00 00 00 02 00 00 00 00 ad de  ................
[   69.921346] Object ffff88007e419a60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 80  ................
[   69.923165] Object ffff88007e419a70: c0 5c 49 82 ff ff ff ff f0 99 41 7e 00 88 ff ff  .\I.......A~....
[   69.924967] Object ffff88007e419a80: 01 00 00 00 ff ff ff ff 20 e3 6f 84 ff ff ff ff  ........ .o.....
[   69.926800] Object ffff88007e419a90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[   69.928581] Object ffff88007e419aa0: 80 d3 b6 82 ff ff ff ff 00 db b6 82 ff ff ff ff  ................
[   69.930414] Object ffff88007e419ab0: 01 00 00 00 00 00 00 00 78 00 00 00 00 00 00 00  ........x.......
[   69.932240] Object ffff88007e419ac0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[   69.934072] Object ffff88007e419ad0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[   69.935944] Object ffff88007e419ae0: 00 00 00 00 00 00 00 00 00 00 00 00 0a 00 00 00  ................
[   69.937797] Object ffff88007e419af0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[   69.939633] Object ffff88007e419b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[   69.941467] Object ffff88007e419b10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[   69.943314] Object ffff88007e419b20: 00 00 00 00 00 00 00 00 00 00 00 00 00 46 76 64  .............Fvd
[   69.945111] Object ffff88007e419b30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[   69.946927] Object ffff88007e419b40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[   69.948751] Object ffff88007e419b50: fd 84 53 5e 00 00 00 00 00 00 00 00 00 00 00 00  ..S^............
[   69.950562] Object ffff88007e419b60: 60 9b 41 7e 00 88 ff ff 60 9b 41 7e 00 88 ff ff  `.A~....`.A~....
[   69.952398] Object ffff88007e419b70: 01 00 00 00 00 00 00 00 78 9b 41 7e 00 88 ff ff  ........x.A~....
[   69.954221] Object ffff88007e419b80: 78 9b 41 7e 00 88 ff ff 00 00 00 00 00 00 00 00  x.A~............
[   69.956059] Object ffff88007e419b90: 02 00 02 00 ad 4e ad de ff ff ff ff 00 00 00 00  .....N..........
[   69.957890] Object ffff88007e419ba0: ff ff ff ff ff ff ff ff a0 e2 6f 84 ff ff ff ff  ..........o.....
[   69.959725] Object ffff88007e419bb0: 20 99 f7 83 ff ff ff ff 00 00 00 00 00 00 00 00   ...............
[   69.961552] Object ffff88007e419bc0: 40 d3 b6 82 ff ff ff ff 00 00 00 00 00 00 00 00  @...............
[   69.963381] Object ffff88007e419bd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[   69.965211] Object ffff88007e419be0: 70 0c 4a 82 ff ff ff ff f0 99 41 7e 00 88 ff ff  p.J.......A~....
[   69.967046] Object ffff88007e419bf0: 01 00 00 00 ff ff ff ff e0 e2 6f 84 ff ff ff ff  ..........o.....
[   69.968870] Object ffff88007e419c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[   69.970612] Object ffff88007e419c10: c0 d3 b6 82 ff ff ff ff 00 00 00 00 00 00 00 00  ................
[   69.972440] Object ffff88007e419c20: 00 00 00 00 0a 00 00 00 00 00 00 00 00 00 00 00  ................
[   69.974259] Object ffff88007e419c30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[   69.976097] Object ffff88007e419c40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[   69.977931] Object ffff88007e419c50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[   69.979763] Object ffff88007e419c60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[   69.981565] Object ffff88007e419c70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[   69.983397] Object ffff88007e419c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[   69.985224] Object ffff88007e419c90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[   69.987057] Object ffff88007e419ca0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[   69.988889] Object ffff88007e419cb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[   69.990728] Object ffff88007e419cc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[   69.992545] Object ffff88007e419cd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[   69.994315] Object ffff88007e419ce0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[   69.996135] Object ffff88007e419cf0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[   69.997968] Object ffff88007e419d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[   69.999801] Object ffff88007e419d10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[   70.001636] Object ffff88007e419d20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[   70.003467] Object ffff88007e419d30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[   70.005305] Object ffff88007e419d40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[   70.007156] Object ffff88007e419d50: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[   70.008692] Object ffff88007e419d60: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[   70.010140] Object ffff88007e419d70: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[   70.011587] Object ffff88007e419d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[   70.013020] Object ffff88007e419d90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[   70.014472] Object ffff88007e419da0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[   70.015911] Object ffff88007e419db0: 00 00 00 00 00 00 00 00 90 d1 48 82 ff ff ff ff  ..........H.....
[   70.017367] Object ffff88007e419dc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[   70.018805] Object ffff88007e419dd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[   70.020245] Object ffff88007e419de0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
[   70.021690] CPU: 1 PID: 2590 Comm: syz-executor.15 Tainted: G    B           4.4.214-514.55.6.9.x86_64 #1
[   70.023167] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
[   70.024635]  0000000000000000 1ca8148cac7f79fe ffff8803aee87c00 ffffffff819acbbb
[   70.025872]  ffff880187c07180 ffff88007e4199f0 ffff8803aee87c30 ffffffff815c0359
[   70.027107]  ffff880187c07180 ffffea0001f90600 ffff88007e4199f0 0000000000000000
[   70.028347] Call Trace:
[   70.028740]  <IRQ>  [<ffffffff819acbbb>] dump_stack+0x8f/0xd4
[   70.029673]  [<ffffffff815c0359>] print_trailer+0xf9/0x150
[   70.030532]  [<ffffffff815c7cb4>] object_err+0x34/0x40
[   70.031340]  [<ffffffff815ca652>] kasan_report.part.2+0x232/0x530
[   70.032297]  [<ffffffff81259f17>] ? trigger_load_balance+0x147/0xca0
[   70.033285]  [<ffffffff812da023>] ? rcu_accelerate_cbs+0x2f3/0x3c0
[   70.034253]  [<ffffffff8128536b>] ? perf_trace_lock+0xbb/0x4b0
[   70.035171]  [<ffffffff815caa0e>] __asan_report_load8_noabort+0x2e/0x30
[   70.036201]  [<ffffffff812da023>] rcu_accelerate_cbs+0x2f3/0x3c0
[   70.037147]  [<ffffffff812da24d>] rcu_advance_cbs+0x15d/0x4a0
[   70.038046]  [<ffffffff812e3336>] ? note_gp_changes+0xa6/0x1e0
[   70.038962]  [<ffffffff812da607>] __note_gp_changes+0x77/0x4c0
[   70.039872]  [<ffffffff812e340d>] note_gp_changes+0x17d/0x1e0
[   70.040777]  [<ffffffff812e52ac>] rcu_process_callbacks+0x11c/0x13a0
[   70.041766]  [<ffffffff812f3920>] ? msleep_interruptible+0x1b0/0x1b0
[   70.042762]  [<ffffffff8128c9e8>] ? mark_held_locks+0xc8/0x120
[   70.043675]  [<ffffffff81196510>] __do_softirq+0x250/0x9a0
[   70.044540]  [<ffffffff81197003>] irq_exit+0x213/0x260
[   70.045347]  [<ffffffff82659cb6>] smp_apic_timer_interrupt+0x86/0xb0
[   70.046342]  [<ffffffff8265776d>] apic_timer_interrupt+0xad/0xc0
[   70.047272]  <EOI>  [<ffffffff812938f8>] ? lock_release+0x6f8/0xc90
[   70.048276]  [<ffffffff81828f65>] ? task_has_perm+0x5/0x2e0
[   70.049147]  [<ffffffff818290fe>] ? task_has_perm+0x19e/0x2e0
[   70.050053]  [<ffffffff8182911d>] task_has_perm+0x1bd/0x2e0
[   70.050927]  [<ffffffff81828f65>] ? task_has_perm+0x5/0x2e0
[   70.051802]  [<ffffffff8182925c>] selinux_task_wait+0x1c/0x20
[   70.052702]  [<ffffffff8180d295>] security_task_wait+0x65/0x90
[   70.053616]  [<ffffffff8118ac01>] wait_consider_task+0x241/0x3760
[   70.054570]  [<ffffffff812d5087>] ? debug_lockdep_rcu_enabled+0x77/0x90
[   70.055604]  [<ffffffff8118a9c0>] ? release_task+0x1310/0x1310
[   70.056520]  [<ffffffff8118e3ad>] ? do_wait+0x28d/0x920
[   70.057341]  [<ffffffff8128ce3e>] ? trace_hardirqs_on_caller+0x3fe/0x580
[   70.058384]  [<ffffffff8118e437>] do_wait+0x317/0x920
[   70.059172]  [<ffffffff8118e120>] ? wait_consider_task+0x3760/0x3760
[   70.060168]  [<ffffffff8154a43b>] ? __might_fault+0xcb/0x1b0
[   70.061051]  [<ffffffff8154a466>] ? __might_fault+0xf6/0x1b0
[   70.061937]  [<ffffffff81192882>] SyS_wait4+0xf2/0x1b0
[   70.062742]  [<ffffffff81192790>] ? SyS_waitid+0x270/0x270
[   70.063601]  [<ffffffff81189000>] ? task_stopped_code+0x100/0x100
[   70.064551]  [<ffffffff81005044>] ? lockdep_sys_exit_thunk+0x12/0x14
[   70.065542]  [<ffffffff826567e1>] entry_SYSCALL_64_fastpath+0x1e/0x9a
[   70.066544] Memory state around the buggy address:
[   70.067302]  ffff88007e419c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   70.068425]  ffff88007e419d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   70.069550] >ffff88007e419d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[   70.070674]                                      ^
[   70.071438]  ffff88007e419e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   70.072564]  ffff88007e419e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[   70.073683] ==================================================================

LTS 4.19.106 also have this issue:

[71353.879282] BUG: KASAN: use-after-free in rcu_cblist_dequeue+0xad/0xc0
[71353.880314] Read of size 8 at addr ffff8882885c3528 by task ksoftirqd/2/22
[71353.881403]
[71353.881672] CPU: 2 PID: 22 Comm: ksoftirqd/2 Not tainted 4.19.106-514.55.6.9.x86_64 #5
[71353.882920] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
[71353.884431] Call Trace:
[71353.884876]  dump_stack+0xaf/0xfb
[71353.885439]  print_address_description+0x75/0x290
[71353.886201]  kasan_report+0x28e/0x390
[71353.886809]  ? rcu_cblist_dequeue+0xad/0xc0
[71353.887494]  ? xfrm_policy_register_afinfo+0x2b0/0x2b0
[71353.888318]  rcu_cblist_dequeue+0xad/0xc0
[71353.888963]  rcu_process_callbacks+0x53b/0x1940
[71353.889698]  ? note_gp_changes+0x170/0x170
[71353.890371]  __do_softirq+0x22e/0x868
[71353.890990]  ? takeover_tasklets+0x700/0x700
[71353.891673]  run_ksoftirqd+0x30/0x60
[71353.892245]  smpboot_thread_fn+0x3ad/0x790
[71353.892902]  ? _raw_spin_unlock_irqrestore+0x32/0x60
[71353.893685]  ? sort_range+0x20/0x20
[71353.894254]  ? __kthread_parkme+0xad/0x180
[71353.894913]  ? sort_range+0x20/0x20
[71353.895467]  kthread+0x2e4/0x3e0
[71353.895990]  ? kthread_cancel_delayed_work_sync+0x10/0x10
[71353.896844]  ret_from_fork+0x3a/0x50
[71353.897434]
[71353.897698] Allocated by task 15407:
[71353.898278]  kasan_kmalloc+0xa6/0xd0
[71353.898854]  kmem_cache_alloc_trace+0x137/0x2c0
[71353.899568]  xfrm_policy_alloc+0x4d/0x340
[71353.900213]  xfrm_policy_construct+0x26/0x820
[71353.900906]  xfrm_add_policy+0x34f/0x6b0
[71353.901533]  xfrm_user_rcv_msg+0x32a/0x550
[71353.902214]  netlink_rcv_skb+0x26b/0x3b0
[71353.902854]  xfrm_netlink_rcv+0x68/0x80
[71353.903460]  netlink_unicast+0x408/0x590
[71353.904087]  netlink_sendmsg+0x77a/0xb40
[71353.904725]  sock_sendmsg+0xb3/0xf0
[71353.905277]  ___sys_sendmsg+0x67b/0x890
[71353.905891]  __sys_sendmsg+0xde/0x170
[71353.906483]  do_syscall_64+0xa5/0x490
[71353.907072]  entry_SYSCALL_64_after_hwframe+0x49/0xbe
[71353.907885]
[71353.908140] Freed by task 0:
[71353.908627]  __kasan_slab_free+0x132/0x180
[71353.909292]  kfree+0xef/0x2c0
[71353.909788]  rcu_process_callbacks+0x5ad/0x1940
[71353.910517]  __do_softirq+0x22e/0x868
[71353.911134]
[71353.911394] The buggy address belongs to the object at ffff8882885c3180
[71353.911394]  which belongs to the cache kmalloc-1024 of size 1024
[71353.913423] The buggy address is located 936 bytes inside of
[71353.913423]  1024-byte region [ffff8882885c3180, ffff8882885c3580)
[71353.915330] The buggy address belongs to the page:
[71353.916126] page:ffffea000a217000 count:1 mapcount:0 mapping:ffff888107c02a00 index:0x0 compound_mapcount: 0
[71353.917717] flags: 0x2fffff80008100(slab|head)
[71353.918445] raw: 002fffff80008100 0000000000000000 0000001a00000001 ffff888107c02a00
[71353.919703] raw: 0000000000000000 00000000001c001c 00000001ffffffff 0000000000000000
[71353.920947] page dumped because: kasan: bad access detected
[71353.921855]
[71353.922120] Memory state around the buggy address:
[71353.922902]  ffff8882885c3400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[71353.924048]  ffff8882885c3480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[71353.925183] >ffff8882885c3500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[71353.926313]                                   ^
[71353.927039]  ffff8882885c3580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[71353.928171]  ffff8882885c3600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[71353.929317] ==================================================================
[71353.930480] Disabling lock debugging due to kernel taint
[71353.931382] Kernel panic - not syncing: panic_on_warn set ...
[71353.931382]
[71353.932551] CPU: 2 PID: 22 Comm: ksoftirqd/2 Tainted: G    B             4.19.106-514.55.6.9.x86_64 #5
[71353.934050] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Ubuntu-1.8.2-1ubuntu1 04/01/2014
[71353.935567] Call Trace:
[71353.935991]  dump_stack+0xaf/0xfb
[71353.936536]  panic+0x1c0/0x35b
[71353.937051]  ? refcount_error_report+0x1a5/0x1a5
[71353.937817]  ? do_raw_spin_unlock+0x54/0x230
[71353.938508]  ? do_raw_spin_unlock+0x54/0x230
[71353.939207]  kasan_end_report+0x4f/0x50
[71353.939837]  kasan_report+0x113/0x390
[71353.940436]  ? rcu_cblist_dequeue+0xad/0xc0
[71353.941141]  ? xfrm_policy_register_afinfo+0x2b0/0x2b0
[71353.941981]  rcu_cblist_dequeue+0xad/0xc0
[71353.942630]  rcu_process_callbacks+0x53b/0x1940
[71353.943352]  ? note_gp_changes+0x170/0x170
[71353.944018]  __do_softirq+0x22e/0x868
[71353.944614]  ? takeover_tasklets+0x700/0x700
[71353.945289]  run_ksoftirqd+0x30/0x60
[71353.945868]  smpboot_thread_fn+0x3ad/0x790
[71353.946529]  ? _raw_spin_unlock_irqrestore+0x32/0x60
[71353.947327]  ? sort_range+0x20/0x20
[71353.947907]  ? __kthread_parkme+0xad/0x180
[71353.948560]  ? sort_range+0x20/0x20
[71353.949127]  kthread+0x2e4/0x3e0
[71353.949659]  ? kthread_cancel_delayed_work_sync+0x10/0x10
[71353.950516]  ret_from_fork+0x3a/0x50
[71353.952194] Dumping ftrace buffer:
[71353.952787]    (ftrace buffer empty)
[71353.953367] Kernel Offset: disabled
[71353.953940] Rebooting in 1 seconds..

On 2020/2/24 17:50, Yuehaibing wrote:

We get this bug report, the config and reproducing procedure is attached.

Any comment is appreciated.

.....