================================================================== BUG: KASAN: stack-out-of-bounds in copy_page_range+0x2051/0x24d0 mm/memory.c:1229 Read of size 8 at addr ffff8801979e4b68 by task syz-executor7/4478 CPU: 0 PID: 4478 Comm: syz-executor7 Not tainted 4.18.0-rc3+ #58 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113 print_address_description+0x6c/0x20b mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433 copy_page_range+0x2051/0x24d0 mm/memory.c:1229 dup_mmap kernel/fork.c:520 [inline] dup_mm kernel/fork.c:1243 [inline] copy_mm kernel/fork.c:1297 [inline] copy_process.part.40+0x4e69/0x7220 kernel/fork.c:1803 copy_process kernel/fork.c:1616 [inline] _do_fork+0x291/0x12a0 kernel/fork.c:2099 __do_sys_clone kernel/fork.c:2206 [inline] __se_sys_clone kernel/fork.c:2200 [inline] __x64_sys_clone+0xbf/0x150 kernel/fork.c:2200 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x45416a Code: f7 d8 64 89 04 25 d4 02 00 00 64 4c 8b 0c 25 10 00 00 00 31 d2 4d 8d 91 d0 02 00 00 31 f6 bf 11 00 20 01 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 f5 00 00 00 85 c0 41 89 c5 0f 85 fc 00 00 RSP: 002b:00007ffc6f154dc0 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 RAX: ffffffffffffffda RBX: 00007ffc6f154dc0 RCX: 000000000045416a RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 RBP: 00007ffc6f154e00 R08: 0000000000000001 R09: 0000000000b11940 R10: 0000000000b11c10 R11: 0000000000000246 R12: 0000000000000001 R13: 0000000000000000 R14: 0000000000000000 R15: 00000000007034c0 The buggy address belongs to the page: page:ffffea00065e7900 count:1 mapcount:-512 mapping:0000000000000000 index:0x0 flags: 0x2fffc0000000000() raw: 02fffc0000000000 dead000000000100 0000000000000000 0000000000000000 raw: 0000000000000000 ffff8801cbb7fe18 00000001fffffdff ffff8801b0f2c3c0 page dumped because: kasan: bad access detected page->mem_cgroup:ffff8801b0f2c3c0 Memory state around the buggy address: ffff8801979e4a00: f2 f2 00 f2 f2 f2 f2 f2 f2 f2 f8 f2 f2 f2 f2 f2 ffff8801979e4a80: f2 f2 00 f2 f2 f2 00 00 00 00 00 00 00 00 00 00 >ffff8801979e4b00: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 ^ ffff8801979e4b80: f2 f2 f2 f2 f2 f2 f2 00 f2 f2 f2 f2 f2 f2 f2 00 ffff8801979e4c00: f2 f2 f2 f2 f2 f2 f2 f8 f2 f2 f2 f2 f2 f2 f2 00 ================================================================== list_del corruption. prev->next should be ffff8801aff806b0, but was ffffffff88bd6cd7 ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:53! invalid opcode: 0000 [#1] SMP KASAN CPU: 0 PID: 4478 Comm: syz-executor7 Tainted: G B 4.18.0-rc3+ #58 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__list_del_entry_valid.cold.1+0x48/0x58 lib/list_debug.c:51 Code: 63 1a 88 e8 66 32 02 fe 0f 0b 48 89 de 48 c7 c7 40 64 1a 88 e8 55 32 02 fe 0f 0b 48 89 de 48 c7 c7 e0 63 1a 88 e8 44 32 02 fe <0f> 0b 90 90 90 90 90 90 90 90 90 90 90 90 90 90 55 48 89 e5 41 57 RSP: 0018:ffff8801dae07068 EFLAGS: 00010086 RAX: 0000000000000054 RBX: ffff8801aff806b0 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff81631851 RDI: ffff8801dae06d60 RBP: ffff8801dae07080 R08: ffff8801c897c4c0 R09: fffffbfff11f1220 R10: fffffbfff11f1220 R11: ffffffff88f89103 R12: ffff8801986283b0 R13: ffff8801daf2d490 R14: ffff8801aff806b0 R15: ffff8801daf2c9c0 FS: 0000000000b11940(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffc96d6caa8 CR3: 00000001a020e000 CR4: 00000000001406f0 DR0: 0000000020000000 DR1: 0000000020000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 Call Trace: __list_del_entry include/linux/list.h:117 [inline] list_del_init include/linux/list.h:159 [inline] account_entity_dequeue+0x3c3/0x800 kernel/sched/fair.c:2708 dequeue_entity+0x3a1/0x15e0 kernel/sched/fair.c:4308 dequeue_task_fair+0xf2/0x9e0 kernel/sched/fair.c:5455 dequeue_task kernel/sched/core.c:762 [inline] deactivate_task+0xf3/0x330 kernel/sched/core.c:778 detach_task.isra.89+0xa9/0x150 kernel/sched/fair.c:7437 detach_tasks kernel/sched/fair.c:7525 [inline] load_balance+0xf0b/0x3640 kernel/sched/fair.c:8884 rebalance_domains+0x82a/0xd90 kernel/sched/fair.c:9262 run_rebalance_domains+0x365/0x4c0 kernel/sched/fair.c:9884 __do_softirq+0x2e8/0xb17 kernel/softirq.c:288 invoke_softirq kernel/softirq.c:368 [inline] irq_exit+0x1d1/0x200 kernel/softirq.c:408 exiting_irq arch/x86/include/asm/apic.h:527 [inline] smp_apic_timer_interrupt+0x186/0x730 arch/x86/kernel/apic/apic.c:1052 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:863 RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:783 [inline] RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0xa1/0xc0 kernel/locking/spinlock.c:184 Code: 68 b0 f1 88 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 75 21 48 83 3d 9e 94 5a 01 00 74 0e 48 89 df 57 9d <0f> 1f 44 00 00 eb bb 0f 0b 0f 0b e8 9f 19 23 fa eb 97 e8 98 19 23 RSP: 0018:ffff8801a0256c88 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13 RAX: dffffc0000000000 RBX: 0000000000000282 RCX: ffffffff81601b77 RDX: 1ffffffff11e360d RSI: 0000000000000004 RDI: 0000000000000282 RBP: ffff8801a0256c98 R08: fffffbfff12053b1 R09: fffffbfff12053b0 R10: fffffbfff12053b0 R11: ffffffff89029d83 R12: ffffffff89029d80 R13: 0000000000000000 R14: ffffffff81ac22a1 R15: ffff8801979e4b68 spin_unlock_irqrestore include/linux/spinlock.h:365 [inline] kasan_end_report+0x32/0x4f mm/kasan/report.c:178 kasan_report_error mm/kasan/report.c:359 [inline] kasan_report.cold.7+0x76/0x2fe mm/kasan/report.c:412 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433 copy_page_range+0x2051/0x24d0 mm/memory.c:1229 dup_mmap kernel/fork.c:520 [inline] dup_mm kernel/fork.c:1243 [inline] copy_mm kernel/fork.c:1297 [inline] copy_process.part.40+0x4e69/0x7220 kernel/fork.c:1803 copy_process kernel/fork.c:1616 [inline] _do_fork+0x291/0x12a0 kernel/fork.c:2099 __do_sys_clone kernel/fork.c:2206 [inline] __se_sys_clone kernel/fork.c:2200 [inline] __x64_sys_clone+0xbf/0x150 kernel/fork.c:2200 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x45416a Code: f7 d8 64 89 04 25 d4 02 00 00 64 4c 8b 0c 25 10 00 00 00 31 d2 4d 8d 91 d0 02 00 00 31 f6 bf 11 00 20 01 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 f5 00 00 00 85 c0 41 89 c5 0f 85 fc 00 00 RSP: 002b:00007ffc6f154dc0 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 RAX: ffffffffffffffda RBX: 00007ffc6f154dc0 RCX: 000000000045416a RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 RBP: 00007ffc6f154e00 R08: 0000000000000001 R09: 0000000000b11940 R10: 0000000000b11c10 R11: 0000000000000246 R12: 0000000000000001 R13: 0000000000000000 R14: 0000000000000000 R15: 00000000007034c0 Modules linked in: Dumping ftrace buffer: (ftrace buffer empty) ---[ end trace d267981ebfe7b95a ]--- RIP: 0010:__list_del_entry_valid.cold.1+0x48/0x58 lib/list_debug.c:51 Code: 63 1a 88 e8 66 32 02 fe 0f 0b 48 89 de 48 c7 c7 40 64 1a 88 e8 55 32 02 fe 0f 0b 48 89 de 48 c7 c7 e0 63 1a 88 e8 44 32 02 fe <0f> 0b 90 90 90 90 90 90 90 90 90 90 90 90 90 90 55 48 89 e5 41 57 RSP: 0018:ffff8801dae07068 EFLAGS: 00010086 RAX: 0000000000000054 RBX: ffff8801aff806b0 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff81631851 RDI: ffff8801dae06d60 RBP: ffff8801dae07080 R08: ffff8801c897c4c0 R09: fffffbfff11f1220 R10: fffffbfff11f1220 R11: ffffffff88f89103 R12: ffff8801986283b0 R13: ffff8801daf2d490 R14: ffff8801aff806b0 R15: ffff8801daf2c9c0 FS: 0000000000b11940(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffc96d6caa8 CR3: 00000001a020e000 CR4: 00000000001406f0 DR0: 0000000020000000 DR1: 0000000020000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600