==================================================================
BUG: KASAN: user-memory-access in atomic_add include/asm-generic/atomic-instrumented.h:62 [inline]
BUG: KASAN: user-memory-access in do_profile_hits kernel/profile.c:324 [inline]
BUG: KASAN: user-memory-access in profile_hits+0x90a/0xb00 kernel/profile.c:398
Write of size 4 at addr 00000007fffc4420 by task swapper/1/0
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.4.147-syzkaller-00015-g5b673be0c6b0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x18e/0x1de lib/dump_stack.c:118
__kasan_report+0x178/0x260 mm/kasan/report.c:520
kasan_report+0x30/0x60 mm/kasan/common.c:653
check_memory_region_inline mm/kasan/generic.c:141 [inline]
check_memory_region+0x2a5/0x2e0 mm/kasan/generic.c:191
atomic_add include/asm-generic/atomic-instrumented.h:62 [inline]
do_profile_hits kernel/profile.c:324 [inline]
profile_hits+0x90a/0xb00 kernel/profile.c:398
tick_sched_handle kernel/time/tick-sched.c:172 [inline]
tick_sched_timer+0x268/0x410 kernel/time/tick-sched.c:1296
__run_hrtimer+0x187/0x7b0 kernel/time/hrtimer.c:1581
__hrtimer_run_queues kernel/time/hrtimer.c:1643 [inline]
hrtimer_interrupt+0x557/0x10d0 kernel/time/hrtimer.c:1705
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1123 [inline]
smp_apic_timer_interrupt+0x109/0x420 arch/x86/kernel/apic/apic.c:1148
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:831
</IRQ>
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:169 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x45/0x60 kernel/locking/spinlock.c:199
Code: 08 00 74 0c 48 c7 c7 10 d4 ca 85 e8 d5 8a 69 fd 48 83 3d ad 71 a6 01 00 74 29 48 89 df e8 d3 8a 25 fd 66 90 fb bf 01 00 00 00 <e8> 26 20 1f fd 65 8b 05 0b 8b dd 7b 85 c0 74 02 5b c3 e8 e4 dd db
RSP: 0018:ffff8881f5defd80 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000001 RBX: ffff8881f6f4dc80 RCX: dffffc0000000000
RDX: 0000000040000000 RSI: 0000000000000002 RDI: 0000000000000001
RBP: ffff8881f5defde0 R08: ffffffff821f7b34 R09: ffffed103bd7adc9
R10: ffffed103bd7adc9 R11: 0000000000000000 R12: ffff8881f6f4dc80
R13: ffff8881f5dc6e40 R14: dffffc0000000000 R15: 0000000000000000
finish_lock_switch kernel/sched/core.c:3340 [inline]
finish_task_switch+0x130/0x550 kernel/sched/core.c:3440
context_switch kernel/sched/core.c:3604 [inline]
__schedule+0x886/0x1020 kernel/sched/core.c:4300
schedule_idle+0x60/0x90 kernel/sched/core.c:4396
do_idle+0x509/0x530 kernel/sched/idle.c:288
cpu_startup_entry+0x15/0x20 kernel/sched/idle.c:356
start_secondary+0x304/0x380 arch/x86/kernel/smpboot.c:264
secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:241
==================================================================
BUG: unable to handle page fault for address: 00000007fffc4420
#PF: supervisor write access in kernel mode
#PF: error_code(0x0002) - not-present page
PGD 1edd6f067 P4D 1edd6f067 PUD 0
Oops: 0002 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 0 Comm: swapper/1 Tainted: G B 5.4.147-syzkaller-00015-g5b673be0c6b0 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:arch_atomic_add arch/x86/include/asm/atomic.h:55 [inline]
RIP: 0010:atomic_add include/asm-generic/atomic-instrumented.h:63 [inline]
RIP: 0010:do_profile_hits kernel/profile.c:324 [inline]
RIP: 0010:profile_hits+0x90e/0xb00 kernel/profile.c:398
Code: 00 00 48 83 c4 58 5b 41 5c 41 5d 41 5e 41 5f 5d c3 48 8b 1d 14 69 85 05 4a 8d 3c a3 be 04 00 00 00 e8 b6 94 3c 00 8b 44 24 24 <f0> 42 01 04 a3 49 83 c7 04 b8 ff 01 00 00 48 89 04 24 49 bd 00 00
RSP: 0018:ffff8881f6f09d28 EFLAGS: 00010046
RAX: 0000000000000001 RBX: 0000000000000010 RCX: 0000000000010004
RDX: 0000000000000001 RSI: 0000000000000046 RDI: 0000000000000001
RBP: 0000000000000020 R08: dffffc0000000000 R09: fffffbfff0da7bd1
R10: fffffbfff0da7bd1 R11: 0000000000000000 R12: 00000001ffff1104
R13: ffff8881ebbab000 R14: dffffc0000000000 R15: ffff8881ebbab000
FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000007fffc4420 CR3: 00000001d68a7000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<IRQ>
tick_sched_handle kernel/time/tick-sched.c:172 [inline]
tick_sched_timer+0x268/0x410 kernel/time/tick-sched.c:1296
__run_hrtimer+0x187/0x7b0 kernel/time/hrtimer.c:1581
__hrtimer_run_queues kernel/time/hrtimer.c:1643 [inline]
hrtimer_interrupt+0x557/0x10d0 kernel/time/hrtimer.c:1705
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1123 [inline]
smp_apic_timer_interrupt+0x109/0x420 arch/x86/kernel/apic/apic.c:1148
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:831
</IRQ>
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:169 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x45/0x60 kernel/locking/spinlock.c:199
Code: 08 00 74 0c 48 c7 c7 10 d4 ca 85 e8 d5 8a 69 fd 48 83 3d ad 71 a6 01 00 74 29 48 89 df e8 d3 8a 25 fd 66 90 fb bf 01 00 00 00 <e8> 26 20 1f fd 65 8b 05 0b 8b dd 7b 85 c0 74 02 5b c3 e8 e4 dd db
RSP: 0018:ffff8881f5defd80 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000001 RBX: ffff8881f6f4dc80 RCX: dffffc0000000000
RDX: 0000000040000000 RSI: 0000000000000002 RDI: 0000000000000001
RBP: ffff8881f5defde0 R08: ffffffff821f7b34 R09: ffffed103bd7adc9
R10: ffffed103bd7adc9 R11: 0000000000000000 R12: ffff8881f6f4dc80
R13: ffff8881f5dc6e40 R14: dffffc0000000000 R15: 0000000000000000
finish_lock_switch kernel/sched/core.c:3340 [inline]
finish_task_switch+0x130/0x550 kernel/sched/core.c:3440
context_switch kernel/sched/core.c:3604 [inline]
__schedule+0x886/0x1020 kernel/sched/core.c:4300
schedule_idle+0x60/0x90 kernel/sched/core.c:4396
do_idle+0x509/0x530 kernel/sched/idle.c:288
cpu_startup_entry+0x15/0x20 kernel/sched/idle.c:356
start_secondary+0x304/0x380 arch/x86/kernel/smpboot.c:264
secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:241
Modules linked in:
CR2: 00000007fffc4420
---[ end trace 0e13b355887d5cf7 ]---
RIP: 0010:arch_atomic_add arch/x86/include/asm/atomic.h:55 [inline]
RIP: 0010:atomic_add include/asm-generic/atomic-instrumented.h:63 [inline]
RIP: 0010:do_profile_hits kernel/profile.c:324 [inline]
RIP: 0010:profile_hits+0x90e/0xb00 kernel/profile.c:398
Code: 00 00 48 83 c4 58 5b 41 5c 41 5d 41 5e 41 5f 5d c3 48 8b 1d 14 69 85 05 4a 8d 3c a3 be 04 00 00 00 e8 b6 94 3c 00 8b 44 24 24 <f0> 42 01 04 a3 49 83 c7 04 b8 ff 01 00 00 48 89 04 24 49 bd 00 00
RSP: 0018:ffff8881f6f09d28 EFLAGS: 00010046
RAX: 0000000000000001 RBX: 0000000000000010 RCX: 0000000000010004
RDX: 0000000000000001 RSI: 0000000000000046 RDI: 0000000000000001
RBP: 0000000000000020 R08: dffffc0000000000 R09: fffffbfff0da7bd1
R10: fffffbfff0da7bd1 R11: 0000000000000000 R12: 00000001ffff1104
R13: ffff8881ebbab000 R14: dffffc0000000000 R15: ffff8881ebbab000
FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000007fffc4420 CR3: 00000001d68a7000 CR4: 00000000003406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: 08 00 or %al,(%rax)
2: 74 0c je 0x10
4: 48 c7 c7 10 d4 ca 85 mov $0xffffffff85cad410,%rdi
b: e8 d5 8a 69 fd callq 0xfd698ae5
10: 48 83 3d ad 71 a6 01 cmpq $0x0,0x1a671ad(%rip) # 0x1a671c5
17: 00
18: 74 29 je 0x43
1a: 48 89 df mov %rbx,%rdi
1d: e8 d3 8a 25 fd callq 0xfd258af5
22: 66 90 xchg %ax,%ax
24: fb sti
25: bf 01 00 00 00 mov $0x1,%edi
* 2a: e8 26 20 1f fd callq 0xfd1f2055 <-- trapping instruction
2f: 65 8b 05 0b 8b dd 7b mov %gs:0x7bdd8b0b(%rip),%eax # 0x7bdd8b41
36: 85 c0 test %eax,%eax
38: 74 02 je 0x3c
3a: 5b pop %rbx
3b: c3 retq
3c: e8 .byte 0xe8
3d: e4 dd in $0xdd,%al
3f: db .byte 0xdb