==================================================================
kasan: CONFIG_KASAN_INLINE enabled
BUG: KASAN: stack-out-of-bounds in task_css include/linux/cgroup.h:477 [inline]
BUG: KASAN: stack-out-of-bounds in task_ca kernel/sched/cpuacct.c:43 [inline]
BUG: KASAN: stack-out-of-bounds in cpuacct_charge+0x533/0x5d0 kernel/sched/cpuacct.c:349
kasan: GPF could be caused by NULL-ptr deref or user memory access
Read of size 8 at addr ffff8801b19bc490 by task syz-executor4/4482
general protection fault: 0000 [#1] SMP KASAN
CPU: 0 PID: 22633 Comm: syz-executor4 Not tainted 4.18.0-rc3+ #48
CPU: 1 PID: 4482 Comm: syz-executor4 Not tainted 4.18.0-rc3+ #48
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:cgroup_rstat_cpu kernel/cgroup/rstat.c:12 [inline]
RIP: 0010:cgroup_rstat_updated+0x1c0/0x470 kernel/cgroup/rstat.c:54
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113
Code:
85
84
02
00 00
print_address_description+0x6c/0x20b mm/kasan/report.c:256
4c
8b 34
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412
dd
__asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
60
task_css include/linux/cgroup.h:477 [inline]
task_ca kernel/sched/cpuacct.c:43 [inline]
cpuacct_charge+0x533/0x5d0 kernel/sched/cpuacct.c:349
1e
d1
cgroup_account_cputime include/linux/cgroup.h:724 [inline]
update_curr+0x389/0xc00 kernel/sched/fair.c:832
88
48 b8
00 00
00 00
00
fc ff
df
dequeue_entity+0xd9/0x15e0 kernel/sched/fair.c:4288
4b
8d
14
3e
4d 8d
bc 24
78
03
00
00
4c
89 fe
48
dequeue_task_fair+0xf2/0x9e0 kernel/sched/fair.c:5455
c1 ee
03 <80>
3c
06
00
0f
85 7e
dequeue_task kernel/sched/core.c:762 [inline]
deactivate_task+0xf3/0x330 kernel/sched/core.c:778
02 00
__schedule+0x9c9/0x1ed0 kernel/sched/core.c:3454
00
48
8d
7a
38
49
8b
84 24
78
03
00
00
schedule+0xfb/0x450 kernel/sched/core.c:3548
RSP: 0018:ffff8801dae07900 EFLAGS: 00010002
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 1ffffffff11a23cc
RDX: ffff8801647d8638 RSI: 0000000020000091 RDI: ffff8801dae26680
RBP: ffff8801dae07948 R08: ffffed003b5c4cd1 R09: ffffed003b5c4cd0
R10: ffffed003b5c4cd0 R11: ffff8801dae26683 R12: 0000000100000110
R13: ffffffff8aa58410 R14: ffff8801dae00000 R15: 0000000100000488
freezable_schedule include/linux/freezer.h:172 [inline]
do_nanosleep+0x20e/0x750 kernel/time/hrtimer.c:1689
FS: 00007fcb65251700(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000001d0d978 CR3: 00000001ae435000 CR4: 00000000001406f0
DR0: 0000000020000000 DR1: 0000000020000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
<IRQ>
cgroup_base_stat_cputime_account_end kernel/cgroup/rstat.c:358 [inline]
__cgroup_account_cputime_field+0xa4/0xf0 kernel/cgroup/rstat.c:392
cgroup_account_cputime_field include/linux/cgroup.h:744 [inline]
task_group_account_field kernel/sched/cputime.c:108 [inline]
account_system_index_time+0x2fb/0x5c0 kernel/sched/cputime.c:171
hrtimer_nanosleep+0x2d4/0x620 kernel/time/hrtimer.c:1743
__do_sys_nanosleep kernel/time/hrtimer.c:1777 [inline]
__se_sys_nanosleep kernel/time/hrtimer.c:1764 [inline]
__x64_sys_nanosleep+0x1e7/0x280 kernel/time/hrtimer.c:1764
account_system_time+0x7f/0xb0 kernel/sched/cputime.c:199
account_process_tick+0x76/0x240 kernel/sched/cputime.c:498
do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
update_process_times+0x21/0x70 kernel/time/timer.c:1634
tick_sched_handle+0x9f/0x180 kernel/time/tick-sched.c:164
tick_sched_timer+0x45/0x130 kernel/time/tick-sched.c:1274
__run_hrtimer kernel/time/hrtimer.c:1398 [inline]
__hrtimer_run_queues+0x3eb/0x10c0 kernel/time/hrtimer.c:1460
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x4812b0
Code:
05
48
3d
01
f0
hrtimer_interrupt+0x2f3/0x750 kernel/time/hrtimer.c:1518
ff ff
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1025 [inline]
smp_apic_timer_interrupt+0x165/0x730 arch/x86/kernel/apic/apic.c:1050
0f
83
0d
03
f9
ff
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:863
c3 66
</IRQ>
2e
Modules linked in:
0f
Dumping ftrace buffer:
1f
---------------------------------
84 00
syz-exec-8002 0...2 83169250us : 0: }D
00
syz-exec-8002 0...2 83169257us : 0: }D
00
syz-exec-8002 0...2 83169260us : 0: }D
00
syz-exec-8002 0...2 83169263us : 0: }D
00
syz-exec-8002 0...2 83169266us : 0: }D
66
syz-exec-8002 0...2 83169268us : 0: }D
90 83
syz-exec-8002 0...2 83169272us : 0: }D
3d
syz-exec-8002 0...2 83169274us : 0: }D
a1 51
syz-exec-8002 0...2 83169276us : 0: }D
5c 00
syz-exec-8002 0...2 83169279us : 0: }D
00
syz-exec-8002 0...2 83169282us : 0: }D
75
syz-exec-8002 0...2 83169284us : 0: }D
14
syz-exec-8002 0...2 83169287us : 0: }D
b8
syz-exec-8002 0...2 83169290us : 0: }D
23
syz-exec-8002 0...2 83169293us : 0: }D
00
syz-exec-8002 0...2 83169295us : 0: }D
00
syz-exec-8002 0...2 83169298us : 0: }D
00
syz-exec-8002 0...2 83169301us : 0: }D
0f
syz-exec-8002 0...2 83169305us : 0: }D
05 <48>
syz-exec-8002 0...2 83169307us : 0: }D
3d
syz-exec-8002 0...2 83169310us : 0: }D
01
syz-exec-8002 0...2 83169313us : 0: }D
f0
syz-exec-8002 0...2 83169316us : 0: }D
ff ff
syz-exec-8002 0...2 83169318us : 0: }D
0f
syz-exec-8002 0...2 83169321us : 0: }D
83
syz-exec-8002 0...2 83169324us : 0: }D
e4
syz-exec-8002 0...2 83169326us : 0: }D
02
syz-exec-8002 0...2 83169329us : 0: }D
f9
syz-exec-8002 0...2 83169332us : 0: }D
ff
syz-exec-8002 0...2 83169334us : 0: }D
c3 48
syz-exec-8002 0...2 83169336us : 0: }D
83
syz-exec-8002 0...2 83169339us : 0: }D
ec 08
syz-exec-8002 0...2 83169341us : 0: }D
e8
syz-exec-8002 0...2 83169343us : 0: }D
6a 74
syz-exec-8002 0...2 83169346us : 0: }D
fd
syz-exec-8002 0...2 83169349us : 0: }D
ff
syz-exec-8002 0...2 83169350us : 0: }D
syz-exec-8002 0...2 83169353us : 0: }D
RSP: 002b:00007ffc7ec39228 EFLAGS: 00000246
syz-exec-8002 0...2 83169355us : 0: }D
ORIG_RAX: 0000000000000023
syz-exec-8002 0...2 83169357us : 0: }D
RAX: ffffffffffffffda RBX: 00000000000344df RCX: 00000000004812b0
syz-exec-8002 0...2 83169360us : 0: }D
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00007ffc7ec39230
syz-exec-8002 0...2 83169362us : 0: }D
RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000001f31940
syz-exec-8002 0...2 83169365us : 0: }D
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000006
syz-exec-8002 0...2 83169367us : 0: }D
R13: 00000000000006f3 R14: 00007ffc7ec398f0 R15: 0000000000034488
syz-exec-8002 0...2 83169369us : 0: }D
syz-exec-8002 0...2 83169372us : 0: }D
Allocated by task 0:
syz-exec-8002 0...2 83169374us : 0: }D
(stack is not available)
syz-exec-8002 0...2 83169377us : 0: }D
syz-exec-8002 0...2 83169379us : 0: }D
Freed by task 0:
syz-exec-8002 0...2 83169382us : 0: }D
(stack is not available)
syz-exec-8002 0...2 83169384us : 0: }D
syz-exec-8002 0...2 83169387us : 0: }D
The buggy address belongs to the object at ffff8801b19bc480
which belongs to the cache kmalloc-1024 of size 1024
The buggy address is located 16 bytes inside of
1024-byte region [ffff8801b19bc480, ffff8801b19bc880)
syz-exec-8002 0...2 83169389us : 0: }D
The buggy address belongs to the page:
syz-exec-8002 0...2 83169392us : 0: }D
page:ffffea0006c66f00 count:1 mapcount:0 mapping:ffff8801da800ac0 index:0x0
syz-exec-8002 0...2 83169395us : 0: }D
compound_mapcount: 0
syz-exec-8002 0...2 83169397us : 0: }D
syz-exec-8002 0...2 83169400us : 0: }D
flags: 0x2fffc0000008100(slab|head)
syz-exec-8002 0...2 83169402us : 0: }D
raw: 02fffc0000008100 ffffea0006b66508 ffffea0006c65e88 ffff8801da800ac0
syz-exec-8002 0...2 83169405us : 0: }D
raw: 0000000000000000 ffff8801b19bc000 0000000100000007 0000000000000000
syz-exec-8002 0...2 83169407us : 0: }D
page dumped because: kasan: bad access detected
syz-exec-8002 0...2 83169410us : 0: }D
syz-exec-8002 0...2 83169413us : 0: }D
Memory state around the buggy address:
syz-exec-8002 0...2 83169415us : 0: }D
ffff8801b19bc380: 00 00 00 f1 f1 f1 f1 00 f2 f2 f2 f2 f2 f2 f2 00
syz-exec-8002 0...2 83169418us : 0: }D
ffff8801b19bc400: f2 f2 f2 f2 f2 f2 f2 00 f2 f2 f2 f2 f2 f2 f2 f8
syz-exec-8002 0...2 83169421us : 0: }D
>ffff8801b19bc480: f2 f2 f2 f2 f2 f2 f2 00 f2 f2 f2 00 00 00 00 00
syz-exec-8002 0...2 83169423us : 0: }D
^
syz-exec-8002 0...2 83169426us : 0: }D
ffff8801b19bc500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
syz-exec-8002 0...2 83169429us : 0: }D
ffff8801b19bc580: f1 f1 f1 f1 00 f2 f2 f2 f2 f2 f2 f2 00 f2 f2 f2
syz-exec-8002 0...2 83169431us : 0: }D
==================================================================
syz-exec-8002 0...2 83169434us : 0: }D