BUG: unable to handle kernel paging request at ffff8801d1c50d20
PGD b4df067 P4D b4df067 PUD 1d9435063 PMD 1c9c4f063 PTE ffff8801c9c4f3a0
Oops: 0000 [#1] SMP KASAN
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.18.0-rc3+ #45
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__debug_check_no_obj_freed lib/debugobjects.c:776 [inline]
RIP: 0010:debug_check_no_obj_freed+0x1c6/0x595 lib/debugobjects.c:815
Code: 00 00 31 f6 4c 89 bd 68 ff ff ff 49 89 df 89 f3 4c 89 e0 48 c1 e8 03 42 80 3c 30 00 0f 85 a1 02 00 00 49 8d 7c 24 18 83 c3 01 <4d> 8b 2c 24 48 89 f8 48 c1 e8 03 42 80 3c 30 00 0f 85 90 02 00 00
RSP: 0018:ffff8801daf07830 EFLAGS: 00010006
RAX: 1ffff1003a38a1a4 RBX: 0000000000000006 RCX: ffffffff81601b77
RDX: ffff8801cd9a4db0 RSI: 0000000000000000 RDI: ffff8801d1c50d38
RBP: ffff8801daf07920 R08: fffffbfff12554b1 R09: fffffbfff12554b0
R10: fffffbfff12554b0 R11: ffffffff892aa583 R12: ffff8801d1c50d20
R13: ffff8801d1c50d20 R14: dffffc0000000000 R15: ffffffff8abf6e88
FS: 0000000000000000(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff8801d1c50d20 CR3: 00000001ca707000 CR4: 00000000001406e0
DR0: 0000000020000000 DR1: 0000000020000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
<IRQ>
kmem_cache_free+0x216/0x2d0 mm/slab.c:3755
file_free_rcu+0x6f/0x90 fs/file_table.c:49
__rcu_reclaim kernel/rcu/rcu.h:178 [inline]
rcu_do_batch kernel/rcu/tree.c:2558 [inline]
invoke_rcu_callbacks kernel/rcu/tree.c:2818 [inline]
__rcu_process_callbacks kernel/rcu/tree.c:2785 [inline]
rcu_process_callbacks+0xed5/0x1850 kernel/rcu/tree.c:2802
__do_softirq+0x2e8/0xb17 kernel/softirq.c:288
invoke_softirq kernel/softirq.c:368 [inline]
irq_exit+0x1d1/0x200 kernel/softirq.c:408
exiting_irq arch/x86/include/asm/apic.h:527 [inline]
smp_apic_timer_interrupt+0x186/0x730 arch/x86/kernel/apic/apic.c:1052
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:863
</IRQ>
RIP: 0010:native_safe_halt+0x6/0x10 arch/x86/include/asm/irqflags.h:54
Code: c7 48 89 45 d8 e8 7a b1 25 fa 48 8b 45 d8 e9 d2 fe ff ff 48 89 df e8 69 b1 25 fa eb 8a 90 90 90 90 90 90 90 55 48 89 e5 fb f4 <5d> c3 0f 1f 84 00 00 00 00 00 55 48 89 e5 f4 5d c3 90 90 90 90 90
RSP: 0018:ffff8801d9af7c38 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13
RAX: dffffc0000000000 RBX: 1ffff1003b35ef8a RCX: ffffffff81667982
RDX: 1ffffffff11e3610 RSI: 0000000000000004 RDI: ffffffff88f1b080
RBP: ffff8801d9af7c38 R08: ffffed003b5e46d7 R09: ffffed003b5e46d6
R10: ffffed003b5e46d6 R11: ffff8801daf236b3 R12: 0000000000000001
R13: ffff8801d9af7cf0 R14: ffffffff899ebe60 R15: 0000000000000000
arch_safe_halt arch/x86/include/asm/paravirt.h:94 [inline]
default_idle+0xc7/0x450 arch/x86/kernel/process.c:500
arch_cpu_idle+0x10/0x20 arch/x86/kernel/process.c:491
default_idle_call+0x6d/0x90 kernel/sched/idle.c:93
cpuidle_idle_call kernel/sched/idle.c:153 [inline]
do_idle+0x3aa/0x570 kernel/sched/idle.c:262
cpu_startup_entry+0x10c/0x120 kernel/sched/idle.c:368
start_secondary+0x433/0x5d0 arch/x86/kernel/smpboot.c:265
secondary_startup_64+0xa5/0xb0 arch/x86/kernel/head_64.S:242
Modules linked in:
Dumping ftrace buffer:
---------------------------------
syz-exec-11046 1...2 106846074us : 0: }D
syz-exec-11046 1...2 106846078us : 0: }D
syz-exec-11046 1...2 106846082us : 0: }D
syz-exec-23813 1...2 246223570us : 0: }D
syz-exec-23813 1...2 246223577us : 0: }D
syz-exec-23813 1...2 246223579us : 0: }D
syz-exec-23813 1...2 246223582us : 0: }D
syz-exec-23813 1...2 246223585us : 0: }D
syz-exec-23813 1...2 246223587us : 0: }D
syz-exec-23813 1...2 246223590us : 0: }D
syz-exec-23813 1...2 246223592us : 0: }D
syz-exec-23813 1...2 246223595us : 0: }D
syz-exec-23813 1...2 246223598us : 0: }D
syz-exec-23813 1...2 246223600us : 0: }D
syz-exec-23813 1...2 246223603us : 0: }D
syz-exec-23813 1...2 246223605us : 0: }D
syz-exec-23813 1...2 246223608us : 0: }D
syz-exec-23813 1...2 246223610us : 0: }D
syz-exec-23813 1...2 246223612us : 0: }D
syz-exec-23813 1...2 246223615us : 0: }D
syz-exec-23813 1...2 246223617us : 0: }D
syz-exec-23813 1...2 246223620us : 0: }D
syz-exec-23813 1...2 246223622us : 0: }D
syz-exec-23813 1...2 246223625us : 0: }D
syz-exec-23813 1...2 246223627us : 0: }D
syz-exec-23813 1...2 246223629us : 0: }D
syz-exec-23813 1...2 246223632us : 0: }D
syz-exec-23813 1...2 246223634us : 0: }D
syz-exec-23813 1...2 246223637us : 0: }D
syz-exec-23813 1...2 246223639us : 0: }D
syz-exec-23813 1...2 246223642us : 0: }D
syz-exec-23813 1...2 246223644us : 0: }D
syz-exec-23813 1...2 246223647us : 0: }D
syz-exec-23813 1...2 246223649us : 0: }D
syz-exec-23813 1...2 246223652us : 0: }D
syz-exec-23813 1...2 246223654us : 0: }D
syz-exec-23813 1...2 246223656us : 0: }D
syz-exec-23813 1...2 246223658us : 0: }D
syz-exec-23813 1...2 246223661us : 0: }D
syz-exec-23813 1...2 246223664us : 0: }D
syz-exec-23813 1...2 246223666us : 0: }D
syz-exec-23813 1...2 246223669us : 0: }D
syz-exec-23813 1...2 246223671us : 0: }D
syz-exec-23813 1...2 246223674us : 0: }D
syz-exec-23813 1...2 246223676us : 0: }D
syz-exec-23813 1...2 246223678us : 0: }D
syz-exec-23813 1...2 246223681us : 0: }D
syz-exec-23813 1...2 246223683us : 0: }D
syz-exec-23813 1...2 246223686us : 0: }D
syz-exec-23813 1...2 246223689us : 0: }D
syz-exec-23813 1...2 246223691us : 0: }D
syz-exec-23813 1...2 246223694us : 0: }D
syz-exec-23813 1...2 246223696us : 0: }D
syz-exec-23813 1...2 246223698us : 0: }D
syz-exec-23813 1...2 246223701us : 0: }D
syz-exec-23813 1...2 246223703us : 0: }D
syz-exec-23813 1...2 246223706us : 0: }D
syz-exec-23813 1...2 246223709us : 0: }D
syz-exec-23813 1...2 246223711us : 0: }D
syz-exec-23813 1...2 246223713us : 0: }D
syz-exec-23813 1...2 246223716us : 0: }D
syz-exec-23813 1...2 246223719us : 0: }D
syz-exec-23813 1...2 246223721us : 0: }D
syz-exec-23813 1...2 246223724us : 0: }D
syz-exec-23813 1...2 246223726us : 0: }D
syz-exec-23813 1...2 246223729us : 0: }D
syz-exec-23813 1...2 246223731us : 0: }D
syz-exec-23813 1...2 246223734us : 0: }D
syz-exec-23813 1...2 246223736us : 0: }D
syz-exec-23813 1...2 246223739us : 0: }D
syz-exec-23813 1...2 246223741us : 0: }D
syz-exec-23813 1...2 246223744us : 0: }D
syz-exec-23813 1...2 246223746us : 0: }D
syz-exec-23813 1...2 246223749us : 0: }D
syz-exec-23813 1...2 246223751us : 0: }D
syz-exec-23813 1...2 246223754us : 0: }D
syz-exec-23813 1...2 246223756us : 0: }D
syz-exec-23813 1...2 246223758us : 0: }D
syz-exec-23813 1...2 246223761us : 0: }D
syz-exec-23813 1...2 246223763us : 0: }D
syz-exec-23813 1...2 246223766us : 0: }D
syz-exec-23813 1...2 246223768us : 0: }D
syz-exec-23813 1...2 246223771us : 0: }D
syz-exec-23813 1...2 246223773us : 0: }D
syz-exec-23813 1...2 246223775us : 0: }D
syz-exec-23813 1...2 246223777us : 0: }D
syz-exec-23813 1...2 246223780us : 0: }D
syz-exec-23813 1...2 246223782us : 0: }D
syz-exec-23813 1...2 246223785us : 0: }D
syz-exec-23813 1...2 246223787us : 0: }D
syz-exec-23813 1...2 246223790us : 0: }D
syz-exec-23813 1...2 246223792us : 0: }D
syz-exec-23813 1...2 246223794us : 0: }D
syz-exec-23813 1...2 246223796us : 0: }D
syz-exec-23813 1...2 246223798us : 0: }D
syz-exec-23813 1...2 246223800us : 0: }D
syz-exec-23813 1...2 246223802us : 0: }D
syz-exec-23813 1...2 246223804us : 0: }D
syz-exec-23813 1...2 246223807us : 0: }D
syz-exec-23813 1...2 246223809us : 0: }D
syz-exec-23813 1...2 246223811us : 0: }D
syz-exec-23813 1...2 246223813us : 0: }D
syz-exec-23813 1...2 246223815us : 0: }D
syz-exec-23813 1...2 246223818us : 0: }D
syz-exec-23813 1...2 246223820us : 0: }D
syz-exec-23813 1...2 246223822us : 0: }D
syz-exec-23813 1...2 246223824us : 0: }D
syz-exec-23813 1...2 246223826us : 0: }D
syz-exec-23813 1...2 246223828us : 0: }D
syz-exec-23813 1...2 246223831us : 0: }D
syz-exec-23813 1...2 246223833us : 0: }D
syz-exec-23813 1...2 246223835us : 0: }D
syz-exec-23813 1...2 246223837us : 0: }D
syz-exec-23813 1...2 246223881us : 0: }D
syz-exec-23813 1...2 246223884us : 0: }D
syz-exec-23813 1...2 246223886us : 0: }D
syz-exec-23813 1...2 246223889us : 0: }D
syz-exec-23813 1...2 246223892us : 0: }D
syz-exec-23813 1...2 246223894us : 0: }D
syz-exec-23813 1...2 246223897us : 0: }D
syz-exec-23813 1...2 246223901us : 0: }D
syz-exec-23813 1...2 246223904us : 0: }D
syz-exec-23813 1...2 246223907us : 0: }D
syz-exec-23813 1...2 246223910us : 0: }D
syz-exec-23813 1...2 246223913us : 0: }D
syz-exec-23813 1...2 246223915us : 0: }D
syz-exec-23813 1...2 246223917us : 0: }D
syz-exec-23813 1...2 246223920us : 0: }D
syz-exec-23813 1...2 246223923us : 0: }D
syz-exec-23813 1...2 246223925us : 0: }D
syz-exec-23813 1...2 246223927us : 0: }D
syz-exec-23813 1...2 246223929us : 0: }D
syz-exec-23813 1...2 246223932us : 0: }D
syz-exec-23813 1...2 246223934us : 0: }D
syz-exec-23813 1...2 246223936us : 0: }D
syz-exec-23813 1...2 246223940us : 0: }D
syz-exec-23813 1...2 246223942us : 0: }D
syz-exec-23813 1...2 246223944us : 0: }D
syz-exec-23813 1...2 246223947us : 0: }D
syz-exec-23813 1...2 246223950us : 0: }D
syz-exec-23813 1...2 246223966us : 0: }D
syz-exec-23813 1...2 246223969us : 0: }D
syz-exec-23813 1...2 246223971us : 0: }D
syz-exec-23813 1...2 246223974us : 0: }D
syz-exec-23813 1...2 246223976us : 0: }D
syz-exec-23813 1...2 246223979us : 0: }D
syz-exec-23813 1...2 246223982us : 0: }D
syz-exec-23813 1...2 246223985us : 0: }D
syz-exec-23813 1...2 246223987us : 0: }D
syz-exec-23813 1...2 246223990us : 0: }D
syz-exec-23813 1...2 246223993us : 0: }D
syz-exec-23813 1...2 246223996us : 0: }D
syz-exec-23813 1...2 246223998us : 0: }D
syz-exec-23813 1...2 246224001us : 0: }D
syz-exec-23813 1...2 246224004us : 0: }D
syz-exec-23813 1...2 246224007us : 0: }D
syz-exec-23813 1...2 246224009us : 0: }D
syz-exec-23813 1...2 246224012us : 0: }D
syz-exec-23813 1...2 246224015us : 0: }D
syz-exec-23813 1...2 246224017us : 0: }D
syz-exec-23813 1...2 246224020us : 0: }D
syz-exec-23813 1...2 246224023us : 0: }D
syz-exec-23813 1...2 246224025us : 0: }D
syz-exec-23813 1...2 246224028us : 0: }D
syz-exec-23813 1...2 246224030us : 0: }D
syz-exec-23813 1...2 246224034us : 0: }D
syz-exec-23813 1...2 246224036us : 0: }D
syz-exec-23813 1...2 246224039us : 0: }D
syz-exec-23813 1...2 246224042us : 0: }D
BUG: unable to handle kernel paging request at ffff88019e373708
PGD b4df067 P4D b4df067 PUD 1c7822063
==================================================================
BUG: KASAN: stack-out-of-bounds in pmd_val arch/x86/include/asm/paravirt.h:494 [inline]
BUG: KASAN: stack-out-of-bounds in dump_pagetable+0x927/0x970 arch/x86/mm/fault.c:551
Read of size 8 at addr ffff8801c7822788 by task swapper/1/0
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.18.0-rc3+ #45
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113
print_address_description+0x6c/0x20b mm/kasan/report.c:256
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412
__asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
pmd_val arch/x86/include/asm/paravirt.h:494 [inline]
dump_pagetable+0x927/0x970 arch/x86/mm/fault.c:551
show_fault_oops arch/x86/mm/fault.c:675 [inline]
no_context.cold.36+0x76/0x98 arch/x86/mm/fault.c:798
__bad_area_nosemaphore+0x33b/0x3f0 arch/x86/mm/fault.c:902
bad_area_nosemaphore+0x33/0x40 arch/x86/mm/fault.c:909
__do_page_fault+0x1db/0xe50 arch/x86/mm/fault.c:1328
do_page_fault+0xf6/0x8c0 arch/x86/mm/fault.c:1471
page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1160
RIP: 0010:rb_inc_page kernel/trace/ring_buffer.c:976 [inline]
RIP: 0010:rb_get_reader_page+0xa8f/0x10d0 kernel/trace/ring_buffer.c:3721
Code: 38 00 0f 85 6e 04 00 00 49 8b 5d 00 48 83 e3 fc 48 8d 7b 08 48 89 f8 48 c1 e8 03 42 80 3c 38 00 0f 85 5d 04 00 00 49 8d 7e 78 <4c> 89 63 08 48 89 f8 48 c1 e8 03 42 80 3c 38 00 0f 85 4d 04 00 00
RSP: 0018:ffff8801daf06bd0 EFLAGS: 00010046
RAX: 1ffff10033c6e6e1 RBX: ffff88019e373700 RCX: ffffffff817f1853
RDX: 0000000000000100 RSI: ffffffff817f19ee RDI: ffff8801d9ba3bb8
RBP: ffff8801daf06e80 R08: ffff8801d9ae8380 R09: ffffed003b343910
R10: ffffed003b343910 R11: ffff8801d9a1c887 R12: ffff8801d9a1c780
R13: ffff8801d9a1c800 R14: ffff8801d9ba3b40 R15: dffffc0000000000
rb_buffer_peek+0x81/0x430 kernel/trace/ring_buffer.c:3835
ring_buffer_peek+0x157/0x440 kernel/trace/ring_buffer.c:4033
peek_next_entry+0x1a2/0x1f0 kernel/trace/trace.c:3071
__find_next_entry+0x4d9/0x600 kernel/trace/trace.c:3102
trace_find_next_entry_inc+0x40/0x1d0 kernel/trace/trace.c:3152
ftrace_dump.cold.88+0xb0/0x1b6 kernel/trace/trace.c:8336
trace_die_handler+0x51/0x60 kernel/trace/trace.c:8185
notifier_call_chain+0x180/0x390 kernel/notifier.c:93
__atomic_notifier_call_chain kernel/notifier.c:183 [inline]
atomic_notifier_call_chain+0x98/0x190 kernel/notifier.c:193
notify_die+0x1be/0x2e0 kernel/notifier.c:549
__die+0x93/0xb4 arch/x86/kernel/dumpstack.c:382
no_context+0x3bd/0x980 arch/x86/mm/fault.c:808
__bad_area_nosemaphore+0x33b/0x3f0 arch/x86/mm/fault.c:902
bad_area_nosemaphore+0x33/0x40 arch/x86/mm/fault.c:909
__do_page_fault+0x1db/0xe50 arch/x86/mm/fault.c:1328
do_page_fault+0xf6/0x8c0 arch/x86/mm/fault.c:1471
page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1160
RIP: 0010:__debug_check_no_obj_freed lib/debugobjects.c:776 [inline]
RIP: 0010:debug_check_no_obj_freed+0x1c6/0x595 lib/debugobjects.c:815
Code: 00 00 31 f6 4c 89 bd 68 ff ff ff 49 89 df 89 f3 4c 89 e0 48 c1 e8 03 42 80 3c 30 00 0f 85 a1 02 00 00 49 8d 7c 24 18 83 c3 01 <4d> 8b 2c 24 48 89 f8 48 c1 e8 03 42 80 3c 30 00 0f 85 90 02 00 00
RSP: 0018:ffff8801daf07830 EFLAGS: 00010006
RAX: 1ffff1003a38a1a4 RBX: 0000000000000006 RCX: ffffffff81601b77
RDX: ffff8801cd9a4db0 RSI: 0000000000000000 RDI: ffff8801d1c50d38
RBP: ffff8801daf07920 R08: fffffbfff12554b1 R09: fffffbfff12554b0
R10: fffffbfff12554b0 R11: ffffffff892aa583 R12: ffff8801d1c50d20
R13: ffff8801d1c50d20 R14: dffffc0000000000 R15: ffffffff8abf6e88
kmem_cache_free+0x216/0x2d0 mm/slab.c:3755
file_free_rcu+0x6f/0x90 fs/file_table.c:49
__rcu_reclaim kernel/rcu/rcu.h:178 [inline]
rcu_do_batch kernel/rcu/tree.c:2558 [inline]
invoke_rcu_callbacks kernel/rcu/tree.c:2818 [inline]
__rcu_process_callbacks kernel/rcu/tree.c:2785 [inline]
rcu_process_callbacks+0xed5/0x1850 kernel/rcu/tree.c:2802
__do_softirq+0x2e8/0xb17 kernel/softirq.c:288
invoke_softirq kernel/softirq.c:368 [inline]
irq_exit+0x1d1/0x200 kernel/softirq.c:408
exiting_irq arch/x86/include/asm/apic.h:527 [inline]
smp_apic_timer_interrupt+0x186/0x730 arch/x86/kernel/apic/apic.c:1052
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:863
</IRQ>
RIP: 0010:native_safe_halt+0x6/0x10 arch/x86/include/asm/irqflags.h:54
Code: c7 48 89 45 d8 e8 7a b1 25 fa 48 8b 45 d8 e9 d2 fe ff ff 48 89 df e8 69 b1 25 fa eb 8a 90 90 90 90 90 90 90 55 48 89 e5 fb f4 <5d> c3 0f 1f 84 00 00 00 00 00 55 48 89 e5 f4 5d c3 90 90 90 90 90
RSP: 0018:ffff8801d9af7c38 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13
RAX: dffffc0000000000 RBX: 1ffff1003b35ef8a RCX: ffffffff81667982
RDX: 1ffffffff11e3610 RSI: 0000000000000004 RDI: ffffffff88f1b080
RBP: ffff8801d9af7c38 R08: ffffed003b5e46d7 R09: ffffed003b5e46d6
R10: ffffed003b5e46d6 R11: ffff8801daf236b3 R12: 0000000000000001
R13: ffff8801d9af7cf0 R14: ffffffff899ebe60 R15: 0000000000000000
arch_safe_halt arch/x86/include/asm/paravirt.h:94 [inline]
default_idle+0xc7/0x450 arch/x86/kernel/process.c:500
arch_cpu_idle+0x10/0x20 arch/x86/kernel/process.c:491
default_idle_call+0x6d/0x90 kernel/sched/idle.c:93
cpuidle_idle_call kernel/sched/idle.c:153 [inline]
do_idle+0x3aa/0x570 kernel/sched/idle.c:262
cpu_startup_entry+0x10c/0x120 kernel/sched/idle.c:368
start_secondary+0x433/0x5d0 arch/x86/kernel/smpboot.c:265
secondary_startup_64+0xa5/0xb0 arch/x86/kernel/head_64.S:242
The buggy address belongs to the page:
page:ffffea00071e0880 count:1 mapcount:0 mapping:0000000000000000 index:0x0
flags: 0x2fffc0000000000()
raw: 02fffc0000000000 dead000000000100 dead000000000200 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8801c7822680: f2 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff8801c7822700: 00 00 00 00 00 00 00 f1 f1 f1 f1 00 f2 f2 f2 f2
>ffff8801c7822780: f2 f2 f2 00 f2 f2 f2 f2 f2 f2 f2 00 f2 f2 f2 f2
^
ffff8801c7822800: f2 f2 f2 f8 f2 f2 f2 f2 f2 f2 f2 00 f2 f2 f2 00
ffff8801c7822880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================