Warning: Permanently added '10.128.0.238' (ED25519) to the list of known hosts. executing program executing program executing program executing program [ 125.641170][ T27] audit: type=1400 audit(1698627346.875:86): avc: denied { execmem } for pid=5035 comm="syz-executor934" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 executing program executing program [ 125.691085][ T27] audit: type=1400 audit(1698627346.925:87): avc: denied { read } for pid=5040 comm="syz-executor934" name="iommu" dev="devtmpfs" ino=625 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 executing program executing program executing program executing program executing program [ 125.760435][ T27] audit: type=1400 audit(1698627346.925:88): avc: denied { open } for pid=5040 comm="syz-executor934" path="/dev/iommu" dev="devtmpfs" ino=625 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 executing program executing program [ 125.846865][ T27] audit: type=1400 audit(1698627346.925:89): avc: denied { open } for pid=5045 comm="syz-executor934" path="/dev/iommu" dev="devtmpfs" ino=625 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 executing program executing program executing program executing program executing program [ 125.895803][ T27] audit: type=1400 audit(1698627346.925:90): avc: denied { ioctl } for pid=5045 comm="syz-executor934" path="/dev/iommu" dev="devtmpfs" ino=625 ioctlcmd=0x3b81 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 131.989127][ T6535] ================================================================== [ 131.997335][ T6535] BUG: KASAN: slab-use-after-free in __up_read+0x627/0x750 [ 132.004623][ T6535] Read of size 8 at addr ffff888073cde868 by task syz-executor934/6535 [ 132.012906][ T6535] [ 132.015265][ T6535] CPU: 1 PID: 6535 Comm: syz-executor934 Not tainted 6.6.0-rc7-syzkaller-00195-g2af9b20dbb39 #0 [ 132.025716][ T6535] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 [ 132.035808][ T6535] Call Trace: executing program executing program [ 132.039203][ T6535] [ 132.042171][ T6535] dump_stack_lvl+0xd9/0x1b0 [ 132.046838][ T6535] print_report+0xc4/0x620 [ 132.051305][ T6535] ? __virt_addr_valid+0x5e/0x2d0 [ 132.056382][ T6535] ? __phys_addr+0xc6/0x140 [ 132.060936][ T6535] kasan_report+0xda/0x110 [ 132.065417][ T6535] ? __up_read+0x627/0x750 [ 132.069889][ T6535] ? __up_read+0x627/0x750 [ 132.074358][ T6535] __up_read+0x627/0x750 [ 132.078654][ T6535] ? do_raw_spin_lock+0x12e/0x2b0 [ 132.083918][ T6535] ? up_write+0x510/0x510 executing program [ 132.088297][ T6535] ? spin_bug+0x1d0/0x1d0 [ 132.092695][ T6535] iommufd_vfio_ioas+0x46c/0x580 [ 132.097690][ T6535] ? _copy_from_user+0x5d/0xf0 [ 132.102515][ T6535] iommufd_fops_ioctl+0x347/0x4d0 [ 132.107592][ T6535] ? iommufd_destroy+0x180/0x180 [ 132.112668][ T6535] ? selinux_file_ioctl+0x17d/0x270 [ 132.117966][ T6535] ? selinux_file_ioctl+0xb5/0x270 [ 132.123233][ T6535] ? iommufd_destroy+0x180/0x180 [ 132.128225][ T6535] __x64_sys_ioctl+0x18f/0x210 [ 132.133064][ T6535] do_syscall_64+0x38/0xb0 executing program executing program [ 132.137539][ T6535] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 132.143495][ T6535] RIP: 0033:0x7f7d7a6505d9 [ 132.147949][ T6535] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 132.167603][ T6535] RSP: 002b:00007f7d7a5f0218 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 132.176062][ T6535] RAX: ffffffffffffffda RBX: 0000000000000037 RCX: 00007f7d7a6505d9 executing program [ 132.184073][ T6535] RDX: 0000000020000080 RSI: 0000000000003b88 RDI: 0000000000000003 [ 132.192085][ T6535] RBP: 00007f7d7a6da358 R08: 0000000000000000 R09: 0000000000000000 [ 132.200185][ T6535] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f7d7a6d8100 [ 132.208203][ T6535] R13: 00007f7d7a6da350 R14: 00007f7d7a6da35c R15: 00007f7d7a6a7074 [ 132.216218][ T6535] [ 132.219382][ T6535] [ 132.221731][ T6535] Allocated by task 6529: [ 132.226174][ T6535] kasan_save_stack+0x33/0x50 [ 132.230897][ T6535] kasan_set_track+0x25/0x30 [ 132.235586][ T6535] __kasan_kmalloc+0xa3/0xb0 executing program executing program [ 132.240245][ T6535] __kmalloc+0x60/0x100 [ 132.244463][ T6535] _iommufd_object_alloc+0x26/0x1b0 [ 132.249802][ T6535] iommufd_ioas_alloc_ioctl+0xaf/0x370 [ 132.255316][ T6535] iommufd_fops_ioctl+0x347/0x4d0 [ 132.260416][ T6535] __x64_sys_ioctl+0x18f/0x210 [ 132.265233][ T6535] do_syscall_64+0x38/0xb0 [ 132.269715][ T6535] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 132.276109][ T6535] [ 132.278472][ T6535] Freed by task 6536: [ 132.282485][ T6535] kasan_save_stack+0x33/0x50 executing program executing program [ 132.287312][ T6535] kasan_set_track+0x25/0x30 [ 132.291957][ T6535] kasan_save_free_info+0x28/0x40 [ 132.297041][ T6535] ____kasan_slab_free+0x138/0x190 [ 132.302203][ T6535] __kmem_cache_free+0xcc/0x2d0 [ 132.307191][ T6535] iommufd_destroy+0x11e/0x180 [ 132.312527][ T6535] iommufd_fops_ioctl+0x347/0x4d0 [ 132.317600][ T6535] __x64_sys_ioctl+0x18f/0x210 [ 132.322421][ T6535] do_syscall_64+0x38/0xb0 [ 132.326891][ T6535] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 132.332845][ T6535] executing program [ 132.335195][ T6535] The buggy address belongs to the object at ffff888073cde800 [ 132.335195][ T6535] which belongs to the cache kmalloc-cg-1k of size 1024 [ 132.349555][ T6535] The buggy address is located 104 bytes inside of [ 132.349555][ T6535] freed 1024-byte region [ffff888073cde800, ffff888073cdec00) [ 132.363498][ T6535] [ 132.365852][ T6535] The buggy address belongs to the physical page: [ 132.372288][ T6535] page:ffffea0001cf3780 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x73cde [ 132.382484][ T6535] flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff) executing program executing program [ 132.390060][ T6535] page_type: 0x2() [ 132.393818][ T6535] raw: 00fff00000000800 ffff888012c4d800 ffffea000082b690 ffffea0000712a10 [ 132.402444][ T6535] raw: 0000000000000000 ffff888073cde000 0000000100000002 0000000000000000 [ 132.411157][ T6535] page dumped because: kasan: bad access detected [ 132.417604][ T6535] page_owner tracks the page as allocated executing program executing program [ 132.423345][ T6535] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2420c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_COMP|__GFP_THISNODE), pid 4488, tgid 4488 (udevd), ts 55677988515, free_ts 55675597837 [ 132.443022][ T6535] post_alloc_hook+0x2cf/0x340 [ 132.447857][ T6535] get_page_from_freelist+0xee0/0x2f20 [ 132.453382][ T6535] __alloc_pages+0x1d0/0x4a0 [ 132.458038][ T6535] cache_grow_begin+0x99/0x3a0 [ 132.462934][ T6535] cache_alloc_refill+0x294/0x3a0 [ 132.468383][ T6535] __kmem_cache_alloc_node+0x3c5/0x470 [ 132.473887][ T6535] __kmalloc+0x4f/0x100 [ 132.478092][ T6535] alloc_pipe_info+0x1ed/0x580 [ 132.482911][ T6535] create_pipe_files+0x8f/0x870 executing program [ 132.487811][ T6535] do_pipe2+0xb0/0x1c0 [ 132.492014][ T6535] __x64_sys_pipe2+0x54/0x80 [ 132.496756][ T6535] do_syscall_64+0x38/0xb0 [ 132.501225][ T6535] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 132.507371][ T6535] page last free stack trace: [ 132.512151][ T6535] free_unref_page_prepare+0x476/0xa40 [ 132.517668][ T6535] free_unref_page+0x33/0x3b0 [ 132.522396][ T6535] inode_doinit_with_dentry+0xac0/0x12c0 [ 132.528091][ T6535] selinux_d_instantiate+0x26/0x30 [ 132.533256][ T6535] security_d_instantiate+0x54/0xe0 executing program executing program [ 132.538511][ T6535] d_splice_alias+0x94/0xdf0 [ 132.543163][ T6535] kernfs_iop_lookup+0x283/0x330 [ 132.548144][ T6535] __lookup_slow+0x24d/0x450 [ 132.552794][ T6535] walk_component+0x349/0x5a0 [ 132.557535][ T6535] path_lookupat+0x17f/0x770 [ 132.562268][ T6535] filename_lookup+0x1e7/0x5b0 [ 132.567156][ T6535] vfs_statx+0x160/0x430 [ 132.571529][ T6535] vfs_fstatat+0xb3/0x140 [ 132.575910][ T6535] __do_sys_newfstatat+0x98/0x110 [ 132.581080][ T6535] do_syscall_64+0x38/0xb0 [ 132.585553][ T6535] entry_SYSCALL_64_after_hwframe+0x63/0xcd executing program executing program [ 132.591510][ T6535] [ 132.593866][ T6535] Memory state around the buggy address: [ 132.599616][ T6535] ffff888073cde700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 132.607727][ T6535] ffff888073cde780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 132.615836][ T6535] >ffff888073cde800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 132.623929][ T6535] ^ [ 132.631418][ T6535] ffff888073cde880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb executing program [ 132.639514][ T6535] ffff888073cde900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 132.647605][ T6535] ================================================================== [ 132.675934][ T6535] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 132.683275][ T6535] CPU: 0 PID: 6535 Comm: syz-executor934 Not tainted 6.6.0-rc7-syzkaller-00195-g2af9b20dbb39 #0 [ 132.693741][ T6535] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023 [ 132.703819][ T6535] Call Trace: [ 132.707141][ T6535] [ 132.710094][ T6535] dump_stack_lvl+0xd9/0x1b0 [ 132.714718][ T6535] panic+0x6a6/0x750 [ 132.718641][ T6535] ? panic_smp_self_stop+0xa0/0xa0 [ 132.723781][ T6535] ? preempt_schedule_thunk+0x1a/0x30 [ 132.729192][ T6535] ? preempt_schedule_common+0x45/0xc0 [ 132.734778][ T6535] check_panic_on_warn+0xab/0xb0 [ 132.739758][ T6535] end_report+0x108/0x150 [ 132.744133][ T6535] kasan_report+0xea/0x110 [ 132.748579][ T6535] ? __up_read+0x627/0x750 [ 132.753026][ T6535] ? __up_read+0x627/0x750 [ 132.757468][ T6535] __up_read+0x627/0x750 [ 132.761738][ T6535] ? do_raw_spin_lock+0x12e/0x2b0 [ 132.766797][ T6535] ? up_write+0x510/0x510 [ 132.771163][ T6535] ? spin_bug+0x1d0/0x1d0 [ 132.775544][ T6535] iommufd_vfio_ioas+0x46c/0x580 [ 132.780551][ T6535] ? _copy_from_user+0x5d/0xf0 [ 132.785452][ T6535] iommufd_fops_ioctl+0x347/0x4d0 [ 132.790517][ T6535] ? iommufd_destroy+0x180/0x180 [ 132.795486][ T6535] ? selinux_file_ioctl+0x17d/0x270 [ 132.800717][ T6535] ? selinux_file_ioctl+0xb5/0x270 [ 132.805859][ T6535] ? iommufd_destroy+0x180/0x180 [ 132.810825][ T6535] __x64_sys_ioctl+0x18f/0x210 [ 132.815718][ T6535] do_syscall_64+0x38/0xb0 [ 132.820167][ T6535] entry_SYSCALL_64_after_hwframe+0x63/0xcd [ 132.826099][ T6535] RIP: 0033:0x7f7d7a6505d9 [ 132.830530][ T6535] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 51 18 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 132.850158][ T6535] RSP: 002b:00007f7d7a5f0218 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 132.858599][ T6535] RAX: ffffffffffffffda RBX: 0000000000000037 RCX: 00007f7d7a6505d9 [ 132.866590][ T6535] RDX: 0000000020000080 RSI: 0000000000003b88 RDI: 0000000000000003 [ 132.874849][ T6535] RBP: 00007f7d7a6da358 R08: 0000000000000000 R09: 0000000000000000 [ 132.882838][ T6535] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f7d7a6d8100 [ 132.890828][ T6535] R13: 00007f7d7a6da350 R14: 00007f7d7a6da35c R15: 00007f7d7a6a7074 [ 132.898825][ T6535] [ 132.902212][ T6535] Kernel Offset: disabled [ 132.906547][ T6535] Rebooting in 86400 seconds..