[ 14.266801][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #40!!! [ 16.367138][ T0] NOHZ tick-stop error: Non-RCU local softirq work is pending, handler #80!!! Warning: Permanently added '10.128.0.242' (ECDSA) to the list of known hosts. executing program [ 59.490720][ T23] audit: type=1400 audit(1642859728.880:73): avc: denied { execmem } for pid=365 comm="syz-executor313" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 [ 59.492351][ T367] L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 59.510305][ T23] audit: type=1400 audit(1642859728.880:74): avc: denied { read } for pid=366 comm="syz-executor313" name="kvm" dev="devtmpfs" ino=82 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 59.549315][ T23] audit: type=1400 audit(1642859728.880:75): avc: denied { open } for pid=366 comm="syz-executor313" path="/dev/kvm" dev="devtmpfs" ino=82 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 executing program executing program executing program [ 59.572693][ T23] audit: type=1400 audit(1642859728.880:76): avc: denied { ioctl } for pid=366 comm="syz-executor313" path="/dev/kvm" dev="devtmpfs" ino=82 ioctlcmd=0xae01 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 59.612758][ T23] audit: type=1400 audit(1642859729.000:77): avc: denied { write } for pid=372 comm="syz-executor313" name="kvm" dev="devtmpfs" ino=82 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 60.099083][ T438] ------------[ cut here ]------------ [ 60.104574][ T438] WARNING: CPU: 1 PID: 438 at arch/x86/kvm/vmx/vmx.c:2615 vmx_free_vcpu+0x266/0x2b0 [ 60.114148][ T438] Modules linked in: [ 60.118182][ T438] CPU: 1 PID: 438 Comm: syz-executor313 Not tainted 5.10.93-syzkaller-01028-g0347b1658399 #0 [ 60.128434][ T438] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 60.138699][ T438] RIP: 0010:vmx_free_vcpu+0x266/0x2b0 [ 60.144103][ T438] Code: 42 80 3c 20 00 74 08 48 89 df e8 45 c8 86 00 48 83 3b 00 75 10 e8 8a d3 4c 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 7a d3 4c 00 <0f> 0b eb ec 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c 2d fe ff ff 48 89 [ 60.164010][ T438] RSP: 0018:ffffc90000c777a8 EFLAGS: 00010293 [ 60.170151][ T438] RAX: ffffffff81201806 RBX: ffff888109eda418 RCX: ffff8881041acf00 [ 60.178170][ T438] RDX: 0000000000000000 RSI: ffff8881f715ab88 RDI: ffffea00040a6cc8 [ 60.186121][ T438] RBP: ffffc90000c777d0 R08: dffffc0000000000 R09: ffffed1020536600 [ 60.194563][ T438] R10: ffffed102070fa33 R11: 0000000000000000 R12: dffffc0000000000 [ 60.202612][ T438] R13: dffffc0000000000 R14: ffff8881029b3000 R15: 1ffff110213db482 [ 60.210596][ T438] FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 60.219526][ T438] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 60.226085][ T438] CR2: 00007fff3cdb87c0 CR3: 000000010c530000 CR4: 00000000003526a0 [ 60.234061][ T438] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 60.242039][ T438] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 60.250015][ T438] Call Trace: [ 60.253292][ T438] kvm_arch_vcpu_destroy+0xd8/0x2f0 [ 60.258491][ T438] kvm_vcpu_destroy+0x21/0xb0 [ 60.263194][ T438] kvm_arch_destroy_vm+0x40f/0x6c0 [ 60.268356][ T438] kvm_put_kvm+0x95a/0x10a0 [ 60.272851][ T438] kvm_vm_release+0x46/0x50 [ 60.277354][ T438] ? kvm_vm_compat_ioctl+0x520/0x520 [ 60.282635][ T438] __fput+0x348/0x7d0 [ 60.286592][ T438] ____fput+0x15/0x20 [ 60.290574][ T438] task_work_run+0x147/0x1b0 [ 60.295156][ T438] do_exit+0x70e/0x23a0 [ 60.299328][ T438] ? __this_cpu_preempt_check+0x1c/0x20 [ 60.304928][ T438] ? mm_update_next_owner+0x6e0/0x6e0 [ 60.310382][ T438] ? seg_setup+0x230/0x230 [ 60.314798][ T438] ? __schedule+0x94c/0xda0 [ 60.319328][ T438] ? _raw_spin_lock_irq+0x137/0x1b0 [ 60.324519][ T438] do_group_exit+0x16a/0x2d0 [ 60.329165][ T438] get_signal+0x131f/0x1f70 [ 60.333654][ T438] ? ptrace_notify+0x340/0x340 [ 60.338420][ T438] ? kvm_vcpu_ioctl+0xab9/0xd70 [ 60.343264][ T438] ? kvm_vm_ioctl_clear_dirty_log+0x6d0/0x6d0 [ 60.349336][ T438] arch_do_signal+0x8d/0x620 [ 60.353911][ T438] ? __do_sys_rt_sigreturn+0x1e0/0x1e0 [ 60.359380][ T438] ? debug_smp_processor_id+0x1c/0x20 [ 60.364761][ T438] exit_to_user_mode_prepare+0xaa/0xe0 [ 60.370222][ T438] syscall_exit_to_user_mode+0x24/0x40 [ 60.375673][ T438] do_syscall_64+0x3d/0x70 [ 60.380090][ T438] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 60.385969][ T438] RIP: 0033:0x7f48478a1729 [ 60.390377][ T438] Code: Unable to access opcode bytes at RIP 0x7f48478a16ff. [ 60.397747][ T438] RSP: 002b:00007f4847851308 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 60.406145][ T438] RAX: fffffffffffffe00 RBX: 00007f484792a408 RCX: 00007f48478a1729 [ 60.414271][ T438] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f484792a408 [ 60.422246][ T438] RBP: 00007f484792a400 R08: 0000000000000000 R09: 0000000000000000 [ 60.430219][ T438] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f484792a40c [ 60.438200][ T438] R13: 00007f48478f70b8 R14: 6d766b2f7665642f R15: 0000000000022000 [ 60.446156][ T438] ---[ end trace 10cc9e29811cf4c6 ]--- [ 60.453047][ T438] ================================================================== [ 60.461137][ T438] BUG: KASAN: use-after-free in hardware_disable+0x10f/0x250 [ 60.468482][ T438] Read of size 8 at addr ffff888109eda8f8 by task syz-executor313/438 [ 60.476687][ T438] [ 60.478997][ T438] CPU: 0 PID: 438 Comm: syz-executor313 Tainted: G W 5.10.93-syzkaller-01028-g0347b1658399 #0 [ 60.490518][ T438] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 60.500555][ T438] Call Trace: [ 60.503832][ T438] dump_stack_lvl+0x1e2/0x24b [ 60.508502][ T438] ? show_regs_print_info+0x18/0x18 [ 60.513676][ T438] ? devkmsg_release+0x127/0x127 [ 60.518596][ T438] print_address_description+0x8d/0x3d0 [ 60.524139][ T438] __kasan_report+0x142/0x220 [ 60.528793][ T438] ? hardware_disable+0x10f/0x250 [ 60.533795][ T438] kasan_report+0x51/0x70 [ 60.538104][ T438] __asan_report_load8_noabort+0x14/0x20 [ 60.543713][ T438] hardware_disable+0x10f/0x250 [ 60.548551][ T438] ? smp_call_function_many_cond+0x945/0xa20 [ 60.554522][ T438] ? hardware_enable+0x260/0x260 [ 60.559436][ T438] ? mutex_lock+0xa6/0x110 [ 60.563835][ T438] ? __kasan_check_write+0x14/0x20 [ 60.568924][ T438] ? kvm_exit+0x80/0x80 [ 60.573058][ T438] kvm_arch_hardware_disable+0x16/0xe0 [ 60.578496][ T438] ? kvm_exit+0x80/0x80 [ 60.582630][ T438] hardware_disable_nolock+0x77/0x80 [ 60.587892][ T438] on_each_cpu+0x117/0x1a0 [ 60.592282][ T438] ? __kasan_check_write+0x14/0x20 [ 60.597365][ T438] ? _raw_spin_lock+0xa3/0x1b0 [ 60.602271][ T438] ? smp_call_function+0x90/0x90 [ 60.607218][ T438] ? cpus_read_unlock+0x59/0x90 [ 60.612040][ T438] ? __static_key_slow_dec+0xab/0x150 [ 60.617397][ T438] kvm_put_kvm+0xf72/0x10a0 [ 60.621874][ T438] kvm_vm_release+0x46/0x50 [ 60.626349][ T438] ? kvm_vm_compat_ioctl+0x520/0x520 [ 60.631604][ T438] __fput+0x348/0x7d0 [ 60.635558][ T438] ____fput+0x15/0x20 [ 60.639509][ T438] task_work_run+0x147/0x1b0 [ 60.644097][ T438] do_exit+0x70e/0x23a0 [ 60.648222][ T438] ? __this_cpu_preempt_check+0x1c/0x20 [ 60.653738][ T438] ? mm_update_next_owner+0x6e0/0x6e0 [ 60.659090][ T438] ? seg_setup+0x230/0x230 [ 60.663474][ T438] ? __schedule+0x94c/0xda0 [ 60.667947][ T438] ? _raw_spin_lock_irq+0x137/0x1b0 [ 60.673116][ T438] do_group_exit+0x16a/0x2d0 [ 60.677685][ T438] get_signal+0x131f/0x1f70 [ 60.682160][ T438] ? ptrace_notify+0x340/0x340 [ 60.686894][ T438] ? kvm_vcpu_ioctl+0xab9/0xd70 [ 60.691727][ T438] ? kvm_vm_ioctl_clear_dirty_log+0x6d0/0x6d0 [ 60.697764][ T438] arch_do_signal+0x8d/0x620 [ 60.702326][ T438] ? __do_sys_rt_sigreturn+0x1e0/0x1e0 [ 60.707755][ T438] ? debug_smp_processor_id+0x1c/0x20 [ 60.713106][ T438] exit_to_user_mode_prepare+0xaa/0xe0 [ 60.718539][ T438] syscall_exit_to_user_mode+0x24/0x40 [ 60.723968][ T438] do_syscall_64+0x3d/0x70 [ 60.728355][ T438] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 60.734219][ T438] RIP: 0033:0x7f48478a1729 [ 60.738600][ T438] Code: Unable to access opcode bytes at RIP 0x7f48478a16ff. [ 60.745936][ T438] RSP: 002b:00007f4847851308 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 60.754322][ T438] RAX: fffffffffffffe00 RBX: 00007f484792a408 RCX: 00007f48478a1729 [ 60.762273][ T438] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f484792a408 [ 60.770221][ T438] RBP: 00007f484792a400 R08: 0000000000000000 R09: 0000000000000000 [ 60.778162][ T438] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f484792a40c [ 60.786106][ T438] R13: 00007f48478f70b8 R14: 6d766b2f7665642f R15: 0000000000022000 [ 60.794053][ T438] [ 60.796353][ T438] Allocated by task 438: [ 60.800577][ T438] __kasan_slab_alloc+0xb2/0xe0 [ 60.805397][ T438] kmem_cache_alloc+0x1a2/0x380 [ 60.810216][ T438] kvm_vm_ioctl+0xd78/0x1fa0 [ 60.814775][ T438] __se_sys_ioctl+0x115/0x190 [ 60.819418][ T438] __x64_sys_ioctl+0x7b/0x90 [ 60.823978][ T438] do_syscall_64+0x31/0x70 [ 60.828369][ T438] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 60.834227][ T438] [ 60.836530][ T438] Freed by task 438: [ 60.840397][ T438] kasan_set_track+0x4c/0x80 [ 60.844959][ T438] kasan_set_free_info+0x23/0x40 [ 60.849865][ T438] ____kasan_slab_free+0x133/0x170 [ 60.854944][ T438] __kasan_slab_free+0x11/0x20 [ 60.859676][ T438] slab_free_freelist_hook+0xcc/0x1a0 [ 60.865019][ T438] kmem_cache_free+0xb5/0x1f0 [ 60.869670][ T438] kvm_vcpu_destroy+0x7e/0xb0 [ 60.874317][ T438] kvm_arch_destroy_vm+0x40f/0x6c0 [ 60.879410][ T438] kvm_put_kvm+0x95a/0x10a0 [ 60.883884][ T438] kvm_vm_release+0x46/0x50 [ 60.888356][ T438] __fput+0x348/0x7d0 [ 60.892309][ T438] ____fput+0x15/0x20 [ 60.896265][ T438] task_work_run+0x147/0x1b0 [ 60.900831][ T438] do_exit+0x70e/0x23a0 [ 60.904957][ T438] do_group_exit+0x16a/0x2d0 [ 60.909517][ T438] get_signal+0x131f/0x1f70 [ 60.913993][ T438] arch_do_signal+0x8d/0x620 [ 60.918558][ T438] exit_to_user_mode_prepare+0xaa/0xe0 [ 60.923990][ T438] syscall_exit_to_user_mode+0x24/0x40 [ 60.929430][ T438] do_syscall_64+0x3d/0x70 [ 60.933823][ T438] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 60.939685][ T438] [ 60.941994][ T438] The buggy address belongs to the object at ffff888109ed8000 [ 60.941994][ T438] which belongs to the cache kvm_vcpu of size 11328 [ 60.955961][ T438] The buggy address is located 10488 bytes inside of [ 60.955961][ T438] 11328-byte region [ffff888109ed8000, ffff888109edac40) [ 60.969565][ T438] The buggy address belongs to the page: [ 60.975179][ T438] page:ffffea000427b600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109ed8 [ 60.985389][ T438] head:ffffea000427b600 order:2 compound_mapcount:0 compound_pincount:0 [ 60.993688][ T438] flags: 0x8000000000010200(slab|head) [ 60.999124][ T438] raw: 8000000000010200 dead000000000100 dead000000000122 ffff8881047adc80 [ 61.007685][ T438] raw: 0000000000000000 0000000080010001 00000001ffffffff 0000000000000000 [ 61.016239][ T438] page dumped because: kasan: bad access detected [ 61.022624][ T438] page_owner tracks the page as allocated [ 61.028321][ T438] page last allocated via order 2, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 438, ts 60080653180, free_ts 60051530576 [ 61.045223][ T438] get_page_from_freelist+0xa74/0xa90 [ 61.050574][ T438] __alloc_pages_nodemask+0x3c8/0x820 [ 61.055921][ T438] allocate_slab+0x6b/0x350 [ 61.060397][ T438] ___slab_alloc+0x143/0x2f0 [ 61.064961][ T438] kmem_cache_alloc+0x26f/0x380 [ 61.069787][ T438] kvm_vm_ioctl+0xd78/0x1fa0 [ 61.074352][ T438] __se_sys_ioctl+0x115/0x190 [ 61.079005][ T438] __x64_sys_ioctl+0x7b/0x90 [ 61.083576][ T438] do_syscall_64+0x31/0x70 [ 61.087968][ T438] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 61.093842][ T438] page last free stack trace: [ 61.098517][ T438] __free_pages_ok+0xbe7/0xc20 [ 61.103269][ T438] __free_pages+0x2d6/0x4a0 [ 61.107747][ T438] __free_slab+0xdf/0x1a0 [ 61.112053][ T438] unfreeze_partials+0x17d/0x1b0 [ 61.116963][ T438] put_cpu_partial+0xc8/0x190 [ 61.121611][ T438] __slab_free+0x2eb/0x4e0 [ 61.126001][ T438] ___cache_free+0x131/0x150 [ 61.130565][ T438] qlink_free+0x38/0x40 [ 61.134695][ T438] kasan_quarantine_reduce+0x178/0x1d0 [ 61.140125][ T438] __kasan_slab_alloc+0x2f/0xe0 [ 61.144947][ T438] kmem_cache_alloc+0x1a2/0x380 [ 61.149772][ T438] getname_flags+0xba/0x650 [ 61.154245][ T438] user_path_at_empty+0x2d/0x50 [ 61.159070][ T438] vfs_statx+0x10a/0x3f0 [ 61.163286][ T438] __se_sys_newfstatat+0xc8/0x760 [ 61.168285][ T438] __x64_sys_newfstatat+0x9b/0xb0 [ 61.173277][ T438] [ 61.175581][ T438] Memory state around the buggy address: [ 61.181190][ T438] ffff888109eda780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 61.189225][ T438] ffff888109eda800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb executing program executing program [ 61.197258][ T438] >ffff888109eda880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 61.205289][ T438] ^ [ 61.213235][ T438] ffff888109eda900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 61.221270][ T438] ffff888109eda980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 61.229312][ T438] ================================================================== [ 61.237345][ T438] Disabling lock debugging due to kernel taint [ 61.307183][ T446] ------------[ cut here ]------------ [ 61.312688][ T446] WARNING: CPU: 1 PID: 446 at arch/x86/kvm/vmx/vmx.c:2615 vmx_free_vcpu+0x266/0x2b0 [ 61.322113][ T446] Modules linked in: [ 61.326011][ T446] CPU: 0 PID: 446 Comm: syz-executor313 Tainted: G B W 5.10.93-syzkaller-01028-g0347b1658399 #0 [ 61.337582][ T446] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 61.347660][ T446] RIP: 0010:vmx_free_vcpu+0x266/0x2b0 [ 61.353042][ T446] Code: 42 80 3c 20 00 74 08 48 89 df e8 45 c8 86 00 48 83 3b 00 75 10 e8 8a d3 4c 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 7a d3 4c 00 <0f> 0b eb ec 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c 2d fe ff ff 48 89 [ 61.372645][ T446] RSP: 0018:ffffc90000c277a8 EFLAGS: 00010293 [ 61.378720][ T446] RAX: ffffffff81201806 RBX: ffff88810a63e418 RCX: ffff8881041a93c0 [ 61.386666][ T446] RDX: 0000000000000000 RSI: ffff8881f715ab88 RDI: ffffea0004282a88 [ 61.394634][ T446] RBP: ffffc90000c277d0 R08: dffffc0000000000 R09: ffffed1021415400 [ 61.402599][ T446] R10: ffffed102074c3fd R11: 0000000000000000 R12: dffffc0000000000 [ 61.410574][ T446] R13: dffffc0000000000 R14: ffff88810a0aa000 R15: 1ffff110214c7c82 [ 61.418540][ T446] FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 61.427461][ T446] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 61.434028][ T446] CR2: 00007f48478f6328 CR3: 000000011cfe9000 CR4: 00000000003526b0 [ 61.442000][ T446] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 61.449971][ T446] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 61.457933][ T446] Call Trace: [ 61.461204][ T446] kvm_arch_vcpu_destroy+0xd8/0x2f0 [ 61.466376][ T446] kvm_vcpu_destroy+0x21/0xb0 [ 61.471055][ T446] kvm_arch_destroy_vm+0x40f/0x6c0 [ 61.476153][ T446] kvm_put_kvm+0x95a/0x10a0 [ 61.480655][ T446] kvm_vm_release+0x46/0x50 [ 61.485202][ T446] ? kvm_vm_compat_ioctl+0x520/0x520 [ 61.490491][ T446] __fput+0x348/0x7d0 [ 61.494459][ T446] ____fput+0x15/0x20 [ 61.498442][ T446] task_work_run+0x147/0x1b0 [ 61.503018][ T446] do_exit+0x70e/0x23a0 [ 61.507170][ T446] ? __this_cpu_preempt_check+0x1c/0x20 [ 61.512700][ T446] ? mm_update_next_owner+0x6e0/0x6e0 [ 61.518067][ T446] ? seg_setup+0x230/0x230 [ 61.522470][ T446] ? _raw_spin_lock_irq+0x137/0x1b0 [ 61.527669][ T446] do_group_exit+0x16a/0x2d0 [ 61.532248][ T446] get_signal+0x131f/0x1f70 [ 61.536722][ T446] ? ptrace_notify+0x340/0x340 [ 61.541482][ T446] ? kvm_vcpu_ioctl+0xab9/0xd70 [ 61.546319][ T446] ? kvm_vm_ioctl_clear_dirty_log+0x6d0/0x6d0 [ 61.552388][ T446] arch_do_signal+0x8d/0x620 [ 61.556966][ T446] ? __do_sys_rt_sigreturn+0x1e0/0x1e0 [ 61.562422][ T446] ? debug_smp_processor_id+0x1c/0x20 [ 61.567795][ T446] exit_to_user_mode_prepare+0xaa/0xe0 [ 61.573227][ T446] syscall_exit_to_user_mode+0x24/0x40 [ 61.578679][ T446] do_syscall_64+0x3d/0x70 [ 61.583075][ T446] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 61.588973][ T446] RIP: 0033:0x7f48478a1729 [ 61.593375][ T446] Code: Unable to access opcode bytes at RIP 0x7f48478a16ff. executing program executing program [ 61.600737][ T446] RSP: 002b:00007f4847851308 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 61.609157][ T446] RAX: fffffffffffffe00 RBX: 00007f484792a408 RCX: 00007f48478a1729 [ 61.617127][ T446] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f484792a408 [ 61.625079][ T446] RBP: 00007f484792a400 R08: 0000000000000000 R09: 0000000000000000 [ 61.633048][ T446] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f484792a40c [ 61.641016][ T446] R13: 00007f48478f70b8 R14: 6d766b2f7665642f R15: 0000000000022000 [ 61.648988][ T446] ---[ end trace 10cc9e29811cf4c7 ]--- executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 62.027283][ T492] ------------[ cut here ]------------ [ 62.032792][ T492] WARNING: CPU: 1 PID: 492 at arch/x86/kvm/vmx/vmx.c:2615 vmx_free_vcpu+0x266/0x2b0 [ 62.042182][ T492] Modules linked in: [ 62.046093][ T492] CPU: 1 PID: 492 Comm: syz-executor313 Tainted: G B W 5.10.93-syzkaller-01028-g0347b1658399 #0 [ 62.057656][ T492] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 62.067844][ T492] RIP: 0010:vmx_free_vcpu+0x266/0x2b0 [ 62.073203][ T492] Code: 42 80 3c 20 00 74 08 48 89 df e8 45 c8 86 00 48 83 3b 00 75 10 e8 8a d3 4c 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 7a d3 4c 00 <0f> 0b eb ec 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c 2d fe ff ff 48 89 [ 62.093314][ T492] RSP: 0018:ffffc90000d477a8 EFLAGS: 00010293 [ 62.099583][ T492] RAX: ffffffff81201806 RBX: ffff88810a77a418 RCX: ffff88810aff62c0 [ 62.107562][ T492] RDX: 0000000000000000 RSI: ffff8881f715ab88 RDI: ffffea000424f888 [ 62.115522][ T492] RBP: ffffc90000d477d0 R08: dffffc0000000000 R09: ffffed102127c400 [ 62.123509][ T492] R10: ffffed102074774d R11: 0000000000000000 R12: dffffc0000000000 [ 62.131489][ T492] R13: dffffc0000000000 R14: ffff8881093e2000 R15: 1ffff110214ef482 [ 62.139467][ T492] FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 62.148394][ T492] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 62.154951][ T492] CR2: fffffffffffffff8 CR3: 000000011cfe9000 CR4: 00000000003526a0 [ 62.162929][ T492] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 62.170897][ T492] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 62.178864][ T492] Call Trace: [ 62.182138][ T492] kvm_arch_vcpu_destroy+0xd8/0x2f0 [ 62.187353][ T492] kvm_vcpu_destroy+0x21/0xb0 [ 62.192082][ T492] kvm_arch_destroy_vm+0x40f/0x6c0 [ 62.197202][ T492] kvm_put_kvm+0x95a/0x10a0 [ 62.201697][ T492] kvm_vm_release+0x46/0x50 [ 62.206172][ T492] ? kvm_vm_compat_ioctl+0x520/0x520 [ 62.211481][ T492] __fput+0x348/0x7d0 [ 62.215451][ T492] ____fput+0x15/0x20 [ 62.219432][ T492] task_work_run+0x147/0x1b0 [ 62.224016][ T492] do_exit+0x70e/0x23a0 [ 62.228174][ T492] ? mm_update_next_owner+0x6e0/0x6e0 [ 62.233532][ T492] ? __kasan_check_write+0x14/0x20 [ 62.238650][ T492] ? _raw_spin_lock_irq+0xa4/0x1b0 [ 62.243834][ T492] do_group_exit+0x16a/0x2d0 [ 62.248435][ T492] get_signal+0x131f/0x1f70 [ 62.252928][ T492] ? ptrace_notify+0x340/0x340 [ 62.257746][ T492] ? kvm_vcpu_ioctl+0xab9/0xd70 [ 62.262578][ T492] ? kvm_vm_ioctl_clear_dirty_log+0x6d0/0x6d0 [ 62.268745][ T492] arch_do_signal+0x8d/0x620 [ 62.273320][ T492] ? __do_sys_rt_sigreturn+0x1e0/0x1e0 [ 62.278785][ T492] exit_to_user_mode_prepare+0xaa/0xe0 [ 62.284232][ T492] syscall_exit_to_user_mode+0x24/0x40 [ 62.289692][ T492] do_syscall_64+0x3d/0x70 [ 62.294093][ T492] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 62.299991][ T492] RIP: 0033:0x7f48478a1729 [ 62.304395][ T492] Code: Unable to access opcode bytes at RIP 0x7f48478a16ff. [ 62.311806][ T492] RSP: 002b:00007f4847830308 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 62.320225][ T492] RAX: fffffffffffffe00 RBX: 00007f484792a418 RCX: 00007f48478a1729 executing program executing program [ 62.328209][ T492] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f484792a418 [ 62.336167][ T492] RBP: 00007f484792a410 R08: 0000000000000000 R09: 0000000000000000 [ 62.344182][ T492] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f484792a41c [ 62.352156][ T492] R13: 00007f48478f70b8 R14: 6d766b2f7665642f R15: 0000000000022000 [ 62.360132][ T492] ---[ end trace 10cc9e29811cf4c8 ]--- executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 62.787329][ T548] ------------[ cut here ]------------ [ 62.792834][ T548] WARNING: CPU: 0 PID: 548 at arch/x86/kvm/vmx/vmx.c:2615 vmx_free_vcpu+0x266/0x2b0 [ 62.802370][ T548] Modules linked in: [ 62.806313][ T548] CPU: 0 PID: 548 Comm: syz-executor313 Tainted: G B W 5.10.93-syzkaller-01028-g0347b1658399 #0 [ 62.817894][ T548] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 62.828011][ T548] RIP: 0010:vmx_free_vcpu+0x266/0x2b0 [ 62.833362][ T548] Code: 42 80 3c 20 00 74 08 48 89 df e8 45 c8 86 00 48 83 3b 00 75 10 e8 8a d3 4c 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 7a d3 4c 00 <0f> 0b eb ec 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c 2d fe ff ff 48 89 [ 62.852983][ T548] RSP: 0018:ffffc90000fb77a8 EFLAGS: 00010293 [ 62.859060][ T548] RAX: ffffffff81201806 RBX: ffff88810caa2418 RCX: ffff88810b7c0000 [ 62.867052][ T548] RDX: 0000000000000000 RSI: ffff8881f705ab88 RDI: ffffea000475a608 [ 62.875034][ T548] RBP: ffffc90000fb77d0 R08: dffffc0000000000 R09: ffffed1023ad3000 [ 62.883009][ T548] R10: ffffed10207e0791 R11: 0000000000000000 R12: dffffc0000000000 [ 62.890977][ T548] R13: dffffc0000000000 R14: ffff88811d698000 R15: 1ffff11021954482 [ 62.898941][ T548] FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 62.907860][ T548] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 62.914424][ T548] CR2: 00007f48478f6328 CR3: 000000011cfe9000 CR4: 00000000003526b0 [ 62.922398][ T548] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 62.930369][ T548] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 62.938334][ T548] Call Trace: [ 62.941605][ T548] kvm_arch_vcpu_destroy+0xd8/0x2f0 [ 62.946827][ T548] kvm_vcpu_destroy+0x21/0xb0 [ 62.951545][ T548] kvm_arch_destroy_vm+0x40f/0x6c0 [ 62.956634][ T548] kvm_put_kvm+0x95a/0x10a0 [ 62.961136][ T548] kvm_vm_release+0x46/0x50 [ 62.965624][ T548] ? kvm_vm_compat_ioctl+0x520/0x520 [ 62.970904][ T548] __fput+0x348/0x7d0 [ 62.974872][ T548] ____fput+0x15/0x20 [ 62.978858][ T548] task_work_run+0x147/0x1b0 [ 62.983437][ T548] do_exit+0x70e/0x23a0 [ 62.987601][ T548] ? mm_update_next_owner+0x6e0/0x6e0 [ 62.992955][ T548] ? __kasan_check_write+0x14/0x20 [ 62.998064][ T548] ? _raw_spin_lock_irq+0xa4/0x1b0 [ 63.003162][ T548] do_group_exit+0x16a/0x2d0 [ 63.007749][ T548] get_signal+0x131f/0x1f70 [ 63.012241][ T548] ? ptrace_notify+0x340/0x340 [ 63.016977][ T548] ? kvm_vcpu_ioctl+0xab9/0xd70 [ 63.021832][ T548] ? kvm_vm_ioctl_clear_dirty_log+0x6d0/0x6d0 [ 63.027889][ T548] arch_do_signal+0x8d/0x620 [ 63.032451][ T548] ? __do_sys_rt_sigreturn+0x1e0/0x1e0 [ 63.037913][ T548] exit_to_user_mode_prepare+0xaa/0xe0 [ 63.043361][ T548] syscall_exit_to_user_mode+0x24/0x40 [ 63.048819][ T548] do_syscall_64+0x3d/0x70 [ 63.053219][ T548] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 63.059106][ T548] RIP: 0033:0x7f48478a1729 [ 63.063501][ T548] Code: Unable to access opcode bytes at RIP 0x7f48478a16ff. [ 63.070890][ T548] RSP: 002b:00007f4847830308 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 63.079299][ T548] RAX: fffffffffffffe00 RBX: 00007f484792a418 RCX: 00007f48478a1729 executing program executing program [ 63.087265][ T548] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f484792a418 [ 63.095216][ T548] RBP: 00007f484792a410 R08: 0000000000000000 R09: 0000000000000000 [ 63.103191][ T548] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f484792a41c [ 63.111165][ T548] R13: 00007f48478f70b8 R14: 6d766b2f7665642f R15: 0000000000022000 [ 63.119129][ T548] ---[ end trace 10cc9e29811cf4c9 ]--- executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 65.036495][ T824] ------------[ cut here ]------------ [ 65.042077][ T824] WARNING: CPU: 1 PID: 824 at arch/x86/kvm/vmx/vmx.c:2615 vmx_free_vcpu+0x266/0x2b0 [ 65.051575][ T824] Modules linked in: [ 65.055460][ T824] CPU: 1 PID: 824 Comm: syz-executor313 Tainted: G B W 5.10.93-syzkaller-01028-g0347b1658399 #0 [ 65.067098][ T824] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 65.077158][ T824] RIP: 0010:vmx_free_vcpu+0x266/0x2b0 [ 65.082512][ T824] Code: 42 80 3c 20 00 74 08 48 89 df e8 45 c8 86 00 48 83 3b 00 75 10 e8 8a d3 4c 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 7a d3 4c 00 <0f> 0b eb ec 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c 2d fe ff ff 48 89 [ 65.102123][ T824] RSP: 0018:ffffc900015a77a8 EFLAGS: 00010293 [ 65.108193][ T824] RAX: ffffffff81201806 RBX: ffff888110846418 RCX: ffff8881110793c0 [ 65.116140][ T824] RDX: 0000000000000000 RSI: ffff8881f715ab88 RDI: ffffea00040a6588 [ 65.124133][ T824] RBP: ffffc900015a77d0 R08: dffffc0000000000 R09: ffffed1020532c00 [ 65.132116][ T824] R10: ffffed102070f985 R11: 0000000000000000 R12: dffffc0000000000 [ 65.140090][ T824] R13: dffffc0000000000 R14: ffff888102996000 R15: 1ffff11022108c82 [ 65.148063][ T824] FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 [ 65.156963][ T824] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 65.163550][ T824] CR2: 00007f48478f6328 CR3: 000000010cad5000 CR4: 00000000003526a0 [ 65.171539][ T824] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 65.179505][ T824] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 65.187488][ T824] Call Trace: [ 65.190775][ T824] kvm_arch_vcpu_destroy+0xd8/0x2f0 [ 65.195950][ T824] kvm_vcpu_destroy+0x21/0xb0 [ 65.200631][ T824] kvm_arch_destroy_vm+0x40f/0x6c0 [ 65.205731][ T824] kvm_put_kvm+0x95a/0x10a0 [ 65.210236][ T824] kvm_vm_release+0x46/0x50 [ 65.214728][ T824] ? kvm_vm_compat_ioctl+0x520/0x520 [ 65.220015][ T824] __fput+0x348/0x7d0 [ 65.223988][ T824] ____fput+0x15/0x20 [ 65.227974][ T824] task_work_run+0x147/0x1b0 [ 65.232560][ T824] do_exit+0x70e/0x23a0 [ 65.236691][ T824] ? mm_update_next_owner+0x6e0/0x6e0 [ 65.242058][ T824] ? __kasan_check_write+0x14/0x20 [ 65.247173][ T824] ? _raw_spin_lock_irq+0xa4/0x1b0 [ 65.252256][ T824] do_group_exit+0x16a/0x2d0 [ 65.256817][ T824] get_signal+0x131f/0x1f70 [ 65.261331][ T824] ? ptrace_notify+0x340/0x340 [ 65.266142][ T824] ? kvm_vcpu_ioctl+0xab9/0xd70 [ 65.270995][ T824] ? kvm_vm_ioctl_clear_dirty_log+0x6d0/0x6d0 [ 65.277040][ T824] arch_do_signal+0x8d/0x620 [ 65.281638][ T824] ? __do_sys_rt_sigreturn+0x1e0/0x1e0 [ 65.287114][ T824] exit_to_user_mode_prepare+0xaa/0xe0 [ 65.292554][ T824] syscall_exit_to_user_mode+0x24/0x40 [ 65.298006][ T824] do_syscall_64+0x3d/0x70 [ 65.302411][ T824] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 65.308303][ T824] RIP: 0033:0x7f48478a1729 [ 65.312702][ T824] Code: Unable to access opcode bytes at RIP 0x7f48478a16ff. [ 65.320202][ T824] RSP: 002b:00007f4847830308 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 65.328633][ T824] RAX: fffffffffffffe00 RBX: 00007f484792a418 RCX: 00007f48478a1729 executing program executing program [ 65.336581][ T824] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f484792a418 [ 65.344568][ T824] RBP: 00007f484792a410 R08: 0000000000000000 R09: 0000000000000000 [ 65.352541][ T824] R10: 0000000000000000 R11: 0000000000000246 R12: 00007f484792a41c [ 65.360515][ T824] R13: 00007f48478f70b8 R14: 6d766b2f7665642f R15: 0000000000022000 [ 65.368491][ T824] ---[ end trace 10cc9e29811cf4ca ]--- executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program executing program [ 70.257257][ T1488] ------------[ cut here ]------------ [ 70.262787][ T1488] WARNING: CPU: 1 PID: 1488 at arch/x86/kvm/vmx/vmx.c:2615 vmx_free_vcpu+0x266/0x2b0 [ 70.272362][ T1488] Modules linked in: [ 70.276273][ T1488] CPU: 1 PID: 1488 Comm: syz-executor313 Tainted: G B W 5.10.93-syzkaller-01028-g0347b1658399 #0 [ 70.287988][ T1488] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 70.298099][ T1488] RIP: 0010:vmx_free_vcpu+0x266/0x2b0 [ 70.303446][ T1488] Code: 42 80 3c 20 00 74 08 48 89 df e8 45 c8 86 00 48 83 3b 00 75 10 e8 8a d3 4c 00 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 7a d3 4c 00 <0f> 0b eb ec 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c 2d fe ff ff 48 89 [ 70.323148][ T1488] RSP: 0018:ffffc900026b77a8 EFLAGS: 00010293 [ 70.329219][ T1488] RAX: ffffffff81201806 RBX: ffff888119d46418 RCX: ffff88811c903b40 [ 70.337188][ T1488] RDX: 0000000000000000 RSI: ffff8881f715ab88 RDI: ffffea00047210c8 [ 70.345146][ T1488] RBP: ffffc900026b77d0 R08: dffffc0000000000 R09: ffffed1023908600 [ 70.353187][ T1488] R10: ffffed10207db193 R11: 0000000000000000 R12: dffffc0000000000 [ 70.361159][ T1488] R13: dffffc0000000000 R14: ffff88811c843000 R15: 1ffff110233a8c82 [ 70.369129][ T1488] FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 [ 70.378056][ T1488] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 70.384610][ T1488] CR2: 00007f48478f6328 CR3: 000000010c530000 CR4: 00000000003526b0 [ 70.392574][ T1488] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 70.400538][ T1488] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 70.408503][ T1488] Call Trace: [ 70.411775][ T1488] kvm_arch_vcpu_destroy+0xd8/0x2f0 [ 70.416946][ T1488] kvm_vcpu_destroy+0x21/0xb0 [ 70.421627][ T1488] kvm_arch_destroy_vm+0x40f/0x6c0 [ 70.426728][ T1488] kvm_put_kvm+0x95a/0x10a0 [ 70.431230][ T1488] kvm_vm_release+0x46/0x50 [ 70.435740][ T1488] ? kvm_vm_compat_ioctl+0x520/0x520 [ 70.441020][ T1488] __fput+0x348/0x7d0 [ 70.444997][ T1488] ____fput+0x15/0x20 [ 70.448979][ T1488] task_work_run+0x147/0x1b0 [ 70.453561][ T1488] do_exit+0x70e/0x23a0