===================================================== BUG: KMSAN: uninit-value in netif_receive_generic_xdp+0x15c2/0x2590 net/core/dev.c:4751 CPU: 1 PID: 24396 Comm: syz-executor.1 Tainted: G W 5.12.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x24c/0x2e0 lib/dump_stack.c:120 kmsan_report+0xfb/0x1e0 mm/kmsan/kmsan_report.c:118 __msan_warning+0x5c/0xa0 mm/kmsan/kmsan_instr.c:197 netif_receive_generic_xdp+0x15c2/0x2590 net/core/dev.c:4751 do_xdp_generic net/core/dev.c:4816 [inline] __netif_receive_skb_core+0x294a/0x65a0 net/core/dev.c:5207 __netif_receive_skb_one_core net/core/dev.c:5382 [inline] __netif_receive_skb+0xf2/0x640 net/core/dev.c:5498 process_backlog+0x517/0xbd0 net/core/dev.c:6365 __napi_poll+0x13e/0xca0 net/core/dev.c:6912 napi_poll net/core/dev.c:6979 [inline] net_rx_action+0x726/0x14a0 net/core/dev.c:7065 __do_softirq+0x1b9/0x715 kernel/softirq.c:345 invoke_softirq kernel/softirq.c:221 [inline] __irq_exit_rcu+0x22f/0x280 kernel/softirq.c:422 irq_exit_rcu+0xe/0x10 kernel/softirq.c:434 sysvec_apic_timer_interrupt+0xc6/0xf0 arch/x86/kernel/apic/apic.c:1100 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:650 RIP: 0010:_raw_spin_unlock_irqrestore+0x62/0x80 kernel/locking/spinlock.c:192 Code: 00 00 41 c6 04 24 00 81 e3 00 02 00 00 41 81 e7 00 02 00 00 48 85 db 74 0a f7 d3 44 21 fb 48 85 db 74 16 4d 85 ff 74 01 fb 5b <41> 5c 41 5e 41 5f 5d c3 e8 11 ca b6 f2 eb be 44 89 f7 e8 07 ca b6 RSP: 0018:ffff88816c3d7830 EFLAGS: 00000206 RAX: ffff88823fd2e700 RBX: 0000000000000000 RCX: 000000023fc8e700 RDX: ffff88823fc8e700 RSI: 0000000000000270 RDI: ffff88813fd1d700 RBP: ffff88816c3d7848 R08: ffffea000000000f R09: ffff88813fffa000 R10: 000000009139edcd R11: 0000000000000000 R12: ffff88813fd1d700 R13: ffff88816b45b0e8 R14: 0000000000000000 R15: 0000000000000200 unlock_hrtimer_base kernel/time/hrtimer.c:915 [inline] hrtimer_start_range_ns+0x44f/0x4d0 kernel/time/hrtimer.c:1153 hrtimer_start include/linux/hrtimer.h:422 [inline] j1939_tp_schedule_txtimer+0x135/0x1b0 net/can/j1939/transport.c:679 j1939_sk_send_loop net/can/j1939/socket.c:1062 [inline] j1939_sk_sendmsg+0x1c34/0x2890 net/can/j1939/socket.c:1175 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg net/socket.c:674 [inline] ____sys_sendmsg+0xcfc/0x12f0 net/socket.c:2350 ___sys_sendmsg net/socket.c:2404 [inline] __sys_sendmsg+0x714/0x830 net/socket.c:2433 __compat_sys_sendmsg net/compat.c:347 [inline] __do_compat_sys_sendmsg net/compat.c:354 [inline] __se_compat_sys_sendmsg+0xa7/0xc0 net/compat.c:351 __ia32_compat_sys_sendmsg+0x4a/0x70 net/compat.c:351 do_syscall_32_irqs_on arch/x86/entry/common.c:79 [inline] __do_fast_syscall_32+0x127/0x180 arch/x86/entry/common.c:142 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c RIP: 0023:0xf7fa5549 Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 RSP: 002b:00000000f559f5fc EFLAGS: 00000296 ORIG_RAX: 0000000000000172 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000200001c0 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Uninit was stored to memory at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:121 [inline] kmsan_internal_chain_origin+0xad/0x130 mm/kmsan/kmsan.c:289 kmsan_memcpy_memmove_metadata+0x25e/0x2d0 mm/kmsan/kmsan.c:226 kmsan_memcpy_metadata+0xb/0x10 mm/kmsan/kmsan.c:246 __msan_memcpy+0x46/0x60 mm/kmsan/kmsan_instr.c:110 pskb_expand_head+0x3d6/0x1e20 net/core/skbuff.c:1685 netif_receive_generic_xdp+0x61c/0x2590 net/core/dev.c:4699 do_xdp_generic net/core/dev.c:4816 [inline] __netif_receive_skb_core+0x294a/0x65a0 net/core/dev.c:5207 __netif_receive_skb_one_core net/core/dev.c:5382 [inline] __netif_receive_skb+0xf2/0x640 net/core/dev.c:5498 process_backlog+0x517/0xbd0 net/core/dev.c:6365 __napi_poll+0x13e/0xca0 net/core/dev.c:6912 napi_poll net/core/dev.c:6979 [inline] net_rx_action+0x726/0x14a0 net/core/dev.c:7065 __do_softirq+0x1b9/0x715 kernel/softirq.c:345 Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:121 [inline] kmsan_internal_poison_shadow+0x5c/0xf0 mm/kmsan/kmsan.c:104 kmsan_slab_alloc+0x8e/0xe0 mm/kmsan/kmsan_hooks.c:76 slab_alloc_node mm/slub.c:2922 [inline] __kmalloc_node_track_caller+0xa4f/0x1470 mm/slub.c:4609 kmalloc_reserve net/core/skbuff.c:353 [inline] __alloc_skb+0x4dd/0xe90 net/core/skbuff.c:424 alloc_skb include/linux/skbuff.h:1103 [inline] alloc_skb_with_frags+0x1f3/0xc10 net/core/skbuff.c:5948 sock_alloc_send_pskb+0xdc1/0xf90 net/core/sock.c:2362 sock_alloc_send_skb+0xca/0xe0 net/core/sock.c:2379 j1939_sk_alloc_skb net/can/j1939/socket.c:858 [inline] j1939_sk_send_loop net/can/j1939/socket.c:1040 [inline] j1939_sk_sendmsg+0xddd/0x2890 net/can/j1939/socket.c:1175 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg net/socket.c:674 [inline] ____sys_sendmsg+0xcfc/0x12f0 net/socket.c:2350 ___sys_sendmsg net/socket.c:2404 [inline] __sys_sendmsg+0x714/0x830 net/socket.c:2433 __compat_sys_sendmsg net/compat.c:347 [inline] __do_compat_sys_sendmsg net/compat.c:354 [inline] __se_compat_sys_sendmsg+0xa7/0xc0 net/compat.c:351 __ia32_compat_sys_sendmsg+0x4a/0x70 net/compat.c:351 do_syscall_32_irqs_on arch/x86/entry/common.c:79 [inline] __do_fast_syscall_32+0x127/0x180 arch/x86/entry/common.c:142 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c ===================================================== ------------[ cut here ]------------ WARNING: CPU: 1 PID: 24396 at drivers/gpu/drm/vkms/vkms_crtc.c:21 vkms_vblank_simulate+0x1eb/0x700 drivers/gpu/drm/vkms/vkms_crtc.c:21 Modules linked in: CPU: 1 PID: 24396 Comm: syz-executor.1 Tainted: G B W 5.12.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:vkms_vblank_simulate+0x1eb/0x700 drivers/gpu/drm/vkms/vkms_crtc.c:21 Code: 22 fb e9 b2 fe ff ff 8b 3a e8 71 77 22 fb e9 bf fe ff ff 44 89 e7 e8 64 77 22 fb 49 83 fe 01 0f 84 6e ff ff ff e8 65 86 9f fa <0f> 0b e9 67 ff ff ff 41 8b bf a8 0f 00 00 e8 42 77 22 fb 84 db 75 RSP: 0018:ffff88813fd05488 EFLAGS: 00010046 RAX: ffffffff871cad8b RBX: 0000000000000000 RCX: ffff88817236be80 RDX: 0000000000010100 RSI: 0000000000000024 RDI: 0000000000000001 RBP: ffff88813fd05508 R08: ffffffff871cacd2 R09: ffff88813fffa000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000024 R15: ffff88813fd27b00 FS: 0000000000000000(0000) GS:ffff88813fd00000(0063) knlGS:00000000f559fb40 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 000000000a769efc CR3: 000000016a964000 CR4: 00000000001506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __run_hrtimer+0x48b/0xd20 kernel/time/hrtimer.c:1537 __hrtimer_run_queues kernel/time/hrtimer.c:1601 [inline] hrtimer_interrupt+0x6e2/0x1b50 kernel/time/hrtimer.c:1663 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1089 [inline] __sysvec_apic_timer_interrupt+0xfd/0x470 arch/x86/kernel/apic/apic.c:1106 sysvec_apic_timer_interrupt+0x6a/0xf0 arch/x86/kernel/apic/apic.c:1100 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:650 RIP: 0010:__msan_warning+0x88/0xa0 mm/kmsan/kmsan_instr.c:201 Code: c4 08 e8 db e8 ff ff 8b b0 b0 0f 00 00 ff ce 89 b0 b0 0f 00 00 75 1a e8 86 df 0b ff 41 f7 c6 00 02 00 00 74 01 fb 48 83 c4 08 <5b> 41 5e 5d c3 0f 0b 48 c7 c7 f9 18 7c 90 31 c0 e8 fc f8 25 ff 0f RSP: 0018:ffff88813fd058a8 EFLAGS: 00000282 RAX: ffff88813fd27b00 RBX: 0000000015ae0268 RCX: ffff88817236be80 RDX: ffffffff92456000 RSI: 0000000000000000 RDI: ffffffff92455b90 RBP: ffff88813fd058b8 R08: ffffffff8165313c R09: 00000000ffffea41 R10: 6f6c20676e696c00 R11: 6e696c6261736944 R12: 000000000000ffff R13: 0000000000000000 R14: 0000000000000246 R15: 0000000000000000 netif_receive_generic_xdp+0x15c2/0x2590 net/core/dev.c:4751 do_xdp_generic net/core/dev.c:4816 [inline] __netif_receive_skb_core+0x294a/0x65a0 net/core/dev.c:5207 __netif_receive_skb_one_core net/core/dev.c:5382 [inline] __netif_receive_skb+0xf2/0x640 net/core/dev.c:5498 process_backlog+0x517/0xbd0 net/core/dev.c:6365 __napi_poll+0x13e/0xca0 net/core/dev.c:6912 napi_poll net/core/dev.c:6979 [inline] net_rx_action+0x726/0x14a0 net/core/dev.c:7065 __do_softirq+0x1b9/0x715 kernel/softirq.c:345 invoke_softirq kernel/softirq.c:221 [inline] __irq_exit_rcu+0x22f/0x280 kernel/softirq.c:422 irq_exit_rcu+0xe/0x10 kernel/softirq.c:434 sysvec_apic_timer_interrupt+0xc6/0xf0 arch/x86/kernel/apic/apic.c:1100 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:650 RIP: 0010:_raw_spin_unlock_irqrestore+0x62/0x80 kernel/locking/spinlock.c:192 Code: 00 00 41 c6 04 24 00 81 e3 00 02 00 00 41 81 e7 00 02 00 00 48 85 db 74 0a f7 d3 44 21 fb 48 85 db 74 16 4d 85 ff 74 01 fb 5b <41> 5c 41 5e 41 5f 5d c3 e8 11 ca b6 f2 eb be 44 89 f7 e8 07 ca b6 RSP: 0018:ffff88816c3d7830 EFLAGS: 00000206 RAX: ffff88823fd2e700 RBX: 0000000000000000 RCX: 000000023fc8e700 RDX: ffff88823fc8e700 RSI: 0000000000000270 RDI: ffff88813fd1d700 RBP: ffff88816c3d7848 R08: ffffea000000000f R09: ffff88813fffa000 R10: 000000009139edcd R11: 0000000000000000 R12: ffff88813fd1d700 R13: ffff88816b45b0e8 R14: 0000000000000000 R15: 0000000000000200 unlock_hrtimer_base kernel/time/hrtimer.c:915 [inline] hrtimer_start_range_ns+0x44f/0x4d0 kernel/time/hrtimer.c:1153 hrtimer_start include/linux/hrtimer.h:422 [inline] j1939_tp_schedule_txtimer+0x135/0x1b0 net/can/j1939/transport.c:679 j1939_sk_send_loop net/can/j1939/socket.c:1062 [inline] j1939_sk_sendmsg+0x1c34/0x2890 net/can/j1939/socket.c:1175 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg net/socket.c:674 [inline] ____sys_sendmsg+0xcfc/0x12f0 net/socket.c:2350 ___sys_sendmsg net/socket.c:2404 [inline] __sys_sendmsg+0x714/0x830 net/socket.c:2433 __compat_sys_sendmsg net/compat.c:347 [inline] __do_compat_sys_sendmsg net/compat.c:354 [inline] __se_compat_sys_sendmsg+0xa7/0xc0 net/compat.c:351 __ia32_compat_sys_sendmsg+0x4a/0x70 net/compat.c:351 do_syscall_32_irqs_on arch/x86/entry/common.c:79 [inline] __do_fast_syscall_32+0x127/0x180 arch/x86/entry/common.c:142 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c RIP: 0023:0xf7fa5549 Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 RSP: 002b:00000000f559f5fc EFLAGS: 00000296 ORIG_RAX: 0000000000000172 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000200001c0 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 ---[ end trace 834477ca168f4358 ]--- ------------[ cut here ]------------ WARNING: CPU: 1 PID: 24396 at drivers/gpu/drm/vkms/vkms_crtc.c:21 vkms_vblank_simulate+0x1eb/0x700 drivers/gpu/drm/vkms/vkms_crtc.c:21 Modules linked in: CPU: 1 PID: 24396 Comm: syz-executor.1 Tainted: G B W 5.12.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:vkms_vblank_simulate+0x1eb/0x700 drivers/gpu/drm/vkms/vkms_crtc.c:21 Code: 22 fb e9 b2 fe ff ff 8b 3a e8 71 77 22 fb e9 bf fe ff ff 44 89 e7 e8 64 77 22 fb 49 83 fe 01 0f 84 6e ff ff ff e8 65 86 9f fa <0f> 0b e9 67 ff ff ff 41 8b bf a8 0f 00 00 e8 42 77 22 fb 84 db 75 RSP: 0018:ffff88813fd05488 EFLAGS: 00010046 RAX: ffffffff871cad8b RBX: 0000000000000000 RCX: ffff88817236be80 RDX: 0000000000010100 RSI: 0000000000000029 RDI: 0000000000000001 RBP: ffff88813fd05508 R08: ffffffff871cacd2 R09: ffff88813fffa000 R10: 000000004d1d8650 R11: ffff88817236be80 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000029 R15: ffff88813fd27b00 FS: 0000000000000000(0000) GS:ffff88813fd00000(0063) knlGS:00000000f559fb40 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 000000000a769efc CR3: 000000016a964000 CR4: 00000000001506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __run_hrtimer+0x48b/0xd20 kernel/time/hrtimer.c:1537 __hrtimer_run_queues kernel/time/hrtimer.c:1601 [inline] hrtimer_interrupt+0x6e2/0x1b50 kernel/time/hrtimer.c:1663 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1089 [inline] __sysvec_apic_timer_interrupt+0xfd/0x470 arch/x86/kernel/apic/apic.c:1106 sysvec_apic_timer_interrupt+0x6a/0xf0 arch/x86/kernel/apic/apic.c:1100 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:650 RIP: 0010:__msan_warning+0x88/0xa0 mm/kmsan/kmsan_instr.c:201 Code: c4 08 e8 db e8 ff ff 8b b0 b0 0f 00 00 ff ce 89 b0 b0 0f 00 00 75 1a e8 86 df 0b ff 41 f7 c6 00 02 00 00 74 01 fb 48 83 c4 08 <5b> 41 5e 5d c3 0f 0b 48 c7 c7 f9 18 7c 90 31 c0 e8 fc f8 25 ff 0f RSP: 0018:ffff88813fd058a8 EFLAGS: 00000282 RAX: ffff88813fd27b00 RBX: 0000000015ae0268 RCX: ffff88817236be80 RDX: ffffffff92456000 RSI: 0000000000000000 RDI: ffffffff92455b90 RBP: ffff88813fd058b8 R08: ffffffff8165313c R09: 00000000ffffea41 R10: 6f6c20676e696c00 R11: 6e696c6261736944 R12: 000000000000ffff R13: 0000000000000000 R14: 0000000000000246 R15: 0000000000000000 netif_receive_generic_xdp+0x15c2/0x2590 net/core/dev.c:4751 do_xdp_generic net/core/dev.c:4816 [inline] __netif_receive_skb_core+0x294a/0x65a0 net/core/dev.c:5207 __netif_receive_skb_one_core net/core/dev.c:5382 [inline] __netif_receive_skb+0xf2/0x640 net/core/dev.c:5498 process_backlog+0x517/0xbd0 net/core/dev.c:6365 __napi_poll+0x13e/0xca0 net/core/dev.c:6912 napi_poll net/core/dev.c:6979 [inline] net_rx_action+0x726/0x14a0 net/core/dev.c:7065 __do_softirq+0x1b9/0x715 kernel/softirq.c:345 invoke_softirq kernel/softirq.c:221 [inline] __irq_exit_rcu+0x22f/0x280 kernel/softirq.c:422 irq_exit_rcu+0xe/0x10 kernel/softirq.c:434 sysvec_apic_timer_interrupt+0xc6/0xf0 arch/x86/kernel/apic/apic.c:1100 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:650 RIP: 0010:_raw_spin_unlock_irqrestore+0x62/0x80 kernel/locking/spinlock.c:192 Code: 00 00 41 c6 04 24 00 81 e3 00 02 00 00 41 81 e7 00 02 00 00 48 85 db 74 0a f7 d3 44 21 fb 48 85 db 74 16 4d 85 ff 74 01 fb 5b <41> 5c 41 5e 41 5f 5d c3 e8 11 ca b6 f2 eb be 44 89 f7 e8 07 ca b6 RSP: 0018:ffff88816c3d7830 EFLAGS: 00000206 RAX: ffff88823fd2e700 RBX: 0000000000000000 RCX: 000000023fc8e700 RDX: ffff88823fc8e700 RSI: 0000000000000270 RDI: ffff88813fd1d700 RBP: ffff88816c3d7848 R08: ffffea000000000f R09: ffff88813fffa000 R10: 000000009139edcd R11: 0000000000000000 R12: ffff88813fd1d700 R13: ffff88816b45b0e8 R14: 0000000000000000 R15: 0000000000000200 unlock_hrtimer_base kernel/time/hrtimer.c:915 [inline] hrtimer_start_range_ns+0x44f/0x4d0 kernel/time/hrtimer.c:1153 hrtimer_start include/linux/hrtimer.h:422 [inline] j1939_tp_schedule_txtimer+0x135/0x1b0 net/can/j1939/transport.c:679 j1939_sk_send_loop net/can/j1939/socket.c:1062 [inline] j1939_sk_sendmsg+0x1c34/0x2890 net/can/j1939/socket.c:1175 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg net/socket.c:674 [inline] ____sys_sendmsg+0xcfc/0x12f0 net/socket.c:2350 ___sys_sendmsg net/socket.c:2404 [inline] __sys_sendmsg+0x714/0x830 net/socket.c:2433 __compat_sys_sendmsg net/compat.c:347 [inline] __do_compat_sys_sendmsg net/compat.c:354 [inline] __se_compat_sys_sendmsg+0xa7/0xc0 net/compat.c:351 __ia32_compat_sys_sendmsg+0x4a/0x70 net/compat.c:351 do_syscall_32_irqs_on arch/x86/entry/common.c:79 [inline] __do_fast_syscall_32+0x127/0x180 arch/x86/entry/common.c:142 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c RIP: 0023:0xf7fa5549 Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 RSP: 002b:00000000f559f5fc EFLAGS: 00000296 ORIG_RAX: 0000000000000172 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000200001c0 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 ---[ end trace 834477ca168f4359 ]--- ------------[ cut here ]------------ WARNING: CPU: 1 PID: 24396 at drivers/gpu/drm/vkms/vkms_crtc.c:21 vkms_vblank_simulate+0x1eb/0x700 drivers/gpu/drm/vkms/vkms_crtc.c:21 Modules linked in: CPU: 1 PID: 24396 Comm: syz-executor.1 Tainted: G B W 5.12.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:vkms_vblank_simulate+0x1eb/0x700 drivers/gpu/drm/vkms/vkms_crtc.c:21 Code: 22 fb e9 b2 fe ff ff 8b 3a e8 71 77 22 fb e9 bf fe ff ff 44 89 e7 e8 64 77 22 fb 49 83 fe 01 0f 84 6e ff ff ff e8 65 86 9f fa <0f> 0b e9 67 ff ff ff 41 8b bf a8 0f 00 00 e8 42 77 22 fb 84 db 75 RSP: 0018:ffff88813fd05488 EFLAGS: 00010046 RAX: ffffffff871cad8b RBX: 0000000000000000 RCX: ffff88817236be80 RDX: 0000000000010100 RSI: 000000000000002a RDI: 0000000000000001 RBP: ffff88813fd05508 R08: ffffffff871cacd2 R09: ffff88813fffa000 R10: 0000000000000002 R11: ffff88817236be80 R12: 0000000000000000 R13: 0000000000000000 R14: 000000000000002a R15: ffff88813fd27b00 FS: 0000000000000000(0000) GS:ffff88813fd00000(0063) knlGS:00000000f559fb40 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 000000000a769efc CR3: 000000016a964000 CR4: 00000000001506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __run_hrtimer+0x48b/0xd20 kernel/time/hrtimer.c:1537 __hrtimer_run_queues kernel/time/hrtimer.c:1601 [inline] hrtimer_interrupt+0x6e2/0x1b50 kernel/time/hrtimer.c:1663 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1089 [inline] __sysvec_apic_timer_interrupt+0xfd/0x470 arch/x86/kernel/apic/apic.c:1106 sysvec_apic_timer_interrupt+0x6a/0xf0 arch/x86/kernel/apic/apic.c:1100 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:650 RIP: 0010:__msan_warning+0x88/0xa0 mm/kmsan/kmsan_instr.c:201 Code: c4 08 e8 db e8 ff ff 8b b0 b0 0f 00 00 ff ce 89 b0 b0 0f 00 00 75 1a e8 86 df 0b ff 41 f7 c6 00 02 00 00 74 01 fb 48 83 c4 08 <5b> 41 5e 5d c3 0f 0b 48 c7 c7 f9 18 7c 90 31 c0 e8 fc f8 25 ff 0f RSP: 0018:ffff88813fd058a8 EFLAGS: 00000282 RAX: ffff88813fd27b00 RBX: 0000000015ae0268 RCX: ffff88817236be80 RDX: ffffffff92456000 RSI: 0000000000000000 RDI: ffffffff92455b90 RBP: ffff88813fd058b8 R08: ffffffff8165313c R09: 00000000ffffea41 R10: 6f6c20676e696c00 R11: 6e696c6261736944 R12: 000000000000ffff R13: 0000000000000000 R14: 0000000000000246 R15: 0000000000000000 netif_receive_generic_xdp+0x15c2/0x2590 net/core/dev.c:4751 do_xdp_generic net/core/dev.c:4816 [inline] __netif_receive_skb_core+0x294a/0x65a0 net/core/dev.c:5207 __netif_receive_skb_one_core net/core/dev.c:5382 [inline] __netif_receive_skb+0xf2/0x640 net/core/dev.c:5498 process_backlog+0x517/0xbd0 net/core/dev.c:6365 __napi_poll+0x13e/0xca0 net/core/dev.c:6912 napi_poll net/core/dev.c:6979 [inline] net_rx_action+0x726/0x14a0 net/core/dev.c:7065 __do_softirq+0x1b9/0x715 kernel/softirq.c:345 invoke_softirq kernel/softirq.c:221 [inline] __irq_exit_rcu+0x22f/0x280 kernel/softirq.c:422 irq_exit_rcu+0xe/0x10 kernel/softirq.c:434 sysvec_apic_timer_interrupt+0xc6/0xf0 arch/x86/kernel/apic/apic.c:1100 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:650 RIP: 0010:_raw_spin_unlock_irqrestore+0x62/0x80 kernel/locking/spinlock.c:192 Code: 00 00 41 c6 04 24 00 81 e3 00 02 00 00 41 81 e7 00 02 00 00 48 85 db 74 0a f7 d3 44 21 fb 48 85 db 74 16 4d 85 ff 74 01 fb 5b <41> 5c 41 5e 41 5f 5d c3 e8 11 ca b6 f2 eb be 44 89 f7 e8 07 ca b6 RSP: 0018:ffff88816c3d7830 EFLAGS: 00000206 RAX: ffff88823fd2e700 RBX: 0000000000000000 RCX: 000000023fc8e700 RDX: ffff88823fc8e700 RSI: 0000000000000270 RDI: ffff88813fd1d700 RBP: ffff88816c3d7848 R08: ffffea000000000f R09: ffff88813fffa000 R10: 000000009139edcd R11: 0000000000000000 R12: ffff88813fd1d700 R13: ffff88816b45b0e8 R14: 0000000000000000 R15: 0000000000000200 unlock_hrtimer_base kernel/time/hrtimer.c:915 [inline] hrtimer_start_range_ns+0x44f/0x4d0 kernel/time/hrtimer.c:1153 hrtimer_start include/linux/hrtimer.h:422 [inline] j1939_tp_schedule_txtimer+0x135/0x1b0 net/can/j1939/transport.c:679 j1939_sk_send_loop net/can/j1939/socket.c:1062 [inline] j1939_sk_sendmsg+0x1c34/0x2890 net/can/j1939/socket.c:1175 sock_sendmsg_nosec net/socket.c:654 [inline] sock_sendmsg net/socket.c:674 [inline] ____sys_sendmsg+0xcfc/0x12f0 net/socket.c:2350 ___sys_sendmsg net/socket.c:2404 [inline] __sys_sendmsg+0x714/0x830 net/socket.c:2433 __compat_sys_sendmsg net/compat.c:347 [inline] __do_compat_sys_sendmsg net/compat.c:354 [inline] __se_compat_sys_sendmsg+0xa7/0xc0 net/compat.c:351 __ia32_compat_sys_sendmsg+0x4a/0x70 net/compat.c:351 do_syscall_32_irqs_on arch/x86/entry/common.c:79 [inline] __do_fast_syscall_32+0x127/0x180 arch/x86/entry/common.c:142 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c RIP: 0023:0xf7fa5549 Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00 RSP: 002b:00000000f559f5fc EFLAGS: 00000296 ORIG_RAX: 0000000000000172 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000200001c0 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 ---[ end trace 834477ca168f435a ]--- ------------[ cut here ]------------ WARNING: CPU: 1 PID: 24396 at drivers/gpu/drm/vkms/vkms_crtc.c:21 vkms_vblank_simulate+0x1eb/0x700 drivers/gpu/drm/vkms/vkms_crtc.c:21 Modules linked in: CPU: 1 PID: 24396 Comm: syz-executor.1 Tainted: G B W 5.12.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:vkms_vblank_simulate+0x1eb/0x700 drivers/gpu/drm/vkms/vkms_crtc.c:21 Code: 22 fb e9 b2 fe ff ff 8b 3a e8 71 77 22 fb e9 bf fe ff ff 44 89 e7 e8 64 77 22 fb 49 83 fe 01 0f 84 6e ff ff ff e8 65 86 9f fa <0f> 0b e9 67 ff ff ff 41 8b bf a8 0f 00 00 e8 42 77 22 fb 84 db 75 RSP: 0018:ffff88813fd05cb0 EFLAGS: 00010046 RAX: ffffffff871cad8b RBX: 0000000000000000 RCX: ffff88817236be80 RDX: 0000000000010000 RSI: 000000000000002e RDI: 0000000000000001 RBP: ffff88813fd05d30 R08: ffffffff871cacd2 R09: ffff88813fffa000 R10: 0000000000000002 R11: ffff88817236be80 R12: 0000000000000000 R13: 0000000000000000 R14: 000000000000002e R15: ffff88813fd27b00 FS: 0000000000000000(0000) GS:ffff88813fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 00000000f559fbb0 CR3: 0000000011629000 CR4: 00000000001506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __run_hrtimer+0x48b/0xd20 kernel/time/hrtimer.c:1537 __hrtimer_run_queues kernel/time/hrtimer.c:1601 [inline] hrtimer_interrupt+0x6e2/0x1b50 kernel/time/hrtimer.c:1663 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1089 [inline] __sysvec_apic_timer_interrupt+0xfd/0x470 arch/x86/kernel/apic/apic.c:1106 sysvec_apic_timer_interrupt+0xc1/0xf0 arch/x86/kernel/apic/apic.c:1100 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:650 RIP: 0010:compound_head include/linux/page-flags.h:184 [inline] RIP: 0010:PageSwapCache include/linux/page-flags.h:399 [inline] RIP: 0010:free_swap_cache mm/swap_state.c:300 [inline] RIP: 0010:free_pages_and_swap_cache+0x121/0x650 mm/swap_state.c:328 Code: 8b 22 49 8d 5f 08 48 89 45 a0 48 85 c0 0f 85 27 02 00 00 4d 8b 77 08 48 89 9d 58 ff ff ff 48 89 df e8 23 54 10 00 44 89 65 d4 <4c> 8b 20 8b 0a 89 4d a8 44 89 e3 83 e3 01 45 89 f5 41 83 e5 01 48 RSP: 0018:ffff88816c3d70a0 EFLAGS: 00000246 RAX: ffffffff92457000 RBX: ffffea0002a15fc8 RCX: 0000000171d6ee2e RDX: ffffffff92457000 RSI: 0000000000000001 RDI: ffffea0002a15fc8 RBP: ffff88816c3d7158 R08: ffffea000000000f R09: ffff88813fffa000 R10: 000000002ffba514 R11: 0000000000000000 R12: 0000000004c90128 R13: ffffea0002a15f70 R14: dead000000000100 R15: ffffea0002a15fc0 tlb_batch_pages_flush mm/mmu_gather.c:50 [inline] tlb_flush_mmu_free mm/mmu_gather.c:243 [inline] tlb_flush_mmu+0x90c/0xa90 mm/mmu_gather.c:250 zap_pte_range+0x3aab/0x3cb0 mm/memory.c:1337 zap_pmd_range mm/memory.c:1375 [inline] zap_pud_range mm/memory.c:1404 [inline] zap_p4d_range mm/memory.c:1425 [inline] unmap_page_range+0x1154/0x1440 mm/memory.c:1446 unmap_single_vma+0x56b/0x750 mm/memory.c:1491 unmap_vmas+0x3c8/0x500 mm/memory.c:1523 exit_mmap+0x5f1/0xb80 mm/mmap.c:3218 __mmput+0x1b7/0x630 kernel/fork.c:1092 mmput+0x8c/0xb0 kernel/fork.c:1113 exit_mm+0x7a9/0x9a0 kernel/exit.c:502 do_exit+0xdbb/0x3c20 kernel/exit.c:814 do_group_exit+0x1e1/0x3c0 kernel/exit.c:924 get_signal+0x2e5f/0x39e0 kernel/signal.c:2781 arch_do_signal_or_restart+0xa4/0xe10 arch/x86/kernel/signal.c:789 handle_signal_work kernel/entry/common.c:147 [inline] exit_to_user_mode_loop kernel/entry/common.c:171 [inline] exit_to_user_mode_prepare+0x2d2/0x560 kernel/entry/common.c:208 __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline] syscall_exit_to_user_mode+0x35/0x60 kernel/entry/common.c:301 __do_fast_syscall_32+0x14f/0x180 arch/x86/entry/common.c:145 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c RIP: 0023:0xf7fa5549 Code: Unable to access opcode bytes at RIP 0xf7fa551f. RSP: 002b:00000000f559f5fc EFLAGS: 00000296 ORIG_RAX: 0000000000000172 RAX: 0000000000000001 RBX: 0000000000000003 RCX: 00000000200001c0 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 ---[ end trace 834477ca168f435b ]--- ------------[ cut here ]------------ WARNING: CPU: 1 PID: 24396 at drivers/gpu/drm/vkms/vkms_crtc.c:21 vkms_vblank_simulate+0x1eb/0x700 drivers/gpu/drm/vkms/vkms_crtc.c:21 Modules linked in: CPU: 1 PID: 24396 Comm: syz-executor.1 Tainted: G B W 5.12.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:vkms_vblank_simulate+0x1eb/0x700 drivers/gpu/drm/vkms/vkms_crtc.c:21 Code: 22 fb e9 b2 fe ff ff 8b 3a e8 71 77 22 fb e9 bf fe ff ff 44 89 e7 e8 64 77 22 fb 49 83 fe 01 0f 84 6e ff ff ff e8 65 86 9f fa <0f> 0b e9 67 ff ff ff 41 8b bf a8 0f 00 00 e8 42 77 22 fb 84 db 75 RSP: 0018:ffff88813fd05cb0 EFLAGS: 00010046 RAX: ffffffff871cad8b RBX: 0000000000000000 RCX: ffff88817236be80 RDX: 0000000000010000 RSI: 0000000000000024 RDI: 0000000000000001 RBP: ffff88813fd05d30 R08: ffffffff871cacd2 R09: ffff88813fffa000 R10: 0000000000000002 R11: ffff88817236be80 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000024 R15: ffff88813fd27b00 FS: 0000000000000000(0000) GS:ffff88813fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 00000000f559fbb0 CR3: 0000000011629000 CR4: 00000000001506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __run_hrtimer+0x48b/0xd20 kernel/time/hrtimer.c:1537 __hrtimer_run_queues kernel/time/hrtimer.c:1601 [inline] hrtimer_interrupt+0x6e2/0x1b50 kernel/time/hrtimer.c:1663 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1089 [inline] __sysvec_apic_timer_interrupt+0xfd/0x470 arch/x86/kernel/apic/apic.c:1106 sysvec_apic_timer_interrupt+0xc1/0xf0 arch/x86/kernel/apic/apic.c:1100 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:650 RIP: 0010:compound_head include/linux/page-flags.h:184 [inline] RIP: 0010:PageSwapCache include/linux/page-flags.h:399 [inline] RIP: 0010:free_swap_cache mm/swap_state.c:300 [inline] RIP: 0010:free_pages_and_swap_cache+0x121/0x650 mm/swap_state.c:328 Code: 8b 22 49 8d 5f 08 48 89 45 a0 48 85 c0 0f 85 27 02 00 00 4d 8b 77 08 48 89 9d 58 ff ff ff 48 89 df e8 23 54 10 00 44 89 65 d4 <4c> 8b 20 8b 0a 89 4d a8 44 89 e3 83 e3 01 45 89 f5 41 83 e5 01 48 RSP: 0018:ffff88816c3d70a0 EFLAGS: 00000246 RAX: ffffffff92457000 RBX: ffffea0002a15fc8 RCX: 0000000171d6ee2e RDX: ffffffff92457000 RSI: 0000000000000001 RDI: ffffea0002a15fc8 RBP: ffff88816c3d7158 R08: ffffea000000000f R09: ffff88813fffa000 R10: 000000002ffba514 R11: 0000000000000000 R12: 0000000004c90128 R13: ffffea0002a15f70 R14: dead000000000100 R15: ffffea0002a15fc0 tlb_batch_pages_flush mm/mmu_gather.c:50 [inline] tlb_flush_mmu_free mm/mmu_gather.c:243 [inline] tlb_flush_mmu+0x90c/0xa90 mm/mmu_gather.c:250 zap_pte_range+0x3aab/0x3cb0 mm/memory.c:1337 zap_pmd_range mm/memory.c:1375 [inline] zap_pud_range mm/memory.c:1404 [inline] zap_p4d_range mm/memory.c:1425 [inline] unmap_page_range+0x1154/0x1440 mm/memory.c:1446 unmap_single_vma+0x56b/0x750 mm/memory.c:1491 unmap_vmas+0x3c8/0x500 mm/memory.c:1523 exit_mmap+0x5f1/0xb80 mm/mmap.c:3218 __mmput+0x1b7/0x630 kernel/fork.c:1092 mmput+0x8c/0xb0 kernel/fork.c:1113 exit_mm+0x7a9/0x9a0 kernel/exit.c:502 do_exit+0xdbb/0x3c20 kernel/exit.c:814 do_group_exit+0x1e1/0x3c0 kernel/exit.c:924 get_signal+0x2e5f/0x39e0 kernel/signal.c:2781 arch_do_signal_or_restart+0xa4/0xe10 arch/x86/kernel/signal.c:789 handle_signal_work kernel/entry/common.c:147 [inline] exit_to_user_mode_loop kernel/entry/common.c:171 [inline] exit_to_user_mode_prepare+0x2d2/0x560 kernel/entry/common.c:208 __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline] syscall_exit_to_user_mode+0x35/0x60 kernel/entry/common.c:301 __do_fast_syscall_32+0x14f/0x180 arch/x86/entry/common.c:145 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c RIP: 0023:0xf7fa5549 Code: Unable to access opcode bytes at RIP 0xf7fa551f. RSP: 002b:00000000f559f5fc EFLAGS: 00000296 ORIG_RAX: 0000000000000172 RAX: 0000000000000001 RBX: 0000000000000003 RCX: 00000000200001c0 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 ---[ end trace 834477ca168f435c ]--- ------------[ cut here ]------------ WARNING: CPU: 1 PID: 24396 at drivers/gpu/drm/vkms/vkms_crtc.c:21 vkms_vblank_simulate+0x1eb/0x700 drivers/gpu/drm/vkms/vkms_crtc.c:21 Modules linked in: CPU: 1 PID: 24396 Comm: syz-executor.1 Tainted: G B W 5.12.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:vkms_vblank_simulate+0x1eb/0x700 drivers/gpu/drm/vkms/vkms_crtc.c:21 Code: 22 fb e9 b2 fe ff ff 8b 3a e8 71 77 22 fb e9 bf fe ff ff 44 89 e7 e8 64 77 22 fb 49 83 fe 01 0f 84 6e ff ff ff e8 65 86 9f fa <0f> 0b e9 67 ff ff ff 41 8b bf a8 0f 00 00 e8 42 77 22 fb 84 db 75 RSP: 0018:ffff88813fd05cb0 EFLAGS: 00010046 RAX: ffffffff871cad8b RBX: 0000000000000000 RCX: ffff88817236be80 RDX: 0000000000010000 RSI: 0000000000000025 RDI: 0000000000000001 RBP: ffff88813fd05d30 R08: ffffffff871cacd2 R09: ffff88813fffa000 R10: 0000000000000002 R11: ffff88817236be80 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000025 R15: ffff88813fd27b00 FS: 0000000000000000(0000) GS:ffff88813fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 00000000f559fbb0 CR3: 0000000011629000 CR4: 00000000001506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __run_hrtimer+0x48b/0xd20 kernel/time/hrtimer.c:1537 __hrtimer_run_queues kernel/time/hrtimer.c:1601 [inline] hrtimer_interrupt+0x6e2/0x1b50 kernel/time/hrtimer.c:1663 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1089 [inline] __sysvec_apic_timer_interrupt+0xfd/0x470 arch/x86/kernel/apic/apic.c:1106 sysvec_apic_timer_interrupt+0xc1/0xf0 arch/x86/kernel/apic/apic.c:1100 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:650 RIP: 0010:compound_head include/linux/page-flags.h:184 [inline] RIP: 0010:PageSwapCache include/linux/page-flags.h:399 [inline] RIP: 0010:free_swap_cache mm/swap_state.c:300 [inline] RIP: 0010:free_pages_and_swap_cache+0x121/0x650 mm/swap_state.c:328 Code: 8b 22 49 8d 5f 08 48 89 45 a0 48 85 c0 0f 85 27 02 00 00 4d 8b 77 08 48 89 9d 58 ff ff ff 48 89 df e8 23 54 10 00 44 89 65 d4 <4c> 8b 20 8b 0a 89 4d a8 44 89 e3 83 e3 01 45 89 f5 41 83 e5 01 48 RSP: 0018:ffff88816c3d70a0 EFLAGS: 00000246 RAX: ffffffff92457000 RBX: ffffea0002a15fc8 RCX: 0000000171d6ee2e RDX: ffffffff92457000 RSI: 0000000000000001 RDI: ffffea0002a15fc8 RBP: ffff88816c3d7158 R08: ffffea000000000f R09: ffff88813fffa000 R10: 000000002ffba514 R11: 0000000000000000 R12: 0000000004c90128 R13: ffffea0002a15f70 R14: dead000000000100 R15: ffffea0002a15fc0 tlb_batch_pages_flush mm/mmu_gather.c:50 [inline] tlb_flush_mmu_free mm/mmu_gather.c:243 [inline] tlb_flush_mmu+0x90c/0xa90 mm/mmu_gather.c:250 zap_pte_range+0x3aab/0x3cb0 mm/memory.c:1337 zap_pmd_range mm/memory.c:1375 [inline] zap_pud_range mm/memory.c:1404 [inline] zap_p4d_range mm/memory.c:1425 [inline] unmap_page_range+0x1154/0x1440 mm/memory.c:1446 unmap_single_vma+0x56b/0x750 mm/memory.c:1491 unmap_vmas+0x3c8/0x500 mm/memory.c:1523 exit_mmap+0x5f1/0xb80 mm/mmap.c:3218 __mmput+0x1b7/0x630 kernel/fork.c:1092 mmput+0x8c/0xb0 kernel/fork.c:1113 exit_mm+0x7a9/0x9a0 kernel/exit.c:502 do_exit+0xdbb/0x3c20 kernel/exit.c:814 do_group_exit+0x1e1/0x3c0 kernel/exit.c:924 get_signal+0x2e5f/0x39e0 kernel/signal.c:2781 arch_do_signal_or_restart+0xa4/0xe10 arch/x86/kernel/signal.c:789 handle_signal_work kernel/entry/common.c:147 [inline] exit_to_user_mode_loop kernel/entry/common.c:171 [inline] exit_to_user_mode_prepare+0x2d2/0x560 kernel/entry/common.c:208 __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline] syscall_exit_to_user_mode+0x35/0x60 kernel/entry/common.c:301 __do_fast_syscall_32+0x14f/0x180 arch/x86/entry/common.c:145 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c RIP: 0023:0xf7fa5549 Code: Unable to access opcode bytes at RIP 0xf7fa551f. RSP: 002b:00000000f559f5fc EFLAGS: 00000296 ORIG_RAX: 0000000000000172 RAX: 0000000000000001 RBX: 0000000000000003 RCX: 00000000200001c0 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 ---[ end trace 834477ca168f435d ]--- ------------[ cut here ]------------ WARNING: CPU: 1 PID: 24397 at drivers/gpu/drm/vkms/vkms_crtc.c:21 vkms_vblank_simulate+0x1eb/0x700 drivers/gpu/drm/vkms/vkms_crtc.c:21 Modules linked in: CPU: 1 PID: 24397 Comm: syz-executor.0 Tainted: G B W 5.12.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:vkms_vblank_simulate+0x1eb/0x700 drivers/gpu/drm/vkms/vkms_crtc.c:21 Code: 22 fb e9 b2 fe ff ff 8b 3a e8 71 77 22 fb e9 bf fe ff ff 44 89 e7 e8 64 77 22 fb 49 83 fe 01 0f 84 6e ff ff ff e8 65 86 9f fa <0f> 0b e9 67 ff ff ff 41 8b bf a8 0f 00 00 e8 42 77 22 fb 84 db 75 RSP: 0018:ffff88813fd05cb0 EFLAGS: 00010046 RAX: ffffffff871cad8b RBX: 0000000000000000 RCX: ffff88817236ddc0 RDX: 0000000000010000 RSI: 0000000000000029 RDI: 0000000000000001 RBP: ffff88813fd05d30 R08: ffffffff871cacd2 R09: ffff88813fffa000 R10: 0000000000000002 R11: ffff88817236ddc0 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000029 R15: ffff88813fd27b00 FS: 0000000000000000(0000) GS:ffff88813fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 000000000816c0d0 CR3: 0000000011629000 CR4: 00000000001506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __run_hrtimer+0x48b/0xd20 kernel/time/hrtimer.c:1537 __hrtimer_run_queues kernel/time/hrtimer.c:1601 [inline] hrtimer_interrupt+0x6e2/0x1b50 kernel/time/hrtimer.c:1663 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1089 [inline] __sysvec_apic_timer_interrupt+0xfd/0x470 arch/x86/kernel/apic/apic.c:1106 sysvec_apic_timer_interrupt+0xc1/0xf0 arch/x86/kernel/apic/apic.c:1100 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:650 RIP: 0010:kmsan_get_shadow_origin_ptr+0x4e/0xb0 mm/kmsan/kmsan_shadow.c:162 Code: e8 67 d5 ff ff 83 b8 b0 0f 00 00 00 74 22 48 c7 c0 00 60 45 92 48 c7 c3 00 70 45 92 45 84 ff 48 0f 45 d8 48 89 da 48 89 d8 5b <41> 5e 41 5f 5d c3 4c 89 f7 48 89 de 31 d2 e8 4f d6 ff ff 84 c0 74 RSP: 0018:ffff888172217070 EFLAGS: 00000246 RAX: ffffffff92457000 RBX: ffffea00026c2c18 RCX: 0000000171d6c12e RDX: ffffffff92457000 RSI: 0000000000000001 RDI: ffffea00026c2c18 RBP: ffff888172217080 R08: ffffea000000000f R09: ffff88813fffa000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000004c90128 R13: ffffea00026c2bc0 R14: ffffea00026c2c18 R15: 0000000000000000 __msan_metadata_ptr_for_load_8+0x10/0x20 mm/kmsan/kmsan_instr.c:55 compound_head include/linux/page-flags.h:184 [inline] PageSwapCache include/linux/page-flags.h:399 [inline] free_swap_cache mm/swap_state.c:300 [inline] free_pages_and_swap_cache+0x11d/0x650 mm/swap_state.c:328 tlb_batch_pages_flush mm/mmu_gather.c:50 [inline] tlb_flush_mmu_free mm/mmu_gather.c:243 [inline] tlb_flush_mmu+0x90c/0xa90 mm/mmu_gather.c:250 zap_pte_range+0x3aab/0x3cb0 mm/memory.c:1337 zap_pmd_range mm/memory.c:1375 [inline] zap_pud_range mm/memory.c:1404 [inline] zap_p4d_range mm/memory.c:1425 [inline] unmap_page_range+0x1154/0x1440 mm/memory.c:1446 unmap_single_vma+0x56b/0x750 mm/memory.c:1491 unmap_vmas+0x3c8/0x500 mm/memory.c:1523 exit_mmap+0x5f1/0xb80 mm/mmap.c:3218 __mmput+0x1b7/0x630 kernel/fork.c:1092 mmput+0x8c/0xb0 kernel/fork.c:1113 exit_mm+0x7a9/0x9a0 kernel/exit.c:502 do_exit+0xdbb/0x3c20 kernel/exit.c:814 do_group_exit+0x1e1/0x3c0 kernel/exit.c:924 get_signal+0x2e5f/0x39e0 kernel/signal.c:2781 arch_do_signal_or_restart+0xa4/0xe10 arch/x86/kernel/signal.c:789 handle_signal_work kernel/entry/common.c:147 [inline] exit_to_user_mode_loop kernel/entry/common.c:171 [inline] exit_to_user_mode_prepare+0x2d2/0x560 kernel/entry/common.c:208 __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline] syscall_exit_to_user_mode+0x35/0x60 kernel/entry/common.c:301 __do_fast_syscall_32+0x14f/0x180 arch/x86/entry/common.c:145 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c RIP: 0023:0xf7f2f549 Code: Unable to access opcode bytes at RIP 0xf7f2f51f. RSP: 002b:00000000f54c65fc EFLAGS: 00000296 ORIG_RAX: 0000000000000027 RAX: 0000000000000000 RBX: 00000000200002c0 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 ---[ end trace 834477ca168f435e ]--- ------------[ cut here ]------------ WARNING: CPU: 1 PID: 24397 at drivers/gpu/drm/vkms/vkms_crtc.c:21 vkms_vblank_simulate+0x1eb/0x700 drivers/gpu/drm/vkms/vkms_crtc.c:21 Modules linked in: CPU: 1 PID: 24397 Comm: syz-executor.0 Tainted: G B W 5.12.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:vkms_vblank_simulate+0x1eb/0x700 drivers/gpu/drm/vkms/vkms_crtc.c:21 Code: 22 fb e9 b2 fe ff ff 8b 3a e8 71 77 22 fb e9 bf fe ff ff 44 89 e7 e8 64 77 22 fb 49 83 fe 01 0f 84 6e ff ff ff e8 65 86 9f fa <0f> 0b e9 67 ff ff ff 41 8b bf a8 0f 00 00 e8 42 77 22 fb 84 db 75 RSP: 0018:ffff88813fd05cb0 EFLAGS: 00010046 RAX: ffffffff871cad8b RBX: 0000000000000000 RCX: ffff88817236ddc0 RDX: 0000000000010000 RSI: 0000000000000022 RDI: 0000000000000001 RBP: ffff88813fd05d30 R08: ffffffff871cacd2 R09: ffff88813fffa000 R10: 0000000000000002 R11: ffff88817236ddc0 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000022 R15: ffff88813fd27b00 FS: 0000000000000000(0000) GS:ffff88813fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 000000000816c0d0 CR3: 0000000011629000 CR4: 00000000001506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __run_hrtimer+0x48b/0xd20 kernel/time/hrtimer.c:1537 __hrtimer_run_queues kernel/time/hrtimer.c:1601 [inline] hrtimer_interrupt+0x6e2/0x1b50 kernel/time/hrtimer.c:1663 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1089 [inline] __sysvec_apic_timer_interrupt+0xfd/0x470 arch/x86/kernel/apic/apic.c:1106 sysvec_apic_timer_interrupt+0xc1/0xf0 arch/x86/kernel/apic/apic.c:1100 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:650 RIP: 0010:kmsan_get_shadow_origin_ptr+0x4e/0xb0 mm/kmsan/kmsan_shadow.c:162 Code: e8 67 d5 ff ff 83 b8 b0 0f 00 00 00 74 22 48 c7 c0 00 60 45 92 48 c7 c3 00 70 45 92 45 84 ff 48 0f 45 d8 48 89 da 48 89 d8 5b <41> 5e 41 5f 5d c3 4c 89 f7 48 89 de 31 d2 e8 4f d6 ff ff 84 c0 74 RSP: 0018:ffff888172217070 EFLAGS: 00000246 RAX: ffffffff92457000 RBX: ffffea00026c2c18 RCX: 0000000171d6c12e RDX: ffffffff92457000 RSI: 0000000000000001 RDI: ffffea00026c2c18 RBP: ffff888172217080 R08: ffffea000000000f R09: ffff88813fffa000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000004c90128 R13: ffffea00026c2bc0 R14: ffffea00026c2c18 R15: 0000000000000000 __msan_metadata_ptr_for_load_8+0x10/0x20 mm/kmsan/kmsan_instr.c:55 compound_head include/linux/page-flags.h:184 [inline] PageSwapCache include/linux/page-flags.h:399 [inline] free_swap_cache mm/swap_state.c:300 [inline] free_pages_and_swap_cache+0x11d/0x650 mm/swap_state.c:328 tlb_batch_pages_flush mm/mmu_gather.c:50 [inline] tlb_flush_mmu_free mm/mmu_gather.c:243 [inline] tlb_flush_mmu+0x90c/0xa90 mm/mmu_gather.c:250 zap_pte_range+0x3aab/0x3cb0 mm/memory.c:1337 zap_pmd_range mm/memory.c:1375 [inline] zap_pud_range mm/memory.c:1404 [inline] zap_p4d_range mm/memory.c:1425 [inline] unmap_page_range+0x1154/0x1440 mm/memory.c:1446 unmap_single_vma+0x56b/0x750 mm/memory.c:1491 unmap_vmas+0x3c8/0x500 mm/memory.c:1523 exit_mmap+0x5f1/0xb80 mm/mmap.c:3218 __mmput+0x1b7/0x630 kernel/fork.c:1092 mmput+0x8c/0xb0 kernel/fork.c:1113 exit_mm+0x7a9/0x9a0 kernel/exit.c:502 do_exit+0xdbb/0x3c20 kernel/exit.c:814 do_group_exit+0x1e1/0x3c0 kernel/exit.c:924 get_signal+0x2e5f/0x39e0 kernel/signal.c:2781 arch_do_signal_or_restart+0xa4/0xe10 arch/x86/kernel/signal.c:789 handle_signal_work kernel/entry/common.c:147 [inline] exit_to_user_mode_loop kernel/entry/common.c:171 [inline] exit_to_user_mode_prepare+0x2d2/0x560 kernel/entry/common.c:208 __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline] syscall_exit_to_user_mode+0x35/0x60 kernel/entry/common.c:301 __do_fast_syscall_32+0x14f/0x180 arch/x86/entry/common.c:145 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c RIP: 0023:0xf7f2f549 Code: Unable to access opcode bytes at RIP 0xf7f2f51f. RSP: 002b:00000000f54c65fc EFLAGS: 00000296 ORIG_RAX: 0000000000000027 RAX: 0000000000000000 RBX: 00000000200002c0 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 ---[ end trace 834477ca168f435f ]--- ------------[ cut here ]------------ WARNING: CPU: 1 PID: 24397 at drivers/gpu/drm/vkms/vkms_crtc.c:21 vkms_vblank_simulate+0x1eb/0x700 drivers/gpu/drm/vkms/vkms_crtc.c:21 Modules linked in: CPU: 1 PID: 24397 Comm: syz-executor.0 Tainted: G B W 5.12.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:vkms_vblank_simulate+0x1eb/0x700 drivers/gpu/drm/vkms/vkms_crtc.c:21 Code: 22 fb e9 b2 fe ff ff 8b 3a e8 71 77 22 fb e9 bf fe ff ff 44 89 e7 e8 64 77 22 fb 49 83 fe 01 0f 84 6e ff ff ff e8 65 86 9f fa <0f> 0b e9 67 ff ff ff 41 8b bf a8 0f 00 00 e8 42 77 22 fb 84 db 75 RSP: 0018:ffff88813fd05cb0 EFLAGS: 00010046 RAX: ffffffff871cad8b RBX: 0000000000000000 RCX: ffff88817236ddc0 RDX: 0000000000010000 RSI: 0000000000000021 RDI: 0000000000000001 RBP: ffff88813fd05d30 R08: ffffffff871cacd2 R09: ffff88813fffa000 R10: 0000000000000002 R11: ffff88817236ddc0 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000021 R15: ffff88813fd27b00 FS: 0000000000000000(0000) GS:ffff88813fd00000(0000) knlGS:0000000000000000 CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 CR2: 000000000816c0d0 CR3: 0000000011629000 CR4: 00000000001506e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __run_hrtimer+0x48b/0xd20 kernel/time/hrtimer.c:1537 __hrtimer_run_queues kernel/time/hrtimer.c:1601 [inline] hrtimer_interrupt+0x6e2/0x1b50 kernel/time/hrtimer.c:1663 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1089 [inline] __sysvec_apic_timer_interrupt+0xfd/0x470 arch/x86/kernel/apic/apic.c:1106 sysvec_apic_timer_interrupt+0xc1/0xf0 arch/x86/kernel/apic/apic.c:1100 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:650 RIP: 0010:kmsan_get_shadow_origin_ptr+0x4e/0xb0 mm/kmsan/kmsan_shadow.c:162 Code: e8 67 d5 ff ff 83 b8 b0 0f 00 00 00 74 22 48 c7 c0 00 60 45 92 48 c7 c3 00 70 45 92 45 84 ff 48 0f 45 d8 48 89 da 48 89 d8 5b <41> 5e 41 5f 5d c3 4c 89 f7 48 89 de 31 d2 e8 4f d6 ff ff 84 c0 74 RSP: 0018:ffff888172217070 EFLAGS: 00000246 RAX: ffffffff92457000 RBX: ffffea00026c2c18 RCX: 0000000171d6c12e RDX: ffffffff92457000 RSI: 0000000000000001 RDI: ffffea00026c2c18 RBP: ffff888172217080 R08: ffffea000000000f R09: ffff88813fffa000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000004c90128 R13: ffffea00026c2bc0 R14: ffffea00026c2c18 R15: 0000000000000000 __msan_metadata_ptr_for_load_8+0x10/0x20 mm/kmsan/kmsan_instr.c:55 compound_head include/linux/page-flags.h:184 [inline] PageSwapCache include/linux/page-flags.h:399 [inline] free_swap_cache mm/swap_state.c:300 [inline] free_pages_and_swap_cache+0x11d/0x650 mm/swap_state.c:328 tlb_batch_pages_flush mm/mmu_gather.c:50 [inline] tlb_flush_mmu_free mm/mmu_gather.c:243 [inline] tlb_flush_mmu+0x90c/0xa90 mm/mmu_gather.c:250 zap_pte_range+0x3aab/0x3cb0 mm/memory.c:1337 zap_pmd_range mm/memory.c:1375 [inline] zap_pud_range mm/memory.c:1404 [inline] zap_p4d_range mm/memory.c:1425 [inline] unmap_page_range+0x1154/0x1440 mm/memory.c:1446 unmap_single_vma+0x56b/0x750 mm/memory.c:1491 unmap_vmas+0x3c8/0x500 mm/memory.c:1523 exit_mmap+0x5f1/0xb80 mm/mmap.c:3218 __mmput+0x1b7/0x630 kernel/fork.c:1092 mmput+0x8c/0xb0 kernel/fork.c:1113 exit_mm+0x7a9/0x9a0 kernel/exit.c:502 do_exit+0xdbb/0x3c20 kernel/exit.c:814 do_group_exit+0x1e1/0x3c0 kernel/exit.c:924 get_signal+0x2e5f/0x39e0 kernel/signal.c:2781 arch_do_signal_or_restart+0xa4/0xe10 arch/x86/kernel/signal.c:789 handle_signal_work kernel/entry/common.c:147 [inline] exit_to_user_mode_loop kernel/entry/common.c:171 [inline] exit_to_user_mode_prepare+0x2d2/0x560 kernel/entry/common.c:208 __syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline] syscall_exit_to_user_mode+0x35/0x60 kernel/entry/common.c:301 __do_fast_syscall_32+0x14f/0x180 arch/x86/entry/common.c:145 do_fast_syscall_32+0x77/0xd0 arch/x86/entry/common.c:168 do_SYSENTER_32+0x73/0x90 arch/x86/entry/common.c:211 entry_SYSENTER_compat_after_hwframe+0x4d/0x5c RIP: 0023:0xf7f2f549 Code: Unable to access opcode bytes at RIP 0xf7f2f51f. RSP: 002b:00000000f54c65fc EFLAGS: 00000296 ORIG_RAX: 0000000000000027 RAX: 0000000000000000 RBX: 00000000200002c0 RCX: 0000000000000000 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 ---[ end trace 834477ca168f4360 ]---