================================================================== BUG: KASAN: slab-out-of-bounds in search_memslots include/linux/kvm_host.h:1051 [inline] BUG: KASAN: slab-out-of-bounds in __gfn_to_memslot include/linux/kvm_host.h:1063 [inline] BUG: KASAN: slab-out-of-bounds in gfn_to_memslot arch/x86/kvm/../../../virt/kvm/kvm_main.c:1597 [inline] BUG: KASAN: slab-out-of-bounds in gfn_to_hva+0x4a0/0x4c0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:1677 Read of size 8 at addr ffff888094f07468 by task kworker/u4:7/9190 CPU: 0 PID: 9190 Comm: kworker/u4:7 Not tainted 5.7.0-rc1-next-20200415-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: writeback wb_workfn (flush-8:0) Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x188/0x20d lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xd3/0x315 mm/kasan/report.c:382 __kasan_report.cold+0x35/0x4d mm/kasan/report.c:511 kasan_report+0x33/0x50 mm/kasan/common.c:625 search_memslots include/linux/kvm_host.h:1051 [inline] __gfn_to_memslot include/linux/kvm_host.h:1063 [inline] gfn_to_memslot arch/x86/kvm/../../../virt/kvm/kvm_main.c:1597 [inline] gfn_to_hva+0x4a0/0x4c0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:1677 kvm_arch_mmu_notifier_invalidate_range+0x21/0x80 arch/x86/kvm/x86.c:8142 kvm_mmu_notifier_invalidate_range_start+0x1a1/0x280 arch/x86/kvm/../../../virt/kvm/kvm_main.c:421 mn_hlist_invalidate_range_start mm/mmu_notifier.c:493 [inline] __mmu_notifier_invalidate_range_start+0x4bc/0x6b0 mm/mmu_notifier.c:525 mmu_notifier_invalidate_range_start include/linux/mmu_notifier.h:446 [inline] page_mkclean_one+0x5dc/0x6c0 mm/rmap.c:916 rmap_walk_file+0x581/0xcf0 mm/rmap.c:1917 rmap_walk+0x122/0x1c0 mm/rmap.c:1935 page_mkclean+0x23b/0x310 mm/rmap.c:998 clear_page_dirty_for_io+0x351/0xdd0 mm/page-writeback.c:2690 mpage_submit_page+0x80/0x2d0 fs/ext4/inode.c:2053 mpage_process_page_bufs+0x616/0x730 fs/ext4/inode.c:2187 mpage_prepare_extent_to_map+0x960/0xeb0 fs/ext4/inode.c:2595 ext4_writepages+0x953/0x3210 fs/ext4/inode.c:2723 do_writepages+0xfa/0x2a0 mm/page-writeback.c:2344 __writeback_single_inode+0x12a/0x1410 fs/fs-writeback.c:1452 writeback_sb_inodes+0x515/0xdd0 fs/fs-writeback.c:1716 __writeback_inodes_wb+0xc3/0x250 fs/fs-writeback.c:1785 wb_writeback+0x910/0xd90 fs/fs-writeback.c:1894 wb_check_old_data_flush fs/fs-writeback.c:1996 [inline] wb_do_writeback fs/fs-writeback.c:2049 [inline] wb_workfn+0xb50/0x11c0 fs/fs-writeback.c:2078 process_one_work+0x965/0x16a0 kernel/workqueue.c:2268 worker_thread+0x96/0xe20 kernel/workqueue.c:2414 kthread+0x388/0x470 kernel/kthread.c:268 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Allocated by task 7334: save_stack+0x1b/0x40 mm/kasan/common.c:49 set_track mm/kasan/common.c:57 [inline] __kasan_kmalloc mm/kasan/common.c:495 [inline] __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:468 kmalloc_node include/linux/slab.h:578 [inline] kvmalloc_node+0x61/0xf0 mm/util.c:574 kvmalloc include/linux/mm.h:757 [inline] kvzalloc include/linux/mm.h:765 [inline] kvm_dup_memslots arch/x86/kvm/../../../virt/kvm/kvm_main.c:1101 [inline] kvm_set_memslot+0x115/0x1530 arch/x86/kvm/../../../virt/kvm/kvm_main.c:1118 __kvm_set_memory_region+0xcf7/0x1320 arch/x86/kvm/../../../virt/kvm/kvm_main.c:1300 kvm_set_memory_region+0x29/0x50 arch/x86/kvm/../../../virt/kvm/kvm_main.c:1321 kvm_vm_ioctl_set_memory_region arch/x86/kvm/../../../virt/kvm/kvm_main.c:1333 [inline] kvm_vm_ioctl+0x678/0x2400 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3604 vfs_ioctl fs/ioctl.c:47 [inline] ksys_ioctl+0x11a/0x180 fs/ioctl.c:763 __do_sys_ioctl fs/ioctl.c:772 [inline] __se_sys_ioctl fs/ioctl.c:770 [inline] __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:770 do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295 entry_SYSCALL_64_after_hwframe+0x49/0xb3 Freed by task 6887: save_stack+0x1b/0x40 mm/kasan/common.c:49 set_track mm/kasan/common.c:57 [inline] kasan_set_free_info mm/kasan/common.c:317 [inline] __kasan_slab_free+0xf7/0x140 mm/kasan/common.c:456 __cache_free mm/slab.c:3426 [inline] kfree+0x109/0x2b0 mm/slab.c:3757 kvfree+0x42/0x50 mm/util.c:603 __free_fdtable+0x2d/0x70 fs/file.c:31 put_files_struct fs/file.c:420 [inline] put_files_struct+0x248/0x2e0 fs/file.c:413 exit_files+0x7e/0xa0 fs/file.c:445 do_exit+0xb24/0x2e10 kernel/exit.c:790 do_group_exit+0x125/0x340 kernel/exit.c:893 get_signal+0x47b/0x24e0 kernel/signal.c:2735 do_signal+0x81/0x2240 arch/x86/kernel/signal.c:784 exit_to_usermode_loop+0x26c/0x360 arch/x86/entry/common.c:161 prepare_exit_to_usermode arch/x86/entry/common.c:196 [inline] syscall_return_slowpath arch/x86/entry/common.c:279 [inline] do_syscall_64+0x6b1/0x7d0 arch/x86/entry/common.c:305 entry_SYSCALL_64_after_hwframe+0x49/0xb3 The buggy address belongs to the object at ffff888094f07000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 1128 bytes inside of 2048-byte region [ffff888094f07000, ffff888094f07800) The buggy address belongs to the page: page:ffffea000253c1c0 refcount:1 mapcount:0 mapping:000000003a118229 index:0x0 flags: 0xfffe0000000200(slab) raw: 00fffe0000000200 ffffea000258f048 ffffea00013a2288 ffff8880aa000e00 raw: 0000000000000000 ffff888094f07000 0000000100000001 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888094f07300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888094f07380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff888094f07400: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc ^ ffff888094f07480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888094f07500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================