==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:68 [inline]
BUG: KASAN: null-ptr-deref in atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
BUG: KASAN: null-ptr-deref in buffer_busy fs/buffer.c:2876 [inline]
BUG: KASAN: null-ptr-deref in drop_buffers.constprop.0+0x89/0x340 fs/buffer.c:2888
Read of size 4 at addr 0000000000000060 by task syz-executor/16160
CPU: 0 UID: 0 PID: 16160 Comm: syz-executor Not tainted 6.13.0-rc4-syzkaller-00071-gfd0584d220fe #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
kasan_report+0xd9/0x110 mm/kasan/report.c:602
check_region_inline mm/kasan/generic.c:183 [inline]
kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189
instrument_atomic_read include/linux/instrumented.h:68 [inline]
atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
buffer_busy fs/buffer.c:2876 [inline]
drop_buffers.constprop.0+0x89/0x340 fs/buffer.c:2888
try_to_free_buffers+0x21e/0x2d0 fs/buffer.c:2942
filemap_release_folio+0x219/0x280 mm/filemap.c:4220
shrink_folio_list+0x200d/0x42d0 mm/vmscan.c:1433
evict_folios+0x6e3/0x19c0 mm/vmscan.c:4593
try_to_shrink_lruvec+0x61e/0xa80 mm/vmscan.c:4789
lru_gen_shrink_lruvec mm/vmscan.c:4938 [inline]
shrink_lruvec+0x313/0x2b10 mm/vmscan.c:5693
shrink_node_memcgs mm/vmscan.c:5929 [inline]
shrink_node+0x98b/0x3e60 mm/vmscan.c:5970
shrink_zones mm/vmscan.c:6215 [inline]
do_try_to_free_pages+0x35f/0x1a30 mm/vmscan.c:6277
try_to_free_mem_cgroup_pages+0x31a/0x7a0 mm/vmscan.c:6609
try_charge_memcg+0x356/0xaf0 mm/memcontrol.c:2238
try_charge mm/memcontrol-v1.h:19 [inline]
charge_memcg mm/memcontrol.c:4497 [inline]
__mem_cgroup_charge+0x9b/0x280 mm/memcontrol.c:4512
mem_cgroup_charge include/linux/memcontrol.h:646 [inline]
filemap_add_folio+0x89/0x220 mm/filemap.c:966
page_cache_ra_unbounded+0x302/0x750 mm/readahead.c:273
do_page_cache_ra mm/readahead.c:325 [inline]
page_cache_ra_order+0x8f2/0xc80 mm/readahead.c:524
page_cache_async_ra+0x5cb/0x820 mm/readahead.c:674
filemap_readahead mm/filemap.c:2518 [inline]
filemap_get_pages+0x367/0x1be0 mm/filemap.c:2563
filemap_read+0x3ca/0xd70 mm/filemap.c:2646
generic_file_read_iter+0x344/0x450 mm/filemap.c:2834
ext4_file_read_iter+0x1d6/0x6a0 fs/ext4/file.c:147
__kernel_read+0x3f4/0xb50 fs/read_write.c:523
integrity_kernel_read+0x7f/0xb0 security/integrity/iint.c:28
ima_calc_file_hash_tfm+0x2c9/0x3e0 security/integrity/ima/ima_crypto.c:480
ima_calc_file_shash security/integrity/ima/ima_crypto.c:511 [inline]
ima_calc_file_hash+0x1ba/0x490 security/integrity/ima/ima_crypto.c:568
ima_collect_measurement+0x89f/0xa40 security/integrity/ima/ima_api.c:293
process_measurement+0x1271/0x2370 security/integrity/ima/ima_main.c:372
ima_file_check+0xc6/0x110 security/integrity/ima/ima_main.c:572
security_file_post_open+0x8e/0x210 security/security.c:3121
do_open fs/namei.c:3830 [inline]
path_openat+0x1419/0x2d60 fs/namei.c:3987
do_filp_open+0x20c/0x470 fs/namei.c:4014
do_sys_openat2+0x17a/0x1e0 fs/open.c:1402
do_sys_open fs/open.c:1417 [inline]
__do_sys_openat fs/open.c:1433 [inline]
__se_sys_openat fs/open.c:1428 [inline]
__x64_sys_openat+0x175/0x210 fs/open.c:1428
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f77e1184690
Code: 48 89 44 24 20 75 93 44 89 54 24 0c e8 49 94 02 00 44 8b 54 24 0c 89 da 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 38 44 89 c7 89 44 24 0c e8 9c 94 02 00 8b 44
RSP: 002b:00007fff14a9f920 EFLAGS: 00000293 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f77e1184690
RDX: 0000000000000000 RSI: 00007fff14a9fa50 RDI: 00000000ffffff9c
RBP: 00007fff14a9fa50 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000293 R12: 00007fff14aa0b40
R13: 00007f77e12018f4 R14: 00005555694204a8 R15: 00000000000001eb
==================================================================
Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]
CPU: 0 UID: 0 PID: 16160 Comm: syz-executor Tainted: G B 6.13.0-rc4-syzkaller-00071-gfd0584d220fe #0
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:arch_atomic_read arch/x86/include/asm/atomic.h:23 [inline]
RIP: 0010:raw_atomic_read include/linux/atomic/atomic-arch-fallback.h:457 [inline]
RIP: 0010:atomic_read include/linux/atomic/atomic-instrumented.h:33 [inline]
RIP: 0010:buffer_busy fs/buffer.c:2876 [inline]
RIP: 0010:drop_buffers.constprop.0+0x90/0x340 fs/buffer.c:2888
Code: 4d 8b 76 08 4c 39 f3 0f 84 84 00 00 00 e8 18 9c 79 ff 4d 8d 66 60 be 04 00 00 00 4c 89 e7 e8 17 76 db ff 4c 89 e0 48 c1 e8 03 <0f> b6 0c 28 4c 89 e0 83 e0 07 83 c0 03 38 c8 7c 08 84 c9 0f 85 2d
RSP: 0018:ffffc90004eed8b8 EFLAGS: 00010216
RAX: 000000000000000c RBX: ffff888034571ba0 RCX: ffffffff815a647f
RDX: ffff88807acd5a00 RSI: ffffffff81fbc44e RDI: 0000000000000007
RBP: dffffc0000000000 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 3d3d3d3d3d3d3d3d R12: 0000000000000060
R13: ffffea000148dfc0 R14: 0000000000000000 R15: ffffea000148dfe8
FS: 0000555569420500(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8cae768800 CR3: 00000000275de000 CR4: 0000000000350ef0
Call Trace:
try_to_free_buffers+0x21e/0x2d0 fs/buffer.c:2942
filemap_release_folio+0x219/0x280 mm/filemap.c:4220
shrink_folio_list+0x200d/0x42d0 mm/vmscan.c:1433
evict_folios+0x6e3/0x19c0 mm/vmscan.c:4593
try_to_shrink_lruvec+0x61e/0xa80 mm/vmscan.c:4789
lru_gen_shrink_lruvec mm/vmscan.c:4938 [inline]
shrink_lruvec+0x313/0x2b10 mm/vmscan.c:5693
shrink_node_memcgs mm/vmscan.c:5929 [inline]
shrink_node+0x98b/0x3e60 mm/vmscan.c:5970
shrink_zones mm/vmscan.c:6215 [inline]
do_try_to_free_pages+0x35f/0x1a30 mm/vmscan.c:6277
try_to_free_mem_cgroup_pages+0x31a/0x7a0 mm/vmscan.c:6609
try_charge_memcg+0x356/0xaf0 mm/memcontrol.c:2238
try_charge mm/memcontrol-v1.h:19 [inline]
charge_memcg mm/memcontrol.c:4497 [inline]
__mem_cgroup_charge+0x9b/0x280 mm/memcontrol.c:4512
mem_cgroup_charge include/linux/memcontrol.h:646 [inline]
filemap_add_folio+0x89/0x220 mm/filemap.c:966
page_cache_ra_unbounded+0x302/0x750 mm/readahead.c:273
do_page_cache_ra mm/readahead.c:325 [inline]
page_cache_ra_order+0x8f2/0xc80 mm/readahead.c:524
page_cache_async_ra+0x5cb/0x820 mm/readahead.c:674
filemap_readahead mm/filemap.c:2518 [inline]
filemap_get_pages+0x367/0x1be0 mm/filemap.c:2563
filemap_read+0x3ca/0xd70 mm/filemap.c:2646
generic_file_read_iter+0x344/0x450 mm/filemap.c:2834
ext4_file_read_iter+0x1d6/0x6a0 fs/ext4/file.c:147
__kernel_read+0x3f4/0xb50 fs/read_write.c:523
integrity_kernel_read+0x7f/0xb0 security/integrity/iint.c:28
ima_calc_file_hash_tfm+0x2c9/0x3e0 security/integrity/ima/ima_crypto.c:480
ima_calc_file_shash security/integrity/ima/ima_crypto.c:511 [inline]
ima_calc_file_hash+0x1ba/0x490 security/integrity/ima/ima_crypto.c:568
ima_collect_measurement+0x89f/0xa40 security/integrity/ima/ima_api.c:293
process_measurement+0x1271/0x2370 security/integrity/ima/ima_main.c:372
ima_file_check+0xc6/0x110 security/integrity/ima/ima_main.c:572
security_file_post_open+0x8e/0x210 security/security.c:3121
do_open fs/namei.c:3830 [inline]
path_openat+0x1419/0x2d60 fs/namei.c:3987
do_filp_open+0x20c/0x470 fs/namei.c:4014
do_sys_openat2+0x17a/0x1e0 fs/open.c:1402
do_sys_open fs/open.c:1417 [inline]
__do_sys_openat fs/open.c:1433 [inline]
__se_sys_openat fs/open.c:1428 [inline]
__x64_sys_openat+0x175/0x210 fs/open.c:1428
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f77e1184690
Code: 48 89 44 24 20 75 93 44 89 54 24 0c e8 49 94 02 00 44 8b 54 24 0c 89 da 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 38 44 89 c7 89 44 24 0c e8 9c 94 02 00 8b 44
RSP: 002b:00007fff14a9f920 EFLAGS: 00000293 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f77e1184690
RDX: 0000000000000000 RSI: 00007fff14a9fa50 RDI: 00000000ffffff9c
RBP: 00007fff14a9fa50 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000293 R12: 00007fff14aa0b40
R13: 00007f77e12018f4 R14: 00005555694204a8 R15: 00000000000001eb
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:arch_atomic_read arch/x86/include/asm/atomic.h:23 [inline]
RIP: 0010:raw_atomic_read include/linux/atomic/atomic-arch-fallback.h:457 [inline]
RIP: 0010:atomic_read include/linux/atomic/atomic-instrumented.h:33 [inline]
RIP: 0010:buffer_busy fs/buffer.c:2876 [inline]
RIP: 0010:drop_buffers.constprop.0+0x90/0x340 fs/buffer.c:2888
Code: 4d 8b 76 08 4c 39 f3 0f 84 84 00 00 00 e8 18 9c 79 ff 4d 8d 66 60 be 04 00 00 00 4c 89 e7 e8 17 76 db ff 4c 89 e0 48 c1 e8 03 <0f> b6 0c 28 4c 89 e0 83 e0 07 83 c0 03 38 c8 7c 08 84 c9 0f 85 2d
RSP: 0018:ffffc90004eed8b8 EFLAGS: 00010216
RAX: 000000000000000c RBX: ffff888034571ba0 RCX: ffffffff815a647f
RDX: ffff88807acd5a00 RSI: ffffffff81fbc44e RDI: 0000000000000007
RBP: dffffc0000000000 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 3d3d3d3d3d3d3d3d R12: 0000000000000060
R13: ffffea000148dfc0 R14: 0000000000000000 R15: ffffea000148dfe8
FS: 0000555569420500(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f8cae768800 CR3: 00000000275de000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess):
0: 4d 8b 76 08 mov 0x8(%r14),%r14
4: 4c 39 f3 cmp %r14,%rbx
7: 0f 84 84 00 00 00 je 0x91
d: e8 18 9c 79 ff call 0xff799c2a
12: 4d 8d 66 60 lea 0x60(%r14),%r12
16: be 04 00 00 00 mov $0x4,%esi
1b: 4c 89 e7 mov %r12,%rdi
1e: e8 17 76 db ff call 0xffdb763a
23: 4c 89 e0 mov %r12,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 0f b6 0c 28 movzbl (%rax,%rbp,1),%ecx <-- trapping instruction
2e: 4c 89 e0 mov %r12,%rax
31: 83 e0 07 and $0x7,%eax
34: 83 c0 03 add $0x3,%eax
37: 38 c8 cmp %cl,%al
39: 7c 08 jl 0x43
3b: 84 c9 test %cl,%cl
3d: 0f .byte 0xf
3e: 85 .byte 0x85
3f: 2d .byte 0x2d