==================================================================
BUG: KASAN: null-ptr-deref in instrument_atomic_read include/linux/instrumented.h:68 [inline]
BUG: KASAN: null-ptr-deref in atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
BUG: KASAN: null-ptr-deref in buffer_busy fs/buffer.c:2876 [inline]
BUG: KASAN: null-ptr-deref in drop_buffers.constprop.0+0x89/0x340 fs/buffer.c:2888
Read of size 4 at addr 0000000000000060 by task syz.5.6789/25857
CPU: 1 UID: 0 PID: 25857 Comm: syz.5.6789 Not tainted 6.13.0-rc6-syzkaller-00038-g09a0fa92e5b4 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
kasan_report+0xd9/0x110 mm/kasan/report.c:602
check_region_inline mm/kasan/generic.c:183 [inline]
kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189
instrument_atomic_read include/linux/instrumented.h:68 [inline]
atomic_read include/linux/atomic/atomic-instrumented.h:32 [inline]
buffer_busy fs/buffer.c:2876 [inline]
drop_buffers.constprop.0+0x89/0x340 fs/buffer.c:2888
try_to_free_buffers+0x21e/0x2d0 fs/buffer.c:2942
filemap_release_folio+0x219/0x280 mm/filemap.c:4211
shrink_folio_list+0x200d/0x42d0 mm/vmscan.c:1440
evict_folios+0x6e3/0x19c0 mm/vmscan.c:4600
try_to_shrink_lruvec+0x61e/0xa80 mm/vmscan.c:4796
lru_gen_shrink_lruvec mm/vmscan.c:4945 [inline]
shrink_lruvec+0x313/0x2b10 mm/vmscan.c:5700
shrink_node_memcgs mm/vmscan.c:5936 [inline]
shrink_node+0x98b/0x3e60 mm/vmscan.c:5977
shrink_zones mm/vmscan.c:6222 [inline]
do_try_to_free_pages+0x35f/0x1a30 mm/vmscan.c:6284
try_to_free_mem_cgroup_pages+0x31a/0x7a0 mm/vmscan.c:6616
try_charge_memcg+0x356/0xaf0 mm/memcontrol.c:2238
obj_cgroup_charge_pages mm/memcontrol.c:2646 [inline]
__memcg_kmem_charge_page+0xdb/0x2b0 mm/memcontrol.c:2673
__alloc_pages_noprof+0x252/0x25b0 mm/page_alloc.c:4770
alloc_pages_mpol_noprof+0x2c9/0x610 mm/mempolicy.c:2269
io_mem_alloc_compound io_uring/memmap.c:29 [inline]
io_pages_map+0xe1/0x520 io_uring/memmap.c:73
io_allocate_scq_urings io_uring/io_uring.c:3523 [inline]
io_uring_create io_uring/io_uring.c:3722 [inline]
io_uring_setup+0x16fc/0x3230 io_uring/io_uring.c:3811
__do_sys_io_uring_setup io_uring/io_uring.c:3838 [inline]
__se_sys_io_uring_setup io_uring/io_uring.c:3832 [inline]
__x64_sys_io_uring_setup+0x98/0x140 io_uring/io_uring.c:3832
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f254eb85d29
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f254fa3dfc8 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9
RAX: ffffffffffffffda RBX: 00007f254ed75fa0 RCX: 00007f254eb85d29
RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000003667
RBP: 0000000020000100 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000003667 R15: 0000000000000000
==================================================================
Oops: general protection fault, probably for non-canonical address 0xdffffc000000000c: 0000 [#1] PREEMPT SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000060-0x0000000000000067]
CPU: 1 UID: 0 PID: 25857 Comm: syz.5.6789 Tainted: G B 6.13.0-rc6-syzkaller-00038-g09a0fa92e5b4 #0
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
RIP: 0010:arch_atomic_read arch/x86/include/asm/atomic.h:23 [inline]
RIP: 0010:raw_atomic_read include/linux/atomic/atomic-arch-fallback.h:457 [inline]
RIP: 0010:atomic_read include/linux/atomic/atomic-instrumented.h:33 [inline]
RIP: 0010:buffer_busy fs/buffer.c:2876 [inline]
RIP: 0010:drop_buffers.constprop.0+0x90/0x340 fs/buffer.c:2888
Code: 4d 8b 76 08 4c 39 f3 0f 84 84 00 00 00 e8 38 9c 79 ff 4d 8d 66 60 be 04 00 00 00 4c 89 e7 e8 57 6d db ff 4c 89 e0 48 c1 e8 03 <0f> b6 0c 28 4c 89 e0 83 e0 07 83 c0 03 38 c8 7c 08 84 c9 0f 85 2d
RSP: 0018:ffffc9000d596988 EFLAGS: 00010216
RAX: 000000000000000c RBX: ffff88807bed40f8 RCX: ffffc9000da4d000
RDX: 0000000000080000 RSI: ffffffff81fbbe8e RDI: 0000000000000007
RBP: dffffc0000000000 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 3d3d3d3d3d3d3d3d R12: 0000000000000060
R13: ffffea0001e34480 R14: 0000000000000000 R15: ffffea0001e344a8
FS: 00007f254fa3e6c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c3c4836 CR3: 00000000130c8000 CR4: 0000000000350ef0
Call Trace:
try_to_free_buffers+0x21e/0x2d0 fs/buffer.c:2942
filemap_release_folio+0x219/0x280 mm/filemap.c:4211
shrink_folio_list+0x200d/0x42d0 mm/vmscan.c:1440
evict_folios+0x6e3/0x19c0 mm/vmscan.c:4600
try_to_shrink_lruvec+0x61e/0xa80 mm/vmscan.c:4796
lru_gen_shrink_lruvec mm/vmscan.c:4945 [inline]
shrink_lruvec+0x313/0x2b10 mm/vmscan.c:5700
shrink_node_memcgs mm/vmscan.c:5936 [inline]
shrink_node+0x98b/0x3e60 mm/vmscan.c:5977
shrink_zones mm/vmscan.c:6222 [inline]
do_try_to_free_pages+0x35f/0x1a30 mm/vmscan.c:6284
try_to_free_mem_cgroup_pages+0x31a/0x7a0 mm/vmscan.c:6616
try_charge_memcg+0x356/0xaf0 mm/memcontrol.c:2238
obj_cgroup_charge_pages mm/memcontrol.c:2646 [inline]
__memcg_kmem_charge_page+0xdb/0x2b0 mm/memcontrol.c:2673
__alloc_pages_noprof+0x252/0x25b0 mm/page_alloc.c:4770
alloc_pages_mpol_noprof+0x2c9/0x610 mm/mempolicy.c:2269
io_mem_alloc_compound io_uring/memmap.c:29 [inline]
io_pages_map+0xe1/0x520 io_uring/memmap.c:73
io_allocate_scq_urings io_uring/io_uring.c:3523 [inline]
io_uring_create io_uring/io_uring.c:3722 [inline]
io_uring_setup+0x16fc/0x3230 io_uring/io_uring.c:3811
__do_sys_io_uring_setup io_uring/io_uring.c:3838 [inline]
__se_sys_io_uring_setup io_uring/io_uring.c:3832 [inline]
__x64_sys_io_uring_setup+0x98/0x140 io_uring/io_uring.c:3832
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f254eb85d29
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f254fa3dfc8 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9
RAX: ffffffffffffffda RBX: 00007f254ed75fa0 RCX: 00007f254eb85d29
RDX: 0000000000000000 RSI: 0000000020000100 RDI: 0000000000003667
RBP: 0000000020000100 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000003667 R15: 0000000000000000
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:arch_atomic_read arch/x86/include/asm/atomic.h:23 [inline]
RIP: 0010:raw_atomic_read include/linux/atomic/atomic-arch-fallback.h:457 [inline]
RIP: 0010:atomic_read include/linux/atomic/atomic-instrumented.h:33 [inline]
RIP: 0010:buffer_busy fs/buffer.c:2876 [inline]
RIP: 0010:drop_buffers.constprop.0+0x90/0x340 fs/buffer.c:2888
Code: 4d 8b 76 08 4c 39 f3 0f 84 84 00 00 00 e8 38 9c 79 ff 4d 8d 66 60 be 04 00 00 00 4c 89 e7 e8 57 6d db ff 4c 89 e0 48 c1 e8 03 <0f> b6 0c 28 4c 89 e0 83 e0 07 83 c0 03 38 c8 7c 08 84 c9 0f 85 2d
RSP: 0018:ffffc9000d596988 EFLAGS: 00010216
RAX: 000000000000000c RBX: ffff88807bed40f8 RCX: ffffc9000da4d000
RDX: 0000000000080000 RSI: ffffffff81fbbe8e RDI: 0000000000000007
RBP: dffffc0000000000 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 3d3d3d3d3d3d3d3d R12: 0000000000000060
R13: ffffea0001e34480 R14: 0000000000000000 R15: ffffea0001e344a8
FS: 00007f254fa3e6c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c3c4836 CR3: 00000000130c8000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess):
0: 4d 8b 76 08 mov 0x8(%r14),%r14
4: 4c 39 f3 cmp %r14,%rbx
7: 0f 84 84 00 00 00 je 0x91
d: e8 38 9c 79 ff call 0xff799c4a
12: 4d 8d 66 60 lea 0x60(%r14),%r12
16: be 04 00 00 00 mov $0x4,%esi
1b: 4c 89 e7 mov %r12,%rdi
1e: e8 57 6d db ff call 0xffdb6d7a
23: 4c 89 e0 mov %r12,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 0f b6 0c 28 movzbl (%rax,%rbp,1),%ecx <-- trapping instruction
2e: 4c 89 e0 mov %r12,%rax
31: 83 e0 07 and $0x7,%eax
34: 83 c0 03 add $0x3,%eax
37: 38 c8 cmp %cl,%al
39: 7c 08 jl 0x43
3b: 84 c9 test %cl,%cl
3d: 0f .byte 0xf
3e: 85 .byte 0x85
3f: 2d .byte 0x2d