BUG: unable to handle kernel paging request at ffff8801c18448b0 PGD b4e1067 P4D b4e1067 PUD 1d9484063 PMD 1949e6063 PTE 0 kasan: CONFIG_KASAN_INLINE enabled Oops: 0000 [#1] SMP KASAN kasan: GPF could be caused by NULL-ptr deref or user memory access CPU: 0 PID: 10250 Comm: blkid Not tainted 4.18.0-rc3+ #48 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:vma_interval_tree_insert+0xfe/0x2a0 mm/interval_tree.c:24 Code: 00 0f 85 51 01 00 00 49 8b 1e 48 85 db 74 7f e8 a8 12 d3 ff 48 8d 7b 18 48 89 f8 48 c1 e8 03 42 80 3c 20 00 0f 85 45 01 00 00 <4c> 8b 73 18 4c 89 ee 4c 89 f7 e8 33 13 d3 ff 4d 39 ee 73 09 e8 79 RSP: 0018:ffff88019d7cf528 EFLAGS: 00010246 RAX: 1ffff10038308916 RBX: ffff8801c1844898 RCX: ffffffff81a8f986 RDX: 0000000000000000 RSI: ffffffff81a8f928 RDI: ffff8801c18448b0 RBP: ffff88019d7cf570 R08: ffff8801d8640180 R09: ffffed003a51ccd4 R10: ffffed003a51ccd4 R11: ffff8801d28e66a3 R12: dffffc0000000000 R13: 0000000000000221 R14: ffff8801ad05bd00 R15: ffff8801d44d8460 FS: 00007f82833b77a0(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff8801c18448b0 CR3: 00000001d8cd4000 CR4: 00000000001406f0 DR0: 0000000020000000 DR1: 0000000020000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 Call Trace: __vma_link_file+0xe4/0x1b0 mm/mmap.c:599 __vma_adjust+0x23b/0x1840 mm/mmap.c:807 vma_adjust include/linux/mm.h:2214 [inline] __split_vma+0x46b/0x810 mm/mmap.c:2657 do_munmap+0x2fe/0xf90 mm/mmap.c:2737 vm_munmap+0x128/0x1b0 mm/mmap.c:2804 elf_map+0x270/0x2b0 fs/binfmt_elf.c:376 load_elf_interp fs/binfmt_elf.c:587 [inline] load_elf_binary+0x1ed6/0x5610 fs/binfmt_elf.c:1087 search_binary_handler+0x17d/0x570 fs/exec.c:1653 exec_binprm fs/exec.c:1695 [inline] __do_execve_file.isra.36+0x171d/0x2730 fs/exec.c:1819 do_execveat_common fs/exec.c:1866 [inline] do_execve fs/exec.c:1883 [inline] __do_sys_execve fs/exec.c:1964 [inline] __se_sys_execve fs/exec.c:1959 [inline] __x64_sys_execve+0x8f/0xc0 fs/exec.c:1959 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f8282a9b207 Code: Bad RIP value. RSP: 002b:00007fff59687a68 EFLAGS: 00000202 ORIG_RAX: 000000000000003b RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007f8282a9b207 RDX: 0000000001dd6a00 RSI: 00007fff59687b60 RDI: 00007fff59688b70 RBP: 0000000000625500 R08: 0000000000000ad7 R09: 0000000000000ad7 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000001dd6a00 R13: 0000000000000007 R14: 0000000001dc5250 R15: 0000000000000005 Modules linked in: Dumping ftrace buffer: (ftrace buffer empty) CR2: ffff8801c18448b0 ---[ end trace af0ba0d97c483bcc ]--- general protection fault: 0000 [#2] SMP KASAN CPU: 1 PID: 10241 Comm: syz-executor5 Tainted: G D 4.18.0-rc3+ #48 RIP: 0010:vma_interval_tree_insert+0xfe/0x2a0 mm/interval_tree.c:24 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Code: RIP: 0010:__x86_indirect_thunk_rax+0x10/0x20 arch/x86/lib/retpoline.S:32 00 Code: 0f 85 ------------[ cut here ]------------ 51 01 Bad or missing usercopy whitelist? Kernel memory overwrite attempt detected to SLAB object 'TCPv6(65:syz5)' (offset 416, size 64)! 00 ================================================================== 00 49 BUG: KASAN: slab-out-of-bounds in do_error_trap+0x3b6/0x4d0 arch/x86/kernel/traps.c:296 8b Read of size 8 at addr ffff880193421450 by task syz-executor5/10241 1e 48 CPU: 1 PID: 10241 Comm: syz-executor5 Tainted: G D 4.18.0-rc3+ #48 85 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 db Call Trace: 74 7f Allocated by task 1: e8 (stack is not available) a8 12 Freed by task 0: (stack is not available) d3 ff The buggy address belongs to the object at ffff880193420340 which belongs to the cache names_cache of size 4096 48 The buggy address is located 272 bytes to the right of 4096-byte region [ffff880193420340, ffff880193421340) The buggy address belongs to the page: 8d page:ffffea00064d0800 count:1 mapcount:0 mapping:ffff8801da987dc0 index:0x0 7b 18 compound_mapcount: 0 48 89 flags: 0x2fffc0000008100(slab|head) f8 raw: 02fffc0000008100 ffffea0006599f88 ffffea00064d0908 ffff8801da987dc0 48 raw: 0000000000000000 ffff880193420340 0000000100000001 0000000000000000 c1 e8 page dumped because: kasan: bad access detected 03 42 Memory state around the buggy address: ffff880193421300: fb fb fb fb fb fb fb fb f3 f3 f3 f3 fc fc fc fc 80 ffff880193421380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc 3c >ffff880193421400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc 20 ^ 00 ffff880193421480: fc fc fc fc fc f1 f1 f1 f1 f8 f2 f2 f2 f2 f2 f2 0f ffff880193421500: f2 f8 f2 f2 f2 fc fc fc fc fc fc fc fc fc fc fc 85 ================================================================== 45