kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] PREEMPT SMP KASAN Modules linked in: CPU: 1 PID: 13916 Comm: syz-executor.2 Not tainted 4.9.202+ #0 task: 00000000dd568374 task.stack: 00000000cfe00e44 RIP: 0010:[] [<00000000da08f472>] bdev_get_queue include/linux/blkdev.h:847 [inline] RIP: 0010:[] [<00000000da08f472>] blk_get_backing_dev_info+0x4a/0x70 block/blk-core.c:119 RSP: 0018:ffff8801a923f820 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 1ffff10035247f35 RDX: 00000000000000a6 RSI: ffffffff81ad4a5d RDI: 0000000000000530 RBP: ffff8801a923f828 R08: 0000000000000000 R09: 0000000000000001 R10: 0000000000000001 R11: 0000000000000001 R12: ffffea00073e7540 R13: ffff8801d473df88 R14: ffff8801d473dd90 R15: ffffffff833f10b8 FS: 00000000026fb940(0000) GS:ffff8801db700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000200016c0 CR3: 00000001a6c0e000 CR4: 00000000001606b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Stack: ffff8801da49a200 ffff8801a923f868 ffffffff8143e202 ffff8801d473df88 ffff8801d473df88 ffffea00073e7540 ffffea00073e7560 ffff8801d473df88 00000000000fffff ffff8801a923f898 ffffffff8144a790 dffffc0000000000 Call Trace: [<00000000c9b0291b>] inode_to_bdi include/linux/backing-dev.h:186 [inline] [<00000000c9b0291b>] mapping_cap_account_dirty include/linux/backing-dev.h:234 [inline] [<00000000c9b0291b>] cancel_dirty_page+0x1a2/0x3d0 mm/page-writeback.c:2609 [<000000003d21c1bf>] truncate_complete_page mm/truncate.c:126 [inline] [<000000003d21c1bf>] truncate_inode_page+0x130/0x260 mm/truncate.c:167 [<000000003632770a>] truncate_inode_pages_range+0x20e/0xfe0 mm/truncate.c:291 [<000000001c5a6c1e>] truncate_inode_pages mm/truncate.c:401 [inline] [<000000001c5a6c1e>] truncate_inode_pages_final+0x81/0xc0 mm/truncate.c:452 [<000000001a9e0a22>] bdev_evict_inode+0x21/0x190 fs/block_dev.c:639 [<000000003a506600>] evict+0x2e9/0x630 fs/inode.c:553 [<00000000b4ab3551>] iput_final fs/inode.c:1516 [inline] [<00000000b4ab3551>] iput fs/inode.c:1543 [inline] [<00000000b4ab3551>] iput+0x370/0x900 fs/inode.c:1528 [<000000001b235368>] bdput fs/block_dev.c:775 [inline] [<000000001b235368>] bd_forget+0xf0/0x1a0 fs/block_dev.c:826 [<00000000db7b043d>] evict+0x485/0x630 fs/inode.c:559 [<00000000b4ab3551>] iput_final fs/inode.c:1516 [inline] [<00000000b4ab3551>] iput fs/inode.c:1543 [inline] [<00000000b4ab3551>] iput+0x370/0x900 fs/inode.c:1528 [<0000000044fc1c49>] dentry_unlink_inode+0x277/0x330 fs/dcache.c:368 [<00000000cc947921>] __dentry_kill+0x333/0x580 fs/dcache.c:570 [<00000000d7ed35c6>] dentry_kill fs/dcache.c:611 [inline] [<00000000d7ed35c6>] dput.part.0+0x5d9/0x7c0 fs/dcache.c:828 [<000000004db427cd>] dput fs/dcache.c:790 [inline] [<000000004db427cd>] do_one_tree+0x44/0x50 fs/dcache.c:1482 [<0000000019f6f502>] shrink_dcache_for_umount+0x67/0x160 fs/dcache.c:1496 [<000000000ae9289c>] generic_shutdown_super+0x6d/0x300 fs/super.c:432 [<000000001a59d43c>] kill_anon_super+0x3f/0x60 fs/super.c:978 [<000000000be5651a>] fuse_kill_sb_anon+0x42/0x50 fs/fuse/inode.c:1223 [<0000000036bde77d>] deactivate_locked_super+0x79/0xe0 fs/super.c:320 [<0000000078cb00c8>] deactivate_super fs/super.c:351 [inline] [<0000000078cb00c8>] deactivate_super+0x8a/0xb0 fs/super.c:347 [<000000008bd7a8e9>] cleanup_mnt+0xb2/0x160 fs/namespace.c:1143 [<0000000001daba0b>] __cleanup_mnt+0x16/0x20 fs/namespace.c:1150 [<000000004c86ab77>] task_work_run+0x108/0x180 kernel/task_work.c:116 [<000000005043ee13>] tracehook_notify_resume include/linux/tracehook.h:191 [inline] [<000000005043ee13>] exit_to_usermode_loop+0x13b/0x160 arch/x86/entry/common.c:163 [<000000006e6a09b6>] prepare_exit_to_usermode arch/x86/entry/common.c:195 [inline] [<000000006e6a09b6>] syscall_return_slowpath arch/x86/entry/common.c:266 [inline] [<000000006e6a09b6>] do_syscall_64+0x3ab/0x5c0 arch/x86/entry/common.c:293 [<000000004088bd4b>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb Code: 89 fa 48 c1 ea 03 80 3c 02 00 75 35 48 8b 9b e0 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d bb 30 05 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 17 48 8b 83 30 05 00 00 5b 5d 48 05 20 02 00 00 RIP [<00000000da08f472>] bdev_get_queue include/linux/blkdev.h:847 [inline] RIP [<00000000da08f472>] blk_get_backing_dev_info+0x4a/0x70 block/blk-core.c:119 RSP audit: type=1400 audit(1574293981.524:2272): avc: denied { create } for pid=2619 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(1574293981.654:2273): avc: denied { write } for pid=2619 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(1574293982.264:2274): avc: denied { create } for pid=2658 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 audit: type=1400 audit(1574293982.834:2275): avc: denied { write } for pid=2658 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1 ---[ end trace 032617886035aae1 ]---