================================================================== BUG: KASAN: stack-out-of-bounds in folio_batch_add include/linux/pagevec.h:140 [inline] BUG: KASAN: stack-out-of-bounds in check_move_unevictable_pages+0x348/0x410 mm/vmscan.c:4803 Write of size 8 at addr ffffc90002cbfe20 by task syz-executor.0/4084 CPU: 1 PID: 4084 Comm: syz-executor.0 Not tainted 5.19.0-rc1-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x57/0x7d lib/dump_stack.c:106 print_address_description.constprop.0.cold+0xf/0x495 mm/kasan/report.c:313 print_report mm/kasan/report.c:429 [inline] kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491 folio_batch_add include/linux/pagevec.h:140 [inline] check_move_unevictable_pages+0x348/0x410 mm/vmscan.c:4803 drm_gem_check_release_pagevec drivers/gpu/drm/drm_gem.c:511 [inline] drm_gem_put_pages+0x205/0x350 drivers/gpu/drm/drm_gem.c:639 drm_gem_shmem_put_pages_locked+0xf3/0x1e0 drivers/gpu/drm/drm_gem_shmem_helper.c:237 drm_gem_shmem_put_pages drivers/gpu/drm/drm_gem_shmem_helper.c:252 [inline] drm_gem_shmem_vm_close+0x46/0x70 drivers/gpu/drm/drm_gem_shmem_helper.c:588 remove_vma+0x9b/0x140 mm/mmap.c:190 exit_mmap+0x1f5/0x3f0 mm/mmap.c:3170 __mmput+0xed/0x430 kernel/fork.c:1187 exit_mm kernel/exit.c:510 [inline] do_exit+0x8e9/0x2470 kernel/exit.c:782 do_group_exit+0xb2/0x2a0 kernel/exit.c:925 get_signal+0x1c76/0x2030 kernel/signal.c:2857 arch_do_signal_or_restart+0x82/0x2300 arch/x86/kernel/signal.c:869 exit_to_user_mode_loop kernel/entry/common.c:166 [inline] exit_to_user_mode_prepare+0x15f/0x250 kernel/entry/common.c:201 __syscall_exit_to_user_mode_work kernel/entry/common.c:283 [inline] syscall_exit_to_user_mode+0x19/0x50 kernel/entry/common.c:294 do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7fe8bf089109 Code: Unable to access opcode bytes at RIP 0x7fe8bf0890df. RSP: 002b:00007fe8c0275218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: 0000000000000001 RBX: 00007fe8bf19bf68 RCX: 00007fe8bf089109 RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007fe8bf19bf6c RBP: 00007fe8bf19bf60 R08: 00007ffec81f9080 R09: 0000000000000000 R10: 0000000020ffc000 R11: 0000000000000246 R12: 00007fe8bf19bf6c R13: 00007ffec81f76cf R14: 00007fe8c0275300 R15: 0000000000022000 The buggy address belongs to stack of task syz-executor.0/4084 and is located at offset 40 in frame: arch_do_signal_or_restart+0x0/0x2300 arch/x86/kernel/signal.c:744 This frame has 2 objects: [32, 40) 'fp' [64, 152) 'ksig' The buggy address belongs to the virtual mapping at [ffffc90002cb8000, ffffc90002cc1000) created by: kernel_clone+0xb8/0x7f0 kernel/fork.c:2655 The buggy address belongs to the physical page: page:ffffea00007bd380 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1ef4e memcg:ffff888144cfe082 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff ffff888144cfe082 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x102dc2(GFP_HIGHUSER|__GFP_NOWARN|__GFP_ZERO), pid 4058, tgid 4058 (dhcpcd-run-hook), ts 64257415686, free_ts 64256194114 prep_new_page mm/page_alloc.c:2456 [inline] get_page_from_freelist+0x19d3/0x3b30 mm/page_alloc.c:4198 __alloc_pages+0x1c7/0x510 mm/page_alloc.c:5426 vm_area_alloc_pages mm/vmalloc.c:2927 [inline] __vmalloc_area_node mm/vmalloc.c:2995 [inline] __vmalloc_node_range+0x560/0x1010 mm/vmalloc.c:3165 alloc_thread_stack_node kernel/fork.c:312 [inline] dup_task_struct kernel/fork.c:977 [inline] copy_process+0x52d/0x6680 kernel/fork.c:2071 kernel_clone+0xb8/0x7f0 kernel/fork.c:2655 __do_sys_clone+0xa1/0xe0 kernel/fork.c:2789 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1371 [inline] free_pcp_prepare+0x549/0xd20 mm/page_alloc.c:1421 free_unref_page_prepare mm/page_alloc.c:3343 [inline] free_unref_page_list+0x16f/0xf80 mm/page_alloc.c:3475 release_pages+0x6f1/0x1780 mm/swap.c:980 tlb_batch_pages_flush+0x85/0x160 mm/mmu_gather.c:58 tlb_flush_mmu_free mm/mmu_gather.c:255 [inline] tlb_flush_mmu mm/mmu_gather.c:262 [inline] tlb_finish_mmu+0x110/0x6c0 mm/mmu_gather.c:353 exit_mmap+0x19d/0x3f0 mm/mmap.c:3164 __mmput+0xed/0x430 kernel/fork.c:1187 exit_mm kernel/exit.c:510 [inline] do_exit+0x8e9/0x2470 kernel/exit.c:782 do_group_exit+0xb2/0x2a0 kernel/exit.c:925 __do_sys_exit_group kernel/exit.c:936 [inline] __se_sys_exit_group kernel/exit.c:934 [inline] __x64_sys_exit_group+0x35/0x40 kernel/exit.c:934 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Memory state around the buggy address: ffffc90002cbfd00: f1 f1 f1 f1 04 f3 f3 f3 00 00 00 00 00 00 00 00 ffffc90002cbfd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 >ffffc90002cbfe00: f1 f1 f1 00 f2 f2 f2 00 00 00 00 00 00 00 00 00 ^ ffffc90002cbfe80: 00 00 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 ffffc90002cbff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================