================================================================== BUG: KASAN: stack-out-of-bounds in deref_stack_iret_regs syzkaller/managers/linux-4-14/kernel/arch/x86/kernel/unwind_orc.c:317 [inline] BUG: KASAN: stack-out-of-bounds in unwind_next_frame+0x13c2/0x17d0 syzkaller/managers/linux-4-14/kernel/arch/x86/kernel/unwind_orc.c:449 Read of size 8 at addr ffff8880ba507c90 by task syz-executor100/8002 CPU: 1 PID: 8002 Comm: syz-executor100 Not tainted 4.14.218-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack syzkaller/managers/linux-4-14/kernel/lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x281 syzkaller/managers/linux-4-14/kernel/lib/dump_stack.c:58 print_address_description.cold+0x54/0x1d3 syzkaller/managers/linux-4-14/kernel/mm/kasan/report.c:252 kasan_report_error.cold+0x8a/0x191 syzkaller/managers/linux-4-14/kernel/mm/kasan/report.c:351 kasan_report syzkaller/managers/linux-4-14/kernel/mm/kasan/report.c:409 [inline] __asan_report_load8_noabort+0x68/0x70 syzkaller/managers/linux-4-14/kernel/mm/kasan/report.c:430 deref_stack_iret_regs syzkaller/managers/linux-4-14/kernel/arch/x86/kernel/unwind_orc.c:317 [inline] unwind_next_frame+0x13c2/0x17d0 syzkaller/managers/linux-4-14/kernel/arch/x86/kernel/unwind_orc.c:449 perf_callchain_kernel+0x38c/0x520 syzkaller/managers/linux-4-14/kernel/arch/x86/events/core.c:2343 get_perf_callchain+0x2de/0x740 syzkaller/managers/linux-4-14/kernel/kernel/events/callchain.c:217 perf_callchain+0x147/0x190 syzkaller/managers/linux-4-14/kernel/kernel/events/callchain.c:190 perf_prepare_sample+0xd77/0x1380 syzkaller/managers/linux-4-14/kernel/kernel/events/core.c:6164 __perf_event_output syzkaller/managers/linux-4-14/kernel/kernel/events/core.c:6280 [inline] perf_event_output_forward+0xc9/0x1f0 syzkaller/managers/linux-4-14/kernel/kernel/events/core.c:6298 __perf_event_overflow+0x113/0x310 syzkaller/managers/linux-4-14/kernel/kernel/events/core.c:7547 perf_swevent_overflow syzkaller/managers/linux-4-14/kernel/kernel/events/core.c:7623 [inline] perf_swevent_event+0x3c8/0x460 syzkaller/managers/linux-4-14/kernel/kernel/events/core.c:7661 perf_tp_event+0x540/0x6e0 syzkaller/managers/linux-4-14/kernel/kernel/events/core.c:8085 perf_trace_run_bpf_submit+0x119/0x200 syzkaller/managers/linux-4-14/kernel/kernel/events/core.c:8055 perf_trace_lock_acquire+0x332/0x510 syzkaller/managers/linux-4-14/kernel/./include/trace/events/lock.h:13 trace_lock_acquire syzkaller/managers/linux-4-14/kernel/./include/trace/events/lock.h:13 [inline] lock_acquire+0x2b8/0x3f0 syzkaller/managers/linux-4-14/kernel/kernel/locking/lockdep.c:3997 __raw_spin_lock_irqsave syzkaller/managers/linux-4-14/kernel/./include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x8c/0xc0 syzkaller/managers/linux-4-14/kernel/kernel/locking/spinlock.c:160 debug_object_deactivate syzkaller/managers/linux-4-14/kernel/lib/debugobjects.c:502 [inline] debug_object_deactivate+0xdf/0x2e0 syzkaller/managers/linux-4-14/kernel/lib/debugobjects.c:491 debug_rcu_head_unqueue syzkaller/managers/linux-4-14/kernel/kernel/rcu/rcu.h:164 [inline] rcu_do_batch syzkaller/managers/linux-4-14/kernel/kernel/rcu/tree.c:2698 [inline] invoke_rcu_callbacks syzkaller/managers/linux-4-14/kernel/kernel/rcu/tree.c:2962 [inline] __rcu_process_callbacks syzkaller/managers/linux-4-14/kernel/kernel/rcu/tree.c:2929 [inline] rcu_process_callbacks+0x83c/0x1180 syzkaller/managers/linux-4-14/kernel/kernel/rcu/tree.c:2946 __do_softirq+0x24d/0x9ff syzkaller/managers/linux-4-14/kernel/kernel/softirq.c:288 invoke_softirq syzkaller/managers/linux-4-14/kernel/kernel/softirq.c:368 [inline] irq_exit+0x193/0x240 syzkaller/managers/linux-4-14/kernel/kernel/softirq.c:409 exiting_irq syzkaller/managers/linux-4-14/kernel/./arch/x86/include/asm/apic.h:648 [inline] smp_apic_timer_interrupt+0x141/0x5e0 syzkaller/managers/linux-4-14/kernel/arch/x86/kernel/apic/apic.c:1102 apic_timer_interrupt+0x93/0xa0 syzkaller/managers/linux-4-14/kernel/arch/x86/entry/entry_64.S:793 RIP: 0010:arch_local_irq_restore syzkaller/managers/linux-4-14/kernel/./arch/x86/include/asm/paravirt.h:779 [inline] RIP: 0010:lock_acquire+0x1ec/0x3f0 syzkaller/managers/linux-4-14/kernel/kernel/locking/lockdep.c:4001 RSP: 0000:ffff888095cefa88 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff10 RAX: 1ffffffff11e1251 RBX: ffff88809b588280 RCX: 6e589fa09c8ac93c RDX: dffffc0000000000 RSI: 0000000000000001 RDI: 0000000000000282 RBP: ffffffff88f776c0 R08: 0000000000000000 R09: 0000000000020012 R10: ffff88809b588b80 R11: ffff88809b588280 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000002 R15: 0000000000000000 rcu_lock_acquire syzkaller/managers/linux-4-14/kernel/./include/linux/rcupdate.h:242 [inline] rcu_read_lock syzkaller/managers/linux-4-14/kernel/./include/linux/rcupdate.h:629 [inline] lock_page_memcg+0x36/0x200 syzkaller/managers/linux-4-14/kernel/mm/memcontrol.c:1640 page_add_file_rmap+0x29/0x860 syzkaller/managers/linux-4-14/kernel/mm/rmap.c:1180 alloc_set_pte+0x38f/0x1610 syzkaller/managers/linux-4-14/kernel/mm/memory.c:3541 filemap_map_pages+0xa2d/0xe40 syzkaller/managers/linux-4-14/kernel/mm/filemap.c:2589 do_fault_around+0x1fe/0x620 syzkaller/managers/linux-4-14/kernel/mm/memory.c:3687 do_read_fault syzkaller/managers/linux-4-14/kernel/mm/memory.c:3721 [inline] do_fault syzkaller/managers/linux-4-14/kernel/mm/memory.c:3852 [inline] handle_pte_fault syzkaller/managers/linux-4-14/kernel/mm/memory.c:4082 [inline] __handle_mm_fault+0x2b1f/0x4620 syzkaller/managers/linux-4-14/kernel/mm/memory.c:4206 handle_mm_fault+0x391/0x860 syzkaller/managers/linux-4-14/kernel/mm/memory.c:4243 __do_page_fault+0x549/0xad0 syzkaller/managers/linux-4-14/kernel/arch/x86/mm/fault.c:1442 page_fault+0x45/0x50 syzkaller/managers/linux-4-14/kernel/arch/x86/entry/entry_64.S:1123 RIP: 0001:0x4b0da0 RSP: 0001:00007fff9db42ad0 EFLAGS: 00000000 The buggy address belongs to the page: page:ffffea0002e941c0 count:1 mapcount:0 mapping: (null) index:0x0 flags: 0xfff00000000800(reserved) raw: 00fff00000000800 0000000000000000 0000000000000000 00000001ffffffff raw: ffffea0002e941e0 ffffea0002e941e0 0000000000000000 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880ba507b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880ba507c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 >ffff8880ba507c80: f1 f1 f1 04 f2 00 f3 f3 f3 00 00 00 00 00 00 00 ^ ffff8880ba507d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880ba507d80: 00 00 00 f1 f1 f1 f1 f1 f1 00 00 00 00 00 f3 f3 ==================================================================