================================================================== BUG: KASAN: slab-use-after-free in kvm_iodevice_destructor virt/kvm/kvm_main.c:5769 [inline] BUG: KASAN: slab-use-after-free in kvm_io_bus_destroy virt/kvm/kvm_main.c:5780 [inline] BUG: KASAN: slab-use-after-free in kvm_destroy_vm virt/kvm/kvm_main.c:1324 [inline] BUG: KASAN: slab-use-after-free in kvm_put_kvm+0x2dc/0x97c virt/kvm/kvm_main.c:1386 Read of size 8 at addr f9f000001638b080 by task syz.0.43/3526 Pointer tag: [f9], memory tag: [fe] CPU: 0 UID: 0 PID: 3526 Comm: syz.0.43 Not tainted 6.11.0-rc5-syzkaller-g17a000564499 #0 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:317 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:324 __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:119 print_address_description mm/kasan/report.c:377 [inline] print_report+0x1b4/0x500 mm/kasan/report.c:488 kasan_report+0xd8/0x138 mm/kasan/report.c:601 kasan_tag_mismatch+0x28/0x3c mm/kasan/sw_tags.c:174 __hwasan_tag_mismatch+0x30/0x60 arch/arm64/lib/kasan_sw_tags.S:55 kvm_iodevice_destructor virt/kvm/kvm_main.c:5769 [inline] kvm_io_bus_destroy virt/kvm/kvm_main.c:5780 [inline] kvm_destroy_vm virt/kvm/kvm_main.c:1324 [inline] kvm_put_kvm+0x2dc/0x97c virt/kvm/kvm_main.c:1386 kvm_vm_release+0x40/0x54 virt/kvm/kvm_main.c:1409 __fput+0x150/0x554 fs/file_table.c:422 ____fput+0x20/0x30 fs/file_table.c:450 task_work_run+0x154/0x1c4 kernel/task_work.c:228 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0x3bc/0x10e0 kernel/exit.c:882 do_group_exit+0xfc/0x13c kernel/exit.c:1031 get_signal+0xd40/0xdb8 kernel/signal.c:2917 do_signal+0x17c/0x2bac arch/arm64/kernel/signal.c:1308 do_notify_resume+0x7c/0x1b8 arch/arm64/kernel/entry-common.c:148 exit_to_user_mode_prepare arch/arm64/kernel/entry-common.c:169 [inline] exit_to_user_mode arch/arm64/kernel/entry-common.c:178 [inline] el0_svc+0xac/0x14c arch/arm64/kernel/entry-common.c:713 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 Allocated by task 3527: kasan_save_stack+0x40/0x6c mm/kasan/common.c:47 save_stack_info+0x34/0x144 mm/kasan/tags.c:106 kasan_save_alloc_info+0x14/0x20 mm/kasan/tags.c:142 unpoison_slab_object mm/kasan/common.c:312 [inline] __kasan_slab_alloc+0x90/0x94 mm/kasan/common.c:338 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook mm/slub.c:3988 [inline] slab_alloc_node mm/slub.c:4037 [inline] kmem_cache_alloc_noprof+0x1c0/0x35c mm/slub.c:4044 kvm_vm_ioctl_create_vcpu+0x114/0x588 virt/kvm/kvm_main.c:4241 kvm_vm_ioctl+0x4dc/0x11e8 virt/kvm/kvm_main.c:5162 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl fs/ioctl.c:893 [inline] __arm64_sys_ioctl+0x108/0x184 fs/ioctl.c:893 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x78/0x1b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xe8/0x1b0 arch/arm64/kernel/syscall.c:132 do_el0_svc+0x40/0x50 arch/arm64/kernel/syscall.c:151 el0_svc+0x54/0x14c arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 Freed by task 3527: kasan_save_stack+0x40/0x6c mm/kasan/common.c:47 save_stack_info+0x34/0x144 mm/kasan/tags.c:106 kasan_save_free_info+0x18/0x24 mm/kasan/tags.c:147 poison_slab_object+0x19c/0x1a0 mm/kasan/common.c:240 __kasan_slab_free+0x10/0x20 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2252 [inline] slab_free mm/slub.c:4473 [inline] kmem_cache_free+0x158/0x4b8 mm/slub.c:4548 kvm_vm_ioctl_create_vcpu+0x404/0x588 virt/kvm/kvm_main.c:4320 kvm_vm_ioctl+0x4dc/0x11e8 virt/kvm/kvm_main.c:5162 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:907 [inline] __se_sys_ioctl fs/ioctl.c:893 [inline] __arm64_sys_ioctl+0x108/0x184 fs/ioctl.c:893 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x78/0x1b8 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xe8/0x1b0 arch/arm64/kernel/syscall.c:132 do_el0_svc+0x40/0x50 arch/arm64/kernel/syscall.c:151 el0_svc+0x54/0x14c arch/arm64/kernel/entry-common.c:712 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598 The buggy address belongs to the object at fff0000016389cb0 which belongs to the cache kvm_vcpu of size 7344 The buggy address is located 5072 bytes inside of 7344-byte region [fff0000016389cb0, fff000001638b960) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x56388 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 memcg:df0000015df5141 flags: 0x1ffc00000000040(head|node=0|zone=0|lastcpupid=0x7ff|kasantag=0x0) page_type: 0xfdffffff(slab) raw: 01ffc00000000040 00f000000ad9d000 dead000000000122 0000000000000000 raw: 0000000000000000 0000000080040004 00000001fdffffff 0df0000015df5141 head: 01ffc00000000040 00f000000ad9d000 dead000000000122 0000000000000000 head: 0000000000000000 0000000080040004 00000001fdffffff 0df0000015df5141 head: 01ffc00000000003 ffffc1ffc058e201 ffffffffffffffff 0000000000000000 head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: fff000001638ae00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fff000001638af00: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe >fff000001638b000: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe ^ fff000001638b100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fff000001638b200: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe ==================================================================