BUG: Bad page map in process syz-executor0 pte:4be3b007 pmd:121307067 page:ffffea0001c75620 count:0 mapcount:-1 mapping:0000000000000000 index:0x0 flags: 0x100000000000000() raw: 0100000000000000 ffffea0001c75628 ffffea0001c75628 0000000000000000 raw: 0000000000000000 0000000000000000 00000000fffffffe 0000000000000000 raw: 0000000000000000 0000000000000000 0000000000000001 0000000000000000 page dumped because: bad pte addr:00000000daac4f64 vm_flags:100400fb anon_vma: (null) mapping:0000000065b05933 index:f5 file:kcov fault: (null) mmap:kcov_mmap readpage: (null) CPU: 0 PID: 9110 Comm: syz-executor0 Not tainted 4.18.0-rc8+ #34 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x17c/0x1c0 lib/dump_stack.c:113 print_bad_pte+0xcae/0xde0 mm/memory.c:775 zap_pte_range mm/memory.c:1336 [inline] zap_pmd_range mm/memory.c:1436 [inline] zap_pud_range mm/memory.c:1465 [inline] zap_p4d_range mm/memory.c:1486 [inline] unmap_page_range+0x2119/0x3b60 mm/memory.c:1507 unmap_single_vma+0x445/0x5e0 mm/memory.c:1552 unmap_vmas+0x241/0x370 mm/memory.c:1582 exit_mmap+0x4d7/0x960 mm/mmap.c:3094 __mmput+0x154/0x5f0 kernel/fork.c:994 mmput+0xa7/0xe0 kernel/fork.c:1015 exit_mm+0x6dd/0x790 kernel/exit.c:545 do_exit+0xbf7/0x3890 kernel/exit.c:854 do_group_exit+0x1a0/0x350 kernel/exit.c:970 get_signal+0x1425/0x1ef0 kernel/signal.c:2468 do_signal+0x120/0x2090 arch/x86/kernel/signal.c:816 exit_to_usermode_loop arch/x86/entry/common.c:162 [inline] prepare_exit_to_usermode+0x273/0x410 arch/x86/entry/common.c:197 syscall_return_slowpath+0xdb/0x700 arch/x86/entry/common.c:268 do_syscall_64+0x1ab/0x220 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x63/0xe7 RIP: 0033:0x457089 Code: fd b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f2848afbcf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00000000009300a8 RCX: 0000000000457089 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000009300a8 RBP: 00000000009300a0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000009300ac R13: 0000000000a3fb9f R14: 00007f2848afc9c0 R15: 0000000000000000 Unknown ioctl -1055894249 Unknown ioctl 8838 Unknown ioctl -1055894249 Unknown ioctl 8838 BUG: Bad rss-counter state mm:000000005aac7f53 idx:0 val:13 capability: warning: `syz-executor2' uses 32-bit capabilities (legacy support in use) device veth0_to_bridge entered promiscuous mode device veth0_to_bridge left promiscuous mode IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready netlink: 12 bytes leftover after parsing attributes in process `syz-executor5'. ================================================================== BUG: KMSAN: uninit-value in bond_xmit_roundrobin drivers/net/bonding/bond_main.c:3858 [inline] BUG: KMSAN: uninit-value in __bond_start_xmit drivers/net/bonding/bond_main.c:4135 [inline] BUG: KMSAN: uninit-value in bond_start_xmit+0x1ab8/0x2b90 drivers/net/bonding/bond_main.c:4169 CPU: 0 PID: 9647 Comm: syz-executor3 Tainted: G B 4.18.0-rc8+ #34 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x17c/0x1c0 lib/dump_stack.c:113 kmsan_report+0x188/0x2a0 mm/kmsan/kmsan.c:982 __msan_warning+0x70/0xc0 mm/kmsan/kmsan_instr.c:645 bond_xmit_roundrobin drivers/net/bonding/bond_main.c:3858 [inline] __bond_start_xmit drivers/net/bonding/bond_main.c:4135 [inline] bond_start_xmit+0x1ab8/0x2b90 drivers/net/bonding/bond_main.c:4169 __netdev_start_xmit include/linux/netdevice.h:4148 [inline] netdev_start_xmit include/linux/netdevice.h:4157 [inline] xmit_one net/core/dev.c:3034 [inline] dev_hard_start_xmit+0x5df/0xc20 net/core/dev.c:3050 __dev_queue_xmit+0x2eea/0x3a70 net/core/dev.c:3569 dev_queue_xmit+0x4b/0x60 net/core/dev.c:3602 packet_snd net/packet/af_packet.c:2921 [inline] packet_sendmsg+0x7fb5/0x8ae0 net/packet/af_packet.c:2946 sock_sendmsg_nosec net/socket.c:642 [inline] sock_sendmsg net/socket.c:652 [inline] __sys_sendto+0x6a3/0x7c0 net/socket.c:1798 __do_sys_sendto net/socket.c:1810 [inline] __se_sys_sendto net/socket.c:1806 [inline] __x64_sys_sendto+0x1a1/0x210 net/socket.c:1806 do_syscall_64+0x15b/0x220 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x63/0xe7 RIP: 0033:0x457089 Code: fd b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f5a3903bc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007f5a3903c6d4 RCX: 0000000000457089 RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000003 RBP: 00000000009300a0 R08: 0000000020000080 R09: 000000000000001c R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 00000000004d4190 R14: 00000000004c8b54 R15: 0000000000000000 Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:256 [inline] kmsan_internal_poison_shadow+0xb8/0x1b0 mm/kmsan/kmsan.c:181 kmsan_kmalloc+0x98/0x100 mm/kmsan/kmsan_hooks.c:91 kmsan_slab_alloc+0x10/0x20 mm/kmsan/kmsan_hooks.c:100 slab_post_alloc_hook mm/slab.h:446 [inline] slab_alloc_node mm/slub.c:2720 [inline] __kmalloc_node_track_caller+0xb4c/0x11d0 mm/slub.c:4353 __kmalloc_reserve net/core/skbuff.c:138 [inline] __alloc_skb+0x2ce/0x9b0 net/core/skbuff.c:206 alloc_skb include/linux/skbuff.h:988 [inline] alloc_skb_with_frags+0x1d0/0xac0 net/core/skbuff.c:5272 sock_alloc_send_pskb+0xb47/0x1120 net/core/sock.c:2095 packet_alloc_skb net/packet/af_packet.c:2776 [inline] packet_snd net/packet/af_packet.c:2867 [inline] packet_sendmsg+0x6480/0x8ae0 net/packet/af_packet.c:2946 sock_sendmsg_nosec net/socket.c:642 [inline] sock_sendmsg net/socket.c:652 [inline] __sys_sendto+0x6a3/0x7c0 net/socket.c:1798 __do_sys_sendto net/socket.c:1810 [inline] __se_sys_sendto net/socket.c:1806 [inline] __x64_sys_sendto+0x1a1/0x210 net/socket.c:1806 do_syscall_64+0x15b/0x220 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x63/0xe7 ==================================================================