kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 28878 Comm: syz-executor.5 Not tainted 5.1.0-rc5 #68 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:ax25_send_frame+0xe5/0x580 net/ax25/ax25_out.c:59 Code: 89 00 00 48 85 c0 0f 85 d4 03 00 00 e8 c4 36 2f fb 49 8d bc 24 30 03 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 fb 03 00 00 49 8b 84 24 30 03 00 00 48 85 c0 48 RSP: 0018:ffff8880ae907a98 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: ffff8882160cb288 RCX: 1ffff110128b5594 RDX: 0000000000000066 RSI: ffffffff864155ec RDI: 0000000000000330 RBP: ffff8880ae907ad8 R08: ffff8880945aa400 R09: ffff8880945aaca0 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: ffffffff8b14f600 R14: 0000000000000104 R15: 0000000000000000 FS: 00007ff21b6c3700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000738000 CR3: 0000000080242000 CR4: 00000000001406e0 Call Trace: rose_send_frame+0xda/0x280 net/rose/rose_link.c:109 rose_transmit_clear_request+0x1de/0x2a0 net/rose/rose_link.c:258 rose_rx_call_request+0x4ea/0x1990 net/rose/af_rose.c:1001 rose_loopback_timer+0x26a/0x3f0 net/rose/rose_loopback.c:100 call_timer_fn+0x190/0x720 kernel/time/timer.c:1325 expire_timers kernel/time/timer.c:1362 [inline] __run_timers kernel/time/timer.c:1681 [inline] __run_timers kernel/time/timer.c:1649 [inline] run_timer_softirq+0x652/0x1700 kernel/time/timer.c:1694 __do_softirq+0x266/0x95a kernel/softirq.c:293 invoke_softirq kernel/softirq.c:374 [inline] irq_exit+0x180/0x1d0 kernel/softirq.c:414 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x14a/0x570 arch/x86/kernel/apic/apic.c:1062 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807 RIP: 0010:check_memory_region+0x21/0x190 mm/kasan/generic.c:190 Code: 2e 0f 1f 84 00 00 00 00 00 48 85 f6 0f 84 21 01 00 00 48 b8 ff ff ff ff ff 7f ff ff 55 0f b6 d2 48 39 c7 48 89 e5 41 55 41 54 <53> 0f 86 f6 00 00 00 4c 8d 5c 37 ff 49 89 f8 48 b8 00 00 00 00 00 RSP: 0018:ffff888054b7f540 EFLAGS: 00000212 ORIG_RAX: ffffffffffffff13 RAX: ffff7fffffffffff RBX: ffffea000207ce74 RCX: ffffffff819064d4 RDX: 0000000000000000 RSI: 0000000000000004 RDI: ffffea000207ce74 RBP: ffff888054b7f550 R08: ffff8880945aa400 R09: fffff9400040f9c7 R10: fffff9400040f9c6 R11: ffffea000207ce37 R12: ffffea000207ce40 R13: 0000000000000007 R14: 0000000000000000 R15: dffffc0000000000 kasan_check_read+0x11/0x20 mm/kasan/common.c:102 atomic_read include/asm-generic/atomic-instrumented.h:26 [inline] page_ref_count include/linux/page_ref.h:67 [inline] put_page_testzero include/linux/mm.h:547 [inline] release_pages+0x164/0x1a50 mm/swap.c:754 free_pages_and_swap_cache+0x2a0/0x3d0 mm/swap_state.c:295 tlb_flush_mmu_free+0x4e/0x120 mm/mmu_gather.c:74 zap_pte_range mm/memory.c:1158 [inline] zap_pmd_range mm/memory.c:1193 [inline] zap_pud_range mm/memory.c:1222 [inline] zap_p4d_range mm/memory.c:1243 [inline] unmap_page_range+0x180e/0x2330 mm/memory.c:1264 unmap_single_vma+0x19d/0x300 mm/memory.c:1309 unmap_vmas+0x115/0x250 mm/memory.c:1340 exit_mmap+0x2c2/0x530 mm/mmap.c:3138 __mmput kernel/fork.c:1046 [inline] mmput+0x15f/0x4c0 kernel/fork.c:1067 exit_mm kernel/exit.c:546 [inline] do_exit+0x816/0x2fa0 kernel/exit.c:863 do_group_exit+0x135/0x370 kernel/exit.c:980 get_signal+0x399/0x1d50 kernel/signal.c:2577 do_signal+0x87/0x1940 arch/x86/kernel/signal.c:816 exit_to_usermode_loop+0x244/0x2c0 arch/x86/entry/common.c:162 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline] syscall_return_slowpath arch/x86/entry/common.c:268 [inline] do_syscall_64+0x52d/0x610 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x458c29 Code: ad b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 7b b8 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007ff21b6c2cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 000000000073bf08 RCX: 0000000000458c29 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 000000000073bf08 RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000073bf0c R13: 00007ffebad9974f R14: 00007ff21b6c39c0 R15: 000000000073bf0c Modules linked in: ---[ end trace 515766fabf950d57 ]--- RIP: 0010:ax25_send_frame+0xe5/0x580 net/ax25/ax25_out.c:59 Code: 89 00 00 48 85 c0 0f 85 d4 03 00 00 e8 c4 36 2f fb 49 8d bc 24 30 03 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 fb 03 00 00 49 8b 84 24 30 03 00 00 48 85 c0 48 RSP: 0018:ffff8880ae907a98 EFLAGS: 00010206 RAX: dffffc0000000000 RBX: ffff8882160cb288 RCX: 1ffff110128b5594 RDX: 0000000000000066 RSI: ffffffff864155ec RDI: 0000000000000330 RBP: ffff8880ae907ad8 R08: ffff8880945aa400 R09: ffff8880945aaca0 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: ffffffff8b14f600 R14: 0000000000000104 R15: 0000000000000000 FS: 00007ff21b6c3700(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000738000 CR3: 0000000080242000 CR4: 00000000001406e0