kasan_quarantine_reduce+0x184/0x210 mm/kasan/quarantine.c:294 __kasan_slab_alloc+0x66/0x90 mm/kasan/common.c:302 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook mm/slab.h:737 [inline] slab_alloc_node mm/slub.c:3398 [inline] __kmem_cache_alloc_node+0x2e2/0x3e0 mm/slub.c:3437 kmalloc_trace+0x26/0x60 mm/slab_common.c:1045 kmalloc include/linux/slab.h:553 [inline] gro_cells_destroy net/core/gro_cells.c:125 [inline] gro_cells_destroy+0x26b/0x470 net/core/gro_cells.c:105 ip_tunnel_dev_free+0x19/0x60 net/ipv4/ip_tunnel.c:1013 netdev_run_todo+0x6bf/0x1100 net/core/dev.c:10362 ip_tunnel_delete_nets+0x3a8/0x5c0 net/ipv4/ip_tunnel.c:1127 ops_exit_list+0x125/0x170 net/core/net_namespace.c:174 setup_net+0x7fb/0xc50 net/core/net_namespace.c:355 copy_net_ns+0x31c/0x760 net/core/net_namespace.c:478 create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110 ------------[ cut here ]------------ kernel BUG at include/linux/memcontrol.h:455! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 22483 Comm: syz-executor.5 Not tainted 6.1.0-rc5-syzkaller-00341-g894909f95aa1 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 RIP: 0010:folio_memcg_rcu include/linux/memcontrol.h:455 [inline] RIP: 0010:workingset_activation+0x4cc/0x580 mm/workingset.c:519 Code: 48 89 ef e8 d6 00 00 00 c6 05 c6 37 87 0c 01 0f 0b e9 0e fd ff ff e8 f3 3d c9 ff 48 c7 c6 40 ac 57 8a 48 89 ef e8 b4 00 00 00 <0f> 0b e8 dd 3d c9 ff 0f 0b e9 10 fc ff ff e8 d1 3d c9 ff 48 c7 c6 RSP: 0018:ffffc9000562f208 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 RDX: ffff88802ad28000 RSI: ffffffff81b6dc2c RDI: 0000000000000000 RBP: ffffea000108f800 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 R13: ffff8880b9b35d48 R14: 0000000000000003 R15: 0000000000000003 FS: 0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005555571f6848 CR3: 000000001cf63000 CR4: 00000000003526e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 00000000000000ab DR6: 00000000ffff0ff0 DR7: 0000000000000400 Call Trace: folio_mark_accessed+0x599/0x830 mm/swap.c:502 kvm_set_page_accessed arch/x86/kvm/../../../virt/kvm/kvm_main.c:2895 [inline] kvm_set_pfn_accessed arch/x86/kvm/../../../virt/kvm/kvm_main.c:2967 [inline] kvm_set_pfn_accessed+0x23f/0x2b0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2961 handle_changed_spte_acc_track arch/x86/kvm/mmu/tdp_mmu.c:354 [inline] handle_changed_spte_acc_track+0x1bc/0x290 arch/x86/kvm/mmu/tdp_mmu.c:346 handle_changed_spte arch/x86/kvm/mmu/tdp_mmu.c:620 [inline] handle_removed_pt arch/x86/kvm/mmu/tdp_mmu.c:504 [inline] __handle_changed_spte+0xdb3/0x1a40 arch/x86/kvm/mmu/tdp_mmu.c:611 handle_changed_spte arch/x86/kvm/mmu/tdp_mmu.c:618 [inline] handle_removed_pt arch/x86/kvm/mmu/tdp_mmu.c:504 [inline] __handle_changed_spte+0xda4/0x1a40 arch/x86/kvm/mmu/tdp_mmu.c:611 __tdp_mmu_set_spte+0x229/0x9d0 arch/x86/kvm/mmu/tdp_mmu.c:743 _tdp_mmu_set_spte arch/x86/kvm/mmu/tdp_mmu.c:759 [inline] tdp_mmu_set_spte arch/x86/kvm/mmu/tdp_mmu.c:768 [inline] __tdp_mmu_zap_root+0x7e7/0x860 arch/x86/kvm/mmu/tdp_mmu.c:874 tdp_mmu_zap_root+0x12e/0x330 arch/x86/kvm/mmu/tdp_mmu.c:910 kvm_tdp_mmu_zap_all+0x158/0x1b0 arch/x86/kvm/mmu/tdp_mmu.c:1014 kvm_mmu_zap_all+0x280/0x2d0 arch/x86/kvm/mmu/mmu.c:6514 kvm_flush_shadow_all arch/x86/kvm/../../../virt/kvm/kvm_main.c:383 [inline] kvm_mmu_notifier_release+0x60/0xb0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:895 mn_hlist_release mm/mmu_notifier.c:319 [inline] __mmu_notifier_release+0x1ad/0x610 mm/mmu_notifier.c:357 mmu_notifier_release include/linux/mmu_notifier.h:415 [inline] exit_mmap+0x66d/0x7b0 mm/mmap.c:3077 __mmput+0x128/0x4c0 kernel/fork.c:1185 mmput+0x60/0x70 kernel/fork.c:1207 exit_mm kernel/exit.c:516 [inline] do_exit+0xa41/0x2a30 kernel/exit.c:807 do_group_exit+0xd4/0x2a0 kernel/exit.c:950 get_signal+0x21b1/0x2440 kernel/signal.c:2858 arch_do_signal_or_restart+0x86/0x2300 arch/x86/kernel/signal.c:869 exit_to_user_mode_loop kernel/entry/common.c:168 [inline] exit_to_user_mode_prepare+0x15f/0x250 kernel/entry/common.c:203 __syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline] syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:296 do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f01c428b639 Code: Unable to access opcode bytes at 0x7f01c428b60f. RSP: 002b:00007f01c5073168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: fffffffffffffffc RBX: 00007f01c43abf80 RCX: 00007f01c428b639 RDX: 0000000000000000 RSI: 000000000000ae01 RDI: 0000000000000003 RBP: 00007f01c42e6ae9 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f01c44cfb1f R14: 00007f01c5073300 R15: 0000000000022000 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:folio_memcg_rcu include/linux/memcontrol.h:455 [inline] RIP: 0010:workingset_activation+0x4cc/0x580 mm/workingset.c:519 Code: 48 89 ef e8 d6 00 00 00 c6 05 c6 37 87 0c 01 0f 0b e9 0e fd ff ff e8 f3 3d c9 ff 48 c7 c6 40 ac 57 8a 48 89 ef e8 b4 00 00 00 <0f> 0b e8 dd 3d c9 ff 0f 0b e9 10 fc ff ff e8 d1 3d c9 ff 48 c7 c6 RSP: 0018:ffffc9000562f208 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 RDX: ffff88802ad28000 RSI: ffffffff81b6dc2c RDI: 0000000000000000 RBP: ffffea000108f800 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 R13: ffff8880b9b35d48 R14: 0000000000000003 R15: 0000000000000003 FS: 0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00005555571f6848 CR3: 000000001cf63000 CR4: 00000000003526e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 00000000000000ab DR6: 00000000ffff0ff0 DR7: 0000000000000400