================================================================== BUG: KASAN: slab-out-of-bounds in __cpa_addr arch/x86/mm/pat/set_memory.c:309 [inline] BUG: KASAN: slab-out-of-bounds in cpa_flush arch/x86/mm/pat/set_memory.c:449 [inline] BUG: KASAN: slab-out-of-bounds in change_page_attr_set_clr+0x625/0xfc0 arch/x86/mm/pat/set_memory.c:2115 Read of size 8 at addr ffff888029b04ae0 by task syz.1.5830/28538 CPU: 0 UID: 0 PID: 28538 Comm: syz.1.5830 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595 __cpa_addr arch/x86/mm/pat/set_memory.c:309 [inline] cpa_flush arch/x86/mm/pat/set_memory.c:449 [inline] change_page_attr_set_clr+0x625/0xfc0 arch/x86/mm/pat/set_memory.c:2115 cpa_set_pages_array arch/x86/mm/pat/set_memory.c:2137 [inline] _set_pages_array+0x145/0x270 arch/x86/mm/pat/set_memory.c:2521 drm_gem_shmem_get_pages_locked+0x2d0/0x440 drivers/gpu/drm/drm_gem_shmem_helper.c:214 drm_gem_shmem_pin_locked+0x22c/0x460 drivers/gpu/drm/drm_gem_shmem_helper.c:261 drm_gem_map_attach+0x19c/0x1f0 drivers/gpu/drm/drm_prime.c:620 dma_buf_dynamic_attach+0x1ea/0x3d0 drivers/dma-buf/dma-buf.c:974 drm_gem_shmem_prime_import_no_map+0xc1/0x2f0 drivers/gpu/drm/drm_gem_shmem_helper.c:835 drm_gem_prime_fd_to_handle+0x196/0x4d0 drivers/gpu/drm/drm_prime.c:313 drm_ioctl_kernel+0x2cf/0x390 drivers/gpu/drm/drm_ioctl.c:797 drm_ioctl+0x67f/0xb10 drivers/gpu/drm/drm_ioctl.c:894 __do_compat_sys_ioctl fs/ioctl.c:695 [inline] __se_compat_sys_ioctl fs/ioctl.c:638 [inline] __ia32_compat_sys_ioctl+0x543/0x840 fs/ioctl.c:638 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] __do_fast_syscall_32+0xb6/0x2b0 arch/x86/entry/syscall_32.c:306 do_fast_syscall_32+0x34/0x80 arch/x86/entry/syscall_32.c:331 entry_SYSENTER_compat_after_hwframe+0x84/0x8e RIP: 0023:0xf7f37539 Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 RSP: 002b:00000000f542655c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 00000000c00c642e RDX: 0000000080000240 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Allocated by task 28538: kasan_save_stack mm/kasan/common.c:56 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:77 poison_kmalloc_redzone mm/kasan/common.c:400 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:417 kasan_kmalloc include/linux/kasan.h:262 [inline] __do_kmalloc_node mm/slub.c:5627 [inline] __kvmalloc_node_noprof+0x5cd/0x910 mm/slub.c:7081 kvmalloc_array_node_noprof include/linux/slab.h:1122 [inline] drm_gem_get_pages+0x166/0xa20 drivers/gpu/drm/drm_gem.c:647 drm_gem_shmem_get_pages_locked+0x201/0x440 drivers/gpu/drm/drm_gem_shmem_helper.c:200 drm_gem_shmem_pin_locked+0x22c/0x460 drivers/gpu/drm/drm_gem_shmem_helper.c:261 drm_gem_map_attach+0x19c/0x1f0 drivers/gpu/drm/drm_prime.c:620 dma_buf_dynamic_attach+0x1ea/0x3d0 drivers/dma-buf/dma-buf.c:974 drm_gem_shmem_prime_import_no_map+0xc1/0x2f0 drivers/gpu/drm/drm_gem_shmem_helper.c:835 drm_gem_prime_fd_to_handle+0x196/0x4d0 drivers/gpu/drm/drm_prime.c:313 drm_ioctl_kernel+0x2cf/0x390 drivers/gpu/drm/drm_ioctl.c:797 drm_ioctl+0x67f/0xb10 drivers/gpu/drm/drm_ioctl.c:894 __do_compat_sys_ioctl fs/ioctl.c:695 [inline] __se_compat_sys_ioctl fs/ioctl.c:638 [inline] __ia32_compat_sys_ioctl+0x543/0x840 fs/ioctl.c:638 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] __do_fast_syscall_32+0xb6/0x2b0 arch/x86/entry/syscall_32.c:306 do_fast_syscall_32+0x34/0x80 arch/x86/entry/syscall_32.c:331 entry_SYSENTER_compat_after_hwframe+0x84/0x8e The buggy address belongs to the object at ffff888029b04a80 which belongs to the cache kmalloc-96 of size 96 The buggy address is located 0 bytes to the right of allocated 96-byte region [ffff888029b04a80, ffff888029b04ae0) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x29b04 anon flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000000 ffff88813ffa6280 ffffea000172f2c0 dead000000000005 raw: 0000000000000000 0000000080200020 00000000f5000000 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 6251, tgid 6245 (syz.3.69), ts 111518985298, free_ts 111490285051 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x240/0x2a0 mm/page_alloc.c:1850 prep_new_page mm/page_alloc.c:1858 [inline] get_page_from_freelist+0x2365/0x2440 mm/page_alloc.c:3884 __alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5183 alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2416 alloc_slab_page mm/slub.c:3039 [inline] allocate_slab+0x96/0x3a0 mm/slub.c:3212 new_slab mm/slub.c:3266 [inline] ___slab_alloc+0xe94/0x18a0 mm/slub.c:4636 __slab_alloc+0x65/0x100 mm/slub.c:4755 __slab_alloc_node mm/slub.c:4831 [inline] slab_alloc_node mm/slub.c:5253 [inline] __do_kmalloc_node mm/slub.c:5626 [inline] __kmalloc_noprof+0x471/0x7f0 mm/slub.c:5639 kmalloc_noprof include/linux/slab.h:961 [inline] kzalloc_noprof include/linux/slab.h:1094 [inline] hash_netport4_add+0x1d37/0x2720 net/netfilter/ipset/ip_set_hash_gen.h:950 hash_netport4_uadt+0xba9/0xf30 net/netfilter/ipset/ip_set_hash_netport.c:255 call_ad+0x383/0xb00 net/netfilter/ipset/ip_set_core.c:1751 ip_set_ad+0x791/0x930 net/netfilter/ipset/ip_set_core.c:1841 nfnetlink_rcv_msg+0xb4d/0x1130 net/netfilter/nfnetlink.c:302 netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552 nfnetlink_rcv+0x282/0x2590 net/netfilter/nfnetlink.c:669 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0x82f/0x9e0 net/netlink/af_netlink.c:1346 page last free pid 5888 tgid 5888 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1394 [inline] __free_frozen_pages+0xbc4/0xd30 mm/page_alloc.c:2906 vfree+0x25a/0x400 mm/vmalloc.c:3440 delayed_vfree_work+0x55/0x80 mm/vmalloc.c:3359 process_one_work kernel/workqueue.c:3263 [inline] process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3346 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3427 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x4bc/0x870 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Memory state around the buggy address: ffff888029b04980: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc ffff888029b04a00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc >ffff888029b04a80: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc ^ ffff888029b04b00: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ffff888029b04b80: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc ================================================================== ---------------- Code disassembly (best guess): 0: 03 74 b4 01 add 0x1(%rsp,%rsi,4),%esi 4: 10 07 adc %al,(%rdi) 6: 03 74 b0 01 add 0x1(%rax,%rsi,4),%esi a: 10 08 adc %cl,(%rax) c: 03 74 d8 01 add 0x1(%rax,%rbx,8),%esi 20: 00 51 52 add %dl,0x52(%rcx) 23: 55 push %rbp 24: 89 e5 mov %esp,%ebp 26: 0f 34 sysenter 28: cd 80 int $0x80 * 2a: 5d pop %rbp <-- trapping instruction 2b: 5a pop %rdx 2c: 59 pop %rcx 2d: c3 ret 2e: 90 nop 2f: 90 nop 30: 90 nop 31: 90 nop 32: 90 nop 33: 90 nop 34: 90 nop 35: 90 nop 36: 90 nop 37: 90 nop 38: 90 nop 39: 90 nop 3a: 90 nop 3b: 90 nop 3c: 90 nop 3d: 90 nop 3e: 90 nop 3f: 90 nop