================================================================== BUG: KASAN: slab-out-of-bounds in search_memslots include/linux/kvm_host.h:1051 [inline] BUG: KASAN: slab-out-of-bounds in __gfn_to_memslot include/linux/kvm_host.h:1063 [inline] BUG: KASAN: slab-out-of-bounds in gfn_to_memslot arch/x86/kvm/../../../virt/kvm/kvm_main.c:1597 [inline] BUG: KASAN: slab-out-of-bounds in gfn_to_hva+0x4a0/0x4c0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:1677 Read of size 8 at addr ffff8880a7f2c468 by task kworker/u4:3/17016 CPU: 0 PID: 17016 Comm: kworker/u4:3 Not tainted 5.7.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: writeback wb_workfn (flush-8:0) Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x188/0x20d lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xd3/0x315 mm/kasan/report.c:382 __kasan_report.cold+0x35/0x4d mm/kasan/report.c:511 kasan_report+0x33/0x50 mm/kasan/common.c:625 search_memslots include/linux/kvm_host.h:1051 [inline] __gfn_to_memslot include/linux/kvm_host.h:1063 [inline] gfn_to_memslot arch/x86/kvm/../../../virt/kvm/kvm_main.c:1597 [inline] gfn_to_hva+0x4a0/0x4c0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:1677 kvm_arch_mmu_notifier_invalidate_range+0x21/0x80 arch/x86/kvm/x86.c:8142 kvm_mmu_notifier_invalidate_range_start+0x1a1/0x280 arch/x86/kvm/../../../virt/kvm/kvm_main.c:421 mn_hlist_invalidate_range_start mm/mmu_notifier.c:493 [inline] __mmu_notifier_invalidate_range_start+0x4bc/0x6b0 mm/mmu_notifier.c:525 mmu_notifier_invalidate_range_start include/linux/mmu_notifier.h:446 [inline] page_mkclean_one+0x5dc/0x6c0 mm/rmap.c:916 rmap_walk_file+0x581/0xcf0 mm/rmap.c:1917 rmap_walk+0x122/0x1c0 mm/rmap.c:1935 page_mkclean+0x23b/0x310 mm/rmap.c:998 clear_page_dirty_for_io+0x351/0xdd0 mm/page-writeback.c:2690 mpage_submit_page+0x80/0x2d0 fs/ext4/inode.c:2053 mpage_process_page_bufs+0x616/0x730 fs/ext4/inode.c:2187 mpage_prepare_extent_to_map+0x960/0xeb0 fs/ext4/inode.c:2595 ext4_writepages+0x953/0x31d0 fs/ext4/inode.c:2723 do_writepages+0xfa/0x2a0 mm/page-writeback.c:2344 __writeback_single_inode+0x12a/0x1410 fs/fs-writeback.c:1452 writeback_sb_inodes+0x515/0xdd0 fs/fs-writeback.c:1716 __writeback_inodes_wb+0xc3/0x250 fs/fs-writeback.c:1785 wb_writeback+0x910/0xd90 fs/fs-writeback.c:1894 wb_check_background_flush fs/fs-writeback.c:1962 [inline] wb_do_writeback fs/fs-writeback.c:2050 [inline] wb_workfn+0xa49/0x11c0 fs/fs-writeback.c:2078 process_one_work+0x965/0x16a0 kernel/workqueue.c:2268 worker_thread+0x96/0xe20 kernel/workqueue.c:2414 kthread+0x388/0x470 kernel/kthread.c:268 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Allocated by task 29859: save_stack+0x1b/0x40 mm/kasan/common.c:49 set_track mm/kasan/common.c:57 [inline] __kasan_kmalloc mm/kasan/common.c:495 [inline] __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:468 kmalloc_node include/linux/slab.h:578 [inline] kvmalloc_node+0x61/0xf0 mm/util.c:574 kvmalloc include/linux/mm.h:757 [inline] kvzalloc include/linux/mm.h:765 [inline] kvm_dup_memslots arch/x86/kvm/../../../virt/kvm/kvm_main.c:1101 [inline] kvm_set_memslot+0x115/0x1530 arch/x86/kvm/../../../virt/kvm/kvm_main.c:1118 __kvm_set_memory_region+0xcf7/0x1320 arch/x86/kvm/../../../virt/kvm/kvm_main.c:1300 kvm_set_memory_region+0x29/0x50 arch/x86/kvm/../../../virt/kvm/kvm_main.c:1321 kvm_vm_ioctl_set_memory_region arch/x86/kvm/../../../virt/kvm/kvm_main.c:1333 [inline] kvm_vm_ioctl+0x678/0x23e0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3604 vfs_ioctl fs/ioctl.c:47 [inline] ksys_ioctl+0x11a/0x180 fs/ioctl.c:763 __do_sys_ioctl fs/ioctl.c:772 [inline] __se_sys_ioctl fs/ioctl.c:770 [inline] __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:770 do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295 entry_SYSCALL_64_after_hwframe+0x49/0xb3 Freed by task 29508: save_stack+0x1b/0x40 mm/kasan/common.c:49 set_track mm/kasan/common.c:57 [inline] kasan_set_free_info mm/kasan/common.c:317 [inline] __kasan_slab_free+0xf7/0x140 mm/kasan/common.c:456 __cache_free mm/slab.c:3426 [inline] kfree+0x109/0x2b0 mm/slab.c:3757 sk_prot_free net/core/sock.c:1641 [inline] __sk_destruct+0x5ad/0x7c0 net/core/sock.c:1725 sk_destruct+0xc6/0x100 net/core/sock.c:1740 __sk_free+0xef/0x3d0 net/core/sock.c:1751 sk_free+0x78/0xa0 net/core/sock.c:1762 deferred_put_nlk_sk+0x151/0x2e0 net/netlink/af_netlink.c:729 rcu_do_batch kernel/rcu/tree.c:2206 [inline] rcu_core+0x59f/0x1370 kernel/rcu/tree.c:2433 __do_softirq+0x26c/0x9f7 kernel/softirq.c:292 The buggy address belongs to the object at ffff8880a7f2c000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 1128 bytes inside of 2048-byte region [ffff8880a7f2c000, ffff8880a7f2c800) The buggy address belongs to the page: page:ffffea00029fcb00 refcount:1 mapcount:0 mapping:00000000c5c4c3a7 index:0x0 flags: 0xfffe0000000200(slab) raw: 00fffe0000000200 ffffea00012635c8 ffffea00028b8008 ffff8880aa000e00 raw: 0000000000000000 ffff8880a7f2c000 0000000100000001 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880a7f2c300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880a7f2c380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff8880a7f2c400: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc ^ ffff8880a7f2c480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8880a7f2c500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================