------------[ cut here ]------------ kernel BUG at mm/kmsan/kmsan_hooks.c:259! invalid opcode: 0000 [#1] SMP CPU: 0 PID: 10039 Comm: syz-executor121 Not tainted 5.0.0+ #15 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:kmsan_free_page+0x13e/0x2f0 mm/kmsan/kmsan_hooks.c:259 Code: 66 90 66 2e 0f 1f 84 00 00 00 00 00 44 39 e8 0f 8d 45 01 00 00 48 63 c8 48 8d 0c 89 48 c1 e1 04 ff c0 48 83 7c 0b 40 00 74 e2 <0f> 0b 41 83 fe 1f 0f 84 24 01 00 00 49 63 c5 48 83 c3 40 31 c9 0f RSP: 0018:ffff88804c52e538 EFLAGS: 00010286 RAX: 0000000000000002 RBX: ffffea0008a66000 RCX: 0000000000000050 RDX: ffffffff8c626000 RSI: 0000000000000008 RDI: ffffea0008a66000 RBP: ffff88804c52e580 R08: 0000000000050601 R09: ffff88812fc39010 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000008 R13: 0000000000000100 R14: 0000000000000008 R15: ffffea0008a66000 FS: 0000000000feb880(0000) GS:ffff88812fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000004bf7a8 CR3: 00000000b56ca000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: free_pages_prepare mm/page_alloc.c:1035 [inline] __free_pages_ok+0x250/0x1990 mm/page_alloc.c:1299 free_the_page mm/page_alloc.c:4625 [inline] __free_pages+0x10e/0x260 mm/page_alloc.c:4631 free_buffer_page drivers/staging/android/ion/ion_system_heap.c:63 [inline] ion_system_heap_free+0x315/0x4d0 drivers/staging/android/ion/ion_system_heap.c:165 ion_buffer_destroy+0x187/0x4d0 drivers/staging/android/ion/ion.c:125 _ion_heap_freelist_drain+0x526/0x840 drivers/staging/android/ion/ion_heap.c:199 ion_heap_freelist_shrink drivers/staging/android/ion/ion_heap.c:214 [inline] ion_heap_shrink_scan+0x13e/0x350 drivers/staging/android/ion/ion_heap.c:289 do_shrink_slab+0xb63/0x1240 mm/vmscan.c:551 shrink_slab+0x307/0xe30 mm/vmscan.c:700 shrink_node+0x76c/0x2130 mm/vmscan.c:2747 shrink_zones mm/vmscan.c:2977 [inline] do_try_to_free_pages+0x55e/0x20b0 mm/vmscan.c:3039 try_to_free_pages+0xc58/0x1690 mm/vmscan.c:3255 __perform_reclaim mm/page_alloc.c:3950 [inline] __alloc_pages_direct_reclaim mm/page_alloc.c:3972 [inline] __alloc_pages_slowpath mm/page_alloc.c:4365 [inline] __alloc_pages_nodemask+0x3078/0x5e30 mm/page_alloc.c:4579 alloc_pages_current+0x69d/0x9b0 mm/mempolicy.c:2106 alloc_pages include/linux/gfp.h:511 [inline] __get_free_pages+0x33/0xc0 mm/page_alloc.c:4607 pte_alloc_one_kernel+0x36/0x40 arch/x86/mm/pgtable.c:28 __pte_alloc_kernel+0x4f/0x300 mm/memory.c:440 vmap_pte_range mm/vmalloc.c:152 [inline] vmap_pmd_range mm/vmalloc.c:179 [inline] vmap_pud_range mm/vmalloc.c:196 [inline] vmap_p4d_range mm/vmalloc.c:213 [inline] __vmap_page_range_noflush+0xa38/0xeb0 mm/vmalloc.c:241 kmsan_vmap_page_range_noflush+0x16f/0x220 mm/kmsan/kmsan_hooks.c:364 vmap_page_range_noflush mm/vmalloc.c:253 [inline] vmap_page_range mm/vmalloc.c:262 [inline] vm_map_ram+0x1018/0x1290 mm/vmalloc.c:1200 ion_heap_clear_pages drivers/staging/android/ion/ion_heap.c:100 [inline] ion_heap_sglist_zero+0x258/0x4e0 drivers/staging/android/ion/ion_heap.c:121 ion_heap_buffer_zero+0x19f/0x1d0 drivers/staging/android/ion/ion_heap.c:143 ion_system_heap_free+0xe6/0x4d0 drivers/staging/android/ion/ion_system_heap.c:162 ion_buffer_destroy+0x187/0x4d0 drivers/staging/android/ion/ion.c:125 _ion_heap_freelist_drain+0x526/0x840 drivers/staging/android/ion/ion_heap.c:199 ion_heap_freelist_drain+0x6e/0x80 drivers/staging/android/ion/ion_heap.c:209 ion_buffer_create drivers/staging/android/ion/ion.c:85 [inline] ion_alloc+0x57f/0x1650 drivers/staging/android/ion/ion.c:420 ion_ioctl+0x326/0x5c0 drivers/staging/android/ion/ion-ioctl.c:76 do_vfs_ioctl+0xebd/0x2bf0 fs/ioctl.c:46 ksys_ioctl fs/ioctl.c:713 [inline] __do_sys_ioctl fs/ioctl.c:720 [inline] __se_sys_ioctl+0x1da/0x270 fs/ioctl.c:718 __x64_sys_ioctl+0x4a/0x70 fs/ioctl.c:718 do_syscall_64+0xbc/0xf0 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x63/0xe7 RIP: 0033:0x4412c9 Code: e8 ac e8 ff ff 48 83 c4 18 c3 0f 1f 80 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb 08 fc ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fffe4011158 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004412c9 RDX: 00000000200004c0 RSI: 00000000c0184900 RDI: 0000000000000003 RBP: 00000000000160f2 R08: 00000000004002c8 R09: 00000000004002c8 R10: 00000000fffffffa R11: 0000000000000246 R12: 0000000000402040 R13: 00000000004020d0 R14: 0000000000000000 R15: 0000000000000000 Modules linked in: ---[ end trace 702040f6d316e9d3 ]--- RIP: 0010:kmsan_free_page+0x13e/0x2f0 mm/kmsan/kmsan_hooks.c:259 Code: 66 90 66 2e 0f 1f 84 00 00 00 00 00 44 39 e8 0f 8d 45 01 00 00 48 63 c8 48 8d 0c 89 48 c1 e1 04 ff c0 48 83 7c 0b 40 00 74 e2 <0f> 0b 41 83 fe 1f 0f 84 24 01 00 00 49 63 c5 48 83 c3 40 31 c9 0f RSP: 0018:ffff88804c52e538 EFLAGS: 00010286 RAX: 0000000000000002 RBX: ffffea0008a66000 RCX: 0000000000000050 RDX: ffffffff8c626000 RSI: 0000000000000008 RDI: ffffea0008a66000 RBP: ffff88804c52e580 R08: 0000000000050601 R09: ffff88812fc39010 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000008 R13: 0000000000000100 R14: 0000000000000008 R15: ffffea0008a66000 FS: 0000000000feb880(0000) GS:ffff88812fc00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000004bf7a8 CR3: 00000000b56ca000 CR4: 00000000001406f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400