BUG: TASK stack guard page was hit at ffffc90006ec7f08 (stack is ffffc90006ec8000..ffffc90006ed0000) Oops: stack guard page: 0000 [#1] PREEMPT SMP KASAN NOPTI CPU: 1 UID: 0 PID: 6721 Comm: syz.2.198 Not tainted 6.13.0-rc7-syzkaller-00149-g9bffa1ad25b8 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:mark_lock+0x25/0xc60 kernel/locking/lockdep.c:4710 Code: 90 90 90 90 90 55 48 89 e5 41 57 41 56 41 89 d6 48 ba 00 00 00 00 00 fc ff df 41 55 41 54 53 48 83 e4 f0 48 81 ec 10 01 00 00 <48> c7 44 24 30 b3 8a b5 41 48 8d 44 24 30 48 c7 44 24 38 30 4d 7b RSP: 0018:ffffc90006ec7f10 EFLAGS: 00010082 RAX: 000000000000000c RBX: ffff88804fb00b2a RCX: 0000000000000004 RDX: dffffc0000000000 RSI: ffff88804fb00b08 RDI: ffff88804fb00000 RBP: ffffc90006ec8050 R08: 0000000000000000 R09: 0000000000000001 R10: ffffffff96e53e07 R11: 000000000001465f R12: ffffed1009f6015b R13: ffff88804fb00000 R14: 0000000000000008 R15: ffff88804fb00b08 FS: 00007f93e5bb46c0(0000) GS:ffff88806a700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc90006ec7f08 CR3: 000000004e758000 CR4: 0000000000352ef0 Call Trace: <#DF> mark_usage kernel/locking/lockdep.c:4670 [inline] __lock_acquire+0x9f1/0x3c40 kernel/locking/lockdep.c:5180 lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5849 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162 stack_depot_save_flags+0x367/0x9c0 lib/stackdepot.c:640 kasan_save_stack+0x42/0x60 mm/kasan/common.c:48 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394 kmalloc_noprof include/linux/slab.h:901 [inline] add_stack_record_to_list mm/page_owner.c:172 [inline] inc_stack_record_count mm/page_owner.c:214 [inline] __set_page_owner+0x34d/0x560 mm/page_owner.c:329 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1558 prep_new_page mm/page_alloc.c:1566 [inline] get_page_from_freelist+0xfce/0x2f80 mm/page_alloc.c:3476 __alloc_pages_noprof+0x223/0x25b0 mm/page_alloc.c:4753 alloc_pages_mpol_noprof+0x2c8/0x620 mm/mempolicy.c:2269 alloc_slab_page mm/slub.c:2423 [inline] allocate_slab mm/slub.c:2589 [inline] new_slab+0x2c9/0x410 mm/slub.c:2642 ___slab_alloc+0xd7d/0x17a0 mm/slub.c:3830 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3920 __slab_alloc_node mm/slub.c:3995 [inline] slab_alloc_node mm/slub.c:4156 [inline] kmem_cache_alloc_noprof+0xfa/0x3d0 mm/slub.c:4175 p9_tag_alloc+0x9c/0x870 net/9p/client.c:281 p9_client_prepare_req+0x19f/0x4d0 net/9p/client.c:644 p9_client_rpc+0x1c3/0xc10 net/9p/client.c:691 p9_client_read_once+0x24f/0x820 net/9p/client.c:1575 p9_client_read+0x13f/0x1b0 net/9p/client.c:1534 v9fs_issue_read+0x115/0x340 fs/9p/vfs_addr.c:76 netfs_retry_read_subrequests fs/netfs/read_retry.c:62 [inline] netfs_retry_reads+0x1512/0x1d40 fs/netfs/read_retry.c:235 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_retry_reads+0x15a4/0x1d40 fs/netfs/read_retry.c:238 netfs_rreq_assess+0x5d3/0x870 fs/netfs/read_collect.c:374 netfs_rreq_terminated+0xe5/0x110 fs/netfs/read_collect.c:409 netfs_dispatch_unbuffered_reads fs/netfs/direct_read.c:103 [inline] netfs_unbuffered_read fs/netfs/direct_read.c:127 [inline] netfs_unbuffered_read_iter_locked+0x12e1/0x19a0 fs/netfs/direct_read.c:221 netfs_unbuffered_read_iter+0xc5/0x100 fs/netfs/direct_read.c:256 v9fs_file_read_iter+0xbf/0x100 fs/9p/vfs_file.c:361 new_sync_read fs/read_write.c:484 [inline] vfs_read+0x87f/0xbe0 fs/read_write.c:565 ksys_pread64 fs/read_write.c:756 [inline] __do_sys_pread64 fs/read_write.c:764 [inline] __se_sys_pread64 fs/read_write.c:761 [inline] __x64_sys_pread64+0x1f6/0x250 fs/read_write.c:761 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f93e4d85d29 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f93e5bb4038 EFLAGS: 00000246 ORIG_RAX: 0000000000000011 RAX: ffffffffffffffda RBX: 00007f93e4f75fa0 RCX: 00007f93e4d85d29 RDX: 0000000000000099 RSI: 0000000020000200 RDI: 0000000000000003 RBP: 00007f93e4e01b08 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000b35 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f93e4f75fa0 R15: 00007fffe9dd6cb8 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:mark_lock+0x25/0xc60 kernel/locking/lockdep.c:4710 Code: 90 90 90 90 90 55 48 89 e5 41 57 41 56 41 89 d6 48 ba 00 00 00 00 00 fc ff df 41 55 41 54 53 48 83 e4 f0 48 81 ec 10 01 00 00 <48> c7 44 24 30 b3 8a b5 41 48 8d 44 24 30 48 c7 44 24 38 30 4d 7b RSP: 0018:ffffc90006ec7f10 EFLAGS: 00010082 RAX: 000000000000000c RBX: ffff88804fb00b2a RCX: 0000000000000004 RDX: dffffc0000000000 RSI: ffff88804fb00b08 RDI: ffff88804fb00000 RBP: ffffc90006ec8050 R08: 0000000000000000 R09: 0000000000000001 R10: ffffffff96e53e07 R11: 000000000001465f R12: ffffed1009f6015b R13: ffff88804fb00000 R14: 0000000000000008 R15: ffff88804fb00b08 FS: 00007f93e5bb46c0(0000) GS:ffff88806a700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffc90006ec7f08 CR3: 000000004e758000 CR4: 0000000000352ef0 ---------------- Code disassembly (best guess): 0: 90 nop 1: 90 nop 2: 90 nop 3: 90 nop 4: 90 nop 5: 55 push %rbp 6: 48 89 e5 mov %rsp,%rbp 9: 41 57 push %r15 b: 41 56 push %r14 d: 41 89 d6 mov %edx,%r14d 10: 48 ba 00 00 00 00 00 movabs $0xdffffc0000000000,%rdx 17: fc ff df 1a: 41 55 push %r13 1c: 41 54 push %r12 1e: 53 push %rbx 1f: 48 83 e4 f0 and $0xfffffffffffffff0,%rsp 23: 48 81 ec 10 01 00 00 sub $0x110,%rsp * 2a: 48 c7 44 24 30 b3 8a movq $0x41b58ab3,0x30(%rsp) <-- trapping instruction 31: b5 41 33: 48 8d 44 24 30 lea 0x30(%rsp),%rax 38: 48 rex.W 39: c7 .byte 0xc7 3a: 44 24 38 rex.R and $0x38,%al 3d: 30 4d 7b xor %cl,0x7b(%rbp)