==================================================================
BUG: KASAN: stack-out-of-bounds in instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
BUG: KASAN: stack-out-of-bounds in atomic_dec include/linux/atomic/atomic-instrumented.h:592 [inline]
BUG: KASAN: stack-out-of-bounds in put_bh include/linux/buffer_head.h:303 [inline]
BUG: KASAN: stack-out-of-bounds in end_buffer_read_sync+0x93/0xe0 fs/buffer.c:161
Write of size 4 at addr ffffc90003f7f890 by task kworker/u8:1/22071
CPU: 1 PID: 22071 Comm: kworker/u8:1 Not tainted 6.10.0-rc4-syzkaller-00301-g5f583a3162ff #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Workqueue: loop0 loop_workfn
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114
print_address_description mm/kasan/report.c:377 [inline]
print_report+0xc3/0x620 mm/kasan/report.c:488
kasan_report+0xd9/0x110 mm/kasan/report.c:601
check_region_inline mm/kasan/generic.c:183 [inline]
kasan_check_range+0xef/0x1a0 mm/kasan/generic.c:189
instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
atomic_dec include/linux/atomic/atomic-instrumented.h:592 [inline]
put_bh include/linux/buffer_head.h:303 [inline]
end_buffer_read_sync+0x93/0xe0 fs/buffer.c:161
end_bio_bh_io_sync+0xe5/0x140 fs/buffer.c:2779
bio_endio+0x644/0x760 block/bio.c:1636
blk_update_request+0x704/0x1850 block/blk-mq.c:929
blk_mq_end_request+0x5b/0x620 block/blk-mq.c:1057
lo_complete_rq+0x232/0x2f0 drivers/block/loop.c:389
blk_complete_reqs+0xae/0xf0 block/blk-mq.c:1132
handle_softirqs+0x216/0x8f0 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu kernel/softirq.c:637 [inline]
irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649
common_interrupt+0xb0/0xd0 arch/x86/kernel/irq.c:278
asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693
RIP: 0010:bytes_is_nonzero mm/kasan/generic.c:87 [inline]
RIP: 0010:memory_is_nonzero mm/kasan/generic.c:104 [inline]
RIP: 0010:memory_is_poisoned_n mm/kasan/generic.c:129 [inline]
RIP: 0010:memory_is_poisoned mm/kasan/generic.c:161 [inline]
RIP: 0010:check_region_inline mm/kasan/generic.c:180 [inline]
RIP: 0010:kasan_check_range+0x111/0x1a0 mm/kasan/generic.c:189
Code: 44 89 c2 e8 e1 ea ff ff 83 f0 01 5b 5d 41 5c c3 cc cc cc cc 48 85 d2 74 4f 48 01 ea eb 09 48 83 c0 01 48 39 d0 74 41 80 38 00 <74> f2 eb b2 41 bc 08 00 00 00 45 29 dc 49 8d 14 2c eb 0c 48 83 c0
RSP: 0000:ffffc9000363fca8 EFLAGS: 00000246
RAX: fffffbfff1fc887a RBX: fffffbfff1fc887b RCX: ffffffff8158547b
RDX: fffffbfff1fc887b RSI: 0000000000000008 RDI: ffffffff8fe443d0
RBP: fffffbfff1fc887a R08: 0000000000000000 R09: fffffbfff1fc887a
R10: ffffffff8fe443d7 R11: 0000000000000003 R12: 0000000000000001
R13: 000000000003d90c R14: 0000000000000000 R15: ffff888061544800
instrument_atomic_read include/linux/instrumented.h:68 [inline]
_test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]
cpumask_test_cpu include/linux/cpumask.h:571 [inline]
cpu_online include/linux/cpumask.h:1181 [inline]
trace_workqueue_execute_end include/trace/events/workqueue.h:110 [inline]
process_one_work+0xa6b/0x1b60 kernel/workqueue.c:3236
process_scheduled_works kernel/workqueue.c:3312 [inline]
worker_thread+0x6c8/0xf70 kernel/workqueue.c:3393
kthread+0x2c1/0x3a0 kernel/kthread.c:389
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
The buggy address belongs to the virtual mapping at
[ffffc90003f78000, ffffc90003f81000) created by:
kernel_clone+0xfd/0x980 kernel/fork.c:2797
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x49bc3
memcg:ffff88801b38f002
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff ffff88801b38f002
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x102dc2(GFP_HIGHUSER|__GFP_NOWARN|__GFP_ZERO), pid 22565, tgid 22565 (syz-executor.0), ts 2373073617794, free_ts 2363234651391
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1468
prep_new_page mm/page_alloc.c:1476 [inline]
get_page_from_freelist+0x136a/0x2e50 mm/page_alloc.c:3420
__alloc_pages_noprof+0x22b/0x2460 mm/page_alloc.c:4678
alloc_pages_mpol_noprof+0x275/0x610 mm/mempolicy.c:2265
vm_area_alloc_pages mm/vmalloc.c:3566 [inline]
__vmalloc_area_node mm/vmalloc.c:3642 [inline]
__vmalloc_node_range_noprof+0xa6a/0x1520 mm/vmalloc.c:3823
alloc_thread_stack_node kernel/fork.c:309 [inline]
dup_task_struct kernel/fork.c:1115 [inline]
copy_process+0x2f38/0x8f10 kernel/fork.c:2220
kernel_clone+0xfd/0x980 kernel/fork.c:2797
__do_sys_clone3+0x1f5/0x270 kernel/fork.c:3098
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 22531 tgid 22530 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1088 [inline]
free_unref_page+0x64a/0xe40 mm/page_alloc.c:2583
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x4e/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:322
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3941 [inline]
slab_alloc_node mm/slub.c:4001 [inline]
kmem_cache_alloc_lru_noprof+0x121/0x2f0 mm/slub.c:4020
sock_alloc_inode+0x25/0x1c0 net/socket.c:308
alloc_inode+0x5d/0x230 fs/inode.c:261
new_inode_pseudo+0x16/0x80 fs/inode.c:1007
sock_alloc+0x40/0x280 net/socket.c:634
__sock_create+0xc0/0x800 net/socket.c:1535
sock_create net/socket.c:1622 [inline]
__sys_socket_create net/socket.c:1659 [inline]
__sys_socket+0x14f/0x260 net/socket.c:1706
__do_sys_socket net/socket.c:1720 [inline]
__se_sys_socket net/socket.c:1718 [inline]
__x64_sys_socket+0x72/0xb0 net/socket.c:1718
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffffc90003f7f780: f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00
ffffc90003f7f800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffc90003f7f880: 00 00 f1 f1 f1 f1 f1 f1 01 f2 00 f2 f2 f2 00 00
^
ffffc90003f7f900: 00 00 00 00 00 f3 f3 f3 f3 f3 00 00 00 00 00 00
ffffc90003f7f980: 00 00 00 00 00 f1 f1 f1 f1 00 f3 f3 f3 00 00 00
==================================================================
----------------
Code disassembly (best guess):
0: 44 89 c2 mov %r8d,%edx
3: e8 e1 ea ff ff call 0xffffeae9
8: 83 f0 01 xor $0x1,%eax
b: 5b pop %rbx
c: 5d pop %rbp
d: 41 5c pop %r12
f: c3 ret
10: cc int3
11: cc int3
12: cc int3
13: cc int3
14: 48 85 d2 test %rdx,%rdx
17: 74 4f je 0x68
19: 48 01 ea add %rbp,%rdx
1c: eb 09 jmp 0x27
1e: 48 83 c0 01 add $0x1,%rax
22: 48 39 d0 cmp %rdx,%rax
25: 74 41 je 0x68
27: 80 38 00 cmpb $0x0,(%rax)
* 2a: 74 f2 je 0x1e <-- trapping instruction
2c: eb b2 jmp 0xffffffe0
2e: 41 bc 08 00 00 00 mov $0x8,%r12d
34: 45 29 dc sub %r11d,%r12d
37: 49 8d 14 2c lea (%r12,%rbp,1),%rdx
3b: eb 0c jmp 0x49
3d: 48 rex.W
3e: 83 .byte 0x83
3f: c0 .byte 0xc0