================================================================== BUG: KASAN: stack-out-of-bounds in user_mode arch/x86/include/asm/ptrace.h:131 [inline] BUG: KASAN: stack-out-of-bounds in unwind_next_frame+0x10a0/0x1400 arch/x86/kernel/unwind_orc.c:410 UBIFS error (pid: 19325): cannot open "/dev/loop2", error -22 Read of size 8 at addr ffff8880502ff600 by task syz-executor.3/19322 CPU: 0 PID: 19322 Comm: syz-executor.3 Not tainted 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fc/0x2ef lib/dump_stack.c:118 print_address_description.cold+0x54/0x219 mm/kasan/report.c:256 kasan_report_error.cold+0x8a/0x1b9 mm/kasan/report.c:354 kasan_report mm/kasan/report.c:412 [inline] __asan_report_load8_noabort+0x88/0x90 mm/kasan/report.c:433 user_mode arch/x86/include/asm/ptrace.h:131 [inline] unwind_next_frame+0x10a0/0x1400 arch/x86/kernel/unwind_orc.c:410 __save_stack_trace+0x9f/0x190 arch/x86/kernel/stacktrace.c:44 save_stack mm/kasan/kasan.c:448 [inline] set_track mm/kasan/kasan.c:460 [inline] __kasan_slab_free+0x126/0x1f0 mm/kasan/kasan.c:521 __cache_free mm/slab.c:3503 [inline] kmem_cache_free+0x7f/0x260 mm/slab.c:3765 ext4_put_io_end_defer fs/ext4/page-io.c:266 [inline] ext4_put_io_end_defer+0xc3/0x3f0 fs/ext4/page-io.c:262 ext4_end_bio+0x171/0x600 fs/ext4/page-io.c:341 bio_endio+0x488/0x830 block/bio.c:1780 req_bio_endio block/blk-core.c:278 [inline] blk_update_request+0x30f/0xaf0 block/blk-core.c:3112 scsi_end_request+0x7d/0xb60 drivers/scsi/scsi_lib.c:673 scsi_io_completion+0x279/0x17c0 drivers/scsi/scsi_lib.c:1103 scsi_softirq_done+0x336/0x3d0 drivers/scsi/scsi_lib.c:1759 __blk_mq_complete_request block/blk-mq.c:583 [inline] blk_mq_complete_request+0x472/0x660 block/blk-mq.c:620 virtscsi_vq_done drivers/scsi/virtio_scsi.c:223 [inline] virtscsi_req_done+0x14b/0x210 drivers/scsi/virtio_scsi.c:238 vring_interrupt+0x12f/0x220 drivers/virtio/virtio_ring.c:953 __handle_irq_event_percpu+0x27e/0x8e0 kernel/irq/handle.c:149 handle_irq_event_percpu kernel/irq/handle.c:189 [inline] handle_irq_event+0x102/0x290 kernel/irq/handle.c:206 handle_edge_irq+0x260/0xcf0 kernel/irq/chip.c:800 generic_handle_irq_desc include/linux/irqdesc.h:155 [inline] handle_irq+0x35/0x50 arch/x86/kernel/irq_64.c:87 do_IRQ+0x93/0x1c0 arch/x86/kernel/irq.c:246 common_interrupt+0xf/0xf arch/x86/entry/entry_64.S:670 RIP: 0010:arch_local_save_flags arch/x86/include/asm/paravirt.h:784 [inline] RIP: 0010:arch_local_irq_save arch/x86/include/asm/paravirt.h:806 [inline] RIP: 0010:lock_acquire+0x97/0x3c0 kernel/locking/lockdep.c:3903 Code: 82 f1 89 48 ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 0f 85 eb 02 00 00 48 83 3d 50 2f a6 08 00 0f 84 75 02 00 00 9c <58> 0f 1f 44 00 00 48 ba 00 00 00 00 00 fc ff df 48 89 44 24 08 48 RSP: 0018:ffff8880502ff4f0 EFLAGS: 00000286 ORIG_RAX: ffffffffffffffd9 RAX: 1ffffffff13e3050 RBX: ffff8880abc7e2c0 RCX: 0000000000000000 RDX: dffffc0000000000 RSI: 0000000000000000 RDI: ffff8880abc7eb44 RBP: ffffffff8a070900 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000005 R11: 0000000059fda0e8 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000001 kernfs_activate+0x2c/0x1d0 fs/kernfs/dir.c:1258 retint_kernel+0x2d/0x2d RIP: 0010:kasan_mem_to_shadow include/linux/kasan.h:28 [inline] RIP: 0010:memory_is_poisoned_n mm/kasan/kasan.c:211 [inline] RIP: 0010:memory_is_poisoned mm/kasan/kasan.c:241 [inline] RIP: 0010:check_memory_region_inline mm/kasan/kasan.c:257 [inline] RIP: 0010:check_memory_region+0x38/0x170 mm/kasan/kasan.c:267 Code: ff ff 7f ff ff 44 0f b6 c2 48 39 c7 0f 86 20 01 00 00 4c 8d 54 37 ff 41 54 48 b8 00 00 00 00 00 fc ff df 4d 89 d1 55 48 89 fd <49> c1 e9 03 48 c1 ed 03 53 49 01 c1 48 01 c5 49 8d 59 01 48 89 e8 RSP: abc7e2c0:ffff8880502ff620 EFLAGS: 00000212 ORIG_RAX: ffffffffffffff13 RAX: dffffc0000000000 RBX: 0000000041b58ab3 RCX: ffffffff88187dba RDX: 0000000000000001 RSI: 0000000000000008 RDI: ffffffff8a0708a0 RBP: ffffffff81c4962c R08: 0000000000000001 R09: ffffffff8a0708a7 R10: ffffffff88188780 R11: ffffffff89b72700 R12: ffffffff8a070900 R13: ffff8880abc7e2c0 R14: ffff8880abc7e2c0 R15: 1ffff1100a05feb4 atomic64_cmpxchg include/asm-generic/atomic-instrumented.h:63 [inline] __mutex_unlock_slowpath+0xea/0x610 kernel/locking/mutex.c:1224 kernfs_add_one+0x36a/0x4c0 fs/kernfs/dir.c:811 __kernfs_create_file+0x293/0x340 fs/kernfs/file.c:1021 sysfs_add_file_mode_ns+0x226/0x540 fs/sysfs/file.c:307 create_files fs/sysfs/group.c:63 [inline] internal_create_group+0x355/0xb20 fs/sysfs/group.c:147 sysfs_create_group fs/sysfs/group.c:173 [inline] sysfs_create_groups fs/sysfs/group.c:200 [inline] sysfs_create_groups+0x98/0x140 fs/sysfs/group.c:190 device_add_groups drivers/base/core.c:1301 [inline] device_add_attrs drivers/base/core.c:1449 [inline] device_add+0x877/0x16d0 drivers/base/core.c:2139 netdev_register_kobject+0x181/0x430 net/core/net-sysfs.c:1806 register_netdevice+0xb46/0x10f0 net/core/dev.c:8730 register_vlan_dev+0x2f1/0x7d0 net/8021q/vlan.c:172 register_vlan_device net/8021q/vlan.c:273 [inline] vlan_ioctl_handler+0xaf9/0xf00 net/8021q/vlan.c:615 sock_ioctl+0x39e/0x5d0 net/socket.c:1113 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:501 [inline] do_vfs_ioctl+0xcdb/0x12e0 fs/ioctl.c:688 ksys_ioctl+0x9b/0xc0 fs/ioctl.c:705 __do_sys_ioctl fs/ioctl.c:712 [inline] __se_sys_ioctl fs/ioctl.c:710 [inline] __x64_sys_ioctl+0x6f/0xb0 fs/ioctl.c:710 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7fe242682109 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fe240fd6168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fe242795030 RCX: 00007fe242682109 RDX: 0000000020000040 RSI: 0000000000008982 RDI: 0000000000000007 RBP: 00007fe2426dc05d R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffd8ff19d6f R14: 00007fe240fd6300 R15: 0000000000022000 The buggy address belongs to the page: page:ffffea000140bfc0 count:0 mapcount:0 mapping:0000000000000000 index:0x0 flags: 0xfff00000000000() raw: 00fff00000000000 0000000000000000 ffffffff01400101 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880502ff500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880502ff580: 00 00 00 00 f1 f1 f1 f1 00 00 00 f2 00 00 00 f2 >ffff8880502ff600: f2 f2 00 00 00 00 00 f3 f3 f3 f3 f3 00 00 00 00 ^ ffff8880502ff680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880502ff700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ================================================================== ---------------- Code disassembly (best guess), 3 bytes skipped: 0: 48 ba 00 00 00 00 00 movabs $0xdffffc0000000000,%rdx 7: fc ff df a: 48 c1 e8 03 shr $0x3,%rax e: 80 3c 10 00 cmpb $0x0,(%rax,%rdx,1) 12: 0f 85 eb 02 00 00 jne 0x303 18: 48 83 3d 50 2f a6 08 cmpq $0x0,0x8a62f50(%rip) # 0x8a62f70 1f: 00 20: 0f 84 75 02 00 00 je 0x29b 26: 9c pushfq * 27: 58 pop %rax <-- trapping instruction 28: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1) 2d: 48 ba 00 00 00 00 00 movabs $0xdffffc0000000000,%rdx 34: fc ff df 37: 48 89 44 24 08 mov %rax,0x8(%rsp) 3c: 48 rex.W