------------[ cut here ]------------ WARNING: CPU: 0 PID: 5188 at arch/x86/mm/tlb.c:515 switch_mm_irqs_off+0x890/0xbc0 arch/x86/mm/tlb.c:515 Modules linked in: CPU: 0 PID: 5188 Comm: udevd Not tainted 6.9.0-rc2-syzkaller-00080-gc85af715cac0 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 RIP: 0010:switch_mm_irqs_off+0x890/0xbc0 arch/x86/mm/tlb.c:515 Code: ff 44 8d 6b 02 48 63 d3 49 8d 8e 18 06 00 00 4d 63 ed 49 c1 e5 04 4d 8d 8d 80 d8 03 00 49 81 c5 88 d8 03 00 e9 75 fd ff ff 90 <0f> 0b 90 e9 e3 f7 ff ff 90 0f 0b 90 e8 df f5 ff ff e9 20 f8 ff ff RSP: 0018:ffffc9000319f260 EFLAGS: 00010202 RAX: 0000000000000292 RBX: ffff888023160000 RCX: ffff88801abd5f00 RDX: 1ffff1100357acba RSI: ffffffff8b8f5260 RDI: ffffffff8b8f52a0 RBP: ffff88801abd3900 R08: 0000000000000000 R09: ffffed100357abf9 R10: ffff88801abd5fcb R11: 0000000000000000 R12: ffff88806b03f500 R13: ffff888024d52440 R14: ffff88801abd5f00 R15: ffff88806b03ea40 FS: 00007f56c6794280(0000) GS:ffff88806b000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055558d1e0938 CR3: 000000001e8ac000 CR4: 0000000000350ef0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: context_switch kernel/sched/core.c:5393 [inline] __schedule+0xd2b/0x5d00 kernel/sched/core.c:6746 preempt_schedule_irq+0x51/0x90 kernel/sched/core.c:7068 irqentry_exit+0x36/0x90 kernel/entry/common.c:354 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:write_comp_data+0x7d/0x90 kernel/kcov.c:262 Code: 00 00 4a 8d 34 dd 28 00 00 00 48 39 f2 72 1b 48 83 c7 01 48 89 38 4c 89 44 30 e0 4c 89 4c 30 e8 4c 89 54 30 f0 4a 89 4c d8 20 cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 90 90 90 RSP: 0018:ffffc9000319f540 EFLAGS: 00000293 RAX: 0000000000000000 RBX: ffffc9000319f5a8 RCX: ffffffff813cef28 RDX: ffff888023168000 RSI: 0000000000000000 RDI: 0000000000000005 RBP: ffffc9000319f638 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000000 R11: dffffc0000000000 R12: 0000000000000000 R13: 0000000000000000 R14: ffffc9000319f5d0 R15: ffffc9000319f5c8 __unwind_start+0x4a8/0x880 arch/x86/kernel/unwind_orc.c:729 unwind_start arch/x86/include/asm/unwind.h:64 [inline] arch_stack_walk+0xb2/0x170 arch/x86/kernel/stacktrace.c:24 stack_trace_save+0x95/0xd0 kernel/stacktrace.c:122 save_stack+0x162/0x1f0 mm/page_owner.c:156 __reset_page_owner+0x88/0x370 mm/page_owner.c:247 reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1141 [inline] free_unref_page_prepare+0x527/0xb10 mm/page_alloc.c:2347 free_unref_page+0x33/0x3c0 mm/page_alloc.c:2487 __put_partials+0x14c/0x170 mm/slub.c:2906 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x4e/0x140 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:322 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook mm/slub.c:3798 [inline] slab_alloc_node mm/slub.c:3845 [inline] __do_kmalloc_node mm/slub.c:3965 [inline] __kmalloc+0x1bd/0x440 mm/slub.c:3979 kmalloc include/linux/slab.h:632 [inline] kzalloc include/linux/slab.h:749 [inline] tomoyo_encode2+0x100/0x3e0 security/tomoyo/realpath.c:45 tomoyo_encode+0x29/0x50 security/tomoyo/realpath.c:80 tomoyo_realpath_from_path+0x19d/0x720 security/tomoyo/realpath.c:283 tomoyo_get_realpath security/tomoyo/file.c:151 [inline] tomoyo_path_perm+0x273/0x450 security/tomoyo/file.c:822 security_inode_getattr+0xf4/0x160 security/security.c:2269 vfs_getattr fs/stat.c:173 [inline] vfs_fstat+0x53/0xd0 fs/stat.c:198 vfs_fstatat+0x134/0x150 fs/stat.c:300 __do_sys_newfstatat+0x98/0x120 fs/stat.c:468 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xd2/0x260 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x72/0x7a RIP: 0033:0x7f56c63165f4 Code: 64 c7 00 09 00 00 00 83 c8 ff c3 48 89 f2 b9 00 01 00 00 48 89 fe bf 9c ff ff ff e9 00 00 00 00 41 89 ca b8 06 01 00 00 0f 05 <45> 31 c0 3d 00 f0 ff ff 76 10 48 8b 15 03 a8 0d 00 f7 d8 41 83 c8 RSP: 002b:00007ffd634fdec8 EFLAGS: 00000206 ORIG_RAX: 0000000000000106 RAX: ffffffffffffffda RBX: 00007f56c63ee460 RCX: 00007f56c63165f4 RDX: 00007ffd634fded0 RSI: 00007f56c63b3130 RDI: 0000000000000009 RBP: 000056509e4f3b20 R08: 0000000000000000 R09: 0000000000000001 R10: 0000000000001000 R11: 0000000000000206 R12: 0000000000000002 R13: 0000000000000002 R14: 000056509e4f3b20 R15: 000056507d187ea6 ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: 4a 8d 34 dd 28 00 00 lea 0x28(,%r11,8),%rsi 9: 00 a: 48 39 f2 cmp %rsi,%rdx d: 72 1b jb 0x2a f: 48 83 c7 01 add $0x1,%rdi 13: 48 89 38 mov %rdi,(%rax) 16: 4c 89 44 30 e0 mov %r8,-0x20(%rax,%rsi,1) 1b: 4c 89 4c 30 e8 mov %r9,-0x18(%rax,%rsi,1) 20: 4c 89 54 30 f0 mov %r10,-0x10(%rax,%rsi,1) 25: 4a 89 4c d8 20 mov %rcx,0x20(%rax,%r11,8) * 2a: c3 ret <-- trapping instruction 2b: cc int3 2c: cc int3 2d: cc int3 2e: cc int3 2f: 66 66 2e 0f 1f 84 00 data16 cs nopw 0x0(%rax,%rax,1) 36: 00 00 00 00 3a: 0f 1f 00 nopl (%rax) 3d: 90 nop 3e: 90 nop 3f: 90 nop