================================================================== BUG: KASAN: stack-out-of-bounds in deref_stack_reg+0x1b8/0x1d0 Read of size 8 at addr ffff8801d467f4b8 by task syz-executor5/8788 CPU: 0 PID: 8788 Comm: syz-executor5 Not tainted 4.14.0-rc5-next-20171017+ #34 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: dump_stack+0x173/0x237 print_address_description+0x6e/0x250 kasan_report+0x251/0x340 deref_stack_reg+0x1b8/0x1d0 unwind_next_frame+0xebc/0x1df0 __save_stack_trace+0x6e/0xd0 save_stack+0x32/0xb0 kasan_slab_free+0x71/0xc0 kmem_cache_free+0x72/0x280 put_pid+0x16c/0x1e0 rcu_process_callbacks+0xcd4/0x1600 __do_softirq+0x2ba/0xafb irq_exit+0x1c7/0x200 smp_apic_timer_interrupt+0x154/0x6b0 apic_timer_interrupt+0x96/0xa0 RIP: 0010:lock_is_held_type+0x84/0x200 RSP: 0018:ffff8801d467efc0 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff11 RAX: dffffc0000000000 RBX: ffff8801c3d9e240 RCX: 0000000000000000 RDX: 1ffffffff0ad8f50 RSI: 00000000ffffffff RDI: ffffffff856c7a80 RBP: 1ffff1003a8cff02 R08: 1ffff1003a8cfde6 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000004 R12: ffffffff85737c60 R13: dffffc0000000000 R14: ffff8801c3d9e240 R15: 00000000fffff8f8 exit_sem+0x910/0x1c40 The buggy address belongs to the page: page:ffffea0007519fc0 count:0 mapcount:0 mapping: (null) index:0x0 flags: 0x200000000000000() raw: 0200000000000000 0000000000000000 0000000000000000 00000000ffffffff raw: 0000000000000000 0000000100000001 0000000000000000 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8801d467f380: f2 00 f2 f2 f2 f2 f2 f2 f2 00 f2 f2 f2 f2 f2 f2 ffff8801d467f400: f2 00 f2 f2 f2 f2 f2 f2 f2 00 f2 f2 f2 f2 f2 f2 >ffff8801d467f480: f2 f8 f8 f2 f2 f3 f3 f3 f3 00 00 00 00 00 00 00 ^ ffff8801d467f500: 00 00 00 00 00 00 f1 f1 f1 f1 04 f2 f2 f2 f2 f2 ffff8801d467f580: f2 f2 04 f2 f2 f2 f2 f2 f2 f2 00 f2 f2 f2 f2 f2 ==================================================================