================================================================== BUG: KASAN: slab-out-of-bounds in seq_buf_putmem+0xc9/0x180 lib/seq_buf.c:241 Read of size 1383 at addr ffff88801c0ecbe8 by task syz.1.2884/16954 CPU: 0 UID: 0 PID: 16954 Comm: syz.1.2884 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x13d/0x4b0 mm/kasan/report.c:482 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595 check_region_inline mm/kasan/generic.c:186 [inline] kasan_check_range+0x10f/0x1e0 mm/kasan/generic.c:200 __asan_memcpy+0x23/0x60 mm/kasan/shadow.c:105 seq_buf_putmem+0xc9/0x180 lib/seq_buf.c:241 trace_seq_putmem kernel/trace/trace_seq.c:296 [inline] trace_seq_putmem+0x11e/0x230 kernel/trace/trace_seq.c:284 blk_trace_synthesize_old_trace kernel/trace/blktrace.c:1780 [inline] blk_trace_event_print_binary+0x13f/0x1b0 kernel/trace/blktrace.c:1788 print_bin_fmt kernel/trace/trace.c:3152 [inline] print_trace_line+0xc9a/0x1790 kernel/trace/trace.c:3229 tracing_read_pipe+0x586/0xd60 kernel/trace/trace.c:5446 vfs_read+0x1e4/0xb40 fs/read_write.c:572 ksys_read+0x12a/0x250 fs/read_write.c:716 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:79 [inline] __do_fast_syscall_32+0x13a/0x8b0 arch/x86/entry/syscall_32.c:291 do_fast_syscall_32+0x32/0x70 arch/x86/entry/syscall_32.c:316 entry_SYSENTER_compat_after_hwframe+0x84/0x8e RIP: 0023:0xf705efec Code: Unable to access opcode bytes at 0xf705efc2. RSP: 002b:00000000f542c50c EFLAGS: 00000292 ORIG_RAX: 0000000000000003 RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 0000000080001500 RDX: 00000000fffffe23 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1c0ec flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44100(__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 0, tgid 0 (swapper), ts 904858969 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1871 prep_new_page mm/page_alloc.c:1879 [inline] get_page_from_freelist+0x110d/0x35d0 mm/page_alloc.c:3943 __alloc_frozen_pages_noprof+0x2eb/0x3300 mm/page_alloc.c:5436 __alloc_pages_noprof mm/page_alloc.c:5471 [inline] alloc_pages_node_noprof+0x93/0x200 mm/page_alloc.c:5485 alloc_cpu_data+0x20/0x120 kernel/trace/ring_buffer.c:446 __rb_allocate_pages+0xb39/0xfc0 kernel/trace/ring_buffer.c:2517 rb_allocate_pages kernel/trace/ring_buffer.c:2550 [inline] rb_allocate_cpu_buffer+0x9db/0x2780 kernel/trace/ring_buffer.c:2648 alloc_buffer+0x66a/0x1690 kernel/trace/ring_buffer.c:2913 __ring_buffer_alloc+0x2d/0x40 kernel/trace/ring_buffer.c:2959 allocate_trace_buffer+0x150/0xa30 kernel/trace/trace.c:8465 allocate_trace_buffers kernel/trace/trace.c:8498 [inline] tracer_alloc_buffers kernel/trace/trace.c:9910 [inline] early_trace_init+0x22d/0x5c0 kernel/trace/trace.c:10009 start_kernel+0x1d3/0x490 init/main.c:1050 x86_64_start_reservations+0x24/0x30 arch/x86/kernel/head64.c:310 x86_64_start_kernel+0x12b/0x130 arch/x86/kernel/head64.c:291 common_startup_64+0x13e/0x158 page_owner free stack trace missing Memory state around the buggy address: ffff88801c0ecf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff88801c0ecf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff88801c0ed000: 00 00 06 fc fc fc fc fc 00 00 01 fc fc fc fc fc ^ ffff88801c0ed080: 00 00 07 fc fc fc fc fc 00 00 07 fc fc fc fc fc ffff88801c0ed100: 00 00 03 fc fc fc fc fc 00 00 05 fc fc fc fc fc ==================================================================