================================================================== BUG: KASAN: stack-out-of-bounds in folio_batch_add include/linux/pagevec.h:130 [inline] BUG: KASAN: stack-out-of-bounds in check_move_unevictable_pages+0x3f6/0x440 mm/vmscan.c:4857 BUG: KASAN: stack-out-of-bounds in folio_batch_add include/linux/pagevec.h:130 [inline] BUG: KASAN: stack-out-of-bounds in check_move_unevictable_pages+0x3f6/0x440 mm/vmscan.c:4857 Write of size 8 at addr ffffc900079a7818 by task syz-executor.1/13136 CPU: 1 PID: 13136 Comm: syz-executor.1 Not tainted 5.19.0-rc1-next-20220607-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0xf/0x495 mm/kasan/report.c:313 print_report mm/kasan/report.c:429 [inline] kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491 folio_batch_add include/linux/pagevec.h:130 [inline] check_move_unevictable_pages+0x3f6/0x440 mm/vmscan.c:4857 drm_gem_check_release_pagevec drivers/gpu/drm/drm_gem.c:511 [inline] drm_gem_put_pages+0x29f/0x3f0 drivers/gpu/drm/drm_gem.c:639 drm_gem_shmem_put_pages_locked+0x13e/0x230 drivers/gpu/drm/drm_gem_shmem_helper.c:237 drm_gem_shmem_put_pages drivers/gpu/drm/drm_gem_shmem_helper.c:252 [inline] drm_gem_shmem_vm_close+0x45/0x70 drivers/gpu/drm/drm_gem_shmem_helper.c:588 remove_vma+0x81/0x130 mm/mmap.c:187 remove_mt mm/mmap.c:2229 [inline] do_mas_align_munmap+0x824/0xf00 mm/mmap.c:2501 do_mas_munmap+0x202/0x2c0 mm/mmap.c:2556 mmap_region+0x219/0x1bf0 mm/mmap.c:2604 do_mmap+0x825/0xf60 mm/mmap.c:1480 vm_mmap_pgoff+0x1b7/0x290 mm/util.c:520 ksys_mmap_pgoff+0x40d/0x5a0 mm/mmap.c:1526 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 RIP: 0033:0x7ff873a89152 Code: 00 00 00 00 00 0f 1f 00 41 f7 c1 ff 0f 00 00 75 27 55 48 89 fd 53 89 cb 48 85 ff 74 3b 41 89 da 48 89 ef b8 09 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 66 5b 5d c3 0f 1f 00 48 c7 c0 b8 ff ff ff 64 RSP: 002b:00007ff874c170d8 EFLAGS: 00000206 ORIG_RAX: 0000000000000009 RAX: ffffffffffffffda RBX: 0000000000008011 RCX: 00007ff873a89152 RDX: 0000000000000003 RSI: 0000000000090140 RDI: 0000000020ffb000 RBP: 0000000020ffb000 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000008011 R11: 0000000000000206 R12: 0000000020000140 R13: 0000000020ffc000 R14: 00000000200000c0 R15: 0000000020ffb000 The buggy address belongs to stack of task syz-executor.1/13136 and is located at offset 160 in frame: check_move_unevictable_pages+0x0/0x440 arch/x86/include/asm/bitops.h:207 This frame has 1 object: [32, 160) 'fbatch' The buggy address belongs to the virtual mapping at [ffffc900079a0000, ffffc900079a9000) created by: kernel_clone+0xe7/0xab0 kernel/fork.c:2648 The buggy address belongs to the physical page: page:ffffea000091bc80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x246f2 memcg:ffff888016972902 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff ffff888016972902 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x102dc2(GFP_HIGHUSER|__GFP_NOWARN|__GFP_ZERO), pid 13127, tgid 13127 (syz-executor.1), ts 713383870300, free_ts 712645631689 prep_new_page mm/page_alloc.c:2460 [inline] get_page_from_freelist+0xa64/0x3d10 mm/page_alloc.c:4279 __alloc_pages+0x1c7/0x510 mm/page_alloc.c:5503 alloc_pages+0x1aa/0x310 mm/mempolicy.c:2279 vm_area_alloc_pages mm/vmalloc.c:2926 [inline] __vmalloc_area_node mm/vmalloc.c:2994 [inline] __vmalloc_node_range+0x735/0x13b0 mm/vmalloc.c:3164 alloc_thread_stack_node kernel/fork.c:311 [inline] dup_task_struct kernel/fork.c:971 [inline] copy_process+0x1568/0x7010 kernel/fork.c:2064 kernel_clone+0xe7/0xab0 kernel/fork.c:2648 __do_sys_clone+0xba/0x100 kernel/fork.c:2782 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1375 [inline] free_pcp_prepare+0x549/0xd20 mm/page_alloc.c:1425 free_unref_page_prepare mm/page_alloc.c:3311 [inline] free_unref_page_list+0x184/0x1530 mm/page_alloc.c:3475 release_pages+0xff1/0x2290 mm/swap.c:980 tlb_batch_pages_flush+0xa8/0x1a0 mm/mmu_gather.c:58 tlb_flush_mmu_free mm/mmu_gather.c:255 [inline] tlb_flush_mmu mm/mmu_gather.c:262 [inline] tlb_finish_mmu+0x147/0x7e0 mm/mmu_gather.c:353 exit_mmap+0x217/0x750 mm/mmap.c:3205 __mmput+0x128/0x4c0 kernel/fork.c:1180 mmput+0x5c/0x70 kernel/fork.c:1201 exec_mmap fs/exec.c:1038 [inline] begin_new_exec+0xfbd/0x2e50 fs/exec.c:1297 load_elf_binary+0x15a3/0x4ec0 fs/binfmt_elf.c:1002 search_binary_handler fs/exec.c:1728 [inline] exec_binprm fs/exec.c:1769 [inline] bprm_execve fs/exec.c:1838 [inline] bprm_execve+0x7ef/0x1970 fs/exec.c:1800 do_execveat_common+0x724/0x890 fs/exec.c:1943 do_execve fs/exec.c:2017 [inline] __do_sys_execve fs/exec.c:2093 [inline] __se_sys_execve fs/exec.c:2088 [inline] __x64_sys_execve+0x8f/0xc0 fs/exec.c:2088 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x46/0xb0 Memory state around the buggy address: ffffc900079a7700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 ffffc900079a7780: f1 f1 f1 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffc900079a7800: 00 00 00 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 ^ ffffc900079a7880: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 ffffc900079a7900: 00 00 00 00 00 00 00 00 00 00 00 00 f3 f3 f3 f3 ==================================================================