================================================================== BUG: KASAN: slab-out-of-bounds in cleancache_fs_enabled_mapping include/linux/cleancache.h:54 [inline] BUG: KASAN: slab-out-of-bounds in cleancache_invalidate_page include/linux/cleancache.h:108 [inline] BUG: KASAN: slab-out-of-bounds in unaccount_page_cache_page+0x6e6/0x750 mm/filemap.c:169 Read of size 4 at addr ffff8881afb27488 by task syz-executor.4/15477 CPU: 1 PID: 15477 Comm: syz-executor.4 Not tainted 5.4.233-syzkaller-00004-gdd94985a9b62 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1d8/0x241 lib/dump_stack.c:118 print_address_description+0x8c/0x600 mm/kasan/report.c:384 __kasan_report+0xf3/0x120 mm/kasan/report.c:516 kasan_report+0x30/0x60 mm/kasan/common.c:653 cleancache_fs_enabled_mapping include/linux/cleancache.h:54 [inline] cleancache_invalidate_page include/linux/cleancache.h:108 [inline] unaccount_page_cache_page+0x6e6/0x750 mm/filemap.c:169 __delete_from_page_cache+0xd0/0x600 mm/filemap.c:237 __remove_mapping+0x4a2/0x590 mm/vmscan.c:978 shrink_page_list+0x22f9/0x42c0 mm/vmscan.c:1482 shrink_inactive_list+0x533/0xfe0 mm/vmscan.c:2001 shrink_list mm/vmscan.c:2293 [inline] shrink_node_memcg+0xc42/0x2430 mm/vmscan.c:2623 shrink_node+0x389/0x14a0 mm/vmscan.c:2836 shrink_zones mm/vmscan.c:3053 [inline] do_try_to_free_pages+0x63f/0x12b0 mm/vmscan.c:3111 try_to_free_mem_cgroup_pages+0x3f6/0x9b0 mm/vmscan.c:3412 memory_max_write+0x23a/0x440 mm/memcontrol.c:6220 cgroup_file_write+0x275/0x5f0 kernel/cgroup/cgroup.c:3898 kernfs_fop_write+0x2e2/0x3e0 fs/kernfs/file.c:315 __vfs_write+0x103/0x750 fs/read_write.c:494 vfs_write+0x206/0x4e0 fs/read_write.c:558 ksys_write+0x199/0x2c0 fs/read_write.c:611 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x5c/0xc1 Allocated by task 354: save_stack mm/kasan/common.c:70 [inline] set_track mm/kasan/common.c:78 [inline] __kasan_kmalloc+0x171/0x210 mm/kasan/common.c:529 slab_post_alloc_hook mm/slab.h:584 [inline] slab_alloc_node mm/slub.c:2829 [inline] slab_alloc mm/slub.c:2837 [inline] __kmalloc_track_caller+0x100/0x2b0 mm/slub.c:4449 __kmalloc_reserve net/core/skbuff.c:142 [inline] __alloc_skb+0xb4/0x4d0 net/core/skbuff.c:210 alloc_skb_fclone include/linux/skbuff.h:1129 [inline] sk_stream_alloc_skb+0x1f4/0xa70 net/ipv4/tcp.c:888 tcp_sendmsg_locked+0xe07/0x3810 net/ipv4/tcp.c:1297 tcp_sendmsg+0x2c/0x40 net/ipv4/tcp.c:1447 sock_sendmsg_nosec net/socket.c:638 [inline] sock_sendmsg net/socket.c:658 [inline] sock_write_iter+0x344/0x470 net/socket.c:990 call_write_iter include/linux/fs.h:1981 [inline] new_sync_write fs/read_write.c:483 [inline] __vfs_write+0x5d3/0x750 fs/read_write.c:496 vfs_write+0x206/0x4e0 fs/read_write.c:558 ksys_write+0x199/0x2c0 fs/read_write.c:611 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x5c/0xc1 Freed by task 15369: save_stack mm/kasan/common.c:70 [inline] set_track mm/kasan/common.c:78 [inline] kasan_set_free_info mm/kasan/common.c:345 [inline] __kasan_slab_free+0x1b5/0x270 mm/kasan/common.c:487 slab_free_hook mm/slub.c:1455 [inline] slab_free_freelist_hook mm/slub.c:1494 [inline] slab_free mm/slub.c:3080 [inline] kfree+0x123/0x370 mm/slub.c:4071 skb_release_all net/core/skbuff.c:675 [inline] __kfree_skb+0x4c/0x60 net/core/skbuff.c:689 tcp_clean_rtx_queue net/ipv4/tcp_input.c:3193 [inline] tcp_ack+0x2041/0x6060 net/ipv4/tcp_input.c:3734 tcp_rcv_established+0xd16/0x1a80 net/ipv4/tcp_input.c:5692 tcp_v4_do_rcv+0x3a9/0x770 net/ipv4/tcp_ipv4.c:1589 tcp_v4_rcv+0x219a/0x26f0 net/ipv4/tcp_ipv4.c:1971 ip_protocol_deliver_rcu+0x2e0/0x630 net/ipv4/ip_input.c:204 ip_local_deliver_finish net/ipv4/ip_input.c:231 [inline] NF_HOOK include/linux/netfilter.h:308 [inline] ip_local_deliver+0x2c6/0x5a0 net/ipv4/ip_input.c:252 dst_input include/net/dst.h:450 [inline] ip_sublist_rcv_finish net/ipv4/ip_input.c:541 [inline] ip_list_rcv_finish net/ipv4/ip_input.c:579 [inline] ip_sublist_rcv+0xc02/0xc80 net/ipv4/ip_input.c:587 ip_list_rcv+0x477/0x4c0 net/ipv4/ip_input.c:621 __netif_receive_skb_list_ptype net/core/dev.c:5001 [inline] __netif_receive_skb_list_core+0x6dd/0x8f0 net/core/dev.c:5049 __netif_receive_skb_list net/core/dev.c:5101 [inline] netif_receive_skb_list_internal+0x944/0xc90 net/core/dev.c:5196 gro_normal_list net/core/dev.c:5307 [inline] napi_complete_done+0x20a/0x580 net/core/dev.c:6038 virtqueue_napi_complete drivers/net/virtio_net.c:357 [inline] virtnet_poll+0xb61/0x1250 drivers/net/virtio_net.c:1512 napi_poll net/core/dev.c:6353 [inline] net_rx_action+0x53f/0x1160 net/core/dev.c:6421 __do_softirq+0x23b/0x6b7 kernel/softirq.c:292 The buggy address belongs to the object at ffff8881afb27000 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 136 bytes to the right of 1024-byte region [ffff8881afb27000, ffff8881afb27400) The buggy address belongs to the page: page:ffffea0006bec800 refcount:1 mapcount:0 mapping:ffff8881f5c02280 index:0x0 compound_mapcount: 0 flags: 0x8000000000010200(slab|head) raw: 8000000000010200 dead000000000100 dead000000000122 ffff8881f5c02280 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL) set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook mm/page_alloc.c:2165 [inline] prep_new_page+0x18f/0x370 mm/page_alloc.c:2171 get_page_from_freelist+0x2d13/0x2d90 mm/page_alloc.c:3794 __alloc_pages_nodemask+0x393/0x840 mm/page_alloc.c:4891 alloc_slab_page+0x39/0x3c0 mm/slub.c:343 allocate_slab mm/slub.c:1683 [inline] new_slab+0x97/0x440 mm/slub.c:1749 new_slab_objects mm/slub.c:2505 [inline] ___slab_alloc+0x2fe/0x490 mm/slub.c:2667 __slab_alloc+0x62/0xa0 mm/slub.c:2707 slab_alloc_node mm/slub.c:2792 [inline] slab_alloc mm/slub.c:2837 [inline] __kmalloc_track_caller+0x16d/0x2b0 mm/slub.c:4449 __kmalloc_reserve net/core/skbuff.c:142 [inline] __alloc_skb+0xb4/0x4d0 net/core/skbuff.c:210 alloc_skb include/linux/skbuff.h:1079 [inline] __tcp_send_ack+0x9c/0x590 net/ipv4/tcp_output.c:3725 tcp_rcv_established+0x11b8/0x1a80 net/ipv4/tcp_input.c:5744 tcp_v4_do_rcv+0x3a9/0x770 net/ipv4/tcp_ipv4.c:1589 sk_backlog_rcv include/net/sock.h:982 [inline] __release_sock+0x14f/0x3e0 net/core/sock.c:2454 release_sock+0x5d/0x1a0 net/core/sock.c:2993 tcp_recvmsg+0x21c6/0x35b0 net/ipv4/tcp.c:2198 inet_recvmsg+0x158/0x510 net/ipv4/af_inet.c:842 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1176 [inline] __free_pages_ok+0x847/0x950 mm/page_alloc.c:1438 put_page include/linux/mm.h:1151 [inline] __skb_frag_unref include/linux/skbuff.h:3045 [inline] skb_release_data+0x210/0x640 net/core/skbuff.c:615 skb_release_all net/core/skbuff.c:675 [inline] __kfree_skb+0x4c/0x60 net/core/skbuff.c:689 sk_eat_skb include/net/sock.h:2523 [inline] tcp_recvmsg+0x174c/0x35b0 net/ipv4/tcp.c:2180 inet_recvmsg+0x158/0x510 net/ipv4/af_inet.c:842 ____sys_recvmsg net/socket.c:2519 [inline] ___sys_recvmsg+0x6a7/0xa60 net/socket.c:2560 __sys_recvmsg net/socket.c:2607 [inline] __do_sys_recvmsg net/socket.c:2617 [inline] __se_sys_recvmsg net/socket.c:2614 [inline] __x64_sys_recvmsg+0x1f4/0x2c0 net/socket.c:2614 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x5c/0xc1 Memory state around the buggy address: ffff8881afb27380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8881afb27400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff8881afb27480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff8881afb27500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8881afb27580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== syz-executor.4 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 CPU: 1 PID: 15477 Comm: syz-executor.4 Tainted: G B 5.4.233-syzkaller-00004-gdd94985a9b62 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1d8/0x241 lib/dump_stack.c:118 dump_header+0xd5/0x6b0 mm/oom_kill.c:460 oom_kill_process+0xeb/0x2c0 mm/oom_kill.c:974 out_of_memory+0x5e1/0x890 mm/oom_kill.c:1111 mem_cgroup_out_of_memory+0x211/0x270 mm/memcontrol.c:1611 memory_max_write+0x329/0x440 mm/memcontrol.c:6227 cgroup_file_write+0x275/0x5f0 kernel/cgroup/cgroup.c:3898 kernfs_fop_write+0x2e2/0x3e0 fs/kernfs/file.c:315 __vfs_write+0x103/0x750 fs/read_write.c:494 vfs_write+0x206/0x4e0 fs/read_write.c:558 ksys_write+0x199/0x2c0 fs/read_write.c:611 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x5c/0xc1 memory: usage 23060kB, limit 0kB, failcnt 0 swap: usage 0kB, limit 9007199254740988kB, failcnt 0 Memory cgroup stats for /syz0: anon 13062144 file 10539008 kernel_stack 0 slab 0 sock 102400 shmem 10612736 file_mapped 0 file_dirty 0 file_writeback 0 anon_thp 0 inactive_anon 135168 active_anon 23654400 inactive_file 135168 active_file 110592 unevictable 0 slab_reclaimable 0 slab_unreclaimable 0 pgfault 645216 pgmajfault 0 workingset_refault 0 workingset_activate 0 workingset_nodereclaim 0 pgrefill 80 pgscan 80 pgsteal 37 pgactivate 33 oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz4,mems_allowed=0,oom_memcg=/syz0,task_memcg=/syz0,task=syz-executor.0,pid=15246,uid=0 Memory cgroup out of memory: Killed process 15246 (syz-executor.0) total-vm:55196kB, anon-rss:4652kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:100kB oom_score_adj:1000 syz-executor.4 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 CPU: 1 PID: 15477 Comm: syz-executor.4 Tainted: G B 5.4.233-syzkaller-00004-gdd94985a9b62 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1d8/0x241 lib/dump_stack.c:118 dump_header+0xd5/0x6b0 mm/oom_kill.c:460 oom_kill_process+0xeb/0x2c0 mm/oom_kill.c:974 out_of_memory+0x5e1/0x890 mm/oom_kill.c:1111 mem_cgroup_out_of_memory+0x211/0x270 mm/memcontrol.c:1611 memory_max_write+0x329/0x440 mm/memcontrol.c:6227 cgroup_file_write+0x275/0x5f0 kernel/cgroup/cgroup.c:3898 kernfs_fop_write+0x2e2/0x3e0 fs/kernfs/file.c:315 __vfs_write+0x103/0x750 fs/read_write.c:494 vfs_write+0x206/0x4e0 fs/read_write.c:558 ksys_write+0x199/0x2c0 fs/read_write.c:611 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x5c/0xc1 memory: usage 18816kB, limit 0kB, failcnt 0 swap: usage 0kB, limit 9007199254740988kB, failcnt 0 Memory cgroup stats for /syz0: anon 8704000 file 10539008 kernel_stack 0 slab 0 sock 102400 shmem 10612736 file_mapped 0 file_dirty 0 file_writeback 0 anon_thp 0 inactive_anon 135168 active_anon 19329024 inactive_file 135168 active_file 110592 unevictable 0 slab_reclaimable 0 slab_unreclaimable 0 pgfault 645216 pgmajfault 0 workingset_refault 0 workingset_activate 0 workingset_nodereclaim 0 pgrefill 80 pgscan 80 pgsteal 37 pgactivate 33 oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz4,mems_allowed=0,oom_memcg=/syz0,task_memcg=/syz0,task=syz-executor.0,pid=15207,uid=0 Memory cgroup out of memory: Killed process 15207 (syz-executor.0) total-vm:55064kB, anon-rss:4648kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:100kB oom_score_adj:1000 syz-executor.4 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 CPU: 1 PID: 15477 Comm: syz-executor.4 Tainted: G B 5.4.233-syzkaller-00004-gdd94985a9b62 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1d8/0x241 lib/dump_stack.c:118 dump_header+0xd5/0x6b0 mm/oom_kill.c:460 oom_kill_process+0xeb/0x2c0 mm/oom_kill.c:974 out_of_memory+0x5e1/0x890 mm/oom_kill.c:1111 mem_cgroup_out_of_memory+0x211/0x270 mm/memcontrol.c:1611 memory_max_write+0x329/0x440 mm/memcontrol.c:6227 cgroup_file_write+0x275/0x5f0 kernel/cgroup/cgroup.c:3898 kernfs_fop_write+0x2e2/0x3e0 fs/kernfs/file.c:315 __vfs_write+0x103/0x750 fs/read_write.c:494 vfs_write+0x206/0x4e0 fs/read_write.c:558 ksys_write+0x199/0x2c0 fs/read_write.c:611 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x5c/0xc1 memory: usage 14576kB, limit 0kB, failcnt 0 swap: usage 0kB, limit 9007199254740988kB, failcnt 0 Memory cgroup stats for /syz0: anon 4591616 file 10539008 kernel_stack 0 slab 0 sock 102400 shmem 10612736 file_mapped 0 file_dirty 0 file_writeback 0 anon_thp 0 inactive_anon 135168 active_anon 15003648 inactive_file 135168 active_file 110592 unevictable 0 slab_reclaimable 0 slab_unreclaimable 0 pgfault 645216 pgmajfault 0 workingset_refault 0 workingset_activate 0 workingset_nodereclaim 0 pgrefill 80 pgscan 80 pgsteal 37 pgactivate 33 oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz4,mems_allowed=0,oom_memcg=/syz0,task_memcg=/syz0,task=syz-executor.0,pid=15275,uid=0 Memory cgroup out of memory: Killed process 15275 (syz-executor.0) total-vm:54800kB, anon-rss:4640kB, file-rss:14336kB, shmem-rss:0kB, UID:0 pgtables:100kB oom_score_adj:1000 syz-executor.4 invoked oom-killer: gfp_mask=0xcc0(GFP_KERNEL), order=0, oom_score_adj=1000 CPU: 1 PID: 15477 Comm: syz-executor.4 Tainted: G B 5.4.233-syzkaller-00004-gdd94985a9b62 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1d8/0x241 lib/dump_stack.c:118 dump_header+0xd5/0x6b0 mm/oom_kill.c:460 oom_kill_process+0xeb/0x2c0 mm/oom_kill.c:974 out_of_memory+0x5e1/0x890 mm/oom_kill.c:1111 mem_cgroup_out_of_memory+0x211/0x270 mm/memcontrol.c:1611 memory_max_write+0x329/0x440 mm/memcontrol.c:6227 cgroup_file_write+0x275/0x5f0 kernel/cgroup/cgroup.c:3898 kernfs_fop_write+0x2e2/0x3e0 fs/kernfs/file.c:315 __vfs_write+0x103/0x750 fs/read_write.c:494 vfs_write+0x206/0x4e0 fs/read_write.c:558 ksys_write+0x199/0x2c0 fs/read_write.c:611 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x5c/0xc1 memory: usage 10328kB, limit 0kB, failcnt 0 swap: usage 0kB, limit 9007199254740988kB, failcnt 0 Memory cgroup stats for /syz0: anon 110592 file 10539008 kernel_stack 0 slab 0 sock 102400 shmem 10612736 file_mapped 0 file_dirty 0 file_writeback 0 anon_thp 0 inactive_anon 135168 active_anon 10678272 inactive_file 135168 active_file 110592 unevictable 0 slab_reclaimable 0 slab_unreclaimable 0 pgfault 645216 pgmajfault 0 workingset_refault 0 workingset_activate 0 workingset_nodereclaim 0 pgrefill 80 pgscan 80 pgsteal 37 pgactivate 33 oom-kill:constraint=CONSTRAINT_MEMCG,nodemask=(null),cpuset=syz4,mems_allowed=0,oom_memcg=/syz0,task_memcg=/syz0,task=syz-executor.0,pid=3934,uid=0 Memory cgroup out of memory: Killed process 3934 (syz-executor.0) total-vm:48516kB, anon-rss:476kB, file-rss:15180kB, shmem-rss:64kB, UID:0 pgtables:92kB oom_score_adj:0