==================================================================
BUG: KASAN: out-of-bounds in instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
BUG: KASAN: out-of-bounds in atomic_dec include/linux/atomic/atomic-instrumented.h:592 [inline]
BUG: KASAN: out-of-bounds in put_bh include/linux/buffer_head.h:308 [inline]
BUG: KASAN: out-of-bounds in end_buffer_read_sync+0x8f/0xe0 fs/buffer.c:161
Write of size 4 at addr ffffc90004c078a0 by task ksoftirqd/0/16
CPU: 0 PID: 16 Comm: ksoftirqd/0 Not tainted 6.6.0-rc3-next-20230925-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/04/2023
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:364 [inline]
print_report+0xc4/0x620 mm/kasan/report.c:475
kasan_report+0xda/0x110 mm/kasan/report.c:588
check_region_inline mm/kasan/generic.c:181 [inline]
kasan_check_range+0xef/0x190 mm/kasan/generic.c:187
instrument_atomic_read_write include/linux/instrumented.h:96 [inline]
atomic_dec include/linux/atomic/atomic-instrumented.h:592 [inline]
put_bh include/linux/buffer_head.h:308 [inline]
end_buffer_read_sync+0x8f/0xe0 fs/buffer.c:161
end_bio_bh_io_sync+0xdd/0x130 fs/buffer.c:2778
bio_endio+0x593/0x6a0 block/bio.c:1603
req_bio_endio block/blk-mq.c:788 [inline]
blk_update_request+0x67b/0x1780 block/blk-mq.c:933
blk_mq_end_request+0x57/0x520 block/blk-mq.c:1056
lo_complete_rq+0x232/0x2f0 drivers/block/loop.c:370
blk_complete_reqs+0xb2/0xf0 block/blk-mq.c:1131
__do_softirq+0x21a/0x968 kernel/softirq.c:553
invoke_softirq kernel/softirq.c:427 [inline]
__irq_exit_rcu kernel/softirq.c:632 [inline]
irq_exit_rcu+0xb7/0x120 kernel/softirq.c:644
sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1074
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645
RIP: 0010:finish_task_switch.isra.0+0x223/0xca0 kernel/sched/core.c:5237
Code: 0a 00 00 44 8b 0d 15 b8 73 0d 45 85 c9 0f 85 c0 01 00 00 48 89 df e8 fc f8 ff ff e8 07 c6 33 00 fb 65 48 8b 1c 25 c0 bc 03 00 <48> 8d bb d8 15 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1
RSP: 0018:ffffc90000157c70 EFLAGS: 00000202
RAX: 00000000001be76b RBX: ffff888015675940 RCX: 1ffffffff1d9d2e1
RDX: 0000000000000000 RSI: ffffffff8a8ca920 RDI: ffffffff8ae97520
RBP: ffffc90000157cb8 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff8ecec997 R11: 0000000000000000 R12: ffff8880b983d498
R13: ffff888015693b80 R14: 0000000000000000 R15: ffff8880b983c700
context_switch kernel/sched/core.c:5368 [inline]
__schedule+0xee9/0x5a00 kernel/sched/core.c:6676
__schedule_loop kernel/sched/core.c:6753 [inline]
schedule+0xe7/0x270 kernel/sched/core.c:6768
smpboot_thread_fn+0x2d4/0xa00 kernel/smpboot.c:160
kthread+0x33c/0x440 kernel/kthread.c:388
ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:304
The buggy address belongs to the virtual mapping at
[ffffc90004c00000, ffffc90004c09000) created by:
kernel_clone+0xfd/0x920 kernel/fork.c:2902
The buggy address belongs to the physical page:
page:ffffea0000a3c400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x28f10
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x102dc2(GFP_HIGHUSER|__GFP_NOWARN|__GFP_ZERO), pid 8080, tgid 8080 (syz-executor.3), ts 405852591861, free_ts 404892590978
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x2cf/0x340 mm/page_alloc.c:1530
prep_new_page mm/page_alloc.c:1537 [inline]
get_page_from_freelist+0xf17/0x2e50 mm/page_alloc.c:3200
__alloc_pages+0x1d0/0x4a0 mm/page_alloc.c:4456
alloc_pages+0x1a9/0x270 mm/mempolicy.c:2305
vm_area_alloc_pages mm/vmalloc.c:3063 [inline]
__vmalloc_area_node mm/vmalloc.c:3139 [inline]
__vmalloc_node_range+0x8f3/0x1bf0 mm/vmalloc.c:3320
alloc_thread_stack_node kernel/fork.c:309 [inline]
dup_task_struct kernel/fork.c:1118 [inline]
copy_process+0x13e3/0x74b0 kernel/fork.c:2327
kernel_clone+0xfd/0x920 kernel/fork.c:2902
__do_sys_clone3+0x1f1/0x260 kernel/fork.c:3203
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1130 [inline]
free_unref_page_prepare+0x476/0xa40 mm/page_alloc.c:2342
free_unref_page_list+0xe6/0xb30 mm/page_alloc.c:2481
release_pages+0x32a/0x14e0 mm/swap.c:1042
tlb_batch_pages_flush+0x9a/0x190 mm/mmu_gather.c:98
tlb_flush_mmu_free mm/mmu_gather.c:293 [inline]
tlb_flush_mmu mm/mmu_gather.c:300 [inline]
tlb_finish_mmu+0x14b/0x6f0 mm/mmu_gather.c:392
exit_mmap+0x38b/0xa60 mm/mmap.c:3221
__mmput+0x12a/0x4d0 kernel/fork.c:1349
mmput+0x62/0x70 kernel/fork.c:1371
exit_mm kernel/exit.c:567 [inline]
do_exit+0x9ad/0x2ae0 kernel/exit.c:858
do_group_exit+0xd4/0x2a0 kernel/exit.c:1021
get_signal+0x23ba/0x2790 kernel/signal.c:2904
arch_do_signal_or_restart+0x90/0x7f0 arch/x86/kernel/signal.c:309
exit_to_user_mode_loop kernel/entry/common.c:168 [inline]
exit_to_user_mode_prepare+0x11f/0x240 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:285 [inline]
syscall_exit_to_user_mode+0x1d/0x60 kernel/entry/common.c:296
do_syscall_64+0x44/0xb0 arch/x86/entry/common.c:87
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Memory state around the buggy address:
ffffc90004c07780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffffc90004c07800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffc90004c07880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
^
ffffc90004c07900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffffc90004c07980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
----------------
Code disassembly (best guess):
0: 0a 00 or (%rax),%al
2: 00 44 8b 0d add %al,0xd(%rbx,%rcx,4)
6: 15 b8 73 0d 45 adc $0x450d73b8,%eax
b: 85 c9 test %ecx,%ecx
d: 0f 85 c0 01 00 00 jne 0x1d3
13: 48 89 df mov %rbx,%rdi
16: e8 fc f8 ff ff call 0xfffff917
1b: e8 07 c6 33 00 call 0x33c627
20: fb sti
21: 65 48 8b 1c 25 c0 bc mov %gs:0x3bcc0,%rbx
28: 03 00
* 2a: 48 8d bb d8 15 00 00 lea 0x15d8(%rbx),%rdi <-- trapping instruction
31: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
38: fc ff df
3b: 48 89 fa mov %rdi,%rdx
3e: 48 rex.W
3f: c1 .byte 0xc1