================================================================== BUG: KASAN: stack-out-of-bounds in fast_imageblit drivers/video/fbdev/core/sysimgblt.c:257 [inline] BUG: KASAN: stack-out-of-bounds in sys_imageblit+0x1ed0/0x2240 drivers/video/fbdev/core/sysimgblt.c:323 Write of size 4 at addr ffffc90004c2fd40 by task syz-executor.4/6330 CPU: 0 PID: 6330 Comm: syz-executor.4 Not tainted 6.0.0-rc1-next-20220819-syzkaller #0 BUG: sleeping function called from invalid context at kernel/locking/rwsem.c:1521 in_atomic(): 1, irqs_disabled(): 1, non_block: 0, pid: 6330, name: syz-executor.4 preempt_count: 1, expected: 0 RCU nest depth: 0, expected: 0 1 lock held by syz-executor.4/6330: #0: ffffffff8bf784c0 (console_lock){+.+.}-{0:0}, at: con_font_set drivers/tty/vt/vt.c:4662 [inline] #0: ffffffff8bf784c0 (console_lock){+.+.}-{0:0}, at: con_font_op+0x654/0xc90 drivers/tty/vt/vt.c:4710 irq event stamp: 1748 hardirqs last enabled at (1747): [] asm_sysvec_reschedule_ipi+0x16/0x20 arch/x86/include/asm/idtentry.h:654 hardirqs last disabled at (1748): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (1748): [] _raw_spin_lock_irqsave+0x4e/0x50 kernel/locking/spinlock.c:162 softirqs last enabled at (1518): [] invoke_softirq kernel/softirq.c:445 [inline] softirqs last enabled at (1518): [] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650 softirqs last disabled at (1507): [] invoke_softirq kernel/softirq.c:445 [inline] softirqs last disabled at (1507): [] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:650 Preemption disabled at: [<0000000000000000>] 0x0 CPU: 0 PID: 6330 Comm: syz-executor.4 Not tainted 6.0.0-rc1-next-20220819-syzkaller #0 syz-executor.4[6330] cmdline: /root/syz-executor.4 exec Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 Call Trace: __dump_stack lib/dump_stack.c:122 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:140 __might_resched.cold+0x222/0x26b kernel/sched/core.c:9896 down_read_killable+0x75/0x490 kernel/locking/rwsem.c:1521 mmap_read_lock_killable include/linux/mmap_lock.h:126 [inline] __access_remote_vm+0xac/0x6f0 mm/memory.c:5461 get_mm_cmdline.part.0+0x217/0x620 fs/proc/base.c:299 get_mm_cmdline fs/proc/base.c:367 [inline] get_task_cmdline_kernel+0x1d9/0x220 fs/proc/base.c:367 dump_stack_print_cmdline.part.0+0x82/0x150 lib/dump_stack.c:61 dump_stack_print_cmdline lib/dump_stack.c:89 [inline] dump_stack_print_info+0x185/0x190 lib/dump_stack.c:97 __dump_stack lib/dump_stack.c:121 [inline] dump_stack_lvl+0xc1/0x134 lib/dump_stack.c:140 print_address_description mm/kasan/report.c:317 [inline] print_report.cold+0x59/0x719 mm/kasan/report.c:433 kasan_report+0xb1/0x1e0 mm/kasan/report.c:495 fast_imageblit drivers/video/fbdev/core/sysimgblt.c:257 [inline] sys_imageblit+0x1ed0/0x2240 drivers/video/fbdev/core/sysimgblt.c:323 drm_fb_helper_sys_imageblit drivers/gpu/drm/drm_fb_helper.c:856 [inline] drm_fbdev_fb_imageblit+0x15c/0x350 drivers/gpu/drm/drm_fb_helper.c:2389 bit_putcs_unaligned drivers/video/fbdev/core/bitblit.c:139 [inline] bit_putcs+0x6e1/0xd20 drivers/video/fbdev/core/bitblit.c:188 fbcon_putcs+0x314/0x3e0 drivers/video/fbdev/core/fbcon.c:1287 do_update_region+0x399/0x630 drivers/tty/vt/vt.c:676 invert_screen+0x1d4/0x600 drivers/tty/vt/vt.c:800 highlight drivers/tty/vt/selection.c:57 [inline] clear_selection drivers/tty/vt/selection.c:85 [inline] clear_selection+0x55/0x70 drivers/tty/vt/selection.c:81 vc_do_resize+0xe61/0x1170 drivers/tty/vt/vt.c:1257 fbcon_do_set_font+0x43a/0x6f0 drivers/video/fbdev/core/fbcon.c:2428 fbcon_set_font+0x89d/0xab0 drivers/video/fbdev/core/fbcon.c:2519 con_font_set drivers/tty/vt/vt.c:4666 [inline] con_font_op+0x73a/0xc90 drivers/tty/vt/vt.c:4710 vt_k_ioctl drivers/tty/vt/vt_ioctl.c:474 [inline] vt_ioctl+0x1efa/0x2b20 drivers/tty/vt/vt_ioctl.c:752 tty_ioctl+0xfab/0x15d0 drivers/tty/tty_io.c:2778 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f19cb489279 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f19cc666168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f19cb59c120 RCX: 00007f19cb489279 RDX: 0000000020000440 RSI: 0000000000004b72 RDI: 0000000000000007 RBP: 00007f19cb4e3189 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc6f7ede5f R14: 00007f19cc666300 R15: 0000000000022000 syz-executor.4[6330] cmdline: /root/syz-executor.4 exec Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022 Call Trace: __dump_stack lib/dump_stack.c:122 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:140 print_address_description mm/kasan/report.c:317 [inline] print_report.cold+0x59/0x719 mm/kasan/report.c:433 kasan_report+0xb1/0x1e0 mm/kasan/report.c:495 fast_imageblit drivers/video/fbdev/core/sysimgblt.c:257 [inline] sys_imageblit+0x1ed0/0x2240 drivers/video/fbdev/core/sysimgblt.c:323 drm_fb_helper_sys_imageblit drivers/gpu/drm/drm_fb_helper.c:856 [inline] drm_fbdev_fb_imageblit+0x15c/0x350 drivers/gpu/drm/drm_fb_helper.c:2389 bit_putcs_unaligned drivers/video/fbdev/core/bitblit.c:139 [inline] bit_putcs+0x6e1/0xd20 drivers/video/fbdev/core/bitblit.c:188 fbcon_putcs+0x314/0x3e0 drivers/video/fbdev/core/fbcon.c:1287 do_update_region+0x399/0x630 drivers/tty/vt/vt.c:676 invert_screen+0x1d4/0x600 drivers/tty/vt/vt.c:800 highlight drivers/tty/vt/selection.c:57 [inline] clear_selection drivers/tty/vt/selection.c:85 [inline] clear_selection+0x55/0x70 drivers/tty/vt/selection.c:81 vc_do_resize+0xe61/0x1170 drivers/tty/vt/vt.c:1257 fbcon_do_set_font+0x43a/0x6f0 drivers/video/fbdev/core/fbcon.c:2428 fbcon_set_font+0x89d/0xab0 drivers/video/fbdev/core/fbcon.c:2519 con_font_set drivers/tty/vt/vt.c:4666 [inline] con_font_op+0x73a/0xc90 drivers/tty/vt/vt.c:4710 vt_k_ioctl drivers/tty/vt/vt_ioctl.c:474 [inline] vt_ioctl+0x1efa/0x2b20 drivers/tty/vt/vt_ioctl.c:752 tty_ioctl+0xfab/0x15d0 drivers/tty/tty_io.c:2778 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:870 [inline] __se_sys_ioctl fs/ioctl.c:856 [inline] __x64_sys_ioctl+0x193/0x200 fs/ioctl.c:856 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f19cb489279 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f19cc666168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f19cb59c120 RCX: 00007f19cb489279 RDX: 0000000020000440 RSI: 0000000000004b72 RDI: 0000000000000007 RBP: 00007f19cb4e3189 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffc6f7ede5f R14: 00007f19cc666300 R15: 0000000000022000 The buggy address belongs to the virtual mapping at [ffffc90004c28000, ffffc90004c31000) created by: kernel_clone+0xe7/0xab0 kernel/fork.c:2677 The buggy address belongs to the physical page: page:ffffea0001c1e2c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7078b flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2dc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_NOWARN|__GFP_ZERO), pid 2, tgid 2 (kthreadd), ts 269204627386, free_ts 269047619029 prep_new_page mm/page_alloc.c:2532 [inline] get_page_from_freelist+0x109b/0x2ce0 mm/page_alloc.c:4283 __alloc_pages+0x1c7/0x510 mm/page_alloc.c:5507 alloc_pages+0x1a6/0x270 mm/mempolicy.c:2272 vm_area_alloc_pages mm/vmalloc.c:2958 [inline] __vmalloc_area_node mm/vmalloc.c:3026 [inline] __vmalloc_node_range+0x954/0x13a0 mm/vmalloc.c:3196 alloc_thread_stack_node kernel/fork.c:312 [inline] dup_task_struct kernel/fork.c:977 [inline] copy_process+0x13cd/0x7120 kernel/fork.c:2090 kernel_clone+0xe7/0xab0 kernel/fork.c:2677 kernel_thread+0xb5/0xf0 kernel/fork.c:2737 create_kthread kernel/kthread.c:399 [inline] kthreadd+0x4ea/0x750 kernel/kthread.c:746 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1449 [inline] free_pcp_prepare+0x5e4/0xd20 mm/page_alloc.c:1499 free_unref_page_prepare mm/page_alloc.c:3380 [inline] free_unref_page+0x19/0x4d0 mm/page_alloc.c:3476 __unfreeze_partials+0x17c/0x1a0 mm/slub.c:2548 qlink_free mm/kasan/quarantine.c:168 [inline] qlist_free_all+0x6a/0x170 mm/kasan/quarantine.c:187 kasan_quarantine_reduce+0x180/0x200 mm/kasan/quarantine.c:294 __kasan_slab_alloc+0xa2/0xc0 mm/kasan/common.c:447 kasan_slab_alloc include/linux/kasan.h:224 [inline] slab_post_alloc_hook mm/slab.h:727 [inline] slab_alloc_node mm/slub.c:3243 [inline] slab_alloc mm/slub.c:3251 [inline] kmem_cache_alloc_trace+0x2c0/0x3e0 mm/slub.c:3282 kmalloc include/linux/slab.h:606 [inline] kzalloc include/linux/slab.h:739 [inline] ref_tracker_alloc+0x14c/0x550 lib/ref_tracker.c:85 __netdev_tracker_alloc include/linux/netdevice.h:3960 [inline] netdev_hold include/linux/netdevice.h:3989 [inline] netdev_hold include/linux/netdevice.h:3984 [inline] register_netdevice+0x1049/0x1680 net/core/dev.c:10090 batadv_softif_newlink+0x6e/0x90 net/batman-adv/soft-interface.c:1071 rtnl_newlink_create net/core/rtnetlink.c:3363 [inline] __rtnl_newlink+0x1087/0x17e0 net/core/rtnetlink.c:3580 rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3593 rtnetlink_rcv_msg+0x43a/0xca0 net/core/rtnetlink.c:6090 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921 Memory state around the buggy address: ffffc90004c2fc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffffc90004c2fc80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffc90004c2fd00: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 f3 f3 ^ ffffc90004c2fd80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffffc90004c2fe00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================