input: syz1 as /devices/virtual/input/input14 list_add corruption. next->prev should be prev (ffff8801db11d130), but was dead000000000200. (next=ffff8801915265e0). ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:25! invalid opcode: 0000 [#1] SMP KASAN CPU: 1 PID: 13746 Comm: syz-executor1 Not tainted 4.19.0-rc1-next-20180829+ #50 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:__list_add_valid.cold.0+0xf/0x25 lib/list_debug.c:23 Code: e8 f3 72 58 fe e9 68 ff ff ff e8 e9 72 58 fe eb c9 4c 89 e7 e8 df 72 58 fe eb 97 48 89 d9 48 c7 c7 c0 ee 3a 87 e8 e2 31 00 fe <0f> 0b 48 89 f1 48 c7 c7 80 ef 3a 87 48 89 de e8 ce 31 00 fe 0f 0b RSP: 0018:ffff8801c79967d8 EFLAGS: 00010086 RAX: 0000000000000075 RBX: ffff8801915265e0 RCX: ffffc90003a32000 RDX: 0000000000000000 RSI: ffffffff8163ac01 RDI: 0000000000000001 RBP: ffff8801c79967f0 R08: ffff8801ab0ae3c0 R09: ffffed003b625010 R10: ffffed003b625010 R11: ffff8801db128087 R12: ffff8801915265e0 R13: ffff880191520e40 R14: ffff8801915265e0 R15: ffff8801db11d130 FS: 00007f3bfb2ec700(0000) GS:ffff8801db100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fff83bd5b9c CR3: 00000001ad2d7000 CR4: 00000000001426e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __list_add include/linux/list.h:60 [inline] list_add include/linux/list.h:79 [inline] vmx_vcpu_load+0x205/0xfe0 arch/x86/kvm/vmx.c:3073 kvm_arch_vcpu_load+0x22b/0x940 arch/x86/kvm/x86.c:3106 kvm_sched_in+0x82/0xa0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:3975 __fire_sched_in_preempt_notifiers kernel/sched/core.c:2481 [inline] fire_sched_in_preempt_notifiers kernel/sched/core.c:2487 [inline] finish_task_switch+0x50d/0x870 kernel/sched/core.c:2679 context_switch kernel/sched/core.c:2828 [inline] __schedule+0x884/0x1df0 kernel/sched/core.c:3473 preempt_schedule_common+0x22/0x60 kernel/sched/core.c:3597 _cond_resched+0x1d/0x30 kernel/sched/core.c:4963 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc_node mm/slab.c:3299 [inline] kmem_cache_alloc_node_trace+0x24f/0x720 mm/slab.c:3661 kmalloc_node include/linux/slab.h:551 [inline] kzalloc_node include/linux/slab.h:718 [inline] __get_vm_area_node+0x12d/0x390 mm/vmalloc.c:1389 __vmalloc_node_range+0xc4/0x760 mm/vmalloc.c:1741 __vmalloc_node mm/vmalloc.c:1791 [inline] __vmalloc_node_flags mm/vmalloc.c:1805 [inline] vmalloc+0x6f/0x80 mm/vmalloc.c:1827 kvm_vcpu_ioctl_set_cpuid+0x1e7/0xa20 arch/x86/kvm/cpuid.c:207 kvm_arch_vcpu_ioctl+0xf80/0x3ac0 arch/x86/kvm/x86.c:3783 kvm_vcpu_ioctl+0x286/0x1280 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2742 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:501 [inline] do_vfs_ioctl+0x1de/0x1720 fs/ioctl.c:685 ksys_ioctl+0xa9/0xd0 fs/ioctl.c:702 __do_sys_ioctl fs/ioctl.c:709 [inline] __se_sys_ioctl fs/ioctl.c:707 [inline] __x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:707 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x457089 Code: fd b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f3bfb2ebc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f3bfb2ec6d4 RCX: 0000000000457089 RDX: 00000000200000c0 RSI: 000000004008ae8a RDI: 0000000000000005 RBP: 00000000009301e0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 00000000004cef50 R14: 00000000004c55ce R15: 0000000000000002 Modules linked in: Dumping ftrace buffer: (ftrace buffer empty) ---[ end trace 002167a32d3eab59 ]--- RIP: 0010:__list_add_valid.cold.0+0xf/0x25 lib/list_debug.c:23 Code: e8 f3 72 58 fe e9 68 ff ff ff e8 e9 72 58 fe eb c9 4c 89 e7 e8 df 72 58 fe eb 97 48 89 d9 48 c7 c7 c0 ee 3a 87 e8 e2 31 00 fe <0f> 0b 48 89 f1 48 c7 c7 80 ef 3a 87 48 89 de e8 ce 31 00 fe 0f 0b RSP: 0018:ffff8801c79967d8 EFLAGS: 00010086 RAX: 0000000000000075 RBX: ffff8801915265e0 RCX: ffffc90003a32000 RDX: 0000000000000000 RSI: ffffffff8163ac01 RDI: 0000000000000001 RBP: ffff8801c79967f0 R08: ffff8801ab0ae3c0 R09: ffffed003b625010 R10: ffffed003b625010 R11: ffff8801db128087 R12: ffff8801915265e0 R13: ffff880191520e40 R14: ffff8801915265e0 R15: ffff8801db11d130 FS: 00007f3bfb2ec700(0000) GS:ffff8801db100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fff83bd5b9c CR3: 00000001ad2d7000 CR4: 00000000001426e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400