Not allocated shadow for addr ffff8801844e9030 (page ffffea000919d760)
Attempted to access 8 bytes
------------[ cut here ]------------
kernel BUG at mm/kmsan/kmsan.c:1091!
invalid opcode: 0000 [#1] SMP
CPU: 0 PID: 8490 Comm: syz-executor1 Not tainted 4.19.0-rc4+ #64
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:kmsan_get_shadow_address+0x2d6/0x3d0 mm/kmsan/kmsan.c:1089
Code: e9 89 00 00 00 c7 04 25 20 73 28 8c 01 00 00 00 65 48 8b 04 25 00 fd 02 00 c6 80 7b 09 00 00 01 80 3c 25 38 73 28 8c 00 74 0c <0f> 0b 0f 1f 84 00 00 00 00 00 eb fe 48 c7 c7 1c bc 57 8b 31 c0 4c
RSP: 0018:ffff88018451f7b0 EFLAGS: 00010046
RAX: 000000000000001b RBX: 0000000000000000 RCX: f04607fd2e40b200
RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000000
RBP: ffff88018451f7e0 R08: 0000000000000000 R09: ffff88021fc38f50
R10: 0000000000000000 R11: ffffffff862594e0 R12: 0000000000000001
R13: ffff8801844e9030 R14: 0000000000000001 R15: 0000000000000008
FS:  0000000000cda940(0000) GS:ffff88021fc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b32221000 CR3: 00000001359b5000 CR4: 00000000001406f0
Call Trace:
 kmsan_internal_memset_shadow mm/kmsan/kmsan.c:163 [inline]
 kmsan_internal_unpoison_shadow+0x5c/0xe0 mm/kmsan/kmsan.c:200
 kmsan_unpoison_shadow+0x72/0xd0 mm/kmsan/kmsan.c:214
 native_ptep_get_and_clear arch/x86/include/asm/pgtable_64.h:87 [inline]
 ptep_get_and_clear arch/x86/include/asm/pgtable.h:1104 [inline]
 vunmap_pte_range mm/vmalloc.c:67 [inline]
 vunmap_pmd_range mm/vmalloc.c:84 [inline]
 vunmap_pud_range mm/vmalloc.c:100 [inline]
 vunmap_p4d_range mm/vmalloc.c:116 [inline]
 vunmap_page_range+0x828/0xc20 mm/vmalloc.c:131
 unmap_vmap_area mm/vmalloc.c:604 [inline]
 free_unmap_vmap_area mm/vmalloc.c:739 [inline]
 remove_vm_area+0x39b/0x450 mm/vmalloc.c:1491
 __vunmap+0x34c/0x5d0 mm/vmalloc.c:1519
 vunmap+0x69/0xb0 mm/vmalloc.c:1612
 ion_heap_unmap_kernel+0x51/0x70 drivers/staging/android/ion/ion_heap.c:60
 ion_buffer_destroy drivers/staging/android/ion/ion.c:117 [inline]
 _ion_buffer_destroy drivers/staging/android/ion/ion.c:135 [inline]
 ion_dma_buf_release+0x222/0x430 drivers/staging/android/ion/ion.c:300
 dma_buf_release+0x1ab/0x8b0 drivers/dma-buf/dma-buf.c:70
 __fput+0x4e8/0xda0 fs/file_table.c:278
 ____fput+0x37/0x40 fs/file_table.c:309
 task_work_run+0x467/0x500 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:193 [inline]
 exit_to_usermode_loop arch/x86/entry/common.c:166 [inline]
 prepare_exit_to_usermode+0x364/0x470 arch/x86/entry/common.c:197
 syscall_return_slowpath+0x112/0x880 arch/x86/entry/common.c:268
 do_syscall_64+0xe4/0x100 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x63/0xe7
RIP: 0033:0x411051
Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 34 19 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01
RSP: 002b:0000000000a3fd90 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000005 RCX: 0000000000411051
RDX: 0000000000000000 RSI: 0000000000730350 RDI: 0000000000000004
RBP: 0000000000000000 R08: ffffffff8224b028 R09: 00000000591bc336
R10: 0000000000a3fcc0 R11: 0000000000000293 R12: 0000000000000000
R13: 0000000000000001 R14: 000000000000001e R15: 0000000000000001
Modules linked in:
---[ end trace 03890932e321637b ]---
RIP: 0010:kmsan_get_shadow_address+0x2d6/0x3d0 mm/kmsan/kmsan.c:1089
Code: e9 89 00 00 00 c7 04 25 20 73 28 8c 01 00 00 00 65 48 8b 04 25 00 fd 02 00 c6 80 7b 09 00 00 01 80 3c 25 38 73 28 8c 00 74 0c <0f> 0b 0f 1f 84 00 00 00 00 00 eb fe 48 c7 c7 1c bc 57 8b 31 c0 4c
RSP: 0018:ffff88018451f7b0 EFLAGS: 00010046
RAX: 000000000000001b RBX: 0000000000000000 RCX: f04607fd2e40b200
RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000000000000
RBP: ffff88018451f7e0 R08: 0000000000000000 R09: ffff88021fc38f50
R10: 0000000000000000 R11: ffffffff862594e0 R12: 0000000000000001
R13: ffff8801844e9030 R14: 0000000000000001 R15: 0000000000000008
FS:  0000000000cda940(0000) GS:ffff88021fc00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b32221000 CR3: 00000001359b5000 CR4: 00000000001406f0