kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] SMP KASAN SELinux: unrecognized netlink message: protocol=0 nlmsg_type=5 sclass=netlink_route_socket pig=6474 comm=syz-executor7 SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=6474 comm=syz-executor7 Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 1 PID: 6460 Comm: syz-executor2 Not tainted 4.14.0-rc4-mm1+ #16 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff8801cf6a0600 task.stack: ffff8801bf858000 RIP: 0010:__read_once_size include/linux/compiler.h:276 [inline] RIP: 0010:hrtimer_active+0x211/0x410 kernel/time/hrtimer.c:1142 RSP: 0018:ffff8801bf85f738 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 1ffff10037f0bf14 RCX: ffffc90002436000 RDX: 0000000000010000 RSI: ffffffff815f407f RDI: ffff8801d0e6f7a0 RBP: ffff8801bf85f878 R08: ffffffff83eef7b7 R09: ffff8801bf85f140 R10: ffff8801bf85fbe0 R11: 1ffff10039ed4353 R12: 0000000000000000 R13: 0000000000000000 R14: ffffed0037f0bef2 R15: dffffc0000000000 FS: 00007fc0e96dc700(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fdeab38edb8 CR3: 00000001ca66c000 CR4: 00000000001426e0 DR0: 0000000020001000 DR1: 0000000020001000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 Call Trace: hrtimer_try_to_cancel+0x91/0x5c0 kernel/time/hrtimer.c:1006 hrtimer_cancel+0x22/0x40 kernel/time/hrtimer.c:1032 napi_disable+0x87/0xa0 net/core/dev.c:5551 tun_napi_disable drivers/net/tun.c:290 [inline] __tun_detach+0xe26/0x1570 drivers/net/tun.c:617 tun_detach drivers/net/tun.c:664 [inline] tun_chr_close+0x44/0x60 drivers/net/tun.c:2832 __fput+0x333/0x7f0 fs/file_table.c:210 ____fput+0x15/0x20 fs/file_table.c:244 task_work_run+0x199/0x270 kernel/task_work.c:112 tracehook_notify_resume include/linux/tracehook.h:191 [inline] exit_to_usermode_loop+0x296/0x310 arch/x86/entry/common.c:162 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline] syscall_return_slowpath+0x42f/0x510 arch/x86/entry/common.c:266 entry_SYSCALL_64_fastpath+0xbc/0xbe RIP: 0033:0x4520a9 RSP: 002b:00007fc0e96dbc08 EFLAGS: 00000216 ORIG_RAX: 0000000000000021 RAX: 0000000000000019 RBX: 0000000000718000 RCX: 00000000004520a9 RDX: 0000000000000000 RSI: 0000000000000019 RDI: 0000000000000017 RBP: 0000000000000590 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000216 R12: 00000000004b7548 R13: 00000000ffffffff R14: 0000000000000017 R15: 0000000000000019 Code: c6 00 00 48 8b 85 d8 fe ff ff 48 c1 e8 03 42 80 3c 38 00 0f 85 f2 01 00 00 48 8b 85 e8 fe ff ff 4c 8b 60 30 4c 89 e0 48 c1 e8 03 <42> 80 3c 38 00 0f 85 c8 01 00 00 48 8b 85 f0 fe ff ff 49 8b 1c RIP: __read_once_size include/linux/compiler.h:276 [inline] RSP: ffff8801bf85f738 RIP: hrtimer_active+0x211/0x410 kernel/time/hrtimer.c:1142 RSP: ffff8801bf85f738 ---[ end trace 15ea18b67a3de806 ]--- usercopy: kernel memory overwrite attempt detected to ffff8801c75db114 (kvm_vcpu) (1320 bytes) ------------[ cut here ]------------ kernel BUG at mm/usercopy.c:84! invalid opcode: 0000 [#2] SMP KASAN Dumping ftrace buffer: (ftrace buffer empty) Modules linked in: CPU: 0 PID: 6468 Comm: syz-executor5 Tainted: G D 4.14.0-rc4-mm1+ #16 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff8801c4a6c180 task.stack: ffff8801c3c88000 RIP: 0010:report_usercopy mm/usercopy.c:76 [inline] RIP: 0010:__check_object_size+0x3a2/0x4f0 mm/usercopy.c:276 RSP: 0018:ffff8801c3c8f148 EFLAGS: 00010286 RAX: 000000000000005e RBX: ffffffff84f1a3e0 RCX: 0000000000000000 RDX: 000000000000005e RSI: ffffffff8159322e RDI: ffffed0038791e1d RBP: ffff8801c3c8f238 R08: 0000000000000001 R09: 1ffff10038791dc3 R10: 0000000000000001 R11: fffffbfff0dbf001 R12: ffffffff84f1a3a0 R13: ffff8801c75db114 R14: 0000000000000528 R15: ffffea00071d7600 FS: 00007fe8fd267700(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000004b6a51 CR3: 00000001c51f6000 CR4: 00000000001426f0 DR0: 0000000020001010 DR1: 0000000020000000 DR2: 0000000020001010 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 Call Trace: check_object_size include/linux/thread_info.h:111 [inline] check_copy_size include/linux/thread_info.h:142 [inline] copy_from_user include/linux/uaccess.h:145 [inline] kvm_vcpu_ioctl_set_cpuid2+0x75/0x1a0 arch/x86/kvm/cpuid.c:245 kvm_arch_vcpu_ioctl+0x1718/0x4710 arch/x86/kvm/x86.c:3521 kvm_vcpu_ioctl+0x240/0x1010 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2703 vfs_ioctl fs/ioctl.c:45 [inline] do_vfs_ioctl+0x1b1/0x1530 fs/ioctl.c:685 SYSC_ioctl fs/ioctl.c:700 [inline] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:691 entry_SYSCALL_64_fastpath+0x1f/0xbe RIP: 0033:0x451f97 RSP: 002b:00007fe8fd265038 EFLAGS: 00000217 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007fe8fd2657d0 RCX: 0000000000451f97 RDX: 00007fe8fd2657d0 RSI: 000000004008ae90 RDI: 0000000000000019 RBP: 00000000208d6000 R08: 0000000000000001 R09: 0000000000000000 R10: 00000000000f4244 R11: 0000000000000217 R12: 00000000fec00000 R13: 0000000000000017 R14: 0000000000000017 R15: 0000000000000019 Code: 48 0f 44 da e8 60 16 c4 ff 48 8b 85 28 ff ff ff 4d 89 f1 4c 89 e9 4c 89 e2 48 89 de 48 c7 c7 a0 a4 f1 84 49 89 c0 e8 b3 34 ae ff <0f> 0b 48 c7 c0 60 a2 f1 84 eb 96 48 c7 c0 a0 a2 f1 84 eb 8d 48 RIP: report_usercopy mm/usercopy.c:76 [inline] RSP: ffff8801c3c8f148 RIP: __check_object_size+0x3a2/0x4f0 mm/usercopy.c:276 RSP: ffff8801c3c8f148 ---[ end trace 15ea18b67a3de807 ]---