BUG: sleeping function called from invalid context at ./include/linux/uaccess.h:71 in_atomic(): 1, irqs_disabled(): 0, pid: 14371, name: syz-executor3 2 locks held by syz-executor3/14371: #0: (&vcpu->mutex){+.+.}, at: [] vcpu_load+0x1c/0x70 arch/x86/kvm/../../../virt/kvm/kvm_main.c:154 #1: (&kvm->srcu){....}, at: [] vcpu_enter_guest arch/x86/kvm/x86.c:7032 [inline] #1: (&kvm->srcu){....}, at: [] vcpu_run arch/x86/kvm/x86.c:7111 [inline] #1: (&kvm->srcu){....}, at: [] kvm_arch_vcpu_ioctl_run+0x1bdd/0x5a30 arch/x86/kvm/x86.c:7272 CPU: 0 PID: 14371 Comm: syz-executor3 Not tainted 4.13.0-rc7-next-20170829+ #11 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:16 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:52 ___might_sleep+0x2b2/0x470 kernel/sched/core.c:6022 __might_sleep+0x95/0x190 kernel/sched/core.c:5975 __might_fault+0xab/0x1d0 mm/memory.c:4483 __copy_from_user include/linux/uaccess.h:71 [inline] paging32_walk_addr_generic+0x427/0x1d80 arch/x86/kvm/paging_tmpl.h:369 paging32_walk_addr arch/x86/kvm/paging_tmpl.h:475 [inline] paging32_gva_to_gpa+0xa5/0x230 arch/x86/kvm/paging_tmpl.h:913 kvm_read_guest_virt_helper+0xd8/0x140 arch/x86/kvm/x86.c:4436 kvm_read_guest_virt_system+0x3c/0x50 arch/x86/kvm/x86.c:4503 segmented_read_std+0x10c/0x180 arch/x86/kvm/emulate.c:822 em_fxrstor+0x27b/0x410 arch/x86/kvm/emulate.c:4025 x86_emulate_insn+0x55d/0x3cf0 arch/x86/kvm/emulate.c:5483 x86_emulate_instruction+0x411/0x1ca0 arch/x86/kvm/x86.c:5735 kvm_mmu_page_fault+0x1b0/0x2f0 arch/x86/kvm/mmu.c:4956 handle_ept_violation+0x194/0x540 arch/x86/kvm/vmx.c:6502 vmx_handle_exit+0x24b/0x1a60 arch/x86/kvm/vmx.c:8823 vcpu_enter_guest arch/x86/kvm/x86.c:7049 [inline] vcpu_run arch/x86/kvm/x86.c:7111 [inline] kvm_arch_vcpu_ioctl_run+0x1d36/0x5a30 arch/x86/kvm/x86.c:7272 kvm_vcpu_ioctl+0x64c/0x1010 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2592 vfs_ioctl fs/ioctl.c:45 [inline] do_vfs_ioctl+0x1b1/0x1530 fs/ioctl.c:685 SYSC_ioctl fs/ioctl.c:700 [inline] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:691 entry_SYSCALL_64_fastpath+0x1f/0xbe RIP: 0033:0x446749 RSP: 002b:00007f7e15a4dc08 EFLAGS: 00000296 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 0000000000000019 RCX: 0000000000446749 RDX: 0000000000000000 RSI: 000000000000ae80 RDI: 0000000000000019 RBP: 0000000000000086 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000296 R12: 0000000000009120 R13: 000000002aaaaaab R14: 00000000006e7690 R15: 0000000000000019 QAT: Invalid ioctl QAT: Invalid ioctl do_dccp_setsockopt: sockopt(PACKET_SIZE) is deprecated: fix your app selinux_nlmsg_perm: 2 callbacks suppressed SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=14478 comm=syz-executor7 do_dccp_setsockopt: sockopt(PACKET_SIZE) is deprecated: fix your app audit: type=1326 audit(1504075992.620:61): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=14542 comm="syz-executor4" exe="/syz-executor4" sig=31 arch=c000003e syscall=202 compat=0 ip=0x446749 code=0x0 audit: type=1326 audit(1504075992.711:62): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=14542 comm="syz-executor4" exe="/syz-executor4" sig=31 arch=c000003e syscall=202 compat=0 ip=0x446749 code=0x0 device lo entered promiscuous mode sctp: [Deprecated]: syz-executor1 (pid 14682) Use of struct sctp_assoc_value in delayed_ack socket option. Use struct sctp_sack_info instead sctp: [Deprecated]: syz-executor1 (pid 14723) Use of struct sctp_assoc_value in delayed_ack socket option. Use struct sctp_sack_info instead kvm_hv_set_msr: 129 callbacks suppressed kvm [14741]: vcpu0, guest rIP: 0x9112 Hyper-V uhandled wrmsr: 0x4000008f data 0x71 kvm [14741]: vcpu0, guest rIP: 0x9112 Hyper-V uhandled wrmsr: 0x4000008e data 0x71 kvm [14741]: vcpu0, guest rIP: 0x9112 Hyper-V uhandled wrmsr: 0x4000008d data 0x71 kvm [14741]: vcpu0, guest rIP: 0x9112 Hyper-V uhandled wrmsr: 0x4000008c data 0x71 kvm [14741]: vcpu0, guest rIP: 0x9112 Hyper-V uhandled wrmsr: 0x4000008b data 0xd1 kvm [14741]: vcpu0, guest rIP: 0x9112 Hyper-V uhandled wrmsr: 0x4000008a data 0x31 kvm [14741]: vcpu0, guest rIP: 0x9112 Hyper-V uhandled wrmsr: 0x40000089 data 0x31 kvm [14741]: vcpu0, guest rIP: 0x9112 Hyper-V uhandled wrmsr: 0x40000088 data 0x31 kvm [14741]: vcpu0, guest rIP: 0x9112 Hyper-V uhandled wrmsr: 0x40000087 data 0x31 kvm [14741]: vcpu0, guest rIP: 0x9112 Hyper-V uhandled wrmsr: 0x40000086 data 0x31 kvm [14741]: vcpu0, guest rIP: 0x9112 Hyper-V uhandled wrmsr: 0x40000020 data 0xb nla_parse: 7 callbacks suppressed netlink: 3440 bytes leftover after parsing attributes in process `syz-executor5'. netlink: 5 bytes leftover after parsing attributes in process `syz-executor4'. audit: type=1326 audit(1504075993.919:63): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=14790 comm="syz-executor2" exe="/syz-executor2" sig=9 arch=c000003e syscall=202 compat=0 ip=0x446749 code=0x0 netlink: 5 bytes leftover after parsing attributes in process `syz-executor4'. audit: type=1326 audit(1504075994.012:64): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=14790 comm="syz-executor2" exe="/syz-executor2" sig=9 arch=c000003e syscall=202 compat=0 ip=0x446749 code=0x0 sg_write: data in/out 2127708969/6 bytes for SCSI command 0xe3-- guessing data in; program syz-executor5 not setting count and/or reply_len properly 9pnet_virtio: no channels available for device ./bus sg_write: data in/out 2127708969/6 bytes for SCSI command 0xe3-- guessing data in; program syz-executor5 not setting count and/or reply_len properly 9pnet_virtio: no channels available for device ./bus audit: type=1326 audit(1504075994.719:65): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=14980 comm="syz-executor3" exe="/syz-executor3" sig=9 arch=c000003e syscall=202 compat=0 ip=0x446749 code=0x0 SELinux: unrecognized netlink message: protocol=9 nlmsg_type=37422 sclass=netlink_audit_socket pig=15032 comm=syz-executor5 audit: type=1326 audit(1504075994.813:66): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=14980 comm="syz-executor3" exe="/syz-executor3" sig=9 arch=c000003e syscall=202 compat=0 ip=0x446749 code=0x0 SELinux: unrecognized netlink message: protocol=9 nlmsg_type=37422 sclass=netlink_audit_socket pig=15044 comm=syz-executor5 SELinux: unrecognized netlink message: protocol=9 nlmsg_type=514 sclass=netlink_audit_socket pig=15051 comm=syz-executor5 SELinux: unrecognized netlink message: protocol=9 nlmsg_type=514 sclass=netlink_audit_socket pig=15051 comm=syz-executor5 SELinux: unrecognized netlink message: protocol=9 nlmsg_type=19 sclass=netlink_audit_socket pig=15071 comm=syz-executor4 SELinux: unrecognized netlink message: protocol=9 nlmsg_type=19 sclass=netlink_audit_socket pig=15071 comm=syz-executor4 netlink: 1 bytes leftover after parsing attributes in process `syz-executor2'. QAT: Invalid ioctl netlink: 1 bytes leftover after parsing attributes in process `syz-executor2'. QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl QAT: Invalid ioctl device lo entered promiscuous mode netlink: 1 bytes leftover after parsing attributes in process `syz-executor2'. netlink: 1 bytes leftover after parsing attributes in process `syz-executor2'. netlink: 8 bytes leftover after parsing attributes in process `syz-executor3'. netlink: 8 bytes leftover after parsing attributes in process `syz-executor3'. audit: type=1326 audit(1504075995.516:67): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=15205 comm="syz-executor4" exe="/syz-executor4" sig=31 arch=c000003e syscall=202 compat=0 ip=0x446749 code=0xffff0000 tmpfs: No value for mount option 'Em2?[f)ԇ$-tc%osXYQ-E FˬgKT\ê65Eq`UVͼLvT(b7OtBDbNZ' tmpfs: No value for mount option 'Em2?[f)ԇ$-tc%osXYQ-E FˬgKT\ê65Eq`UVͼLvT(b7OtBDbNZ' QAT: Invalid ioctl audit: type=1326 audit(1504075995.675:68): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=15205 comm="syz-executor4" exe="/syz-executor4" sig=31 arch=c000003e syscall=202 compat=0 ip=0x446749 code=0xffff0000 QAT: Invalid ioctl device  entered promiscuous mode device  left promiscuous mode QAT: Invalid ioctl QAT: Invalid ioctl sock: process `syz-executor4' is using obsolete getsockopt SO_BSDCOMPAT print_req_error: I/O error, dev loop0, sector 0 netlink: 1 bytes leftover after parsing attributes in process `syz-executor6'. sctp: [Deprecated]: syz-executor7 (pid 15725) Use of int in maxseg socket option. Use struct sctp_assoc_value instead PF_BRIDGE: RTM_SETLINK with unknown ifindex sctp: [Deprecated]: syz-executor7 (pid 15749) Use of int in maxseg socket option. Use struct sctp_assoc_value instead PF_BRIDGE: RTM_SETLINK with unknown ifindex sctp: [Deprecated]: syz-executor0 (pid 15786) Use of struct sctp_assoc_value in delayed_ack socket option. Use struct sctp_sack_info instead sctp: [Deprecated]: syz-executor0 (pid 15801) Use of struct sctp_assoc_value in delayed_ack socket option. Use struct sctp_sack_info instead RDS: rds_bind could not find a transport for 224.0.0.2, load rds_tcp or rds_rdma? RDS: rds_bind could not find a transport for 224.0.0.2, load rds_tcp or rds_rdma? sctp: [Deprecated]: syz-executor2 (pid 15951) Use of int in maxseg socket option. Use struct sctp_assoc_value instead sctp: [Deprecated]: syz-executor2 (pid 15960) Use of int in maxseg socket option. Use struct sctp_assoc_value instead nla_parse: 2 callbacks suppressed netlink: 6 bytes leftover after parsing attributes in process `syz-executor7'. netlink: 3 bytes leftover after parsing attributes in process `syz-executor5'. netlink: 1 bytes leftover after parsing attributes in process `syz-executor0'. ================================================================== BUG: KASAN: use-after-free in hlist_add_head include/linux/list.h:673 [inline] BUG: KASAN: use-after-free in enqueue_timer kernel/time/timer.c:520 [inline] BUG: KASAN: use-after-free in __internal_add_timer+0x275/0x2d0 kernel/time/timer.c:531 Write of size 8 at addr ffff88002bfeb6c8 by task kworker/0:3/3689 CPU: 0 PID: 3689 Comm: kworker/0:3 Tainted: G W 4.13.0-rc7-next-20170829+ #11 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Workqueue: pm pm_runtime_work Call Trace: __dump_stack lib/dump_stack.c:16 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:52 print_address_description+0x73/0x250 mm/kasan/report.c:252 kasan_report_error mm/kasan/report.c:351 [inline] kasan_report+0x24e/0x340 mm/kasan/report.c:409 __asan_report_store8_noabort+0x17/0x20 mm/kasan/report.c:435 hlist_add_head include/linux/list.h:673 [inline] enqueue_timer kernel/time/timer.c:520 [inline] __internal_add_timer+0x275/0x2d0 kernel/time/timer.c:531 internal_add_timer kernel/time/timer.c:573 [inline] __mod_timer kernel/time/timer.c:1024 [inline] mod_timer+0x622/0x15b0 kernel/time/timer.c:1071 netlink: 1 bytes leftover after parsing attributes in process `syz-executor0'. rpm_suspend+0x126b/0x1610 drivers/base/power/runtime.c:533 __pm_runtime_suspend+0x5b/0xf0 drivers/base/power/runtime.c:1009 pm_runtime_autosuspend include/linux/pm_runtime.h:195 [inline] usb_runtime_idle+0x2f/0x40 drivers/usb/core/driver.c:1889 __rpm_callback+0x338/0xab0 drivers/base/power/runtime.c:334 rpm_idle+0x632/0xac0 drivers/base/power/runtime.c:426 pm_runtime_work+0x144/0x170 drivers/base/power/runtime.c:874 process_one_work+0xbff/0x1bf0 kernel/workqueue.c:2119 worker_thread+0x223/0x1860 kernel/workqueue.c:2254 kthread+0x39c/0x470 kernel/kthread.c:231 ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:431 Allocated by task 15835: save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59 save_stack+0x43/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551 __do_kmalloc_node mm/slab.c:3689 [inline] __kmalloc_node+0x47/0x70 mm/slab.c:3696 kmalloc_node include/linux/slab.h:535 [inline] kvmalloc_node+0x64/0xd0 mm/util.c:397 kvmalloc include/linux/mm.h:529 [inline] kvzalloc include/linux/mm.h:537 [inline] alloc_netdev_mqs+0x16e/0xed0 net/core/dev.c:8010 tun_set_iff drivers/net/tun.c:2008 [inline] __tun_chr_ioctl+0x12be/0x3d20 drivers/net/tun.c:2262 tun_chr_ioctl+0x2a/0x40 drivers/net/tun.c:2507 vfs_ioctl fs/ioctl.c:45 [inline] do_vfs_ioctl+0x1b1/0x1530 fs/ioctl.c:685 SYSC_ioctl fs/ioctl.c:700 [inline] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:691 entry_SYSCALL_64_fastpath+0x1f/0xbe Freed by task 15835: save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59 save_stack+0x43/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524 __cache_free mm/slab.c:3503 [inline] kfree+0xca/0x250 mm/slab.c:3820 kvfree+0x36/0x60 mm/util.c:416 netdev_freemem net/core/dev.c:7962 [inline] free_netdev+0x2cf/0x360 net/core/dev.c:8124 tun_set_iff drivers/net/tun.c:2091 [inline] __tun_chr_ioctl+0x2cf6/0x3d20 drivers/net/tun.c:2262 tun_chr_ioctl+0x2a/0x40 drivers/net/tun.c:2507 vfs_ioctl fs/ioctl.c:45 [inline] do_vfs_ioctl+0x1b1/0x1530 fs/ioctl.c:685 SYSC_ioctl fs/ioctl.c:700 [inline] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:691 entry_SYSCALL_64_fastpath+0x1f/0xbe The buggy address belongs to the object at ffff88002bfe82c0 which belongs to the cache kmalloc-16384 of size 16384 The buggy address is located 13320 bytes inside of 16384-byte region [ffff88002bfe82c0, ffff88002bfec2c0) The buggy address belongs to the page: page:ffffea0000affa00 count:1 mapcount:0 mapping:ffff88002bfe82c0 index:0x0 compound_mapcount: 0 flags: 0x100000000008100(slab|head) raw: 0100000000008100 ffff88002bfe82c0 0000000000000000 0000000100000001 raw: ffffea0000db4620 ffffea0000f47e20 ffff88003e802200 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88002bfeb580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88002bfeb600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88002bfeb680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88002bfeb700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88002bfeb780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================