Warning: Permanently added '10.128.1.105' (ED25519) to the list of known hosts. 2024/06/14 15:06:37 ignoring optional flag "sandboxArg"="0" 2024/06/14 15:06:37 parsed 1 programs [ 53.433762][ T2673] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k 2024/06/14 15:06:41 executed programs: 0 [ 70.545642][ T5153] mmap: syz-executor.1 (5153) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. 2024/06/14 15:06:55 executed programs: 5 2024/06/14 15:07:00 executed programs: 62 2024/06/14 15:07:05 executed programs: 122 [ 82.078110][ T5614] ================================================================== [ 82.086299][ T5614] BUG: KASAN: slab-use-after-free in finish_fault+0x8b9/0xe90 [ 82.093778][ T5614] Read of size 8 at addr ffff888012eec000 by task syz-executor.0/5614 [ 82.101923][ T5614] [ 82.104256][ T5614] CPU: 1 PID: 5614 Comm: syz-executor.0 Not tainted 6.10.0-rc1-syzkaller #0 [ 82.112917][ T5614] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 82.122979][ T5614] Call Trace: [ 82.126253][ T5614] [ 82.129180][ T5614] dump_stack_lvl+0x108/0x280 [ 82.133851][ T5614] ? __pfx_dump_stack_lvl+0x10/0x10 [ 82.139045][ T5614] ? __pfx__printk+0x10/0x10 [ 82.143625][ T5614] ? __virt_addr_valid+0x141/0x260 [ 82.148731][ T5614] ? __virt_addr_valid+0x219/0x260 [ 82.153857][ T5614] print_report+0x169/0x550 [ 82.158452][ T5614] ? __virt_addr_valid+0x141/0x260 [ 82.163570][ T5614] ? __virt_addr_valid+0x219/0x260 [ 82.168671][ T5614] ? finish_fault+0x8b9/0xe90 [ 82.173335][ T5614] kasan_report+0x143/0x180 [ 82.177828][ T5614] ? finish_fault+0x8b9/0xe90 [ 82.182507][ T5614] finish_fault+0x8b9/0xe90 [ 82.186999][ T5614] ? __pfx_finish_fault+0x10/0x10 [ 82.192025][ T5614] ? __pfx_lock_release+0x10/0x10 [ 82.197043][ T5614] ? __do_fault+0x1a7/0x310 [ 82.201531][ T5614] __handle_mm_fault+0x142c/0x5b30 [ 82.206647][ T5614] ? __pfx___handle_mm_fault+0x10/0x10 [ 82.212094][ T5614] ? __pfx_lock_release+0x10/0x10 [ 82.217107][ T5614] ? do_raw_spin_unlock+0x13c/0x8b0 [ 82.222296][ T5614] ? follow_page_pte+0x1f8/0x12b0 [ 82.227309][ T5614] ? __pfx_follow_page_pte+0x10/0x10 [ 82.232585][ T5614] ? follow_page_mask+0xd8a/0x2090 [ 82.237686][ T5614] ? __pfx_follow_page_mask+0x10/0x10 [ 82.243046][ T5614] ? find_vma+0xca/0x130 [ 82.247285][ T5614] handle_mm_fault+0x122/0x470 [ 82.252048][ T5614] __get_user_pages+0x74f/0x1180 [ 82.256979][ T5614] ? __pfx___get_user_pages+0x10/0x10 [ 82.262345][ T5614] ? __pfx_mt_find+0x10/0x10 [ 82.266926][ T5614] populate_vma_page_range+0x1bc/0x260 [ 82.272374][ T5614] ? __pfx_populate_vma_page_range+0x10/0x10 [ 82.278348][ T5614] ? do_mmap+0x6b6/0xc20 [ 82.282578][ T5614] __mm_populate+0x21c/0x380 [ 82.287164][ T5614] ? __pfx___mm_populate+0x10/0x10 [ 82.292273][ T5614] __se_sys_remap_file_pages+0x681/0x850 [ 82.297894][ T5614] ? __pfx___se_sys_remap_file_pages+0x10/0x10 [ 82.304035][ T5614] ? __pfx___rseq_handle_notify_resume+0x10/0x10 [ 82.310612][ T5614] ? switch_fpu_return+0xce/0x140 [ 82.315633][ T5614] do_syscall_64+0x8d/0x170 [ 82.320125][ T5614] ? clear_bhb_loop+0x55/0xb0 [ 82.324786][ T5614] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.330680][ T5614] RIP: 0033:0x7f24c007cf69 [ 82.335092][ T5614] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 [ 82.354783][ T5614] RSP: 002b:00007f24c0dbd0c8 EFLAGS: 00000246 ORIG_RAX: 00000000000000d8 [ 82.363219][ T5614] RAX: ffffffffffffffda RBX: 00007f24c01b3f80 RCX: 00007f24c007cf69 [ 82.371188][ T5614] RDX: 0000000000000000 RSI: 0000000000200000 RDI: 00000000202ec000 [ 82.379155][ T5614] RBP: 00007f24c00da6fe R08: 0000000000000000 R09: 0000000000000000 [ 82.387123][ T5614] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 82.395088][ T5614] R13: 0000000000000006 R14: 00007f24c01b3f80 R15: 00007ffc2a631c08 [ 82.403068][ T5614] [ 82.406078][ T5614] [ 82.408395][ T5614] Allocated by task 5163: [ 82.412795][ T5614] kasan_save_track+0x3f/0x80 [ 82.417476][ T5614] __kasan_slab_alloc+0x66/0x80 [ 82.422314][ T5614] kmem_cache_alloc_noprof+0x12b/0x350 [ 82.427771][ T5614] vm_area_dup+0x5b/0x160 [ 82.432094][ T5614] __split_vma+0xfe/0xa30 [ 82.436411][ T5614] vma_modify+0x221/0x2e0 [ 82.440730][ T5614] mprotect_fixup+0x303/0x890 [ 82.445409][ T5614] do_mprotect_pkey+0x7ea/0xa80 [ 82.450253][ T5614] __x64_sys_mprotect+0x7b/0x90 [ 82.455098][ T5614] do_syscall_64+0x8d/0x170 [ 82.459594][ T5614] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.465651][ T5614] [ 82.467974][ T5614] Freed by task 5163: [ 82.471976][ T5614] kasan_save_track+0x3f/0x80 [ 82.476731][ T5614] kasan_save_free_info+0x40/0x50 [ 82.481744][ T5614] poison_slab_object+0xe0/0x150 [ 82.486679][ T5614] __kasan_slab_free+0x37/0x60 [ 82.491433][ T5614] kmem_cache_free+0x12c/0x3b0 [ 82.496187][ T5614] __vm_area_free+0x66/0x80 [ 82.500684][ T5614] exit_mmap+0x51d/0x950 [ 82.504916][ T5614] __mmput+0x9b/0x2d0 [ 82.508882][ T5614] exit_mm+0x114/0x1b0 [ 82.512963][ T5614] do_exit+0x7d5/0x2550 [ 82.517106][ T5614] do_group_exit+0x1ba/0x280 [ 82.521683][ T5614] __x64_sys_exit_group+0x3f/0x40 [ 82.526694][ T5614] do_syscall_64+0x8d/0x170 [ 82.531184][ T5614] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.537073][ T5614] [ 82.539387][ T5614] The buggy address belongs to the object at ffff888012eec000 [ 82.539387][ T5614] which belongs to the cache vma_lock of size 152 [ 82.553167][ T5614] The buggy address is located 0 bytes inside of [ 82.553167][ T5614] freed 152-byte region [ffff888012eec000, ffff888012eec098) [ 82.566775][ T5614] [ 82.569098][ T5614] The buggy address belongs to the physical page: [ 82.575516][ T5614] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888012eec288 pfn:0x12eec [ 82.585574][ T5614] memcg:ffff88800faaca01 [ 82.589804][ T5614] flags: 0xfff00000000200(workingset|node=0|zone=1|lastcpupid=0x7ff) [ 82.597865][ T5614] page_type: 0xfdffffff(slab) [ 82.602528][ T5614] raw: 00fff00000000200 ffff88800a2dbc80 ffffea0001f52110 ffffea0001e56d90 [ 82.611101][ T5614] raw: ffff888012eec288 0000000000120004 00000001fdffffff ffff88800faaca01 [ 82.619760][ T5614] page dumped because: kasan: bad access detected [ 82.626166][ T5614] page_owner tracks the page as allocated [ 82.631869][ T5614] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x152cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 1815, tgid 1815 (modprobe), ts 27904737408, free_ts 27801785634 [ 82.650691][ T5614] post_alloc_hook+0x10f/0x130 [ 82.655447][ T5614] get_page_from_freelist+0x2c3f/0x2cf0 [ 82.660988][ T5614] __alloc_pages_noprof+0x256/0x670 [ 82.666436][ T5614] alloc_slab_page+0x5f/0x120 [ 82.671104][ T5614] allocate_slab+0x5d/0x290 [ 82.675594][ T5614] ___slab_alloc+0xa7f/0x11d0 [ 82.680257][ T5614] kmem_cache_alloc_noprof+0x1eb/0x350 [ 82.685704][ T5614] vm_area_dup+0x5b/0x160 [ 82.690118][ T5614] __split_vma+0xfe/0xa30 [ 82.694435][ T5614] do_vmi_align_munmap+0x3b7/0x13c0 [ 82.699623][ T5614] do_vmi_munmap+0x1c4/0x230 [ 82.704205][ T5614] mmap_region+0x607/0x19a0 [ 82.708781][ T5614] do_mmap+0x6b6/0xc20 [ 82.712838][ T5614] vm_mmap_pgoff+0x1aa/0x320 [ 82.717415][ T5614] ksys_mmap_pgoff+0x2d2/0x3f0 [ 82.722167][ T5614] do_syscall_64+0x8d/0x170 [ 82.726659][ T5614] page last free pid 1802 tgid 1802 stack trace: [ 82.732974][ T5614] free_unref_page+0xb6f/0xca0 [ 82.737811][ T5614] __put_partials+0x18e/0x1d0 [ 82.742476][ T5614] put_cpu_partial+0x151/0x1b0 [ 82.747238][ T5614] __slab_free+0x2b8/0x3a0 [ 82.751647][ T5614] qlist_free_all+0x9e/0x140 [ 82.756221][ T5614] kasan_quarantine_reduce+0x14f/0x170 [ 82.761670][ T5614] __kasan_slab_alloc+0x23/0x80 [ 82.766506][ T5614] __kmalloc_noprof+0x182/0x440 [ 82.771341][ T5614] tomoyo_realpath_from_path+0xe3/0x4e0 [ 82.776881][ T5614] tomoyo_path_perm+0x282/0x8a0 [ 82.781808][ T5614] security_inode_getattr+0x84/0x100 [ 82.787080][ T5614] vfs_fstat+0x39/0x980 [ 82.791231][ T5614] __se_sys_newfstatat+0xc3/0x750 [ 82.796242][ T5614] do_syscall_64+0x8d/0x170 [ 82.800736][ T5614] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 82.806616][ T5614] [ 82.808942][ T5614] Memory state around the buggy address: [ 82.814559][ T5614] ffff888012eebf00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 82.822609][ T5614] ffff888012eebf80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 82.830658][ T5614] >ffff888012eec000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 82.838705][ T5614] ^ [ 82.842761][ T5614] ffff888012eec080: fb fb fb fc fc fc fc fc fc fc fc fa fb fb fb fb [ 82.850884][ T5614] ffff888012eec100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc [ 82.858941][ T5614] ================================================================== [ 82.867429][ T5614] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 82.874851][ T5614] Kernel Offset: disabled [ 82.879164][ T5614] Rebooting in 86400 seconds..