[] free_pages_prepare mm/page_alloc.c:1402 [inline] [] __free_frozen_pages+0x4a6/0x1576 mm/page_alloc.c:2943 [] ___free_pages+0x156/0x1e4 mm/page_alloc.c:5291 [] __free_pages+0xe/0x16 mm/page_alloc.c:5329 ================================================================== BUG: KASAN: stack-out-of-bounds in walk_stackframe+0x4de/0x558 arch/riscv/kernel/stacktrace.c:88 Read of size 8 at addr ffff8f8002267300 by task kworker/0:1/5976 CPU: 0 UID: 0 PID: 5976 Comm: kworker/0:1 Not tainted syzkaller #0 PREEMPT Hardware name: riscv-virtio,qemu (DT) Workqueue: wg-crypt-wg1 wg_packet_decrypt_worker Call Trace: [] dump_backtrace+0x2e/0x3c arch/riscv/kernel/stacktrace.c:149 [] show_stack+0x30/0x3c arch/riscv/kernel/stacktrace.c:155 [] __dump_stack lib/dump_stack.c:94 [inline] [] dump_stack_lvl+0x12a/0x1a2 lib/dump_stack.c:120 [] print_address_description mm/kasan/report.c:378 [inline] [] print_report+0x28c/0x59e mm/kasan/report.c:482 [] kasan_report+0xf0/0x218 mm/kasan/report.c:595 [] __asan_report_load8_noabort+0x12/0x1a mm/kasan/report_generic.c:381 [] walk_stackframe+0x4de/0x558 arch/riscv/kernel/stacktrace.c:88 [] dump_backtrace+0x2e/0x3c arch/riscv/kernel/stacktrace.c:149 [] show_stack+0x30/0x3c arch/riscv/kernel/stacktrace.c:155 [] sched_show_task kernel/sched/core.c:7819 [inline] [] sched_show_task+0x460/0x61c kernel/sched/core.c:7794 [] show_state_filter+0xcc/0x302 kernel/sched/core.c:7864 [] show_state include/linux/sched/debug.h:21 [inline] [] fn_show_state+0x1a/0x22 drivers/tty/vt/keyboard.c:610 [] k_spec drivers/tty/vt/keyboard.c:662 [inline] [] k_spec+0x102/0x16c drivers/tty/vt/keyboard.c:651 [] kbd_keycode drivers/tty/vt/keyboard.c:1497 [inline] [] kbd_event+0x8d8/0x10e2 drivers/tty/vt/keyboard.c:1515 [] input_handle_events_default+0xfe/0x174 drivers/input/input.c:2541 [] input_pass_values+0x6f4/0x7f6 drivers/input/input.c:128 [] input_event_dispose drivers/input/input.c:353 [inline] [] input_handle_event+0x536/0x13e6 drivers/input/input.c:370 [] input_event drivers/input/input.c:396 [inline] [] input_event+0x9c/0xe6 drivers/input/input.c:391 [] hidinput_hid_event+0x870/0x2476 drivers/hid/hid-input.c:1747 [] hid_process_event+0x48a/0x59e drivers/hid/hid-core.c:1565 [] hid_input_array_field+0x49e/0x66e drivers/hid/hid-core.c:1677 [] hid_process_report drivers/hid/hid-core.c:1719 [inline] [] hid_report_raw_event+0xa50/0x1178 drivers/hid/hid-core.c:2074 [] __hid_input_report.constprop.0+0x2f6/0x426 drivers/hid/hid-core.c:2144 [] hid_input_report+0x32/0x44 drivers/hid/hid-core.c:2166 [] hid_irq_in+0x2f6/0x732 drivers/hid/usbhid/hid-core.c:286 [] __usb_hcd_giveback_urb+0x36e/0x61c drivers/usb/core/hcd.c:1661 [] usb_hcd_giveback_urb+0x364/0x3fe drivers/usb/core/hcd.c:1745 [] dummy_timer+0x134e/0x357e drivers/usb/gadget/udc/dummy_hcd.c:1995 [] __run_hrtimer kernel/time/hrtimer.c:1777 [inline] [] __hrtimer_run_queues+0x1bc/0xfaa kernel/time/hrtimer.c:1841 [] hrtimer_run_softirq+0x144/0x2f6 kernel/time/hrtimer.c:1858 [] handle_softirqs+0x4b6/0x1336 kernel/softirq.c:622 [] __do_softirq+0x12/0x1a kernel/softirq.c:656 [] ___do_softirq+0x18/0x20 arch/riscv/kernel/irq.c:119 [] call_on_irq_stack+0x32/0x40 arch/riscv/kernel/entry.S:361 The buggy address belongs to a 8-page vmalloc region starting at 0xffff8f8002260000 allocated at kernel_clone+0x128/0xdb0 kernel/fork.c:2651 The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x9c8b7 flags: 0xffe000000000000(node=0|zone=0|lastcpupid=0x7ff) raw: 0ffe000000000000 0000000000000000 ffff8d8000722dc8 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x29c2(GFP_NOWAIT|__GFP_HIGHMEM|__GFP_IO|__GFP_FS|__GFP_ZERO), pid 5184, tgid 5184 (syz-executor), ts 2546808491000, free_ts 2546799324200 __set_page_owner+0x94/0x4c4 mm/page_owner.c:341 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0xfc/0x1c4 mm/page_alloc.c:1846 prep_new_page mm/page_alloc.c:1854 [inline] get_page_from_freelist+0x8e0/0x36b0 mm/page_alloc.c:3915 __alloc_frozen_pages_noprof+0x22e/0x211a mm/page_alloc.c:5210 alloc_pages_mpol+0x1fa/0x5be mm/mempolicy.c:2486 alloc_frozen_pages_noprof+0x174/0x2f0 mm/mempolicy.c:2557 alloc_pages_noprof+0x20/0x48 mm/mempolicy.c:2577 vm_area_alloc_pages mm/vmalloc.c:3649 [inline] __vmalloc_area_node mm/vmalloc.c:3863 [inline] __vmalloc_node_range_noprof+0xea6/0x19ce mm/vmalloc.c:4051 __vmalloc_node_noprof+0x104/0x142 mm/vmalloc.c:4111 alloc_thread_stack_node kernel/fork.c:354 [inline] dup_task_struct kernel/fork.c:923 [inline] copy_process+0x6c4/0x748e kernel/fork.c:2052 kernel_clone+0x128/0xdb0 kernel/fork.c:2651 __do_sys_clone+0xfe/0x13e kernel/fork.c:2792 __se_sys_clone kernel/fork.c:2760 [inline] __riscv_sys_clone+0xa0/0x10e kernel/fork.c:2760 syscall_handler+0x94/0x118 arch/riscv/include/asm/syscall.h:112 do_trap_ecall_u+0x3d8/0x56c arch/riscv/kernel/traps.c:343 handle_exception+0x146/0x152 arch/riscv/kernel/entry.S:198 page last free pid 5186 tgid 5186 stack trace: __reset_page_owner+0x78/0x1ba mm/page_owner.c:320 reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1395 [inline] __free_frozen_pages+0x846/0x1576 mm/page_alloc.c:2943 free_frozen_pages+0xe/0x16 mm/page_alloc.c:2981 __free_slab+0xba/0x15c mm/slub.c:3317 free_slab+0x38/0x1ae mm/slub.c:3340 discard_slab mm/slub.c:3346 [inline] __put_partials+0x134/0x198 mm/slub.c:3886 put_cpu_partial+0x192/0x35c mm/slub.c:3961 __slab_free+0x268/0x29a mm/slub.c:5952 do_slab_free mm/slub.c:6616 [inline] ___cache_free+0x178/0x1b2 mm/slub.c:6735 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x76/0x146 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x158/0x1ba mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x5c/0x82 mm/kasan/common.c:349 kasan_slab_alloc include/linux/kasan.h:252 [inline] slab_post_alloc_hook mm/slub.c:4953 [inline] slab_alloc_node mm/slub.c:5263 [inline] __do_kmalloc_node mm/slub.c:5656 [inline] __kmalloc_noprof+0x25e/0x9e4 mm/slub.c:5669 kmalloc_noprof include/linux/slab.h:961 [inline] load_elf_phdrs+0x12a/0x23c fs/binfmt_elf.c:540 load_elf_binary+0x28c/0x5fc4 fs/binfmt_elf.c:869 search_binary_handler fs/exec.c:1669 [inline] exec_binprm fs/exec.c:1701 [inline] bprm_execve fs/exec.c:1753 [inline] bprm_execve+0x8b8/0x178a fs/exec.c:1729 Memory state around the buggy address: ffff8f8002267200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8f8002267280: f1 f1 f1 f1 00 f3 f3 f3 00 00 00 00 00 00 00 00 >ffff8f8002267300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ^ ffff8f8002267380: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8f8002267400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================