================================================================== BUG: KASAN: slab-use-after-free in ptep_get include/linux/pgtable.h:495 [inline] BUG: KASAN: slab-use-after-free in filemap_map_folio_range mm/filemap.c:3829 [inline] BUG: KASAN: slab-use-after-free in filemap_map_pages+0x1cb2/0x2100 mm/filemap.c:3965 Read of size 8 at addr ffff8880276cbc00 by task syz-executor116/6049 CPU: 0 UID: 0 PID: 6049 Comm: syz-executor116 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x13d/0x4b0 mm/kasan/report.c:482 kasan_report+0xdf/0x1c0 mm/kasan/report.c:595 ptep_get include/linux/pgtable.h:495 [inline] filemap_map_folio_range mm/filemap.c:3829 [inline] filemap_map_pages+0x1cb2/0x2100 mm/filemap.c:3965 do_fault_around mm/memory.c:5958 [inline] do_read_fault mm/memory.c:5991 [inline] do_fault+0xa76/0x1830 mm/memory.c:6134 do_pte_missing mm/memory.c:4700 [inline] handle_pte_fault mm/memory.c:6558 [inline] __handle_mm_fault+0x150b/0x2f60 mm/memory.c:6707 handle_mm_fault+0x363/0xa20 mm/memory.c:6876 do_user_addr_fault+0x745/0x12f0 arch/x86/mm/fault.c:1394 handle_page_fault arch/x86/mm/fault.c:1483 [inline] exc_page_fault+0x6f/0xd0 arch/x86/mm/fault.c:1536 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595 RIP: 0010:fault_in_readable+0xde/0x190 mm/gup.c:2161 Code: 58 77 ac ff 4c 89 f0 48 85 c0 0f 85 bf 00 00 00 e8 67 7d ac ff 0f 01 cb 0f ae e8 4c 89 fb 4d 85 ff 75 31 eb 48 e8 52 7d ac ff <44> 8a 33 e8 4a 7d ac ff 48 81 c3 00 10 00 00 31 ff 48 81 e3 00 f0 RSP: 0018:ffffc900038afb00 EFLAGS: 00050293 RAX: 0000000000000000 RBX: 00007f1c49c00000 RCX: 0000000000000000 RDX: ffff888032fa2580 RSI: ffffffff825f59de RDI: ffff888032fa2580 RBP: 00007f1c49c00001 R08: 0000000000000006 R09: 00007f1c49c00001 R10: 00007f1c49c00000 R11: 0000000000000001 R12: 0000000000000001 R13: 1ffff92000715f61 R14: 0000000000000000 R15: 00007f1c49c00000 fault_in_iov_iter_readable+0x101/0x2c0 lib/iov_iter.c:106 generic_perform_write+0x863/0xa40 mm/filemap.c:4423 shmem_file_write_iter+0x10e/0x140 mm/shmem.c:3440 new_sync_write fs/read_write.c:595 [inline] vfs_write+0x6af/0x1050 fs/read_write.c:687 ksys_pwrite64 fs/read_write.c:794 [inline] __do_sys_pwrite64 fs/read_write.c:802 [inline] __se_sys_pwrite64 fs/read_write.c:799 [inline] __x64_sys_pwrite64+0x1eb/0x250 fs/read_write.c:799 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f1c4a0c7e5e Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08 RSP: 002b:00007f1c48bfd1a8 EFLAGS: 00000246 ORIG_RAX: 0000000000000012 RAX: ffffffffffffffda RBX: 00007f1c48bfd6c0 RCX: 00007f1c4a0c7e5e RDX: 0000000000000001 RSI: 00007f1c49c00000 RDI: 0000000000000003 RBP: 0000000000000021 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0 R13: 0000000000000000 R14: 00007ffc128a1a20 R15: 00007ffc128a1b08 Allocated by task 1442: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 unpoison_slab_object mm/kasan/common.c:340 [inline] __kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:366 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4683 [inline] slab_alloc_node mm/slub.c:4996 [inline] kmem_cache_alloc_noprof+0x269/0x6a0 mm/slub.c:5010 skb_clone+0x190/0x400 net/core/skbuff.c:2119 dev_queue_xmit_nit+0x255/0xa60 net/core/dev.c:2600 xmit_one net/core/dev.c:3933 [inline] dev_hard_start_xmit+0x2f5/0x760 net/core/dev.c:3953 sch_direct_xmit+0x1b2/0xc70 net/sched/sch_generic.c:372 __dev_xmit_skb net/core/dev.c:4262 [inline] __dev_queue_xmit+0x27ac/0x4970 net/core/dev.c:4884 dev_queue_xmit include/linux/netdevice.h:3461 [inline] tx+0xc4/0x130 drivers/block/aoe/aoenet.c:62 kthread+0x1d8/0x3c0 drivers/block/aoe/aoecmd.c:1241 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Freed by task 1442: kasan_save_stack+0x30/0x50 mm/kasan/common.c:57 kasan_save_track+0x14/0x30 mm/kasan/common.c:78 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2748 [inline] slab_free mm/slub.c:6499 [inline] kmem_cache_free+0x127/0x6c0 mm/slub.c:6626 kfree_skbmem+0x19a/0x210 net/core/skbuff.c:1145 __kfree_skb net/core/skbuff.c:1212 [inline] sk_skb_reason_drop+0x10f/0x1b0 net/core/skbuff.c:1250 packet_rcv+0x16c/0x17b0 net/packet/af_packet.c:2245 dev_queue_xmit_nit+0x6fc/0xa60 net/core/dev.c:2632 xmit_one net/core/dev.c:3933 [inline] dev_hard_start_xmit+0x2f5/0x760 net/core/dev.c:3953 sch_direct_xmit+0x1b2/0xc70 net/sched/sch_generic.c:372 __dev_xmit_skb net/core/dev.c:4262 [inline] __dev_queue_xmit+0x27ac/0x4970 net/core/dev.c:4884 dev_queue_xmit include/linux/netdevice.h:3461 [inline] tx+0xc4/0x130 drivers/block/aoe/aoenet.c:62 kthread+0x1d8/0x3c0 drivers/block/aoe/aoecmd.c:1241 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 The buggy address belongs to the object at ffff8880276cbb80 which belongs to the cache skbuff_head_cache of size 240 The buggy address is located 128 bytes inside of freed 240-byte region [ffff8880276cbb80, ffff8880276cbc70) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x276ca head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801cbfc280 dead000000000100 dead000000000122 raw: 0000000000000000 0000000200190019 00000000f5000000 0000000000000000 head: 00fff00000000040 ffff88801cbfc280 dead000000000100 dead000000000122 head: 0000000000000000 0000000200190019 00000000f5000000 0000000000000000 head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1442, tgid 1442 (aoe_tx0), ts 71548459530 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1871 prep_new_page mm/page_alloc.c:1879 [inline] get_page_from_freelist+0x110d/0x35b0 mm/page_alloc.c:3943 __alloc_frozen_pages_noprof+0x2eb/0x3300 mm/page_alloc.c:5436 alloc_slab_page mm/slub.c:3347 [inline] allocate_slab mm/slub.c:3462 [inline] new_slab+0xa9/0x6e0 mm/slub.c:3513 refill_objects+0xe3/0x410 mm/slub.c:7410 refill_sheaf mm/slub.c:2885 [inline] __pcs_replace_empty_main+0x35e/0x650 mm/slub.c:4774 alloc_from_pcs mm/slub.c:4850 [inline] slab_alloc_node mm/slub.c:4984 [inline] kmem_cache_alloc_noprof+0x4c4/0x6a0 mm/slub.c:5010 skb_clone+0x190/0x400 net/core/skbuff.c:2119 dev_queue_xmit_nit+0x255/0xa60 net/core/dev.c:2600 xmit_one net/core/dev.c:3933 [inline] dev_hard_start_xmit+0x2f5/0x760 net/core/dev.c:3953 sch_direct_xmit+0x1b2/0xc70 net/sched/sch_generic.c:372 __dev_xmit_skb net/core/dev.c:4262 [inline] __dev_queue_xmit+0x27ac/0x4970 net/core/dev.c:4884 dev_queue_xmit include/linux/netdevice.h:3461 [inline] tx+0xc4/0x130 drivers/block/aoe/aoenet.c:62 kthread+0x1d8/0x3c0 drivers/block/aoe/aoecmd.c:1241 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 page last free pid 1349 tgid 1349 ts 55026124153 stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] __free_pages_prepare mm/page_alloc.c:1418 [inline] __free_frozen_pages+0x79f/0x10f0 mm/page_alloc.c:2962 kasan_depopulate_vmalloc_pte+0x5d/0x80 mm/kasan/shadow.c:484 apply_to_pte_range mm/memory.c:3470 [inline] apply_to_pmd_range mm/memory.c:3514 [inline] apply_to_pud_range mm/memory.c:3550 [inline] apply_to_p4d_range mm/memory.c:3586 [inline] __apply_to_page_range+0xb1d/0x1520 mm/memory.c:3622 __kasan_release_vmalloc+0xd7/0xe0 mm/kasan/shadow.c:602 kasan_release_vmalloc include/linux/kasan.h:593 [inline] kasan_release_vmalloc_node mm/vmalloc.c:2306 [inline] purge_vmap_node+0x210/0xb40 mm/vmalloc.c:2328 __purge_vmap_area_lazy+0x90a/0xc00 mm/vmalloc.c:2418 drain_vmap_area_work+0x27/0x40 mm/vmalloc.c:2452 process_one_work+0xac7/0x1b10 kernel/workqueue.c:3387 process_scheduled_works kernel/workqueue.c:3470 [inline] worker_thread+0x5ef/0xe50 kernel/workqueue.c:3551 kthread+0x373/0x450 kernel/kthread.c:436 ret_from_fork+0x730/0xd60 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Memory state around the buggy address: ffff8880276cbb00: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc ffff8880276cbb80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8880276cbc00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc ^ ffff8880276cbc80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb ffff8880276cbd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== ---------------- Code disassembly (best guess): 0: 58 pop %rax 1: 77 ac ja 0xffffffaf 3: ff 4c 89 f0 decl -0x10(%rcx,%rcx,4) 7: 48 85 c0 test %rax,%rax a: 0f 85 bf 00 00 00 jne 0xcf 10: e8 67 7d ac ff call 0xffac7d7c 15: 0f 01 cb stac 18: 0f ae e8 lfence 1b: 4c 89 fb mov %r15,%rbx 1e: 4d 85 ff test %r15,%r15 21: 75 31 jne 0x54 23: eb 48 jmp 0x6d 25: e8 52 7d ac ff call 0xffac7d7c * 2a: 44 8a 33 mov (%rbx),%r14b <-- trapping instruction 2d: e8 4a 7d ac ff call 0xffac7d7c 32: 48 81 c3 00 10 00 00 add $0x1000,%rbx 39: 31 ff xor %edi,%edi 3b: 48 rex.W 3c: 81 .byte 0x81 3d: e3 00 jrcxz 0x3f 3f: f0 lock