================================================================== BUG: KASAN: stack-out-of-bounds in __lock_acquire+0x114/0x75f0 kernel/locking/lockdep.c:4942 Read of size 8 at addr ffff800024027618 by task syz-executor.4/12208 CPU: 1 PID: 12208 Comm: syz-executor.4 Not tainted 6.4.0-rc3-syzkaller-00024-geb0f1697d729 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023 Call trace: dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:233 show_stack+0x2c/0x44 arch/arm64/kernel/stacktrace.c:240 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd0/0x124 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:351 [inline] print_report+0x174/0x514 mm/kasan/report.c:462 kasan_report+0xd4/0x130 mm/kasan/report.c:572 __asan_report_load8_noabort+0x20/0x2c mm/kasan/report_generic.c:381 __lock_acquire+0x114/0x75f0 kernel/locking/lockdep.c:4942 lock_acquire+0x23c/0x71c kernel/locking/lockdep.c:5691 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x5c/0x7c kernel/locking/spinlock.c:162 down+0x3c/0xe8 kernel/locking/semaphore.c:59 xfs_buf_lock+0x178/0x624 fs/xfs/xfs_buf.c:1119 xfs_buf_delwri_submit_buffers+0x12c/0x87c fs/xfs/xfs_buf.c:2164 xfs_buf_delwri_submit+0xbc/0x244 fs/xfs/xfs_buf.c:2242 xfs_qm_shrink_scan+0x17c/0x35c fs/xfs/xfs_qm.c:522 do_shrink_slab+0x4d4/0x10a8 mm/vmscan.c:912 shrink_slab+0x1f8/0x970 mm/vmscan.c:1075 drop_slab_node mm/vmscan.c:1098 [inline] drop_slab+0x124/0x26c mm/vmscan.c:1116 drop_caches_sysctl_handler+0x178/0x394 fs/drop_caches.c:66 proc_sys_call_handler+0x4cc/0x7cc fs/proc/proc_sysctl.c:604 proc_sys_write+0x2c/0x3c fs/proc/proc_sysctl.c:630 do_iter_write+0x65c/0xa80 fs/read_write.c:860 vfs_iter_write+0x88/0xac fs/read_write.c:901 iter_file_splice_write+0x610/0xc40 fs/splice.c:795 do_splice_from fs/splice.c:873 [inline] direct_splice_actor+0xe4/0x1c0 fs/splice.c:1039 splice_direct_to_actor+0x3c4/0x944 fs/splice.c:994 do_splice_direct+0x1f4/0x334 fs/splice.c:1082 do_sendfile+0x4bc/0xc70 fs/read_write.c:1254 __do_sys_sendfile64 fs/read_write.c:1316 [inline] __se_sys_sendfile64 fs/read_write.c:1308 [inline] __arm64_sys_sendfile64+0x23c/0x3b4 fs/read_write.c:1308 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:193 el0_svc+0x4c/0x15c arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591 The buggy address belongs to the virtual mapping at [ffff800024020000, ffff800024029000) created by: copy_process+0x488/0x3514 kernel/fork.c:2333 The buggy address belongs to the physical page: page:000000005d40e509 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10bc60 memcg:ffff0000e9ada002 flags: 0x5ffc00000000000(node=0|zone=2|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 05ffc00000000000 0000000000000000 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff ffff0000e9ada002 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff800024027500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff800024027580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff800024027600: f3 f3 f3 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 ^ ffff800024027680: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 ffff800024027700: 00 00 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 ================================================================== Unable to handle kernel paging request at virtual address ffff800023aa9c58 KASAN: probably user-memory-access in range [0x000000011d54e2c0-0x000000011d54e2c7] Mem abort info: ESR = 0x0000000096000007 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x07: level 3 translation fault Data abort info: ISV = 0, ISS = 0x00000007, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0 swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000001b0232000 [ffff800023aa9c58] pgd=100000023ffff003, p4d=100000023ffff003, pud=100000023fffe003, pmd=100000010be4a003, pte=0000000000000000 Internal error: Oops: 0000000096000007 [#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 12208 Comm: syz-executor.4 Tainted: G B 6.4.0-rc3-syzkaller-00024-geb0f1697d729 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/28/2023 pstate: 804000c5 (Nzcv daIF +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : generic_test_bit include/asm-generic/bitops/generic-non-atomic.h:128 [inline] pc : __lock_acquire+0xc38/0x75f0 kernel/locking/lockdep.c:5044 lr : generic_test_bit include/asm-generic/bitops/generic-non-atomic.h:128 [inline] lr : __lock_acquire+0xc30/0x75f0 kernel/locking/lockdep.c:5044 sp : ffff800024116780 x29: ffff800024116a20 x28: 0000000000000002 x27: ffff0000db2c0000 x26: ffff0000db2c0a58 x25: 1fffe0001b65815a x24: ffff0000db2c0ad0 x23: ffff0000db2c0ab0 x22: 00000000000000c0 x21: 0000000000000000 x20: 0000000000000000 x19: ffff800023aa9c58 x18: ffff8000241165b8 x17: 0000000000000000 x16: ffff8000124340b0 x15: 0000000000000002 x14: 0000000000000001 x13: dfff800000000000 x12: dfff800000000000 x11: 0000000000080000 x10: ffff800019041780 x9 : ffff80001a28f310 x8 : 0000000000000001 x7 : 0000000000000001 x6 : 0000000000000001 x5 : ffff800024115f98 x4 : ffff800015f9e800 x3 : ffff8000083163ec x2 : 0000000000000000 x1 : 0000000000000008 x0 : 0000000000000000 Call trace: __lock_acquire+0xc38/0x75f0 kernel/locking/lockdep.c:5044 lock_acquire+0x23c/0x71c kernel/locking/lockdep.c:5691 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x5c/0x7c kernel/locking/spinlock.c:162 down+0x3c/0xe8 kernel/locking/semaphore.c:59 xfs_buf_lock+0x178/0x624 fs/xfs/xfs_buf.c:1119 xfs_buf_delwri_submit_buffers+0x12c/0x87c fs/xfs/xfs_buf.c:2164 xfs_buf_delwri_submit+0xbc/0x244 fs/xfs/xfs_buf.c:2242 xfs_qm_shrink_scan+0x17c/0x35c fs/xfs/xfs_qm.c:522 do_shrink_slab+0x4d4/0x10a8 mm/vmscan.c:912 shrink_slab+0x1f8/0x970 mm/vmscan.c:1075 drop_slab_node mm/vmscan.c:1098 [inline] drop_slab+0x124/0x26c mm/vmscan.c:1116 drop_caches_sysctl_handler+0x178/0x394 fs/drop_caches.c:66 proc_sys_call_handler+0x4cc/0x7cc fs/proc/proc_sysctl.c:604 proc_sys_write+0x2c/0x3c fs/proc/proc_sysctl.c:630 do_iter_write+0x65c/0xa80 fs/read_write.c:860 vfs_iter_write+0x88/0xac fs/read_write.c:901 iter_file_splice_write+0x610/0xc40 fs/splice.c:795 do_splice_from fs/splice.c:873 [inline] direct_splice_actor+0xe4/0x1c0 fs/splice.c:1039 splice_direct_to_actor+0x3c4/0x944 fs/splice.c:994 do_splice_direct+0x1f4/0x334 fs/splice.c:1082 do_sendfile+0x4bc/0xc70 fs/read_write.c:1254 __do_sys_sendfile64 fs/read_write.c:1316 [inline] __se_sys_sendfile64 fs/read_write.c:1308 [inline] __arm64_sys_sendfile64+0x23c/0x3b4 fs/read_write.c:1308 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x64/0x198 arch/arm64/kernel/syscall.c:193 el0_svc+0x4c/0x15c arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:591 Code: aa1303e0 941a0444 d2d0000d f2fbffed (f9400268) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: aa1303e0 mov x0, x19 4: 941a0444 bl 0x681114 8: d2d0000d mov x13, #0x800000000000 // #140737488355328 c: f2fbffed movk x13, #0xdfff, lsl #48 * 10: f9400268 ldr x8, [x19] <-- trapping instruction