general protection fault, probably for non-canonical address 0xdffffc0000000029: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000148-0x000000000000014f] CPU: 1 PID: 8292 Comm: syz-executor.7 Not tainted 5.10.52 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 RIP: 0010:io_sq_offload_start fs/io_uring.c:7995 [inline] RIP: 0010:io_disable_sqo_submit+0x1b1/0x230 fs/io_uring.c:8715 Code: e8 f4 01 bc ff 85 ed 0f 84 fc fe ff ff e8 77 08 bc ff 49 8d bd 48 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 64 49 8b ad 48 01 00 00 48 85 ed 0f 84 c9 fe ff ff RSP: 0018:ffff88803a317d70 EFLAGS: 00010212 RAX: dffffc0000000000 RBX: ffff8880453b4000 RCX: ffffc90008a06000 RDX: 0000000000000029 RSI: ffffffff81837cb9 RDI: 0000000000000148 RBP: 0000000000000002 R08: 0000000000000000 R09: ffff8880453b43c7 R10: 0000000000000000 R11: 0000000000000001 R12: ffff8880453b43c0 R13: 0000000000000000 R14: ffff8880453b4048 R15: ffff8880453b4000 FS: 00007fd1e9bbc700(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020001b00 CR3: 0000000016214000 CR4: 0000000000350ee0 Call Trace: io_uring_create fs/io_uring.c:9508 [inline] io_uring_setup+0x14e0/0x2ee0 fs/io_uring.c:9536 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x466609 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd1e9bbc108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 0000000000466609 RDX: 0000000020ff4000 RSI: 0000000020000180 RDI: 00000000000019e9 RBP: 0000000020000180 R08: 0000000020000280 R09: 0000000020000280 R10: 0000000020000240 R11: 0000000000000202 R12: 0000000020000280 R13: 0000000020ff4000 R14: 0000000020000240 R15: 0000000020fff000 Modules linked in: ---[ end trace 4bab8e1a125ea4e1 ]--- RIP: 0010:io_sq_offload_start fs/io_uring.c:7995 [inline] RIP: 0010:io_disable_sqo_submit+0x1b1/0x230 fs/io_uring.c:8715 Code: e8 f4 01 bc ff 85 ed 0f 84 fc fe ff ff e8 77 08 bc ff 49 8d bd 48 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 64 49 8b ad 48 01 00 00 48 85 ed 0f 84 c9 fe ff ff RSP: 0018:ffff88803a317d70 EFLAGS: 00010212 RAX: dffffc0000000000 RBX: ffff8880453b4000 RCX: ffffc90008a06000 RDX: 0000000000000029 RSI: ffffffff81837cb9 RDI: 0000000000000148 RBP: 0000000000000002 R08: 0000000000000000 R09: ffff8880453b43c7 R10: 0000000000000000 R11: 0000000000000001 R12: ffff8880453b43c0 R13: 0000000000000000 R14: ffff8880453b4048 R15: ffff8880453b4000 FS: 00007fd1e9bbc700(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000020001b00 CR3: 0000000016214000 CR4: 0000000000350ee0 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 PID: 8297 Comm: syz-executor.0 Tainted: G D 5.10.52 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x107/0x163 lib/dump_stack.c:118 fail_dump lib/fault-inject.c:52 [inline] should_fail.cold+0x5/0xa lib/fault-inject.c:146 should_failslab+0x5/0x10 mm/slab_common.c:1193 slab_pre_alloc_hook mm/slab.h:515 [inline] slab_alloc_node mm/slub.c:2814 [inline] kmem_cache_alloc_node+0x55/0x370 mm/slub.c:2925 __alloc_skb+0x6d/0x570 net/core/skbuff.c:198 alloc_skb include/linux/skbuff.h:1094 [inline] alloc_uevent_skb+0x7b/0x210 lib/kobject_uevent.c:290 uevent_net_broadcast_untagged lib/kobject_uevent.c:326 [inline] kobject_uevent_net_broadcast lib/kobject_uevent.c:409 [inline] kobject_uevent_env+0x996/0xf90 lib/kobject_uevent.c:593 loop_set_size drivers/block/loop.c:259 [inline] loop_configure+0x116b/0x1480 drivers/block/loop.c:1170 lo_ioctl+0xa6e/0x1760 drivers/block/loop.c:1695 __blkdev_driver_ioctl block/ioctl.c:237 [inline] blkdev_ioctl+0x28d/0x700 block/ioctl.c:632 block_ioctl+0xf9/0x140 fs/block_dev.c:1893 vfs_ioctl fs/ioctl.c:48 [inline] __do_sys_ioctl fs/ioctl.c:753 [inline] __se_sys_ioctl fs/ioctl.c:739 [inline] __x64_sys_ioctl+0x196/0x210 fs/ioctl.c:739 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x4663c7 Code: 3c 1c 48 f7 d8 49 39 c4 72 b8 e8 84 49 02 00 85 c0 78 bd 48 83 c4 08 4c 89 e0 5b 41 5c c3 0f 1f 44 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f130688df48 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00000000004afcc0 RCX: 00000000004663c7 RDX: 0000000000000004 RSI: 0000000000004c00 RDI: 0000000000000005 RBP: 0000000000000005 R08: 0000000000000000 R09: ffffffffffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 R13: 0000000000000004 R14: 00000000200006c0 R15: 0000000000000000 FAT-fs (loop0): bogus number of reserved sectors FAT-fs (loop0): Can't find a valid FAT filesystem EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue EXT4-fs (loop6): mounted filesystem without journal. Opts: ,errors=continue EXT4-fs error (device loop6): htree_dirblock_to_tree:1027: inode #2: block 13: comm syz-executor.6: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, name_len=0, size=1024 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 PID: 8327 Comm: syz-executor.0 Tainted: G D 5.10.52 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x107/0x163 lib/dump_stack.c:118 fail_dump lib/fault-inject.c:52 [inline] should_fail.cold+0x5/0xa lib/fault-inject.c:146 should_failslab+0x5/0x10 mm/slab_common.c:1193 slab_pre_alloc_hook mm/slab.h:515 [inline] slab_alloc_node mm/slub.c:2814 [inline] slab_alloc mm/slub.c:2897 [inline] kmem_cache_alloc+0x5b/0x350 mm/slub.c:2902 mem_pool_alloc mm/kmemleak.c:423 [inline] create_object.isra.0+0x3a/0xa20 mm/kmemleak.c:578 kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline] slab_post_alloc_hook mm/slab.h:534 [inline] slab_alloc_node mm/slub.c:2889 [inline] kmem_cache_alloc_node+0x169/0x370 mm/slub.c:2925 __alloc_skb+0x6d/0x570 net/core/skbuff.c:198 alloc_skb include/linux/skbuff.h:1094 [inline] alloc_uevent_skb+0x7b/0x210 lib/kobject_uevent.c:290 uevent_net_broadcast_untagged lib/kobject_uevent.c:326 [inline] kobject_uevent_net_broadcast lib/kobject_uevent.c:409 [inline] kobject_uevent_env+0x996/0xf90 lib/kobject_uevent.c:593 loop_set_size drivers/block/loop.c:259 [inline] loop_configure+0x116b/0x1480 drivers/block/loop.c:1170 lo_ioctl+0xa6e/0x1760 drivers/block/loop.c:1695 __blkdev_driver_ioctl block/ioctl.c:237 [inline] blkdev_ioctl+0x28d/0x700 block/ioctl.c:632 block_ioctl+0xf9/0x140 fs/block_dev.c:1893 vfs_ioctl fs/ioctl.c:48 [inline] __do_sys_ioctl fs/ioctl.c:753 [inline] __se_sys_ioctl fs/ioctl.c:739 [inline] __x64_sys_ioctl+0x196/0x210 fs/ioctl.c:739 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x4663c7 Code: 3c 1c 48 f7 d8 49 39 c4 72 b8 e8 84 49 02 00 85 c0 78 bd 48 83 c4 08 4c 89 e0 5b 41 5c c3 0f 1f 44 00 00 b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f130688df48 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00000000004afcc0 RCX: 00000000004663c7 RDX: 0000000000000004 RSI: 0000000000004c00 RDI: 0000000000000005 RBP: 0000000000000005 R08: 0000000000000000 R09: ffffffffffffffff R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000004 R13: 0000000000000004 R14: 00000000200006c0 R15: 0000000000000000 FAT-fs (loop0): bogus number of reserved sectors FAT-fs (loop0): Can't find a valid FAT filesystem EXT4-fs (loop4): mounted filesystem without journal. Opts: ,errors=continue EXT4-fs (loop6): mounted filesystem without journal. Opts: ,errors=continue EXT4-fs error (device loop4): htree_dirblock_to_tree:1027: inode #2: block 13: comm syz-executor.4: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, name_len=0, size=1024 EXT4-fs error (device loop6): htree_dirblock_to_tree:1027: inode #2: block 13: comm syz-executor.6: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, name_len=0, size=1024 EXT4-fs (loop1): mounted filesystem without journal. Opts: ,errors=continue EXT4-fs error (device loop1): htree_dirblock_to_tree:1027: inode #2: block 13: comm syz-executor.1: bad entry in directory: rec_len is smaller than minimal - offset=0, inode=0, rec_len=0, name_len=0, size=1024 general protection fault, probably for non-canonical address 0xdffffc0000000029: 0000 [#2] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000148-0x000000000000014f] CPU: 1 PID: 8301 Comm: syz-executor.7 Tainted: G D 5.10.52 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 RIP: 0010:io_sq_offload_start fs/io_uring.c:7995 [inline] RIP: 0010:io_disable_sqo_submit+0x1b1/0x230 fs/io_uring.c:8715 Code: e8 f4 01 bc ff 85 ed 0f 84 fc fe ff ff e8 77 08 bc ff 49 8d bd 48 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 64 49 8b ad 48 01 00 00 48 85 ed 0f 84 c9 fe ff ff RSP: 0018:ffff888045987d70 EFLAGS: 00010212 RAX: dffffc0000000000 RBX: ffff888023430000 RCX: ffffc90009a0e000 RDX: 0000000000000029 RSI: ffffffff81837cb9 RDI: 0000000000000148 RBP: 0000000000000002 R08: 0000000000000000 R09: ffff8880234303c7 R10: 0000000000000000 R11: 0000000000000001 R12: ffff8880234303c0 R13: 0000000000000000 R14: ffff888023430048 R15: ffff888023430000 FS: 00007fd1e9b9b700(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000561a247dcc38 CR3: 0000000016214000 CR4: 0000000000350ee0 Call Trace: io_uring_create fs/io_uring.c:9508 [inline] io_uring_setup+0x14e0/0x2ee0 fs/io_uring.c:9536 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x466609 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd1e9b9b108 EFLAGS: 00000202 ORIG_RAX: 00000000000001a9 RAX: ffffffffffffffda RBX: 000000000056c038 RCX: 0000000000466609 RDX: 0000000020ff4000 RSI: 0000000020000180 RDI: 00000000000019e9 RBP: 0000000020000180 R08: 0000000020000280 R09: 0000000020000280 R10: 0000000020000240 R11: 0000000000000202 R12: 0000000020000280 R13: 0000000020ff4000 R14: 0000000020000240 R15: 0000000020fff000 Modules linked in: ---[ end trace 4bab8e1a125ea4e2 ]--- RIP: 0010:io_sq_offload_start fs/io_uring.c:7995 [inline] RIP: 0010:io_disable_sqo_submit+0x1b1/0x230 fs/io_uring.c:8715 Code: e8 f4 01 bc ff 85 ed 0f 84 fc fe ff ff e8 77 08 bc ff 49 8d bd 48 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <80> 3c 02 00 75 64 49 8b ad 48 01 00 00 48 85 ed 0f 84 c9 fe ff ff RSP: 0018:ffff88803a317d70 EFLAGS: 00010212 RAX: dffffc0000000000 RBX: ffff8880453b4000 RCX: ffffc90008a06000 RDX: 0000000000000029 RSI: ffffffff81837cb9 RDI: 0000000000000148 RBP: 0000000000000002 R08: 0000000000000000 R09: ffff8880453b43c7 R10: 0000000000000000 R11: 0000000000000001 R12: ffff8880453b43c0 R13: 0000000000000000 R14: ffff8880453b4048 R15: ffff8880453b4000 FS: 00007fd1e9b9b700(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000561a247dcc38 CR3: 0000000016214000 CR4: 0000000000350ee0