EXT4-fs (loop3): revision level too high, forcing read-only mode EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue ================================================================== BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline] BUG: KASAN: use-after-free in atomic_fetch_add_relaxed include/asm-generic/atomic-instrumented.h:142 [inline] BUG: KASAN: use-after-free in __refcount_add include/linux/refcount.h:193 [inline] BUG: KASAN: use-after-free in __refcount_inc include/linux/refcount.h:250 [inline] BUG: KASAN: use-after-free in refcount_inc include/linux/refcount.h:267 [inline] BUG: KASAN: use-after-free in get_task_struct include/linux/sched/task.h:104 [inline] BUG: KASAN: use-after-free in kthread_stop+0x76/0x610 kernel/kthread.c:616 Write of size 4 at addr ffff8880488a9960 by task syz-executor.3/434 CPU: 1 PID: 434 Comm: syz-executor.3 Not tainted 5.10.52 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x107/0x163 lib/dump_stack.c:118 print_address_description.constprop.0+0x1c/0x210 mm/kasan/report.c:385 __kasan_report mm/kasan/report.c:545 [inline] kasan_report.cold+0x37/0x7c mm/kasan/report.c:562 check_memory_region_inline mm/kasan/generic.c:186 [inline] check_memory_region+0xf9/0x1e0 mm/kasan/generic.c:192 instrument_atomic_read_write include/linux/instrumented.h:101 [inline] atomic_fetch_add_relaxed include/asm-generic/atomic-instrumented.h:142 [inline] __refcount_add include/linux/refcount.h:193 [inline] __refcount_inc include/linux/refcount.h:250 [inline] refcount_inc include/linux/refcount.h:267 [inline] get_task_struct include/linux/sched/task.h:104 [inline] kthread_stop+0x76/0x610 kernel/kthread.c:616 ext4_stop_mmpd+0x47/0xd0 fs/ext4/mmp.c:254 ext4_put_super+0x87c/0xf90 fs/ext4/super.c:1263 generic_shutdown_super+0x142/0x370 fs/super.c:464 kill_block_super+0x9d/0xf0 fs/super.c:1446 deactivate_locked_super+0x99/0x160 fs/super.c:335 deactivate_super+0xad/0xd0 fs/super.c:366 cleanup_mnt+0x396/0x500 fs/namespace.c:1118 task_work_run+0xe2/0x1a0 kernel/task_work.c:151 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop kernel/entry/common.c:164 [inline] exit_to_user_mode_prepare+0x155/0x160 kernel/entry/common.c:191 syscall_exit_to_user_mode+0x38/0x230 kernel/entry/common.c:266 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x467a67 Code: ff d0 48 89 c7 b8 3c 00 00 00 0f 05 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd4baf9848 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000118 RCX: 0000000000467a67 RDX: 00007ffd4baf991a RSI: 0000000000000002 RDI: 00007ffd4baf9910 RBP: 00007ffd4baf9910 R08: 00000000ffffffff R09: 00007ffd4baf96e0 R10: 000000000168db43 R11: 0000000000000246 R12: 00000000004bee70 R13: 00007ffd4bafa9e0 R14: 000000000168db00 R15: 00007ffd4bafaa20 Allocated by task 2: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48 kasan_set_track mm/kasan/common.c:56 [inline] __kasan_kmalloc.constprop.0+0xc2/0xd0 mm/kasan/common.c:461 slab_post_alloc_hook mm/slab.h:532 [inline] slab_alloc_node mm/slub.c:2889 [inline] kmem_cache_alloc_node+0x14b/0x370 mm/slub.c:2925 alloc_task_struct_node kernel/fork.c:170 [inline] dup_task_struct kernel/fork.c:860 [inline] copy_process+0x4380/0x6650 kernel/fork.c:1947 kernel_clone+0xe7/0xa20 kernel/fork.c:2465 kernel_thread+0xb5/0xf0 kernel/fork.c:2517 create_kthread kernel/kthread.c:315 [inline] kthreadd+0x4bb/0x710 kernel/kthread.c:658 ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:296 Freed by task 7349: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48 kasan_set_track+0x1c/0x30 mm/kasan/common.c:56 kasan_set_free_info+0x1b/0x30 mm/kasan/generic.c:355 __kasan_slab_free+0x110/0x150 mm/kasan/common.c:422 slab_free_hook mm/slub.c:1542 [inline] slab_free_freelist_hook+0x64/0x150 mm/slub.c:1575 slab_free mm/slub.c:3140 [inline] kmem_cache_free+0x97/0x2f0 mm/slub.c:3156 __put_task_struct+0x25a/0x3e0 kernel/fork.c:741 put_task_struct include/linux/sched/task.h:113 [inline] delayed_put_task_struct+0x1a4/0x2b0 kernel/exit.c:173 rcu_do_batch kernel/rcu/tree.c:2484 [inline] rcu_core+0x52d/0x1660 kernel/rcu/tree.c:2719 __do_softirq+0x1b8/0x867 kernel/softirq.c:298 Last call_rcu(): kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48 kasan_record_aux_stack+0x9e/0xb0 mm/kasan/generic.c:346 __call_rcu kernel/rcu/tree.c:2960 [inline] call_rcu+0x8a/0xa20 kernel/rcu/tree.c:3034 put_task_struct_rcu_user+0x7f/0xb0 kernel/exit.c:179 finish_task_switch+0x428/0x5d0 kernel/sched/core.c:3649 context_switch kernel/sched/core.c:3779 [inline] __schedule+0x850/0x1e80 kernel/sched/core.c:4525 preempt_schedule_common kernel/sched/core.c:4684 [inline] _cond_resched+0x45/0x80 kernel/sched/core.c:6117 slab_pre_alloc_hook mm/slab.h:513 [inline] slab_alloc_node mm/slub.c:2814 [inline] slab_alloc mm/slub.c:2897 [inline] kmem_cache_alloc+0x298/0x350 mm/slub.c:2902 mem_pool_alloc mm/kmemleak.c:423 [inline] create_object.isra.0+0x3a/0xa20 mm/kmemleak.c:578 kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline] slab_post_alloc_hook mm/slab.h:534 [inline] slab_alloc_node mm/slub.c:2889 [inline] slab_alloc mm/slub.c:2897 [inline] __kmalloc+0x16e/0x3e0 mm/slub.c:3958 kmalloc_array include/linux/slab.h:592 [inline] kcalloc include/linux/slab.h:603 [inline] ext4_find_extent+0xa39/0xd00 fs/ext4/extents.c:864 ext4_ext_map_blocks+0x1c8/0x5c10 fs/ext4/extents.c:4060 ext4_map_blocks+0x9a6/0x18d0 fs/ext4/inode.c:562 ext4_getblk+0x144/0x680 fs/ext4/inode.c:847 ext4_bread+0x29/0x210 fs/ext4/inode.c:899 ext4_append+0x15d/0x370 fs/ext4/namei.c:67 ext4_init_new_dir+0x25e/0x4d0 fs/ext4/namei.c:2766 ext4_mkdir+0x3c1/0xb10 fs/ext4/namei.c:2811 vfs_mkdir+0x41f/0x660 fs/namei.c:3641 do_mkdirat+0x145/0x2a0 fs/namei.c:3664 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Second to last call_rcu(): kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48 kasan_record_aux_stack+0x9e/0xb0 mm/kasan/generic.c:346 __call_rcu kernel/rcu/tree.c:2960 [inline] call_rcu+0x8a/0xa20 kernel/rcu/tree.c:3034 put_task_struct_rcu_user+0x7f/0xb0 kernel/exit.c:179 finish_task_switch+0x428/0x5d0 kernel/sched/core.c:3649 context_switch kernel/sched/core.c:3779 [inline] __schedule+0x850/0x1e80 kernel/sched/core.c:4525 preempt_schedule_common kernel/sched/core.c:4684 [inline] _cond_resched+0x45/0x80 kernel/sched/core.c:6117 inet_twsk_purge+0xed/0x7d0 net/ipv4/inet_timewait_sock.c:267 tcp_sk_exit_batch+0x1d/0xa0 net/ipv4/tcp_ipv4.c:2938 ops_exit_list+0x113/0x160 net/core/net_namespace.c:190 cleanup_net+0x484/0x8e0 net/core/net_namespace.c:604 process_one_work+0x9a9/0x1590 kernel/workqueue.c:2270 worker_thread+0x61d/0x1310 kernel/workqueue.c:2416 kthread+0x38f/0x470 kernel/kthread.c:292 ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:296 The buggy address belongs to the object at ffff8880488a9940 which belongs to the cache task_struct of size 6208 The buggy address is located 32 bytes inside of 6208-byte region [ffff8880488a9940, ffff8880488ab180) The buggy address belongs to the page: page:000000002955cbe9 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x488a8 head:000000002955cbe9 order:3 compound_mapcount:0 compound_pincount:0 flags: 0x100000000010200(slab|head) raw: 0100000000010200 0000000000000000 0000000400000001 ffff888007fdc140 raw: 0000000000000000 0000000000050005 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880488a9800: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff8880488a9880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff8880488a9900: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb ^ ffff8880488a9980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880488a9a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== ------------[ cut here ]------------ refcount_t: addition on 0; use-after-free. WARNING: CPU: 1 PID: 434 at lib/refcount.c:25 refcount_warn_saturate+0x178/0x1f0 lib/refcount.c:25 Modules linked in: CPU: 1 PID: 434 Comm: syz-executor.3 Tainted: G B 5.10.52 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 RIP: 0010:refcount_warn_saturate+0x178/0x1f0 lib/refcount.c:25 Code: 03 31 ff 89 de e8 58 22 51 ff 84 db 0f 85 2e ff ff ff e8 1b 29 51 ff 48 c7 c7 c0 37 3b 84 c6 05 3e 63 54 03 01 e8 57 0c c9 01 <0f> 0b e9 0f ff ff ff e8 fc 28 51 ff 0f b6 1d 28 63 54 03 31 ff 89 RSP: 0018:ffff888044247d38 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff888016de1940 RSI: ffffffff81293053 RDI: ffffed1008848f99 RBP: ffff8880488a9960 R08: 0000000000000001 R09: ffff88806cf1ff9b R10: 0000000000000000 R11: 0000000000000001 R12: ffff8880488a9960 R13: ffff88804c95c848 R14: 0000000000000000 R15: ffff88804c95c438 FS: 000000000168c400(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffd46bc0c58 CR3: 0000000015bd6000 CR4: 0000000000350ee0 Call Trace: __refcount_add include/linux/refcount.h:199 [inline] __refcount_inc include/linux/refcount.h:250 [inline] refcount_inc include/linux/refcount.h:267 [inline] get_task_struct include/linux/sched/task.h:104 [inline] kthread_stop+0x583/0x610 kernel/kthread.c:616 ext4_stop_mmpd+0x47/0xd0 fs/ext4/mmp.c:254 ext4_put_super+0x87c/0xf90 fs/ext4/super.c:1263 generic_shutdown_super+0x142/0x370 fs/super.c:464 kill_block_super+0x9d/0xf0 fs/super.c:1446 deactivate_locked_super+0x99/0x160 fs/super.c:335 deactivate_super+0xad/0xd0 fs/super.c:366 cleanup_mnt+0x396/0x500 fs/namespace.c:1118 task_work_run+0xe2/0x1a0 kernel/task_work.c:151 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop kernel/entry/common.c:164 [inline] exit_to_user_mode_prepare+0x155/0x160 kernel/entry/common.c:191 syscall_exit_to_user_mode+0x38/0x230 kernel/entry/common.c:266 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x467a67 Code: ff d0 48 89 c7 b8 3c 00 00 00 0f 05 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd4baf9848 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000118 RCX: 0000000000467a67 RDX: 00007ffd4baf991a RSI: 0000000000000002 RDI: 00007ffd4baf9910 RBP: 00007ffd4baf9910 R08: 00000000ffffffff R09: 00007ffd4baf96e0 R10: 000000000168db43 R11: 0000000000000246 R12: 00000000004bee70 R13: 00007ffd4bafa9e0 R14: 000000000168db00 R15: 00007ffd4bafaa20 irq event stamp: 654556 hardirqs last enabled at (654555): [] quarantine_put+0x87/0x1a0 mm/kasan/quarantine.c:217 hardirqs last disabled at (654556): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (654556): [] _raw_spin_lock_irqsave+0x4b/0x50 kernel/locking/spinlock.c:159 softirqs last enabled at (653818): [] asm_call_irq_on_stack+0x12/0x20 softirqs last disabled at (653655): [] asm_call_irq_on_stack+0x12/0x20 ---[ end trace d5caf37ac978fc0b ]--- FAT-fs (loop5): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1) ------------[ cut here ]------------ refcount_t: underflow; use-after-free. WARNING: CPU: 1 PID: 434 at lib/refcount.c:28 refcount_warn_saturate+0x103/0x1f0 lib/refcount.c:28 Modules linked in: CPU: 1 PID: 434 Comm: syz-executor.3 Tainted: G B W 5.10.52 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 RIP: 0010:refcount_warn_saturate+0x103/0x1f0 lib/refcount.c:28 Code: 1d d2 63 54 03 31 ff 89 de e8 c9 22 51 ff 84 db 75 a3 e8 90 29 51 ff 48 c7 c7 20 38 3b 84 c6 05 b2 63 54 03 01 e8 cc 0c c9 01 <0f> 0b eb 87 e8 74 29 51 ff 0f b6 1d 9b 63 54 03 31 ff 89 de e8 94 RSP: 0018:ffff888044247d38 EFLAGS: 00010286 RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: ffff888016de1940 RSI: ffffffff81293053 RDI: ffffed1008848f99 RBP: ffff8880488a9960 R08: 0000000000000001 R09: ffff88806cf1ff9b R10: 0000000000000000 R11: 0000000000000001 R12: ffff8880488a9960 R13: 0000000000000000 R14: 0000000000000000 R15: ffff88804c95c438 FS: 000000000168c400(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fdc06814050 CR3: 0000000015bd6000 CR4: 0000000000350ee0 Call Trace: __refcount_sub_and_test include/linux/refcount.h:283 [inline] __refcount_dec_and_test include/linux/refcount.h:315 [inline] refcount_dec_and_test include/linux/refcount.h:333 [inline] put_task_struct include/linux/sched/task.h:112 [inline] kthread_stop+0x56c/0x610 kernel/kthread.c:623 ext4_stop_mmpd+0x47/0xd0 fs/ext4/mmp.c:254 ext4_put_super+0x87c/0xf90 fs/ext4/super.c:1263 generic_shutdown_super+0x142/0x370 fs/super.c:464 kill_block_super+0x9d/0xf0 fs/super.c:1446 deactivate_locked_super+0x99/0x160 fs/super.c:335 deactivate_super+0xad/0xd0 fs/super.c:366 cleanup_mnt+0x396/0x500 fs/namespace.c:1118 task_work_run+0xe2/0x1a0 kernel/task_work.c:151 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop kernel/entry/common.c:164 [inline] exit_to_user_mode_prepare+0x155/0x160 kernel/entry/common.c:191 syscall_exit_to_user_mode+0x38/0x230 kernel/entry/common.c:266 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x467a67 Code: ff d0 48 89 c7 b8 3c 00 00 00 0f 05 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 0f 1f 44 00 00 b8 a6 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd4baf9848 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6 RAX: 0000000000000000 RBX: 0000000000000118 RCX: 0000000000467a67 RDX: 00007ffd4baf991a RSI: 0000000000000002 RDI: 00007ffd4baf9910 RBP: 00007ffd4baf9910 R08: 00000000ffffffff R09: 00007ffd4baf96e0 R10: 000000000168db43 R11: 0000000000000246 R12: 00000000004bee70 R13: 00007ffd4bafa9e0 R14: 000000000168db00 R15: 00007ffd4bafaa20 irq event stamp: 654556 hardirqs last enabled at (654555): [] quarantine_put+0x87/0x1a0 mm/kasan/quarantine.c:217 hardirqs last disabled at (654556): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (654556): [] _raw_spin_lock_irqsave+0x4b/0x50 kernel/locking/spinlock.c:159 softirqs last enabled at (653818): [] asm_call_irq_on_stack+0x12/0x20 softirqs last disabled at (653655): [] asm_call_irq_on_stack+0x12/0x20 ---[ end trace d5caf37ac978fc0c ]--- FAT-fs (loop5): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1) FAT-fs (loop5): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1) EXT4-fs (loop3): revision level too high, forcing read-only mode EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue FAT-fs (loop5): Invalid FSINFO signature: 0x00000000, 0x00000000 (sector = 1) EXT4-fs (loop3): revision level too high, forcing read-only mode EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue general protection fault, probably for non-canonical address 0x72c3ddfe220000: 0000 [#1] SMP KASAN NOPTI CPU: 1 PID: 97 Comm: systemd-journal Tainted: G B W 5.10.52 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 RIP: 0010:compound_head include/linux/page-flags.h:185 [inline] RIP: 0010:virt_to_head_page include/linux/mm.h:860 [inline] RIP: 0010:qlink_to_cache mm/kasan/quarantine.c:130 [inline] RIP: 0010:qlist_free_all+0x8d/0xd0 mm/kasan/quarantine.c:167 Code: df 48 85 db 75 cc 48 89 f0 4c 01 e8 72 56 4c 89 f2 48 2b 15 15 59 3a 03 48 01 d0 48 c1 e8 0c 48 c1 e0 06 48 03 05 f3 58 3a 03 <48> 8b 50 08 48 8d 4a ff 83 e2 01 48 0f 45 c1 48 8b 78 18 eb 93 49 RSP: 0018:ffff88800d547d28 EFLAGS: 00010207 RAX: 0072c3ddfe220000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000777f80000000 RSI: 1cb5ffff88800f96 RDI: 0000000000000000 RBP: dffffc0000000000 R08: 0000000000000004 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: ffff88800d547d60 R13: 0000000080000000 R14: ffffffff80000000 R15: 1cb5ffff88800f96 FS: 00007fdc095698c0(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2cc24000 CR3: 000000000ba38000 CR4: 0000000000350ee0 Call Trace: quarantine_reduce+0x180/0x200 mm/kasan/quarantine.c:267 __kasan_kmalloc.constprop.0+0x9e/0xd0 mm/kasan/common.c:442 slab_post_alloc_hook mm/slab.h:532 [inline] slab_alloc_node mm/slub.c:2889 [inline] slab_alloc mm/slub.c:2897 [inline] kmem_cache_alloc+0x13b/0x350 mm/slub.c:2902 getname_flags.part.0+0x50/0x4f0 fs/namei.c:138 getname_flags+0x9a/0xe0 include/linux/audit.h:320 getname fs/namei.c:209 [inline] user_path_create fs/namei.c:3516 [inline] do_mkdirat+0x8d/0x2a0 fs/namei.c:3656 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7fdc08825687 Code: 00 b8 ff ff ff ff c3 0f 1f 40 00 48 8b 05 09 d8 2b 00 64 c7 00 5f 00 00 00 b8 ff ff ff ff c3 0f 1f 40 00 b8 53 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d e1 d7 2b 00 f7 d8 64 89 01 48 RSP: 002b:00007ffec5251768 EFLAGS: 00000293 ORIG_RAX: 0000000000000053 RAX: ffffffffffffffda RBX: 00007ffec5254680 RCX: 00007fdc08825687 RDX: 00007fdc09296a00 RSI: 00000000000001ed RDI: 00005580aa8048d0 RBP: 00007ffec52517a0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000069 R11: 0000000000000293 R12: 0000000000000000 R13: 0000000000000000 R14: 00007ffec5254680 R15: 00007ffec5251c90 Modules linked in: ---[ end trace d5caf37ac978fc0d ]--- RIP: 0010:compound_head include/linux/page-flags.h:185 [inline] RIP: 0010:virt_to_head_page include/linux/mm.h:860 [inline] RIP: 0010:qlink_to_cache mm/kasan/quarantine.c:130 [inline] RIP: 0010:qlist_free_all+0x8d/0xd0 mm/kasan/quarantine.c:167 Code: df 48 85 db 75 cc 48 89 f0 4c 01 e8 72 56 4c 89 f2 48 2b 15 15 59 3a 03 48 01 d0 48 c1 e8 0c 48 c1 e0 06 48 03 05 f3 58 3a 03 <48> 8b 50 08 48 8d 4a ff 83 e2 01 48 0f 45 c1 48 8b 78 18 eb 93 49 RSP: 0018:ffff88800d547d28 EFLAGS: 00010207 RAX: 0072c3ddfe220000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000777f80000000 RSI: 1cb5ffff88800f96 RDI: 0000000000000000 RBP: dffffc0000000000 R08: 0000000000000004 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: ffff88800d547d60 R13: 0000000080000000 R14: ffffffff80000000 R15: 1cb5ffff88800f96 FS: 00007fdc095698c0(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b2cc24000 CR3: 000000000ba38000 CR4: 0000000000350ee0 general protection fault, probably for non-canonical address 0xdffffc0000002001: 0000 [#2] SMP KASAN NOPTI KASAN: probably user-memory-access in range [0x0000000000010008-0x000000000001000f] CPU: 1 PID: 7448 Comm: syz-executor.5 Tainted: G B D W 5.10.52 #1 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014 RIP: 0010:__rb_insert lib/rbtree.c:115 [inline] RIP: 0010:rb_insert_color+0x6d/0x7a0 lib/rbtree.c:436 Code: 48 89 d8 48 c1 e8 03 42 80 3c 28 00 0f 85 48 05 00 00 48 8b 2b 40 f6 c5 01 0f 85 81 01 00 00 48 8d 7d 08 48 89 f8 48 c1 e8 03 <42> 80 3c 28 00 0f 85 01 05 00 00 4c 8b 75 08 49 39 de 0f 84 6d 01 RSP: 0018:ffff88806cf09bf8 EFLAGS: 00010012 RAX: 0000000000002001 RBX: ffff8880488a99d0 RCX: ffff8880458fb300 RDX: 1ffff11002dbc98a RSI: ffff88806cf33270 RDI: 0000000000010008 RBP: 0000000000010000 R08: 00000000000002bb R09: ffff88806cf33250 R10: ffff888016de4c50 R11: 1ffff11001a4d33e R12: ffff88800d2699d0 R13: dffffc0000000000 R14: ffff8880459f6590 R15: ffff888016de4c40 FS: 00007fd7e13bb700(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055703d237fe8 CR3: 0000000048236000 CR4: 0000000000350ee0 Call Trace: rb_insert_color_cached include/linux/rbtree.h:141 [inline] __enqueue_entity kernel/sched/fair.c:601 [inline] enqueue_entity kernel/sched/fair.c:4273 [inline] enqueue_task_fair+0x4c7/0x2610 kernel/sched/fair.c:5538 enqueue_task kernel/sched/core.c:1570 [inline] activate_task kernel/sched/core.c:1589 [inline] ttwu_do_activate+0x17b/0x4b0 kernel/sched/core.c:2509 ttwu_queue kernel/sched/core.c:2699 [inline] try_to_wake_up+0x59c/0x1350 kernel/sched/core.c:2977 hrtimer_wakeup+0x43/0x60 kernel/time/hrtimer.c:1791 __run_hrtimer kernel/time/hrtimer.c:1537 [inline] __hrtimer_run_queues+0x5e8/0xb50 kernel/time/hrtimer.c:1601 hrtimer_interrupt+0x2fd/0x9b0 kernel/time/hrtimer.c:1663 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1084 [inline] __sysvec_apic_timer_interrupt+0xfb/0x400 arch/x86/kernel/apic/apic.c:1101 asm_call_irq_on_stack+0x12/0x20 __run_sysvec_on_irqstack arch/x86/include/asm/irq_stack.h:37 [inline] run_sysvec_on_irqstack_cond arch/x86/include/asm/irq_stack.h:89 [inline] sysvec_apic_timer_interrupt+0x7f/0xa0 arch/x86/kernel/apic/apic.c:1095 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:635 RIP: 0010:__preempt_count_sub arch/x86/include/asm/preempt.h:84 [inline] RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:161 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0x25/0x40 kernel/locking/spinlock.c:191 Code: 80 00 00 00 00 55 48 89 fd 48 83 c7 18 53 48 89 f3 48 8b 74 24 10 e8 2a c8 60 fd 48 89 ef e8 42 7e 61 fd f6 c7 02 75 0c 53 9d <65> ff 0d e4 1a 3c 7c 5b 5d c3 e8 1c ec 7f fd eb ed 66 2e 0f 1f 84 RSP: 0018:ffff88804bd67ab0 EFLAGS: 00000246 RAX: 0000000000000007 RBX: 0000000000000246 RCX: 1ffffffff0a8a147 RDX: 0000000000000000 RSI: ffffffff8145c091 RDI: ffffffff83c5d424 RBP: ffffffff84ea35e0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000dc0 R13: 0000000000000dc0 R14: 0000000000000110 R15: 0000000000000000 kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline] slab_post_alloc_hook mm/slab.h:534 [inline] slab_alloc_node mm/slub.c:2889 [inline] slab_alloc mm/slub.c:2897 [inline] kmem_cache_alloc_trace+0x151/0x360 mm/slub.c:2914 kmalloc include/linux/slab.h:552 [inline] kzalloc include/linux/slab.h:664 [inline] device_private_init drivers/base/core.c:2805 [inline] device_add+0x101c/0x1bc0 drivers/base/core.c:2855 wakeup_source_device_create+0x21c/0x2a0 drivers/base/power/wakeup_stats.c:161 wakeup_source_sysfs_add+0x1a/0x90 drivers/base/power/wakeup_stats.c:181 wakeup_source_register+0x99/0x130 drivers/base/power/wakeup.c:227 ep_create_wakeup_source+0x1c0/0x2b0 fs/eventpoll.c:1461 ep_modify fs/eventpoll.c:1647 [inline] do_epoll_ctl+0x203c/0x2ba0 fs/eventpoll.c:2255 __do_sys_epoll_ctl fs/eventpoll.c:2294 [inline] __se_sys_epoll_ctl fs/eventpoll.c:2285 [inline] __x64_sys_epoll_ctl+0x13f/0x1c0 fs/eventpoll.c:2285 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x466609 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd7e13bb188 EFLAGS: 00000246 ORIG_RAX: 00000000000000e9 RAX: ffffffffffffffda RBX: 000000000056c0f0 RCX: 0000000000466609 RDX: 0000000000000005 RSI: 0000000000000003 RDI: 0000000000000003 RBP: 00000000004bfcb9 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000020000000 R11: 0000000000000246 R12: 000000000056c0f0 R13: 00007ffc754a0f6f R14: 00007fd7e13bb300 R15: 0000000000022000 Modules linked in: ---[ end trace d5caf37ac978fc0e ]--- RIP: 0010:compound_head include/linux/page-flags.h:185 [inline] RIP: 0010:virt_to_head_page include/linux/mm.h:860 [inline] RIP: 0010:qlink_to_cache mm/kasan/quarantine.c:130 [inline] RIP: 0010:qlist_free_all+0x8d/0xd0 mm/kasan/quarantine.c:167 Code: df 48 85 db 75 cc 48 89 f0 4c 01 e8 72 56 4c 89 f2 48 2b 15 15 59 3a 03 48 01 d0 48 c1 e8 0c 48 c1 e0 06 48 03 05 f3 58 3a 03 <48> 8b 50 08 48 8d 4a ff 83 e2 01 48 0f 45 c1 48 8b 78 18 eb 93 49 RSP: 0018:ffff88800d547d28 EFLAGS: 00010207 RAX: 0072c3ddfe220000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 0000777f80000000 RSI: 1cb5ffff88800f96 RDI: 0000000000000000 RBP: dffffc0000000000 R08: 0000000000000004 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000001 R12: ffff88800d547d60 R13: 0000000080000000 R14: ffffffff80000000 R15: 1cb5ffff88800f96 FS: 00007fd7e13bb700(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055703d237fe8 CR3: 0000000048236000 CR4: 0000000000350ee0