==================================================================
BUG: KASAN: use-after-free in get_kprobe kernel/kprobes.c:372 [inline]
BUG: KASAN: use-after-free in register_kprobe kernel/kprobes.c:1710 [inline]
BUG: KASAN: use-after-free in register_kprobe+0x1021/0x1330 kernel/kprobes.c:1682
Read of size 8 at addr ffff88800e797828 by task syz-executor.5/21019

CPU: 1 PID: 21019 Comm: syz-executor.5 Not tainted 5.10.56 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:118
 print_address_description.constprop.0+0x1c/0x210 mm/kasan/report.c:385
 __kasan_report mm/kasan/report.c:545 [inline]
 kasan_report.cold+0x37/0x7c mm/kasan/report.c:562
 get_kprobe kernel/kprobes.c:372 [inline]
 register_kprobe kernel/kprobes.c:1710 [inline]
 register_kprobe+0x1021/0x1330 kernel/kprobes.c:1682
 __register_trace_kprobe kernel/trace/trace_kprobe.c:514 [inline]
 __register_trace_kprobe+0x262/0x2d0 kernel/trace/trace_kprobe.c:482
 create_local_trace_kprobe+0x1e6/0x3b0 kernel/trace/trace_kprobe.c:1833
 perf_kprobe_init+0x18c/0x280 kernel/trace/trace_event_perf.c:272
 perf_kprobe_event_init+0xf8/0x1c0 kernel/events/core.c:9595
 perf_try_init_event+0x130/0x570 kernel/events/core.c:10973
 perf_init_event kernel/events/core.c:11025 [inline]
 perf_event_alloc.part.0+0xd96/0x2b30 kernel/events/core.c:11303
 perf_event_alloc kernel/events/core.c:11682 [inline]
 __do_sys_perf_event_open+0x57c/0x2d00 kernel/events/core.c:11780
 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x466609
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f1e1b238188 EFLAGS: 00000246 ORIG_RAX: 000000000000012a
RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 0000000000466609
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020001d80
RBP: 00000000004bfcb9 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffffffffffff R11: 0000000000000246 R12: 000000000056bf80
R13: 00007ffc7a6d764f R14: 00007f1e1b238300 R15: 0000000000022000

Allocated by task 21019:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48
 kasan_set_track mm/kasan/common.c:56 [inline]
 __kasan_kmalloc.constprop.0+0xc2/0xd0 mm/kasan/common.c:461
 kmalloc include/linux/slab.h:552 [inline]
 kzalloc include/linux/slab.h:664 [inline]
 alloc_aggr_kprobe+0x41/0x190 kernel/kprobes.c:822
 try_to_optimize_kprobe kernel/kprobes.c:853 [inline]
 register_kprobe kernel/kprobes.c:1740 [inline]
 register_kprobe+0xb78/0x1330 kernel/kprobes.c:1682
 __register_trace_kprobe kernel/trace/trace_kprobe.c:514 [inline]
 __register_trace_kprobe+0x262/0x2d0 kernel/trace/trace_kprobe.c:482
 create_local_trace_kprobe+0x1e6/0x3b0 kernel/trace/trace_kprobe.c:1833
 perf_kprobe_init+0x18c/0x280 kernel/trace/trace_event_perf.c:272
 perf_kprobe_event_init+0xf8/0x1c0 kernel/events/core.c:9595
 perf_try_init_event+0x130/0x570 kernel/events/core.c:10973
 perf_init_event kernel/events/core.c:11025 [inline]
 perf_event_alloc.part.0+0xd96/0x2b30 kernel/events/core.c:11303
 perf_event_alloc kernel/events/core.c:11682 [inline]
 __do_sys_perf_event_open+0x57c/0x2d00 kernel/events/core.c:11780
 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Freed by task 18795:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48
 kasan_set_track+0x1c/0x30 mm/kasan/common.c:56
 kasan_set_free_info+0x1b/0x30 mm/kasan/generic.c:355
 __kasan_slab_free+0x110/0x150 mm/kasan/common.c:422
 slab_free_hook mm/slub.c:1542 [inline]
 slab_free_freelist_hook+0x64/0x150 mm/slub.c:1575
 slab_free mm/slub.c:3140 [inline]
 kfree+0xca/0x360 mm/slub.c:4116
 free_aggr_kprobe kernel/kprobes.c:434 [inline]
 do_free_cleaned_kprobes kernel/kprobes.c:586 [inline]
 kprobe_optimizer+0x56f/0x7e0 kernel/kprobes.c:624
 process_one_work+0x9a9/0x1590 kernel/workqueue.c:2270
 worker_thread+0x61d/0x1310 kernel/workqueue.c:2416
 kthread+0x38f/0x470 kernel/kthread.c:292
 ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:296

Last call_rcu():
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48
 kasan_record_aux_stack+0x9e/0xb0 mm/kasan/generic.c:346
 __call_rcu kernel/rcu/tree.c:2960 [inline]
 call_rcu+0x8a/0xa20 kernel/rcu/tree.c:3034
 neigh_parms_release net/core/neighbour.c:1670 [inline]
 neigh_parms_release+0x178/0x1d0 net/core/neighbour.c:1660
 inetdev_destroy net/ipv4/devinet.c:325 [inline]
 inetdev_event+0x1007/0x1550 net/ipv4/devinet.c:1599
 notifier_call_chain kernel/notifier.c:83 [inline]
 raw_notifier_call_chain+0xb3/0x110 kernel/notifier.c:410
 call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:2047
 call_netdevice_notifiers_extack net/core/dev.c:2059 [inline]
 call_netdevice_notifiers net/core/dev.c:2073 [inline]
 rollback_registered_many+0x83d/0x1270 net/core/dev.c:9540
 rollback_registered net/core/dev.c:9585 [inline]
 unregister_netdevice_queue+0x1fd/0x420 net/core/dev.c:10730
 unregister_netdevice include/linux/netdevice.h:2868 [inline]
 __tun_detach+0xfa8/0x1240 drivers/net/tun.c:681
 tun_detach drivers/net/tun.c:698 [inline]
 tun_chr_close+0xc4/0x180 drivers/net/tun.c:3445
 __fput+0x285/0x980 fs/file_table.c:281
 task_work_run+0xe2/0x1a0 kernel/task_work.c:151
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:164 [inline]
 exit_to_user_mode_prepare+0x155/0x160 kernel/entry/common.c:191
 syscall_exit_to_user_mode+0x38/0x230 kernel/entry/common.c:266
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

The buggy address belongs to the object at ffff88800e797800
 which belongs to the cache kmalloc-192 of size 192
The buggy address is located 40 bytes inside of
 192-byte region [ffff88800e797800, ffff88800e7978c0)
The buggy address belongs to the page:
page:0000000062583151 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xe797
flags: 0x100000000000200(slab)
raw: 0100000000000200 ffffea0000e1a980 0000000a0000000a ffff888007c41500
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88800e797700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88800e797780: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff88800e797800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                  ^
 ffff88800e797880: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
 ffff88800e797900: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
EXT4-fs (loop6): unsupported inode size: 0
EXT4-fs (loop6): blocksize: 2048
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 0 PID: 21033 Comm: syz-executor.0 Tainted: G    B             5.10.56 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:118
 fail_dump lib/fault-inject.c:52 [inline]
 should_fail.cold+0x5/0xa lib/fault-inject.c:146
 should_failslab+0x5/0x10 mm/slab_common.c:1193
 slab_pre_alloc_hook mm/slab.h:515 [inline]
 slab_alloc_node mm/slub.c:2814 [inline]
 slab_alloc mm/slub.c:2897 [inline]
 kmem_cache_alloc+0x5b/0x350 mm/slub.c:2902
 mem_pool_alloc mm/kmemleak.c:423 [inline]
 create_object.isra.0+0x3a/0xa20 mm/kmemleak.c:578
 kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
 slab_post_alloc_hook mm/slab.h:534 [inline]
 slab_alloc_node mm/slub.c:2889 [inline]
 slab_alloc mm/slub.c:2897 [inline]
 kmem_cache_alloc+0x159/0x350 mm/slub.c:2902
 getname_flags.part.0+0x50/0x4f0 fs/namei.c:138
 getname_flags include/linux/audit.h:320 [inline]
 getname+0x8e/0xd0 fs/namei.c:209
 do_sys_openat2+0xf5/0x420 fs/open.c:1174
 do_sys_open fs/open.c:1196 [inline]
 __do_sys_openat fs/open.c:1212 [inline]
 __se_sys_openat fs/open.c:1207 [inline]
 __x64_sys_openat+0x13f/0x1f0 fs/open.c:1207
 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x4196c4
Code: 84 00 00 00 00 00 44 89 54 24 0c e8 96 f9 ff ff 44 8b 54 24 0c 44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 89 44 24 0c e8 c8 f9 ff ff 8b 44
RSP: 002b:00007fb42e622ed0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00000000004afcc0 RCX: 00000000004196c4
RDX: 0000000000000002 RSI: 00007fb42e623000 RDI: 00000000ffffff9c
RBP: 00007fb42e623000 R08: 0000000000000000 R09: ffffffffffffffff
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000002
R13: 0000000000000004 R14: 0000000020000248 R15: 0000000000000003
EXT4-fs error (device loop4): ext4_fill_super:4954: inode #2: comm syz-executor.4: iget: root inode unallocated
EXT4-fs (loop4): get root inode failed
EXT4-fs (loop4): mount failed
EXT4-fs error (device loop0): ext4_fill_super:4954: inode #2: comm syz-executor.0: iget: root inode unallocated
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 0 PID: 21042 Comm: syz-executor.3 Tainted: G    B             5.10.56 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:118
 fail_dump lib/fault-inject.c:52 [inline]
 should_fail.cold+0x5/0xa lib/fault-inject.c:146
 should_failslab+0x5/0x10 mm/slab_common.c:1193
 slab_pre_alloc_hook mm/slab.h:515 [inline]
 slab_alloc_node mm/slub.c:2814 [inline]
 slab_alloc mm/slub.c:2897 [inline]
 kmem_cache_alloc+0x5b/0x350 mm/slub.c:2902
 xas_alloc+0x332/0x440 lib/xarray.c:374
 xas_expand lib/xarray.c:581 [inline]
 xas_create+0x607/0x1030 lib/xarray.c:652
EXT4-fs (loop0): get root inode failed
 xas_create_range+0x192/0x5c0 lib/xarray.c:716
EXT4-fs (loop0): mount failed
 shmem_add_to_page_cache+0x759/0x1150 mm/shmem.c:705
 shmem_getpage_gfp.constprop.0+0x646/0x1920 mm/shmem.c:1927
 shmem_getpage mm/shmem.c:155 [inline]
 shmem_write_begin+0xf7/0x1d0 mm/shmem.c:2529
 generic_perform_write+0x1fe/0x4d0 mm/filemap.c:3333
 __generic_file_write_iter+0x399/0x5d0 mm/filemap.c:3462
 generic_file_write_iter+0xd7/0x220 mm/filemap.c:3494
 call_write_iter include/linux/fs.h:1903 [inline]
 new_sync_write+0x42c/0x660 fs/read_write.c:518
 vfs_write+0x743/0xa20 fs/read_write.c:605
 ksys_pwrite64 fs/read_write.c:712 [inline]
 __do_sys_pwrite64 fs/read_write.c:722 [inline]
 __se_sys_pwrite64 fs/read_write.c:719 [inline]
 __x64_sys_pwrite64+0x1fd/0x250 fs/read_write.c:719
 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x419777
Code: 08 89 3c 24 48 89 4c 24 18 e8 e5 f8 ff ff 4c 8b 54 24 18 48 8b 54 24 10 41 89 c0 48 8b 74 24 08 8b 3c 24 b8 12 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 04 24 e8 15 f9 ff ff 48 8b
RSP: 002b:00007f8c5969df20 EFLAGS: 00000293 ORIG_RAX: 0000000000000012
RAX: ffffffffffffffda RBX: 00000000004afcc0 RCX: 0000000000419777
RDX: 000000000000001d RSI: 0000000020011600 RDI: 0000000000000004
RBP: 0000000000000004 R08: 0000000000000000 R09: ffffffffffffffff
R10: 0000000000002100 R11: 0000000000000293 R12: 0000000000000004
R13: 0000000000000004 R14: 0000000020000248 R15: 0000000000000003
EXT4-fs (loop3): warning: checktime reached, running e2fsck is recommended
EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue
------------[ cut here ]------------
WARNING: CPU: 1 PID: 21019 at kernel/kprobes.c:764 reuse_unused_kprobe kernel/kprobes.c:764 [inline]
WARNING: CPU: 1 PID: 21019 at kernel/kprobes.c:764 register_aggr_kprobe kernel/kprobes.c:1447 [inline]
WARNING: CPU: 1 PID: 21019 at kernel/kprobes.c:764 register_kprobe kernel/kprobes.c:1713 [inline]
WARNING: CPU: 1 PID: 21019 at kernel/kprobes.c:764 register_kprobe+0x1008/0x1330 kernel/kprobes.c:1682
Modules linked in:
CPU: 1 PID: 21019 Comm: syz-executor.5 Tainted: G    B             5.10.56 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
RIP: 0010:reuse_unused_kprobe kernel/kprobes.c:764 [inline]
RIP: 0010:register_aggr_kprobe kernel/kprobes.c:1447 [inline]
RIP: 0010:register_kprobe kernel/kprobes.c:1713 [inline]
RIP: 0010:register_kprobe+0x1008/0x1330 kernel/kprobes.c:1682
Code: 4d 89 6c 24 08 e8 58 64 ff ff 41 89 dc 48 b8 22 01 00 00 00 00 ad de 48 89 45 08 e8 c2 ef ed ff e9 5b f9 ff ff e8 38 64 ff ff <0f> 0b e9 9d fc ff ff 4c 89 ff e8 d9 95 2a 00 e9 99 f5 ff ff e8 cf
RSP: 0018:ffff8880462a7bd0 EFLAGS: 00010216
RAX: 000000000003904e RBX: ffff88800e797878 RCX: ffffc9000660a000
RDX: 0000000000040000 RSI: ffffffff81402218 RDI: ffff88800e797878
RBP: ffff88800c645018 R08: 0000000000000000 R09: ffffffff84ce8a47
R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000
R13: ffff88800c645028 R14: ffff88800e797870 R15: ffff88800e797800
FS:  00007f1e1b238700(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffcd5b47f10 CR3: 000000004e858000 CR4: 0000000000350ee0
Call Trace:
 __register_trace_kprobe kernel/trace/trace_kprobe.c:514 [inline]
 __register_trace_kprobe+0x262/0x2d0 kernel/trace/trace_kprobe.c:482
 create_local_trace_kprobe+0x1e6/0x3b0 kernel/trace/trace_kprobe.c:1833
 perf_kprobe_init+0x18c/0x280 kernel/trace/trace_event_perf.c:272
 perf_kprobe_event_init+0xf8/0x1c0 kernel/events/core.c:9595
 perf_try_init_event+0x130/0x570 kernel/events/core.c:10973
 perf_init_event kernel/events/core.c:11025 [inline]
 perf_event_alloc.part.0+0xd96/0x2b30 kernel/events/core.c:11303
 perf_event_alloc kernel/events/core.c:11682 [inline]
 __do_sys_perf_event_open+0x57c/0x2d00 kernel/events/core.c:11780
 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x466609
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f1e1b238188 EFLAGS: 00000246 ORIG_RAX: 000000000000012a
RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 0000000000466609
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000020001d80
RBP: 00000000004bfcb9 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffffffffffff R11: 0000000000000246 R12: 000000000056bf80
R13: 00007ffc7a6d764f R14: 00007f1e1b238300 R15: 0000000000022000
irq event stamp: 464
hardirqs last  enabled at (463): [<ffffffff83c5e3ff>] __raw_spin_unlock_irq include/linux/spinlock_api_smp.h:168 [inline]
hardirqs last  enabled at (463): [<ffffffff83c5e3ff>] _raw_spin_unlock_irq+0x1f/0x30 kernel/locking/spinlock.c:199
hardirqs last disabled at (464): [<ffffffff83c5e25b>] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline]
hardirqs last disabled at (464): [<ffffffff83c5e25b>] _raw_spin_lock_irqsave+0x4b/0x50 kernel/locking/spinlock.c:159
softirqs last  enabled at (460): [<ffffffff83e00f92>] asm_call_irq_on_stack+0x12/0x20
softirqs last disabled at (451): [<ffffffff83e00f92>] asm_call_irq_on_stack+0x12/0x20
---[ end trace fd2906d25c1f5bd8 ]---
EXT4-fs (loop6): unsupported inode size: 0
EXT4-fs (loop6): blocksize: 2048
FAULT_INJECTION: forcing a failure.
name fail_usercopy, interval 1, probability 0, space 0, times 0
CPU: 1 PID: 21057 Comm: syz-executor.4 Tainted: G    B   W         5.10.56 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:118
 fail_dump lib/fault-inject.c:52 [inline]
 should_fail.cold+0x5/0xa lib/fault-inject.c:146
 _copy_from_user+0x2e/0x1b0 lib/usercopy.c:14
 copy_from_user include/linux/uaccess.h:192 [inline]
 __do_sys_memfd_create+0x16d/0x450 mm/memfd.c:282
 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x466609
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fb945f49f48 EFLAGS: 00000246 ORIG_RAX: 000000000000013f
RAX: ffffffffffffffda RBX: 0000000020000200 RCX: 0000000000466609
RDX: 0000000000001000 RSI: 0000000000000000 RDI: 00000000004bee66
RBP: 0000000000000003 R08: 0000000000000800 R09: ffffffffffffffff
R10: 0000000000000003 R11: 0000000000000246 R12: 0000000008100000
R13: 0000000020000100 R14: 0000000000040000 R15: 0000000020001500
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 1 PID: 21056 Comm: syz-executor.0 Tainted: G    B   W         5.10.56 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:118
 fail_dump lib/fault-inject.c:52 [inline]
 should_fail.cold+0x5/0xa lib/fault-inject.c:146
 should_failslab+0x5/0x10 mm/slab_common.c:1193
 slab_pre_alloc_hook mm/slab.h:515 [inline]
 slab_alloc_node mm/slub.c:2814 [inline]
 slab_alloc mm/slub.c:2897 [inline]
 kmem_cache_alloc+0x5b/0x350 mm/slub.c:2902
 mem_pool_alloc mm/kmemleak.c:423 [inline]
 create_object.isra.0+0x3a/0xa20 mm/kmemleak.c:578
 kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
 slab_post_alloc_hook mm/slab.h:534 [inline]
 slab_alloc_node mm/slub.c:2889 [inline]
 slab_alloc mm/slub.c:2897 [inline]
 kmem_cache_alloc+0x159/0x350 mm/slub.c:2902
 getname_flags.part.0+0x50/0x4f0 fs/namei.c:138
 getname_flags include/linux/audit.h:320 [inline]
 getname+0x8e/0xd0 fs/namei.c:209
 do_sys_openat2+0xf5/0x420 fs/open.c:1174
 do_sys_open fs/open.c:1196 [inline]
 __do_sys_openat fs/open.c:1212 [inline]
 __se_sys_openat fs/open.c:1207 [inline]
 __x64_sys_openat+0x13f/0x1f0 fs/open.c:1207
 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x4196c4
Code: 84 00 00 00 00 00 44 89 54 24 0c e8 96 f9 ff ff 44 8b 54 24 0c 44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 89 44 24 0c e8 c8 f9 ff ff 8b 44
RSP: 002b:00007fb42e622ed0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00000000004afcc0 RCX: 00000000004196c4
RDX: 0000000000000002 RSI: 00007fb42e623000 RDI: 00000000ffffff9c
RBP: 00007fb42e623000 R08: 0000000000000000 R09: ffffffffffffffff
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000002
R13: 0000000000000004 R14: 0000000020000248 R15: 0000000000000003
EXT4-fs error (device loop0): ext4_fill_super:4954: inode #2: comm syz-executor.0: iget: root inode unallocated
EXT4-fs (loop0): get root inode failed
EXT4-fs (loop0): mount failed
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 1 PID: 21071 Comm: syz-executor.3 Tainted: G    B   W         5.10.56 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:118
 fail_dump lib/fault-inject.c:52 [inline]
 should_fail.cold+0x5/0xa lib/fault-inject.c:146
 should_failslab+0x5/0x10 mm/slab_common.c:1193
 slab_pre_alloc_hook mm/slab.h:515 [inline]
 slab_alloc_node mm/slub.c:2814 [inline]
 slab_alloc mm/slub.c:2897 [inline]
 kmem_cache_alloc+0x5b/0x350 mm/slub.c:2902
 mem_pool_alloc mm/kmemleak.c:423 [inline]
 create_object.isra.0+0x3a/0xa20 mm/kmemleak.c:578
 kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
 slab_post_alloc_hook mm/slab.h:534 [inline]
 slab_alloc_node mm/slub.c:2889 [inline]
 slab_alloc mm/slub.c:2897 [inline]
 kmem_cache_alloc+0x159/0x350 mm/slub.c:2902
 xas_alloc+0x332/0x440 lib/xarray.c:374
 xas_expand lib/xarray.c:581 [inline]
 xas_create+0x607/0x1030 lib/xarray.c:652
 xas_create_range+0x192/0x5c0 lib/xarray.c:716
 shmem_add_to_page_cache+0x759/0x1150 mm/shmem.c:705
 shmem_getpage_gfp.constprop.0+0x646/0x1920 mm/shmem.c:1927
 shmem_getpage mm/shmem.c:155 [inline]
 shmem_write_begin+0xf7/0x1d0 mm/shmem.c:2529
 generic_perform_write+0x1fe/0x4d0 mm/filemap.c:3333
 __generic_file_write_iter+0x399/0x5d0 mm/filemap.c:3462
 generic_file_write_iter+0xd7/0x220 mm/filemap.c:3494
 call_write_iter include/linux/fs.h:1903 [inline]
 new_sync_write+0x42c/0x660 fs/read_write.c:518
 vfs_write+0x743/0xa20 fs/read_write.c:605
 ksys_pwrite64 fs/read_write.c:712 [inline]
 __do_sys_pwrite64 fs/read_write.c:722 [inline]
 __se_sys_pwrite64 fs/read_write.c:719 [inline]
 __x64_sys_pwrite64+0x1fd/0x250 fs/read_write.c:719
 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x419777
Code: 08 89 3c 24 48 89 4c 24 18 e8 e5 f8 ff ff 4c 8b 54 24 18 48 8b 54 24 10 41 89 c0 48 8b 74 24 08 8b 3c 24 b8 12 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 04 24 e8 15 f9 ff ff 48 8b
RSP: 002b:00007f8c5969df20 EFLAGS: 00000293 ORIG_RAX: 0000000000000012
RAX: ffffffffffffffda RBX: 00000000004afcc0 RCX: 0000000000419777
RDX: 000000000000001d RSI: 0000000020011600 RDI: 0000000000000004
RBP: 0000000000000004 R08: 0000000000000000 R09: ffffffffffffffff
R10: 0000000000002100 R11: 0000000000000293 R12: 0000000000000004
R13: 0000000000000004 R14: 0000000020000248 R15: 0000000000000003
EXT4-fs (loop3): warning: checktime reached, running e2fsck is recommended
EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue
FAULT_INJECTION: forcing a failure.
name fail_usercopy, interval 1, probability 0, space 0, times 0
CPU: 1 PID: 21085 Comm: syz-executor.3 Tainted: G    B   W         5.10.56 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:118
 fail_dump lib/fault-inject.c:52 [inline]
 should_fail.cold+0x5/0xa lib/fault-inject.c:146
 copyin lib/iov_iter.c:155 [inline]
 iov_iter_copy_from_user_atomic+0x49b/0xc60 lib/iov_iter.c:1010
 generic_perform_write+0x26d/0x4d0 mm/filemap.c:3341
 __generic_file_write_iter+0x399/0x5d0 mm/filemap.c:3462
 generic_file_write_iter+0xd7/0x220 mm/filemap.c:3494
 call_write_iter include/linux/fs.h:1903 [inline]
 new_sync_write+0x42c/0x660 fs/read_write.c:518
 vfs_write+0x743/0xa20 fs/read_write.c:605
 ksys_pwrite64 fs/read_write.c:712 [inline]
 __do_sys_pwrite64 fs/read_write.c:722 [inline]
 __se_sys_pwrite64 fs/read_write.c:719 [inline]
 __x64_sys_pwrite64+0x1fd/0x250 fs/read_write.c:719
 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x419777
Code: 08 89 3c 24 48 89 4c 24 18 e8 e5 f8 ff ff 4c 8b 54 24 18 48 8b 54 24 10 41 89 c0 48 8b 74 24 08 8b 3c 24 b8 12 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 04 24 e8 15 f9 ff ff 48 8b
RSP: 002b:00007f8c5969df20 EFLAGS: 00000293 ORIG_RAX: 0000000000000012
RAX: ffffffffffffffda RBX: 00000000004afcc0 RCX: 0000000000419777
RDX: 000000000000001d RSI: 0000000020011600 RDI: 0000000000000004
RBP: 0000000000000004 R08: 0000000000000000 R09: ffffffffffffffff
R10: 0000000000002100 R11: 0000000000000293 R12: 0000000000000004
R13: 0000000000000004 R14: 0000000020000248 R15: 0000000000000003
EXT4-fs (loop3): warning: checktime reached, running e2fsck is recommended
EXT4-fs (loop3): mounted filesystem without journal. Opts: ,errors=continue
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 1 PID: 21092 Comm: syz-executor.0 Tainted: G    B   W         5.10.56 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:118
 fail_dump lib/fault-inject.c:52 [inline]
 should_fail.cold+0x5/0xa lib/fault-inject.c:146
 should_failslab+0x5/0x10 mm/slab_common.c:1193
 slab_pre_alloc_hook mm/slab.h:515 [inline]
 slab_alloc_node mm/slub.c:2814 [inline]
 slab_alloc mm/slub.c:2897 [inline]
 kmem_cache_alloc+0x5b/0x350 mm/slub.c:2902
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
 kmem_cache_zalloc include/linux/slab.h:654 [inline]
 __alloc_file+0x21/0x310 fs/file_table.c:101
 alloc_empty_file+0x6d/0x170 fs/file_table.c:151
 path_openat+0xde/0x26c0 fs/namei.c:3346
 do_filp_open+0x17e/0x3c0 fs/namei.c:3387
 do_sys_openat2+0x16d/0x420 fs/open.c:1180
 do_sys_open fs/open.c:1196 [inline]
 __do_sys_openat fs/open.c:1212 [inline]
 __se_sys_openat fs/open.c:1207 [inline]
 __x64_sys_openat+0x13f/0x1f0 fs/open.c:1207
 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x4196c4
Code: 84 00 00 00 00 00 44 89 54 24 0c e8 96 f9 ff ff 44 8b 54 24 0c 44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 89 44 24 0c e8 c8 f9 ff ff 8b 44
RSP: 002b:00007fb42e622ed0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00000000004afcc0 RCX: 00000000004196c4
RDX: 0000000000000002 RSI: 00007fb42e623000 RDI: 00000000ffffff9c
RBP: 00007fb42e623000 R08: 0000000000000000 R09: ffffffffffffffff
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000002
R13: 0000000000000004 R14: 0000000020000248 R15: 0000000000000003
CPU: 0 PID: 21095 Comm: syz-executor.4 Tainted: G    B   W         5.10.56 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:118
 fail_dump lib/fault-inject.c:52 [inline]
 should_fail.cold+0x5/0xa lib/fault-inject.c:146
 should_failslab+0x5/0x10 mm/slab_common.c:1193
 slab_pre_alloc_hook mm/slab.h:515 [inline]
 slab_alloc_node mm/slub.c:2814 [inline]
 slab_alloc mm/slub.c:2897 [inline]
 kmem_cache_alloc+0x5b/0x350 mm/slub.c:2902
 shmem_alloc_inode+0x18/0x40 mm/shmem.c:3827
 alloc_inode+0x63/0x230 fs/inode.c:234
 new_inode_pseudo fs/inode.c:930 [inline]
 new_inode+0x23/0x240 fs/inode.c:959
 shmem_get_inode+0x15e/0xbc0 mm/shmem.c:2289
 __shmem_file_setup mm/shmem.c:4195 [inline]
 __shmem_file_setup+0xb8/0x310 mm/shmem.c:4180
 __do_sys_memfd_create+0x271/0x450 mm/memfd.c:307
 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x466609
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fb945f49f48 EFLAGS: 00000246 ORIG_RAX: 000000000000013f
RAX: ffffffffffffffda RBX: 0000000020000200 RCX: 0000000000466609
RDX: 0000000000001000 RSI: 0000000000000000 RDI: 00000000004bee66
RBP: 0000000000000003 R08: 0000000000000800 R09: ffffffffffffffff
R10: 0000000000000003 R11: 0000000000000246 R12: 0000000008100000
R13: 0000000020000100 R14: 0000000000040000 R15: 0000000020001500
general protection fault, probably for non-canonical address 0xf423fc40e000092d: 0000 [#1] SMP KASAN NOPTI
KASAN: maybe wild-memory-access in range [0xa120020700004968-0xa12002070000496f]
CPU: 1 PID: 21081 Comm: syz-executor.5 Tainted: G    B   W         5.10.56 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
RIP: 0010:__hlist_del include/linux/list.h:838 [inline]
RIP: 0010:hlist_del_rcu include/linux/rculist.h:514 [inline]
RIP: 0010:__unregister_kprobe_top+0x3a3/0x550 kernel/kprobes.c:1859
Code: 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 ab 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 65 08 4c 89 e2 48 c1 ea 03 <80> 3c 02 00 0f 85 44 01 00 00 49 89 1c 24 48 85 db 74 28 e8 25 9b
RSP: 0018:ffff888042cc7ca8 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: ffff8880489a2bc0 RCX: ffffffff813fecae
RDX: 14240040e000092d RSI: 0000000000000008 RDI: ffff88800e797808
RBP: ffff88800e797800 R08: 0000000000000000 R09: ffffffff84e336a7
R10: 0000000000000000 R11: 0000000000000001 R12: a12002070000496b
R13: ffffffff813f97c0 R14: ffff88800e797870 R15: 0000000000000001
FS:  0000000002353400(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f6198b8b358 CR3: 000000004561c000 CR4: 0000000000350ee0
Call Trace:
 unregister_kprobes kernel/kprobes.c:1911 [inline]
 unregister_kprobes kernel/kprobes.c:1903 [inline]
 unregister_kprobe+0x26/0xc0 kernel/kprobes.c:1899
 __unregister_trace_kprobe+0x1a2/0x210 kernel/trace/trace_kprobe.c:526
 destroy_local_trace_kprobe+0xc8/0x170 kernel/trace/trace_kprobe.c:1856
 _free_event+0x159/0xc70 kernel/events/core.c:4887
 put_event kernel/events/core.c:4981 [inline]
 perf_event_release_kernel+0x899/0xc20 kernel/events/core.c:5096
 perf_release+0x33/0x40 kernel/events/core.c:5106
 __fput+0x285/0x980 fs/file_table.c:281
 task_work_run+0xe2/0x1a0 kernel/task_work.c:151
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:164 [inline]
 exit_to_user_mode_prepare+0x155/0x160 kernel/entry/common.c:191
 syscall_exit_to_user_mode+0x38/0x230 kernel/entry/common.c:266
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x4193eb
Code: 0f 05 48 3d 00 f0 ff ff 77 45 c3 0f 1f 40 00 48 83 ec 18 89 7c 24 0c e8 63 fc ff ff 8b 7c 24 0c 41 89 c0 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 44 89 c7 89 44 24 0c e8 a1 fc ff ff 8b 44
RSP: 002b:00007ffc7a6d76b0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000004 RCX: 00000000004193eb
RDX: 00000000005714d0 RSI: ffffffff83c45b5d RDI: 0000000000000003
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000001b2d6211a0
R10: 0000000000000923 R11: 0000000000000293 R12: 0000000000348b17
R13: 00000000000003e8 R14: 000000000056bf80 R15: 0000000000348af8
Modules linked in:
---[ end trace fd2906d25c1f5bd9 ]---
RIP: 0010:__hlist_del include/linux/list.h:838 [inline]
RIP: 0010:hlist_del_rcu include/linux/rculist.h:514 [inline]
RIP: 0010:__unregister_kprobe_top+0x3a3/0x550 kernel/kprobes.c:1859
Code: 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 ab 01 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 65 08 4c 89 e2 48 c1 ea 03 <80> 3c 02 00 0f 85 44 01 00 00 49 89 1c 24 48 85 db 74 28 e8 25 9b
RSP: 0018:ffff888042cc7ca8 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: ffff8880489a2bc0 RCX: ffffffff813fecae
RDX: 14240040e000092d RSI: 0000000000000008 RDI: ffff88800e797808
RBP: ffff88800e797800 R08: 0000000000000000 R09: ffffffff84e336a7
R10: 0000000000000000 R11: 0000000000000001 R12: a12002070000496b
R13: ffffffff813f97c0 R14: ffff88800e797870 R15: 0000000000000001
FS:  0000000002353400(0000) GS:ffff88806cf00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f6198b8b358 CR3: 000000004561c000 CR4: 0000000000350ee0
EXT4-fs (loop6): unsupported inode size: 0
EXT4-fs (loop6): blocksize: 2048
FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 0
CPU: 1 PID: 21102 Comm: syz-executor.3 Tainted: G    B D W         5.10.56 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.14.0-0-g155821a1990b-prebuilt.qemu.org 04/01/2014
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:118
 fail_dump lib/fault-inject.c:52 [inline]
 should_fail.cold+0x5/0xa lib/fault-inject.c:146
 should_failslab+0x5/0x10 mm/slab_common.c:1193
 slab_pre_alloc_hook mm/slab.h:515 [inline]
 slab_alloc_node mm/slub.c:2814 [inline]
 slab_alloc mm/slub.c:2897 [inline]
 kmem_cache_alloc+0x5b/0x350 mm/slub.c:2902
 getname_flags.part.0+0x50/0x4f0 fs/namei.c:138
 getname_flags include/linux/audit.h:320 [inline]
 getname+0x8e/0xd0 fs/namei.c:209
 do_sys_openat2+0xf5/0x420 fs/open.c:1174
 do_sys_open fs/open.c:1196 [inline]
 __do_sys_openat fs/open.c:1212 [inline]
 __se_sys_openat fs/open.c:1207 [inline]
 __x64_sys_openat+0x13f/0x1f0 fs/open.c:1207
 do_syscall_64+0x33/0x40 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x4196c4
Code: 84 00 00 00 00 00 44 89 54 24 0c e8 96 f9 ff ff 44 8b 54 24 0c 44 89 e2 48 89 ee 41 89 c0 bf 9c ff ff ff b8 01 01 00 00 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 89 44 24 0c e8 c8 f9 ff ff 8b 44
RSP: 002b:00007f8c5969ded0 EFLAGS: 00000293 ORIG_RAX: 0000000000000101
RAX: ffffffffffffffda RBX: 00000000004afcc0 RCX: 00000000004196c4
RDX: 0000000000000002 RSI: 00007f8c5969e000 RDI: 00000000ffffff9c
RBP: 00007f8c5969e000 R08: 0000000000000000 R09: ffffffffffffffff
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000002
R13: 0000000000000004 R14: 0000000020000260 R15: 0000000000000004