FAULT_INJECTION: forcing a failure.
name failslab, interval 1, probability 0, space 0, times 1
CPU: 0 UID: 0 PID: 5318 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
fail_dump lib/fault-inject.c:73 [inline]
should_fail_ex+0x414/0x560 lib/fault-inject.c:174
should_failslab+0xa8/0x100 mm/failslab.c:46
slab_pre_alloc_hook mm/slub.c:4923 [inline]
slab_alloc_node mm/slub.c:5256 [inline]
__do_kmalloc_node mm/slub.c:5641 [inline]
__kmalloc_noprof+0xcb/0x7f0 mm/slub.c:5654
kmalloc_noprof include/linux/slab.h:961 [inline]
kzalloc_noprof include/linux/slab.h:1094 [inline]
tomoyo_encode2 security/tomoyo/realpath.c:45 [inline]
tomoyo_encode+0x28b/0x550 security/tomoyo/realpath.c:80
tomoyo_realpath_from_path+0x58d/0x5d0 security/tomoyo/realpath.c:283
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_number_perm+0x1e8/0x5a0 security/tomoyo/file.c:723
security_file_ioctl+0xcb/0x2d0 security/security.c:2982
__do_sys_ioctl fs/ioctl.c:591 [inline]
__se_sys_ioctl+0x47/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f14f6d8efc9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f14f7be7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f14f6fe5fa0 RCX: 00007f14f6d8efc9
RDX: 0000000000000000 RSI: 00000000400448ca RDI: 0000000000000006
RBP: 00007f14f7be7090 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007f14f6fe6038 R14: 00007f14f6fe5fa0 R15: 00007fff73dd9fb8
ERROR: Out of memory at tomoyo_realpath_from_path.
Oops: general protection fault, probably for non-canonical address 0xdffffc000000000b: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000058-0x000000000000005f]
CPU: 0 UID: 0 PID: 5318 Comm: syz.0.0 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
RIP: 0010:klist_put lib/klist.c:212 [inline]
RIP: 0010:klist_del lib/klist.c:230 [inline]
RIP: 0010:klist_remove+0x14a/0x340 lib/klist.c:249
Code: 4d 89 f5 49 c1 ed 03 43 80 7c 3d 00 00 74 08 4c 89 f7 e8 b9 87 e8 f6 4d 8b 26 49 83 e4 fe 49 8d 7c 24 58 48 89 f8 48 c1 e8 03 <42> 80 3c 38 00 74 05 e8 9a 87 e8 f6 49 8b 44 24 58 48 89 44 24 08
RSP: 0018:ffffc9000d347920 EFLAGS: 00010202
RAX: 000000000000000b RBX: ffff8880003da480 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000058
RBP: ffffc9000d347a20 R08: ffffffff8f63a603 R09: 1ffffffff1ec74c0
R10: dffffc0000000000 R11: fffffbfff1ec74c1 R12: 0000000000000000
R13: 1ffff11007d07d8c R14: ffff88803e83ec60 R15: dffffc0000000000
FS: 00007f14f7be76c0(0000) GS:ffff88808d733000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000558e8aab5670 CR3: 0000000034359000 CR4: 0000000000352ef0
Call Trace:
device_move+0x193/0x700 drivers/base/core.c:4615
hci_conn_del_sysfs+0xb8/0x170 net/bluetooth/hci_sysfs.c:75
hci_conn_cleanup net/bluetooth/hci_conn.c:173 [inline]
hci_conn_del+0xc33/0x11b0 net/bluetooth/hci_conn.c:1217
hci_conn_hash_flush+0x191/0x230 net/bluetooth/hci_conn.c:2610
hci_dev_close_sync+0xaef/0x1330 net/bluetooth/hci_sync.c:5308
hci_dev_do_close net/bluetooth/hci_core.c:501 [inline]
hci_dev_close+0x108/0x200 net/bluetooth/hci_core.c:526
sock_do_ioctl+0xdc/0x300 net/socket.c:1254
sock_ioctl+0x576/0x790 net/socket.c:1375
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f14f6d8efc9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f14f7be7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f14f6fe5fa0 RCX: 00007f14f6d8efc9
RDX: 0000000000000000 RSI: 00000000400448ca RDI: 0000000000000006
RBP: 00007f14f7be7090 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007f14f6fe6038 R14: 00007f14f6fe5fa0 R15: 00007fff73dd9fb8
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:klist_put lib/klist.c:212 [inline]
RIP: 0010:klist_del lib/klist.c:230 [inline]
RIP: 0010:klist_remove+0x14a/0x340 lib/klist.c:249
Code: 4d 89 f5 49 c1 ed 03 43 80 7c 3d 00 00 74 08 4c 89 f7 e8 b9 87 e8 f6 4d 8b 26 49 83 e4 fe 49 8d 7c 24 58 48 89 f8 48 c1 e8 03 <42> 80 3c 38 00 74 05 e8 9a 87 e8 f6 49 8b 44 24 58 48 89 44 24 08
RSP: 0018:ffffc9000d347920 EFLAGS: 00010202
RAX: 000000000000000b RBX: ffff8880003da480 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000004 RDI: 0000000000000058
RBP: ffffc9000d347a20 R08: ffffffff8f63a603 R09: 1ffffffff1ec74c0
R10: dffffc0000000000 R11: fffffbfff1ec74c1 R12: 0000000000000000
R13: 1ffff11007d07d8c R14: ffff88803e83ec60 R15: dffffc0000000000
FS: 00007f14f7be76c0(0000) GS:ffff88808d733000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f697e053286 CR3: 0000000034359000 CR4: 0000000000352ef0
----------------
Code disassembly (best guess):
0: 4d 89 f5 mov %r14,%r13
3: 49 c1 ed 03 shr $0x3,%r13
7: 43 80 7c 3d 00 00 cmpb $0x0,0x0(%r13,%r15,1)
d: 74 08 je 0x17
f: 4c 89 f7 mov %r14,%rdi
12: e8 b9 87 e8 f6 call 0xf6e887d0
17: 4d 8b 26 mov (%r14),%r12
1a: 49 83 e4 fe and $0xfffffffffffffffe,%r12
1e: 49 8d 7c 24 58 lea 0x58(%r12),%rdi
23: 48 89 f8 mov %rdi,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1) <-- trapping instruction
2f: 74 05 je 0x36
31: e8 9a 87 e8 f6 call 0xf6e887d0
36: 49 8b 44 24 58 mov 0x58(%r12),%rax
3b: 48 89 44 24 08 mov %rax,0x8(%rsp)