kernel tried to execute NX-protected page - exploit attempt? (uid: 0) BUG: unable to handle page fault for address: ffff88801f7424c0 #PF: supervisor instruction fetch in kernel mode #PF: error_code(0x0011) - permissions violation PGD 1a001067 P4D 1a001067 PUD 1a002067 PMD 800000001f6001e3 Oops: Oops: 0011 [#1] SMP KASAN NOPTI CPU: 0 UID: 0 PID: 79 Comm: kswapd1 Not tainted syzkaller #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 RIP: 0010:0xffff88801f7424c0 Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <00> 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 RSP: 0018:ffffc90000007c98 EFLAGS: 00010046 RAX: ffffffff81ae1da9 RBX: 0000000000000100 RCX: ffff888032a38000 RDX: 0000000000000100 RSI: ffffffff8bc09540 RDI: ffffc9000e66f780 RBP: ffffc90000007d90 R08: ffffffff8f824277 R09: 1ffffffff1f0484e R10: dffffc0000000000 R11: ffff88801f7424c0 R12: 0000000000000000 R13: ffffc9000e66f780 R14: 1ffff92000000f98 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff88808d416000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff88801f7424c0 CR3: 0000000033253000 CR4: 0000000000352ef0 Call Trace: expire_timers kernel/time/timer.c:1794 [inline] __run_timers kernel/time/timer.c:2373 [inline] __run_timer_base+0x646/0x860 kernel/time/timer.c:2385 run_timer_base kernel/time/timer.c:2394 [inline] run_timer_softirq+0xb7/0x180 kernel/time/timer.c:2404 handle_softirqs+0x22b/0x7c0 kernel/softirq.c:622 __do_softirq kernel/softirq.c:656 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x60/0x150 kernel/softirq.c:723 irq_exit_rcu+0x9/0x30 kernel/softirq.c:739 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0010:lock_acquire+0x222/0x340 kernel/locking/lockdep.c:5872 Code: ff ff ff e8 30 a1 bd 09 f7 44 24 08 00 02 00 00 0f 84 3a ff ff ff 65 48 8b 05 3a b0 e2 10 48 3b 44 24 58 75 33 fb 48 83 c4 60 <5b> 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 48 8d 3d 57 97 e7 RSP: 0018:ffffc900012ce898 EFLAGS: 00000282 RAX: 80e1a4b471a2d900 RBX: 0000000000000000 RCX: 0000000000000046 RDX: 0000000045806afb RSI: ffffffff8d97c354 RDI: ffffffff8bc09560 RBP: ffffffff8173fd65 R08: ffffffff8173fd65 R09: ffffffff8df41aa0 R10: ffffc900012ce9f8 R11: ffffffff81acf3a0 R12: 0000000000000002 R13: ffffffff8df41aa0 R14: 0000000000000000 R15: 0000000000000246 rcu_lock_acquire include/linux/rcupdate.h:331 [inline] rcu_read_lock include/linux/rcupdate.h:867 [inline] class_rcu_constructor include/linux/rcupdate.h:1195 [inline] unwind_next_frame+0xc2/0x23d0 arch/x86/kernel/unwind_orc.c:495 arch_stack_walk+0x11c/0x150 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x9c/0xe0 kernel/stacktrace.c:122 save_stack+0xf5/0x1f0 mm/page_owner.c:165 __reset_page_owner+0x71/0x1f0 mm/page_owner.c:320 reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1395 [inline] free_unref_folios+0xdb3/0x14f0 mm/page_alloc.c:3000 shrink_folio_list+0x28df/0x5010 mm/vmscan.c:1534 evict_folios+0x473e/0x57f0 mm/vmscan.c:4711 try_to_shrink_lruvec+0x8a3/0xb50 mm/vmscan.c:4874 shrink_one+0x25c/0x720 mm/vmscan.c:4919 shrink_many mm/vmscan.c:4982 [inline] lru_gen_shrink_node mm/vmscan.c:5060 [inline] shrink_node+0x2f7d/0x35b0 mm/vmscan.c:6047 kswapd_shrink_node mm/vmscan.c:6901 [inline] balance_pgdat mm/vmscan.c:7084 [inline] kswapd+0x145a/0x2820 mm/vmscan.c:7354 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 Modules linked in: CR2: ffff88801f7424c0 ---[ end trace 0000000000000000 ]--- RIP: 0010:0xffff88801f7424c0 Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 <00> 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 RSP: 0018:ffffc90000007c98 EFLAGS: 00010046 RAX: ffffffff81ae1da9 RBX: 0000000000000100 RCX: ffff888032a38000 RDX: 0000000000000100 RSI: ffffffff8bc09540 RDI: ffffc9000e66f780 RBP: ffffc90000007d90 R08: ffffffff8f824277 R09: 1ffffffff1f0484e R10: dffffc0000000000 R11: ffff88801f7424c0 R12: 0000000000000000 R13: ffffc9000e66f780 R14: 1ffff92000000f98 R15: 0000000000000001 FS: 0000000000000000(0000) GS:ffff88808d416000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff88801f7424c0 CR3: 0000000033253000 CR4: 0000000000352ef0 ---------------- Code disassembly (best guess), 2 bytes skipped: * 28: 00 00 add %al,(%rax) <-- trapping instruction 2a: 08 00 or %al,(%rax)