kasan_slab_alloc include/linux/kasan.h:250 [inline] slab_post_alloc_hook mm/slub.c:4161 [inline] slab_alloc_node mm/slub.c:4210 [inline] kmem_cache_alloc_noprof+0x1cb/0x3b0 mm/slub.c:4217 getname_flags.part.0+0x4c/0x550 fs/namei.c:146 getname_flags+0x93/0xf0 include/linux/audit.h:322 getname include/linux/fs.h:2852 [inline] do_sys_openat2+0xb8/0x1d0 fs/open.c:1423 do_sys_open fs/open.c:1444 [inline] __do_sys_openat fs/open.c:1460 [inline] __se_sys_openat fs/open.c:1455 [inline] __x64_sys_openat+0x174/0x210 fs/open.c:1455 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f ------------[ cut here ]------------ kernel BUG at mm/filemap.c:867! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 1 UID: 0 PID: 10609 Comm: syz.1.997 Not tainted 6.15.0-rc2-syzkaller-00488-g6fea5fabd332 #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 RIP: 0010:__filemap_add_folio+0xf53/0x11d0 mm/filemap.c:867 Code: 36 c9 ff 48 c7 c6 c0 e4 98 8b 4c 89 ef e8 a5 07 11 00 90 0f 0b e8 1d 36 c9 ff 48 c7 c6 20 e5 98 8b 4c 89 ef e8 8e 07 11 00 90 <0f> 0b e8 06 36 c9 ff 90 0f 0b 90 e9 f2 fb ff ff e8 f8 35 c9 ff 48 RSP: 0018:ffffc90003f9f328 EFLAGS: 00010246 RAX: 0000000000080000 RBX: 0000000000000002 RCX: ffffc9000b209000 RDX: 0000000000080000 RSI: ffffffff81f20932 RDI: ffff888034ed2244 RBP: 0000000000112cc0 R08: 0000000000000001 R09: 0000000000000001 R10: ffffffff90866917 R11: 0000000000000000 R12: 0000000000000004 R13: ffffea0001a0d200 R14: 0000000000000029 R15: 0000000000000002 FS: 00007f8ddeb886c0(0000) GS:ffff888124ab8000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fa90dae56c0 CR3: 0000000012474000 CR4: 0000000000350ef0 Call Trace: filemap_add_folio+0x10e/0x220 mm/filemap.c:969 ra_alloc_folio mm/readahead.c:448 [inline] page_cache_ra_order+0x586/0xd00 mm/readahead.c:509 do_sync_mmap_readahead mm/filemap.c:3262 [inline] filemap_fault+0x147c/0x2740 mm/filemap.c:3403 __do_fault+0x10d/0x490 mm/memory.c:5098 do_read_fault mm/memory.c:5518 [inline] do_fault mm/memory.c:5652 [inline] do_pte_missing+0x1031/0x3fb0 mm/memory.c:4160 handle_pte_fault mm/memory.c:5997 [inline] __handle_mm_fault+0x103d/0x2a40 mm/memory.c:6140 handle_mm_fault+0x3fe/0xad0 mm/memory.c:6309 do_user_addr_fault+0x7a6/0x1370 arch/x86/mm/fault.c:1388 handle_page_fault arch/x86/mm/fault.c:1480 [inline] exc_page_fault+0x5c/0xc0 arch/x86/mm/fault.c:1538 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 RIP: 0010:fault_in_readable+0x160/0x200 mm/gup.c:2241 Code: 42 e8 45 31 f6 e8 e0 16 b8 ff 48 39 eb 75 13 eb 2e e8 d4 16 b8 ff 48 81 c3 00 10 00 00 48 39 eb 74 1d e8 c3 16 b8 ff 45 89 f7 <8a> 03 31 ff 44 89 fe 88 44 24 28 e8 f0 11 b8 ff 45 85 ff 74 d2 e8 RSP: 0018:ffffc90003f9fb10 EFLAGS: 00050283 RAX: 0000000000045c8f RBX: 00002000000af000 RCX: ffffc9000b209000 RDX: 0000000000080000 RSI: ffffffff8203287d RDI: 0000000000000007 RBP: 00002000000b0000 R08: 0000000000000007 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000240 R13: 00002000000af000 R14: 0000000000000000 R15: 0000000000000000 fault_in_iov_iter_readable+0x101/0x2c0 lib/iov_iter.c:94 generic_perform_write+0x7b4/0x930 mm/filemap.c:4152 shmem_file_write_iter+0x10e/0x140 mm/shmem.c:3464 new_sync_write fs/read_write.c:591 [inline] vfs_write+0x5bd/0x1180 fs/read_write.c:684 ksys_write+0x12a/0x240 fs/read_write.c:736 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xcd/0x260 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f8dddd8e169 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f8ddeb88038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f8dddfb5fa0 RCX: 00007f8dddd8e169 RDX: 000000000208e24b RSI: 0000200000000240 RDI: 0000000000000005 RBP: 00007f8ddde10a68 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f8dddfb5fa0 R15: 00007ffe1fedcca8 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:__filemap_add_folio+0xf53/0x11d0 mm/filemap.c:867 Code: 36 c9 ff 48 c7 c6 c0 e4 98 8b 4c 89 ef e8 a5 07 11 00 90 0f 0b e8 1d 36 c9 ff 48 c7 c6 20 e5 98 8b 4c 89 ef e8 8e 07 11 00 90 <0f> 0b e8 06 36 c9 ff 90 0f 0b 90 e9 f2 fb ff ff e8 f8 35 c9 ff 48 RSP: 0018:ffffc90003f9f328 EFLAGS: 00010246 RAX: 0000000000080000 RBX: 0000000000000002 RCX: ffffc9000b209000 RDX: 0000000000080000 RSI: ffffffff81f20932 RDI: ffff888034ed2244 RBP: 0000000000112cc0 R08: 0000000000000001 R09: 0000000000000001 R10: ffffffff90866917 R11: 0000000000000000 R12: 0000000000000004 R13: ffffea0001a0d200 R14: 0000000000000029 R15: 0000000000000002 FS: 00007f8ddeb886c0(0000) GS:ffff888124ab8000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f5de92d3dc3 CR3: 0000000012474000 CR4: 0000000000350ef0 ---------------- Code disassembly (best guess): 0: 42 e8 45 31 f6 e8 rex.X call 0xe8f6314b 6: e0 16 loopne 0x1e 8: b8 ff 48 39 eb mov $0xeb3948ff,%eax d: 75 13 jne 0x22 f: eb 2e jmp 0x3f 11: e8 d4 16 b8 ff call 0xffb816ea 16: 48 81 c3 00 10 00 00 add $0x1000,%rbx 1d: 48 39 eb cmp %rbp,%rbx 20: 74 1d je 0x3f 22: e8 c3 16 b8 ff call 0xffb816ea 27: 45 89 f7 mov %r14d,%r15d * 2a: 8a 03 mov (%rbx),%al <-- trapping instruction 2c: 31 ff xor %edi,%edi 2e: 44 89 fe mov %r15d,%esi 31: 88 44 24 28 mov %al,0x28(%rsp) 35: e8 f0 11 b8 ff call 0xffb8122a 3a: 45 85 ff test %r15d,%r15d 3d: 74 d2 je 0x11 3f: e8 .byte 0xe8