================================================================== BUG: KASAN: slab-use-after-free in virtqueue_add+0x2200/0x2960 drivers/virtio/virtio_ring.c:2839 Read of size 4 at addr ffff888025a84648 by task syz-executor/5624 CPU: 0 UID: 0 PID: 5624 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description+0x55/0x1e0 mm/kasan/report.c:378 print_report+0x58/0x70 mm/kasan/report.c:482 kasan_report+0x117/0x150 mm/kasan/report.c:595 virtqueue_add+0x2200/0x2960 drivers/virtio/virtio_ring.c:2839 virtqueue_add_sgs+0x17f/0x1a0 drivers/virtio/virtio_ring.c:2878 __virtscsi_add_cmd drivers/scsi/virtio_scsi.c:475 [inline] virtscsi_add_cmd+0x4f2/0x660 drivers/scsi/virtio_scsi.c:509 virtscsi_queuecommand+0x6be/0xb80 drivers/scsi/virtio_scsi.c:606 scsi_dispatch_cmd drivers/scsi/scsi_lib.c:1671 [inline] scsi_queue_rq+0x188a/0x33a0 drivers/scsi/scsi_lib.c:1928 blk_mq_dispatch_rq_list+0x499/0x1990 block/blk-mq.c:2117 __blk_mq_do_dispatch_sched block/blk-mq-sched.c:168 [inline] blk_mq_do_dispatch_sched block/blk-mq-sched.c:182 [inline] __blk_mq_sched_dispatch_requests+0xd36/0x1580 block/blk-mq-sched.c:307 blk_mq_sched_dispatch_requests+0xd7/0x190 block/blk-mq-sched.c:329 blk_mq_run_hw_queue+0x404/0x4f0 block/blk-mq.c:2356 blk_mq_dispatch_list+0xd11/0xe10 include/linux/spinlock.h:-1 blk_mq_flush_plug_list+0x45f/0x540 block/blk-mq.c:2966 __blk_flush_plug+0x3ed/0x4d0 block/blk-core.c:1266 blk_finish_plug+0x5d/0x80 block/blk-core.c:1293 read_pages+0x3c2/0x5a0 mm/readahead.c:187 page_cache_ra_unbounded+0x425/0x9d0 mm/readahead.c:282 do_page_cache_ra mm/readahead.c:348 [inline] page_cache_ra_order+0xb47/0xee0 mm/readahead.c:558 do_sync_mmap_readahead+0x75e/0x990 mm/filemap.c:3428 filemap_fault+0x7d9/0x13b0 mm/filemap.c:3582 __do_fault+0x138/0x2a0 mm/memory.c:5425 do_read_fault mm/memory.c:5860 [inline] do_fault mm/memory.c:5994 [inline] do_pte_missing+0x2215/0x34b0 mm/memory.c:4566 handle_pte_fault mm/memory.c:6379 [inline] __handle_mm_fault mm/memory.c:6517 [inline] handle_mm_fault+0x1b36/0x3080 mm/memory.c:6686 do_user_addr_fault+0xa4d/0x1340 arch/x86/mm/fault.c:1343 handle_page_fault arch/x86/mm/fault.c:1483 [inline] exc_page_fault+0x6a/0xc0 arch/x86/mm/fault.c:1536 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:595 RIP: 0033:0x7f468b159195 Code: Unable to access opcode bytes at 0x7f468b15916b. RSP: 002b:00007fffeeaeaec0 EFLAGS: 00010202 RAX: 000000000000003d RBX: 0000555562e55500 RCX: 00007f468b159197 RDX: 0000000040000000 RSI: 00007fffeeaeaf1c RDI: ffffffffffffffff RBP: 00007fffeeaeaf1c R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000008 R13: 0000000000000003 R14: 00007fffeeaeb178 R15: 0000000000000000 Allocated by task 152: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __kmalloc_cache_noprof+0x32d/0x660 mm/slub.c:5489 _kmalloc_noprof include/linux/slab.h:988 [inline] _kzalloc_noprof include/linux/slab.h:1309 [inline] set_mm_walk mm/vmscan.c:3802 [inline] try_to_inc_max_seq+0x1f2/0x10e0 mm/vmscan.c:4023 try_to_shrink_lruvec+0xb0f/0xed0 mm/vmscan.c:4977 shrink_one+0x233/0x730 mm/vmscan.c:5024 shrink_many mm/vmscan.c:5087 [inline] lru_gen_shrink_node mm/vmscan.c:5165 [inline] shrink_node+0x3303/0x3b60 mm/vmscan.c:6154 shrink_zones mm/vmscan.c:6410 [inline] do_try_to_free_pages+0x6a3/0x1990 mm/vmscan.c:6472 try_to_free_pages+0x90a/0xe50 mm/vmscan.c:6711 __perform_reclaim mm/page_alloc.c:4405 [inline] __alloc_pages_direct_reclaim+0x148/0x310 mm/page_alloc.c:4427 __alloc_pages_slowpath+0x59d/0xcc0 mm/page_alloc.c:4876 __alloc_frozen_pages_noprof+0x31f/0x380 mm/page_alloc.c:5317 alloc_pages_mpol+0x212/0x380 mm/mempolicy.c:2490 alloc_frozen_pages_noprof mm/mempolicy.c:2561 [inline] alloc_pages_noprof+0xac/0x2a0 mm/mempolicy.c:2581 stack_depot_save_flags+0x735/0x800 lib/stackdepot.c:685 kasan_save_stack mm/kasan/common.c:58 [inline] kasan_save_track+0x4f/0x80 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5334 [inline] __kmalloc_noprof+0x375/0x720 mm/slub.c:5359 _kmalloc_noprof include/linux/slab.h:992 [inline] _kzalloc_noprof include/linux/slab.h:1309 [inline] vp_request_msix_vectors drivers/virtio/virtio_pci_common.c:141 [inline] vp_find_vqs_msix+0x4b8/0xd00 drivers/virtio/virtio_pci_common.c:414 vp_find_vqs+0xce/0x790 drivers/virtio/virtio_pci_common.c:531 virtio_find_vqs include/linux/virtio_config.h:298 [inline] virtnet_find_vqs drivers/net/virtio_net.c:6473 [inline] init_vqs+0xad6/0x11c0 drivers/net/virtio_net.c:6555 virtnet_restore_up drivers/net/virtio_net.c:5740 [inline] virtnet_restore+0x4b/0xb70 drivers/net/virtio_net.c:7202 virtio_device_restore_priv+0x381/0x690 drivers/virtio/virtio.c:633 dpm_run_callback+0x84/0x2a0 drivers/base/power/main.c:510 device_resume+0x8f7/0xa30 drivers/base/power/main.c:1178 async_resume+0x20/0x30 drivers/base/power/main.c:1201 async_run_entry_fn+0x9d/0x430 kernel/async.c:129 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Freed by task 152: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2677 [inline] slab_free mm/slub.c:6377 [inline] kfree+0x1c5/0x640 mm/slub.c:6692 lru_gen_shrink_node mm/vmscan.c:5170 [inline] shrink_node+0x370b/0x3b60 mm/vmscan.c:6154 shrink_zones mm/vmscan.c:6410 [inline] do_try_to_free_pages+0x6a3/0x1990 mm/vmscan.c:6472 try_to_free_pages+0x90a/0xe50 mm/vmscan.c:6711 __perform_reclaim mm/page_alloc.c:4405 [inline] __alloc_pages_direct_reclaim+0x148/0x310 mm/page_alloc.c:4427 __alloc_pages_slowpath+0x59d/0xcc0 mm/page_alloc.c:4876 __alloc_frozen_pages_noprof+0x31f/0x380 mm/page_alloc.c:5317 alloc_pages_mpol+0x212/0x380 mm/mempolicy.c:2490 alloc_frozen_pages_noprof mm/mempolicy.c:2561 [inline] alloc_pages_noprof+0xac/0x2a0 mm/mempolicy.c:2581 stack_depot_save_flags+0x735/0x800 lib/stackdepot.c:685 kasan_save_stack mm/kasan/common.c:58 [inline] kasan_save_track+0x4f/0x80 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5334 [inline] __kmalloc_noprof+0x375/0x720 mm/slub.c:5359 _kmalloc_noprof include/linux/slab.h:992 [inline] _kzalloc_noprof include/linux/slab.h:1309 [inline] vp_request_msix_vectors drivers/virtio/virtio_pci_common.c:141 [inline] vp_find_vqs_msix+0x4b8/0xd00 drivers/virtio/virtio_pci_common.c:414 vp_find_vqs+0xce/0x790 drivers/virtio/virtio_pci_common.c:531 virtio_find_vqs include/linux/virtio_config.h:298 [inline] virtnet_find_vqs drivers/net/virtio_net.c:6473 [inline] init_vqs+0xad6/0x11c0 drivers/net/virtio_net.c:6555 virtnet_restore_up drivers/net/virtio_net.c:5740 [inline] virtnet_restore+0x4b/0xb70 drivers/net/virtio_net.c:7202 virtio_device_restore_priv+0x381/0x690 drivers/virtio/virtio.c:633 dpm_run_callback+0x84/0x2a0 drivers/base/power/main.c:510 device_resume+0x8f7/0xa30 drivers/base/power/main.c:1178 async_resume+0x20/0x30 drivers/base/power/main.c:1201 async_run_entry_fn+0x9d/0x430 kernel/async.c:129 process_one_work kernel/workqueue.c:3322 [inline] process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 The buggy address belongs to the object at ffff888025a84600 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 72 bytes inside of freed 256-byte region [ffff888025a84600, ffff888025a84700) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x25a84 head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801b001b40 dead000000000100 dead000000000122 raw: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 head: 00fff00000000040 ffff88801b001b40 dead000000000100 dead000000000122 head: 0000000000000000 0000000800100010 00000000f5000000 0000000000000000 head: 00fff00000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000002 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 1, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 5963958113, free_ts 0 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859 prep_new_page mm/page_alloc.c:1867 [inline] get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946 __alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304 alloc_slab_page mm/slub.c:3266 [inline] allocate_slab+0x79/0x5e0 mm/slub.c:3380 new_slab mm/slub.c:3426 [inline] refill_objects+0x2d5/0x350 mm/slub.c:7310 refill_sheaf mm/slub.c:2804 [inline] __pcs_replace_empty_main+0x2bf/0x6b0 mm/slub.c:4675 alloc_from_pcs mm/slub.c:4773 [inline] slab_alloc_node mm/slub.c:4905 [inline] __kmalloc_cache_noprof+0x3a7/0x660 mm/slub.c:5485 _kmalloc_noprof include/linux/slab.h:988 [inline] _kzalloc_noprof include/linux/slab.h:1309 [inline] bus_add_driver+0x162/0x670 drivers/base/bus.c:747 driver_register+0x23a/0x320 drivers/base/driver.c:174 do_one_initcall+0x250/0x870 init/main.c:1347 do_initcall_level+0x10a/0x1a0 init/main.c:1409 do_initcalls+0x59/0xa0 init/main.c:1425 kernel_init_freeable+0x29d/0x3e0 init/main.c:1658 kernel_init+0x1d/0x1d0 init/main.c:1548 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 page_owner free stack trace missing Memory state around the buggy address: ffff888025a84500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888025a84580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888025a84600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888025a84680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888025a84700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================