pci 0000:00:04.0: BAR 0 [io 0xc040-0xc07f]
pci 0000:00:04.0: BAR 1 [mem 0xfe801000-0xfe80107f]
pci 0000:00:04.0: BAR 1 [mem 0xc0000000-0xc000007f]: assigned
pci 0000:00:04.0: BAR 0 [io 0xc040-0xc07f]: assigned
==================================================================
BUG: KASAN: slab-use-after-free in acpi_ut_update_object_reference+0x33b/0x730 drivers/acpi/acpica/utdelete.c:544
Read of size 1 at addr ffff88810a2481a9 by task syz.3.213/1093
CPU: 1 UID: 0 PID: 1093 Comm: syz.3.213 Not tainted syzkaller #0 d3eed1e307a834e4006f99660f38f56e8d371643
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Call Trace:
__dump_stack+0x21/0x30 lib/dump_stack.c:94
dump_stack_lvl+0x140/0x1c0 lib/dump_stack.c:120
print_address_description+0x71/0x210 mm/kasan/report.c:377
print_report+0x4a/0x70 mm/kasan/report.c:481
kasan_report+0x162/0x1a0 mm/kasan/report.c:594
__asan_report_load1_noabort+0x18/0x20 mm/kasan/report_generic.c:378
acpi_ut_update_object_reference+0x33b/0x730 drivers/acpi/acpica/utdelete.c:544
acpi_ut_add_reference+0x3d/0x50 drivers/acpi/acpica/utdelete.c:694
acpi_ex_resolve_node_to_value+0x680/0x730 drivers/acpi/acpica/exresnte.c:-1
acpi_ns_evaluate+0x78b/0xa60 drivers/acpi/acpica/nseval.c:238
acpi_ut_evaluate_object+0x15a/0x5b0 drivers/acpi/acpica/uteval.c:60
acpi_rs_get_prt_method_data+0x96/0x110 drivers/acpi/acpica/rsutils.c:446
acpi_get_irq_routing_table+0xb8/0xe0 drivers/acpi/acpica/rsxface.c:137
acpi_pci_irq_find_prt_entry+0x164/0x1010 drivers/acpi/pci_irq.c:214
acpi_pci_irq_lookup+0x44/0x5a0 drivers/acpi/pci_irq.c:298
acpi_pci_irq_enable+0x1c2/0x5e0 drivers/acpi/pci_irq.c:413
pcibios_enable_device+0xe1/0x140 arch/x86/pci/common.c:699
do_pci_enable_device+0x1e0/0x3e0 drivers/pci/pci.c:2118
pci_enable_device_flags+0x45e/0x510 drivers/pci/pci.c:2203
pci_enable_device+0x1e/0xc0 drivers/pci/pci.c:2236
virtio_pci_probe+0x1ab/0x400 drivers/virtio/virtio_pci_common.c:702
local_pci_probe drivers/pci/pci-driver.c:335 [inline]
pci_call_probe drivers/pci/pci-driver.c:403 [inline]
__pci_device_probe drivers/pci/pci-driver.c:428 [inline]
pci_device_probe+0x282/0x440 drivers/pci/pci-driver.c:462
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x2e1/0x8b0 drivers/base/dd.c:657
__driver_probe_device+0x193/0x280 drivers/base/dd.c:799
driver_probe_device+0x54/0x3f0 drivers/base/dd.c:829
__device_attach_driver+0x2f1/0x4b0 drivers/base/dd.c:957
bus_for_each_drv+0x264/0x300 drivers/base/bus.c:459
__device_attach+0x2c4/0x3c0 drivers/base/dd.c:1029
device_attach+0x1b/0x40 drivers/base/dd.c:1072
pci_bus_add_device+0x11f/0x1f0 drivers/pci/bus.c:378
pci_bus_add_devices+0x98/0x1c0 drivers/pci/bus.c:401
pci_rescan_bus+0x30/0x40 drivers/pci/probe.c:3440
rescan_store+0xcd/0x150 drivers/pci/pci-sysfs.c:463
bus_attr_store+0x91/0xb0 drivers/base/bus.c:172
sysfs_kf_write+0x141/0x160 fs/sysfs/file.c:136
kernfs_fop_write_iter+0x316/0x510 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:591 [inline]
vfs_write+0x75f/0xfd0 fs/read_write.c:684
ksys_write+0x145/0x260 fs/read_write.c:737
__do_sys_write fs/read_write.c:749 [inline]
__se_sys_write fs/read_write.c:746 [inline]
__x64_sys_write+0x7f/0x90 fs/read_write.c:746
x64_sys_call+0x271c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:2
do_syscall_x64 arch/x86/entry/common.c:47 [inline]
do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f420719e199
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f4207fa8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f4207426090 RCX: 00007f420719e199
RDX: 000000000000001e RSI: 0000200000000600 RDI: 0000000000000009
RBP: 00007f42072358e0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f4207426128 R14: 00007f4207426090 R15: 00007fff025eaac8
Allocated by task 1:
kasan_save_stack mm/kasan/common.c:49 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:70
kasan_save_alloc_info+0x3a/0x50 mm/kasan/generic.c:565
unpoison_slab_object mm/kasan/common.c:321 [inline]
__kasan_slab_alloc+0x73/0x90 mm/kasan/common.c:347
kasan_slab_alloc include/linux/kasan.h:251 [inline]
slab_post_alloc_hook mm/slub.c:4202 [inline]
slab_alloc_node mm/slub.c:4251 [inline]
kmem_cache_alloc_noprof+0x1bf/0x410 mm/slub.c:4260
acpi_ut_allocate_object_desc_dbg+0xf2/0x270 drivers/acpi/acpica/utobject.c:359
acpi_ut_create_internal_object_dbg+0x2a/0x290 drivers/acpi/acpica/utobject.c:69
acpi_ds_build_internal_package_obj+0x18e/0xc20 drivers/acpi/acpica/dspkginit.c:92
acpi_ds_eval_data_object_operands+0x2e3/0x530 drivers/acpi/acpica/dsopcode.c:638
acpi_ds_exec_end_op+0xbd5/0x1210 drivers/acpi/acpica/dswexec.c:-1
acpi_ps_parse_loop+0xc83/0x1ac0 drivers/acpi/acpica/psloop.c:525
acpi_ps_parse_aml+0x218/0x9b0 drivers/acpi/acpica/psparse.c:475
acpi_ps_execute_table+0x336/0x420 drivers/acpi/acpica/psxface.c:295
acpi_ns_execute_table+0x396/0x670 drivers/acpi/acpica/nsparse.c:116
acpi_ns_parse_table+0x21/0x30 drivers/acpi/acpica/nsparse.c:268
acpi_ns_load_table+0x6f/0x130 drivers/acpi/acpica/nsload.c:71
acpi_tb_load_namespace+0x290/0x6d0 drivers/acpi/acpica/tbxfload.c:158
acpi_load_tables+0x4b/0x100 drivers/acpi/acpica/tbxfload.c:59
acpi_bus_init+0x8e/0x700 drivers/acpi/bus.c:1343
acpi_init+0xc5/0x23b drivers/acpi/bus.c:1454
do_one_initcall+0x1e8/0x6a0 init/main.c:1406
do_initcall_level+0x174/0x2e5 init/main.c:1468
do_initcalls+0x7e/0x160 init/main.c:1484
do_basic_setup+0x95/0xb0 init/main.c:1503
kernel_init_freeable+0x2b1/0x400 init/main.c:1717
kernel_init+0x21/0x1e0 init/main.c:1606
ret_from_fork+0x67/0xa0 arch/x86/kernel/process.c:153
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
Freed by task 1086:
kasan_save_stack mm/kasan/common.c:49 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:70
kasan_save_free_info+0x44/0x50 mm/kasan/generic.c:579
poison_slab_object mm/kasan/common.c:249 [inline]
__kasan_slab_free+0x5f/0x80 mm/kasan/common.c:266
kasan_slab_free include/linux/kasan.h:234 [inline]
slab_free_hook mm/slub.c:2445 [inline]
slab_free mm/slub.c:4714 [inline]
kmem_cache_free+0x1bd/0x4f0 mm/slub.c:4825
acpi_os_release_object+0x21/0x30 drivers/acpi/osl.c:1612
acpi_ut_delete_object_desc+0x80/0xe0 drivers/acpi/acpica/utobject.c:402
acpi_ut_delete_internal_obj drivers/acpi/acpica/utdelete.c:316 [inline]
acpi_ut_update_ref_count+0xb52/0xc80 drivers/acpi/acpica/utdelete.c:436
acpi_ut_update_object_reference+0x487/0x730 drivers/acpi/acpica/utdelete.c:632
acpi_ut_remove_reference+0x87/0xb0 drivers/acpi/acpica/utdelete.c:740
acpi_rs_get_prt_method_data+0xcd/0x110 drivers/acpi/acpica/rsutils.c:460
acpi_get_irq_routing_table+0xb8/0xe0 drivers/acpi/acpica/rsxface.c:137
acpi_pci_irq_find_prt_entry+0x164/0x1010 drivers/acpi/pci_irq.c:214
acpi_pci_irq_lookup+0x44/0x5a0 drivers/acpi/pci_irq.c:298
acpi_pci_irq_disable+0x171/0x2f0 drivers/acpi/pci_irq.c:495
pcibios_disable_device+0xc3/0x120 arch/x86/pci/common.c:706
do_pci_disable_device drivers/pci/pci.c:2284 [inline]
pci_disable_device+0x162/0x2d0 drivers/pci/pci.c:2318
virtio_pci_remove+0xc2/0xf0 drivers/virtio/virtio_pci_common.c:766
pci_device_remove+0xab/0x260 drivers/pci/pci-driver.c:485
device_remove drivers/base/dd.c:567 [inline]
__device_release_driver drivers/base/dd.c:1272 [inline]
device_release_driver_internal+0x4ad/0x830 drivers/base/dd.c:1295
device_release_driver+0x1d/0x30 drivers/base/dd.c:1318
pci_stop_dev drivers/pci/remove.c:44 [inline]
pci_stop_bus_device+0x10c/0x160 drivers/pci/remove.c:109
pci_stop_and_remove_bus_device drivers/pci/remove.c:143 [inline]
pci_stop_and_remove_bus_device_locked+0x1e/0x40 drivers/pci/remove.c:151
remove_store+0xe6/0x150 drivers/pci/pci-sysfs.c:513
dev_attr_store+0x73/0xa0 drivers/base/core.c:2440
sysfs_kf_write+0x141/0x160 fs/sysfs/file.c:136
kernfs_fop_write_iter+0x316/0x510 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:591 [inline]
vfs_write+0x75f/0xfd0 fs/read_write.c:684
ksys_write+0x145/0x260 fs/read_write.c:737
__do_sys_write fs/read_write.c:749 [inline]
__se_sys_write fs/read_write.c:746 [inline]
__x64_sys_write+0x7f/0x90 fs/read_write.c:746
x64_sys_call+0x271c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:2
do_syscall_x64 arch/x86/entry/common.c:47 [inline]
do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
entry_SYSCALL_64_after_hwframe+0x76/0x7e
The buggy address belongs to the object at ffff88810a2481a0
which belongs to the cache Acpi-Operand of size 72
The buggy address is located 9 bytes inside of
freed 72-byte region [ffff88810a2481a0, ffff88810a2481e8)
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88810a2484e0 pfn:0x10a248
flags: 0x4000000000000200(workingset|zone=1)
page_type: f5(slab)
raw: 4000000000000200 ffff888100a43780 ffffea0004289d50 ffffea0004289810
raw: ffff88810a2484e0 0000000000270022 00000001f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 1, tgid 1 (swapper/0), ts 1702188020, free_ts 0
set_page_owner include/linux/page_owner.h:35 [inline]
post_alloc_hook+0x37d/0x3b0 mm/page_alloc.c:1864
prep_new_page+0x2d/0x180 mm/page_alloc.c:1872
get_page_from_freelist+0x4aea/0x4ba0 mm/page_alloc.c:3949
__alloc_pages_noprof+0x35a/0x7e0 mm/page_alloc.c:5316
alloc_slab_page+0x6b/0x1e0 mm/slub.c:-1
allocate_slab+0x69/0x430 mm/slub.c:2687
new_slab mm/slub.c:2741 [inline]
___slab_alloc+0x591/0x8c0 mm/slub.c:3934
__slab_alloc mm/slub.c:4025 [inline]
__slab_alloc_node mm/slub.c:4078 [inline]
slab_alloc_node mm/slub.c:4239 [inline]
kmem_cache_alloc_noprof+0x290/0x410 mm/slub.c:4260
acpi_ut_allocate_object_desc_dbg+0xf2/0x270 drivers/acpi/acpica/utobject.c:359
acpi_ut_create_internal_object_dbg+0x2a/0x290 drivers/acpi/acpica/utobject.c:69
acpi_ds_build_internal_object+0x296/0x660 drivers/acpi/acpica/dsobject.c:94
acpi_ds_create_node+0x9f/0x150 drivers/acpi/acpica/dsobject.c:281
acpi_ds_load2_end_op+0x8be/0xfb0 drivers/acpi/acpica/dswload2.c:618
acpi_ds_exec_end_op+0x6a0/0x1210 drivers/acpi/acpica/dswexec.c:638
acpi_ps_parse_loop+0xc83/0x1ac0 drivers/acpi/acpica/psloop.c:525
acpi_ps_parse_aml+0x218/0x9b0 drivers/acpi/acpica/psparse.c:475
page_owner free stack trace missing
Memory state around the buggy address:
ffff88810a248080: 00 00 00 00 00 00 fc fc fc fc fa fb fb fb fb fb
ffff88810a248100: fb fb fb fc fc fc fc 00 00 00 00 00 00 00 00 00
>ffff88810a248180: fc fc fc fc fa fb fb fb fb fb fb fb fb fc fc fc
^
ffff88810a248200: fc 00 00 00 00 00 00 00 00 00 fc fc fc fc 00 00
ffff88810a248280: 00 00 00 00 00 00 00 fc fc fc fc 00 00 00 00 00
==================================================================
Oops: general protection fault, probably for non-canonical address 0xe043fc5200000088: 0000 [#1] PREEMPT SMP KASAN PTI
KASAN: maybe wild-memory-access in range [0x0220029000000440-0x0220029000000447]
CPU: 1 UID: 0 PID: 1093 Comm: syz.3.213 Tainted: G B syzkaller #0 d3eed1e307a834e4006f99660f38f56e8d371643
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
RIP: 0010:acpi_ut_update_object_reference+0x255/0x730 drivers/acpi/acpica/utdelete.c:544
Code: 48 89 f8 48 c1 e8 03 42 80 3c 20 00 74 05 e8 92 e3 d4 fe 4a 8b 1c 2b 48 85 db 74 54 4c 89 e1 4c 8d 63 09 4c 89 e0 48 c1 e8 03 <0f> b6 04 08 84 c0 0f 85 c4 00 00 00 41 0f b6 04 24 fe c8 44 0f b6
RSP: 0018:ffffc90012f2ef60 EFLAGS: 00010207
RAX: 0044005200000088 RBX: 022002900000043e RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff88810a252908
RBP: ffffc90012f2f030 R08: 000000003c6c0e85 R09: 0000000000000000
R10: ffff88811693a770 R11: ffffffff8175a6a0 R12: 0220029000000447
R13: 0000000000000008 R14: 0000000000000000 R15: 0000000000000002
FS: 00007f4207fa86c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa670e6c588 CR3: 0000000142a46000 CR4: 00000000003526b0
Call Trace:
acpi_ut_add_reference+0x3d/0x50 drivers/acpi/acpica/utdelete.c:694
acpi_ex_resolve_node_to_value+0x680/0x730 drivers/acpi/acpica/exresnte.c:-1
acpi_ns_evaluate+0x78b/0xa60 drivers/acpi/acpica/nseval.c:238
acpi_ut_evaluate_object+0x15a/0x5b0 drivers/acpi/acpica/uteval.c:60
acpi_rs_get_prt_method_data+0x96/0x110 drivers/acpi/acpica/rsutils.c:446
acpi_get_irq_routing_table+0xb8/0xe0 drivers/acpi/acpica/rsxface.c:137
acpi_pci_irq_find_prt_entry+0x164/0x1010 drivers/acpi/pci_irq.c:214
acpi_pci_irq_lookup+0x44/0x5a0 drivers/acpi/pci_irq.c:298
acpi_pci_irq_enable+0x1c2/0x5e0 drivers/acpi/pci_irq.c:413
pcibios_enable_device+0xe1/0x140 arch/x86/pci/common.c:699
do_pci_enable_device+0x1e0/0x3e0 drivers/pci/pci.c:2118
pci_enable_device_flags+0x45e/0x510 drivers/pci/pci.c:2203
pci_enable_device+0x1e/0xc0 drivers/pci/pci.c:2236
virtio_pci_probe+0x1ab/0x400 drivers/virtio/virtio_pci_common.c:702
local_pci_probe drivers/pci/pci-driver.c:335 [inline]
pci_call_probe drivers/pci/pci-driver.c:403 [inline]
__pci_device_probe drivers/pci/pci-driver.c:428 [inline]
pci_device_probe+0x282/0x440 drivers/pci/pci-driver.c:462
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x2e1/0x8b0 drivers/base/dd.c:657
__driver_probe_device+0x193/0x280 drivers/base/dd.c:799
driver_probe_device+0x54/0x3f0 drivers/base/dd.c:829
__device_attach_driver+0x2f1/0x4b0 drivers/base/dd.c:957
bus_for_each_drv+0x264/0x300 drivers/base/bus.c:459
__device_attach+0x2c4/0x3c0 drivers/base/dd.c:1029
device_attach+0x1b/0x40 drivers/base/dd.c:1072
pci_bus_add_device+0x11f/0x1f0 drivers/pci/bus.c:378
pci_bus_add_devices+0x98/0x1c0 drivers/pci/bus.c:401
pci_rescan_bus+0x30/0x40 drivers/pci/probe.c:3440
rescan_store+0xcd/0x150 drivers/pci/pci-sysfs.c:463
bus_attr_store+0x91/0xb0 drivers/base/bus.c:172
sysfs_kf_write+0x141/0x160 fs/sysfs/file.c:136
kernfs_fop_write_iter+0x316/0x510 fs/kernfs/file.c:352
new_sync_write fs/read_write.c:591 [inline]
vfs_write+0x75f/0xfd0 fs/read_write.c:684
ksys_write+0x145/0x260 fs/read_write.c:737
__do_sys_write fs/read_write.c:749 [inline]
__se_sys_write fs/read_write.c:746 [inline]
__x64_sys_write+0x7f/0x90 fs/read_write.c:746
x64_sys_call+0x271c/0x2ee0 arch/x86/include/generated/asm/syscalls_64.h:2
do_syscall_x64 arch/x86/entry/common.c:47 [inline]
do_syscall_64+0x57/0xf0 arch/x86/entry/common.c:78
entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x7f420719e199
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f4207fa8028 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007f4207426090 RCX: 00007f420719e199
RDX: 000000000000001e RSI: 0000200000000600 RDI: 0000000000000009
RBP: 00007f42072358e0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f4207426128 R14: 00007f4207426090 R15: 00007fff025eaac8
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:acpi_ut_update_object_reference+0x255/0x730 drivers/acpi/acpica/utdelete.c:544
Code: 48 89 f8 48 c1 e8 03 42 80 3c 20 00 74 05 e8 92 e3 d4 fe 4a 8b 1c 2b 48 85 db 74 54 4c 89 e1 4c 8d 63 09 4c 89 e0 48 c1 e8 03 <0f> b6 04 08 84 c0 0f 85 c4 00 00 00 41 0f b6 04 24 fe c8 44 0f b6
RSP: 0018:ffffc90012f2ef60 EFLAGS: 00010207
RAX: 0044005200000088 RBX: 022002900000043e RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff88810a252908
RBP: ffffc90012f2f030 R08: 000000003c6c0e85 R09: 0000000000000000
R10: ffff88811693a770 R11: ffffffff8175a6a0 R12: 0220029000000447
R13: 0000000000000008 R14: 0000000000000000 R15: 0000000000000002
FS: 00007f4207fa86c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f04d29f9ff8 CR3: 0000000142a46000 CR4: 00000000003526b0
----------------
Code disassembly (best guess):
0: 48 89 f8 mov %rdi,%rax
3: 48 c1 e8 03 shr $0x3,%rax
7: 42 80 3c 20 00 cmpb $0x0,(%rax,%r12,1)
c: 74 05 je 0x13
e: e8 92 e3 d4 fe call 0xfed4e3a5
13: 4a 8b 1c 2b mov (%rbx,%r13,1),%rbx
17: 48 85 db test %rbx,%rbx
1a: 74 54 je 0x70
1c: 4c 89 e1 mov %r12,%rcx
1f: 4c 8d 63 09 lea 0x9(%rbx),%r12
23: 4c 89 e0 mov %r12,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 0f b6 04 08 movzbl (%rax,%rcx,1),%eax <-- trapping instruction
2e: 84 c0 test %al,%al
30: 0f 85 c4 00 00 00 jne 0xfa
36: 41 0f b6 04 24 movzbl (%r12),%eax
3b: fe c8 dec %al
3d: 44 rex.R
3e: 0f .byte 0xf
3f: b6 .byte 0xb6