kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 719 Comm: syz.0.78 Not tainted 5.4.292-syzkaller-00021-gcd8e74fa0fa3 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
RIP: 0010:set_track mm/kasan/common.c:78 [inline]
RIP: 0010:kasan_set_free_info mm/kasan/common.c:345 [inline]
RIP: 0010:__kasan_slab_free+0x223/0x280 mm/kasan/common.c:487
Code: c2 40 84 fe 75 11 08 d1 74 0d 49 ff c7 4c 39 f8 75 c1 41 89 c7 eb 03 41 ff c7 48 89 e7 44 89 fe ba 00 08 00 00 e8 2d 2d a9 00 <42> 89 44 2b 0c 49 63 be c4 01 00 00 48 01 df 4c 89 f6 e8 96 1d 00
RSP: 0018:ffff8881f6f09cf0 EFLAGS: 00010286
RAX: 00000000c96001d5 RBX: 0000000000000101 RCX: 1dfa5b7e75d3c500
RDX: 0000000000000200 RSI: 0000000000000a06 RDI: 00000000ffffffff
RBP: ffff8881f6f09d30 R08: 0000000000000004 R09: 0000000000000003
R10: ffffed103ede137c R11: 1ffff1103ede137c R12: 00000000ffff99b0
R13: dffffc0000000000 R14: ffffffff818d5c23 R15: 0000000000000040
FS: 00007f9e8d6e46c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000002000 CR3: 00000001e4897000 CR4: 00000000003406a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
expire_timers kernel/time/timer.c:1493 [inline]
__run_timers+0x81d/0xb60 kernel/time/timer.c:1817
run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1830
__do_softirq+0x236/0x660 kernel/softirq.c:292
invoke_softirq kernel/softirq.c:373 [inline]
irq_exit+0x197/0x1c0 kernel/softirq.c:413
exiting_irq arch/x86/include/asm/apic.h:539 [inline]
smp_apic_timer_interrupt+0x11d/0x490 arch/x86/kernel/apic/apic.c:1161
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:834
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:169 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x49/0x70 kernel/locking/spinlock.c:199
Code: 12 48 89 fb 48 c7 c7 b0 2d cb 85 e8 31 7f 62 fd 48 89 df 48 83 3d c6 33 a0 01 00 74 27 e8 93 37 1d fd 66 90 fb bf 01 00 00 00 72 7a 16 fd 65 8b 05 87 93 d7 7b 85 c0 74 03 5b 5d c3 e8 7f 4d
RSP: 0018:ffff8881e39868a8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: 0000000000000001 RBX: 0000000000012cc0 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001
RBP: ffff8881e39868b0 R08: 00000000aacc1449 R09: 00000000e8927cef
R10: 00000000a25c5a7c R11: 000000004b66c48c R12: ffffea000715b5c0
R13: ffff8881e3986960 R14: 0000000000000000 R15: 00000003fffffffc
spin_unlock_irq include/linux/spinlock.h:388 [inline]
__add_to_page_cache_locked+0x56c/0x8c0 mm/filemap.c:915
add_to_page_cache_lru+0xa7/0x210 mm/filemap.c:962
ext4_mpage_readpages+0x46f/0x1db0 fs/ext4/readpage.c:300
ext4_readpages+0xdb/0x100 fs/ext4/inode.c:3424
read_pages+0x117/0x3f0 mm/readahead.c:126
__do_page_cache_readahead+0x41e/0x4b0 mm/readahead.c:212
ondemand_readahead+0x6ae/0xad0 mm/internal.h:62
page_cache_async_readahead+0x28e/0x2c0 mm/readahead.c:574
do_async_mmap_readahead mm/filemap.c:2605 [inline]
filemap_fault+0x50d/0x1680 mm/filemap.c:2660
ext4_filemap_fault+0x84/0xa0 fs/ext4/inode.c:6513
__do_fault mm/memory.c:3290 [inline]
do_read_fault mm/memory.c:3699 [inline]
do_fault mm/memory.c:3828 [inline]
handle_pte_fault mm/memory.c:4059 [inline]
__handle_mm_fault mm/memory.c:4183 [inline]
handle_mm_fault+0x2a4d/0x3930 mm/memory.c:4220
faultin_page mm/gup.c:654 [inline]
__get_user_pages+0xc50/0x15d0 mm/gup.c:874
get_dump_page+0xd1/0x140 mm/gup.c:1363
elf_core_dump+0x3438/0x3bd0 fs/binfmt_elf.c:2349
do_coredump+0x1d8c/0x2ab0 fs/coredump.c:801
get_signal+0xdb7/0x13d0 kernel/signal.c:2732
do_signal+0xad/0xda0 arch/x86/kernel/signal.c:809
exit_to_usermode_loop+0xc4/0x1b0 arch/x86/entry/common.c:159
prepare_exit_to_usermode+0x18e/0x1f0 arch/x86/entry/common.c:194
ret_from_intr+0x1c/0x1c
RIP: 0033:0x7f9e8f07b971
Code: 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 48 3d 01 f0 ff ff 73 01 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f
RSP: 002b:00000000fffffeb0 EFLAGS: 00010217
RAX: 0000000000000000 RBX: 00007f9e8f2a2fa0 RCX: 00007f9e8f07b969
RDX: 0000000000000000 RSI: 00000000fffffeb0 RDI: 0000000002000400
RBP: 00007f9e8f0fdab1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f9e8f2a2fa0 R15: 00007ffed58bb7a8
Modules linked in:
---[ end trace dd86b0a1d41cea42 ]---
RIP: 0010:set_track mm/kasan/common.c:78 [inline]
RIP: 0010:kasan_set_free_info mm/kasan/common.c:345 [inline]
RIP: 0010:__kasan_slab_free+0x223/0x280 mm/kasan/common.c:487
Code: c2 40 84 fe 75 11 08 d1 74 0d 49 ff c7 4c 39 f8 75 c1 41 89 c7 eb 03 41 ff c7 48 89 e7 44 89 fe ba 00 08 00 00 e8 2d 2d a9 00 <42> 89 44 2b 0c 49 63 be c4 01 00 00 48 01 df 4c 89 f6 e8 96 1d 00
RSP: 0018:ffff8881f6f09cf0 EFLAGS: 00010286
RAX: 00000000c96001d5 RBX: 0000000000000101 RCX: 1dfa5b7e75d3c500
RDX: 0000000000000200 RSI: 0000000000000a06 RDI: 00000000ffffffff
RBP: ffff8881f6f09d30 R08: 0000000000000004 R09: 0000000000000003
R10: ffffed103ede137c R11: 1ffff1103ede137c R12: 00000000ffff99b0
R13: dffffc0000000000 R14: ffffffff818d5c23 R15: 0000000000000040
FS: 00007f9e8d6e46c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000002000 CR3: 00000001e4897000 CR4: 00000000003406a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 40 84 fe test %dil,%sil
3: 75 11 jne 0x16
5: 08 d1 or %dl,%cl
7: 74 0d je 0x16
9: 49 ff c7 inc %r15
c: 4c 39 f8 cmp %r15,%rax
f: 75 c1 jne 0xffffffd2
11: 41 89 c7 mov %eax,%r15d
14: eb 03 jmp 0x19
16: 41 ff c7 inc %r15d
19: 48 89 e7 mov %rsp,%rdi
1c: 44 89 fe mov %r15d,%esi
1f: ba 00 08 00 00 mov $0x800,%edx
24: e8 2d 2d a9 00 call 0xa92d56
* 29: 42 89 44 2b 0c mov %eax,0xc(%rbx,%r13,1) <-- trapping instruction
2e: 49 63 be c4 01 00 00 movslq 0x1c4(%r14),%rdi
35: 48 01 df add %rbx,%rdi
38: 4c 89 f6 mov %r14,%rsi
3b: e8 .byte 0xe8
3c: 96 xchg %eax,%esi
3d: 1d .byte 0x1d