qlink_free mm/kasan/quarantine.c:168 [inline] qlist_free_all+0x4f/0x1a0 mm/kasan/quarantine.c:187 kasan_quarantine_reduce+0x184/0x210 mm/kasan/quarantine.c:294 __kasan_slab_alloc+0x63/0x90 mm/kasan/common.c:302 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook mm/slab.h:737 [inline] slab_alloc_node mm/slab.c:3257 [inline] slab_alloc mm/slab.c:3265 [inline] __kmem_cache_alloc_lru mm/slab.c:3442 [inline] kmem_cache_alloc+0x220/0x460 mm/slab.c:3461 mt_alloc_one lib/maple_tree.c:152 [inline] mas_alloc_nodes+0x429/0x810 lib/maple_tree.c:1226 mas_node_count_gfp lib/maple_tree.c:1310 [inline] mas_preallocate+0x1bb/0x360 lib/maple_tree.c:5717 do_mas_align_munmap+0x129/0x1260 mm/mmap.c:2314 do_mas_munmap+0x26e/0x2c0 mm/mmap.c:2502 mmap_region+0x21d/0x1dd0 mm/mmap.c:2550 do_mmap+0x831/0xf60 mm/mmap.c:1412 vm_mmap_pgoff+0x1af/0x280 mm/util.c:520 ksys_mmap_pgoff+0x41f/0x5a0 mm/mmap.c:1458 ------------[ cut here ]------------ kernel BUG at include/linux/memcontrol.h:455! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 3635 Comm: syz-executor192 Not tainted 6.1.0-rc5-syzkaller-00018-g59d0d52c30d4 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 RIP: 0010:folio_memcg_rcu include/linux/memcontrol.h:455 [inline] RIP: 0010:workingset_activation+0x4cc/0x580 mm/workingset.c:519 Code: 48 89 ef e8 d6 00 00 00 c6 05 8e df 87 0c 01 0f 0b e9 0e fd ff ff e8 13 b4 c9 ff 48 c7 c6 c0 82 57 8a 48 89 ef e8 b4 00 00 00 <0f> 0b e8 fd b3 c9 ff 0f 0b e9 10 fc ff ff e8 f1 b3 c9 ff 48 c7 c6 RSP: 0018:ffffc900033474a0 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 RDX: ffff88807505c280 RSI: ffffffff81b5881c RDI: 0000000000000000 RBP: ffffea00005f9e00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 R13: ffff8880b9b35d48 R14: 000000000000000d R15: 0000000000000003 FS: 0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f4ebf5ec3e8 CR3: 000000007d4d4000 CR4: 00000000003526e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> folio_mark_accessed+0x599/0x830 mm/swap.c:502 kvm_set_page_accessed arch/x86/kvm/../../../virt/kvm/kvm_main.c:2895 [inline] kvm_set_pfn_accessed arch/x86/kvm/../../../virt/kvm/kvm_main.c:2967 [inline] kvm_set_pfn_accessed+0x23f/0x2b0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:2961 handle_changed_spte_acc_track arch/x86/kvm/mmu/tdp_mmu.c:354 [inline] handle_changed_spte_acc_track+0x1bc/0x290 arch/x86/kvm/mmu/tdp_mmu.c:346 handle_changed_spte arch/x86/kvm/mmu/tdp_mmu.c:620 [inline] handle_removed_pt arch/x86/kvm/mmu/tdp_mmu.c:504 [inline] __handle_changed_spte+0xdb3/0x1a40 arch/x86/kvm/mmu/tdp_mmu.c:611 handle_changed_spte arch/x86/kvm/mmu/tdp_mmu.c:618 [inline] handle_removed_pt arch/x86/kvm/mmu/tdp_mmu.c:504 [inline] __handle_changed_spte+0xda4/0x1a40 arch/x86/kvm/mmu/tdp_mmu.c:611 __tdp_mmu_set_spte+0x229/0x9d0 arch/x86/kvm/mmu/tdp_mmu.c:743 _tdp_mmu_set_spte arch/x86/kvm/mmu/tdp_mmu.c:759 [inline] tdp_mmu_set_spte arch/x86/kvm/mmu/tdp_mmu.c:768 [inline] __tdp_mmu_zap_root+0x7e7/0x860 arch/x86/kvm/mmu/tdp_mmu.c:874 tdp_mmu_zap_root+0x12e/0x330 arch/x86/kvm/mmu/tdp_mmu.c:910 kvm_tdp_mmu_zap_all+0x158/0x1b0 arch/x86/kvm/mmu/tdp_mmu.c:1014 kvm_mmu_zap_all+0x280/0x2d0 arch/x86/kvm/mmu/mmu.c:6514 kvm_flush_shadow_all arch/x86/kvm/../../../virt/kvm/kvm_main.c:383 [inline] kvm_mmu_notifier_release+0x60/0xb0 arch/x86/kvm/../../../virt/kvm/kvm_main.c:895 mn_hlist_release mm/mmu_notifier.c:319 [inline] __mmu_notifier_release+0x1ad/0x610 mm/mmu_notifier.c:357 mmu_notifier_release include/linux/mmu_notifier.h:415 [inline] exit_mmap+0x66d/0x7b0 mm/mmap.c:3077 __mmput+0x128/0x4c0 kernel/fork.c:1185 mmput+0x60/0x70 kernel/fork.c:1207 exit_mm kernel/exit.c:516 [inline] do_exit+0xa41/0x2a30 kernel/exit.c:807 do_group_exit+0xd4/0x2a0 kernel/exit.c:950 __do_sys_exit_group kernel/exit.c:961 [inline] __se_sys_exit_group kernel/exit.c:959 [inline] __x64_sys_exit_group+0x3e/0x50 kernel/exit.c:959 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f4ebf5a8359 Code: Unable to access opcode bytes at 0x7f4ebf5a832f. RSP: 002b:00007fff9f076cf8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 00007f4ebf61c290 RCX: 00007f4ebf5a8359 RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f4ebf61c290 R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:folio_memcg_rcu include/linux/memcontrol.h:455 [inline] RIP: 0010:workingset_activation+0x4cc/0x580 mm/workingset.c:519 Code: 48 89 ef e8 d6 00 00 00 c6 05 8e df 87 0c 01 0f 0b e9 0e fd ff ff e8 13 b4 c9 ff 48 c7 c6 c0 82 57 8a 48 89 ef e8 b4 00 00 00 <0f> 0b e8 fd b3 c9 ff 0f 0b e9 10 fc ff ff e8 f1 b3 c9 ff 48 c7 c6 RSP: 0018:ffffc900033474a0 EFLAGS: 00010293 RAX: 0000000000000000 RBX: 0000000000000001 RCX: 0000000000000000 RDX: ffff88807505c280 RSI: ffffffff81b5881c RDI: 0000000000000000 RBP: ffffea00005f9e00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 R13: ffff8880b9b35d48 R14: 000000000000000d R15: 0000000000000003 FS: 0000000000000000(0000) GS:ffff8880b9b00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f4ebf5ec3e8 CR3: 000000007d4d4000 CR4: 00000000003526e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400