From: syzbot <syzbot+685955db58555575fdd2@syzkaller.appspotmail.com>
To: linux-kernel@vger.kernel.org, syzkaller-bugs@googlegroups.com
Subject: [syzbot] KASAN: use-after-free Read in ring_buffer_peek
Date: Sun, 16 Aug 2026 15:10:21 -0700 [thread overview]
Message-ID: <6a82354d.10853dc7.22f513.0014.GAE@google.com> (raw)
Hello,
syzbot found the following issue on:
HEAD commit: 3d6d817622b0 Merge tag 'scsi-fixes' of git://git.kernel.or..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=10d17479580000
kernel config: https://syzkaller.appspot.com/x/.config?x=dd70c0851d340092
dashboard link: https://syzkaller.appspot.com/bug?extid=685955db58555575fdd2
compiler: gcc (Debian 14.2.0-19) 14.2.0, GNU ld (GNU Binutils for Debian) 2.44
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12910ac6580000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+685955db58555575fdd2@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in ring_buffer_peek+0x3e0/0x430 kernel/trace/ring_buffer.c:6274
Read of size 1 at addr ffff88802a4cf010 by task syz-executor989/6002
CPU: 1 UID: 0 PID: 6002 Comm: syz-executor989 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x13d/0x4b0 mm/kasan/report.c:482
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
ring_buffer_peek+0x3e0/0x430 kernel/trace/ring_buffer.c:6274
peek_next_entry+0x17a/0x250 kernel/trace/trace.c:2354
__find_next_entry+0x1ed/0x4e0 kernel/trace/trace.c:2398
trace_find_next_entry_inc+0x3d/0x1c0 kernel/trace/trace.c:2672
tracing_read_pipe+0x557/0xd60 kernel/trace/trace.c:5440
vfs_read+0x1e4/0xb40 fs/read_write.c:572
ksys_read+0x12a/0x250 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f588d3b7d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007f588d361198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f588d3626c0 RCX: 00007f588d3b7d9e
RDX: 0000000000001000 RSI: 00007f588d361200 RDI: 0000000000000003
RBP: 00007f588d361200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffe1b5bf5a0 R15: 00007ffe1b5bf688
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2a4cf
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 ffffea0001ddbd08 ffffea00006f0fc8 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5981, tgid 5981 (syz-executor989), ts 130836230668, free_ts 170720200085
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304
__alloc_pages_noprof+0xb/0x110 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data+0x60/0x160 kernel/trace/ring_buffer.c:427
__rb_allocate_pages+0xbd5/0x10a0 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x6df/0x1e80 kernel/trace/ring_buffer.c:3274
__tracing_resize_ring_buffer.part.0+0x52/0x1f0 kernel/trace/trace.c:4738
__tracing_resize_ring_buffer kernel/trace/trace.c:4732 [inline]
tracing_update_buffers+0xd4/0xf0 kernel/trace/trace.c:4977
system_enable_write+0x151/0x300 kernel/trace/trace_events.c:2020
vfs_write+0x2aa/0x1050 fs/read_write.c:685
ksys_write+0x12a/0x250 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 6003 tgid 5981 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0x1325/0x18e0 kernel/trace/ring_buffer.c:7444
buffer_subbuf_size_write+0x182/0x280 kernel/trace/trace.c:8221
vfs_write+0x2aa/0x1050 fs/read_write.c:685
ksys_write+0x12a/0x250 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff88802a4cef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88802a4cef80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
>ffff88802a4cf000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff88802a4cf080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88802a4cf100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in ring_buffer_event_length+0x218/0x260 kernel/trace/ring_buffer.c:266
Read of size 4 at addr ffff88802a4cf010 by task syz-executor989/6002
CPU: 0 UID: 0 PID: 6002 Comm: syz-executor989 Tainted: G B syzkaller #0 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x13d/0x4b0 mm/kasan/report.c:482
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
ring_buffer_event_length+0x218/0x260 kernel/trace/ring_buffer.c:266
peek_next_entry+0x198/0x250 kernel/trace/trace.c:2359
__find_next_entry+0x1ed/0x4e0 kernel/trace/trace.c:2398
trace_find_next_entry_inc+0x3d/0x1c0 kernel/trace/trace.c:2672
tracing_read_pipe+0x557/0xd60 kernel/trace/trace.c:5440
vfs_read+0x1e4/0xb40 fs/read_write.c:572
ksys_read+0x12a/0x250 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f588d3b7d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007f588d361198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f588d3626c0 RCX: 00007f588d3b7d9e
RDX: 0000000000001000 RSI: 00007f588d361200 RDI: 0000000000000003
RBP: 00007f588d361200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffe1b5bf5a0 R15: 00007ffe1b5bf688
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2a4cf
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 ffffea0001ddbd08 ffffea00006f0fc8 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5981, tgid 5981 (syz-executor989), ts 130836230668, free_ts 170720200085
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304
__alloc_pages_noprof+0xb/0x110 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data+0x60/0x160 kernel/trace/ring_buffer.c:427
__rb_allocate_pages+0xbd5/0x10a0 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x6df/0x1e80 kernel/trace/ring_buffer.c:3274
__tracing_resize_ring_buffer.part.0+0x52/0x1f0 kernel/trace/trace.c:4738
__tracing_resize_ring_buffer kernel/trace/trace.c:4732 [inline]
tracing_update_buffers+0xd4/0xf0 kernel/trace/trace.c:4977
system_enable_write+0x151/0x300 kernel/trace/trace_events.c:2020
vfs_write+0x2aa/0x1050 fs/read_write.c:685
ksys_write+0x12a/0x250 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 6003 tgid 5981 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0x1325/0x18e0 kernel/trace/ring_buffer.c:7444
buffer_subbuf_size_write+0x182/0x280 kernel/trace/trace.c:8221
vfs_write+0x2aa/0x1050 fs/read_write.c:685
ksys_write+0x12a/0x250 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff88802a4cef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88802a4cef80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
>ffff88802a4cf000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff88802a4cf080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88802a4cf100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in rb_event_data_length kernel/trace/ring_buffer.c:198 [inline]
BUG: KASAN: use-after-free in rb_event_length kernel/trace/ring_buffer.c:227 [inline]
BUG: KASAN: use-after-free in ring_buffer_event_length+0x243/0x260 kernel/trace/ring_buffer.c:269
Read of size 1 at addr ffff88802a4cf010 by task syz-executor989/6002
CPU: 0 UID: 0 PID: 6002 Comm: syz-executor989 Tainted: G B syzkaller #0 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x13d/0x4b0 mm/kasan/report.c:482
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
rb_event_data_length kernel/trace/ring_buffer.c:198 [inline]
rb_event_length kernel/trace/ring_buffer.c:227 [inline]
ring_buffer_event_length+0x243/0x260 kernel/trace/ring_buffer.c:269
peek_next_entry+0x198/0x250 kernel/trace/trace.c:2359
__find_next_entry+0x1ed/0x4e0 kernel/trace/trace.c:2398
trace_find_next_entry_inc+0x3d/0x1c0 kernel/trace/trace.c:2672
tracing_read_pipe+0x557/0xd60 kernel/trace/trace.c:5440
vfs_read+0x1e4/0xb40 fs/read_write.c:572
ksys_read+0x12a/0x250 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f588d3b7d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007f588d361198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f588d3626c0 RCX: 00007f588d3b7d9e
RDX: 0000000000001000 RSI: 00007f588d361200 RDI: 0000000000000003
RBP: 00007f588d361200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffe1b5bf5a0 R15: 00007ffe1b5bf688
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2a4cf
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 ffffea0001ddbd08 ffffea00006f0fc8 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5981, tgid 5981 (syz-executor989), ts 130836230668, free_ts 170720200085
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304
__alloc_pages_noprof+0xb/0x110 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data+0x60/0x160 kernel/trace/ring_buffer.c:427
__rb_allocate_pages+0xbd5/0x10a0 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x6df/0x1e80 kernel/trace/ring_buffer.c:3274
__tracing_resize_ring_buffer.part.0+0x52/0x1f0 kernel/trace/trace.c:4738
__tracing_resize_ring_buffer kernel/trace/trace.c:4732 [inline]
tracing_update_buffers+0xd4/0xf0 kernel/trace/trace.c:4977
system_enable_write+0x151/0x300 kernel/trace/trace_events.c:2020
vfs_write+0x2aa/0x1050 fs/read_write.c:685
ksys_write+0x12a/0x250 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 6003 tgid 5981 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0x1325/0x18e0 kernel/trace/ring_buffer.c:7444
buffer_subbuf_size_write+0x182/0x280 kernel/trace/trace.c:8221
vfs_write+0x2aa/0x1050 fs/read_write.c:685
ksys_write+0x12a/0x250 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff88802a4cef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88802a4cef80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
>ffff88802a4cf000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff88802a4cf080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88802a4cf100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in rb_event_data kernel/trace/ring_buffer.c:284 [inline]
BUG: KASAN: use-after-free in ring_buffer_event_data+0x129/0x150 kernel/trace/ring_buffer.c:300
Read of size 4 at addr ffff88802a4cf010 by task syz-executor989/6002
CPU: 1 UID: 0 PID: 6002 Comm: syz-executor989 Tainted: G B syzkaller #0 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x13d/0x4b0 mm/kasan/report.c:482
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
rb_event_data kernel/trace/ring_buffer.c:284 [inline]
ring_buffer_event_data+0x129/0x150 kernel/trace/ring_buffer.c:300
peek_next_entry+0x1d3/0x250 kernel/trace/trace.c:2360
__find_next_entry+0x1ed/0x4e0 kernel/trace/trace.c:2398
trace_find_next_entry_inc+0x3d/0x1c0 kernel/trace/trace.c:2672
tracing_read_pipe+0x557/0xd60 kernel/trace/trace.c:5440
vfs_read+0x1e4/0xb40 fs/read_write.c:572
ksys_read+0x12a/0x250 fs/read_write.c:716
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f588d3b7d9e
Code: 08 0f 85 f5 e2 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 90 41 57 41 56 4d 89 c6 41 55 4d 89 cd 41 54 55 53 48 83 ec 08
RSP: 002b:00007f588d361198 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
RAX: ffffffffffffffda RBX: 00007f588d3626c0 RCX: 00007f588d3b7d9e
RDX: 0000000000001000 RSI: 00007f588d361200 RDI: 0000000000000003
RBP: 00007f588d361200 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffd0
R13: 0000000000000000 R14: 00007ffe1b5bf5a0 R15: 00007ffe1b5bf688
</TASK>
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2a4cf
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 ffffea0001ddbd08 ffffea00006f0fc8 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x44dc0(GFP_KERNEL|__GFP_ZERO|__GFP_RETRY_MAYFAIL|__GFP_COMP), pid 5981, tgid 5981 (syz-executor989), ts 130836230668, free_ts 170720200085
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0xf48/0x3530 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x299/0x2dc0 mm/page_alloc.c:5304
__alloc_pages_noprof+0xb/0x110 mm/page_alloc.c:5338
__alloc_pages_node_noprof include/linux/gfp.h:291 [inline]
alloc_pages_node_noprof include/linux/gfp.h:318 [inline]
alloc_cpu_data+0x60/0x160 kernel/trace/ring_buffer.c:427
__rb_allocate_pages+0xbd5/0x10a0 kernel/trace/ring_buffer.c:2436
ring_buffer_resize+0x6df/0x1e80 kernel/trace/ring_buffer.c:3274
__tracing_resize_ring_buffer.part.0+0x52/0x1f0 kernel/trace/trace.c:4738
__tracing_resize_ring_buffer kernel/trace/trace.c:4732 [inline]
tracing_update_buffers+0xd4/0xf0 kernel/trace/trace.c:4977
system_enable_write+0x151/0x300 kernel/trace/trace_events.c:2020
vfs_write+0x2aa/0x1050 fs/read_write.c:685
ksys_write+0x12a/0x250 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 6003 tgid 5981 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0x79f/0x1090 mm/page_alloc.c:2950
free_buffer_page kernel/trace/ring_buffer.c:398 [inline]
ring_buffer_subbuf_order_set+0x1325/0x18e0 kernel/trace/ring_buffer.c:7444
buffer_subbuf_size_write+0x182/0x280 kernel/trace/trace.c:8221
vfs_write+0x2aa/0x1050 fs/read_write.c:685
ksys_write+0x12a/0x250 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x115/0x870 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff88802a4cef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88802a4cef80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
>ffff88802a4cf000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff88802a4cf080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff88802a4cf100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
reply other threads:[~2026-08-16 22:10 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6a82354d.10853dc7.22f513.0014.GAE@google.com \
--to=syzbot+685955db58555575fdd2@syzkaller.appspotmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.