KASAN: use-after-free Read in cpu_map_generic

Kernel	Title	Count	Last	Reported	Patched	Status
linux-5.15	KASAN: use-after-free Read in cpu_map_generic_redirect	4	3d20h	17d	0/3	upstream: reported on 2025/02/06 04:04
android-6-1	KASAN: use-after-free Read in cpu_map_generic_redirect	4	107d	186d	0/2	auto-obsoleted due to no activity on 2025/02/06 07:47
linux-6.1	KASAN: use-after-free Read in cpu_map_generic_redirect	5	44d	163d	0/3	upstream: reported on 2024/09/13 03:13

==================================================================
BUG: KASAN: use-after-free in cpu_map_generic_redirect+0x1a8/0x6d0 kernel/bpf/cpumap.c:786
Read of size 8 at addr ffff888115d31818 by task kworker/1:2/60

CPU: 1 PID: 60 Comm: kworker/1:2 Not tainted 5.15.176-syzkaller-00066-gd1a25a6a4b3b #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Workqueue: wg-crypt-wg1 wg_packet_tx_worker
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x151/0x1c0 lib/dump_stack.c:106
 print_address_description+0x87/0x3b0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:427 [inline]
 kasan_report+0x179/0x1c0 mm/kasan/report.c:444
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report_generic.c:309
 cpu_map_generic_redirect+0x1a8/0x6d0 kernel/bpf/cpumap.c:786
 xdp_do_generic_redirect_map net/core/filter.c:4189 [inline]
 xdp_do_generic_redirect+0x3df/0xb40 net/core/filter.c:4236
 do_xdp_generic+0x50b/0x7c0 net/core/dev.c:4919
 __netif_receive_skb_core+0x1706/0x3640 net/core/dev.c:5324
 __netif_receive_skb_one_core net/core/dev.c:5499 [inline]
 __netif_receive_skb+0x11c/0x530 net/core/dev.c:5615
 process_backlog+0x31c/0x650 net/core/dev.c:6492
 __napi_poll+0xc4/0x5a0 net/core/dev.c:7051
 napi_poll net/core/dev.c:7118 [inline]
 net_rx_action+0x47d/0xc50 net/core/dev.c:7208
 handle_softirqs+0x25e/0x5c0 kernel/softirq.c:565
 __do_softirq+0xb/0xd kernel/softirq.c:603
 do_softirq+0xf6/0x150 kernel/softirq.c:452
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x75/0x80 kernel/softirq.c:379
 __raw_read_unlock_bh include/linux/rwlock_api_smp.h:251 [inline]
 _raw_read_unlock_bh+0x29/0x30 kernel/locking/spinlock.c:284
 wg_socket_send_skb_to_peer+0x178/0x1d0 drivers/net/wireguard/socket.c:184
 wg_packet_create_data_done drivers/net/wireguard/send.c:251 [inline]
 wg_packet_tx_worker+0x1e6/0x530 drivers/net/wireguard/send.c:276
 process_one_work+0x6bb/0xc10 kernel/workqueue.c:2325
 worker_thread+0xad5/0x12a0 kernel/workqueue.c:2472
 kthread+0x421/0x510 kernel/kthread.c:337
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>

Allocated by task 9139:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:45 [inline]
 set_alloc_info mm/kasan/common.c:433 [inline]
 ____kasan_kmalloc+0xdb/0x110 mm/kasan/common.c:512
 __kasan_kmalloc+0x9/0x10 mm/kasan/common.c:521
 kasan_kmalloc include/linux/kasan.h:227 [inline]
 __kmalloc+0x13f/0x2c0 mm/slub.c:4431
 __kmalloc_node include/linux/slab.h:469 [inline]
 kmalloc_node include/linux/slab.h:626 [inline]
 bpf_map_kmalloc_node+0xdb/0x160 kernel/bpf/syscall.c:432
 __cpu_map_entry_alloc kernel/bpf/cpumap.c:442 [inline]
 cpu_map_update_elem+0x26c/0xea0 kernel/bpf/cpumap.c:600
 bpf_map_update_value+0x1a3/0x3c0 kernel/bpf/syscall.c:186
 map_update_elem+0x644/0x770 kernel/bpf/syscall.c:1165
 __sys_bpf+0x405/0x760 kernel/bpf/syscall.c:4626
 __do_sys_bpf kernel/bpf/syscall.c:4742 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:4740 [inline]
 __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:4740
 x64_sys_call+0x87f/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:322
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0

Freed by task 9140:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:45
 kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370
 ____kasan_slab_free+0x126/0x160 mm/kasan/common.c:365
 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:373
 kasan_slab_free include/linux/kasan.h:193 [inline]
 slab_free_hook mm/slub.c:1723 [inline]
 slab_free_freelist_hook+0xbd/0x190 mm/slub.c:1749
 slab_free mm/slub.c:3521 [inline]
 kfree+0xcc/0x270 mm/slub.c:4583
 put_cpu_map_entry+0x6dd/0x750 kernel/bpf/cpumap.c:160
 cpu_map_kthread_run+0x22d0/0x2390 kernel/bpf/cpumap.c:407
 kthread+0x421/0x510 kernel/kthread.c:337
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287

Last potentially related work creation:
 kasan_save_stack+0x3b/0x60 mm/kasan/common.c:38
 __kasan_record_aux_stack+0xd3/0xf0 mm/kasan/generic.c:348
 kasan_record_aux_stack_noalloc+0xb/0x10 mm/kasan/generic.c:358
 insert_work+0x56/0x320 kernel/workqueue.c:1373
 __queue_work+0x92a/0xcd0 kernel/workqueue.c:1539
 queue_work_on+0x105/0x170 kernel/workqueue.c:1566
 queue_work include/linux/workqueue.h:510 [inline]
 schedule_work include/linux/workqueue.h:571 [inline]
 __cpu_map_entry_replace kernel/bpf/cpumap.c:555 [inline]
 cpu_map_free+0x1e7/0x2c0 kernel/bpf/cpumap.c:638
 bpf_map_free_deferred+0x10d/0x1e0 kernel/bpf/syscall.c:481
 process_one_work+0x6bb/0xc10 kernel/workqueue.c:2325
 worker_thread+0xad5/0x12a0 kernel/workqueue.c:2472
 kthread+0x421/0x510 kernel/kthread.c:337
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287

Second to last potentially related work creation:
 kasan_save_stack+0x3b/0x60 mm/kasan/common.c:38
 __kasan_record_aux_stack+0xd3/0xf0 mm/kasan/generic.c:348
 kasan_record_aux_stack_noalloc+0xb/0x10 mm/kasan/generic.c:358
 __call_rcu_common kernel/rcu/tree.c:3007 [inline]
 call_rcu+0x123/0x10b0 kernel/rcu/tree.c:3125
 __cpu_map_entry_replace kernel/bpf/cpumap.c:553 [inline]
 cpu_map_free+0x109/0x2c0 kernel/bpf/cpumap.c:638
 bpf_map_free_deferred+0x10d/0x1e0 kernel/bpf/syscall.c:481
 process_one_work+0x6bb/0xc10 kernel/workqueue.c:2325
 worker_thread+0xad5/0x12a0 kernel/workqueue.c:2472
 kthread+0x421/0x510 kernel/kthread.c:337
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287

The buggy address belongs to the object at ffff888115d31800
 which belongs to the cache kmalloc-192 of size 192
The buggy address is located 24 bytes inside of
 192-byte region [ffff888115d31800, ffff888115d318c0)
The buggy address belongs to the page:
page:ffffea0004574c40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x115d31
flags: 0x4000000000000200(slab|zone=1)
raw: 4000000000000200 0000000000000000 0000000100000001 ffff888100042c00
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_HARDWALL), pid 10, ts 107278525660, free_ts 107266552840
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0x1a3/0x1b0 mm/page_alloc.c:2605
 prep_new_page+0x1b/0x110 mm/page_alloc.c:2611
 get_page_from_freelist+0x3550/0x35d0 mm/page_alloc.c:4485
 __alloc_pages+0x27e/0x8f0 mm/page_alloc.c:5780
 allocate_slab mm/slub.c:1932 [inline]
 new_slab+0x9a/0x4e0 mm/slub.c:1995
 ___slab_alloc+0x39e/0x830 mm/slub.c:3028
 __slab_alloc+0x4a/0x90 mm/slub.c:3115
 slab_alloc_node mm/slub.c:3206 [inline]
 slab_alloc mm/slub.c:3250 [inline]
 __kmalloc+0x172/0x2c0 mm/slub.c:4427
 kmalloc_array include/linux/slab.h:643 [inline]
 kcalloc include/linux/slab.h:672 [inline]
 ext4_find_extent+0x375/0xe30 fs/ext4/extents.c:907
 ext4_ext_map_blocks+0x269/0x7450 fs/ext4/extents.c:4165
 ext4_map_blocks+0xa60/0x1c70 fs/ext4/inode.c:673
 ext4_convert_unwritten_extents+0x2e0/0x6c0 fs/ext4/extents.c:4867
 ext4_convert_unwritten_io_end_vec+0x104/0x180 fs/ext4/extents.c:4906
 ext4_end_io_end fs/ext4/page-io.c:186 [inline]
 ext4_do_flush_completed_IO fs/ext4/page-io.c:259 [inline]
 ext4_end_io_rsv_work+0x358/0x690 fs/ext4/page-io.c:273
 process_one_work+0x6bb/0xc10 kernel/workqueue.c:2325
 worker_thread+0xad5/0x12a0 kernel/workqueue.c:2472
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 free_pages_prepare mm/page_alloc.c:1472 [inline]
 free_pcp_prepare mm/page_alloc.c:1544 [inline]
 free_unref_page_prepare+0x7c8/0x7d0 mm/page_alloc.c:3534
 free_unref_page+0xe8/0x750 mm/page_alloc.c:3616
 free_the_page mm/page_alloc.c:805 [inline]
 __free_pages+0x61/0xf0 mm/page_alloc.c:5856
 free_pages+0x7c/0x90 mm/page_alloc.c:5867
 tlb_batch_list_free mm/mmu_gather.c:61 [inline]
 tlb_finish_mmu+0x253/0x320 mm/mmu_gather.c:341
 exit_mmap+0x484/0x990 mm/mmap.c:3236
 __mmput+0x95/0x310 kernel/fork.c:1180
 mmput+0x5b/0x170 kernel/fork.c:1203
 exit_mm kernel/exit.c:554 [inline]
 do_exit+0xb9c/0x2ca0 kernel/exit.c:867
 do_group_exit+0x141/0x310 kernel/exit.c:1002
 __do_sys_exit_group kernel/exit.c:1013 [inline]
 __se_sys_exit_group kernel/exit.c:1011 [inline]
 __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1011
 x64_sys_call+0x610/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:232
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0

Memory state around the buggy address:
 ffff888115d31700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888115d31780: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff888115d31800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                            ^
 ffff888115d31880: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
 ffff888115d31900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
================================================================================
UBSAN: array-index-out-of-bounds in kernel/locking/qspinlock.c:130:9
index 16382 is out of range for type 'unsigned long[8]'
CPU: 1 PID: 60 Comm: kworker/1:2 Tainted: G    B             5.15.176-syzkaller-00066-gd1a25a6a4b3b #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Workqueue: wg-crypt-wg1 wg_packet_tx_worker
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x151/0x1c0 lib/dump_stack.c:106
 dump_stack+0x15/0x20 lib/dump_stack.c:113
 ubsan_epilogue lib/ubsan.c:151 [inline]
 __ubsan_handle_out_of_bounds+0x118/0x140 lib/ubsan.c:282
 decode_tail kernel/locking/qspinlock.c:130 [inline]
 __pv_queued_spin_lock_slowpath+0xb9d/0xc40 kernel/locking/qspinlock.c:468
 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:585 [inline]
 queued_spin_lock_slowpath arch/x86/include/asm/qspinlock.h:51 [inline]
 queued_spin_lock include/asm-generic/qspinlock.h:85 [inline]
 do_raw_spin_lock include/linux/spinlock.h:187 [inline]
 __raw_spin_lock include/linux/spinlock_api_smp.h:143 [inline]
 _raw_spin_lock+0x139/0x1b0 kernel/locking/spinlock.c:154
 spin_lock include/linux/spinlock.h:363 [inline]
 ptr_ring_produce include/linux/ptr_ring.h:128 [inline]
 cpu_map_generic_redirect+0x1d5/0x6d0 kernel/bpf/cpumap.c:786
 xdp_do_generic_redirect_map net/core/filter.c:4189 [inline]
 xdp_do_generic_redirect+0x3df/0xb40 net/core/filter.c:4236
 do_xdp_generic+0x50b/0x7c0 net/core/dev.c:4919
 __netif_receive_skb_core+0x1706/0x3640 net/core/dev.c:5324
 __netif_receive_skb_one_core net/core/dev.c:5499 [inline]
 __netif_receive_skb+0x11c/0x530 net/core/dev.c:5615
 process_backlog+0x31c/0x650 net/core/dev.c:6492
 __napi_poll+0xc4/0x5a0 net/core/dev.c:7051
 napi_poll net/core/dev.c:7118 [inline]
 net_rx_action+0x47d/0xc50 net/core/dev.c:7208
 handle_softirqs+0x25e/0x5c0 kernel/softirq.c:565
 __do_softirq+0xb/0xd kernel/softirq.c:603
 do_softirq+0xf6/0x150 kernel/softirq.c:452
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x75/0x80 kernel/softirq.c:379
 __raw_read_unlock_bh include/linux/rwlock_api_smp.h:251 [inline]
 _raw_read_unlock_bh+0x29/0x30 kernel/locking/spinlock.c:284
 wg_socket_send_skb_to_peer+0x178/0x1d0 drivers/net/wireguard/socket.c:184
 wg_packet_create_data_done drivers/net/wireguard/send.c:251 [inline]
 wg_packet_tx_worker+0x1e6/0x530 drivers/net/wireguard/send.c:276
 process_one_work+0x6bb/0xc10 kernel/workqueue.c:2325
 worker_thread+0xad5/0x12a0 kernel/workqueue.c:2472
 kthread+0x421/0x510 kernel/kthread.c:337
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
================================================================================
general protection fault, probably for non-canonical address 0xe010f4fb9f81ff59: 0000 [#1] PREEMPT SMP KASAN
KASAN: maybe wild-memory-access in range [0x0087c7dcfc0ffac8-0x0087c7dcfc0ffacf]
CPU: 1 PID: 60 Comm: kworker/1:2 Tainted: G    B             5.15.176-syzkaller-00066-gd1a25a6a4b3b #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Workqueue: wg-crypt-wg1 wg_packet_tx_worker
RIP: 0010:__pv_queued_spin_lock_slowpath+0x2f3/0xc40 kernel/locking/qspinlock.c:471
Code: 74 1e 48 89 4c 24 10 48 8b 7c 24 10 e8 26 98 5d 00 48 8b 4c 24 10 48 ba 00 00 00 00 00 fc ff df 4c 03 21 4c 89 e0 48 c1 e8 03 <80> 3c 10 00 74 12 4c 89 e7 e8 9f 98 5d 00 48 ba 00 00 00 00 00 fc
RSP: 0018:ffffc900001d05c0 EFLAGS: 00010206
RAX: 0010f8fb9f81ff59 RBX: ffff8881f7138ad4 RCX: ffffffff86285820
RDX: dffffc0000000000 RSI: 0000000000000002 RDI: 00000000ffffffff
RBP: ffffc900001d06b0 R08: ffffffff8141a99b R09: 0000000000000003
R10: fffffbfff0e9a84c R11: dffffc0000000001 R12: 0087c7dcfc0ffac9
R13: 1ffff11022ba6200 R14: 1ffff1103ee27159 R15: ffff888115d31004
FS:  0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffe30230ff8 CR3: 0000000124619000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 pv_queued_spin_lock_slowpath arch/x86/include/asm/paravirt.h:585 [inline]
 queued_spin_lock_slowpath arch/x86/include/asm/qspinlock.h:51 [inline]
 queued_spin_lock include/asm-generic/qspinlock.h:85 [inline]
 do_raw_spin_lock include/linux/spinlock.h:187 [inline]
 __raw_spin_lock include/linux/spinlock_api_smp.h:143 [inline]
 _raw_spin_lock+0x139/0x1b0 kernel/locking/spinlock.c:154
 spin_lock include/linux/spinlock.h:363 [inline]
 ptr_ring_produce include/linux/ptr_ring.h:128 [inline]
 cpu_map_generic_redirect+0x1d5/0x6d0 kernel/bpf/cpumap.c:786
 xdp_do_generic_redirect_map net/core/filter.c:4189 [inline]
 xdp_do_generic_redirect+0x3df/0xb40 net/core/filter.c:4236
 do_xdp_generic+0x50b/0x7c0 net/core/dev.c:4919
 __netif_receive_skb_core+0x1706/0x3640 net/core/dev.c:5324
 __netif_receive_skb_one_core net/core/dev.c:5499 [inline]
 __netif_receive_skb+0x11c/0x530 net/core/dev.c:5615
 process_backlog+0x31c/0x650 net/core/dev.c:6492
 __napi_poll+0xc4/0x5a0 net/core/dev.c:7051
 napi_poll net/core/dev.c:7118 [inline]
 net_rx_action+0x47d/0xc50 net/core/dev.c:7208
 handle_softirqs+0x25e/0x5c0 kernel/softirq.c:565
 __do_softirq+0xb/0xd kernel/softirq.c:603
 do_softirq+0xf6/0x150 kernel/softirq.c:452
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0x75/0x80 kernel/softirq.c:379
 __raw_read_unlock_bh include/linux/rwlock_api_smp.h:251 [inline]
 _raw_read_unlock_bh+0x29/0x30 kernel/locking/spinlock.c:284
 wg_socket_send_skb_to_peer+0x178/0x1d0 drivers/net/wireguard/socket.c:184
 wg_packet_create_data_done drivers/net/wireguard/send.c:251 [inline]
 wg_packet_tx_worker+0x1e6/0x530 drivers/net/wireguard/send.c:276
 process_one_work+0x6bb/0xc10 kernel/workqueue.c:2325
 worker_thread+0xad5/0x12a0 kernel/workqueue.c:2472
 kthread+0x421/0x510 kernel/kthread.c:337
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>
Modules linked in:
---[ end trace 2ecb828003406d55 ]---
RIP: 0010:__pv_queued_spin_lock_slowpath+0x2f3/0xc40 kernel/locking/qspinlock.c:471
Code: 74 1e 48 89 4c 24 10 48 8b 7c 24 10 e8 26 98 5d 00 48 8b 4c 24 10 48 ba 00 00 00 00 00 fc ff df 4c 03 21 4c 89 e0 48 c1 e8 03 <80> 3c 10 00 74 12 4c 89 e7 e8 9f 98 5d 00 48 ba 00 00 00 00 00 fc
RSP: 0018:ffffc900001d05c0 EFLAGS: 00010206
RAX: 0010f8fb9f81ff59 RBX: ffff8881f7138ad4 RCX: ffffffff86285820
RDX: dffffc0000000000 RSI: 0000000000000002 RDI: 00000000ffffffff
RBP: ffffc900001d06b0 R08: ffffffff8141a99b R09: 0000000000000003
R10: fffffbfff0e9a84c R11: dffffc0000000001 R12: 0087c7dcfc0ffac9
R13: 1ffff11022ba6200 R14: 1ffff1103ee27159 R15: ffff888115d31004
FS:  0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffe30230ff8 CR3: 0000000124619000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
   0:	74 1e                	je     0x20
   2:	48 89 4c 24 10       	mov    %rcx,0x10(%rsp)
   7:	48 8b 7c 24 10       	mov    0x10(%rsp),%rdi
   c:	e8 26 98 5d 00       	call   0x5d9837
  11:	48 8b 4c 24 10       	mov    0x10(%rsp),%rcx
  16:	48 ba 00 00 00 00 00 	movabs $0xdffffc0000000000,%rdx
  1d:	fc ff df
  20:	4c 03 21             	add    (%rcx),%r12
  23:	4c 89 e0             	mov    %r12,%rax
  26:	48 c1 e8 03          	shr    $0x3,%rax
* 2a:	80 3c 10 00          	cmpb   $0x0,(%rax,%rdx,1) <-- trapping instruction
  2e:	74 12                	je     0x42
  30:	4c 89 e7             	mov    %r12,%rdi
  33:	e8 9f 98 5d 00       	call   0x5d98d7
  38:	48                   	rex.W
  39:	ba 00 00 00 00       	mov    $0x0,%edx
  3e:	00 fc                	add    %bh,%ah

Time	Kernel	Commit	Syzkaller	Config	Log	Report	VM info	Assets (help?)	Manager	Title
2025/01/29 13:03	android13-5.15-lts	d1a25a6a4b3b	136953f1	.config	console log	report	info	[disk image] [vmlinux] [kernel image]	ci2-android-5-15	KASAN: use-after-free Read in cpu_map_generic_redirect
2025/01/29 00:50	android13-5.15-lts	d1a25a6a4b3b	865ef71e	.config	console log	report	info	[disk image] [vmlinux] [kernel image]	ci2-android-5-15	KASAN: use-after-free Read in cpu_map_generic_redirect
2025/01/29 00:50	android13-5.15-lts	d1a25a6a4b3b	865ef71e	.config	console log	report	info	[disk image] [vmlinux] [kernel image]	ci2-android-5-15	KASAN: use-after-free Read in cpu_map_generic_redirect
2025/01/24 14:28	android13-5.15-lts	829d9f138569	1293872d	.config	console log	report	info	[disk image] [vmlinux] [kernel image]	ci2-android-5-15	KASAN: use-after-free Read in cpu_map_generic_redirect
2025/01/23 18:09	android13-5.15-lts	829d9f138569	521b0ce3	.config	console log	report	info	[disk image] [vmlinux] [kernel image]	ci2-android-5-15	KASAN: use-after-free Read in cpu_map_generic_redirect
2025/01/20 15:34	android13-5.15-lts	829d9f138569	6e87cfa2	.config	console log	report	info	[disk image] [vmlinux] [kernel image]	ci2-android-5-15	KASAN: use-after-free Read in cpu_map_generic_redirect
2025/01/16 14:01	android13-5.15-lts	829d9f138569	f9e07a6e	.config	console log	report	info	[disk image] [vmlinux] [kernel image]	ci2-android-5-15	KASAN: use-after-free Read in cpu_map_generic_redirect
2025/01/15 04:14	android13-5.15-lts	829d9f138569	7315a7cf	.config	console log	report	info	[disk image] [vmlinux] [kernel image]	ci2-android-5-15	KASAN: use-after-free Read in cpu_map_generic_redirect
2025/01/15 04:14	android13-5.15-lts	829d9f138569	7315a7cf	.config	console log	report	info	[disk image] [vmlinux] [kernel image]	ci2-android-5-15	KASAN: use-after-free Read in cpu_map_generic_redirect
2025/02/19 17:04	android13-5.15-lts	058abb720bd1	b257a9b7	.config	console log	report	info	[disk image] [vmlinux] [kernel image]	ci2-android-5-15	UBSAN: array-index-out-of-bounds in cpu_map_generic_redirect