==================================================================
BUG: KASAN: use-after-free in __rb_change_child include/linux/rbtree_augmented.h:173 [inline]
BUG: KASAN: use-after-free in __rb_rotate_set_parents lib/rbtree.c:81 [inline]
BUG: KASAN: use-after-free in __rb_insert lib/rbtree.c:215 [inline]
BUG: KASAN: use-after-free in __rb_insert_augmented+0x5a8/0x610 lib/rbtree.c:459
Read of size 8 at addr ffff8881c0000010 by task syz-executor.2/1363
CPU: 0 PID: 1363 Comm: syz-executor.2 Not tainted 5.15.137-syzkaller-01792-g61cfd264993d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x151/0x1b7 lib/dump_stack.c:106
print_address_description+0x87/0x3b0 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:427 [inline]
kasan_report+0x179/0x1c0 mm/kasan/report.c:444
__asan_report_load8_noabort+0x14/0x20 mm/kasan/report_generic.c:309
__rb_change_child include/linux/rbtree_augmented.h:173 [inline]
__rb_rotate_set_parents lib/rbtree.c:81 [inline]
__rb_insert lib/rbtree.c:215 [inline]
__rb_insert_augmented+0x5a8/0x610 lib/rbtree.c:459
rb_insert_augmented include/linux/rbtree_augmented.h:50 [inline]
rb_insert_augmented_cached include/linux/rbtree_augmented.h:60 [inline]
vma_interval_tree_insert+0x341/0x350 mm/interval_tree.c:23
__vma_link_file mm/mmap.c:674 [inline]
vma_link+0x18a/0x1f0 mm/mmap.c:700
mmap_region+0x16b8/0x1b60 mm/mmap.c:1853
do_mmap+0x776/0xe50 mm/mmap.c:1584
vm_mmap_pgoff+0x1dd/0x450 mm/util.c:555
vm_mmap+0x8d/0xb0 mm/util.c:575
elf_map+0x19c/0x240 fs/binfmt_elf.c:392
load_elf_binary+0xfe0/0x2750 fs/binfmt_elf.c:1141
search_binary_handler fs/exec.c:1739 [inline]
exec_binprm fs/exec.c:1780 [inline]
bprm_execve+0x7ae/0x14a0 fs/exec.c:1849
do_execveat_common+0x565/0x710 fs/exec.c:1954
do_execve fs/exec.c:2024 [inline]
__do_sys_execve fs/exec.c:2100 [inline]
__se_sys_execve fs/exec.c:2095 [inline]
__x64_sys_execve+0x92/0xb0 fs/exec.c:2095
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x403ace
Code: Unable to access opcode bytes at RIP 0x403aa4.
RSP: 002b:000000c00a61ac48 EFLAGS: 00000206
ORIG_RAX: 000000000000003b
RAX: ffffffffffffffda RBX: 000000c0241960f0 RCX: 0000000000403ace
RDX: 000000c0256a4420 RSI: 000000c014f8e048 RDI: 000000c0241960f0
RBP: 000000c00a61ac88 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 00000000004b4ff4
R13: 0000000000000010 R14: 000000c000007ba0 R15: 000000c0007ee000
</TASK>
The buggy address belongs to the page:
page:ffffea0007000000 refcount:0 mapcount:-128 mapping:0000000000000000 index:0x0 pfn:0x1c0000
flags: 0x4000000000000000(zone=1)
raw: 4000000000000000 ffffea0006ff0008 ffffea0007010008 0000000000000000
raw: 0000000000000000 000000000000000a 00000000ffffff7f 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x506dc0(GFP_USER|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_ZERO|__GFP_ACCOUNT), pid 11699, ts 1857700163248, free_ts 1860205364940
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0x1a3/0x1b0 mm/page_alloc.c:2602
prep_new_page+0x1b/0x110 mm/page_alloc.c:2608
get_page_from_freelist+0x3550/0x35d0 mm/page_alloc.c:4482
__alloc_pages+0x206/0x5e0 mm/page_alloc.c:5773
__alloc_pages_node include/linux/gfp.h:591 [inline]
alloc_pages_node include/linux/gfp.h:605 [inline]
bpf_ringbuf_area_alloc kernel/bpf/ringbuf.c:96 [inline]
bpf_ringbuf_alloc+0xd0/0x3d0 kernel/bpf/ringbuf.c:133
ringbuf_map_alloc+0x202/0x320 kernel/bpf/ringbuf.c:172
find_and_alloc_map kernel/bpf/syscall.c:129 [inline]
map_create+0x411/0x2050 kernel/bpf/syscall.c:857
__sys_bpf+0x296/0x760 kernel/bpf/syscall.c:4600
__do_sys_bpf kernel/bpf/syscall.c:4722 [inline]
__se_sys_bpf kernel/bpf/syscall.c:4720 [inline]
__x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:4720
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb
page last free stack trace:
reset_page_owner include/linux/page_owner.h:26 [inline]
free_pages_prepare mm/page_alloc.c:1469 [inline]
free_pcp_prepare mm/page_alloc.c:1541 [inline]
free_unref_page_prepare+0x7c8/0x7d0 mm/page_alloc.c:3531
free_unref_page+0xe6/0x730 mm/page_alloc.c:3613
free_the_page mm/page_alloc.c:802 [inline]
__free_pages+0x61/0xf0 mm/page_alloc.c:5849
bpf_ringbuf_free kernel/bpf/ringbuf.c:191 [inline]
ringbuf_map_free+0xbe/0x120 kernel/bpf/ringbuf.c:200
map_create+0x1a3a/0x2050 kernel/bpf/syscall.c:935
__sys_bpf+0x296/0x760 kernel/bpf/syscall.c:4600
__do_sys_bpf kernel/bpf/syscall.c:4722 [inline]
__se_sys_bpf kernel/bpf/syscall.c:4720 [inline]
__x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:4720
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb
Memory state around the buggy address:
ffff8881bfffff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff8881bfffff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff8881c0000000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
^
ffff8881c0000080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
ffff8881c0000100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] PREEMPT SMP KASAN
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 0 PID: 1363 Comm: syz-executor.2 Tainted: G B 5.15.137-syzkaller-01792-g61cfd264993d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/09/2023
RIP: 0010:__rb_insert lib/rbtree.c:115 [inline]
RIP: 0010:__rb_insert_augmented+0x91/0x610 lib/rbtree.c:459
Code: 00 74 08 4c 89 ef e8 ae b3 2b ff 49 8b 45 00 a8 01 0f 85 60 05 00 00 48 89 5d a0 48 89 45 c0 48 8d 58 08 49 89 de 49 c1 ee 03 <43> 80 3c 26 00 74 08 48 89 df e8 80 b3 2b ff 48 89 d8 48 8b 1b 4c
RSP: 0018:ffffc90000e678f8 EFLAGS: 00010202
RAX: 0000000000000000 RBX: 0000000000000008 RCX: ffffffff82864062
RDX: 0000000000000000 RSI: 0000000000000292 RDI: ffff8881c0000000
RBP: ffffc90000e67960 R08: dffffc0000000000 R09: ffff88811d386188
R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000
R13: ffff8881c0000000 R14: 0000000000000001 R15: ffff8881164f6620
FS: 0000555557499480(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f59f3852f40 CR3: 000000010f4ac000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
<TASK>
rb_insert_augmented include/linux/rbtree_augmented.h:50 [inline]
vma_interval_tree_insert_after+0x2be/0x2d0 mm/interval_tree.c:57
dup_mmap kernel/fork.c:631 [inline]
dup_mm kernel/fork.c:1521 [inline]
copy_mm+0xba2/0x13e0 kernel/fork.c:1573
copy_process+0x12bc/0x3260 kernel/fork.c:2264
kernel_clone+0x21e/0x9e0 kernel/fork.c:2662
__do_sys_clone kernel/fork.c:2788 [inline]
__se_sys_clone kernel/fork.c:2772 [inline]
__x64_sys_clone+0x23f/0x290 kernel/fork.c:2772
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x61/0xcb
RIP: 0033:0x7f59f3730b13
Code: 1f 84 00 00 00 00 00 64 48 8b 04 25 10 00 00 00 45 31 c0 31 d2 31 f6 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 89 c2 85 c0 75 2c 64 48 8b 04 25 10 00 00
RSP: 002b:00007ffe375053d8 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f59f3730b13
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000555557499750 R11: 0000000000000246 R12: 0000000000000001
R13: 0000000000000006 R14: 00007f59f38534f8 R15: 0000000000000006
</TASK>
Modules linked in:
---[ end trace 8651802c9773c367 ]---
RIP: 0010:__rb_insert lib/rbtree.c:115 [inline]
RIP: 0010:__rb_insert_augmented+0x91/0x610 lib/rbtree.c:459
Code: 00 74 08 4c 89 ef e8 ae b3 2b ff 49 8b 45 00 a8 01 0f 85 60 05 00 00 48 89 5d a0 48 89 45 c0 48 8d 58 08 49 89 de 49 c1 ee 03 <43> 80 3c 26 00 74 08 48 89 df e8 80 b3 2b ff 48 89 d8 48 8b 1b 4c
RSP: 0018:ffffc90000e678f8 EFLAGS: 00010202
RAX: 0000000000000000 RBX: 0000000000000008 RCX: ffffffff82864062
RDX: 0000000000000000 RSI: 0000000000000292 RDI: ffff8881c0000000
RBP: ffffc90000e67960 R08: dffffc0000000000 R09: ffff88811d386188
R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000
R13: ffff8881c0000000 R14: 0000000000000001 R15: ffff8881164f6620
FS: 0000555557499480(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f59f3852f40 CR3: 000000010f4ac000 CR4: 00000000003506b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
----------------
Code disassembly (best guess):
0: 00 74 08 4c add %dh,0x4c(%rax,%rcx,1)
4: 89 ef mov %ebp,%edi
6: e8 ae b3 2b ff call 0xff2bb3b9
b: 49 8b 45 00 mov 0x0(%r13),%rax
f: a8 01 test $0x1,%al
11: 0f 85 60 05 00 00 jne 0x577
17: 48 89 5d a0 mov %rbx,-0x60(%rbp)
1b: 48 89 45 c0 mov %rax,-0x40(%rbp)
1f: 48 8d 58 08 lea 0x8(%rax),%rbx
23: 49 89 de mov %rbx,%r14
26: 49 c1 ee 03 shr $0x3,%r14
* 2a: 43 80 3c 26 00 cmpb $0x0,(%r14,%r12,1) <-- trapping instruction
2f: 74 08 je 0x39
31: 48 89 df mov %rbx,%rdi
34: e8 80 b3 2b ff call 0xff2bb3b9
39: 48 89 d8 mov %rbx,%rax
3c: 48 8b 1b mov (%rbx),%rbx
3f: 4c rex.WR