KASAN: vmalloc-out-of-bounds Read in bpf_trace

KASAN: vmalloc-out-of-bounds Read in bpf_trace_run1
Status: moderation: reported on 2020/10/17 05:53
Reported-by: syzbot+7caca50f0beefbe3f96b@syzkaller.appspotmail.com
First crash: 11d, last: 4d06h

Sample crash report:

==================================================================
BUG: KASAN: vmalloc-out-of-bounds in __bpf_trace_run kernel/trace/bpf_trace.c:2045 [inline]
BUG: KASAN: vmalloc-out-of-bounds in bpf_trace_run1+0x3b0/0x3c0 kernel/trace/bpf_trace.c:2081
Read of size 8 at addr ffffc90000fee030 by task kworker/u4:7/8507

CPU: 1 PID: 8507 Comm: kworker/u4:7 Not tainted 5.9.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: writeback wb_workfn (flush-8:0)
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x198/0x1fb lib/dump_stack.c:118
 print_address_description.constprop.0.cold+0x5/0x497 mm/kasan/report.c:385
 __kasan_report mm/kasan/report.c:545 [inline]
 kasan_report.cold+0x1f/0x37 mm/kasan/report.c:562
 __bpf_trace_run kernel/trace/bpf_trace.c:2045 [inline]
 bpf_trace_run1+0x3b0/0x3c0 kernel/trace/bpf_trace.c:2081
 __bpf_trace_block_plug+0x8b/0xc0 block/blk-core.c:712
 trace_block_plug+0x138/0x280 include/trace/events/block.h:470
 blk_mq_submit_bio+0xcf2/0x1770 block/blk-mq.c:2219
 __submit_bio_noacct_mq block/blk-core.c:1022 [inline]
 submit_bio_noacct+0xa27/0xe30 block/blk-core.c:1055
 submit_bio+0x263/0x5b0 block/blk-core.c:1125
 submit_bh_wbc+0x685/0x8e0 fs/buffer.c:3054
 __block_write_full_page+0x837/0x12f0 fs/buffer.c:1810
 block_write_full_page+0x205/0x260 fs/buffer.c:2980
 __writepage+0x60/0x180 mm/page-writeback.c:2311
 write_cache_pages+0x754/0x1190 mm/page-writeback.c:2246
 generic_writepages mm/page-writeback.c:2337 [inline]
 generic_writepages+0xe2/0x150 mm/page-writeback.c:2326
 do_writepages+0xec/0x290 mm/page-writeback.c:2352
 __writeback_single_inode+0x122/0x1180 fs/fs-writeback.c:1461
 writeback_sb_inodes+0x53d/0xef0 fs/fs-writeback.c:1721
 __writeback_inodes_wb+0xc6/0x280 fs/fs-writeback.c:1790
 wb_writeback+0x814/0xc40 fs/fs-writeback.c:1896
 wb_check_old_data_flush fs/fs-writeback.c:1998 [inline]
 wb_do_writeback fs/fs-writeback.c:2051 [inline]
 wb_workfn+0x891/0x12d0 fs/fs-writeback.c:2080
 process_one_work+0x933/0x15a0 kernel/workqueue.c:2269
 worker_thread+0x64c/0x1120 kernel/workqueue.c:2415
 kthread+0x3b5/0x4a0 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296


Memory state around the buggy address:
 ffffc90000fedf00: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
 ffffc90000fedf80: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
>ffffc90000fee000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
                                     ^
 ffffc90000fee080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
 ffffc90000fee100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8
==================================================================

Crashes (2):
Manager	Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Maintainers
ci-upstream-bpf-kasan-gce	2020/10/20 00:15	bpf	76702a2e	ff4a3345	.config	log	report			info	andrii@kernel.org, ast@kernel.org, bpf@vger.kernel.org, daniel@iogearbox.net, davem@davemloft.net, hawk@kernel.org, john.fastabend@gmail.com, kafai@fb.com, kpsingh@chromium.org, kuba@kernel.org, linux-kernel@vger.kernel.org, mingo@redhat.com, netdev@vger.kernel.org, rostedt@goodmis.org, songliubraving@fb.com, yhs@fb.com
ci-upstream-bpf-next-kasan-gce	2020/10/13 05:43	bpf-next	376dcfe3	d32b0bbf	.config	log	report			info	andrii@kernel.org, ast@kernel.org, bpf@vger.kernel.org, daniel@iogearbox.net, davem@davemloft.net, hawk@kernel.org, john.fastabend@gmail.com, kafai@fb.com, kpsingh@chromium.org, kuba@kernel.org, linux-kernel@vger.kernel.org, mingo@redhat.com, netdev@vger.kernel.org, rostedt@goodmis.org, songliubraving@fb.com, yhs@fb.com