Warning: Permanently added '10.128.0.35' (ECDSA) to the list of known hosts. executing program [ 72.409818][ T8418] ================================================================== [ 72.418068][ T8418] BUG: KASAN: use-after-free in find_uprobe+0x12c/0x150 [ 72.426865][ T8418] Read of size 8 at addr ffff88801eacc568 by task syz-executor164/8418 [ 72.435086][ T8418] [ 72.437403][ T8418] CPU: 1 PID: 8418 Comm: syz-executor164 Not tainted 5.11.0-rc6-next-20210205-syzkaller #0 [ 72.447362][ T8418] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 72.457498][ T8418] Call Trace: [ 72.460766][ T8418] dump_stack+0x107/0x163 [ 72.465092][ T8418] ? find_uprobe+0x12c/0x150 [ 72.469669][ T8418] ? find_uprobe+0x12c/0x150 [ 72.474263][ T8418] print_address_description.constprop.0.cold+0x5b/0x2f8 [ 72.481289][ T8418] ? find_uprobe+0x12c/0x150 [ 72.485992][ T8418] ? find_uprobe+0x12c/0x150 [ 72.490596][ T8418] kasan_report.cold+0x7c/0xd8 [ 72.495372][ T8418] ? find_uprobe+0x12c/0x150 [ 72.499956][ T8418] find_uprobe+0x12c/0x150 [ 72.504364][ T8418] uprobe_unregister+0x1e/0x70 [ 72.509135][ T8418] __probe_event_disable+0x11e/0x240 [ 72.514427][ T8418] probe_event_disable+0x155/0x1c0 [ 72.519526][ T8418] trace_uprobe_register+0x45a/0x880 [ 72.524801][ T8418] ? trace_uprobe_register+0x3ef/0x880 [ 72.530244][ T8418] ? rcu_read_lock_sched_held+0x3a/0x70 [ 72.535789][ T8418] perf_trace_event_unreg.isra.0+0xac/0x250 [ 72.541670][ T8418] perf_uprobe_destroy+0xbb/0x130 [ 72.546681][ T8418] ? perf_uprobe_init+0x210/0x210 [ 72.551691][ T8418] _free_event+0x2ee/0x1380 [ 72.556185][ T8418] perf_event_release_kernel+0xa24/0xe00 [ 72.561803][ T8418] ? fsnotify_first_mark+0x1f0/0x1f0 [ 72.567078][ T8418] ? __perf_event_exit_context+0x170/0x170 [ 72.572887][ T8418] ? __sanitizer_cov_trace_const_cmp2+0x22/0x80 [ 72.579237][ T8418] perf_release+0x33/0x40 [ 72.583570][ T8418] __fput+0x283/0x920 [ 72.587541][ T8418] ? perf_event_release_kernel+0xe00/0xe00 [ 72.593348][ T8418] task_work_run+0xdd/0x190 [ 72.597841][ T8418] do_exit+0xc5c/0x2ae0 [ 72.602008][ T8418] ? mm_update_next_owner+0x7a0/0x7a0 [ 72.607382][ T8418] ? __sanitizer_cov_trace_const_cmp1+0x22/0x80 [ 72.613610][ T8418] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 72.619858][ T8418] do_group_exit+0x125/0x310 [ 72.624437][ T8418] __x64_sys_exit_group+0x3a/0x50 [ 72.629448][ T8418] do_syscall_64+0x2d/0x70 [ 72.633854][ T8418] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 72.639752][ T8418] RIP: 0033:0x43ddc9 [ 72.643637][ T8418] Code: Unable to access opcode bytes at RIP 0x43dd9f. [ 72.650459][ T8418] RSP: 002b:00007ffcd166d608 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 72.658879][ T8418] RAX: ffffffffffffffda RBX: 00000000004af2f0 RCX: 000000000043ddc9 [ 72.666844][ T8418] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 [ 72.674915][ T8418] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000000400488 [ 72.682893][ T8418] R10: 00000000ffffffff R11: 0000000000000246 R12: 00000000004af2f0 [ 72.690858][ T8418] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001 [ 72.698834][ T8418] [ 72.701142][ T8418] Allocated by task 8418: [ 72.705447][ T8418] kasan_save_stack+0x1b/0x40 [ 72.710113][ T8418] ____kasan_kmalloc.constprop.0+0xa0/0xd0 [ 72.715906][ T8418] __uprobe_register+0x19c/0x850 [ 72.720832][ T8418] probe_event_enable+0x441/0xa00 [ 72.725946][ T8418] trace_uprobe_register+0x443/0x880 [ 72.731215][ T8418] perf_trace_event_init+0x549/0xa20 [ 72.736484][ T8418] perf_uprobe_init+0x16f/0x210 [ 72.741331][ T8418] perf_uprobe_event_init+0xff/0x1c0 [ 72.746624][ T8418] perf_try_init_event+0x12a/0x560 [ 72.751730][ T8418] perf_event_alloc.part.0+0xe3b/0x3960 [ 72.757265][ T8418] __do_sys_perf_event_open+0x647/0x2e60 [ 72.763330][ T8418] do_syscall_64+0x2d/0x70 [ 72.767817][ T8418] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 72.773710][ T8418] [ 72.776016][ T8418] Freed by task 8418: [ 72.779994][ T8418] kasan_save_stack+0x1b/0x40 [ 72.784675][ T8418] kasan_set_track+0x1c/0x30 [ 72.789319][ T8418] kasan_set_free_info+0x20/0x30 [ 72.794244][ T8418] ____kasan_slab_free.part.0+0xe1/0x110 [ 72.799870][ T8418] slab_free_freelist_hook+0x82/0x1d0 [ 72.805231][ T8418] kfree+0xe5/0x7b0 [ 72.809023][ T8418] put_uprobe+0x13b/0x190 [ 72.813430][ T8418] uprobe_apply+0xfc/0x130 [ 72.817833][ T8418] trace_uprobe_register+0x5c9/0x880 [ 72.823122][ T8418] perf_trace_event_init+0x17a/0xa20 [ 72.828391][ T8418] perf_uprobe_init+0x16f/0x210 [ 72.833225][ T8418] perf_uprobe_event_init+0xff/0x1c0 [ 72.838492][ T8418] perf_try_init_event+0x12a/0x560 [ 72.843600][ T8418] perf_event_alloc.part.0+0xe3b/0x3960 [ 72.849146][ T8418] __do_sys_perf_event_open+0x647/0x2e60 [ 72.854761][ T8418] do_syscall_64+0x2d/0x70 [ 72.859161][ T8418] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 72.865053][ T8418] [ 72.867371][ T8418] The buggy address belongs to the object at ffff88801eacc400 [ 72.867371][ T8418] which belongs to the cache kmalloc-512 of size 512 [ 72.881433][ T8418] The buggy address is located 360 bytes inside of [ 72.881433][ T8418] 512-byte region [ffff88801eacc400, ffff88801eacc600) [ 72.894690][ T8418] The buggy address belongs to the page: [ 72.900313][ T8418] page:00000000e51c0836 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1eacc [ 72.910448][ T8418] head:00000000e51c0836 order:1 compound_mapcount:0 [ 72.917016][ T8418] flags: 0xfff00000010200(slab|head) [ 72.922303][ T8418] raw: 00fff00000010200 0000000000000000 0000000200000001 ffff888010841c80 [ 72.930869][ T8418] raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000 [ 72.939432][ T8418] page dumped because: kasan: bad access detected [ 72.945832][ T8418] [ 72.948182][ T8418] Memory state around the buggy address: [ 72.953805][ T8418] ffff88801eacc400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 72.961858][ T8418] ffff88801eacc480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 72.969931][ T8418] >ffff88801eacc500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 72.977988][ T8418] ^ [ 72.985436][ T8418] ffff88801eacc580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 72.993550][ T8418] ffff88801eacc600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 73.001600][ T8418] ================================================================== [ 73.009647][ T8418] Disabling lock debugging due to kernel taint [ 73.016099][ T8418] Kernel panic - not syncing: panic_on_warn set ... [ 73.022696][ T8418] CPU: 1 PID: 8418 Comm: syz-executor164 Tainted: G B 5.11.0-rc6-next-20210205-syzkaller #0 [ 73.034094][ T8418] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 73.044158][ T8418] Call Trace: [ 73.047428][ T8418] dump_stack+0x107/0x163 [ 73.051746][ T8418] ? find_uprobe+0x90/0x150 [ 73.056234][ T8418] panic+0x306/0x73d [ 73.060124][ T8418] ? __warn_printk+0xf3/0xf3 [ 73.064694][ T8418] ? asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 73.070844][ T8418] ? trace_hardirqs_on+0x38/0x1c0 [ 73.075854][ T8418] ? trace_hardirqs_on+0x51/0x1c0 [ 73.080876][ T8418] ? find_uprobe+0x12c/0x150 [ 73.085448][ T8418] ? find_uprobe+0x12c/0x150 [ 73.090046][ T8418] end_report.cold+0x5a/0x5a [ 73.094634][ T8418] kasan_report.cold+0x6a/0xd8 [ 73.099378][ T8418] ? find_uprobe+0x12c/0x150 [ 73.103952][ T8418] find_uprobe+0x12c/0x150 [ 73.108347][ T8418] uprobe_unregister+0x1e/0x70 [ 73.113094][ T8418] __probe_event_disable+0x11e/0x240 [ 73.118376][ T8418] probe_event_disable+0x155/0x1c0 [ 73.123481][ T8418] trace_uprobe_register+0x45a/0x880 [ 73.128755][ T8418] ? trace_uprobe_register+0x3ef/0x880 [ 73.134207][ T8418] ? rcu_read_lock_sched_held+0x3a/0x70 [ 73.139757][ T8418] perf_trace_event_unreg.isra.0+0xac/0x250 [ 73.145655][ T8418] perf_uprobe_destroy+0xbb/0x130 [ 73.150673][ T8418] ? perf_uprobe_init+0x210/0x210 [ 73.155690][ T8418] _free_event+0x2ee/0x1380 [ 73.160178][ T8418] perf_event_release_kernel+0xa24/0xe00 [ 73.165814][ T8418] ? fsnotify_first_mark+0x1f0/0x1f0 [ 73.171220][ T8418] ? __perf_event_exit_context+0x170/0x170 [ 73.177018][ T8418] ? __sanitizer_cov_trace_const_cmp2+0x22/0x80 [ 73.183363][ T8418] perf_release+0x33/0x40 [ 73.187696][ T8418] __fput+0x283/0x920 [ 73.191666][ T8418] ? perf_event_release_kernel+0xe00/0xe00 [ 73.197482][ T8418] task_work_run+0xdd/0x190 [ 73.201997][ T8418] do_exit+0xc5c/0x2ae0 [ 73.206139][ T8418] ? mm_update_next_owner+0x7a0/0x7a0 [ 73.211494][ T8418] ? __sanitizer_cov_trace_const_cmp1+0x22/0x80 [ 73.221191][ T8418] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 73.227419][ T8418] do_group_exit+0x125/0x310 [ 73.232014][ T8418] __x64_sys_exit_group+0x3a/0x50 [ 73.237109][ T8418] do_syscall_64+0x2d/0x70 [ 73.241510][ T8418] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 73.247398][ T8418] RIP: 0033:0x43ddc9 [ 73.251272][ T8418] Code: Unable to access opcode bytes at RIP 0x43dd9f. [ 73.259134][ T8418] RSP: 002b:00007ffcd166d608 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 73.267527][ T8418] RAX: ffffffffffffffda RBX: 00000000004af2f0 RCX: 000000000043ddc9 [ 73.275495][ T8418] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 [ 73.283538][ T8418] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000000400488 [ 73.291492][ T8418] R10: 00000000ffffffff R11: 0000000000000246 R12: 00000000004af2f0 [ 73.299461][ T8418] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001 [ 73.308440][ T8418] Kernel Offset: disabled [ 73.312772][ T8418] Rebooting in 86400 seconds..