Warning: Permanently added '10.128.10.55' (ECDSA) to the list of known hosts. executing program [ 71.013344][ T8390] ================================================================== [ 71.021569][ T8390] BUG: KASAN: use-after-free in find_uprobe+0x12c/0x150 [ 71.028740][ T8390] Read of size 8 at addr ffff88802092dd68 by task syz-executor280/8390 [ 71.036963][ T8390] [ 71.039272][ T8390] CPU: 0 PID: 8390 Comm: syz-executor280 Not tainted 5.11.0-rc6-next-20210205-syzkaller #0 [ 71.049244][ T8390] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 71.059284][ T8390] Call Trace: [ 71.062552][ T8390] dump_stack+0x107/0x163 [ 71.066885][ T8390] ? find_uprobe+0x12c/0x150 [ 71.071464][ T8390] ? find_uprobe+0x12c/0x150 [ 71.076039][ T8390] print_address_description.constprop.0.cold+0x5b/0x2f8 [ 71.083066][ T8390] ? find_uprobe+0x12c/0x150 [ 71.087657][ T8390] ? find_uprobe+0x12c/0x150 [ 71.092233][ T8390] kasan_report.cold+0x7c/0xd8 [ 71.096986][ T8390] ? find_uprobe+0x12c/0x150 [ 71.101566][ T8390] find_uprobe+0x12c/0x150 [ 71.105972][ T8390] uprobe_apply+0x26/0x130 [ 71.110394][ T8390] uprobe_perf_close+0x41e/0x6f0 [ 71.115349][ T8390] trace_uprobe_register+0x3e7/0x880 [ 71.120626][ T8390] ? rcu_read_lock_sched_held+0x3a/0x70 [ 71.126180][ T8390] ? kfree+0x69a/0x7b0 [ 71.130240][ T8390] perf_uprobe_destroy+0x98/0x130 [ 71.135290][ T8390] ? perf_uprobe_init+0x210/0x210 [ 71.140304][ T8390] _free_event+0x2ee/0x1380 [ 71.144796][ T8390] perf_event_release_kernel+0xa24/0xe00 [ 71.150415][ T8390] ? fsnotify_first_mark+0x1f0/0x1f0 [ 71.155692][ T8390] ? __perf_event_exit_context+0x170/0x170 [ 71.161491][ T8390] ? __sanitizer_cov_trace_const_cmp2+0x22/0x80 [ 71.167724][ T8390] perf_release+0x33/0x40 [ 71.172045][ T8390] __fput+0x283/0x920 [ 71.176016][ T8390] ? perf_event_release_kernel+0xe00/0xe00 [ 71.181902][ T8390] task_work_run+0xdd/0x190 [ 71.186401][ T8390] do_exit+0xc5c/0x2ae0 [ 71.190553][ T8390] ? mm_update_next_owner+0x7a0/0x7a0 [ 71.195928][ T8390] ? __sanitizer_cov_trace_const_cmp1+0x22/0x80 [ 71.202158][ T8390] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 71.208413][ T8390] do_group_exit+0x125/0x310 [ 71.213095][ T8390] __x64_sys_exit_group+0x3a/0x50 [ 71.218631][ T8390] do_syscall_64+0x2d/0x70 [ 71.223035][ T8390] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 71.228927][ T8390] RIP: 0033:0x43daf9 [ 71.232908][ T8390] Code: Unable to access opcode bytes at RIP 0x43dacf. [ 71.239754][ T8390] RSP: 002b:00007ffef110c988 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 71.248184][ T8390] RAX: ffffffffffffffda RBX: 00000000004ae230 RCX: 000000000043daf9 [ 71.257793][ T8390] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 [ 71.265764][ T8390] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000000000000 [ 71.273733][ T8390] R10: 00000000ffffffff R11: 0000000000000246 R12: 00000000004ae230 [ 71.281691][ T8390] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001 [ 71.289662][ T8390] [ 71.291971][ T8390] Allocated by task 8390: [ 71.296291][ T8390] kasan_save_stack+0x1b/0x40 [ 71.300962][ T8390] ____kasan_kmalloc.constprop.0+0xa0/0xd0 [ 71.306754][ T8390] __uprobe_register+0x19c/0x850 [ 71.311680][ T8390] probe_event_enable+0x357/0xa00 [ 71.316689][ T8390] trace_uprobe_register+0x443/0x880 [ 71.321963][ T8390] perf_trace_event_init+0x549/0xa20 [ 71.327238][ T8390] perf_uprobe_init+0x16f/0x210 [ 71.332098][ T8390] perf_uprobe_event_init+0xff/0x1c0 [ 71.337368][ T8390] perf_try_init_event+0x12a/0x560 [ 71.342480][ T8390] perf_event_alloc.part.0+0xe3b/0x3960 [ 71.348026][ T8390] __do_sys_perf_event_open+0x647/0x2e60 [ 71.353667][ T8390] do_syscall_64+0x2d/0x70 [ 71.358096][ T8390] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 71.363994][ T8390] [ 71.366356][ T8390] Freed by task 8390: [ 71.370322][ T8390] kasan_save_stack+0x1b/0x40 [ 71.375003][ T8390] kasan_set_track+0x1c/0x30 [ 71.379577][ T8390] kasan_set_free_info+0x20/0x30 [ 71.384500][ T8390] ____kasan_slab_free.part.0+0xe1/0x110 [ 71.390229][ T8390] slab_free_freelist_hook+0x82/0x1d0 [ 71.395605][ T8390] kfree+0xe5/0x7b0 [ 71.399414][ T8390] put_uprobe+0x13b/0x190 [ 71.403736][ T8390] uprobe_apply+0xfc/0x130 [ 71.408175][ T8390] trace_uprobe_register+0x5c9/0x880 [ 71.413469][ T8390] perf_trace_event_init+0x17a/0xa20 [ 71.418758][ T8390] perf_uprobe_init+0x16f/0x210 [ 71.423594][ T8390] perf_uprobe_event_init+0xff/0x1c0 [ 71.428866][ T8390] perf_try_init_event+0x12a/0x560 [ 71.433963][ T8390] perf_event_alloc.part.0+0xe3b/0x3960 [ 71.439523][ T8390] __do_sys_perf_event_open+0x647/0x2e60 [ 71.445167][ T8390] do_syscall_64+0x2d/0x70 [ 71.449604][ T8390] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 71.455591][ T8390] [ 71.457903][ T8390] The buggy address belongs to the object at ffff88802092dc00 [ 71.457903][ T8390] which belongs to the cache kmalloc-512 of size 512 [ 71.472045][ T8390] The buggy address is located 360 bytes inside of [ 71.472045][ T8390] 512-byte region [ffff88802092dc00, ffff88802092de00) [ 71.485321][ T8390] The buggy address belongs to the page: [ 71.490938][ T8390] page:000000008e4d4885 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2092c [ 71.501088][ T8390] head:000000008e4d4885 order:1 compound_mapcount:0 [ 71.507657][ T8390] flags: 0xfff00000010200(slab|head) [ 71.512978][ T8390] raw: 00fff00000010200 0000000000000000 0000000200000001 ffff888010841c80 [ 71.521667][ T8390] raw: 0000000000000000 0000000080080008 00000001ffffffff 0000000000000000 [ 71.530505][ T8390] page dumped because: kasan: bad access detected [ 71.536923][ T8390] [ 71.539235][ T8390] Memory state around the buggy address: [ 71.544849][ T8390] ffff88802092dc00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 71.552898][ T8390] ffff88802092dc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 71.560956][ T8390] >ffff88802092dd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 71.569009][ T8390] ^ [ 71.576460][ T8390] ffff88802092dd80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 71.584535][ T8390] ffff88802092de00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 71.592596][ T8390] ================================================================== [ 71.600752][ T8390] Disabling lock debugging due to kernel taint [ 71.608149][ T8390] Kernel panic - not syncing: panic_on_warn set ... [ 71.614750][ T8390] CPU: 0 PID: 8390 Comm: syz-executor280 Tainted: G B 5.11.0-rc6-next-20210205-syzkaller #0 [ 71.626243][ T8390] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 71.636307][ T8390] Call Trace: [ 71.639577][ T8390] dump_stack+0x107/0x163 [ 71.643917][ T8390] ? find_uprobe+0x90/0x150 [ 71.648408][ T8390] panic+0x306/0x73d [ 71.652289][ T8390] ? __warn_printk+0xf3/0xf3 [ 71.656877][ T8390] ? asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 71.663036][ T8390] ? trace_hardirqs_on+0x38/0x1c0 [ 71.668060][ T8390] ? trace_hardirqs_on+0x51/0x1c0 [ 71.673069][ T8390] ? find_uprobe+0x12c/0x150 [ 71.677660][ T8390] ? find_uprobe+0x12c/0x150 [ 71.682250][ T8390] end_report.cold+0x5a/0x5a [ 71.686824][ T8390] kasan_report.cold+0x6a/0xd8 [ 71.691576][ T8390] ? find_uprobe+0x12c/0x150 [ 71.696151][ T8390] find_uprobe+0x12c/0x150 [ 71.700631][ T8390] uprobe_apply+0x26/0x130 [ 71.705058][ T8390] uprobe_perf_close+0x41e/0x6f0 [ 71.710011][ T8390] trace_uprobe_register+0x3e7/0x880 [ 71.715303][ T8390] ? rcu_read_lock_sched_held+0x3a/0x70 [ 71.720832][ T8390] ? kfree+0x69a/0x7b0 [ 71.724911][ T8390] perf_uprobe_destroy+0x98/0x130 [ 71.729917][ T8390] ? perf_uprobe_init+0x210/0x210 [ 71.734938][ T8390] _free_event+0x2ee/0x1380 [ 71.739423][ T8390] perf_event_release_kernel+0xa24/0xe00 [ 71.745140][ T8390] ? fsnotify_first_mark+0x1f0/0x1f0 [ 71.750426][ T8390] ? __perf_event_exit_context+0x170/0x170 [ 71.756216][ T8390] ? __sanitizer_cov_trace_const_cmp2+0x22/0x80 [ 71.762443][ T8390] perf_release+0x33/0x40 [ 71.766759][ T8390] __fput+0x283/0x920 [ 71.770727][ T8390] ? perf_event_release_kernel+0xe00/0xe00 [ 71.776517][ T8390] task_work_run+0xdd/0x190 [ 71.781006][ T8390] do_exit+0xc5c/0x2ae0 [ 71.785161][ T8390] ? mm_update_next_owner+0x7a0/0x7a0 [ 71.790706][ T8390] ? __sanitizer_cov_trace_const_cmp1+0x22/0x80 [ 71.796931][ T8390] ? __sanitizer_cov_trace_const_cmp4+0x1c/0x70 [ 71.803177][ T8390] do_group_exit+0x125/0x310 [ 71.807850][ T8390] __x64_sys_exit_group+0x3a/0x50 [ 71.812858][ T8390] do_syscall_64+0x2d/0x70 [ 71.817255][ T8390] entry_SYSCALL_64_after_hwframe+0x44/0xa9 [ 71.823153][ T8390] RIP: 0033:0x43daf9 [ 71.827040][ T8390] Code: Unable to access opcode bytes at RIP 0x43dacf. [ 71.833931][ T8390] RSP: 002b:00007ffef110c988 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 [ 71.842376][ T8390] RAX: ffffffffffffffda RBX: 00000000004ae230 RCX: 000000000043daf9 [ 71.850344][ T8390] RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 [ 71.858907][ T8390] RBP: 0000000000000000 R08: ffffffffffffffc0 R09: 0000000000000000 [ 71.866879][ T8390] R10: 00000000ffffffff R11: 0000000000000246 R12: 00000000004ae230 [ 71.874832][ T8390] R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000001 [ 71.883484][ T8390] Kernel Offset: disabled [ 71.887842][ T8390] Rebooting in 86400 seconds..