==================================================================
BUG: KASAN: stack-out-of-bounds in jhash2 include/linux/jhash.h:128 [inline]
BUG: KASAN: stack-out-of-bounds in hash+0x227/0xc20 kernel/bpf/bloom_filter.c:36
Read of size 4 at addr ffffc90000107900 by task rcu_exp_gp_kthr/16
CPU: 1 PID: 16 Comm: rcu_exp_gp_kthr Not tainted 6.1.75-syzkaller-00089-g1794308d463f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x151/0x1b7 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:316 [inline]
print_report+0x158/0x4e0 mm/kasan/report.c:427
kasan_report+0x13c/0x170 mm/kasan/report.c:531
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:350
jhash2 include/linux/jhash.h:128 [inline]
hash+0x227/0xc20 kernel/bpf/bloom_filter.c:36
bloom_map_peek_elem+0xac/0x1a0 kernel/bpf/bloom_filter.c:51
bpf_prog_00798911c748094f+0x3a/0x3e
bpf_dispatcher_nop_func include/linux/bpf.h:987 [inline]
__bpf_prog_run include/linux/filter.h:600 [inline]
bpf_prog_run include/linux/filter.h:607 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2275 [inline]
bpf_trace_run3+0x177/0x2e0 kernel/trace/bpf_trace.c:2315
__bpf_trace_timer_start+0x2b/0x40 include/trace/events/timer.h:53
trace_timer_start include/trace/events/timer.h:53 [inline]
enqueue_timer+0x303/0x480 kernel/time/timer.c:615
internal_add_timer kernel/time/timer.c:640 [inline]
__mod_timer+0x8d3/0xcf0 kernel/time/timer.c:1121
schedule_timeout+0x187/0x380 kernel/time/timer.c:1940
synchronize_rcu_expedited_wait_once kernel/rcu/tree_exp.h:571 [inline]
synchronize_rcu_expedited_wait kernel/rcu/tree_exp.h:622 [inline]
rcu_exp_wait_wake kernel/rcu/tree_exp.h:690 [inline]
rcu_exp_sel_wait_wake+0x7fc/0x1fd0 kernel/rcu/tree_exp.h:724
wait_rcu_exp_gp+0x33/0x40 kernel/rcu/tree_exp.h:460
kthread_worker_fn+0x3bb/0x790 kernel/kthread.c:835
kthread+0x26d/0x300 kernel/kthread.c:386
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
The buggy address belongs to stack of task rcu_exp_gp_kthr/16
and is located at offset 0 in frame:
bpf_trace_run3+0x0/0x2e0
This frame has 1 object:
[32, 56) 'args'
The buggy address belongs to the virtual mapping at
[ffffc90000100000, ffffc90000109000) created by:
copy_process+0x5c3/0x3530 kernel/fork.c:2199
The buggy address belongs to the physical page:
page:ffffea0004027180 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1009c6
flags: 0x4000000000000000(zone=1)
raw: 4000000000000000 0000000000000000 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x0(), pid 1, tgid 1 (swapper/0), ts 1081058866, free_ts 0
create_dummy_stack mm/page_owner.c:68 [inline]
register_early_stack+0x86/0xe0 mm/page_owner.c:84
init_page_owner+0x3d/0x650 mm/page_owner.c:94
invoke_init_callbacks mm/page_ext.c:130 [inline]
page_ext_init+0x3a6/0x3cb mm/page_ext.c:524
kernel_init_freeable+0x2ec/0x451 init/main.c:1620
page_owner free stack trace missing
Memory state around the buggy address:
ffffc90000107800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffffc90000107880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffc90000107900: f1 f1 f1 f1 00 00 00 f3 f3 f3 f3 f3 00 00 00 00
^
ffffc90000107980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffffc90000107a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
BUG: unable to handle page fault for address: ffffc90000108000
#PF: supervisor read access in kernel mode
#PF: error_code(0x0000) - not-present page
PGD 100000067 P4D 100000067 PUD 100154067
PMD 100155067
PTE 0
Oops: 0000 [#2] PREEMPT SMP KASAN
CPU: 1 PID: 16 Comm: rcu_exp_gp_kthr Tainted: G B D 6.1.75-syzkaller-00089-g1794308d463f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
RIP: 0010:jhash2 include/linux/jhash.h:126 [inline]
RIP: 0010:hash+0xe3/0xc20 kernel/bpf/bloom_filter.c:36
Code: 83 c6 0c 41 83 c0 fd 45 89 ec 44 89 eb 48 89 f0 48 c1 e8 03 48 ba 00 00 00 00 00 fc ff df 0f b6 04 10 84 c0 0f 85 c1 00 00 00 <45> 03 6e f4 48 8d 7e 04 48 89 f8 48 c1 e8 03 0f b6 04 10 84 c0 0f
RSP: 0018:ffffc90000107808 EFLAGS: 00010086
RAX: 0000000000000000 RBX: 0000000044d9fbf1 RCX: ffffffff8191d533
RDX: dffffc0000000000 RSI: ffffc90000108000 RDI: ffffc90000108000
RBP: ffffc90000107848 R08: 000000003ffffe2d R09: fffffbfff0f260fd
R10: 0000000000000000 R11: dffffc0000000001 R12: 000000000ca8a61b
R13: 00000000d584b303 R14: ffffc9000010800c R15: ffffc90000108000
FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90000108000 CR3: 000000011c769000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
bloom_map_peek_elem+0xac/0x1a0 kernel/bpf/bloom_filter.c:51
bpf_prog_00798911c748094f+0x3a/0x3e
bpf_dispatcher_nop_func include/linux/bpf.h:987 [inline]
__bpf_prog_run include/linux/filter.h:600 [inline]
bpf_prog_run include/linux/filter.h:607 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:2275 [inline]
bpf_trace_run3+0x177/0x2e0 kernel/trace/bpf_trace.c:2315
__bpf_trace_timer_start+0x2b/0x40 include/trace/events/timer.h:53
trace_timer_start include/trace/events/timer.h:53 [inline]
enqueue_timer+0x303/0x480 kernel/time/timer.c:615
internal_add_timer kernel/time/timer.c:640 [inline]
__mod_timer+0x8d3/0xcf0 kernel/time/timer.c:1121
schedule_timeout+0x187/0x380 kernel/time/timer.c:1940
synchronize_rcu_expedited_wait_once kernel/rcu/tree_exp.h:571 [inline]
synchronize_rcu_expedited_wait kernel/rcu/tree_exp.h:622 [inline]
rcu_exp_wait_wake kernel/rcu/tree_exp.h:690 [inline]
rcu_exp_sel_wait_wake+0x7fc/0x1fd0 kernel/rcu/tree_exp.h:724
wait_rcu_exp_gp+0x33/0x40 kernel/rcu/tree_exp.h:460
kthread_worker_fn+0x3bb/0x790 kernel/kthread.c:835
kthread+0x26d/0x300 kernel/kthread.c:386
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
Modules linked in:
CR2: ffffc90000108000
---[ end trace 0000000000000000 ]---
RIP: 0010:jhash2 include/linux/jhash.h:126 [inline]
RIP: 0010:hash+0xe3/0xc20 kernel/bpf/bloom_filter.c:36
Code: 83 c6 0c 41 83 c0 fd 45 89 ec 44 89 eb 48 89 f0 48 c1 e8 03 48 ba 00 00 00 00 00 fc ff df 0f b6 04 10 84 c0 0f 85 c1 00 00 00 <45> 03 6e f4 48 8d 7e 04 48 89 f8 48 c1 e8 03 0f b6 04 10 84 c0 0f
RSP: 0018:ffffc90000ea70e8 EFLAGS: 00010086
RAX: 0000000000000000 RBX: 00000000ea9878f3 RCX: ffffffff8191d533
RDX: dffffc0000000000 RSI: ffffc90000ea8000 RDI: ffffc90000ea8000
RBP: ffffc90000ea7128 R08: 000000003ffffc65 R09: fffffbfff0ede256
R10: 0000000000000000 R11: dffffc0000000001 R12: 0000000022843c78
R13: 000000000cc5b68c R14: ffffc90000ea800c R15: ffffc90000ea8000
FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffc90000108000 CR3: 000000011c769000 CR4: 00000000003506a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
----------------
Code disassembly (best guess):
0: 83 c6 0c add $0xc,%esi
3: 41 83 c0 fd add $0xfffffffd,%r8d
7: 45 89 ec mov %r13d,%r12d
a: 44 89 eb mov %r13d,%ebx
d: 48 89 f0 mov %rsi,%rax
10: 48 c1 e8 03 shr $0x3,%rax
14: 48 ba 00 00 00 00 00 movabs $0xdffffc0000000000,%rdx
1b: fc ff df
1e: 0f b6 04 10 movzbl (%rax,%rdx,1),%eax
22: 84 c0 test %al,%al
24: 0f 85 c1 00 00 00 jne 0xeb
* 2a: 45 03 6e f4 add -0xc(%r14),%r13d <-- trapping instruction
2e: 48 8d 7e 04 lea 0x4(%rsi),%rdi
32: 48 89 f8 mov %rdi,%rax
35: 48 c1 e8 03 shr $0x3,%rax
39: 0f b6 04 10 movzbl (%rax,%rdx,1),%eax
3d: 84 c0 test %al,%al
3f: 0f .byte 0xf