==================================================================
BUG: KASAN: stack-out-of-bounds in bpf_net_ctx_get_all_used_flush_lists include/linux/filter.h:837 [inline]
BUG: KASAN: stack-out-of-bounds in xdp_do_check_flushed+0x41c/0x4e0 net/core/filter.c:4305
Read of size 4 at addr ffffc90003267a50 by task syz.1.369/6428

CPU: 1 UID: 0 PID: 6428 Comm: syz.1.369 Not tainted 6.10.0-syzkaller-12881-g6342649c33d2 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:93 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0xc3/0x620 mm/kasan/report.c:488
 kasan_report+0xd9/0x110 mm/kasan/report.c:601
 bpf_net_ctx_get_all_used_flush_lists include/linux/filter.h:837 [inline]
 xdp_do_check_flushed+0x41c/0x4e0 net/core/filter.c:4305
 __napi_poll.constprop.0+0xd1/0x550 net/core/dev.c:6774
 napi_poll net/core/dev.c:6840 [inline]
 net_rx_action+0xa92/0x1010 net/core/dev.c:6962
 handle_softirqs+0x216/0x8f0 kernel/softirq.c:554
 __do_softirq kernel/softirq.c:588 [inline]
 invoke_softirq kernel/softirq.c:428 [inline]
 __irq_exit_rcu kernel/softirq.c:637 [inline]
 irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649
 common_interrupt+0xb0/0xd0 arch/x86/kernel/irq.c:278
 </IRQ>
 <TASK>
 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693
RIP: 0010:write_comp_data+0x34/0x90 kernel/kcov.c:236
Code: 48 8b 15 3f 52 79 7e 65 8b 05 40 52 79 7e a9 00 01 ff 00 74 0f f6 c4 01 74 59 8b 82 1c 16 00 00 85 c0 74 4f 8b 82 f8 15 00 00 <83> f8 03 75 44 48 8b 82 00 16 00 00 8b 92 fc 15 00 00 48 8b 38 48
RSP: 0018:ffffc90003267328 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 0000000000000007 RCX: ffffffff813ce5c1
RDX: ffff88801c7f8000 RSI: 0000000000000008 RDI: 0000000000000001
RBP: ffffffff8b49d740 R08: 0000000000000001 R09: 0000000000000008
R10: 0000000000000005 R11: 0000000000000000 R12: 0000000000000005
R13: 0000000000000001 R14: 0000000000000008 R15: ffffc90003267415
 __sanitizer_cov_trace_switch+0x54/0x90 kernel/kcov.c:341
 unwind_next_frame+0x6c1/0x23a0 arch/x86/kernel/unwind_orc.c:515
 arch_stack_walk+0x100/0x170 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x95/0xd0 kernel/stacktrace.c:122
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579
 poison_slab_object+0xf7/0x160 mm/kasan/common.c:240
 __kasan_slab_free+0x32/0x50 mm/kasan/common.c:256
 kasan_slab_free include/linux/kasan.h:184 [inline]
 slab_free_hook mm/slub.c:2252 [inline]
 slab_free mm/slub.c:4473 [inline]
 kmem_cache_free+0x12f/0x3a0 mm/slub.c:4548
 pagetable_pte_dtor include/linux/mm.h:2967 [inline]
 ___pte_free_tlb+0x1d/0x260 arch/x86/mm/pgtable.c:55
 __pte_free_tlb arch/x86/include/asm/pgalloc.h:61 [inline]
 free_pte_range mm/memory.c:194 [inline]
 free_pmd_range mm/memory.c:212 [inline]
 free_pud_range mm/memory.c:246 [inline]
 free_p4d_range mm/memory.c:280 [inline]
 free_pgd_range+0x4e7/0xbc0 mm/memory.c:360
 free_pgtables+0x1c1/0x950 mm/memory.c:413
 exit_mmap+0x3c9/0xb20 mm/mmap.c:3423
 __mmput+0x12a/0x480 kernel/fork.c:1345
 mmput+0x62/0x70 kernel/fork.c:1367
 exit_mm kernel/exit.c:571 [inline]
 do_exit+0x9bf/0x2bb0 kernel/exit.c:869
 do_group_exit+0xd3/0x2a0 kernel/exit.c:1031
 get_signal+0x25fd/0x2770 kernel/signal.c:2917
 arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:310
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218
 do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fba27577299
Code: Unable to access opcode bytes at 0x7fba2757726f.
RSP: 002b:00007fba283e70f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007fba27705f88 RCX: 00007fba27577299
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fba27705f88
RBP: 00007fba27705f80 R08: 00007fba283e76c0 R09: 00007fba283e76c0
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fba27705f8c
R13: 000000000000000b R14: 00007fffe645b5f0 R15: 00007fffe645b6d8
 </TASK>

The buggy address belongs to stack of task syz.1.369/6428
 and is located at offset 24 in frame:
 exit_mmap+0x0/0xb20 mm/mmap.c:3232

This frame has 2 objects:
 [32, 96) 'vmi'
 [128, 256) 'tlb'

The buggy address belongs to the virtual mapping at
 [ffffc90003260000, ffffc90003269000) created by:
 kernel_clone+0xfd/0x980 kernel/fork.c:2781

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x25c9a
memcg:ffff88802064c882
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff ffff88802064c882
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x102dc2(GFP_HIGHUSER|__GFP_NOWARN|__GFP_ZERO), pid 65, tgid 65 (kworker/u32:3), ts 92922965966, free_ts 91668148326
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1493
 prep_new_page mm/page_alloc.c:1501 [inline]
 get_page_from_freelist+0x1351/0x2e50 mm/page_alloc.c:3442
 __alloc_pages_noprof+0x22b/0x2460 mm/page_alloc.c:4700
 alloc_pages_mpol_noprof+0x275/0x610 mm/mempolicy.c:2263
 vm_area_alloc_pages mm/vmalloc.c:3584 [inline]
 __vmalloc_area_node mm/vmalloc.c:3660 [inline]
 __vmalloc_node_range_noprof+0xa6a/0x1520 mm/vmalloc.c:3841
 alloc_thread_stack_node kernel/fork.c:313 [inline]
 dup_task_struct kernel/fork.c:1113 [inline]
 copy_process+0x2f3b/0x8de0 kernel/fork.c:2204
 kernel_clone+0xfd/0x980 kernel/fork.c:2781
 user_mode_thread+0xb4/0xf0 kernel/fork.c:2859
 call_usermodehelper_exec_sync kernel/umh.c:133 [inline]
 call_usermodehelper_exec_work+0x6b/0x170 kernel/umh.c:164
 process_one_work+0x9c5/0x1b40 kernel/workqueue.c:3231
 process_scheduled_works kernel/workqueue.c:3312 [inline]
 worker_thread+0x6c8/0xf20 kernel/workqueue.c:3390
 kthread+0x2c1/0x3a0 kernel/kthread.c:389
 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
page last free pid 6274 tgid 6274 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1094 [inline]
 free_unref_page+0x64a/0xe40 mm/page_alloc.c:2612
 kvm_mmu_free_memory_cache+0x189/0x2d0 virt/kvm/kvm_main.c:460
 mmu_free_memory_caches arch/x86/kvm/mmu/mmu.c:708 [inline]
 kvm_mmu_destroy+0x45/0x60 arch/x86/kvm/mmu/mmu.c:7247
 kvm_arch_vcpu_destroy+0x179/0x2a0 arch/x86/kvm/x86.c:12349
 kvm_vcpu_destroy virt/kvm/kvm_main.c:508 [inline]
 kvm_destroy_vcpus+0x114/0x2a0 virt/kvm/kvm_main.c:528
 kvm_arch_destroy_vm+0x2ec/0x490 arch/x86/kvm/x86.c:12835
 kvm_destroy_vm virt/kvm/kvm_main.c:1350 [inline]
 kvm_put_kvm+0x510/0xb80 virt/kvm/kvm_main.c:1386
 kvm_vm_release+0x42/0x60 virt/kvm/kvm_main.c:1409
 __fput+0x408/0xbb0 fs/file_table.c:422
 task_work_run+0x14e/0x250 kernel/task_work.c:222
 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:114 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x27b/0x2a0 kernel/entry/common.c:218
 do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffffc90003267900: 00 00 00 f1 f1 f1 f1 f1 f1 00 00 00 00 00 00 00
 ffffc90003267980: 00 00 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00
>ffffc90003267a00: 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00
                                                 ^
 ffffc90003267a80: 00 00 00 f2 f2 f2 f2 00 00 00 00 00 00 00 00 00
 ffffc90003267b00: 00 00 00 00 00 00 00 f3 f3 f3 f3 00 00 00 00 00
==================================================================
----------------
Code disassembly (best guess):
   0:	48 8b 15 3f 52 79 7e 	mov    0x7e79523f(%rip),%rdx        # 0x7e795246
   7:	65 8b 05 40 52 79 7e 	mov    %gs:0x7e795240(%rip),%eax        # 0x7e79524e
   e:	a9 00 01 ff 00       	test   $0xff0100,%eax
  13:	74 0f                	je     0x24
  15:	f6 c4 01             	test   $0x1,%ah
  18:	74 59                	je     0x73
  1a:	8b 82 1c 16 00 00    	mov    0x161c(%rdx),%eax
  20:	85 c0                	test   %eax,%eax
  22:	74 4f                	je     0x73
  24:	8b 82 f8 15 00 00    	mov    0x15f8(%rdx),%eax
* 2a:	83 f8 03             	cmp    $0x3,%eax <-- trapping instruction
  2d:	75 44                	jne    0x73
  2f:	48 8b 82 00 16 00 00 	mov    0x1600(%rdx),%rax
  36:	8b 92 fc 15 00 00    	mov    0x15fc(%rdx),%edx
  3c:	48 8b 38             	mov    (%rax),%rdi
  3f:	48                   	rex.W