================================================================== BUG: KASAN: use-after-free in __rb_insert lib/rbtree.c:115 [inline] BUG: KASAN: use-after-free in __rb_insert_augmented+0xa0/0x610 lib/rbtree.c:459 Read of size 8 at addr ffff8881c0000008 by task syz-executor.1/6437 CPU: 0 PID: 6437 Comm: syz-executor.1 Tainted: G W 5.15.148-syzkaller-00718-g993bed180178 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x151/0x1b7 lib/dump_stack.c:106 print_address_description+0x87/0x3b0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:427 [inline] kasan_report+0x179/0x1c0 mm/kasan/report.c:444 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report_generic.c:309 __rb_insert lib/rbtree.c:115 [inline] __rb_insert_augmented+0xa0/0x610 lib/rbtree.c:459 rb_insert_augmented include/linux/rbtree_augmented.h:50 [inline] vma_interval_tree_insert_after+0x2be/0x2d0 mm/interval_tree.c:57 dup_mmap kernel/fork.c:631 [inline] dup_mm kernel/fork.c:1521 [inline] copy_mm+0xba2/0x13e0 kernel/fork.c:1573 copy_process+0x1149/0x3290 kernel/fork.c:2264 kernel_clone+0x21e/0x9e0 kernel/fork.c:2662 __do_sys_clone kernel/fork.c:2788 [inline] __se_sys_clone kernel/fork.c:2772 [inline] __x64_sys_clone+0x23f/0x290 kernel/fork.c:2772 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7fd15e9c1dd3 Code: 1f 84 00 00 00 00 00 64 48 8b 04 25 10 00 00 00 45 31 c0 31 d2 31 f6 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 89 c2 85 c0 75 2c 64 48 8b 04 25 10 00 00 RSP: 002b:00007ffd88144808 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fd15e9c1dd3 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001 R10: 0000555556b99750 R11: 0000000000000246 R12: 0000000000000001 R13: 0000000000000001 R14: 0000000000000001 R15: 0000000000000001 The buggy address belongs to the page: page:ffffea0007000000 refcount:0 mapcount:-128 mapping:0000000000000000 index:0x0 pfn:0x1c0000 flags: 0x4000000000000000(zone=1) raw: 4000000000000000 ffffea0006ff0008 ffffea0007010008 0000000000000000 raw: 0000000000000000 000000000000000a 00000000ffffff7f 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 0, migratetype Unmovable, gfp_mask 0x506dc0(GFP_USER|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_ZERO|__GFP_ACCOUNT), pid 6877, ts 231191320393, free_ts 233414701693 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x1a3/0x1b0 mm/page_alloc.c:2604 prep_new_page+0x1b/0x110 mm/page_alloc.c:2610 get_page_from_freelist+0x3550/0x35d0 mm/page_alloc.c:4484 __alloc_pages+0x27e/0x8f0 mm/page_alloc.c:5776 __alloc_pages_node include/linux/gfp.h:591 [inline] alloc_pages_node include/linux/gfp.h:605 [inline] bpf_ringbuf_area_alloc kernel/bpf/ringbuf.c:96 [inline] bpf_ringbuf_alloc+0xd0/0x3d0 kernel/bpf/ringbuf.c:133 ringbuf_map_alloc+0x202/0x320 kernel/bpf/ringbuf.c:172 find_and_alloc_map kernel/bpf/syscall.c:129 [inline] map_create+0x411/0x2050 kernel/bpf/syscall.c:857 __sys_bpf+0x296/0x760 kernel/bpf/syscall.c:4609 __do_sys_bpf kernel/bpf/syscall.c:4731 [inline] __se_sys_bpf kernel/bpf/syscall.c:4729 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:4729 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x61/0xcb page last free stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] free_pages_prepare mm/page_alloc.c:1471 [inline] free_pcp_prepare mm/page_alloc.c:1543 [inline] free_unref_page_prepare+0x7c8/0x7d0 mm/page_alloc.c:3533 free_unref_page+0xe8/0x750 mm/page_alloc.c:3615 free_the_page mm/page_alloc.c:804 [inline] __free_pages+0x61/0xf0 mm/page_alloc.c:5852 bpf_ringbuf_free kernel/bpf/ringbuf.c:191 [inline] ringbuf_map_free+0xbe/0x120 kernel/bpf/ringbuf.c:200 map_create+0x1a3a/0x2050 kernel/bpf/syscall.c:935 __sys_bpf+0x296/0x760 kernel/bpf/syscall.c:4609 __do_sys_bpf kernel/bpf/syscall.c:4731 [inline] __se_sys_bpf kernel/bpf/syscall.c:4729 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:4729 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x3d/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x61/0xcb Memory state around the buggy address: ffff8881bfffff00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff8881bfffff80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff8881c0000000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff8881c0000080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff8881c0000100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ==================================================================