================================================================== BUG: KASAN: stack-out-of-bounds in profile_pc+0xa4/0xe0 arch/x86/kernel/time.c:42 Read of size 8 at addr ffff8881e793f780 by task syz.4.2391/7438 CPU: 0 PID: 7438 Comm: syz.4.2391 Tainted: G W 5.4.276-syzkaller-00021-g58de09405d1e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1d8/0x241 lib/dump_stack.c:118 print_address_description+0x8c/0x600 mm/kasan/report.c:384 __kasan_report+0xf3/0x120 mm/kasan/report.c:516 kasan_report+0x30/0x60 mm/kasan/common.c:653 profile_pc+0xa4/0xe0 arch/x86/kernel/time.c:42 profile_tick+0xb9/0x100 kernel/profile.c:416 tick_sched_handle kernel/time/tick-sched.c:206 [inline] tick_sched_timer+0x237/0x3c0 kernel/time/tick-sched.c:1342 __run_hrtimer kernel/time/hrtimer.c:1581 [inline] __hrtimer_run_queues+0x3e9/0xb90 kernel/time/hrtimer.c:1643 hrtimer_interrupt+0x38a/0x890 kernel/time/hrtimer.c:1705 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1122 [inline] smp_apic_timer_interrupt+0x110/0x460 arch/x86/kernel/apic/apic.c:1147 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:834 RIP: 0010:queued_spin_lock include/asm-generic/qspinlock.h:76 [inline] RIP: 0010:do_raw_spin_lock include/linux/spinlock.h:181 [inline] RIP: 0010:__raw_spin_lock include/linux/spinlock_api_smp.h:143 [inline] RIP: 0010:_raw_spin_lock+0x75/0x1b0 kernel/locking/spinlock.c:151 Code: c0 14 51 84 48 89 e3 48 c1 eb 03 48 b8 f1 f1 f1 f1 04 f3 f3 f3 4a 89 04 23 bf 01 00 00 00 e8 72 c9 f3 fc 4d 89 fe 49 c1 ee 03 <43> 0f b6 04 26 84 c0 0f 85 bb 00 00 00 c7 44 24 20 00 00 00 00 4c RSP: 0018:ffff8881e793f780 EFLAGS: 00000a02 ORIG_RAX: ffffffffffffff13 RAX: 1ffff1103d79acff RBX: 1ffff1103cf27ef0 RCX: ffffffff84512a00 RDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000000 RBP: ffff8881e793f820 R08: ffffffff81bd6e0a R09: ffffed103c6756c9 R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000 R13: ffffffff86eeb840 R14: 1ffff1103cf27ef4 R15: ffff8881e793f7a0 spin_lock include/linux/spinlock.h:338 [inline] kernfs_put+0x2c3/0x4b0 fs/kernfs/dir.c:546 kernfs_remove_by_name_ns+0x99/0x100 fs/kernfs/dir.c:1533 kernfs_remove_by_name include/linux/kernfs.h:583 [inline] remove_files fs/sysfs/group.c:27 [inline] sysfs_remove_group+0xfa/0x2a0 fs/sysfs/group.c:288 sysfs_remove_groups+0x50/0xa0 fs/sysfs/group.c:312 __kobject_del+0x85/0x260 lib/kobject.c:622 kobject_cleanup lib/kobject.c:707 [inline] kobject_release lib/kobject.c:747 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1fa/0x2f0 lib/kobject.c:764 net_rx_queue_update_kobjects+0x3b5/0x420 net/core/net-sysfs.c:1024 remove_queue_kobjects net/core/net-sysfs.c:1662 [inline] netdev_unregister_kobject+0x100/0x240 net/core/net-sysfs.c:1816 rollback_registered_many+0xed6/0x1330 net/core/dev.c:8655 rollback_registered net/core/dev.c:8673 [inline] unregister_netdevice_queue+0x333/0x500 net/core/dev.c:9767 unregister_netdevice include/linux/netdevice.h:2726 [inline] __tun_detach+0x8de/0x1390 drivers/net/tun.c:747 tun_detach drivers/net/tun.c:763 [inline] tun_chr_close+0x8f/0x130 drivers/net/tun.c:3560 __fput+0x262/0x680 fs/file_table.c:281 task_work_run+0x140/0x170 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_usermode_loop+0x190/0x1a0 arch/x86/entry/common.c:163 prepare_exit_to_usermode+0x199/0x200 arch/x86/entry/common.c:194 entry_SYSCALL_64_after_hwframe+0x5c/0xc1 RIP: 0033:0x7f17fa252c4a Code: 48 3d 00 f0 ff ff 77 48 c3 0f 1f 80 00 00 00 00 48 83 ec 18 89 7c 24 0c e8 73 8a 02 00 8b 7c 24 0c 89 c2 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 36 89 d7 89 44 24 0c e8 d3 8a 02 00 8b 44 24 RSP: 002b:00007ffd8857da00 EFLAGS: 00000293 ORIG_RAX: 0000000000000003 RAX: 0000000000000000 RBX: 0000000000000006 RCX: 00007f17fa252c4a RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000005 RBP: 00007f17fa3e3a60 R08: 0000000000000006 R09: 0000001e8857dd4f R10: 00000000003ffbac R11: 0000000000000293 R12: 0000000000034b91 R13: 0000000000000226 R14: 00007f17fa3e3a60 R15: 00007f17fa3e2038 The buggy address belongs to the page: page:ffffea00079e4fc0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 flags: 0x8000000000000000() raw: 8000000000000000 0000000000000000 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT) set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook mm/page_alloc.c:2165 [inline] prep_new_page+0x18f/0x370 mm/page_alloc.c:2171 get_page_from_freelist+0x2d13/0x2d90 mm/page_alloc.c:3794 __alloc_pages_nodemask+0x393/0x840 mm/page_alloc.c:4893 __alloc_pages include/linux/gfp.h:503 [inline] __alloc_pages_node include/linux/gfp.h:516 [inline] alloc_pages_node include/linux/gfp.h:530 [inline] alloc_thread_stack_node kernel/fork.c:259 [inline] dup_task_struct+0x85/0x600 kernel/fork.c:886 copy_process+0x56d/0x3230 kernel/fork.c:1889 _do_fork+0x197/0x900 kernel/fork.c:2399 __do_sys_clone kernel/fork.c:2557 [inline] __se_sys_clone kernel/fork.c:2538 [inline] __x64_sys_clone+0x26b/0x2c0 kernel/fork.c:2538 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x5c/0xc1 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1176 [inline] __free_pages_ok+0x847/0x950 mm/page_alloc.c:1438 put_page include/linux/mm.h:1153 [inline] __skb_frag_unref include/linux/skbuff.h:3061 [inline] skb_release_data+0x210/0x640 net/core/skbuff.c:615 skb_release_all net/core/skbuff.c:675 [inline] __kfree_skb+0x4c/0x60 net/core/skbuff.c:689 tcp_clean_rtx_queue net/ipv4/tcp_input.c:3206 [inline] tcp_ack+0x206c/0x6090 net/ipv4/tcp_input.c:3757 tcp_rcv_established+0x6ea/0x1a80 net/ipv4/tcp_input.c:5791 tcp_v4_do_rcv+0x3a9/0x770 net/ipv4/tcp_ipv4.c:1595 tcp_v4_rcv+0x219a/0x26f0 net/ipv4/tcp_ipv4.c:1977 ip_protocol_deliver_rcu+0x2e0/0x630 net/ipv4/ip_input.c:204 ip_local_deliver_finish net/ipv4/ip_input.c:231 [inline] NF_HOOK include/linux/netfilter.h:303 [inline] ip_local_deliver+0x2c6/0x5a0 net/ipv4/ip_input.c:252 dst_input include/net/dst.h:444 [inline] ip_sublist_rcv_finish net/ipv4/ip_input.c:541 [inline] ip_list_rcv_finish net/ipv4/ip_input.c:579 [inline] ip_sublist_rcv+0xc02/0xc80 net/ipv4/ip_input.c:587 ip_list_rcv+0x477/0x4c0 net/ipv4/ip_input.c:621 __netif_receive_skb_list_ptype net/core/dev.c:5015 [inline] __netif_receive_skb_list_core+0x6dd/0x8f0 net/core/dev.c:5063 __netif_receive_skb_list net/core/dev.c:5115 [inline] netif_receive_skb_list_internal+0x944/0xc90 net/core/dev.c:5210 gro_normal_list net/core/dev.c:5321 [inline] gro_normal_one net/core/dev.c:5334 [inline] napi_skb_finish net/core/dev.c:5664 [inline] napi_gro_receive+0x49a/0xa60 net/core/dev.c:5696 receive_buf+0x351c/0x51c0 drivers/net/virtio_net.c:1139 virtnet_receive drivers/net/virtio_net.c:1403 [inline] virtnet_poll+0x5f3/0x1250 drivers/net/virtio_net.c:1512 addr ffff8881e793f780 is located in stack of task syz.4.2391/7438 at offset 0 in frame: _raw_spin_lock+0x0/0x1b0 this frame has 1 object: [32, 36) 'val.i.i.i' Memory state around the buggy address: ffff8881e793f680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8881e793f700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff8881e793f780: f1 f1 f1 f1 04 f3 f3 f3 00 00 00 00 00 00 00 00 ^ ffff8881e793f800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8881e793f880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ================================================================== ---------------- Code disassembly (best guess): 0: c0 14 51 84 rclb $0x84,(%rcx,%rdx,2) 4: 48 89 e3 mov %rsp,%rbx 7: 48 c1 eb 03 shr $0x3,%rbx b: 48 b8 f1 f1 f1 f1 04 movabs $0xf3f3f304f1f1f1f1,%rax 12: f3 f3 f3 15: 4a 89 04 23 mov %rax,(%rbx,%r12,1) 19: bf 01 00 00 00 mov $0x1,%edi 1e: e8 72 c9 f3 fc call 0xfcf3c995 23: 4d 89 fe mov %r15,%r14 26: 49 c1 ee 03 shr $0x3,%r14 * 2a: 43 0f b6 04 26 movzbl (%r14,%r12,1),%eax <-- trapping instruction 2f: 84 c0 test %al,%al 31: 0f 85 bb 00 00 00 jne 0xf2 37: c7 44 24 20 00 00 00 movl $0x0,0x20(%rsp) 3e: 00 3f: 4c rex.WR