================================================================== BUG: KASAN: slab-out-of-bounds in perf_output_read_group kernel/events/core.c:5874 [inline] BUG: KASAN: slab-out-of-bounds in perf_output_read+0xe43/0xfb0 kernel/events/core.c:5909 Read of size 8 at addr ffff8881c5869e60 by task syz-executor5/18042 CPU: 0 PID: 18042 Comm: syz-executor5 Not tainted 4.14.90+ #29 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0xb9/0x11b lib/dump_stack.c:53 print_address_description+0x60/0x22b mm/kasan/report.c:252 kasan_report_error mm/kasan/report.c:351 [inline] kasan_report.cold.6+0x11b/0x2dd mm/kasan/report.c:409 perf_output_read_group kernel/events/core.c:5874 [inline] perf_output_read+0xe43/0xfb0 kernel/events/core.c:5909 perf_output_sample+0x10dd/0x1780 kernel/events/core.c:5951 __perf_event_output kernel/events/core.c:6261 [inline] perf_event_output_forward+0x121/0x230 kernel/events/core.c:6274 __perf_event_overflow+0x116/0x320 kernel/events/core.c:7510 perf_swevent_overflow+0x166/0x1f0 kernel/events/core.c:7586 perf_swevent_event+0x19c/0x270 kernel/events/core.c:7619 do_perf_sw_event kernel/events/core.c:7727 [inline] ___perf_sw_event+0x296/0x480 kernel/events/core.c:7758 __perf_sw_event+0x3f/0x70 kernel/events/core.c:7770 perf_sw_event include/linux/perf_event.h:1041 [inline] __do_page_fault+0x77f/0xb60 arch/x86/mm/fault.c:1466 page_fault+0x22/0x50 arch/x86/entry/entry_64.S:1104 RIP: 0010:copy_user_enhanced_fast_string+0x7/0x10 arch/x86/lib/copy_user_64.S:181 RSP: 0018:ffff888181acfb98 EFLAGS: 00010206 RAX: 0000000000000000 RBX: 0000000000001000 RCX: 00000000000001c0 RDX: 0000000000001000 RSI: 00000000205df000 RDI: ffff8881c4a98e40 RBP: 00000000205de1c0 R08: 0000000000000000 R09: 0000000000000040 R10: ffffed10389531ff R11: ffff8881c4a98fff R12: ffff8881c4a98000 R13: 00007ffffffff000 R14: 00000000205df1c0 R15: ffff8881c4a98000 copy_user_generic arch/x86/include/asm/uaccess_64.h:37 [inline] raw_copy_from_user arch/x86/include/asm/uaccess_64.h:55 [inline] copyin+0x99/0xc0 lib/iov_iter.c:146 copy_page_from_iter_iovec lib/iov_iter.c:290 [inline] copy_page_from_iter+0x320/0x7a0 lib/iov_iter.c:731 pipe_write+0x21a/0xd30 fs/pipe.c:434 call_write_iter include/linux/fs.h:1784 [inline] new_sync_write fs/read_write.c:471 [inline] __vfs_write+0x417/0x5c0 fs/read_write.c:484 vfs_write+0x17f/0x4d0 fs/read_write.c:546 SYSC_write fs/read_write.c:593 [inline] SyS_write+0xc2/0x1a0 fs/read_write.c:585 do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x4579b9 RSP: 002b:00007fae918bdc78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000004579b9 RDX: 0000000100000073 RSI: 00000000200001c0 RDI: 0000000000000007 RBP: 000000000073bf00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fae918be6d4 R13: 00000000004c367d R14: 00000000004db550 R15: 00000000ffffffff Allocated by task 18042: save_stack mm/kasan/kasan.c:447 [inline] set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc.part.1+0x4f/0xd0 mm/kasan/kasan.c:551 __kmalloc+0x153/0x340 mm/slub.c:3760 kmalloc include/linux/slab.h:493 [inline] kzalloc include/linux/slab.h:661 [inline] rb_alloc+0x33/0x460 kernel/events/ring_buffer.c:722 perf_mmap+0xc42/0x1370 kernel/events/core.c:5459 call_mmap include/linux/fs.h:1789 [inline] mmap_region+0x836/0xfb0 mm/mmap.c:1731 do_mmap+0x551/0xb80 mm/mmap.c:1509 do_mmap_pgoff include/linux/mm.h:2167 [inline] vm_mmap_pgoff+0x180/0x1d0 mm/util.c:333 SYSC_mmap_pgoff mm/mmap.c:1559 [inline] SyS_mmap_pgoff+0xf8/0x1a0 mm/mmap.c:1517 do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289 entry_SYSCALL_64_after_hwframe+0x42/0xb7 Freed by task 16409: save_stack mm/kasan/kasan.c:447 [inline] set_track mm/kasan/kasan.c:459 [inline] kasan_slab_free+0xac/0x190 mm/kasan/kasan.c:524 slab_free_hook mm/slub.c:1389 [inline] slab_free_freelist_hook mm/slub.c:1410 [inline] slab_free mm/slub.c:2966 [inline] kfree+0xf5/0x310 mm/slub.c:3897 skb_free_head+0x83/0xa0 net/core/skbuff.c:550 skb_release_data+0x4d9/0x720 net/core/skbuff.c:570 skb_release_all+0x46/0x60 net/core/skbuff.c:627 __kfree_skb net/core/skbuff.c:641 [inline] consume_skb+0xc1/0x330 net/core/skbuff.c:701 skb_free_datagram+0x15/0xd0 net/core/datagram.c:331 netlink_recvmsg+0x569/0xd10 net/netlink/af_netlink.c:1956 sock_recvmsg_nosec net/socket.c:818 [inline] sock_recvmsg+0xc0/0x100 net/socket.c:825 SYSC_recvfrom net/socket.c:1814 [inline] SyS_recvfrom+0x1d2/0x310 net/socket.c:1786 do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289 entry_SYSCALL_64_after_hwframe+0x42/0xb7 The buggy address belongs to the object at ffff8881c5869b80 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 224 bytes to the right of 512-byte region [ffff8881c5869b80, ffff8881c5869d80) The buggy address belongs to the page: page:ffffea0007161a00 count:1 mapcount:0 mapping: (null) index:0x0 compound_mapcount: 0 flags: 0x4000000000008100(slab|head) raw: 4000000000008100 0000000000000000 0000000000000000 00000001000c000c raw: 0000000000000000 0000000a00000001 ffff8881da802c00 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8881c5869d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8881c5869d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff8881c5869e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff8881c5869e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8881c5869f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================