==================================================================
BUG: KASAN: stack-out-of-bounds in profile_pc+0x118/0x130 arch/x86/kernel/time.c:44
Read of size 8 at addr ffffc900001e0770 by task sshd/5019
CPU: 1 PID: 5019 Comm: sshd Not tainted 6.5.0-rc1-next-20230710-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106
print_address_description.constprop.0+0x2c/0x3c0 mm/kasan/report.c:364
print_report mm/kasan/report.c:475 [inline]
kasan_report+0x11d/0x130 mm/kasan/report.c:588
profile_pc+0x118/0x130 arch/x86/kernel/time.c:44
profile_tick+0xcd/0x130 kernel/profile.c:339
tick_sched_timer+0xee/0x110 kernel/time/tick-sched.c:1492
__run_hrtimer kernel/time/hrtimer.c:1688 [inline]
__hrtimer_run_queues+0x1ca/0xc00 kernel/time/hrtimer.c:1752
hrtimer_interrupt+0x320/0x7b0 kernel/time/hrtimer.c:1814
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1098 [inline]
__sysvec_apic_timer_interrupt+0x14a/0x430 arch/x86/kernel/apic/apic.c:1115
sysvec_apic_timer_interrupt+0x44/0xc0 arch/x86/kernel/apic/apic.c:1109
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645
RIP: 0010:queued_write_lock_slowpath+0x147/0x2d0 kernel/locking/qrwlock.c:85
Code: 00 00 00 fc ff df 49 01 c7 41 83 c6 03 41 0f b6 07 41 38 c6 7c 08 84 c0 0f 85 46 01 00 00 8b 45 00 3d 00 01 00 00 74 19 f3 90 <41> 0f b6 07 41 38 c6 7c eb 84 c0 74 e7 48 89 ef e8 14 e4 b2 f7 eb
RSP: 0018:ffffc900001e0768 EFLAGS: 00000206
RAX: 00000000000001ff RBX: 1ffff9200003c0ee RCX: ffffffff8a25667d
RDX: fffffbfff1cb59a9 RSI: 0000000000000004 RDI: ffffffff8e5acd40
RBP: ffffffff8e5acd40 R08: 0000000000000001 R09: fffffbfff1cb59a8
R10: ffffffff8e5acd43 R11: 0000000000000000 R12: ffffffff8e5acd44
R13: 00000000000000ff R14: 0000000000000003 R15: fffffbfff1cb59a8
queued_write_lock include/asm-generic/qrwlock.h:101 [inline]
do_raw_write_lock+0x1d2/0x3b0 kernel/locking/spinlock_debug.c:210
___neigh_create+0x9c7/0x2a40 net/core/neighbour.c:674
ip6_finish_output2+0xfde/0x1560 net/ipv6/ip6_output.c:126
__ip6_finish_output net/ipv6/ip6_output.c:196 [inline]
ip6_finish_output+0x69a/0x1200 net/ipv6/ip6_output.c:207
NF_HOOK_COND include/linux/netfilter.h:292 [inline]
ip6_output+0x1f1/0x540 net/ipv6/ip6_output.c:228
dst_output include/net/dst.h:458 [inline]
NF_HOOK include/linux/netfilter.h:303 [inline]
ndisc_send_skb+0xa63/0x1890 net/ipv6/ndisc.c:508
ndisc_send_rs+0x132/0x6f0 net/ipv6/ndisc.c:718
addrconf_rs_timer+0x3f1/0x830 net/ipv6/addrconf.c:3935
call_timer_fn+0x1a0/0x580 kernel/time/timer.c:1700
expire_timers+0x29b/0x4b0 kernel/time/timer.c:1751
__run_timers kernel/time/timer.c:2022 [inline]
__run_timers kernel/time/timer.c:1995 [inline]
run_timer_softirq+0x326/0x910 kernel/time/timer.c:2035
__do_softirq+0x1d4/0x905 kernel/softirq.c:553
invoke_softirq kernel/softirq.c:427 [inline]
__irq_exit_rcu kernel/softirq.c:632 [inline]
irq_exit_rcu+0xb7/0x120 kernel/softirq.c:644
sysvec_apic_timer_interrupt+0x97/0xc0 arch/x86/kernel/apic/apic.c:1109
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x3c/0x70 kernel/locking/spinlock.c:194
Code: 74 24 10 e8 16 31 41 f7 48 89 ef e8 ee a0 41 f7 81 e3 00 02 00 00 75 25 9c 58 f6 c4 02 75 2d 48 85 db 74 01 fb bf 01 00 00 00 3f 59 33 f7 65 8b 05 40 73 de 75 85 c0 74 0a 5b 5d c3 e8 6c 79
RSP: 0018:ffffc900039df870 EFLAGS: 00000206
RAX: 0000000000000006 RBX: 0000000000000200 RCX: 1ffffffff1d550e9
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001
RBP: ffff888023aaf490 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff8eaab8d7 R11: 0000000000000001 R12: 0000000000000080
R13: ffff888023aaf490 R14: 00000000082a0001 R15: ffffc900039dfbe0
__pollwait+0x256/0x430 fs/select.c:234
poll_wait include/linux/poll.h:49 [inline]
pipe_poll+0x48b/0x7a0 fs/pipe.c:667
vfs_poll include/linux/poll.h:88 [inline]
do_pollfd fs/select.c:873 [inline]
do_poll fs/select.c:921 [inline]
do_sys_poll+0x508/0xe10 fs/select.c:1015
__do_sys_ppoll fs/select.c:1121 [inline]
__se_sys_ppoll fs/select.c:1101 [inline]
__x64_sys_ppoll+0x214/0x290 fs/select.c:1101
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f465e519ad5
Code: 85 d2 74 0d 0f 10 02 48 8d 54 24 20 0f 11 44 24 20 64 8b 04 25 18 00 00 00 85 c0 75 27 41 b8 08 00 00 00 b8 0f 01 00 00 0f 05 <48> 3d 00 f0 ff ff 76 75 48 8b 15 24 73 0d 00 f7 d8 64 89 02 48 83
RSP: 002b:00007ffe54f0d9b0 EFLAGS: 00000246 ORIG_RAX: 000000000000010f
RAX: ffffffffffffffda RBX: 00000000000668a0 RCX: 00007f465e519ad5
RDX: 00007ffe54f0d9d0 RSI: 0000000000000004 RDI: 00005649fcad3ab0
RBP: 00005649fcad2570 R08: 0000000000000008 R09: 0000000000000000
R10: 00007ffe54f0dab8 R11: 0000000000000246 R12: 00005649fc75caa4
R13: 0000000000000001 R14: 00005649fc75d3e8 R15: 00007ffe54f0da38
The buggy address belongs to the virtual mapping at
[ffffc900001d9000, ffffc900001e2000) created by:
map_irq_stack arch/x86/kernel/irq_64.c:48 [inline]
irq_init_percpu_irqstack+0x1d0/0x320 arch/x86/kernel/irq_64.c:75
The buggy address belongs to the physical page:
page:ffffea0002e64240 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0xb9909
flags: 0xfff00000001000(reserved|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000001000 ffffea0002e64248 ffffea0002e64248 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner info is not present (never set?)
Memory state around the buggy address:
ffffc900001e0600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffffc900001e0680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffc900001e0700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1
^
ffffc900001e0780: f1 f1 04 f3 f3 f3 00 00 00 00 00 00 00 00 00 00
ffffc900001e0800: 00 00 f1 f1 f1 f1 04 f3 f3 f3 00 00 00 00 00 00
==================================================================
----------------
Code disassembly (best guess), 5 bytes skipped:
0: df 49 01 fisttps 0x1(%rcx)
3: c7 41 83 c6 03 41 0f movl $0xf4103c6,-0x7d(%rcx)
a: b6 07 mov $0x7,%dh
c: 41 38 c6 cmp %al,%r14b
f: 7c 08 jl 0x19
11: 84 c0 test %al,%al
13: 0f 85 46 01 00 00 jne 0x15f
19: 8b 45 00 mov 0x0(%rbp),%eax
1c: 3d 00 01 00 00 cmp $0x100,%eax
21: 74 19 je 0x3c
23: f3 90 pause
* 25: 41 0f b6 07 movzbl (%r15),%eax <-- trapping instruction
29: 41 38 c6 cmp %al,%r14b
2c: 7c eb jl 0x19
2e: 84 c0 test %al,%al
30: 74 e7 je 0x19
32: 48 89 ef mov %rbp,%rdi
35: e8 14 e4 b2 f7 callq 0xf7b2e44e
3a: eb .byte 0xeb