==================================================================
BUG: KASAN: stack-out-of-bounds in bq_flush_to_queue+0x3a/0x610 kernel/bpf/cpumap.c:673
Read of size 8 at addr ffffc90002e0f8f0 by task syz.4.214/5924
CPU: 0 UID: 0 PID: 5924 Comm: syz.4.214 Not tainted 6.10.0-syzkaller-12708-g2f8c4f506285 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024
Call Trace:
__dump_stack lib/dump_stack.c:93 [inline]
dump_stack_lvl+0x241/0x360 lib/dump_stack.c:119
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
bq_flush_to_queue+0x3a/0x610 kernel/bpf/cpumap.c:673
__cpu_map_flush+0x5d/0xd0 kernel/bpf/cpumap.c:767
xdp_do_check_flushed+0x136/0x240 net/core/filter.c:4311
__napi_poll+0xe4/0x490 net/core/dev.c:6774
napi_poll net/core/dev.c:6840 [inline]
net_rx_action+0x89b/0x1240 net/core/dev.c:6962
handle_softirqs+0x2c6/0x970 kernel/softirq.c:554
__do_softirq kernel/softirq.c:588 [inline]
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637
irq_exit_rcu+0x9/0x30 kernel/softirq.c:649
common_interrupt+0xaa/0xd0 arch/x86/kernel/irq.c:278
asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693
RIP: 0010:refill_stock+0x2bd/0x470 mm/memcontrol.c:1829
Code: 40 42 80 3c 2b 00 74 08 4c 89 f7 e8 1d f8 f7 ff f6 44 24 41 02 75 54 41 f7 c7 00 02 00 00 74 01 fb 48 c7 44 24 20 0e 36 e0 45 <4b> c7 44 25 00 00 00 00 00 66 43 c7 44 25 09 00 00 43 c6 44 25 0b
RSP: 0018:ffffc90002e0f8a0 EFLAGS: 00000206
RAX: dbf477da80d49a00 RBX: 1ffff920005c1f1c RCX: ffffffff94f1e903
RDX: dffffc0000000000 RSI: ffffffff8c0ad5a0 RDI: ffffffff8c606920
RBP: ffffc90002e0f970 R08: ffffffff90179c2f R09: 1ffffffff202f385
R10: dffffc0000000000 R11: fffffbfff202f386 R12: 1ffff920005c1f18
R13: dffffc0000000000 R14: ffffc90002e0f8e0 R15: 0000000000000246
obj_cgroup_uncharge_pages+0x157/0x200 mm/memcontrol.c:2639
__memcg_kmem_uncharge_page+0xe9/0x290 mm/memcontrol.c:2713
memcg_kmem_uncharge_page include/linux/memcontrol.h:1707 [inline]
exit_task_stack_account+0x226/0x340 kernel/fork.c:566
do_exit+0x1d02/0x27f0 kernel/exit.c:923
do_group_exit+0x207/0x2c0 kernel/exit.c:1031
get_signal+0x16a1/0x1740 kernel/signal.c:2917
arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:310
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0xc9/0x370 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f8366b77299
Code: Unable to access opcode bytes at 0x7f8366b7726f.
RSP: 002b:00007f83678b90f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007f8366d06210 RCX: 00007f8366b77299
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f8366d06210
RBP: 00007f8366d06208 R08: 00007f83678b96c0 R09: 00007f83678b96c0
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f8366d06214
R13: 000000000000006e R14: 00007ffdfad84390 R15: 00007ffdfad84478
The buggy address belongs to stack of task syz.4.214/5924
internal error: frame has invalid marker: 1172321806
The buggy address belongs to the virtual mapping at
[ffffc90002e08000, ffffc90002e11000) created by:
copy_process+0x5d1/0x3dc0 kernel/fork.c:2204
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x3 pfn:0x7ce5e
memcg:ffff8880232e1682
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000
raw: 0000000000000003 0000000000000000 00000001ffffffff ffff8880232e1682
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x102dc2(GFP_HIGHUSER|__GFP_NOWARN|__GFP_ZERO), pid 5914, tgid 5914 (syz.4.214), ts 127362904797, free_ts 127138102143
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1493
prep_new_page mm/page_alloc.c:1501 [inline]
get_page_from_freelist+0x2e4c/0x2f10 mm/page_alloc.c:3438
__alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4696
alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2263
vm_area_alloc_pages mm/vmalloc.c:3584 [inline]
__vmalloc_area_node mm/vmalloc.c:3660 [inline]
__vmalloc_node_range_noprof+0x971/0x1460 mm/vmalloc.c:3841
alloc_thread_stack_node kernel/fork.c:313 [inline]
dup_task_struct+0x444/0x8c0 kernel/fork.c:1113
copy_process+0x5d1/0x3dc0 kernel/fork.c:2204
kernel_clone+0x226/0x8f0 kernel/fork.c:2781
__do_sys_clone3 kernel/fork.c:3085 [inline]
__se_sys_clone3+0x2cb/0x350 kernel/fork.c:3064
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 5909 tgid 5908 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1094 [inline]
free_unref_folios+0x103a/0x1b00 mm/page_alloc.c:2656
folios_put_refs+0x76e/0x860 mm/swap.c:1039
free_pages_and_swap_cache+0x2ea/0x690 mm/swap_state.c:332
__tlb_batch_free_encoded_pages mm/mmu_gather.c:136 [inline]
tlb_batch_pages_flush mm/mmu_gather.c:149 [inline]
tlb_flush_mmu_free mm/mmu_gather.c:366 [inline]
tlb_flush_mmu+0x3a3/0x680 mm/mmu_gather.c:373
tlb_finish_mmu+0xd4/0x200 mm/mmu_gather.c:465
exit_mmap+0x44f/0xc80 mm/mmap.c:3425
__mmput+0x115/0x390 kernel/fork.c:1345
exit_mm+0x220/0x310 kernel/exit.c:571
do_exit+0x9b2/0x27f0 kernel/exit.c:869
do_group_exit+0x207/0x2c0 kernel/exit.c:1031
get_signal+0x16a1/0x1740 kernel/signal.c:2917
arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:310
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0xc9/0x370 kernel/entry/common.c:218
do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffffc90002e0f780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffffc90002e0f800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffc90002e0f880: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 f2 f2 f2
^
ffffc90002e0f900: 00 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
ffffc90002e0f980: 00 00 00 00 f1 f1 f1 f1 00 f2 f2 f2 00 f3 f3 f3
==================================================================
----------------
Code disassembly (best guess):
0: 40 rex
1: 42 80 3c 2b 00 cmpb $0x0,(%rbx,%r13,1)
6: 74 08 je 0x10
8: 4c 89 f7 mov %r14,%rdi
b: e8 1d f8 f7 ff call 0xfff7f82d
10: f6 44 24 41 02 testb $0x2,0x41(%rsp)
15: 75 54 jne 0x6b
17: 41 f7 c7 00 02 00 00 test $0x200,%r15d
1e: 74 01 je 0x21
20: fb sti
21: 48 c7 44 24 20 0e 36 movq $0x45e0360e,0x20(%rsp)
28: e0 45
* 2a: 4b c7 44 25 00 00 00 movq $0x0,0x0(%r13,%r12,1) <-- trapping instruction
31: 00 00
33: 66 43 c7 44 25 09 00 movw $0x0,0x9(%r13,%r12,1)
3a: 00
3b: 43 rex.XB
3c: c6 .byte 0xc6
3d: 44 rex.R
3e: 25 .byte 0x25
3f: 0b .byte 0xb