device nr0
 entered promiscuous mode
==================================================================
BUG: KASAN: use-after-free in dev_map_flush_old kernel/bpf/devmap.c:389 [inline]
BUG: KASAN: use-after-free in __dev_map_entry_free+0x2a9/0x330 kernel/bpf/devmap.c:403
Read of size 8 at addr ffff88806d466e48 by task syz-executor5/8004

CPU: 1 PID: 8004 Comm: syz-executor5 Not tainted 4.20.0+ #2
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1db/0x2d0 lib/dump_stack.c:113
 print_address_description.cold+0x7c/0x20d mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report mm/kasan/report.c:412 [inline]
 kasan_report.cold+0x8c/0x2ba mm/kasan/report.c:396
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
 dev_map_flush_old kernel/bpf/devmap.c:389 [inline]
 __dev_map_entry_free+0x2a9/0x330 kernel/bpf/devmap.c:403
 __rcu_reclaim kernel/rcu/rcu.h:240 [inline]
 rcu_do_batch kernel/rcu/tree.c:2452 [inline]
 invoke_rcu_callbacks kernel/rcu/tree.c:2773 [inline]
 rcu_process_callbacks+0xc4a/0x1680 kernel/rcu/tree.c:2754
 __do_softirq+0x30b/0xb11 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:373 [inline]
 irq_exit+0x180/0x1d0 kernel/softirq.c:413
 exiting_irq arch/x86/include/asm/apic.h:536 [inline]
 smp_apic_timer_interrupt+0x1b7/0x760 arch/x86/kernel/apic/apic.c:1062
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807
 </IRQ>
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:766 [inline]
RIP: 0010:lock_acquire+0x259/0x570 kernel/locking/lockdep.c:3844
Code: 00 00 00 00 00 48 c1 e8 03 80 3c 10 00 0f 85 64 02 00 00 48 83 3d 56 7f 2e 08 00 0f 84 d0 01 00 00 48 8b bd 48 ff ff ff 57 9d <0f> 1f 44 00 00 48 b8 00 00 00 00 00 fc ff df 48 03 85 40 ff ff ff
RSP: 0018:ffff88806db0ee88 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff13249ee RBX: ffff88806db04040 RCX: 0000000000000000
RDX: dffffc0000000000 RSI: 00000000000032f3 RDI: 0000000000000282
RBP: ffff88806db0ef58 R08: 0000000000000004 R09: ffff88806db04980
R10: ffff88806db04960 R11: 0000000000000001 R12: ffff888096f36bf0
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline]
 _raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:144
 spin_lock include/linux/spinlock.h:329 [inline]
 ext4_do_update_inode fs/ext4/inode.c:5219 [inline]
 ext4_mark_iloc_dirty+0x28b/0x2f00 fs/ext4/inode.c:5849
kobject: 'tx-0' (00000000be6ab4d9): kobject_add_internal: parent: 'queues', set: 'queues'
 ext4_mark_inode_dirty+0x24f/0xb80 fs/ext4/inode.c:6028
kobject: 'tx-0' (00000000be6ab4d9): kobject_uevent_env
 __ext4_ext_dirty+0x1f3/0x270 fs/ext4/extents.c:165
 ext4_ext_rm_leaf fs/ext4/extents.c:2804 [inline]
 ext4_ext_remove_space+0x1934/0x5b40 fs/ext4/extents.c:3010
kobject: 'tx-0' (00000000be6ab4d9): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/tx-0'
kobject: 'batman_adv' (00000000957c3ef0): kobject_add_internal: parent: 'nr0
', set: '<NULL>'
 ext4_ext_truncate+0x1b5/0x200 fs/ext4/extents.c:4543
 ext4_truncate+0xf8d/0x1610 fs/ext4/inode.c:4533
 ext4_evict_inode+0xaed/0x1ae0 fs/ext4/inode.c:289
kobject: 'tx-1' (0000000031a7823f): kobject_add_internal: parent: 'queues', set: 'queues'
kobject: 'tx-1' (0000000031a7823f): kobject_uevent_env
 evict+0x49b/0x940 fs/inode.c:558
kobject: 'tx-1' (0000000031a7823f): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/tx-1'
 iput_final fs/inode.c:1550 [inline]
 iput fs/inode.c:1576 [inline]
 iput+0x67e/0xae0 fs/inode.c:1562
kobject: 'rx-1' (00000000266b8ba4): kobject_add_internal: parent: 'queues', set: 'queues'
 dentry_unlink_inode+0x43a/0x5e0 fs/dcache.c:360
kobject: 'rx-1' (00000000266b8ba4): kobject_uevent_env
 d_delete+0x1e1/0x230 fs/dcache.c:2350
 vfs_rmdir fs/namei.c:3892 [inline]
 vfs_rmdir+0x38f/0x470 fs/namei.c:3858
 do_rmdir+0x474/0x580 fs/namei.c:3940
kobject: 'rx-1' (00000000266b8ba4): fill_kobj_path: path = '/devices/virtual/net/nr0
/queues/rx-1'
kobject: 'nr0
' (000000000348fc8a): kobject_add_internal: parent: 'net', set: 'devices'
 __do_sys_rmdir fs/namei.c:3958 [inline]
 __se_sys_rmdir fs/namei.c:3956 [inline]
 __x64_sys_rmdir+0x36/0x40 fs/namei.c:3956
 do_syscall_64+0x1a3/0x800 arch/x86/entry/common.c:290
kobject: 'nr0
' (000000000348fc8a): kobject_uevent_env
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457c37
Code: 00 66 90 b8 57 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 ed b9 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 54 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 cd b9 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007ffc18e8cc38 EFLAGS: 00000207 ORIG_RAX: 0000000000000054
RAX: ffffffffffffffda RBX: 0000000000000065 RCX: 0000000000457c37
kobject: 'nr0
' (000000000348fc8a): fill_kobj_path: path = '/devices/virtual/net/nr0
'
RDX: 0000000000000000 RSI: 0000000000710698 RDI: 00007ffc18e8dd70
RBP: 0000000000000077 R08: 0000000000000000 R09: 0000000000000001
R10: 0000000000000006 R11: 0000000000000207 R12: 00007ffc18e8dd70
R13: 00000000016ab940 R14: 0000000000000000 R15: 0000000000000005

Allocated by task 8969:
 save_stack+0x45/0xd0 mm/kasan/kasan.c:448
 set_track mm/kasan/kasan.c:460 [inline]
 kasan_kmalloc mm/kasan/kasan.c:553 [inline]
 kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:531
kobject: 'queues' (00000000ef037b2b): kobject_add_internal: parent: 'nr0
', set: '<NULL>'
 kmem_cache_alloc_trace+0x152/0x760 mm/slab.c:3620
 kmalloc include/linux/slab.h:546 [inline]
 kzalloc include/linux/slab.h:741 [inline]
 dev_map_alloc kernel/bpf/devmap.c:102 [inline]
 dev_map_alloc+0x205/0x800 kernel/bpf/devmap.c:88
 find_and_alloc_map kernel/bpf/syscall.c:129 [inline]
 map_create kernel/bpf/syscall.c:510 [inline]
 __do_sys_bpf+0x6df/0x4410 kernel/bpf/syscall.c:2603
 __se_sys_bpf kernel/bpf/syscall.c:2580 [inline]
 __x64_sys_bpf+0x73/0xb0 kernel/bpf/syscall.c:2580
 do_syscall_64+0x1a3/0x800 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
kobject: 'queues' (00000000ef037b2b): kobject_uevent_env

Freed by task 7997:
 save_stack+0x45/0xd0 mm/kasan/kasan.c:448
 set_track mm/kasan/kasan.c:460 [inline]
 __kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
 __cache_free mm/slab.c:3498 [inline]
 kfree+0xcf/0x230 mm/slab.c:3817
 dev_map_free+0x522/0x6b0 kernel/bpf/devmap.c:192
 bpf_map_free_deferred+0xba/0xf0 kernel/bpf/syscall.c:290
 process_one_work+0xd0c/0x1ce0 kernel/workqueue.c:2153
kobject: 'queues' (00000000ef037b2b): kobject_uevent_env: filter function caused the event to drop!
 worker_thread+0x143/0x14a0 kernel/workqueue.c:2296
 kthread+0x357/0x430 kernel/kthread.c:246
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352

The buggy address belongs to the object at ffff88806d466d40
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 264 bytes inside of
 512-byte region [ffff88806d466d40, ffff88806d466f40)
The buggy address belongs to the page:
kobject: 'rx-0' (0000000077f75738): kobject_add_internal: parent: 'queues', set: 'queues'
page:ffffea0001b51980 count:1 mapcount:0 mapping:ffff88812c3f0940 index:0xffff88806d4665c0
flags: 0x1fffc0000000200(slab)
raw: 01fffc0000000200 ffffea0001b56bc8 ffffea0001b512c8 ffff88812c3f0940
raw: ffff88806d4665c0 ffff88806d4660c0 0000000100000005 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88806d466d00: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
 ffff88806d466d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
kobject: 'rx-0' (0000000077f75738): kobject_uevent_env
>ffff88806d466e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                              ^
 ffff88806d466e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88806d466f00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
==================================================================