================================================================== BUG: KASAN: stack-out-of-bounds in bq_xmit_all+0x134/0x11d0 kernel/bpf/devmap.c:385 Read of size 8 at addr ffffc9000382fac0 by task syz-executor153/7026 CPU: 1 PID: 7026 Comm: syz-executor153 Not tainted 6.10.0-syzkaller-08676-g720261cfc732 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/27/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 bq_xmit_all+0x134/0x11d0 kernel/bpf/devmap.c:385 __dev_flush+0x81/0x160 kernel/bpf/devmap.c:425 xdp_do_check_flushed+0x129/0x240 net/core/filter.c:4300 __napi_poll+0xe4/0x490 net/core/dev.c:6774 napi_poll net/core/dev.c:6840 [inline] net_rx_action+0x89b/0x1240 net/core/dev.c:6962 handle_softirqs+0x2c4/0x970 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637 irq_exit_rcu+0x9/0x30 kernel/softirq.c:649 common_interrupt+0xaa/0xd0 arch/x86/kernel/irq.c:278 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693 RIP: 0010:orc_find arch/x86/kernel/unwind_orc.c:206 [inline] RIP: 0010:unwind_next_frame+0x1ef/0x2a00 arch/x86/kernel/unwind_orc.c:494 Code: c3 00 00 00 81 48 89 ef 48 c7 c6 00 00 00 81 e8 e7 4d 55 00 49 c7 c6 00 00 c0 8b 48 89 ef 48 c7 c6 00 00 c0 8b e8 d1 4d 55 00 <48> 39 dd 48 89 6c 24 38 0f 82 27 01 00 00 4c 39 f5 0f 83 1e 01 00 RSP: 0018:ffffc9000382f260 EFLAGS: 00000293 RAX: 0000000000000000 RBX: ffffffff81000000 RCX: ffff888022579e00 RDX: ffffc9000382f3d5 RSI: ffffffff8bc00000 RDI: ffffffff814149cb RBP: ffffffff814149cb R08: ffffffff8141193f R09: 0000000000000000 R10: ffffc9000382f3a0 R11: fffff52000705e80 R12: ffffc9000382f3a0 R13: ffffc9000382f3f0 R14: ffffffff8bc00000 R15: ffffffff814149cc __unwind_start+0x641/0x7c0 arch/x86/kernel/unwind_orc.c:760 unwind_start arch/x86/include/asm/unwind.h:64 [inline] arch_stack_walk+0x103/0x1b0 arch/x86/kernel/stacktrace.c:24 stack_trace_save+0x118/0x1d0 kernel/stacktrace.c:122 kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object+0xe0/0x150 mm/kasan/common.c:240 __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2235 [inline] slab_free mm/slub.c:4464 [inline] kmem_cache_free+0x145/0x350 mm/slub.c:4539 pmd_ptlock_free include/linux/mm.h:3081 [inline] pagetable_pmd_dtor include/linux/mm.h:3122 [inline] ___pmd_free_tlb+0x7c/0x1a0 arch/x86/mm/pgtable.c:72 __pmd_free_tlb arch/x86/include/asm/pgalloc.h:93 [inline] free_pmd_range mm/memory.c:228 [inline] free_pud_range mm/memory.c:246 [inline] free_p4d_range mm/memory.c:280 [inline] free_pgd_range+0x9fe/0xdd0 mm/memory.c:360 free_pgtables+0x653/0x730 exit_mmap+0x447/0xc80 mm/mmap.c:3352 __mmput+0x115/0x380 kernel/fork.c:1343 exit_mm+0x220/0x310 kernel/exit.c:566 do_exit+0x9b2/0x27f0 kernel/exit.c:864 do_group_exit+0x207/0x2c0 kernel/exit.c:1026 __do_sys_exit_group kernel/exit.c:1037 [inline] __se_sys_exit_group kernel/exit.c:1035 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1035 x64_sys_call+0x26c3/0x26d0 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f310bf11e09 Code: Unable to access opcode bytes at 0x7f310bf11ddf. RSP: 002b:00007ffeb5a4e7b8 EFLAGS: 00000246 ORIG_RAX: 00000000000000e7 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f310bf11e09 RDX: 000000000000003c RSI: 00000000000000e7 RDI: 0000000000000000 RBP: 00007f310bf92390 R08: ffffffffffffffb8 R09: 00007ffeb5a4e840 R10: 00007ffeb5a4e840 R11: 0000000000000246 R12: 00007f310bf92390 R13: 0000000000000000 R14: 00007f310bf93e60 R15: 00007f310bee2c60 The buggy address belongs to stack of task syz-executor153/7026 and is located at offset 0 in frame: exit_mmap+0x0/0xc80 This frame has 2 objects: [32, 160) 'tlb' [192, 256) 'vmi' The buggy address belongs to the virtual mapping at [ffffc90003828000, ffffc90003831000) created by: copy_process+0x5d1/0x3dc0 kernel/fork.c:2203 The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88807a644dc0 pfn:0x7a644 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000 raw: ffff88807a644dc0 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2dc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_NOWARN|__GFP_ZERO), pid 5077, tgid 5077 (syz-executor153), ts 85811625558, free_ts 85310218450 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1473 prep_new_page mm/page_alloc.c:1481 [inline] get_page_from_freelist+0x2e4c/0x2f10 mm/page_alloc.c:3425 __alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4683 alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265 vm_area_alloc_pages mm/vmalloc.c:3583 [inline] __vmalloc_area_node mm/vmalloc.c:3659 [inline] __vmalloc_node_range_noprof+0x971/0x1460 mm/vmalloc.c:3840 alloc_thread_stack_node kernel/fork.c:311 [inline] dup_task_struct+0x444/0x8c0 kernel/fork.c:1111 copy_process+0x5d1/0x3dc0 kernel/fork.c:2203 kernel_clone+0x223/0x870 kernel/fork.c:2780 __do_sys_clone kernel/fork.c:2923 [inline] __se_sys_clone kernel/fork.c:2907 [inline] __x64_sys_clone+0x258/0x2a0 kernel/fork.c:2907 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6980 tgid 6980 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1093 [inline] free_unref_folios+0xf12/0x19c0 mm/page_alloc.c:2637 folios_put_refs+0x93a/0xa60 mm/swap.c:1024 free_pages_and_swap_cache+0x5c8/0x690 mm/swap_state.c:332 __tlb_batch_free_encoded_pages mm/mmu_gather.c:136 [inline] tlb_batch_pages_flush mm/mmu_gather.c:149 [inline] tlb_flush_mmu_free mm/mmu_gather.c:366 [inline] tlb_flush_mmu+0x3a3/0x680 mm/mmu_gather.c:373 tlb_finish_mmu+0xd4/0x200 mm/mmu_gather.c:465 exit_mmap+0x44f/0xc80 mm/mmap.c:3354 __mmput+0x115/0x380 kernel/fork.c:1343 exit_mm+0x220/0x310 kernel/exit.c:566 do_exit+0x9b2/0x27f0 kernel/exit.c:864 do_group_exit+0x207/0x2c0 kernel/exit.c:1026 __do_sys_exit_group kernel/exit.c:1037 [inline] __se_sys_exit_group kernel/exit.c:1035 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1035 x64_sys_call+0x26c3/0x26d0 arch/x86/include/generated/asm/syscalls_64.h:232 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffffc9000382f980: 00 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 ffffc9000382fa00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffc9000382fa80: 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 ^ ffffc9000382fb00: 00 00 00 00 00 00 00 00 00 00 00 00 f2 f2 f2 f2 ffffc9000382fb80: 00 00 00 00 00 00 00 00 f3 f3 f3 f3 00 00 00 00 ================================================================== ---------------- Code disassembly (best guess): 0: c3 ret 1: 00 00 add %al,(%rax) 3: 00 81 48 89 ef 48 add %al,0x48ef8948(%rcx) 9: c7 c6 00 00 00 81 mov $0x81000000,%esi f: e8 e7 4d 55 00 call 0x554dfb 14: 49 c7 c6 00 00 c0 8b mov $0xffffffff8bc00000,%r14 1b: 48 89 ef mov %rbp,%rdi 1e: 48 c7 c6 00 00 c0 8b mov $0xffffffff8bc00000,%rsi 25: e8 d1 4d 55 00 call 0x554dfb * 2a: 48 39 dd cmp %rbx,%rbp <-- trapping instruction 2d: 48 89 6c 24 38 mov %rbp,0x38(%rsp) 32: 0f 82 27 01 00 00 jb 0x15f 38: 4c 39 f5 cmp %r14,%rbp 3b: 0f .byte 0xf 3c: 83 1e 01 sbbl $0x1,(%rsi)