================================================================== BUG: KASAN: slab-use-after-free in __bpf_trace_run kernel/trace/bpf_trace.c:2382 [inline] BUG: KASAN: slab-use-after-free in bpf_trace_run4+0x143/0x580 kernel/trace/bpf_trace.c:2439 Read of size 8 at addr ffff888020bc5e18 by task modprobe/5510 CPU: 0 PID: 5510 Comm: modprobe Not tainted 6.8.0-syzkaller-05243-g14bb1e8c8d4a #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 __bpf_trace_run kernel/trace/bpf_trace.c:2382 [inline] bpf_trace_run4+0x143/0x580 kernel/trace/bpf_trace.c:2439 __traceiter_sched_switch+0x98/0xd0 include/trace/events/sched.h:222 trace_sched_switch include/trace/events/sched.h:222 [inline] __schedule+0x255d/0x4a20 kernel/sched/core.c:6733 preempt_schedule_irq+0xfb/0x1c0 kernel/sched/core.c:7058 irqentry_exit+0x5e/0x90 kernel/entry/common.c:348 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:rb_erase_augmented include/linux/rbtree_augmented.h:329 [inline] RIP: 0010:rb_erase_augmented_cached include/linux/rbtree_augmented.h:340 [inline] RIP: 0010:vma_interval_tree_remove+0x136/0xae0 mm/interval_tree.c:23 Code: df 48 83 c3 10 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 c9 5a 1b 00 48 8b 1b 48 85 db 74 76 e8 2c 00 b8 ff eb d1 <4d> 89 fc 48 89 d8 48 c1 e8 03 42 80 3c 28 00 74 08 48 89 df e8 a1 RSP: 0018:ffffc9000a517908 EFLAGS: 00000246 RAX: 1ffff1100fa0a84a RBX: ffff88807d054240 RCX: ffff88806d001e00 RDX: 0000000000000000 RSI: ffff888028f373d8 RDI: ffff88807d054248 RBP: ffff88807d054250 R08: ffffffff81dd0887 R09: 1ffff110056afd78 R10: dffffc0000000000 R11: ffffed10056afd79 R12: ffff88807d054200 R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 vma_prepare+0x440/0x4c0 mm/mmap.c:494 __split_vma+0xa50/0xd00 mm/mmap.c:2378 split_vma mm/mmap.c:2415 [inline] vma_modify+0x331/0x410 mm/mmap.c:2457 vma_modify_flags include/linux/mm.h:3283 [inline] mprotect_fixup+0x4a6/0xb80 mm/mprotect.c:635 do_mprotect_pkey+0x903/0xe20 mm/mprotect.c:809 __do_sys_mprotect mm/mprotect.c:830 [inline] __se_sys_mprotect mm/mprotect.c:827 [inline] __x64_sys_mprotect+0x80/0x90 mm/mprotect.c:827 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 RIP: 0033:0x7f7694389bb7 Code: 00 00 00 b8 0b 00 00 00 0f 05 48 3d 01 f0 ff ff 73 01 c3 48 8d 0d b9 46 01 00 f7 d8 89 01 48 83 c8 ff c3 b8 0a 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8d 0d 99 46 01 00 f7 d8 89 01 48 83 RSP: 002b:00007ffdae3bfcd8 EFLAGS: 00000206 ORIG_RAX: 000000000000000a RAX: ffffffffffffffda RBX: 00007f76943665c0 RCX: 00007f7694389bb7 RDX: 0000000000000001 RSI: 0000000000004000 RDI: 00007f7694290000 RBP: 00007ffdae3bfdf0 R08: 00007ffdae3b0000 R09: 00007f769439dab0 R10: 00007f76940f6ab8 R11: 0000000000000206 R12: 00007f76943665c0 R13: 00007f7694391eda R14: 00007f7694293bf8 R15: 00007f7694293b70 Allocated by task 5499: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:370 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387 kasan_kmalloc include/linux/kasan.h:211 [inline] kmalloc_trace+0x1d9/0x360 mm/slub.c:4012 kmalloc include/linux/slab.h:590 [inline] kzalloc include/linux/slab.h:711 [inline] bpf_raw_tp_link_attach+0x2a0/0x6e0 kernel/bpf/syscall.c:3816 bpf_raw_tracepoint_open+0x1c2/0x240 kernel/bpf/syscall.c:3863 __sys_bpf+0x3c0/0x810 kernel/bpf/syscall.c:5673 __do_sys_bpf kernel/bpf/syscall.c:5738 [inline] __se_sys_bpf kernel/bpf/syscall.c:5736 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5736 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 Freed by task 5498: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:589 poison_slab_object+0xa6/0xe0 mm/kasan/common.c:240 __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2121 [inline] slab_free mm/slub.c:4299 [inline] kfree+0x14a/0x380 mm/slub.c:4409 bpf_link_release+0x3b/0x50 kernel/bpf/syscall.c:3071 __fput+0x429/0x8a0 fs/file_table.c:423 task_work_run+0x24f/0x310 kernel/task_work.c:180 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0xa1b/0x27e0 kernel/exit.c:878 do_group_exit+0x207/0x2c0 kernel/exit.c:1027 __do_sys_exit_group kernel/exit.c:1038 [inline] __se_sys_exit_group kernel/exit.c:1036 [inline] __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1036 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 The buggy address belongs to the object at ffff888020bc5e00 which belongs to the cache kmalloc-128 of size 128 The buggy address is located 24 bytes inside of freed 128-byte region [ffff888020bc5e00, ffff888020bc5e80) The buggy address belongs to the physical page: page:ffffea000082f140 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x20bc5 anon flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 00fff00000000800 ffff888014c418c0 0000000000000000 dead000000000001 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 5076, tgid 5076 (syz-executor.1), ts 63733825492, free_ts 63240284037 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1533 prep_new_page mm/page_alloc.c:1540 [inline] get_page_from_freelist+0x33ea/0x3580 mm/page_alloc.c:3311 __alloc_pages+0x256/0x680 mm/page_alloc.c:4569 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] alloc_slab_page+0x5f/0x160 mm/slub.c:2190 allocate_slab mm/slub.c:2354 [inline] new_slab+0x84/0x2f0 mm/slub.c:2407 ___slab_alloc+0xd1b/0x13e0 mm/slub.c:3540 __slab_alloc mm/slub.c:3625 [inline] __slab_alloc_node mm/slub.c:3678 [inline] slab_alloc_node mm/slub.c:3850 [inline] __do_kmalloc_node mm/slub.c:3980 [inline] __kmalloc_node+0x2d9/0x4e0 mm/slub.c:3988 kmalloc_array_node include/linux/slab.h:688 [inline] kcalloc_node include/linux/slab.h:693 [inline] memcg_alloc_slab_cgroups+0x81/0x120 mm/memcontrol.c:3014 account_slab mm/slub.c:2317 [inline] allocate_slab mm/slub.c:2372 [inline] new_slab+0xc0/0x2f0 mm/slub.c:2407 ___slab_alloc+0xd1b/0x13e0 mm/slub.c:3540 __slab_alloc mm/slub.c:3625 [inline] __slab_alloc_node mm/slub.c:3678 [inline] slab_alloc_node mm/slub.c:3850 [inline] __do_kmalloc_node mm/slub.c:3980 [inline] __kmalloc_node+0x2d9/0x4e0 mm/slub.c:3988 kmalloc_node include/linux/slab.h:610 [inline] kvmalloc_node+0x72/0x190 mm/util.c:634 kvmalloc include/linux/slab.h:728 [inline] kvzalloc include/linux/slab.h:736 [inline] allocate_hook_entries_size net/netfilter/core.c:61 [inline] nf_hook_entries_grow+0x288/0x720 net/netfilter/core.c:140 __nf_register_net_hook+0x278/0x8d0 net/netfilter/core.c:435 nf_register_net_hook+0xb0/0x190 net/netfilter/core.c:578 nf_register_net_hooks+0x41/0x1a0 net/netfilter/core.c:594 page last free pid 24 tgid 24 stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1140 [inline] free_unref_page_prepare+0x968/0xa90 mm/page_alloc.c:2346 free_unref_page+0x37/0x3f0 mm/page_alloc.c:2486 discard_slab mm/slub.c:2453 [inline] __put_partials+0xeb/0x130 mm/slub.c:2922 put_cpu_partial+0x17c/0x250 mm/slub.c:2997 __slab_free+0x302/0x410 mm/slub.c:4166 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x5e/0xc0 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x14f/0x170 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x23/0x80 mm/kasan/common.c:322 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook mm/slub.c:3813 [inline] slab_alloc_node mm/slub.c:3860 [inline] kmem_cache_alloc_node+0x192/0x380 mm/slub.c:3903 __alloc_skb+0x1c3/0x440 net/core/skbuff.c:658 alloc_skb include/linux/skbuff.h:1318 [inline] alloc_skb_with_frags+0xc3/0x770 net/core/skbuff.c:6504 sock_alloc_send_pskb+0x91a/0xa60 net/core/sock.c:2795 sock_alloc_send_skb include/net/sock.h:1835 [inline] mld_newpack+0x1c3/0xa90 net/ipv6/mcast.c:1746 add_grhead net/ipv6/mcast.c:1849 [inline] add_grec+0x1492/0x19a0 net/ipv6/mcast.c:1987 mld_send_initial_cr+0x228/0x4b0 net/ipv6/mcast.c:2233 mld_dad_work+0x44/0x500 net/ipv6/mcast.c:2259 Memory state around the buggy address: ffff888020bc5d00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888020bc5d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888020bc5e00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888020bc5e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888020bc5f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc ================================================================== ---------------- Code disassembly (best guess): 0: df 48 83 fisttps -0x7d(%rax) 3: c3 ret 4: 10 48 89 adc %cl,-0x77(%rax) 7: d8 48 c1 fmuls -0x3f(%rax) a: e8 03 42 80 3c call 0x3c804212 f: 28 00 sub %al,(%rax) 11: 74 08 je 0x1b 13: 48 89 df mov %rbx,%rdi 16: e8 c9 5a 1b 00 call 0x1b5ae4 1b: 48 8b 1b mov (%rbx),%rbx 1e: 48 85 db test %rbx,%rbx 21: 74 76 je 0x99 23: e8 2c 00 b8 ff call 0xffb80054 28: eb d1 jmp 0xfffffffb * 2a: 4d 89 fc mov %r15,%r12 <-- trapping instruction 2d: 48 89 d8 mov %rbx,%rax 30: 48 c1 e8 03 shr $0x3,%rax 34: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) 39: 74 08 je 0x43 3b: 48 89 df mov %rbx,%rdi 3e: e8 .byte 0xe8 3f: a1 .byte 0xa1