==================================================================
BUG: KASAN: slab-out-of-bounds in __bpf_get_stackid+0x6fa/0x960 kernel/bpf/stackmap.c:274
Write of size 24 at addr ffff888149c06728 by task syz.7.12452/18779

CPU: 0 PID: 18779 Comm: syz.7.12452 Tainted: G        W          syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026
Call Trace:
 <TASK>
 __dump_stack+0x21/0x24 lib/dump_stack.c:88
 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
 print_address_description+0x71/0x200 mm/kasan/report.c:316
 print_report+0x4a/0x60 mm/kasan/report.c:420
 kasan_report+0x122/0x150 mm/kasan/report.c:524
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x249/0x2a0 mm/kasan/generic.c:189
 memcpy+0x44/0x70 mm/kasan/shadow.c:66
 __bpf_get_stackid+0x6fa/0x960 kernel/bpf/stackmap.c:274
 ____bpf_get_stackid_pe kernel/bpf/stackmap.c:377 [inline]
 bpf_get_stackid_pe+0x350/0x400 kernel/bpf/stackmap.c:334
 bpf_prog_f1a392886e42970f+0x24/0x34
 bpf_dispatcher_nop_func include/linux/bpf.h:987 [inline]
 __bpf_prog_run include/linux/filter.h:607 [inline]
 bpf_prog_run include/linux/filter.h:614 [inline]
 bpf_overflow_handler+0x3c7/0x5e0 kernel/events/core.c:10273
 __perf_event_overflow+0x458/0x640 kernel/events/core.c:9448
 perf_swevent_overflow kernel/events/core.c:9531 [inline]
 perf_swevent_event+0x243/0x440 kernel/events/core.c:9582
 do_perf_sw_event kernel/events/core.c:9695 [inline]
 ___perf_sw_event+0x3bf/0x500 kernel/events/core.c:9726
 __perf_sw_event+0x134/0x270 kernel/events/core.c:9738
 perf_sw_event include/linux/perf_event.h:1250 [inline]
 do_user_addr_fault+0xfe9/0x1030 arch/x86/mm/fault.c:1285
 handle_page_fault arch/x86/mm/fault.c:1464 [inline]
 exc_page_fault+0x51/0xb0 arch/x86/mm/fault.c:1517
 asm_exc_page_fault+0x27/0x30 arch/x86/include/asm/idtentry.h:608
RIP: 0033:0x7f5b19659650
Code: c0 75 27 69 3d 75 c0 ef 00 b8 0b 00 00 e8 f8 6f 14 00 31 f6 bf 3c 00 00 00 31 c0 e8 ba 64 14 00 eb fe 0f 1f 84 00 00 00 00 00 <64> c7 04 25 a4 ff ff ff 00 00 00 00 48 83 c4 38 c3 66 66 2e 0f 1f
RSP: 002b:00007f5b1a728fe0 EFLAGS: 00010202
RAX: 00000000000002e6 RBX: 00007f5b19a25fa0 RCX: 00007f5b1979fb19
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 00000000c0126080
RBP: 00007f5b19837b70 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
R13: 00007f5b19a26038 R14: 00007f5b19a25fa0 R15: 00007ffde6c79cc8
 </TASK>

Allocated by task 18779:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
 kasan_save_alloc_info+0x1f/0x30 mm/kasan/generic.c:505
 ____kasan_kmalloc mm/kasan/common.c:380 [inline]
 __kasan_kmalloc+0x95/0xb0 mm/kasan/common.c:389
 kasan_kmalloc include/linux/kasan.h:212 [inline]
 __do_kmalloc_node mm/slab_common.c:938 [inline]
 __kmalloc_node+0xb2/0x1e0 mm/slab_common.c:945
 kmalloc_node include/linux/slab.h:589 [inline]
 __bpf_map_area_alloc kernel/bpf/syscall.c:328 [inline]
 bpf_map_area_alloc+0x4b/0xe0 kernel/bpf/syscall.c:341
 prealloc_elems_and_freelist+0x8a/0x1e0 kernel/bpf/stackmap.c:51
 stack_map_alloc+0x398/0x520 kernel/bpf/stackmap.c:117
 find_and_alloc_map kernel/bpf/syscall.c:133 [inline]
 map_create+0x467/0xcf0 kernel/bpf/syscall.c:1126
 __sys_bpf+0x34e/0x850 kernel/bpf/syscall.c:4988
 __do_sys_bpf kernel/bpf/syscall.c:5110 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5108 [inline]
 __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5108
 x64_sys_call+0x488/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:322
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

Last potentially related work creation:
 kasan_save_stack+0x3a/0x60 mm/kasan/common.c:46
 __kasan_record_aux_stack+0xb6/0xc0 mm/kasan/generic.c:486
 kasan_record_aux_stack_noalloc+0xb/0x10 mm/kasan/generic.c:496
 __call_rcu_common kernel/rcu/tree.c:2807 [inline]
 call_rcu+0xcf/0xf50 kernel/rcu/tree.c:2926
 nf_hook_entries_free net/netfilter/core.c:94 [inline]
 __nf_unregister_net_hook+0x486/0x610 net/netfilter/core.c:520
 nf_unregister_net_hook net/netfilter/core.c:-1 [inline]
 nf_unregister_net_hooks+0xe2/0x150 net/netfilter/core.c:607
 selinux_nf_unregister+0x21/0x30 security/selinux/hooks.c:7499
 ops_exit_list net/core/net_namespace.c:172 [inline]
 cleanup_net+0x5b0/0xb10 net/core/net_namespace.c:604
 process_one_work+0x717/0xc30 kernel/workqueue.c:2302
 worker_thread+0xa4d/0x11d0 kernel/workqueue.c:2449
 kthread+0x281/0x320 kernel/kthread.c:386
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

Second to last potentially related work creation:
 kasan_save_stack+0x3a/0x60 mm/kasan/common.c:46
 __kasan_record_aux_stack+0xb6/0xc0 mm/kasan/generic.c:486
 kasan_record_aux_stack_noalloc+0xb/0x10 mm/kasan/generic.c:496
 __call_rcu_common kernel/rcu/tree.c:2807 [inline]
 call_rcu+0xcf/0xf50 kernel/rcu/tree.c:2926
 nf_hook_entries_free net/netfilter/core.c:94 [inline]
 __nf_unregister_net_hook+0x486/0x610 net/netfilter/core.c:520
 nf_unregister_net_hook net/netfilter/core.c:-1 [inline]
 nf_unregister_net_hooks+0xe2/0x150 net/netfilter/core.c:607
 selinux_nf_unregister+0x21/0x30 security/selinux/hooks.c:7499
 ops_exit_list net/core/net_namespace.c:172 [inline]
 cleanup_net+0x5b0/0xb10 net/core/net_namespace.c:604
 process_one_work+0x717/0xc30 kernel/workqueue.c:2302
 worker_thread+0xa4d/0x11d0 kernel/workqueue.c:2449
 kthread+0x281/0x320 kernel/kthread.c:386
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295

The buggy address belongs to the object at ffff888149c06700
 which belongs to the cache kmalloc-64 of size 64
The buggy address is located 40 bytes inside of
 64-byte region [ffff888149c06700, ffff888149c06740)

The buggy address belongs to the physical page:
page:ffffea0005270180 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x149c06
flags: 0x4000000000000200(slab|zone=1)
raw: 4000000000000200 ffffea00079a03c0 dead000000000002 ffff888100042780
raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 28941, tgid 28940 (syz.4.6969), ts 770599973379, free_ts 770592357592
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0x1f5/0x210 mm/page_alloc.c:2673
 prep_new_page+0x1c/0x110 mm/page_alloc.c:2680
 get_page_from_freelist+0x2ca9/0x2d20 mm/page_alloc.c:4587
 __alloc_pages+0x1fa/0x610 mm/page_alloc.c:5931
 alloc_slab_page+0x6e/0xf0 include/linux/gfp.h:-1
 allocate_slab mm/slub.c:1967 [inline]
 new_slab+0x98/0x3e0 mm/slub.c:2020
 ___slab_alloc+0x70f/0xb70 mm/slub.c:3177
 __slab_alloc+0x5e/0xa0 mm/slub.c:3263
 slab_alloc_node mm/slub.c:3348 [inline]
 __kmem_cache_alloc_node+0x204/0x2d0 mm/slub.c:3423
 __do_kmalloc_node mm/slab_common.c:937 [inline]
 __kmalloc_node_track_caller+0xa1/0x1e0 mm/slab_common.c:958
 __do_krealloc mm/slab_common.c:1341 [inline]
 krealloc+0x6f/0x110 mm/slab_common.c:1374
 copy_array kernel/bpf/verifier.c:955 [inline]
 copy_verifier_state+0xe9/0xb10 kernel/bpf/verifier.c:1139
 push_stack+0x19b/0x4f0 kernel/bpf/verifier.c:1237
 check_cond_jmp_op kernel/bpf/verifier.c:10492 [inline]
 do_check+0x96df/0xf140 kernel/bpf/verifier.c:12736
 do_check_common+0x11c3/0x1970 kernel/bpf/verifier.c:14940
 do_check_main kernel/bpf/verifier.c:15003 [inline]
 bpf_check+0xa04e/0x10e90 kernel/bpf/verifier.c:15580
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 free_pages_prepare mm/page_alloc.c:1581 [inline]
 free_pcp_prepare mm/page_alloc.c:1655 [inline]
 free_unref_page_prepare+0x81b/0x820 mm/page_alloc.c:3622
 free_unref_page+0x93/0x530 mm/page_alloc.c:3720
 free_the_page mm/page_alloc.c:863 [inline]
 __free_pages+0x67/0x100 mm/page_alloc.c:6021
 __free_slab+0xc7/0x1a0 mm/slub.c:2044
 free_slab mm/slub.c:2059 [inline]
 discard_slab+0x29/0x40 mm/slub.c:2065
 __slab_free+0x201/0x280 mm/slub.c:3625
 do_slab_free mm/slub.c:3666 [inline]
 ___cache_free+0xbf/0xd0 mm/slub.c:3722
 qlink_free mm/kasan/quarantine.c:168 [inline]
 qlist_free_all+0xc6/0x140 mm/kasan/quarantine.c:187
 kasan_quarantine_reduce+0x14a/0x170 mm/kasan/quarantine.c:294
 __kasan_slab_alloc+0x24/0x80 mm/kasan/common.c:311
 kasan_slab_alloc include/linux/kasan.h:202 [inline]
 slab_post_alloc_hook+0x4f/0x2d0 mm/slab.h:768
 slab_alloc_node mm/slub.c:3382 [inline]
 __kmem_cache_alloc_node+0x194/0x2d0 mm/slub.c:3423
 kmalloc_trace+0x29/0xb0 mm/slab_common.c:1028
 kmalloc include/linux/slab.h:563 [inline]
 kzalloc include/linux/slab.h:699 [inline]
 is_state_visited kernel/bpf/verifier.c:12332 [inline]
 do_check+0x227b/0xf140 kernel/bpf/verifier.c:12461
 do_check_common+0x11c3/0x1970 kernel/bpf/verifier.c:14940
 do_check_main kernel/bpf/verifier.c:15003 [inline]
 bpf_check+0xa04e/0x10e90 kernel/bpf/verifier.c:15580

Memory state around the buggy address:
 ffff888149c06600: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
 ffff888149c06680: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
>ffff888149c06700: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
                                     ^
 ffff888149c06780: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
 ffff888149c06800: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
==================================================================
general protection fault, probably for non-canonical address 0xe0000beb632f3f63: 0000 [#1] PREEMPT SMP KASAN
KASAN: probably user-memory-access in range [0x00007f5b1979fb18-0x00007f5b1979fb1f]
CPU: 1 PID: 18779 Comm: syz.7.12452 Tainted: G    B   W          syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026
RIP: 0010:___pcpu_freelist_pop kernel/bpf/percpu_freelist.c:134 [inline]
RIP: 0010:__pcpu_freelist_pop+0x777/0x840 kernel/bpf/percpu_freelist.c:188
Code: 00 74 52 48 89 df e8 08 1d 2a 00 eb 48 e8 d1 7f e4 ff eb 4b e8 ca 7f e4 ff 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 ff e8 eb 1b 2a 00 4d 8b 37 48 b8 00 00 00
RSP: 0000:ffffc9000104f7d0 EFLAGS: 00010006
RAX: 00000feb632f3f63 RBX: ffffe8ffff300670 RCX: dffffc0000000000
RDX: ffffc90003fe1000 RSI: 000000000007ffff RDI: 0000000000080000
RBP: ffffc9000104f810 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff52000209eec R12: ffffe8ffff300678
R13: 1ffffd1fffe600ce R14: 0000000000000001 R15: 00007f5b1979fb19
FS:  00007f5b1a7296c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f5b1a728f88 CR3: 0000000155bd1000 CR4: 00000000003506a0
DR0: 00002000000004c0 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000200000000480 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 <TASK>
 pcpu_freelist_pop+0x8a/0xf0 kernel/bpf/percpu_freelist.c:197
 __bpf_get_stackid+0x6d5/0x960 kernel/bpf/stackmap.c:271
 ____bpf_get_stackid_pe kernel/bpf/stackmap.c:377 [inline]
 bpf_get_stackid_pe+0x350/0x400 kernel/bpf/stackmap.c:334
 bpf_prog_f1a392886e42970f+0x24/0x34
 bpf_dispatcher_nop_func include/linux/bpf.h:987 [inline]
 __bpf_prog_run include/linux/filter.h:607 [inline]
 bpf_prog_run include/linux/filter.h:614 [inline]
 bpf_overflow_handler+0x3c7/0x5e0 kernel/events/core.c:10273
 __perf_event_overflow+0x458/0x640 kernel/events/core.c:9448
 perf_swevent_overflow kernel/events/core.c:9531 [inline]
 perf_swevent_event+0x243/0x440 kernel/events/core.c:9582
 do_perf_sw_event kernel/events/core.c:9695 [inline]
 ___perf_sw_event+0x3bf/0x500 kernel/events/core.c:9726
 __perf_sw_event+0x134/0x270 kernel/events/core.c:9738
 perf_sw_event include/linux/perf_event.h:1250 [inline]
 do_user_addr_fault+0xfe9/0x1030 arch/x86/mm/fault.c:1285
 handle_page_fault arch/x86/mm/fault.c:1464 [inline]
 exc_page_fault+0x51/0xb0 arch/x86/mm/fault.c:1517
 asm_exc_page_fault+0x27/0x30 arch/x86/include/asm/idtentry.h:608
RIP: 0033:0x7f5b196536ae
Code: bf 40 0d 03 00 89 c3 e8 a0 cf 14 00 48 83 c4 10 48 63 c3 5b c3 0f 1f 80 00 00 00 00 41 54 55 53 48 89 fb 48 81 ec d0 00 00 00 <48> 89 74 24 28 48 89 54 24 30 48 89 4c 24 38 4c 89 44 24 40 4c 89
RSP: 002b:00007f5b1a728f60 EFLAGS: 00010206
RAX: 0000000000000000 RBX: 00007f5b19838579 RCX: 00007f5b19850b2a
RDX: 000000000001e307 RSI: 0000000000000000 RDI: 00007f5b19838579
RBP: 00007f5b19850b2a R08: 00000000000002e6 R09: 000c65ac805b1c96
R10: 000002d181b6b435 R11: 0000000000043ac2 R12: 0000000000000000
R13: 00007f5b19a26038 R14: 00007f5b19a25fa0 R15: 00007ffde6c79cc8
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:___pcpu_freelist_pop kernel/bpf/percpu_freelist.c:134 [inline]
RIP: 0010:__pcpu_freelist_pop+0x777/0x840 kernel/bpf/percpu_freelist.c:188
Code: 00 74 52 48 89 df e8 08 1d 2a 00 eb 48 e8 d1 7f e4 ff eb 4b e8 ca 7f e4 ff 4c 89 f8 48 c1 e8 03 48 b9 00 00 00 00 00 fc ff df <80> 3c 08 00 74 08 4c 89 ff e8 eb 1b 2a 00 4d 8b 37 48 b8 00 00 00
RSP: 0000:ffffc9000104f7d0 EFLAGS: 00010006
RAX: 00000feb632f3f63 RBX: ffffe8ffff300670 RCX: dffffc0000000000
RDX: ffffc90003fe1000 RSI: 000000000007ffff RDI: 0000000000080000
RBP: ffffc9000104f810 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff52000209eec R12: ffffe8ffff300678
R13: 1ffffd1fffe600ce R14: 0000000000000001 R15: 00007f5b1979fb19
FS:  00007f5b1a7296c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f5b1a728f88 CR3: 0000000155bd1000 CR4: 00000000003506a0
DR0: 00002000000004c0 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000200000000480 DR6: 00000000ffff0ff0 DR7: 0000000000000600
----------------
Code disassembly (best guess):
   0:	00 74 52 48          	add    %dh,0x48(%rdx,%rdx,2)
   4:	89 df                	mov    %ebx,%edi
   6:	e8 08 1d 2a 00       	call   0x2a1d13
   b:	eb 48                	jmp    0x55
   d:	e8 d1 7f e4 ff       	call   0xffe47fe3
  12:	eb 4b                	jmp    0x5f
  14:	e8 ca 7f e4 ff       	call   0xffe47fe3
  19:	4c 89 f8             	mov    %r15,%rax
  1c:	48 c1 e8 03          	shr    $0x3,%rax
  20:	48 b9 00 00 00 00 00 	movabs $0xdffffc0000000000,%rcx
  27:	fc ff df
* 2a:	80 3c 08 00          	cmpb   $0x0,(%rax,%rcx,1) <-- trapping instruction
  2e:	74 08                	je     0x38
  30:	4c 89 ff             	mov    %r15,%rdi
  33:	e8 eb 1b 2a 00       	call   0x2a1c23
  38:	4d 8b 37             	mov    (%r15),%r14
  3b:	48                   	rex.W
  3c:	b8                   	.byte 0xb8
  3d:	00 00                	add    %al,(%rax)