==================================================================
BUG: KASAN: stack-out-of-bounds in user_mode arch/x86/include/asm/ptrace.h:136 [inline]
BUG: KASAN: stack-out-of-bounds in unwind_next_frame+0x17fc/0x1ef0 arch/x86/kernel/unwind_orc.c:455
Read of size 8 at addr ffffc90015337950 by task syz-executor.4/19714
CPU: 0 PID: 19714 Comm: syz-executor.4 Not tainted 6.2.0-rc8-next-20230217-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/21/2023
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd9/0x150 lib/dump_stack.c:106
print_address_description.constprop.0+0x2c/0x3c0 mm/kasan/report.c:319
print_report mm/kasan/report.c:430 [inline]
kasan_report+0x11c/0x130 mm/kasan/report.c:536
user_mode arch/x86/include/asm/ptrace.h:136 [inline]
unwind_next_frame+0x17fc/0x1ef0 arch/x86/kernel/unwind_orc.c:455
arch_stack_walk+0x81/0xf0 arch/x86/kernel/stacktrace.c:25
stack_trace_save+0x90/0xc0 kernel/stacktrace.c:122
kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
__kasan_record_aux_stack+0xbc/0xd0 mm/kasan/generic.c:491
irq_work_queue_on+0xd6/0x1a0 kernel/irq_work.c:140
irq_work_single+0x1e4/0x260 kernel/irq_work.c:211
__flush_smp_call_function_queue+0x484/0x7b0 kernel/smp.c:470
__sysvec_call_function_single+0xce/0x4f0 arch/x86/kernel/smp.c:248
sysvec_call_function_single+0x92/0xc0 arch/x86/kernel/smp.c:243
asm_sysvec_call_function_single+0x1a/0x20 arch/x86/include/asm/idtentry.h:653
RIP: 0010:__might_resched+0x372/0x580 kernel/sched/core.c:10022
Code: c7 c7 00 f1 4b 8a e8 cd 32 10 00 e8 38 72 aa 08 31 f6 bf 09 00 00 00 48 83 c4 10 5b 5d 41 5c 41 5d 41 5e e9 00 ed f3 ff 9c 58 c4 02 0f 84 15 fd ff ff 65 4c 8b 2c 25 40 b8 03 00 49 8d 7d 2c
RSP: 0018:ffffc90015337868 EFLAGS: 00000246
RAX: 0000000000000246 RBX: 0000000000000000 RCX: 0000000000000001
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff888016693ebc
RBP: ffffffff8b6835c0 R08: 0000000000000004 R09: 000000000007ffff
R10: 0000000000005846 R11: 1ffffffff18f44e1 R12: 0000000000000123
R13: 0000000000000000 R14: ffff888016693a80 R15: 0000000000005846
lockdep_hardirqs_on+0x7d/0x100 kernel/locking/lockdep.c:4394
asm_sysvec_reschedule_ipi+0x1a/0x20 arch/x86/include/asm/idtentry.h:650
RIP: 0010:resched_offsets_ok kernel/sched/core.c:10007 [inline]
RIP: 0010:__might_resched+0x66/0x580 kernel/sched/core.c:10022
Code: 8d be 3c 04 00 00 65 8b 05 af 82 ab 7e 48 89 fa 25 ff ff ff 7f 48 c1 ea 03 41 89 c5 48 b8 00 00 00 00 00 fc ff df 0f b6 14 02 <48> 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 54 04 00 00 41
RSP: 0246:ffffc90015337970 EFLAGS: 00000a07
RAX: 0000000041b58ab3 RBX: ffffffff9216f1f0 RCX: ffffffff8c005b58
RDX: ffffffff8896ce60 RSI: 0000000000000000 RDI: ffff888016693ebc
RBP: 000058460000000a R08: ffffffff9216f228 R09: 1ffff92002a66f23
R10: 1ffffffff242de45 R11: fffffbfff242de3c R12: fffffbfff242de45
R13: ffffffff9216f1e0 R14: 0000000000005846 R15: fffffbfff1c81358
ops_exit_list+0x125/0x170 net/core/net_namespace.c:174
setup_net+0x7fb/0xc50 net/core/net_namespace.c:361
copy_net_ns+0x4ee/0x8e0 net/core/net_namespace.c:490
create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110
copy_namespaces+0x410/0x500 kernel/nsproxy.c:179
copy_process+0x3129/0x76c0 kernel/fork.c:2272
kernel_clone+0xeb/0xa10 kernel/fork.c:2684
__do_sys_clone+0xba/0x100 kernel/fork.c:2825
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fbbd368c0f9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fbbd4427118 EFLAGS: 00000206 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 00007fbbd37abf80 RCX: 00007fbbd368c0f9
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000
RBP: 00007fbbd36e7ae9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000
R13: 00007ffc8a16d4cf R14: 00007fbbd4427300 R15: 0000000000022000
The buggy address belongs to stack of task syz-executor.4/19714
and is located at offset 56 in frame:
inet_twsk_purge+0x0/0x900 net/ipv4/inet_timewait_sock.c:237
This frame has 1 object:
[32, 36) 'old'
The buggy address belongs to the virtual mapping at
[ffffc90015330000, ffffc90015339000) created by:
kernel_clone+0xeb/0xa10 kernel/fork.c:2684
The buggy address belongs to the physical page:
page:ffffea0001e5f540 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x797d5
memcg:ffff888025955802
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff ffff888025955802
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x102dc2(GFP_HIGHUSER|__GFP_NOWARN|__GFP_ZERO), pid 5130, tgid 5130 (syz-executor.3), ts 3313812889209, free_ts 3280971160869
prep_new_page mm/page_alloc.c:2552 [inline]
get_page_from_freelist+0x11bb/0x2d50 mm/page_alloc.c:4339
__alloc_pages+0x1cb/0x5c0 mm/page_alloc.c:5605
alloc_pages+0x1aa/0x270 mm/mempolicy.c:2283
vm_area_alloc_pages mm/vmalloc.c:2942 [inline]
__vmalloc_area_node mm/vmalloc.c:3010 [inline]
__vmalloc_node_range+0xb8a/0x1300 mm/vmalloc.c:3180
alloc_thread_stack_node kernel/fork.c:311 [inline]
dup_task_struct kernel/fork.c:984 [inline]
copy_process+0x1320/0x76c0 kernel/fork.c:2100
kernel_clone+0xeb/0xa10 kernel/fork.c:2684
__do_sys_clone+0xba/0x100 kernel/fork.c:2825
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1453 [inline]
free_pcp_prepare+0x4de/0x930 mm/page_alloc.c:1503
free_unref_page_prepare mm/page_alloc.c:3401 [inline]
free_unref_page_list+0x176/0xcd0 mm/page_alloc.c:3542
release_pages+0xcd7/0x1380 mm/swap.c:1042
tlb_batch_pages_flush+0xa8/0x1a0 mm/mmu_gather.c:97
tlb_flush_mmu_free mm/mmu_gather.c:292 [inline]
tlb_flush_mmu mm/mmu_gather.c:299 [inline]
tlb_finish_mmu+0x14b/0x7e0 mm/mmu_gather.c:391
exit_mmap+0x205/0x7d0 mm/mmap.c:3047
__mmput+0x128/0x4c0 kernel/fork.c:1209
mmput+0x60/0x70 kernel/fork.c:1231
exit_mm kernel/exit.c:563 [inline]
do_exit+0x9d7/0x2b60 kernel/exit.c:856
do_group_exit+0xd4/0x2a0 kernel/exit.c:1019
get_signal+0x2315/0x25b0 kernel/signal.c:2859
arch_do_signal_or_restart+0x79/0x5c0 arch/x86/kernel/signal.c:306
exit_to_user_mode_loop kernel/entry/common.c:168 [inline]
exit_to_user_mode_prepare+0x11f/0x240 kernel/entry/common.c:204
__syscall_exit_to_user_mode_work kernel/entry/common.c:286 [inline]
syscall_exit_to_user_mode+0x1d/0x50 kernel/entry/common.c:297
do_syscall_64+0x46/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Memory state around the buggy address:
ffffc90015337800: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffffc90015337880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffc90015337900: 00 00 00 f1 f1 f1 f1 04 f3 f3 f3 00 00 00 00 00
^
ffffc90015337980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffffc90015337a00: 00 00 f1 f1 f1 f1 00 00 f3 f3 00 00 00 00 00 00
==================================================================
----------------
Code disassembly (best guess):
0: c7 c7 00 f1 4b 8a mov $0x8a4bf100,%edi
6: e8 cd 32 10 00 callq 0x1032d8
b: e8 38 72 aa 08 callq 0x8aa7248
10: 31 f6 xor %esi,%esi
12: bf 09 00 00 00 mov $0x9,%edi
17: 48 83 c4 10 add $0x10,%rsp
1b: 5b pop %rbx
1c: 5d pop %rbp
1d: 41 5c pop %r12
1f: 41 5d pop %r13
21: 41 5e pop %r14
23: e9 00 ed f3 ff jmpq 0xfff3ed28
28: 9c pushfq
29: 58 pop %rax
* 2a: f6 c4 02 test $0x2,%ah <-- trapping instruction
2d: 0f 84 15 fd ff ff je 0xfffffd48
33: 65 4c 8b 2c 25 40 b8 mov %gs:0x3b840,%r13
3a: 03 00
3c: 49 8d 7d 2c lea 0x2c(%r13),%rdi