==================================================================
BUG: KASAN: slab-out-of-bounds in do_jit.isra.0+0x4c35/0x5630 arch/x86/net/bpf_jit_comp.c:966
Read of size 4 at addr ffff8880a11caa3c by task syz-executor.1/6199
CPU: 1 PID: 6199 Comm: syz-executor.1 Not tainted 5.3.0-rc3+ #124
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x172/0x1f0 lib/dump_stack.c:113
print_address_description.cold+0xd4/0x306 mm/kasan/report.c:351
__kasan_report.cold+0x1b/0x36 mm/kasan/report.c:482
kasan_report+0x12/0x17 mm/kasan/common.c:612
__asan_report_load4_noabort+0x14/0x20 mm/kasan/generic_report.c:131
do_jit.isra.0+0x4c35/0x5630 arch/x86/net/bpf_jit_comp.c:966
bpf_int_jit_compile+0x374/0xda0 arch/x86/net/bpf_jit_comp.c:1132
bpf_prog_select_runtime+0x4cd/0x7d0 kernel/bpf/core.c:1725
bpf_prog_load+0xe9b/0x1670 kernel/bpf/syscall.c:1702
__do_sys_bpf+0xc43/0x3460 kernel/bpf/syscall.c:2849
__se_sys_bpf kernel/bpf/syscall.c:2808 [inline]
__x64_sys_bpf+0x73/0xb0 kernel/bpf/syscall.c:2808
do_syscall_64+0xfd/0x6a0 arch/x86/entry/common.c:296
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x459829
Code: fd b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f7336f54c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000459829
RDX: 0000000000000048 RSI: 000000002000e000 RDI: 0000000000000005
RBP: 000000000075bf20 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f7336f556d4
R13: 00000000004bfc7c R14: 00000000004d18d8 R15: 00000000ffffffff
Allocated by task 1:
save_stack+0x23/0x90 mm/kasan/common.c:69
set_track mm/kasan/common.c:77 [inline]
__kasan_kmalloc mm/kasan/common.c:487 [inline]
__kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:460
kasan_kmalloc+0x9/0x10 mm/kasan/common.c:501
__do_kmalloc mm/slab.c:3655 [inline]
__kmalloc_track_caller+0x15f/0x760 mm/slab.c:3670
kvasprintf+0xc8/0x170 lib/kasprintf.c:25
kvasprintf_const+0x65/0x190 lib/kasprintf.c:49
kobject_set_name_vargs+0x5b/0x150 lib/kobject.c:289
dev_set_name+0xbb/0xf0 drivers/base/core.c:1918
usb_alloc_dev+0xcc4/0xf86 drivers/usb/core/usb.c:641
usb_add_hcd.cold+0x3bf/0x1649 drivers/usb/core/hcd.c:2804
vhci_hcd_probe+0x17d/0x250 drivers/usb/usbip/vhci_hcd.c:1354
platform_drv_probe+0x8d/0x140 drivers/base/platform.c:616
really_probe+0x291/0x680 drivers/base/dd.c:548
driver_probe_device+0x110/0x1c0 drivers/base/dd.c:709
__device_attach_driver+0x1c9/0x230 drivers/base/dd.c:816
bus_for_each_drv+0x16c/0x1f0 drivers/base/bus.c:454
__device_attach+0x237/0x390 drivers/base/dd.c:882
device_initial_probe+0x1b/0x20 drivers/base/dd.c:929
bus_probe_device+0x1f1/0x2a0 drivers/base/bus.c:514
device_add+0xae0/0x17a0 drivers/base/core.c:2114
platform_device_add+0x34d/0x6c0 drivers/base/platform.c:453
vhci_hcd_init+0x359/0x4af drivers/usb/usbip/vhci_hcd.c:1524
do_one_initcall+0x120/0x81a init/main.c:939
do_initcall_level init/main.c:1007 [inline]
do_initcalls init/main.c:1015 [inline]
do_basic_setup init/main.c:1032 [inline]
kernel_init_freeable+0x4cf/0x5be init/main.c:1192
kernel_init+0x12/0x1c5 init/main.c:1110
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352
Freed by task 0:
(stack is not available)
The buggy address belongs to the object at ffff8880a11caa00
which belongs to the cache kmalloc-32 of size 32
The buggy address is located 28 bytes to the right of
32-byte region [ffff8880a11caa00, ffff8880a11caa20)
The buggy address belongs to the page:
page:ffffea0002847280 refcount:1 mapcount:0 mapping:ffff8880aa4001c0 index:0xffff8880a11cafc1
flags: 0x1fffc0000000200(slab)
raw: 01fffc0000000200 ffffea00029e8148 ffffea00029ed908 ffff8880aa4001c0
raw: ffff8880a11cafc1 ffff8880a11ca000 000000010000003f 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8880a11ca900: 05 fc fc fc fc fc fc fc fb fb fb fb fc fc fc fc
ffff8880a11ca980: 00 01 fc fc fc fc fc fc 00 00 00 03 fc fc fc fc
>ffff8880a11caa00: 05 fc fc fc fc fc fc fc 00 00 fc fc fc fc fc fc
^
ffff8880a11caa80: 00 fc fc fc fc fc fc fc 06 fc fc fc fc fc fc fc
ffff8880a11cab00: 06 fc fc fc fc fc fc fc 00 fc fc fc fc fc fc fc
==================================================================