================================================================== BUG: KASAN: stack-out-of-bounds in bpf_net_ctx_get_all_used_flush_lists include/linux/filter.h:837 [inline] BUG: KASAN: stack-out-of-bounds in xdp_do_check_flushed+0x41c/0x4e0 net/core/filter.c:4305 Read of size 4 at addr ffffc900034b7a50 by task syz.2.355/6759 CPU: 1 UID: 0 PID: 6759 Comm: syz.2.355 Not tainted 6.11.0-rc1-syzkaller-00063-g21b136cc63d2 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:93 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:119 print_address_description mm/kasan/report.c:377 [inline] print_report+0xc3/0x620 mm/kasan/report.c:488 kasan_report+0xd9/0x110 mm/kasan/report.c:601 bpf_net_ctx_get_all_used_flush_lists include/linux/filter.h:837 [inline] xdp_do_check_flushed+0x41c/0x4e0 net/core/filter.c:4305 __napi_poll.constprop.0+0xd1/0x550 net/core/dev.c:6774 napi_poll net/core/dev.c:6840 [inline] net_rx_action+0xa92/0x1010 net/core/dev.c:6962 handle_softirqs+0x216/0x8f0 kernel/softirq.c:554 __do_softirq kernel/softirq.c:588 [inline] invoke_softirq kernel/softirq.c:428 [inline] __irq_exit_rcu kernel/softirq.c:637 [inline] irq_exit_rcu+0xbb/0x120 kernel/softirq.c:649 common_interrupt+0xb0/0xd0 arch/x86/kernel/irq.c:278 asm_common_interrupt+0x26/0x40 arch/x86/include/asm/idtentry.h:693 RIP: 0010:finish_task_switch.isra.0+0x220/0xcc0 kernel/sched/core.c:5062 Code: a9 0a 00 00 44 8b 0d 07 d6 b7 0e 45 85 c9 0f 85 c0 01 00 00 48 89 df e8 ae f8 ff ff e8 19 ba 36 00 fb 65 48 8b 1d 30 cf a8 7e <48> 8d bb f8 15 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 RSP: 0018:ffffc900034b7410 EFLAGS: 00000202 RAX: 00000000000003fb RBX: ffff8880243d2440 RCX: 1ffffffff28c7e6d RDX: 0000000000000000 RSI: ffffffff8b4cc580 RDI: ffffffff8bb08480 RBP: ffffc900034b7458 R08: 0000000000000001 R09: fffffbfff28c50df R10: ffffffff946286ff R11: 0000000000000000 R12: ffff88806b13fb58 R13: ffff88801e428000 R14: 0000000000000000 R15: ffff88806b03edc0 context_switch kernel/sched/core.c:5191 [inline] __schedule+0xe3f/0x5490 kernel/sched/core.c:6529 preempt_schedule_common+0x44/0xc0 kernel/sched/core.c:6708 preempt_schedule_thunk+0x1a/0x30 arch/x86/entry/thunk.S:12 __raw_spin_unlock include/linux/spinlock_api_smp.h:143 [inline] _raw_spin_unlock+0x3e/0x50 kernel/locking/spinlock.c:186 spin_unlock include/linux/spinlock.h:391 [inline] zap_pte_range mm/memory.c:1688 [inline] zap_pmd_range mm/memory.c:1736 [inline] zap_pud_range mm/memory.c:1765 [inline] zap_p4d_range mm/memory.c:1786 [inline] unmap_page_range+0xbb8/0x3c10 mm/memory.c:1807 unmap_single_vma+0x194/0x2b0 mm/memory.c:1853 unmap_vmas+0x22f/0x490 mm/memory.c:1897 exit_mmap+0x1b8/0xb20 mm/mmap.c:3412 __mmput+0x12a/0x480 kernel/fork.c:1345 mmput+0x62/0x70 kernel/fork.c:1367 exit_mm kernel/exit.c:571 [inline] do_exit+0x9bf/0x2bb0 kernel/exit.c:869 do_group_exit+0xd3/0x2a0 kernel/exit.c:1031 get_signal+0x25fd/0x2770 kernel/signal.c:2917 arch_do_signal_or_restart+0x90/0x7e0 arch/x86/kernel/signal.c:310 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218 do_syscall_64+0xda/0x250 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7ff1185773b9 Code: Unable to access opcode bytes at 0x7ff11857738f. RSP: 002b:00007ff11931a0f8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: fffffffffffffe00 RBX: 00007ff118705f88 RCX: 00007ff1185773b9 RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007ff118705f88 RBP: 00007ff118705f80 R08: 00007ff11931a6c0 R09: 00007ff11931a6c0 R10: 0000000000000000 R11: 0000000000000246 R12: 00007ff118705f8c R13: 000000000000000b R14: 00007ffe053da0f0 R15: 00007ffe053da1d8 The buggy address belongs to stack of task syz.2.355/6759 and is located at offset 24 in frame: exit_mmap+0x0/0xb20 mm/mmap.c:3232 This frame has 2 objects: [32, 96) 'vmi' [128, 256) 'tlb' The buggy address belongs to the virtual mapping at [ffffc900034b0000, ffffc900034b9000) created by: kernel_clone+0xfd/0x980 kernel/fork.c:2781 The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88802acb1f00 pfn:0x2acb1 memcg:ffff88802c8a5482 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000 raw: ffff88802acb1f00 0000000000000000 00000001ffffffff ffff88802c8a5482 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x102dc2(GFP_HIGHUSER|__GFP_NOWARN|__GFP_ZERO), pid 6721, tgid 6721 (syz.2.344), ts 146192736783, free_ts 143248474505 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1493 prep_new_page mm/page_alloc.c:1501 [inline] get_page_from_freelist+0x1351/0x2e50 mm/page_alloc.c:3442 __alloc_pages_noprof+0x22b/0x2460 mm/page_alloc.c:4700 alloc_pages_mpol_noprof+0x275/0x610 mm/mempolicy.c:2263 vm_area_alloc_pages mm/vmalloc.c:3584 [inline] __vmalloc_area_node mm/vmalloc.c:3660 [inline] __vmalloc_node_range_noprof+0xa6a/0x1520 mm/vmalloc.c:3841 alloc_thread_stack_node kernel/fork.c:313 [inline] dup_task_struct kernel/fork.c:1113 [inline] copy_process+0x2f3b/0x8de0 kernel/fork.c:2204 kernel_clone+0xfd/0x980 kernel/fork.c:2781 __do_sys_clone3+0x1f5/0x270 kernel/fork.c:3085 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 6674 tgid 6673 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1094 [inline] free_unref_page+0x64a/0xe40 mm/page_alloc.c:2612 kasan_depopulate_vmalloc_pte+0x63/0x80 mm/kasan/shadow.c:408 apply_to_pte_range mm/memory.c:2797 [inline] apply_to_pmd_range mm/memory.c:2841 [inline] apply_to_pud_range mm/memory.c:2877 [inline] apply_to_p4d_range mm/memory.c:2913 [inline] __apply_to_page_range+0x795/0xdd0 mm/memory.c:2947 kasan_release_vmalloc+0xac/0xc0 mm/kasan/shadow.c:525 purge_vmap_node+0x3fc/0x920 mm/vmalloc.c:2208 __purge_vmap_area_lazy+0x9ca/0xc10 mm/vmalloc.c:2290 _vm_unmap_aliases+0x286/0x880 mm/vmalloc.c:2885 change_page_attr_set_clr+0x24c/0x490 arch/x86/mm/pat/set_memory.c:1881 change_page_attr_clear arch/x86/mm/pat/set_memory.c:1929 [inline] set_memory_ro+0x7c/0xb0 arch/x86/mm/pat/set_memory.c:2115 bpf_prog_lock_ro include/linux/filter.h:1036 [inline] bpf_prog_select_runtime+0x59d/0x6f0 kernel/bpf/core.c:2421 bpf_prog_load+0xf0f/0x2660 kernel/bpf/syscall.c:2912 __sys_bpf+0x8e9/0x4a20 kernel/bpf/syscall.c:5710 __do_sys_bpf kernel/bpf/syscall.c:5817 [inline] __se_sys_bpf kernel/bpf/syscall.c:5815 [inline] __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5815 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffffc900034b7900: 00 f2 f2 f2 00 f2 f2 f2 00 00 f2 f2 00 00 00 00 ffffc900034b7980: 00 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 >ffffc900034b7a00: 00 00 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00 ^ ffffc900034b7a80: 00 00 00 f2 f2 f2 f2 00 00 00 00 00 00 00 00 00 ffffc900034b7b00: 00 00 00 00 00 00 00 f3 f3 f3 f3 00 00 00 00 00 ================================================================== ---------------- Code disassembly (best guess): 0: a9 0a 00 00 44 test $0x4400000a,%eax 5: 8b 0d 07 d6 b7 0e mov 0xeb7d607(%rip),%ecx # 0xeb7d612 b: 45 85 c9 test %r9d,%r9d e: 0f 85 c0 01 00 00 jne 0x1d4 14: 48 89 df mov %rbx,%rdi 17: e8 ae f8 ff ff call 0xfffff8ca 1c: e8 19 ba 36 00 call 0x36ba3a 21: fb sti 22: 65 48 8b 1d 30 cf a8 mov %gs:0x7ea8cf30(%rip),%rbx # 0x7ea8cf5a 29: 7e * 2a: 48 8d bb f8 15 00 00 lea 0x15f8(%rbx),%rdi <-- trapping instruction 31: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 38: fc ff df 3b: 48 89 fa mov %rdi,%rdx 3e: 48 rex.W 3f: c1 .byte 0xc1