==================================================================
BUG: KASAN: use-after-free in __hlist_del include/linux/list.h:791 [inline]
BUG: KASAN: use-after-free in detach_timer kernel/time/timer.c:824 [inline]
BUG: KASAN: use-after-free in expire_timers kernel/time/timer.c:1482 [inline]
BUG: KASAN: use-after-free in __run_timers+0x7be/0xbe0 kernel/time/timer.c:1817
Write of size 8 at addr ffff8881d2fbb1c8 by task syz.0.531/2206
CPU: 1 PID: 2206 Comm: syz.0.531 Not tainted 5.4.290-syzkaller-00017-g6b07fcd94a6a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1d8/0x241 lib/dump_stack.c:118
print_address_description+0x8c/0x600 mm/kasan/report.c:384
__kasan_report+0xf3/0x120 mm/kasan/report.c:516
kasan_report+0x30/0x60 mm/kasan/common.c:653
__hlist_del include/linux/list.h:791 [inline]
detach_timer kernel/time/timer.c:824 [inline]
expire_timers kernel/time/timer.c:1482 [inline]
__run_timers+0x7be/0xbe0 kernel/time/timer.c:1817
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1830
__do_softirq+0x23b/0x6b7 kernel/softirq.c:292
invoke_softirq kernel/softirq.c:373 [inline]
irq_exit+0x195/0x1c0 kernel/softirq.c:413
exiting_irq arch/x86/include/asm/apic.h:539 [inline]
smp_apic_timer_interrupt+0x11a/0x490 arch/x86/kernel/apic/apic.c:1161
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:834
RIP: 0010:blkcg_maybe_throttle_current+0x1/0xa90 block/blk-cgroup.c:1781
Code: 5f 5d c3 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c f8 fe ff ff 48 89 df e8 4e e4 6b ff e9 eb fe ff ff 66 0f 1f 84 00 00 00 00 00 55 <48> 89 e5 41 57 41 56 41 55 41 54 53 48 83 e4 e0 48 81 ec 00 01 00
RSP: 0018:ffff8881e33e7ee0 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: 121033b97aeb6500 RBX: ffff8881e42aa720 RCX: 0000000000080000
RDX: dffffc0000000000 RSI: 000000000007ffff RDI: ffff8881e33e7e60
RBP: 0000000010000006 R08: dffffc0000000000 R09: ffffed103c8553f1
R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000
R13: 1ffff1103c8553f0 R14: ffff8881e33e7f58 R15: 0000000010000006
tracehook_notify_resume include/linux/tracehook.h:198 [inline]
exit_to_usermode_loop+0x127/0x1a0 arch/x86/entry/common.c:163
prepare_exit_to_usermode+0x199/0x200 arch/x86/entry/common.c:194
entry_SYSCALL_64_after_hwframe+0x5c/0xc1
RIP: 0033:0x7f689d2a9980
Code: 44 24 20 0f 29 44 24 30 0f 29 44 24 40 48 8b 44 24 08 ff d0 48 83 c4 50 31 c0 5b 5d 41 5c 41 5d 41 5e c3 0f 1f 80 00 00 00 00 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 c3 66 66 2e 0f 1f
RSP: 002b:00007f689ba53b38 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 00007f689d602fa8 RCX: 00007f689d3ea169
RDX: 00007f689ba53b40 RSI: 00007f689ba53c70 RDI: 0000000000000011
RBP: 00007f689d602fa0 R08: 00007ffc19b510b0 R09: 0000000000000000
R10: 000000000000000a R11: 0000000000000246 R12: 00007f689d602fac
R13: 0000000000000000 R14: 00007ffc19aea390 R15: 00007ffc19aea478
Allocated by task 163:
save_stack mm/kasan/common.c:70 [inline]
set_track mm/kasan/common.c:78 [inline]
__kasan_kmalloc+0x171/0x210 mm/kasan/common.c:529
slab_post_alloc_hook mm/slab.h:584 [inline]
slab_alloc_node mm/slub.c:2829 [inline]
slab_alloc mm/slub.c:2837 [inline]
kmem_cache_alloc+0xd9/0x250 mm/slub.c:2842
__sigqueue_alloc+0x19b/0x2e0 kernel/signal.c:435
__send_signal+0x1ee/0xbe0 kernel/signal.c:1116
do_send_sig_info+0xe0/0x130 kernel/signal.c:1291
____bpf_send_signal kernel/trace/bpf_trace.c:677 [inline]
bpf_send_signal+0x2a8/0x3b0 kernel/trace/bpf_trace.c:637
0xffffffffa00c8fdb
bpf_call_func include/linux/filter.h:627 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:1341 [inline]
bpf_trace_run2+0x101/0x2d0 kernel/trace/bpf_trace.c:1379
trace_sys_exit include/trace/events/syscalls.h:44 [inline]
syscall_slow_exit_work+0x370/0x400 arch/x86/entry/common.c:234
syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
do_syscall_64+0x19d/0x1c0 arch/x86/entry/common.c:300
entry_SYSCALL_64_after_hwframe+0x5c/0xc1
Freed by task 163:
save_stack mm/kasan/common.c:70 [inline]
set_track mm/kasan/common.c:78 [inline]
kasan_set_free_info mm/kasan/common.c:345 [inline]
__kasan_slab_free+0x1b5/0x270 mm/kasan/common.c:487
slab_free_hook mm/slub.c:1455 [inline]
slab_free_freelist_hook mm/slub.c:1494 [inline]
slab_free mm/slub.c:3080 [inline]
kmem_cache_free+0x10b/0x2c0 mm/slub.c:3096
__sigqueue_free kernel/signal.c:458 [inline]
collect_signal kernel/signal.c:597 [inline]
__dequeue_signal+0x54f/0x630 kernel/signal.c:619
dequeue_signal+0x10c/0x520 kernel/signal.c:639
signalfd_dequeue fs/signalfd.c:163 [inline]
signalfd_read+0x3a9/0x1330 fs/signalfd.c:217
__vfs_read+0x103/0x730 fs/read_write.c:425
vfs_read+0x148/0x360 fs/read_write.c:461
ksys_read+0x199/0x2c0 fs/read_write.c:587
do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x5c/0xc1
The buggy address belongs to the object at ffff8881d2fbb1c0
which belongs to the cache sigqueue of size 80
The buggy address is located 8 bytes inside of
80-byte region [ffff8881d2fbb1c0, ffff8881d2fbb210)
The buggy address belongs to the page:
page:ffffea00074beec0 refcount:1 mapcount:0 mapping:ffff8881f5cfe000 index:0x0
flags: 0x8000000000000200(slab)
raw: 8000000000000200 dead000000000100 dead000000000122 ffff8881f5cfe000
raw: 0000000000000000 0000000000240024 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_HARDWALL)
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook mm/page_alloc.c:2165 [inline]
prep_new_page+0x18f/0x370 mm/page_alloc.c:2171
get_page_from_freelist+0x2d13/0x2d90 mm/page_alloc.c:3794
__alloc_pages_nodemask+0x393/0x840 mm/page_alloc.c:4893
alloc_slab_page+0x39/0x3c0 mm/slub.c:343
allocate_slab mm/slub.c:1683 [inline]
new_slab+0x97/0x440 mm/slub.c:1749
new_slab_objects mm/slub.c:2505 [inline]
___slab_alloc+0x2fe/0x490 mm/slub.c:2667
__slab_alloc+0x62/0xa0 mm/slub.c:2707
slab_alloc_node mm/slub.c:2792 [inline]
slab_alloc mm/slub.c:2837 [inline]
kmem_cache_alloc+0x109/0x250 mm/slub.c:2842
__sigqueue_alloc+0x19b/0x2e0 kernel/signal.c:435
__send_signal+0x1ee/0xbe0 kernel/signal.c:1116
do_send_sig_info+0xe0/0x130 kernel/signal.c:1291
____bpf_send_signal kernel/trace/bpf_trace.c:677 [inline]
bpf_send_signal+0x2a8/0x3b0 kernel/trace/bpf_trace.c:637
0xffffffffa00c8fdb
bpf_call_func include/linux/filter.h:627 [inline]
__bpf_trace_run kernel/trace/bpf_trace.c:1341 [inline]
bpf_trace_run2+0x101/0x2d0 kernel/trace/bpf_trace.c:1379
trace_sys_exit include/trace/events/syscalls.h:44 [inline]
syscall_slow_exit_work+0x370/0x400 arch/x86/entry/common.c:234
syscall_return_slowpath arch/x86/entry/common.c:271 [inline]
do_syscall_64+0x19d/0x1c0 arch/x86/entry/common.c:300
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1176 [inline]
free_pcp_prepare mm/page_alloc.c:1233 [inline]
free_unref_page_prepare+0x297/0x380 mm/page_alloc.c:3085
free_unref_page mm/page_alloc.c:3134 [inline]
free_the_page mm/page_alloc.c:4953 [inline]
__free_pages+0xaf/0x140 mm/page_alloc.c:4961
__vunmap+0x75b/0x890 mm/vmalloc.c:2260
htab_free_elems kernel/bpf/hashtab.c:116 [inline]
prealloc_destroy kernel/bpf/hashtab.c:194 [inline]
htab_map_free+0x515/0x670 kernel/bpf/hashtab.c:1238
bpf_map_free_deferred+0xa8/0x100 kernel/bpf/syscall.c:311
process_one_work+0x765/0xd20 kernel/workqueue.c:2290
worker_thread+0xaef/0x1470 kernel/workqueue.c:2436
kthread+0x2da/0x360 kernel/kthread.c:288
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:354
Memory state around the buggy address:
ffff8881d2fbb080: fb fb fb fb fb fb fb fb fc fc fc fc fb fb fb fb
ffff8881d2fbb100: fb fb fb fb fb fb fc fc fc fc fb fb fb fb fb fb
>ffff8881d2fbb180: fb fb fb fb fc fc fc fc fb fb fb fb fb fb fb fb
^
ffff8881d2fbb200: fb fb fc fc fc fc fb fb fb fb fb fb fb fb fb fb
ffff8881d2fbb280: fc fc fc fc fb fb fb fb fb fb fb fb fb fb fc fc
==================================================================
BUG: kernel NULL pointer dereference, address: 000000000000001c
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 1e8244067 P4D 1e8244067 PUD 0
Oops: 0010 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 2206 Comm: syz.0.531 Tainted: G B 5.4.290-syzkaller-00017-g6b07fcd94a6a #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
RIP: 0010:0x1c
Code: Bad RIP value.
RSP: 0018:ffff8881f6f09d18 EFLAGS: 00010206
RAX: ffffffff8154e8ca RBX: 0000000000000100 RCX: ffff8881e42a9f80
RDX: 0000000000000100 RSI: 000000000000001c RDI: ffff8881d2fbb1c0
RBP: ffff8881f6f09ec8 R08: ffffffff8154e50e R09: 0000000000000003
R10: ffffffffffffffff R11: dffffc0000000001 R12: 00000000ffffa118
R13: dffffc0000000000 R14: 000000000000001c R15: ffff8881d2fbb1c0
FS: 00007f689ba546c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffff2 CR3: 00000001e52c6000 CR4: 00000000003406a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1830
__do_softirq+0x23b/0x6b7 kernel/softirq.c:292
invoke_softirq kernel/softirq.c:373 [inline]
irq_exit+0x195/0x1c0 kernel/softirq.c:413
exiting_irq arch/x86/include/asm/apic.h:539 [inline]
smp_apic_timer_interrupt+0x11a/0x490 arch/x86/kernel/apic/apic.c:1161
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:834
RIP: 0010:blkcg_maybe_throttle_current+0x1/0xa90 block/blk-cgroup.c:1781
Code: 5f 5d c3 89 d9 80 e1 07 80 c1 03 38 c1 0f 8c f8 fe ff ff 48 89 df e8 4e e4 6b ff e9 eb fe ff ff 66 0f 1f 84 00 00 00 00 00 55 <48> 89 e5 41 57 41 56 41 55 41 54 53 48 83 e4 e0 48 81 ec 00 01 00
RSP: 0018:ffff8881e33e7ee0 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: 121033b97aeb6500 RBX: ffff8881e42aa720 RCX: 0000000000080000
RDX: dffffc0000000000 RSI: 000000000007ffff RDI: ffff8881e33e7e60
RBP: 0000000010000006 R08: dffffc0000000000 R09: ffffed103c8553f1
R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000
R13: 1ffff1103c8553f0 R14: ffff8881e33e7f58 R15: 0000000010000006
tracehook_notify_resume include/linux/tracehook.h:198 [inline]
exit_to_usermode_loop+0x127/0x1a0 arch/x86/entry/common.c:163
prepare_exit_to_usermode+0x199/0x200 arch/x86/entry/common.c:194
entry_SYSCALL_64_after_hwframe+0x5c/0xc1
RIP: 0033:0x7f689d2a9980
Code: 44 24 20 0f 29 44 24 30 0f 29 44 24 40 48 8b 44 24 08 ff d0 48 83 c4 50 31 c0 5b 5d 41 5c 41 5d 41 5e c3 0f 1f 80 00 00 00 00 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 c3 66 66 2e 0f 1f
RSP: 002b:00007f689ba53b38 EFLAGS: 00000246
RAX: 0000000000000000 RBX: 00007f689d602fa8 RCX: 00007f689d3ea169
RDX: 00007f689ba53b40 RSI: 00007f689ba53c70 RDI: 0000000000000011
RBP: 00007f689d602fa0 R08: 00007ffc19b510b0 R09: 0000000000000000
R10: 000000000000000a R11: 0000000000000246 R12: 00007f689d602fac
R13: 0000000000000000 R14: 00007ffc19aea390 R15: 00007ffc19aea478
Modules linked in:
CR2: 000000000000001c
---[ end trace 360b9f16ab08e908 ]---
RIP: 0010:0x1c
Code: Bad RIP value.
RSP: 0018:ffff8881f6f09d18 EFLAGS: 00010206
RAX: ffffffff8154e8ca RBX: 0000000000000100 RCX: ffff8881e42a9f80
RDX: 0000000000000100 RSI: 000000000000001c RDI: ffff8881d2fbb1c0
RBP: ffff8881f6f09ec8 R08: ffffffff8154e50e R09: 0000000000000003
R10: ffffffffffffffff R11: dffffc0000000001 R12: 00000000ffffa118
R13: dffffc0000000000 R14: 000000000000001c R15: ffff8881d2fbb1c0
FS: 00007f689ba546c0(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: fffffffffffffff2 CR3: 00000001e52c6000 CR4: 00000000003406a0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
----------------
Code disassembly (best guess):
0: 5f pop %rdi
1: 5d pop %rbp
2: c3 ret
3: 89 d9 mov %ebx,%ecx
5: 80 e1 07 and $0x7,%cl
8: 80 c1 03 add $0x3,%cl
b: 38 c1 cmp %al,%cl
d: 0f 8c f8 fe ff ff jl 0xffffff0b
13: 48 89 df mov %rbx,%rdi
16: e8 4e e4 6b ff call 0xff6be469
1b: e9 eb fe ff ff jmp 0xffffff0b
20: 66 0f 1f 84 00 00 00 nopw 0x0(%rax,%rax,1)
27: 00 00
29: 55 push %rbp
* 2a: 48 89 e5 mov %rsp,%rbp <-- trapping instruction
2d: 41 57 push %r15
2f: 41 56 push %r14
31: 41 55 push %r13
33: 41 54 push %r12
35: 53 push %rbx
36: 48 83 e4 e0 and $0xffffffffffffffe0,%rsp
3a: 48 rex.W
3b: 81 .byte 0x81
3c: ec in (%dx),%al
3d: 00 01 add %al,(%rcx)