WARNING: can't dereference registers at 1ffff11015d40f66 for ip apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:793 ================================================================== BUG: KASAN: stack-out-of-bounds in deref_stack_regs arch/x86/kernel/unwind_orc.c:311 [inline] BUG: KASAN: stack-out-of-bounds in unwind_next_frame+0x146f/0x17d0 arch/x86/kernel/unwind_orc.c:441 Read of size 8 at addr ffff8880aea07bd0 by task syz-executor.4/12798 CPU: 0 PID: 12798 Comm: syz-executor.4 Not tainted 4.14.189-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x283 lib/dump_stack.c:58 print_address_description.cold+0x54/0x1d3 mm/kasan/report.c:252 kasan_report_error.cold+0x8a/0x194 mm/kasan/report.c:351 kasan_report mm/kasan/report.c:409 [inline] __asan_report_load8_noabort+0x68/0x70 mm/kasan/report.c:430 deref_stack_regs arch/x86/kernel/unwind_orc.c:311 [inline] unwind_next_frame+0x146f/0x17d0 arch/x86/kernel/unwind_orc.c:441 perf_callchain_kernel+0x38c/0x520 arch/x86/events/core.c:2343 get_perf_callchain+0x2df/0x740 kernel/events/callchain.c:217 perf_callchain+0x147/0x190 kernel/events/callchain.c:190 perf_prepare_sample+0xd77/0x1380 kernel/events/core.c:6162 __perf_event_output kernel/events/core.c:6278 [inline] perf_event_output_forward+0xc9/0x1f0 kernel/events/core.c:6296 __perf_event_overflow+0x113/0x310 kernel/events/core.c:7541 perf_swevent_overflow kernel/events/core.c:7617 [inline] perf_swevent_event+0x299/0x460 kernel/events/core.c:7645 perf_tp_event+0x540/0x6e0 kernel/events/core.c:8079 perf_trace_run_bpf_submit+0x119/0x200 kernel/events/core.c:8049 perf_trace_lock+0x2d6/0x490 include/trace/events/lock.h:39 trace_lock_release include/trace/events/lock.h:58 [inline] lock_release+0x4df/0x870 kernel/locking/lockdep.c:4016 __raw_spin_unlock include/linux/spinlock_api_smp.h:150 [inline] _raw_spin_unlock+0x17/0x40 kernel/locking/spinlock.c:184 spin_unlock include/linux/spinlock.h:357 [inline] ____cache_alloc_node+0x156/0x1d0 mm/slab.c:3277 slab_alloc_node mm/slab.c:3325 [inline] kmem_cache_alloc_node_trace+0xed/0x400 mm/slab.c:3659 __do_kmalloc_node mm/slab.c:3681 [inline] __kmalloc_node_track_caller+0x38/0x70 mm/slab.c:3696 __kmalloc_reserve net/core/skbuff.c:137 [inline] __alloc_skb+0x96/0x510 net/core/skbuff.c:205 alloc_skb include/linux/skbuff.h:980 [inline] __pfkey_xfrm_state2msg+0x37e/0x3560 net/key/af_key.c:833 pfkey_xfrm_state2msg_expire net/key/af_key.c:1066 [inline] key_notify_sa_expire net/key/af_key.c:3038 [inline] pfkey_send_notify+0x9ce/0xea0 net/key/af_key.c:3066 km_state_notify+0xa9/0x1a0 net/xfrm/xfrm_state.c:1920 km_state_expired net/xfrm/xfrm_state.c:1934 [inline] xfrm_timer_handler+0x6a1/0x9f0 net/xfrm/xfrm_state.c:553 __tasklet_hrtimer_trampoline+0x29/0xa0 kernel/softirq.c:618 tasklet_hi_action+0x195/0x330 kernel/softirq.c:549 __do_softirq+0x254/0xa1d kernel/softirq.c:288 invoke_softirq kernel/softirq.c:368 [inline] irq_exit+0x193/0x240 kernel/softirq.c:409 exiting_irq arch/x86/include/asm/apic.h:648 [inline] smp_apic_timer_interrupt+0x141/0x5e0 arch/x86/kernel/apic/apic.c:1102 apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:793 RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:779 [inline] RIP: 0010:lock_release+0x41e/0x870 kernel/locking/lockdep.c:4020 RSP: 0018:ffff888205dd78c8 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff10 RAX: 1ffffffff0fa2d21 RBX: 1ffff11040bbaf1c RCX: 1ffff11041340d39 RDX: dffffc0000000000 RSI: 0000000000000001 RDI: 0000000000000282 RBP: ffff888209a06140 R08: 0000000000000000 R09: 0000000000000000 R10: ffff888205dd7788 R11: 0000000000000001 R12: 0000000000000000 R13: 0000000000000003 R14: ffff888209a06140 R15: 0000000000000001 rcu_lock_release include/linux/rcupdate.h:247 [inline] rcu_read_unlock include/linux/rcupdate.h:685 [inline] is_bpf_text_address+0xb8/0x150 kernel/bpf/core.c:458 kernel_text_address kernel/extable.c:150 [inline] kernel_text_address+0xbd/0xf0 kernel/extable.c:120 __kernel_text_address+0x9/0x30 kernel/extable.c:105 unwind_get_return_address arch/x86/kernel/unwind_orc.c:252 [inline] unwind_get_return_address+0x51/0x90 arch/x86/kernel/unwind_orc.c:247 __save_stack_trace+0xa0/0x160 arch/x86/kernel/stacktrace.c:45 save_stack mm/kasan/kasan.c:447 [inline] set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:551 slab_post_alloc_hook mm/slab.h:442 [inline] slab_alloc mm/slab.c:3390 [inline] kmem_cache_alloc_trace+0x11b/0x3d0 mm/slab.c:3616 kmalloc include/linux/slab.h:488 [inline] kzalloc include/linux/slab.h:661 [inline] selinux_sk_alloc_security+0x59/0x190 security/selinux/hooks.c:4910 security_sk_alloc+0x76/0xb0 security/security.c:1434 sk_prot_alloc+0xe1/0x290 net/core/sock.c:1470 sk_alloc+0x36/0xcd0 net/core/sock.c:1521 unix_create1+0x78/0x4f0 net/unix/af_unix.c:779 unix_create+0xdd/0x1c0 net/unix/af_unix.c:841 __sock_create+0x303/0x620 net/socket.c:1275 sock_create net/socket.c:1315 [inline] SYSC_socketpair net/socket.c:1391 [inline] SyS_socketpair+0x159/0x480 net/socket.c:1366 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x45c1f9 RSP: 002b:00007f46ae2d3c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000035 RAX: ffffffffffffffda RBX: 0000000000032080 RCX: 000000000045c1f9 RDX: 0000000000000000 RSI: 0000000000000005 RDI: 0000000000000001 RBP: 000000000078bf48 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000020000240 R11: 0000000000000246 R12: 000000000078bf0c R13: 00007ffd07020d2f R14: 00007f46ae2d49c0 R15: 000000000078bf0c The buggy address belongs to the page: page:ffffea0002ba81c0 count:1 mapcount:0 mapping: (null) index:0x0 flags: 0xfffe0000000800(reserved) raw: 00fffe0000000800 0000000000000000 0000000000000000 00000001ffffffff raw: ffffea0002ba81e0 ffffea0002ba81e0 0000000000000000 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880aea07a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 ffff8880aea07b00: f1 f1 f1 f1 04 f2 00 f3 f3 f3 00 00 00 00 00 00 >ffff8880aea07b80: 00 00 00 00 f1 f1 f1 f1 04 f3 f3 f3 00 00 00 00 ^ ffff8880aea07c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880aea07c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================