================================================================== BUG: KASAN: slab-use-after-free in __bpf_trace_run kernel/trace/bpf_trace.c:2382 [inline] BUG: KASAN: slab-use-after-free in bpf_trace_run1+0xcb/0x510 kernel/trace/bpf_trace.c:2436 Read of size 8 at addr ffff88802b50ee18 by task udevd/5307 CPU: 0 PID: 5307 Comm: udevd Not tainted 6.8.0-syzkaller-05243-g14bb1e8c8d4a #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 __bpf_trace_run kernel/trace/bpf_trace.c:2382 [inline] bpf_trace_run1+0xcb/0x510 kernel/trace/bpf_trace.c:2436 __traceiter_mm_lru_insertion+0x71/0xc0 include/trace/events/pagemap.h:28 trace_mm_lru_insertion include/trace/events/pagemap.h:28 [inline] lru_add_fn+0xee0/0x19f0 mm/swap.c:200 folio_batch_move_lru+0x322/0x6e0 mm/swap.c:217 lru_add_drain_cpu+0x10e/0x8c0 mm/swap.c:652 lru_add_drain+0x123/0x3e0 mm/swap.c:752 __folio_batch_release+0x55/0x100 mm/swap.c:1059 folio_batch_release include/linux/pagevec.h:83 [inline] shmem_undo_range+0x6b5/0x1da0 mm/shmem.c:1005 shmem_truncate_range mm/shmem.c:1114 [inline] shmem_evict_inode+0x29b/0xa60 mm/shmem.c:1242 evict+0x2a8/0x630 fs/inode.c:667 __dentry_kill+0x20d/0x630 fs/dcache.c:603 dput+0x19f/0x2b0 fs/dcache.c:845 do_renameat2+0xda1/0x13f0 fs/namei.c:5040 __do_sys_rename fs/namei.c:5085 [inline] __se_sys_rename fs/namei.c:5083 [inline] __x64_sys_rename+0x86/0xa0 fs/namei.c:5083 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 RIP: 0033:0x7fec93c9a93b Code: 48 8b 15 f0 64 15 00 83 c8 ff 64 83 3a 15 75 0e 48 8b 7c 24 08 e8 d5 d4 07 00 f7 d8 19 c0 48 83 c4 18 c3 b8 52 00 00 00 0f 05 <48> 3d 00 f0 ff ff 76 10 48 8b 15 be 64 15 00 f7 d8 64 89 02 48 83 RSP: 002b:00007ffec43c0718 EFLAGS: 00000202 ORIG_RAX: 0000000000000052 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fec93c9a93b RDX: 00005626469afe23 RSI: 00007ffec43c0738 RDI: 00007ffec43c0b38 RBP: 0000562324a88d00 R08: 0000000000000006 R09: 56d302d7d1d8cdc8 R10: 00000000000001b6 R11: 0000000000000202 R12: 0000562324a93f20 R13: 00007ffec43c0738 R14: 00007ffec43c0b38 R15: 00005622f549b160 Allocated by task 6259: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:370 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387 kasan_kmalloc include/linux/kasan.h:211 [inline] kmalloc_trace+0x1d9/0x360 mm/slub.c:4012 kmalloc include/linux/slab.h:590 [inline] kzalloc include/linux/slab.h:711 [inline] bpf_raw_tp_link_attach+0x2a0/0x6e0 kernel/bpf/syscall.c:3816 bpf_raw_tracepoint_open+0x1c2/0x240 kernel/bpf/syscall.c:3863 __sys_bpf+0x3c0/0x810 kernel/bpf/syscall.c:5673 __do_sys_bpf kernel/bpf/syscall.c:5738 [inline] __se_sys_bpf kernel/bpf/syscall.c:5736 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5736 do_syscall_64+0xfb/0x240 entry_SYSCALL_64_after_hwframe+0x6d/0x75 Freed by task 6261: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:589 poison_slab_object+0xa6/0xe0 mm/kasan/common.c:240 __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2121 [inline] slab_free mm/slub.c:4299 [inline] kfree+0x14a/0x380 mm/slub.c:4409 bpf_link_release+0x3b/0x50 kernel/bpf/syscall.c:3071 __fput+0x429/0x8a0 fs/file_table.c:423 task_work_run+0x24f/0x310 kernel/task_work.c:180 exit_task_work include/linux/task_work.h:38 [inline] do_exit+0xa1b/0x27e0 kernel/exit.c:878 do_group_exit+0x207/0x2c0 kernel/exit.c:1027 get_signal+0x176e/0x1850 kernel/signal.c:2907 arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:310 exit_to_user_mode_loop kernel/entry/common.c:105 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:201 [inline] syscall_exit_to_user_mode+0xc9/0x360 kernel/entry/common.c:212 do_syscall_64+0x10a/0x240 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x6d/0x75 The buggy address belongs to the object at ffff88802b50ee00 which belongs to the cache kmalloc-128 of size 128 The buggy address is located 24 bytes inside of freed 128-byte region [ffff88802b50ee00, ffff88802b50ee80) The buggy address belongs to the physical page: page:ffffea0000ad4380 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2b50e flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 00fff00000000800 ffff888014c418c0 ffffea0001f2e680 dead000000000002 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 5683, tgid 5682 (syz-executor.3), ts 89024287085, free_ts 86663541507 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1533 prep_new_page mm/page_alloc.c:1540 [inline] get_page_from_freelist+0x33ea/0x3580 mm/page_alloc.c:3311 __alloc_pages+0x256/0x680 mm/page_alloc.c:4569 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] alloc_slab_page+0x5f/0x160 mm/slub.c:2190 allocate_slab mm/slub.c:2354 [inline] new_slab+0x84/0x2f0 mm/slub.c:2407 ___slab_alloc+0xd1b/0x13e0 mm/slub.c:3540 __slab_alloc mm/slub.c:3625 [inline] __slab_alloc_node mm/slub.c:3678 [inline] slab_alloc_node mm/slub.c:3850 [inline] __do_kmalloc_node mm/slub.c:3980 [inline] __kmalloc_node_track_caller+0x2d4/0x4e0 mm/slub.c:4001 __do_krealloc mm/slab_common.c:1187 [inline] krealloc+0x7d/0x120 mm/slab_common.c:1220 copy_array kernel/bpf/verifier.c:1220 [inline] copy_stack_state kernel/bpf/verifier.c:1274 [inline] copy_func_state kernel/bpf/verifier.c:1407 [inline] copy_verifier_state+0x95a/0xf30 kernel/bpf/verifier.c:1451 push_stack+0x1a7/0x4e0 kernel/bpf/verifier.c:1714 check_cond_jmp_op+0x1fea/0x3d80 kernel/bpf/verifier.c:15055 do_check+0x9b75/0x10500 kernel/bpf/verifier.c:17888 do_check_common+0x14bd/0x1dd0 kernel/bpf/verifier.c:20501 do_check_main kernel/bpf/verifier.c:20592 [inline] bpf_check+0x136ab/0x190c0 kernel/bpf/verifier.c:21262 bpf_prog_load+0x1667/0x20f0 kernel/bpf/syscall.c:2895 __sys_bpf+0x4ee/0x810 kernel/bpf/syscall.c:5631 page last free pid 5125 tgid 5125 stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1140 [inline] free_unref_page_prepare+0x968/0xa90 mm/page_alloc.c:2346 free_unref_page+0x37/0x3f0 mm/page_alloc.c:2486 kasan_depopulate_vmalloc_pte+0x74/0x90 mm/kasan/shadow.c:415 apply_to_pte_range mm/memory.c:2619 [inline] apply_to_pmd_range mm/memory.c:2663 [inline] apply_to_pud_range mm/memory.c:2699 [inline] apply_to_p4d_range mm/memory.c:2735 [inline] __apply_to_page_range+0x8ec/0xe40 mm/memory.c:2769 kasan_release_vmalloc+0x9a/0xb0 mm/kasan/shadow.c:532 __purge_vmap_area_lazy+0x163f/0x1a10 mm/vmalloc.c:1842 drain_vmap_area_work+0x40/0xd0 mm/vmalloc.c:1876 process_one_work kernel/workqueue.c:3254 [inline] process_scheduled_works+0xa00/0x1770 kernel/workqueue.c:3335 worker_thread+0x86d/0xd70 kernel/workqueue.c:3416 kthread+0x2f0/0x390 kernel/kthread.c:388 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243 Memory state around the buggy address: ffff88802b50ed00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff88802b50ed80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88802b50ee00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88802b50ee80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88802b50ef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================