bisecting fixing commit since 32ee7492f104d82b01a44fc4b4ae17d5d2bb237b building syzkaller on 2274ad39c8bee8efda31dc31ec8933d5624e8fe4 testing commit 32ee7492f104d82b01a44fc4b4ae17d5d2bb237b with gcc (GCC) 8.1.0 kernel signature: a656bfa9a6dbbda3bd7414f0e9c753bbf02f1bc317eff49f9c803d3c34f7d4e9 run #0: crashed: BUG: unable to handle kernel paging request in bpf_prog_kallsyms_find run #1: crashed: BUG: unable to handle kernel paging request in bpf_prog_kallsyms_find run #2: crashed: KASAN: use-after-free Read in bpf_prog_kallsyms_find run #3: crashed: BUG: unable to handle kernel paging request in bpf_prog_kallsyms_find run #4: crashed: BUG: unable to handle kernel paging request in bpf_prog_kallsyms_find run #5: crashed: KASAN: use-after-free Read in bpf_prog_kallsyms_find run #6: crashed: KASAN: use-after-free Read in bpf_prog_kallsyms_find run #7: crashed: BUG: unable to handle kernel paging request in bpf_prog_kallsyms_find run #8: crashed: KASAN: use-after-free Read in bpf_prog_kallsyms_find run #9: crashed: BUG: unable to handle kernel paging request in bpf_prog_kallsyms_find testing current HEAD 3fc898571b974f9a05e4e5c1fe17b18548207091 testing commit 3fc898571b974f9a05e4e5c1fe17b18548207091 with gcc (GCC) 8.1.0 kernel signature: 657af0323cba25c89cf1547f10600db7aaf4cba5284cb8ed7ecf81e84fbb5c3a run #0: crashed: BUG: unable to handle kernel paging request in bpf_prog_kallsyms_find run #1: crashed: BUG: unable to handle kernel paging request in bpf_prog_kallsyms_find run #2: crashed: BUG: unable to handle kernel paging request in bpf_prog_kallsyms_find run #3: crashed: WARNING in bpf_prog_kallsyms_find run #4: crashed: BUG: unable to handle kernel paging request in bpf_prog_kallsyms_find run #5: crashed: BUG: unable to handle kernel paging request in bpf_prog_kallsyms_find run #6: crashed: BUG: unable to handle kernel paging request in bpf_prog_kallsyms_find run #7: crashed: BUG: unable to handle kernel paging request in bpf_prog_kallsyms_find run #8: crashed: BUG: unable to handle kernel paging request in bpf_prog_kallsyms_find run #9: crashed: KASAN: use-after-free Read in bpf_prog_kallsyms_find revisions tested: 2, total time: 27m24.813823914s (build: 18m37.241701379s, test: 7m33.396000644s) the crash still happens on HEAD commit msg: Linux 4.19.128 crash: KASAN: use-after-free Read in bpf_prog_kallsyms_find IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready ================================================================== BUG: KASAN: use-after-free in bpf_tree_comp kernel/bpf/core.c:437 [inline] BUG: KASAN: use-after-free in __lt_find include/linux/rbtree_latch.h:115 [inline] BUG: KASAN: use-after-free in latch_tree_find include/linux/rbtree_latch.h:208 [inline] BUG: KASAN: use-after-free in bpf_prog_kallsyms_find+0x1d1/0x2e0 kernel/bpf/core.c:511 Read of size 8 at addr ffff88808ea0bac0 by task systemd-udevd/3693 CPU: 1 PID: 3693 Comm: systemd-udevd Not tainted 4.19.128-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x123/0x177 lib/dump_stack.c:118 print_address_description.cold.8+0x9/0x1ff mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report.cold.9+0x242/0x309 mm/kasan/report.c:412 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433 bpf_tree_comp kernel/bpf/core.c:437 [inline] __lt_find include/linux/rbtree_latch.h:115 [inline] latch_tree_find include/linux/rbtree_latch.h:208 [inline] bpf_prog_kallsyms_find+0x1d1/0x2e0 kernel/bpf/core.c:511 is_bpf_text_address+0x48/0xe0 kernel/bpf/core.c:546 kernel_text_address+0x79/0xf0 kernel/extable.c:152 __kernel_text_address+0xd/0x40 kernel/extable.c:107 unwind_get_return_address+0x61/0xa0 arch/x86/kernel/unwind_frame.c:18 __save_stack_trace+0x9c/0x100 arch/x86/kernel/stacktrace.c:45 save_stack_trace+0x1a/0x20 arch/x86/kernel/stacktrace.c:60 save_stack+0x43/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:553 __do_kmalloc mm/slab.c:3727 [inline] __kmalloc_track_caller+0x157/0x760 mm/slab.c:3742 kmemdup_nul+0x25/0x90 mm/util.c:138 security_context_to_sid_core.isra.15+0xa2/0x560 security/selinux/ss/services.c:1463 security_context_to_sid+0x23/0x30 security/selinux/ss/services.c:1525 selinux_inode_setsecurity+0x16d/0x430 security/selinux/hooks.c:3501 selinux_inode_notifysecctx+0x18/0x30 security/selinux/hooks.c:6667 security_inode_notifysecctx+0x4a/0x90 security/security.c:1343 kernfs_refresh_inode+0x31e/0x4a0 fs/kernfs/inode.c:195 kernfs_iop_permission+0x53/0x80 fs/kernfs/inode.c:302 do_inode_permission fs/namei.c:386 [inline] inode_permission+0x271/0x3e0 fs/namei.c:451 may_lookup fs/namei.c:1703 [inline] link_path_walk.part.40+0x6f9/0x1550 fs/namei.c:2085 link_path_walk fs/namei.c:2073 [inline] path_lookupat.isra.43+0x1aa/0x850 fs/namei.c:2318 filename_lookup.part.57+0x160/0x360 fs/namei.c:2349 filename_lookup fs/namei.c:2342 [inline] user_path_at_empty+0x39/0x40 fs/namei.c:2609 do_readlinkat+0xcc/0x2c0 fs/stat.c:394 __do_sys_readlinkat fs/stat.c:421 [inline] __se_sys_readlinkat fs/stat.c:418 [inline] __x64_sys_readlinkat+0x92/0xf0 fs/stat.c:418 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7f10f5a5d0ba Code: 48 8b 0d e1 bd 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 0b 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ae bd 2b 00 f7 d8 64 89 01 48 RSP: 002b:00007ffd5b3fbc48 EFLAGS: 00000202 ORIG_RAX: 000000000000010b RAX: ffffffffffffffda RBX: 000056427c64c6e0 RCX: 00007f10f5a5d0ba RDX: 000056427c64c6e0 RSI: 000056427c64b320 RDI: 00000000ffffff9c RBP: 0000000000000064 R08: 000056427bf00670 R09: 0000000000000070 R10: 0000000000000063 R11: 0000000000000202 R12: 000056427c64b320 R13: 00000000ffffff9c R14: 00007ffd5b3fbca0 R15: 0000000000000063 Allocated by task 13891: save_stack+0x43/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:553 kmem_cache_alloc_trace+0x152/0x740 mm/slab.c:3625 kmalloc include/linux/slab.h:515 [inline] kzalloc include/linux/slab.h:709 [inline] bpf_prog_alloc+0x1e7/0x270 kernel/bpf/core.c:90 jit_subprogs kernel/bpf/verifier.c:5849 [inline] fixup_call_args kernel/bpf/verifier.c:5968 [inline] bpf_check+0x2fd2/0x585d kernel/bpf/verifier.c:6375 bpf_prog_load+0xab4/0x1160 kernel/bpf/syscall.c:1445 __do_sys_bpf kernel/bpf/syscall.c:2414 [inline] __se_sys_bpf kernel/bpf/syscall.c:2375 [inline] __x64_sys_bpf+0x254/0x3a0 kernel/bpf/syscall.c:2375 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 2829: save_stack+0x43/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528 __cache_free mm/slab.c:3503 [inline] kfree+0xcf/0x220 mm/slab.c:3822 bpf_jit_free+0x6f/0x2a0 bpf_prog_free_deferred+0x15d/0x3a0 kernel/bpf/core.c:1809 process_one_work+0x830/0x1670 kernel/workqueue.c:2155 worker_thread+0x85/0xb60 kernel/workqueue.c:2298 kthread+0x324/0x3e0 kernel/kthread.c:246 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 The buggy address belongs to the object at ffff88808ea0ba40 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 128 bytes inside of 256-byte region [ffff88808ea0ba40, ffff88808ea0bb40) The buggy address belongs to the page: page:ffffea00023a82c0 count:1 mapcount:0 mapping:ffff88812c29c7c0 index:0x0 flags: 0xfffe0000000100(slab) raw: 00fffe0000000100 ffffea00023b6a08 ffffea00023a88c8 ffff88812c29c7c0 raw: 0000000000000000 ffff88808ea0b040 000000010000000c 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88808ea0b980: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc ffff88808ea0ba00: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb >ffff88808ea0ba80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88808ea0bb00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff88808ea0bb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================