bisecting fixing commit since 32ee7492f104d82b01a44fc4b4ae17d5d2bb237b
building syzkaller on 2274ad39c8bee8efda31dc31ec8933d5624e8fe4
testing commit 32ee7492f104d82b01a44fc4b4ae17d5d2bb237b with gcc (GCC) 8.1.0
kernel signature: a656bfa9a6dbbda3bd7414f0e9c753bbf02f1bc317eff49f9c803d3c34f7d4e9
run #0: crashed: BUG: unable to handle kernel paging request in bpf_prog_kallsyms_find
run #1: crashed: BUG: unable to handle kernel paging request in bpf_prog_kallsyms_find
run #2: crashed: KASAN: use-after-free Read in bpf_prog_kallsyms_find
run #3: crashed: BUG: unable to handle kernel paging request in bpf_prog_kallsyms_find
run #4: crashed: BUG: unable to handle kernel paging request in bpf_prog_kallsyms_find
run #5: crashed: KASAN: use-after-free Read in bpf_prog_kallsyms_find
run #6: crashed: KASAN: use-after-free Read in bpf_prog_kallsyms_find
run #7: crashed: BUG: unable to handle kernel paging request in bpf_prog_kallsyms_find
run #8: crashed: KASAN: use-after-free Read in bpf_prog_kallsyms_find
run #9: crashed: BUG: unable to handle kernel paging request in bpf_prog_kallsyms_find
testing current HEAD 3fc898571b974f9a05e4e5c1fe17b18548207091
testing commit 3fc898571b974f9a05e4e5c1fe17b18548207091 with gcc (GCC) 8.1.0
kernel signature: 657af0323cba25c89cf1547f10600db7aaf4cba5284cb8ed7ecf81e84fbb5c3a
run #0: crashed: BUG: unable to handle kernel paging request in bpf_prog_kallsyms_find
run #1: crashed: BUG: unable to handle kernel paging request in bpf_prog_kallsyms_find
run #2: crashed: BUG: unable to handle kernel paging request in bpf_prog_kallsyms_find
run #3: crashed: WARNING in bpf_prog_kallsyms_find
run #4: crashed: BUG: unable to handle kernel paging request in bpf_prog_kallsyms_find
run #5: crashed: BUG: unable to handle kernel paging request in bpf_prog_kallsyms_find
run #6: crashed: BUG: unable to handle kernel paging request in bpf_prog_kallsyms_find
run #7: crashed: BUG: unable to handle kernel paging request in bpf_prog_kallsyms_find
run #8: crashed: BUG: unable to handle kernel paging request in bpf_prog_kallsyms_find
run #9: crashed: KASAN: use-after-free Read in bpf_prog_kallsyms_find
revisions tested: 2, total time: 27m24.813823914s (build: 18m37.241701379s, test: 7m33.396000644s)
the crash still happens on HEAD
commit msg: Linux 4.19.128
crash: KASAN: use-after-free Read in bpf_prog_kallsyms_find
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
==================================================================
BUG: KASAN: use-after-free in bpf_tree_comp kernel/bpf/core.c:437 [inline]
BUG: KASAN: use-after-free in __lt_find include/linux/rbtree_latch.h:115 [inline]
BUG: KASAN: use-after-free in latch_tree_find include/linux/rbtree_latch.h:208 [inline]
BUG: KASAN: use-after-free in bpf_prog_kallsyms_find+0x1d1/0x2e0 kernel/bpf/core.c:511
Read of size 8 at addr ffff88808ea0bac0 by task systemd-udevd/3693

CPU: 1 PID: 3693 Comm: systemd-udevd Not tainted 4.19.128-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x123/0x177 lib/dump_stack.c:118
 print_address_description.cold.8+0x9/0x1ff mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report.cold.9+0x242/0x309 mm/kasan/report.c:412
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
 bpf_tree_comp kernel/bpf/core.c:437 [inline]
 __lt_find include/linux/rbtree_latch.h:115 [inline]
 latch_tree_find include/linux/rbtree_latch.h:208 [inline]
 bpf_prog_kallsyms_find+0x1d1/0x2e0 kernel/bpf/core.c:511
 is_bpf_text_address+0x48/0xe0 kernel/bpf/core.c:546
 kernel_text_address+0x79/0xf0 kernel/extable.c:152
 __kernel_text_address+0xd/0x40 kernel/extable.c:107
 unwind_get_return_address+0x61/0xa0 arch/x86/kernel/unwind_frame.c:18
 __save_stack_trace+0x9c/0x100 arch/x86/kernel/stacktrace.c:45
 save_stack_trace+0x1a/0x20 arch/x86/kernel/stacktrace.c:60
 save_stack+0x43/0xd0 mm/kasan/kasan.c:448
 set_track mm/kasan/kasan.c:460 [inline]
 kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:553
 __do_kmalloc mm/slab.c:3727 [inline]
 __kmalloc_track_caller+0x157/0x760 mm/slab.c:3742
 kmemdup_nul+0x25/0x90 mm/util.c:138
 security_context_to_sid_core.isra.15+0xa2/0x560 security/selinux/ss/services.c:1463
 security_context_to_sid+0x23/0x30 security/selinux/ss/services.c:1525
 selinux_inode_setsecurity+0x16d/0x430 security/selinux/hooks.c:3501
 selinux_inode_notifysecctx+0x18/0x30 security/selinux/hooks.c:6667
 security_inode_notifysecctx+0x4a/0x90 security/security.c:1343
 kernfs_refresh_inode+0x31e/0x4a0 fs/kernfs/inode.c:195
 kernfs_iop_permission+0x53/0x80 fs/kernfs/inode.c:302
 do_inode_permission fs/namei.c:386 [inline]
 inode_permission+0x271/0x3e0 fs/namei.c:451
 may_lookup fs/namei.c:1703 [inline]
 link_path_walk.part.40+0x6f9/0x1550 fs/namei.c:2085
 link_path_walk fs/namei.c:2073 [inline]
 path_lookupat.isra.43+0x1aa/0x850 fs/namei.c:2318
 filename_lookup.part.57+0x160/0x360 fs/namei.c:2349
 filename_lookup fs/namei.c:2342 [inline]
 user_path_at_empty+0x39/0x40 fs/namei.c:2609
 do_readlinkat+0xcc/0x2c0 fs/stat.c:394
 __do_sys_readlinkat fs/stat.c:421 [inline]
 __se_sys_readlinkat fs/stat.c:418 [inline]
 __x64_sys_readlinkat+0x92/0xf0 fs/stat.c:418
 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f10f5a5d0ba
Code: 48 8b 0d e1 bd 2b 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 49 89 ca b8 0b 01 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d ae bd 2b 00 f7 d8 64 89 01 48
RSP: 002b:00007ffd5b3fbc48 EFLAGS: 00000202 ORIG_RAX: 000000000000010b
RAX: ffffffffffffffda RBX: 000056427c64c6e0 RCX: 00007f10f5a5d0ba
RDX: 000056427c64c6e0 RSI: 000056427c64b320 RDI: 00000000ffffff9c
RBP: 0000000000000064 R08: 000056427bf00670 R09: 0000000000000070
R10: 0000000000000063 R11: 0000000000000202 R12: 000056427c64b320
R13: 00000000ffffff9c R14: 00007ffd5b3fbca0 R15: 0000000000000063

Allocated by task 13891:
 save_stack+0x43/0xd0 mm/kasan/kasan.c:448
 set_track mm/kasan/kasan.c:460 [inline]
 kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:553
 kmem_cache_alloc_trace+0x152/0x740 mm/slab.c:3625
 kmalloc include/linux/slab.h:515 [inline]
 kzalloc include/linux/slab.h:709 [inline]
 bpf_prog_alloc+0x1e7/0x270 kernel/bpf/core.c:90
 jit_subprogs kernel/bpf/verifier.c:5849 [inline]
 fixup_call_args kernel/bpf/verifier.c:5968 [inline]
 bpf_check+0x2fd2/0x585d kernel/bpf/verifier.c:6375
 bpf_prog_load+0xab4/0x1160 kernel/bpf/syscall.c:1445
 __do_sys_bpf kernel/bpf/syscall.c:2414 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:2375 [inline]
 __x64_sys_bpf+0x254/0x3a0 kernel/bpf/syscall.c:2375
 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 2829:
 save_stack+0x43/0xd0 mm/kasan/kasan.c:448
 set_track mm/kasan/kasan.c:460 [inline]
 __kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
 __cache_free mm/slab.c:3503 [inline]
 kfree+0xcf/0x220 mm/slab.c:3822
 bpf_jit_free+0x6f/0x2a0
 bpf_prog_free_deferred+0x15d/0x3a0 kernel/bpf/core.c:1809
 process_one_work+0x830/0x1670 kernel/workqueue.c:2155
 worker_thread+0x85/0xb60 kernel/workqueue.c:2298
 kthread+0x324/0x3e0 kernel/kthread.c:246
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415

The buggy address belongs to the object at ffff88808ea0ba40
 which belongs to the cache kmalloc-256 of size 256
The buggy address is located 128 bytes inside of
 256-byte region [ffff88808ea0ba40, ffff88808ea0bb40)
The buggy address belongs to the page:
page:ffffea00023a82c0 count:1 mapcount:0 mapping:ffff88812c29c7c0 index:0x0
flags: 0xfffe0000000100(slab)
raw: 00fffe0000000100 ffffea00023b6a08 ffffea00023a88c8 ffff88812c29c7c0
raw: 0000000000000000 ffff88808ea0b040 000000010000000c 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88808ea0b980: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc
 ffff88808ea0ba00: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
>ffff88808ea0ba80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                           ^
 ffff88808ea0bb00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
 ffff88808ea0bb80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================