Warning: Permanently added '10.128.10.24' (ECDSA) to the list of known hosts. [ 66.604629][ T4053] ================================================================== [ 66.612892][ T4053] BUG: KASAN: slab-out-of-bounds in bpf_prog_test_run_xdp+0xf9a/0x1010 [ 66.621131][ T4053] Write of size 8 at addr ffff88807d16f000 by task syz-executor365/4053 [ 66.629651][ T4053] [ 66.632140][ T4053] CPU: 0 PID: 4053 Comm: syz-executor365 Not tainted 5.16.0-syzkaller #0 [ 66.640545][ T4053] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 66.650590][ T4053] Call Trace: [ 66.653877][ T4053] [ 66.656839][ T4053] dump_stack_lvl+0x57/0x7d [ 66.661592][ T4053] print_address_description.constprop.0.cold+0x8d/0x320 [ 66.668736][ T4053] ? bpf_prog_test_run_xdp+0xf9a/0x1010 [ 66.674259][ T4053] ? bpf_prog_test_run_xdp+0xf9a/0x1010 [ 66.679784][ T4053] kasan_report.cold+0x83/0xdf [ 66.684799][ T4053] ? bpf_prog_test_run_xdp+0xf9a/0x1010 [ 66.690335][ T4053] bpf_prog_test_run_xdp+0xf9a/0x1010 [ 66.695734][ T4053] ? bpf_prog_test_run_skb+0x1cb0/0x1cb0 [ 66.701466][ T4053] ? lock_downgrade+0x6e0/0x6e0 [ 66.706304][ T4053] ? __fget_light+0x4c/0x220 [ 66.710987][ T4053] __sys_bpf+0x1054/0x4410 [ 66.715663][ T4053] ? bpf_link_get_from_fd+0xe0/0xe0 [ 66.720853][ T4053] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 66.727339][ T4053] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 66.733405][ T4053] ? find_held_lock+0x2d/0x110 [ 66.738183][ T4053] __x64_sys_bpf+0x70/0xb0 [ 66.742586][ T4053] ? syscall_enter_from_user_mode+0x21/0x70 [ 66.748679][ T4053] do_syscall_64+0x35/0xb0 [ 66.753089][ T4053] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 66.759133][ T4053] RIP: 0033:0x7fd9171e8d59 [ 66.763827][ T4053] Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 66.784401][ T4053] RSP: 002b:00007fffbefdbd58 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 66.794718][ T4053] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fd9171e8d59 [ 66.803118][ T4053] RDX: 0000000000000048 RSI: 0000000020000000 RDI: 000000000000000a [ 66.811167][ T4053] RBP: 00007fd9171acf00 R08: 0000000000000000 R09: 0000000000000000 [ 66.819273][ T4053] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd9171acf90 [ 66.827495][ T4053] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 66.835603][ T4053] [ 66.838617][ T4053] [ 66.840930][ T4053] Allocated by task 4053: [ 66.845249][ T4053] kasan_save_stack+0x1e/0x50 [ 66.849995][ T4053] __kasan_kmalloc+0xa9/0xd0 [ 66.854576][ T4053] bpf_test_init.isra.0+0x4c/0xb0 [ 66.859599][ T4053] bpf_prog_test_run_xdp+0x2a9/0x1010 [ 66.865214][ T4053] __sys_bpf+0x1054/0x4410 [ 66.869733][ T4053] __x64_sys_bpf+0x70/0xb0 [ 66.874121][ T4053] do_syscall_64+0x35/0xb0 [ 66.878520][ T4053] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 66.884438][ T4053] [ 66.886752][ T4053] The buggy address belongs to the object at ffff88807d16e000 [ 66.886752][ T4053] which belongs to the cache kmalloc-4k of size 4096 [ 66.901603][ T4053] The buggy address is located 0 bytes to the right of [ 66.901603][ T4053] 4096-byte region [ffff88807d16e000, ffff88807d16f000) [ 66.915483][ T4053] The buggy address belongs to the page: [ 66.921210][ T4053] page:ffffea0001f45a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7d168 [ 66.931342][ T4053] head:ffffea0001f45a00 order:3 compound_mapcount:0 compound_pincount:0 [ 66.939737][ T4053] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 66.947703][ T4053] raw: 00fff00000010200 0000000000000000 dead000000000001 ffff88800fc42140 [ 66.956446][ T4053] raw: 0000000000000000 0000000080040004 00000001ffffffff 0000000000000000 [ 66.965087][ T4053] page dumped because: kasan: bad access detected [ 66.971809][ T4053] page_owner tracks the page as allocated [ 66.977501][ T4053] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 8, ts 51905196458, free_ts 51586417134 [ 66.998334][ T4053] get_page_from_freelist+0xa6f/0x2f10 [ 67.003804][ T4053] __alloc_pages+0x1b2/0x500 [ 67.008453][ T4053] new_slab+0x28a/0x3b0 [ 67.012689][ T4053] ___slab_alloc+0x87e/0xe80 [ 67.017523][ T4053] __slab_alloc.constprop.0+0x4d/0xa0 [ 67.022871][ T4053] __kmalloc_node_track_caller+0x2cb/0x360 [ 67.028667][ T4053] __alloc_skb+0x8a/0x270 [ 67.032984][ T4053] rtmsg_ifinfo_build_skb+0x6d/0x160 [ 67.038249][ T4053] rtmsg_ifinfo+0x5c/0x100 [ 67.042641][ T4053] register_netdevice+0xe38/0x1240 [ 67.047725][ T4053] nsim_create+0x371/0x4b0 [ 67.052131][ T4053] __nsim_dev_port_add+0x250/0x6e0 [ 67.057234][ T4053] nsim_dev_port_add_all+0x36/0x120 [ 67.062499][ T4053] nsim_dev_reload_up+0x496/0x670 [ 67.067597][ T4053] devlink_reload+0x27d/0x5e0 [ 67.072264][ T4053] devlink_pernet_pre_exit+0x141/0x1c0 [ 67.077789][ T4053] page last free stack trace: [ 67.082444][ T4053] free_pcp_prepare+0x374/0x870 [ 67.087386][ T4053] free_unref_page+0x19/0x690 [ 67.092129][ T4053] __unfreeze_partials+0x320/0x340 [ 67.097309][ T4053] qlist_free_all+0x5e/0xf0 [ 67.101829][ T4053] kasan_quarantine_reduce+0x180/0x200 [ 67.107264][ T4053] __kasan_slab_alloc+0xa2/0xc0 [ 67.112093][ T4053] kmem_cache_alloc_trace+0x1e9/0x2c0 [ 67.117619][ T4053] nsim_fib_event_work+0x1003/0x20e0 [ 67.122897][ T4053] process_one_work+0x87f/0x1420 [ 67.127822][ T4053] worker_thread+0x741/0xf90 [ 67.132396][ T4053] kthread+0x3ab/0x480 [ 67.136545][ T4053] ret_from_fork+0x1f/0x30 [ 67.141028][ T4053] [ 67.143328][ T4053] Memory state around the buggy address: [ 67.148945][ T4053] ffff88807d16ef00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.157073][ T4053] ffff88807d16ef80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 67.165125][ T4053] >ffff88807d16f000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 67.173189][ T4053] ^ [ 67.177423][ T4053] ffff88807d16f080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 67.185459][ T4053] ffff88807d16f100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 67.193795][ T4053] ================================================================== [ 67.201827][ T4053] Disabling lock debugging due to kernel taint [ 67.212586][ T4053] Kernel panic - not syncing: panic_on_warn set ... [ 67.219176][ T4053] CPU: 0 PID: 4053 Comm: syz-executor365 Tainted: G B 5.16.0-syzkaller #0 [ 67.228963][ T4053] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 67.239278][ T4053] Call Trace: [ 67.242545][ T4053] [ 67.245459][ T4053] dump_stack_lvl+0x57/0x7d [ 67.249945][ T4053] panic+0x214/0x49f [ 67.253923][ T4053] ? __warn_printk+0xee/0xee [ 67.258527][ T4053] ? preempt_schedule_common+0x59/0xc0 [ 67.263960][ T4053] ? bpf_prog_test_run_xdp+0xf9a/0x1010 [ 67.269478][ T4053] ? preempt_schedule_thunk+0x16/0x18 [ 67.274850][ T4053] ? bpf_prog_test_run_xdp+0xf9a/0x1010 [ 67.280371][ T4053] ? bpf_prog_test_run_xdp+0xf9a/0x1010 [ 67.285987][ T4053] end_report.cold+0x63/0x6f [ 67.290561][ T4053] kasan_report.cold+0x71/0xdf [ 67.295306][ T4053] ? bpf_prog_test_run_xdp+0xf9a/0x1010 [ 67.301179][ T4053] bpf_prog_test_run_xdp+0xf9a/0x1010 [ 67.306537][ T4053] ? bpf_prog_test_run_skb+0x1cb0/0x1cb0 [ 67.312504][ T4053] ? lock_downgrade+0x6e0/0x6e0 [ 67.317512][ T4053] ? __fget_light+0x4c/0x220 [ 67.322082][ T4053] __sys_bpf+0x1054/0x4410 [ 67.326490][ T4053] ? bpf_link_get_from_fd+0xe0/0xe0 [ 67.331695][ T4053] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 67.337767][ T4053] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 67.343732][ T4053] ? find_held_lock+0x2d/0x110 [ 67.348491][ T4053] __x64_sys_bpf+0x70/0xb0 [ 67.352897][ T4053] ? syscall_enter_from_user_mode+0x21/0x70 [ 67.358966][ T4053] do_syscall_64+0x35/0xb0 [ 67.363766][ T4053] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 67.369748][ T4053] RIP: 0033:0x7fd9171e8d59 [ 67.374144][ T4053] Code: 28 c3 e8 2a 14 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 [ 67.393730][ T4053] RSP: 002b:00007fffbefdbd58 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 67.402410][ T4053] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fd9171e8d59 [ 67.410630][ T4053] RDX: 0000000000000048 RSI: 0000000020000000 RDI: 000000000000000a [ 67.419405][ T4053] RBP: 00007fd9171acf00 R08: 0000000000000000 R09: 0000000000000000 [ 67.427633][ T4053] R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd9171acf90 [ 67.435586][ T4053] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 67.443891][ T4053] [ 67.447245][ T4053] Kernel Offset: disabled [ 67.451558][ T4053] Rebooting in 86400 seconds..