Warning: Permanently added '10.128.1.127' (ECDSA) to the list of known hosts. [ 59.483853][ T4114] ================================================================== [ 59.492111][ T4114] BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x5c/0xc0 [ 59.499377][ T4114] Read of size 42 at addr ffff8880177fe200 by task syz-executor692/4114 [ 59.507679][ T4114] [ 59.510347][ T4114] CPU: 1 PID: 4114 Comm: syz-executor692 Not tainted 5.16.0-syzkaller #0 [ 59.518739][ T4114] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 59.528864][ T4114] Call Trace: [ 59.532154][ T4114] [ 59.535072][ T4114] dump_stack_lvl+0x57/0x7d [ 59.539564][ T4114] print_address_description.constprop.0.cold+0x8d/0x336 [ 59.546572][ T4114] ? _copy_to_user+0x5c/0xc0 [ 59.551148][ T4114] ? _copy_to_user+0x5c/0xc0 [ 59.555719][ T4114] kasan_report.cold+0x83/0xdf [ 59.560468][ T4114] ? _copy_to_user+0x5c/0xc0 [ 59.565039][ T4114] kasan_check_range+0x13d/0x180 [ 59.569962][ T4114] _copy_to_user+0x5c/0xc0 [ 59.574374][ T4114] __htab_map_lookup_and_delete_batch+0xb71/0x1460 [ 59.580874][ T4114] ? __fget_files+0x1bf/0x3c0 [ 59.585548][ T4114] ? htab_of_map_alloc+0xb0/0xb0 [ 59.590559][ T4114] bpf_map_do_batch+0x1f5/0x420 [ 59.595399][ T4114] __sys_bpf+0x161f/0x4400 [ 59.599801][ T4114] ? bpf_link_get_from_fd+0xe0/0xe0 [ 59.604985][ T4114] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 59.610950][ T4114] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 59.616917][ T4114] ? find_held_lock+0x2d/0x110 [ 59.621684][ T4114] __x64_sys_bpf+0x70/0xb0 [ 59.626083][ T4114] ? syscall_enter_from_user_mode+0x21/0x70 [ 59.632047][ T4114] do_syscall_64+0x35/0xb0 [ 59.636539][ T4114] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 59.642502][ T4114] RIP: 0033:0x7f2343a2eb79 [ 59.646901][ T4114] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 59.666665][ T4114] RSP: 002b:00007f23439bf2f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 59.675062][ T4114] RAX: ffffffffffffffda RBX: 00007f2343ab73f0 RCX: 00007f2343a2eb79 [ 59.683019][ T4114] RDX: 0000000000000038 RSI: 0000000020000080 RDI: 0000000000000019 [ 59.691248][ T4114] RBP: 00007f2343a848e0 R08: 00007f23439bf700 R09: 0000000000000000 [ 59.699286][ T4114] R10: 00007f23439bf700 R11: 0000000000000246 R12: 00000000200031c0 [ 59.707421][ T4114] R13: 00007f2343a84068 R14: 00000000200021c0 R15: 00007f2343ab73f8 [ 59.715656][ T4114] [ 59.718748][ T4114] [ 59.721230][ T4114] Allocated by task 4114: [ 59.725538][ T4114] kasan_save_stack+0x1e/0x50 [ 59.730205][ T4114] __kasan_kmalloc+0xa9/0xd0 [ 59.734778][ T4114] __htab_map_lookup_and_delete_batch+0x479/0x1460 [ 59.741262][ T4114] bpf_map_do_batch+0x1f5/0x420 [ 59.746093][ T4114] __sys_bpf+0x161f/0x4400 [ 59.750496][ T4114] __x64_sys_bpf+0x70/0xb0 [ 59.754893][ T4114] do_syscall_64+0x35/0xb0 [ 59.759285][ T4114] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 59.765157][ T4114] [ 59.767465][ T4114] The buggy address belongs to the object at ffff8880177fe200 [ 59.767465][ T4114] which belongs to the cache kmalloc-64 of size 64 [ 59.781330][ T4114] The buggy address is located 0 bytes inside of [ 59.781330][ T4114] 64-byte region [ffff8880177fe200, ffff8880177fe240) [ 59.794324][ T4114] The buggy address belongs to the page: [ 59.799942][ T4114] page:ffffea00005dff80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x177fe [ 59.810333][ T4114] flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) [ 59.818031][ T4114] raw: 00fff00000000200 ffffea00004760c0 dead000000000005 ffff88800fc41640 [ 59.826593][ T4114] raw: 0000000000000000 0000000080200020 00000001ffffffff 0000000000000000 [ 59.835155][ T4114] page dumped because: kasan: bad access detected [ 59.841722][ T4114] page_owner tracks the page as allocated [ 59.847417][ T4114] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1056, ts 3750806203, free_ts 3023088508 [ 59.863460][ T4114] get_page_from_freelist+0xa6f/0x2f10 [ 59.869085][ T4114] __alloc_pages+0x1b2/0x500 [ 59.873657][ T4114] new_slab+0x28a/0x3b0 [ 59.877793][ T4114] ___slab_alloc+0x87e/0xe80 [ 59.882539][ T4114] __slab_alloc.constprop.0+0x4d/0xa0 [ 59.887893][ T4114] kmem_cache_alloc_node_trace+0x116/0x310 [ 59.893766][ T4114] __get_vm_area_node.constprop.0+0x9b/0x300 [ 59.899728][ T4114] __vmalloc_node_range+0x124/0xd70 [ 59.904929][ T4114] copy_process+0x720/0x6890 [ 59.909502][ T4114] kernel_clone+0xb8/0x7f0 [ 59.913895][ T4114] kernel_thread+0xa3/0xe0 [ 59.918286][ T4114] call_usermodehelper_exec_work+0xa4/0x140 [ 59.924158][ T4114] process_one_work+0x879/0x1410 [ 59.929076][ T4114] worker_thread+0x5a0/0xf60 [ 59.933731][ T4114] kthread+0x299/0x340 [ 59.937779][ T4114] ret_from_fork+0x1f/0x30 [ 59.942172][ T4114] page last free stack trace: [ 59.946910][ T4114] free_pcp_prepare+0x374/0x870 [ 59.951827][ T4114] free_unref_page_list+0x1a9/0xfa0 [ 59.957091][ T4114] release_pages+0x223/0xee0 [ 59.961663][ T4114] tlb_finish_mmu+0x127/0x790 [ 59.966496][ T4114] exit_mmap+0x1d1/0x580 [ 59.970717][ T4114] __mmput+0xed/0x430 [ 59.974676][ T4114] free_bprm+0x5b/0x290 [ 59.978810][ T4114] kernel_execve+0x2cc/0x3e0 [ 59.983817][ T4114] call_usermodehelper_exec_async+0x2c1/0x500 [ 59.989864][ T4114] ret_from_fork+0x1f/0x30 [ 59.994261][ T4114] [ 59.996569][ T4114] Memory state around the buggy address: [ 60.002179][ T4114] ffff8880177fe100: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 60.010223][ T4114] ffff8880177fe180: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc [ 60.018263][ T4114] >ffff8880177fe200: 00 00 00 00 03 fc fc fc fc fc fc fc fc fc fc fc [ 60.026740][ T4114] ^ [ 60.031832][ T4114] ffff8880177fe280: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc [ 60.039871][ T4114] ffff8880177fe300: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 60.047910][ T4114] ================================================================== [ 60.055987][ T4114] Disabling lock debugging due to kernel taint [ 61.594594][ T4114] Kernel panic - not syncing: panic_on_warn set ... [ 61.601210][ T4114] CPU: 1 PID: 4114 Comm: syz-executor692 Tainted: G B 5.16.0-syzkaller #0 [ 61.612746][ T4114] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 61.622781][ T4114] Call Trace: [ 61.626042][ T4114] [ 61.629043][ T4114] dump_stack_lvl+0x57/0x7d [ 61.633529][ T4114] panic+0x214/0x49f [ 61.637404][ T4114] ? __warn_printk+0xee/0xee [ 61.641972][ T4114] ? preempt_schedule_common+0x59/0xc0 [ 61.647408][ T4114] ? _copy_to_user+0x5c/0xc0 [ 61.651980][ T4114] ? preempt_schedule_thunk+0x16/0x18 [ 61.657333][ T4114] ? _copy_to_user+0x5c/0xc0 [ 61.661899][ T4114] ? _copy_to_user+0x5c/0xc0 [ 61.666549][ T4114] end_report.cold+0x63/0x6f [ 61.671380][ T4114] kasan_report.cold+0x71/0xdf [ 61.676117][ T4114] ? _copy_to_user+0x5c/0xc0 [ 61.680945][ T4114] kasan_check_range+0x13d/0x180 [ 61.685950][ T4114] _copy_to_user+0x5c/0xc0 [ 61.690348][ T4114] __htab_map_lookup_and_delete_batch+0xb71/0x1460 [ 61.696924][ T4114] ? __fget_files+0x1bf/0x3c0 [ 61.701580][ T4114] ? htab_of_map_alloc+0xb0/0xb0 [ 61.706498][ T4114] bpf_map_do_batch+0x1f5/0x420 [ 61.711325][ T4114] __sys_bpf+0x161f/0x4400 [ 61.716155][ T4114] ? bpf_link_get_from_fd+0xe0/0xe0 [ 61.721332][ T4114] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 61.727292][ T4114] ? lockdep_hardirqs_on_prepare+0x400/0x400 [ 61.733251][ T4114] ? find_held_lock+0x2d/0x110 [ 61.737998][ T4114] __x64_sys_bpf+0x70/0xb0 [ 61.742388][ T4114] ? syscall_enter_from_user_mode+0x21/0x70 [ 61.748258][ T4114] do_syscall_64+0x35/0xb0 [ 61.752657][ T4114] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 61.758526][ T4114] RIP: 0033:0x7f2343a2eb79 [ 61.762919][ T4114] Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 11 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 [ 61.782680][ T4114] RSP: 002b:00007f23439bf2f8 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 61.791069][ T4114] RAX: ffffffffffffffda RBX: 00007f2343ab73f0 RCX: 00007f2343a2eb79 [ 61.799019][ T4114] RDX: 0000000000000038 RSI: 0000000020000080 RDI: 0000000000000019 [ 61.807231][ T4114] RBP: 00007f2343a848e0 R08: 00007f23439bf700 R09: 0000000000000000 [ 61.815186][ T4114] R10: 00007f23439bf700 R11: 0000000000000246 R12: 00000000200031c0 [ 61.823228][ T4114] R13: 00007f2343a84068 R14: 00000000200021c0 R15: 00007f2343ab73f8 [ 61.831531][ T4114] [ 61.835340][ T4114] Kernel Offset: disabled [ 61.839738][ T4114] Rebooting in 86400 seconds..