ci2-android-6-1-perf/strace-static-x86_64 -e \!wait4,clock_nanosleep,nanosleep -s 100 -x -f ci2-android-6-1-perf/syz-executor1414907671 <...> Warning: Permanently added '10.128.0.145' (ED25519) to the list of known hosts. execve("ci2-android-6-1-perf/syz-executor1414907671", ["ci2-android-6-1-perf/syz-executor1414907671"], 0x7ffc60240050 /* 10 vars */) = 0 brk(NULL) = 0x5555561ad000 brk(0x5555561ade00) = 0x5555561ade00 arch_prctl(ARCH_SET_FS, 0x5555561ad480) = 0 set_tid_address(0x5555561ad750) = 305 set_robust_list(0x5555561ad760, 24) = 0 rseq({cpu_id_start=0, cpu_id=RSEQ_CPU_ID_UNINITIALIZED, rseq_cs=NULL, flags=0, node_id=0, mm_cid=0, slice_ctrl={request=0, granted=0, __reserved=0}, __reserved=0}, 32, 0, 0x53053053) = -1 ENOSYS (Function not implemented) prlimit64(0, RLIMIT_STACK, NULL, {rlim_cur=8192*1024, rlim_max=RLIM64_INFINITY}) = 0 readlinkat(AT_FDCWD, "/proc/self/exe", "/root/ci2-android-6-1-perf/syz-executor1414907671", 4096) = 49 getrandom("\x43\x9b\x98\x19\x5c\xf3\x08\x40", 8, GRND_NONBLOCK) = 8 brk(NULL) = 0x5555561ade00 brk(0x5555561cee00) = 0x5555561cee00 brk(0x5555561cf000) = 0x5555561cf000 mprotect(0x7fb5bc0e8000, 20480, PROT_READ) = 0 mmap(0x1ffffffff000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x1ffffffff000 mmap(0x200000000000, 16777216, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200000000000 mmap(0x200001000000, 4096, PROT_NONE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x200001000000 rt_sigprocmask(SIG_BLOCK, ~[], [], 8) = 0 clone(child_stack=NULL, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x5555561ad750) = 306 ci2-android-6-1-perf/strace-static-x86_64: Process 306 attached [pid 305] rt_sigprocmask(SIG_SETMASK, [] [pid 306] set_robust_list(0x5555561ad760, 24) = 0 [pid 305] <... rt_sigprocmask resumed>, NULL, 8) = 0 [pid 305] openat(AT_FDCWD, "/sys/kernel/debug/x86/nmi_longest_ns", O_WRONLY|O_CLOEXEC) = 3 [pid 306] rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0 [pid 305] write(3, "10000000000", 11) = 11 [pid 305] close(3) = 0 [pid 305] openat(AT_FDCWD, "/proc/sys/kernel/hung_task_check_interval_secs", O_WRONLY|O_CLOEXEC) = 3 [pid 305] write(3, "20", 2) = 2 [pid 305] close(3) = 0 [pid 305] openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_kallsyms", O_WRONLY|O_CLOEXEC) = 3 [pid 305] write(3, "1", 1) = 1 [pid 305] close(3) = 0 [pid 305] openat(AT_FDCWD, "/proc/sys/net/core/bpf_jit_harden", O_WRONLY|O_CLOEXEC) = 3 [pid 305] write(3, "0", 1) = 1 [pid 305] close(3) = 0 [pid 305] openat(AT_FDCWD, "/proc/sys/kernel/kptr_restrict", O_WRONLY|O_CLOEXEC) = 3 [pid 305] write(3, "0", 1) = 1 [pid 305] close(3) = 0 [pid 305] openat(AT_FDCWD, "/proc/sys/kernel/softlockup_all_cpu_backtrace", O_WRONLY|O_CLOEXEC) = 3 [pid 305] write(3, "1", 1) = 1 [pid 305] close(3) = 0 [pid 305] openat(AT_FDCWD, "/proc/sys/fs/mount-max", O_WRONLY|O_CLOEXEC) = 3 [pid 305] write(3, "100", 3) = 3 [pid 305] close(3) = 0 [pid 305] openat(AT_FDCWD, "/proc/sys/vm/oom_dump_tasks", O_WRONLY|O_CLOEXEC) = 3 [pid 305] write(3, "0", 1) = 1 [pid 305] close(3) = 0 [pid 305] openat(AT_FDCWD, "/proc/sys/debug/exception-trace", O_WRONLY|O_CLOEXEC) = 3 [pid 305] write(3, "0", 1) = 1 [pid 305] close(3) = 0 [pid 305] openat(AT_FDCWD, "/proc/sys/kernel/printk", O_WRONLY|O_CLOEXEC) = 3 [pid 305] write(3, "7 4 1 3", 7) = 7 [pid 305] close(3) = 0 [pid 305] openat(AT_FDCWD, "/proc/sys/kernel/keys/gc_delay", O_WRONLY|O_CLOEXEC) = 3 [pid 305] write(3, "1", 1) = 1 [pid 305] close(3) = 0 [pid 305] openat(AT_FDCWD, "/proc/sys/vm/oom_kill_allocating_task", O_WRONLY|O_CLOEXEC) = 3 [pid 305] write(3, "1", 1) = 1 [pid 305] close(3) = 0 [pid 305] openat(AT_FDCWD, "/sys/kernel/debug/failslab/task-filter", O_WRONLY|O_CLOEXEC) = 3 [pid 305] write(3, "Y", 1) = 1 [pid 305] close(3) = 0 [pid 305] openat(AT_FDCWD, "/sys/kernel/debug/fail_page_alloc/task-filter", O_WRONLY|O_CLOEXEC) = 3 [pid 305] write(3, "Y", 1) = 1 [pid 305] close(3) = 0 [pid 305] openat(AT_FDCWD, "/sys/kernel/debug/fail_futex/task-filter", O_WRONLY|O_CLOEXEC) = 3 [pid 305] write(3, "Y", 1) = 1 [pid 305] close(3) = 0 [pid 305] openat(AT_FDCWD, "/sys/kernel/debug/fail_usercopy/task-filter", O_WRONLY|O_CLOEXEC) = 3 [pid 305] write(3, "Y", 1) = 1 [pid 305] close(3) = 0 [pid 305] openat(AT_FDCWD, "/sys/kernel/debug/fail_make_request/task-filter", O_WRONLY|O_CLOEXEC) = 3 [pid 305] write(3, "Y", 1) = 1 [pid 305] close(3) = 0 [pid 305] openat(AT_FDCWD, "/sys/kernel/debug/fail_io_timeout/task-filter", O_WRONLY|O_CLOEXEC) = 3 [pid 305] write(3, "Y", 1) = 1 [pid 305] close(3) = 0 [pid 305] openat(AT_FDCWD, "/sys/kernel/debug/fail_iommufd/task-filter", O_WRONLY|O_CLOEXEC) = -1 ENOENT (No such file or directory) [pid 305] openat(AT_FDCWD, "/proc/sys/kernel/ctrl-alt-del", O_WRONLY|O_CLOEXEC) = 3 [pid 305] write(3, "0", 1) = 1 [pid 305] close(3) = 0 [pid 305] openat(AT_FDCWD, "/proc/sys/kernel/cad_pid", O_WRONLY|O_CLOEXEC) = 3 [pid 305] write(3, "306", 3) = 3 [pid 305] close(3) = 0 [pid 305] kill(306, SIGKILL) = 0 [pid 306] +++ killed by SIGKILL +++ --- SIGCHLD {si_signo=SIGCHLD, si_code=CLD_KILLED, si_pid=306, si_uid=0, si_status=SIGKILL, si_utime=0, si_stime=0} --- rt_sigaction(SIGRTMIN, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGRT_1, {sa_handler=SIG_IGN, sa_mask=[], sa_flags=0}, NULL, 8) = 0 rt_sigaction(SIGSEGV, {sa_handler=0x7fb5bc0436e0, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7fb5bc0462b0}, NULL, 8) = 0 rt_sigaction(SIGBUS, {sa_handler=0x7fb5bc0436e0, sa_mask=[], sa_flags=SA_RESTORER|SA_NODEFER|SA_SIGINFO, sa_restorer=0x7fb5bc0462b0}, NULL, 8) = 0 write(1, "executing program\n", 18) = 18 executing program [ 23.726540][ T28] audit: type=1400 audit(1788996709.133:64): avc: denied { execmem } for pid=305 comm="syz-executor141" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=process permissive=1 bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_PERF_EVENT, insn_cnt=8, insns=0x200000000080, license=NULL, log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(4, 16, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET6_GETSOCKNAME, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, core_relo_cnt=0, fd_array=NULL, core_relos=NULL, core_relo_rec_size=0, log_true_size=0, prog_token_fd=0}, 148) = -1 EFAULT (Bad address) bpf(BPF_MAP_CREATE, {map_type=BPF_MAP_TYPE_STACK_TRACE, key_size=4, value_size=256, max_entries=3, map_flags=BPF_F_RDONLY|BPF_F_STACK_BUILD_ID, inner_map_fd=-1, map_name="", map_ifindex=0, btf_fd=-1, btf_key_type_id=0, btf_value_type_id=0, btf_vmlinux_value_type_id=0, map_extra=0, value_type_btf_obj_fd=0, map_token_fd=0}, 80) = 3 bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_PERF_EVENT, insn_cnt=8, insns=0x200000000080, license="GPL", log_level=0, log_size=0, log_buf=NULL, kern_version=KERNEL_VERSION(4, 16, 0), prog_flags=0, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET6_GETSOCKNAME, prog_btf_fd=0, func_info_rec_size=0, func_info=NULL, func_info_cnt=0, line_info_rec_size=0, line_info=NULL, line_info_cnt=0, attach_btf_id=0, attach_prog_fd=0, core_relo_cnt=0, fd_array=NULL, core_relos=NULL, core_relo_rec_size=0, log_true_size=0, prog_token_fd=0}, 148) = 4 perf_event_open({type=PERF_TYPE_SOFTWARE, size=PERF_ATTR_SIZE_VER7, config=PERF_COUNT_SW_PAGE_FAULTS, sample_period=1024, sample_type=PERF_SAMPLE_IP|PERF_SAMPLE_TID|PERF_SAMPLE_TIME|PERF_SAMPLE_READ|PERF_SAMPLE_CALLCHAIN|PERF_SAMPLE_PERIOD|PERF_SAMPLE_STACK_USER|PERF_SAMPLE_WEIGHT|PERF_SAMPLE_TRANSACTION|PERF_SAMPLE_REGS_INTR, read_format=0, precise_ip=0 /* arbitrary skid */, ...}, 0, -1, -1, 0) = 5 ioctl(5, PERF_EVENT_IOC_SET_BPF, 4) = 0 [ 23.758074][ T28] audit: type=1400 audit(1788996709.163:65): avc: denied { bpf } for pid=305 comm="syz-executor141" capability=39 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 23.779209][ T28] audit: type=1400 audit(1788996709.163:66): avc: denied { prog_load } for pid=305 comm="syz-executor141" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 23.779778][ T305] ================================================================== [ 23.798813][ T28] audit: type=1400 audit(1788996709.163:67): avc: denied { map_create } for pid=305 comm="syz-executor141" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 23.806454][ T305] BUG: KASAN: slab-out-of-bounds in stack_map_get_build_id_offset+0x988/0x9b0 [ 23.825908][ T28] audit: type=1400 audit(1788996709.163:68): avc: denied { map_read } for pid=305 comm="syz-executor141" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 23.834550][ T305] Write of size 4 at addr ffff888121059b30 by task syz-executor141/305 [ 23.834564][ T305] [ 23.834569][ T305] CPU: 1 PID: 305 Comm: syz-executor141 Not tainted syzkaller #0 [ 23.834583][ T305] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 [ 23.834606][ T305] Call Trace: [ 23.853903][ T28] audit: type=1400 audit(1788996709.163:69): avc: denied { perfmon } for pid=305 comm="syz-executor141" capability=38 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 23.861863][ T305] [ 23.861871][ T305] __dump_stack+0x21/0x24 [ 23.864261][ T28] audit: type=1400 audit(1788996709.163:70): avc: denied { prog_run } for pid=305 comm="syz-executor141" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bpf permissive=1 [ 23.871887][ T305] dump_stack_lvl+0x110/0x170 [ 23.871910][ T305] ? __cfi_dump_stack_lvl+0x8/0x8 [ 23.881970][ T28] audit: type=1400 audit(1788996709.163:71): avc: denied { open } for pid=305 comm="syz-executor141" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 23.885207][ T305] ? bad_area_nosemaphore+0x2d/0x40 [ 23.906227][ T28] audit: type=1400 audit(1788996709.163:72): avc: denied { kernel } for pid=305 comm="syz-executor141" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 23.909106][ T305] ? stack_map_get_build_id_offset+0x988/0x9b0 [ 23.909131][ T305] print_address_description+0x71/0x200 [ 23.909159][ T305] print_report+0x4a/0x60 [ 23.913496][ T28] audit: type=1400 audit(1788996709.183:73): avc: denied { write } for pid=305 comm="syz-executor141" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=perf_event permissive=1 [ 23.932532][ T305] kasan_report+0x122/0x150 [ 23.932559][ T305] ? stack_map_get_build_id_offset+0x988/0x9b0 [ 24.032435][ T305] __asan_report_store4_noabort+0x17/0x20 [ 24.038149][ T305] stack_map_get_build_id_offset+0x988/0x9b0 [ 24.044113][ T305] ? _raw_spin_unlock+0x4c/0x70 [ 24.048952][ T305] ? __bpf_get_stackid+0x960/0x960 [ 24.054044][ T305] ? pcpu_freelist_pop+0xac/0xf0 [ 24.058961][ T305] ? __cfi_pcpu_freelist_pop+0x10/0x10 [ 24.064428][ T305] __bpf_get_stackid+0x5ac/0x960 [ 24.069353][ T305] bpf_get_stackid_pe+0x2ee/0x400 [ 24.074380][ T305] bpf_prog_2414a5d5030ea31b+0x21/0x25 [ 24.079819][ T305] bpf_overflow_handler+0x3c7/0x5e0 [ 24.085011][ T305] ? __sys_bpf+0x57b/0x850 [ 24.089421][ T305] ? __cfi_bpf_overflow_handler+0x10/0x10 [ 24.095165][ T305] ? __this_cpu_preempt_check+0x13/0x20 [ 24.100698][ T305] ? __perf_event_account_interrupt+0x1a4/0x2c0 [ 24.106934][ T305] __perf_event_overflow+0x458/0x640 [ 24.112209][ T305] perf_swevent_event+0x243/0x440 [ 24.117240][ T305] ? perf_tp_event+0xa20/0xa20 [ 24.121983][ T305] ? unwind_get_return_address+0x4d/0x90 [ 24.127598][ T305] ___perf_sw_event+0x3bf/0x500 [ 24.132429][ T305] ? __cfi____perf_sw_event+0x10/0x10 [ 24.137799][ T305] ? is_bpf_text_address+0x177/0x190 [ 24.143082][ T305] ? stack_trace_save+0xa6/0xf0 [ 24.147912][ T305] ? __stack_depot_save+0x36/0x490 [ 24.153003][ T305] __perf_sw_event+0x134/0x270 [ 24.157745][ T305] do_user_addr_fault+0xfe9/0x1030 [ 24.162839][ T305] exc_page_fault+0x51/0xb0 [ 24.167319][ T305] asm_exc_page_fault+0x27/0x30 [ 24.172150][ T305] RIP: 0010:copy_user_short_string+0xd/0x40 [ 24.178022][ T305] Code: 74 0a 89 d1 f3 a4 89 c8 0f 01 ca c3 89 d0 0f 01 ca c3 01 ca eb e7 90 90 90 90 90 90 90 89 d1 83 e2 07 c1 e9 03 74 12 4c 8b 06 <4c> 89 07 48 8d 76 08 48 8d 7f 08 ff c9 75 ee 21 d2 74 10 89 d1 8a [ 24.197627][ T305] RSP: 0018:ffffc90000e17298 EFLAGS: 00050202 [ 24.203677][ T305] RAX: ffffffff82692d01 RBX: 000000000000000b RCX: 0000000000000001 [ 24.211625][ T305] RDX: 0000000000000003 RSI: ffff8881229a066c RDI: 000020000000cf3d [ 24.219574][ T305] RBP: ffffc90000e172c0 R08: 40203023636e7566 R09: 1ffff110245340ce [ 24.227524][ T305] R10: dffffc0000000000 R11: ffffed10245340cf R12: 00007fffffffeff5 [ 24.235473][ T305] R13: 000000000000000b R14: 000020000000cf3d R15: ffff8881229a066c [ 24.243444][ T305] ? _copy_to_user+0x41/0x90 [ 24.248021][ T305] ? _copy_to_user+0x72/0x90 [ 24.252611][ T305] bpf_verifier_vlog+0x179/0x390 [ 24.257529][ T305] verbose+0x1f0/0x2b0 [ 24.261578][ T305] ? __cfi_verbose+0x10/0x10 [ 24.266146][ T305] ? security_capable+0x99/0xc0 [ 24.270977][ T305] bpf_check+0x2f1b/0x10e90 [ 24.275465][ T305] ? unwind_get_return_address+0x4d/0x90 [ 24.281077][ T305] ? __cfi_gfp_zone+0x10/0x10 [ 24.285732][ T305] ? __cfi_bpf_check+0x10/0x10 [ 24.290472][ T305] ? 0xffffffffa0000948 [ 24.294600][ T305] ? is_bpf_text_address+0x177/0x190 [ 24.299884][ T305] ? kernel_text_address+0xa0/0xd0 [ 24.304980][ T305] ? __kernel_text_address+0xd/0x30 [ 24.310181][ T305] ? unwind_get_return_address+0x4d/0x90 [ 24.315818][ T305] ? __cfi_stack_trace_consume_entry+0x10/0x10 [ 24.321978][ T305] ? arch_stack_walk+0xfc/0x150 [ 24.326826][ T305] ? stack_trace_save+0xa6/0xf0 [ 24.331659][ T305] ? __stack_depot_save+0x36/0x490 [ 24.336754][ T305] ? kasan_set_track+0x60/0x70 [ 24.341506][ T305] ? kasan_set_track+0x4b/0x70 [ 24.346249][ T305] ? kasan_save_alloc_info+0x1f/0x30 [ 24.351517][ T305] ? __kasan_kmalloc+0x95/0xb0 [ 24.356271][ T305] ? kmalloc_trace+0x40/0xb0 [ 24.360858][ T305] ? selinux_bpf_prog_alloc+0x51/0x140 [ 24.366319][ T305] ? security_bpf_prog_alloc+0x73/0xa0 [ 24.371767][ T305] ? bpf_prog_load+0xa03/0x1670 [ 24.376607][ T305] ? __sys_bpf+0x57b/0x850 [ 24.381005][ T305] ? __x64_sys_bpf+0x7c/0x90 [ 24.385578][ T305] ? x64_sys_call+0x488/0x9a0 [ 24.390231][ T305] ? do_syscall_64+0x4c/0xa0 [ 24.394800][ T305] ? entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 24.400856][ T305] ? __kasan_check_write+0x14/0x20 [ 24.405947][ T305] ? _raw_spin_lock+0x94/0xf0 [ 24.410598][ T305] ? __cfi__raw_spin_lock+0x10/0x10 [ 24.415795][ T305] ? _raw_spin_unlock+0x4c/0x70 [ 24.420626][ T305] ? memset+0x35/0x40 [ 24.424587][ T305] ? bpf_obj_name_cpy+0x193/0x1e0 [ 24.429606][ T305] bpf_prog_load+0x10f4/0x1670 [ 24.434351][ T305] ? map_freeze+0x3a0/0x3a0 [ 24.438849][ T305] ? selinux_bpf+0xc7/0xf0 [ 24.443245][ T305] ? security_bpf+0x93/0xb0 [ 24.447768][ T305] __sys_bpf+0x57b/0x850 [ 24.452008][ T305] ? bpf_link_show_fdinfo+0x330/0x330 [ 24.457357][ T305] ? do_user_addr_fault+0x9a5/0x1030 [ 24.462623][ T305] ? debug_smp_processor_id+0x17/0x20 [ 24.467974][ T305] __x64_sys_bpf+0x7c/0x90 [ 24.472367][ T305] x64_sys_call+0x488/0x9a0 [ 24.476862][ T305] do_syscall_64+0x4c/0xa0 [ 24.481257][ T305] ? clear_bhb_loop+0x30/0x80 [ 24.485927][ T305] ? clear_bhb_loop+0x30/0x80 [ 24.490580][ T305] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 24.496473][ T305] RIP: 0033:0x7fb5bc055d39 [ 24.500864][ T305] Code: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48 [ 24.520448][ T305] RSP: 002b:00007ffdc3712f68 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 24.528843][ T305] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fb5bc055d39 [ 24.536791][ T305] RDX: 0000000000000048 RSI: 000020000000e000 RDI: 0000000000000005 [ 24.544757][ T305] RBP: 0000000000000000 R08: 0000000000000000 R09: 00007fb5bc0436e0 [ 24.552702][ T305] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 24.560669][ T305] R13: 0000000000000002 R14: 00007fb5bc0e8ba0 R15: 0000000000000002 [ 24.568621][ T305] [ 24.571616][ T305] [ 24.573916][ T305] Allocated by task 305: [ 24.578129][ T305] kasan_set_track+0x4b/0x70 [ 24.582697][ T305] kasan_save_alloc_info+0x1f/0x30 [ 24.587786][ T305] __kasan_kmalloc+0x95/0xb0 [ 24.592352][ T305] __kmalloc_node+0xb2/0x1e0 [ 24.596913][ T305] bpf_map_area_alloc+0x4b/0xe0 [ 24.601742][ T305] prealloc_elems_and_freelist+0x8a/0x1e0 [ 24.607438][ T305] stack_map_alloc+0x398/0x520 [ 24.612203][ T305] map_create+0x467/0xcf0 [ 24.616509][ T305] __sys_bpf+0x34e/0x850 [ 24.620736][ T305] __x64_sys_bpf+0x7c/0x90 [ 24.625121][ T305] x64_sys_call+0x488/0x9a0 [ 24.629600][ T305] do_syscall_64+0x4c/0xa0 [ 24.633995][ T305] entry_SYSCALL_64_after_hwframe+0x68/0xd2 [ 24.639885][ T305] [ 24.642187][ T305] The buggy address belongs to the object at ffff888121059800 [ 24.642187][ T305] which belongs to the cache kmalloc-1k of size 1024 [ 24.656209][ T305] The buggy address is located 816 bytes inside of [ 24.656209][ T305] 1024-byte region [ffff888121059800, ffff888121059c00) [ 24.669541][ T305] [ 24.671846][ T305] The buggy address belongs to the physical page: [ 24.678234][ T305] page:ffffea0004841600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x121058 [ 24.688455][ T305] head:ffffea0004841600 order:3 compound_mapcount:0 compound_pincount:0 [ 24.696749][ T305] flags: 0x4000000000010200(slab|head|zone=1) [ 24.702816][ T305] raw: 4000000000010200 0000000000000000 dead000000000122 ffff888100043080 [ 24.711389][ T305] raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 [ 24.719941][ T305] page dumped because: kasan: bad access detected [ 24.726354][ T305] page_owner tracks the page as allocated [ 24.732043][ T305] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 302, tgid 302 (sshd-session), ts 23757512020, free_ts 23756792953 [ 24.753196][ T305] post_alloc_hook+0x1f5/0x210 [ 24.757946][ T305] prep_new_page+0x1c/0x110 [ 24.762428][ T305] get_page_from_freelist+0x2ca9/0x2d20 [ 24.767951][ T305] __alloc_pages+0x1fa/0x610 [ 24.772521][ T305] alloc_slab_page+0x6e/0xf0 [ 24.777107][ T305] new_slab+0x98/0x3e0 [ 24.781150][ T305] ___slab_alloc+0x70f/0xb70 [ 24.785725][ T305] __slab_alloc+0x5e/0xa0 [ 24.790033][ T305] __kmem_cache_alloc_node+0x204/0x2d0 [ 24.795467][ T305] __kmalloc_node_track_caller+0xa1/0x1e0 [ 24.801162][ T305] __alloc_skb+0x226/0x4a0 [ 24.805563][ T305] tcp_stream_alloc_skb+0x47/0x360 [ 24.810654][ T305] tcp_sendmsg_locked+0xcb7/0x39f0 [ 24.815741][ T305] tcp_sendmsg+0x2f/0x50 [ 24.819965][ T305] inet_sendmsg+0xb6/0xd0 [ 24.824286][ T305] sock_write_iter+0x2ea/0x3f0 [ 24.829030][ T305] page last free stack trace: [ 24.833681][ T305] free_unref_page_prepare+0x81b/0x820 [ 24.839121][ T305] free_unref_page+0x93/0x530 [ 24.843788][ T305] free_compound_page+0x99/0xd0 [ 24.848638][ T305] destroy_large_folio+0x68/0xa0 [ 24.853561][ T305] __folio_put+0xd1/0xe0 [ 24.857782][ T305] page_to_skb+0x4e1/0xb50 [ 24.862180][ T305] receive_buf+0x469/0x4890 [ 24.866661][ T305] virtnet_poll+0x5c9/0x1150 [ 24.871258][ T305] __napi_poll+0xcd/0x5d0 [ 24.875563][ T305] net_rx_action+0x4a3/0xa90 [ 24.880143][ T305] handle_softirqs+0x1d7/0x600 [ 24.884887][ T305] __irq_exit_rcu+0x52/0xf0 [ 24.889364][ T305] irq_exit_rcu+0x9/0x10 [ 24.893581][ T305] common_interrupt+0xbe/0xe0 [ 24.898233][ T305] asm_common_interrupt+0x27/0x40 [ 24.903236][ T305] [ 24.905533][ T305] Memory state around the buggy address: [ 24.911137][ T305] ffff888121059a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 24.919173][ T305] ffff888121059a80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bpf(BPF_PROG_LOAD, {prog_type=BPF_PROG_TYPE_SK_REUSEPORT, insn_cnt=4, insns=0x2000000000c0, license="GPL", log_level=2, log_size=64912, log_buf="", kern_version=KERNEL_VERSION(0, 0, 0), prog_flags=BPF_F_STRICT_ALIGNMENT|BPF_F_TEST_RND_HI32|BPF_F_XDP_HAS_FRAGS, prog_name="", prog_ifindex=0, expected_attach_type=BPF_CGROUP_INET_INGRESS}, 72) = 6 exit_group(0) = ? +++ exited with 0 +++ [ 24.927225][ T305] >ffff888121059b00: 00 00 00 00 0