==================================================================
BUG: KASAN: slab-out-of-bounds in __bpf_get_stackid+0x6c7/0x900 kernel/bpf/stackmap.c:271
Write of size 32 at addr ffff888022034660 by task syz.2.2940/17051

CPU: 1 PID: 17051 Comm: syz.2.2940 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:364 [inline]
 print_report+0xa8/0x210 mm/kasan/report.c:468
 kasan_report+0x117/0x150 mm/kasan/report.c:581
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x241/0x290 mm/kasan/generic.c:187
 __asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106
 __bpf_get_stackid+0x6c7/0x900 kernel/bpf/stackmap.c:271
 ____bpf_get_stackid_pe kernel/bpf/stackmap.c:374 [inline]
 bpf_get_stackid_pe+0x2f0/0x410 kernel/bpf/stackmap.c:331
 bpf_prog_56bee3f0c8bee862+0x2c/0x41
 bpf_dispatcher_nop_func include/linux/bpf.h:1224 [inline]
 __bpf_prog_run include/linux/filter.h:617 [inline]
 bpf_prog_run include/linux/filter.h:624 [inline]
 bpf_overflow_handler+0x1fc/0x510 kernel/events/core.c:10576
 __perf_event_overflow+0x461/0x660 kernel/events/core.c:9712
 perf_event_overflow kernel/events/core.c:9733 [inline]
 perf_swevent_hrtimer+0x437/0x610 kernel/events/core.c:11222
 __run_hrtimer kernel/time/hrtimer.c:1754 [inline]
 __hrtimer_run_queues+0x4e8/0xc10 kernel/time/hrtimer.c:1818
 hrtimer_interrupt+0x39d/0x980 kernel/time/hrtimer.c:1880
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1077 [inline]
 __sysvec_apic_timer_interrupt+0xfb/0x3b0 arch/x86/kernel/apic/apic.c:1094
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
 sysvec_apic_timer_interrupt+0x9f/0xc0 arch/x86/kernel/apic/apic.c:1088
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:strcpy+0x2b/0xa0 lib/string.c:83
Code: 0f 1e fa 55 41 57 41 56 41 54 53 48 89 f8 48 bb 00 00 00 00 00 fc ff df 45 31 f6 4a 8d 3c 36 48 89 f9 48 c1 e9 03 0f b6 0c 19 <84> c9 75 26 42 0f b6 2c 36 4a 8d 3c 30 48 89 f9 48 c1 e9 03 0f b6
RSP: 0000:ffffc9000de57a10 EFLAGS: 00000a02
RAX: ffffe8ffffd9e018 RBX: dffffc0000000000 RCX: 0000000000000000
RDX: 0000000000140018 RSI: ffffffff8ac98a80 RDI: ffffffff8ac98a8a
RBP: 000000000000006c R08: 0000000000000004 R09: 0000000000000004
R10: ffffe8ffffd9e024 R11: fffff91ffffb3c06 R12: ffffe8ffffd9e000
R13: 000000000000002c R14: 000000000000000a R15: dffffc0000000000
 strcpy include/linux/fortify-string.h:808 [inline]
 perf_trace_lock_acquire+0x2f6/0x400 include/trace/events/lock.h:40
 trace_lock_acquire include/trace/events/lock.h:24 [inline]
 lock_acquire+0x3ef/0x420 kernel/locking/lockdep.c:5725
 down_read_trylock+0x232/0x3b0 kernel/locking/rwsem.c:1562
 vma_start_read include/linux/mm.h:669 [inline]
 lock_vma_under_rcu+0x249/0x660 mm/memory.c:5509
 do_user_addr_fault+0x31c/0x12d0 arch/x86/mm/fault.c:1314
 handle_page_fault arch/x86/mm/fault.c:1463 [inline]
 exc_page_fault+0x64/0x100 arch/x86/mm/fault.c:1516
 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:608
RIP: 0033:0x7ffcd9d17a21
Code: 48 89 c2 eb a7 4c 29 d2 48 0f ba e2 3e 0f 82 ad 00 00 00 48 bf ff ff ff ff ff ff ff 7f 48 21 fa 49 0f af d1 48 01 c2 48 d3 ea <48> 89 55 c0 31 c0 48 81 fa 00 ca 9a 3b 72 1c 31 c9 48 81 c2 00 36
RSP: 002b:00007f42e6538ff0 EFLAGS: 00010207
RAX: 0038369ffe8e0ea8 RBX: 00007ffcd9d130b0 RCX: 0000000000000018
RDX: 0000000038afec0f RSI: 00007f42e6539080 RDI: 7fffffffffffffff
RBP: 00007f42e6539030 R08: 000000000000026d R09: 0000000000745a38
R10: 000001431806c8e5 R11: 000000000001d226 R12: 0000000000000010
R13: 00007f42e5826038 R14: 00007ffcd9d13080 R15: 000000000001d226
 </TASK>

Allocated by task 17051:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4e/0x70 mm/kasan/common.c:53
 ____kasan_kmalloc mm/kasan/common.c:375 [inline]
 __kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:384
 kasan_kmalloc include/linux/kasan.h:198 [inline]
 __do_kmalloc_node mm/slab_common.c:1007 [inline]
 __kmalloc_node+0xb6/0x240 mm/slab_common.c:1014
 kmalloc_node include/linux/slab.h:620 [inline]
 __bpf_map_area_alloc kernel/bpf/syscall.c:303 [inline]
 bpf_map_area_alloc+0x5e/0x110 kernel/bpf/syscall.c:316
 prealloc_elems_and_freelist+0x86/0x1c0 kernel/bpf/stackmap.c:51
 stack_map_alloc+0x32b/0x4b0 kernel/bpf/stackmap.c:114
 map_create+0x877/0x12f0 kernel/bpf/syscall.c:1247
 __sys_bpf+0x651/0x890 kernel/bpf/syscall.c:5460
 __do_sys_bpf kernel/bpf/syscall.c:5582 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5580 [inline]
 __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5580
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

Last potentially related work creation:
 kasan_save_stack+0x3e/0x60 mm/kasan/common.c:46
 __kasan_record_aux_stack+0xaf/0xc0 mm/kasan/generic.c:492
 kvfree_call_rcu+0xee/0x780 kernel/rcu/tree.c:3452
 drop_sysctl_table+0x394/0x540 fs/proc/proc_sysctl.c:1515
 unregister_sysctl_table+0x41/0x60 fs/proc/proc_sysctl.c:1536
 mpls_dev_sysctl_unregister+0x8b/0xc0 net/mpls/af_mpls.c:1431
 mpls_dev_notify+0x533/0x7a0 net/mpls/af_mpls.c:1643
 notifier_call_chain+0x18f/0x380 kernel/notifier.c:93
 call_netdevice_notifiers_extack net/core/dev.c:2077 [inline]
 call_netdevice_notifiers net/core/dev.c:2091 [inline]
 unregister_netdevice_many_notify+0x1037/0x1910 net/core/dev.c:11124
 ip_tunnel_delete_nets+0x32a/0x380 net/ipv4/ip_tunnel.c:1157
 ops_exit_list net/core/net_namespace.c:178 [inline]
 cleanup_net+0x792/0xbb0 net/core/net_namespace.c:652
 process_one_work kernel/workqueue.c:2653 [inline]
 process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2730
 worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2811
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293

Second to last potentially related work creation:
 kasan_save_stack+0x3e/0x60 mm/kasan/common.c:46
 __kasan_record_aux_stack+0xaf/0xc0 mm/kasan/generic.c:492
 kvfree_call_rcu+0xee/0x780 kernel/rcu/tree.c:3452
 drop_sysctl_table+0x394/0x540 fs/proc/proc_sysctl.c:1515
 unregister_sysctl_table+0x41/0x60 fs/proc/proc_sysctl.c:1536
 mpls_dev_sysctl_unregister+0x8b/0xc0 net/mpls/af_mpls.c:1431
 mpls_dev_notify+0x533/0x7a0 net/mpls/af_mpls.c:1643
 notifier_call_chain+0x18f/0x380 kernel/notifier.c:93
 call_netdevice_notifiers_extack net/core/dev.c:2077 [inline]
 call_netdevice_notifiers net/core/dev.c:2091 [inline]
 unregister_netdevice_many_notify+0x1037/0x1910 net/core/dev.c:11124
 unregister_netdevice_many net/core/dev.c:11180 [inline]
 unregister_netdevice_queue+0x2e9/0x330 net/core/dev.c:11060
 unregister_netdevice include/linux/netdevice.h:3139 [inline]
 _cfg80211_unregister_wdev+0x16d/0x580 net/wireless/core.c:1216
 ieee80211_remove_interfaces+0x4b3/0x690 net/mac80211/iface.c:2363
 ieee80211_unregister_hw+0x5d/0x2a0 net/mac80211/main.c:1518
 mac80211_hwsim_del_radio+0x289/0x480 drivers/net/wireless/virtual/mac80211_hwsim.c:5412
 hwsim_exit_net+0x58d/0x650 drivers/net/wireless/virtual/mac80211_hwsim.c:6290
 ops_exit_list net/core/net_namespace.c:173 [inline]
 cleanup_net+0x707/0xbb0 net/core/net_namespace.c:652
 process_one_work kernel/workqueue.c:2653 [inline]
 process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2730
 worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2811
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293

The buggy address belongs to the object at ffff888022034600
 which belongs to the cache kmalloc-cg-128 of size 128
The buggy address is located 96 bytes inside of
 allocated 120-byte region [ffff888022034600, ffff888022034678)

The buggy address belongs to the physical page:
page:ffffea0000880d00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x22034
memcg:ffff88805ba11601
ksm flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000800 ffff888017c4dc80 ffffea000179c880 dead000000000007
raw: 0000000000000000 0000000080100010 00000001ffffffff ffff88805ba11601
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 5771, tgid 5771 (syz-executor), ts 81798646473, free_ts 81787009107
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x1c1/0x200 mm/page_alloc.c:1582
 prep_new_page mm/page_alloc.c:1589 [inline]
 get_page_from_freelist+0x2181/0x22a0 mm/page_alloc.c:3221
 __alloc_pages+0x1f0/0x460 mm/page_alloc.c:4501
 alloc_slab_page+0x5d/0x180 mm/slub.c:1881
 allocate_slab mm/slub.c:2028 [inline]
 new_slab+0x87/0x2d0 mm/slub.c:2081
 ___slab_alloc+0xc5c/0x12f0 mm/slub.c:3253
 __slab_alloc mm/slub.c:3339 [inline]
 __slab_alloc_node mm/slub.c:3392 [inline]
 slab_alloc_node mm/slub.c:3485 [inline]
 __kmem_cache_alloc_node+0x11f/0x250 mm/slub.c:3534
 __do_kmalloc_node mm/slab_common.c:1006 [inline]
 __kmalloc_node+0xa6/0x240 mm/slab_common.c:1014
 kmalloc_node include/linux/slab.h:620 [inline]
 kvmalloc_node+0x70/0x180 mm/util.c:617
 kvmalloc include/linux/slab.h:738 [inline]
 kvzalloc include/linux/slab.h:746 [inline]
 allocate_hook_entries_size net/netfilter/core.c:61 [inline]
 nf_hook_entries_grow+0x27c/0x710 net/netfilter/core.c:140
 __nf_register_net_hook+0x2c9/0x910 net/netfilter/core.c:435
 nf_register_net_hook+0xb2/0x190 net/netfilter/core.c:578
 nf_register_net_hooks+0x44/0x1b0 net/netfilter/core.c:594
 ip6t_register_table+0x520/0x7c0 net/ipv6/netfilter/ip6_tables.c:1784
 ip6table_security_table_init+0x41/0x60 net/ipv6/netfilter/ip6table_security.c:45
 xt_find_table_lock+0x304/0x3e0 net/netfilter/x_tables.c:1282
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1182 [inline]
 free_unref_page_prepare+0x7d7/0x8f0 mm/page_alloc.c:2366
 free_unref_page+0x32/0x2e0 mm/page_alloc.c:2459
 tlb_batch_list_free mm/mmu_gather.c:115 [inline]
 tlb_finish_mmu+0x13e/0x220 mm/mmu_gather.c:428
 exit_mmap+0x428/0xb90 mm/mmap.c:3315
 __mmput+0x118/0x3a0 kernel/fork.c:1362
 exit_mm+0x23f/0x340 kernel/exit.c:576
 do_exit+0x909/0x2530 kernel/exit.c:877
 do_group_exit+0x22d/0x2f0 kernel/exit.c:1032
 __do_sys_exit_group kernel/exit.c:1043 [inline]
 __se_sys_exit_group kernel/exit.c:1041 [inline]
 __x64_sys_exit_group+0x3f/0x40 kernel/exit.c:1041
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

Memory state around the buggy address:
 ffff888022034500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc
 ffff888022034580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888022034600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc
                                                                ^
 ffff888022034680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888022034700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc
==================================================================
----------------
Code disassembly (best guess):
   0:	0f 1e fa             	nop    %edx
   3:	55                   	push   %rbp
   4:	41 57                	push   %r15
   6:	41 56                	push   %r14
   8:	41 54                	push   %r12
   a:	53                   	push   %rbx
   b:	48 89 f8             	mov    %rdi,%rax
   e:	48 bb 00 00 00 00 00 	movabs $0xdffffc0000000000,%rbx
  15:	fc ff df
  18:	45 31 f6             	xor    %r14d,%r14d
  1b:	4a 8d 3c 36          	lea    (%rsi,%r14,1),%rdi
  1f:	48 89 f9             	mov    %rdi,%rcx
  22:	48 c1 e9 03          	shr    $0x3,%rcx
  26:	0f b6 0c 19          	movzbl (%rcx,%rbx,1),%ecx
* 2a:	84 c9                	test   %cl,%cl <-- trapping instruction
  2c:	75 26                	jne    0x54
  2e:	42 0f b6 2c 36       	movzbl (%rsi,%r14,1),%ebp
  33:	4a 8d 3c 30          	lea    (%rax,%r14,1),%rdi
  37:	48 89 f9             	mov    %rdi,%rcx
  3a:	48 c1 e9 03          	shr    $0x3,%rcx
  3e:	0f                   	.byte 0xf
  3f:	b6                   	.byte 0xb6