================================================================== BUG: KASAN: use-after-free in hlist_add_head include/linux/list.h:814 [inline] BUG: KASAN: use-after-free in enqueue_timer+0xb7/0x300 kernel/time/timer.c:541 Write of size 8 at addr ffff8881d15eb1c8 by task syz.2.111/825 CPU: 1 PID: 825 Comm: syz.2.111 Not tainted 5.4.290-syzkaller-00002-g41adfeb3d639 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1d8/0x241 lib/dump_stack.c:118 print_address_description+0x8c/0x600 mm/kasan/report.c:384 __kasan_report+0xf3/0x120 mm/kasan/report.c:516 kasan_report+0x30/0x60 mm/kasan/common.c:653 hlist_add_head include/linux/list.h:814 [inline] enqueue_timer+0xb7/0x300 kernel/time/timer.c:541 __internal_add_timer kernel/time/timer.c:554 [inline] internal_add_timer+0x240/0x430 kernel/time/timer.c:604 __mod_timer+0x6f1/0x13e0 kernel/time/timer.c:1065 call_timer_fn+0x36/0x390 kernel/time/timer.c:1448 expire_timers kernel/time/timer.c:1493 [inline] __run_timers+0x879/0xbe0 kernel/time/timer.c:1817 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1830 __do_softirq+0x23b/0x6b7 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0x195/0x1c0 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:539 [inline] smp_apic_timer_interrupt+0x11a/0x490 arch/x86/kernel/apic/apic.c:1161 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:834 RIP: 0010:arch_atomic_add_negative arch/x86/include/asm/atomic.h:154 [inline] RIP: 0010:atomic_add_negative include/asm-generic/atomic-instrumented.h:768 [inline] RIP: 0010:page_remove_file_rmap mm/rmap.c:1252 [inline] RIP: 0010:page_remove_rmap+0x1e0/0x810 mm/rmap.c:1317 Code: 0c 04 00 00 e8 91 c7 d5 ff 48 83 c3 40 eb bf e8 86 c7 d5 ff 49 8d 7f 30 be 04 00 00 00 e8 18 85 05 00 31 db f0 41 83 47 30 ff <40> 0f 99 c5 0f 98 c3 bf 02 00 00 00 89 de e8 6d c9 d5 ff 31 ff 89 RSP: 0018:ffff8881e7ccf558 EFLAGS: 00000213 ORIG_RAX: ffffffffffffff13 RAX: ffffffff818e8301 RBX: 0000000000000000 RCX: ffffffff818e8388 RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffea00075f1a30 RBP: 0000000000000000 R08: dffffc0000000000 R09: fffff94000ebe347 R10: 0000000000000000 R11: dffffc0000000001 R12: dffffc0000000000 R13: 1ffffd4000ebe341 R14: ffffea00075f1a08 R15: ffffea00075f1a00 zap_pte_range mm/memory.c:1105 [inline] zap_pmd_range mm/memory.c:1222 [inline] zap_pud_range mm/memory.c:1251 [inline] zap_p4d_range mm/memory.c:1272 [inline] unmap_page_range+0x10b7/0x2620 mm/memory.c:1293 unmap_single_vma mm/memory.c:1338 [inline] unmap_vmas+0x355/0x4b0 mm/memory.c:1370 exit_mmap+0x2bc/0x520 mm/mmap.c:3191 __mmput+0x8e/0x2c0 kernel/fork.c:1101 exit_mm kernel/exit.c:538 [inline] do_exit+0xc08/0x2bc0 kernel/exit.c:848 do_group_exit+0x138/0x300 kernel/exit.c:984 get_signal+0xdb1/0x1440 kernel/signal.c:2738 do_signal+0xb0/0x11f0 arch/x86/kernel/signal.c:809 exit_to_usermode_loop+0xc0/0x1a0 arch/x86/entry/common.c:159 prepare_exit_to_usermode+0x199/0x200 arch/x86/entry/common.c:194 entry_SYSCALL_64_after_hwframe+0x5c/0xc1 RIP: 0033:0x7f2b4d02d169 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f2b4b696fe8 EFLAGS: 00000206 ORIG_RAX: 0000000000000038 RAX: fffffffffffffff4 RBX: 00007f2b4d245fa0 RCX: 00007f2b4d02d169 RDX: 0000200000000e40 RSI: 0000000000000000 RDI: 000000004080b000 RBP: 00007f2b4d0ae2a0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f2b4d245fa0 R15: 00007ffd17c10288 The buggy address belongs to the page: page:ffffea0007457ac0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 flags: 0x8000000000000000() raw: 8000000000000000 ffffea0007457b08 ffffea0007457a88 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 0, migratetype Unmovable, gfp_mask 0x106dc2(GFP_HIGHUSER|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_ZERO) set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook mm/page_alloc.c:2165 [inline] prep_new_page+0x18f/0x370 mm/page_alloc.c:2171 get_page_from_freelist+0x2d13/0x2d90 mm/page_alloc.c:3794 __alloc_pages_nodemask+0x393/0x840 mm/page_alloc.c:4893 __vmalloc_area_node mm/vmalloc.c:2431 [inline] __vmalloc_node_range+0x384/0x710 mm/vmalloc.c:2499 __vmalloc_node mm/vmalloc.c:2554 [inline] __vmalloc_node_flags_caller+0x78/0x90 mm/vmalloc.c:2576 prealloc_init+0x12f/0x800 kernel/bpf/hashtab.c:142 htab_map_alloc+0x638/0x930 kernel/bpf/hashtab.c:385 find_and_alloc_map kernel/bpf/syscall.c:122 [inline] map_create kernel/bpf/syscall.c:573 [inline] __do_sys_bpf kernel/bpf/syscall.c:2873 [inline] __se_sys_bpf+0x3291/0xbcb0 kernel/bpf/syscall.c:2849 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x5c/0xc1 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1176 [inline] free_pcp_prepare mm/page_alloc.c:1233 [inline] free_unref_page_prepare+0x297/0x380 mm/page_alloc.c:3085 free_unref_page mm/page_alloc.c:3134 [inline] free_the_page mm/page_alloc.c:4953 [inline] __free_pages+0xaf/0x140 mm/page_alloc.c:4961 __vunmap+0x75b/0x890 mm/vmalloc.c:2260 htab_free_elems kernel/bpf/hashtab.c:116 [inline] prealloc_destroy kernel/bpf/hashtab.c:194 [inline] htab_map_free+0x515/0x670 kernel/bpf/hashtab.c:1238 bpf_map_free_deferred+0xa8/0x100 kernel/bpf/syscall.c:311 process_one_work+0x765/0xd20 kernel/workqueue.c:2290 worker_thread+0xaef/0x1470 kernel/workqueue.c:2436 kthread+0x2da/0x360 kernel/kthread.c:288 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:354 Memory state around the buggy address: ffff8881d15eb080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff8881d15eb100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff8881d15eb180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff8881d15eb200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff8881d15eb280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor instruction fetch in kernel mode #PF: error_code(0x0010) - not-present page PGD 1eba57067 P4D 1eba57067 PUD 0 Oops: 0010 [#1] PREEMPT SMP KASAN CPU: 1 PID: 17 Comm: ksoftirqd/1 Tainted: G B 5.4.290-syzkaller-00002-g41adfeb3d639 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 RIP: 0010:0x0 Code: Bad RIP value. RSP: 0018:ffff8881f5e27b58 EFLAGS: 00010206 RAX: ffffffff8154e8ca RBX: 0000000000000100 RCX: ffff8881f5e12f40 RDX: 0000000080000100 RSI: 0000000000000000 RDI: ffff8881d15eb1c0 RBP: ffff8881f5e27d08 R08: ffffffff8154e50e R09: 0000000000000003 R10: ffffffffffffffff R11: dffffc0000000001 R12: 00000000ffffa0b8 R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8881d15eb1c0 FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffd6 CR3: 00000001d7276000 CR4: 00000000003406a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: call_timer_fn+0x36/0x390 kernel/time/timer.c:1448 expire_timers kernel/time/timer.c:1493 [inline] __run_timers+0x879/0xbe0 kernel/time/timer.c:1817 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1830 __do_softirq+0x23b/0x6b7 kernel/softirq.c:292 run_ksoftirqd+0x1f/0x30 kernel/softirq.c:603 smpboot_thread_fn+0x545/0x930 kernel/smpboot.c:165 kthread+0x2da/0x360 kernel/kthread.c:288 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:354 Modules linked in: CR2: 0000000000000000 ---[ end trace 403dd55531335b59 ]--- RIP: 0010:0x0 Code: Bad RIP value. RSP: 0018:ffff8881f5e27b58 EFLAGS: 00010206 RAX: ffffffff8154e8ca RBX: 0000000000000100 RCX: ffff8881f5e12f40 RDX: 0000000080000100 RSI: 0000000000000000 RDI: ffff8881d15eb1c0 RBP: ffff8881f5e27d08 R08: ffffffff8154e50e R09: 0000000000000003 R10: ffffffffffffffff R11: dffffc0000000001 R12: 00000000ffffa0b8 R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8881d15eb1c0 FS: 0000000000000000(0000) GS:ffff8881f6f00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffd6 CR3: 00000001d7276000 CR4: 00000000003406a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 0c 04 or $0x4,%al 2: 00 00 add %al,(%rax) 4: e8 91 c7 d5 ff call 0xffd5c79a 9: 48 83 c3 40 add $0x40,%rbx d: eb bf jmp 0xffffffce f: e8 86 c7 d5 ff call 0xffd5c79a 14: 49 8d 7f 30 lea 0x30(%r15),%rdi 18: be 04 00 00 00 mov $0x4,%esi 1d: e8 18 85 05 00 call 0x5853a 22: 31 db xor %ebx,%ebx 24: f0 41 83 47 30 ff lock addl $0xffffffff,0x30(%r15) * 2a: 40 0f 99 c5 setns %bpl <-- trapping instruction 2e: 0f 98 c3 sets %bl 31: bf 02 00 00 00 mov $0x2,%edi 36: 89 de mov %ebx,%esi 38: e8 6d c9 d5 ff call 0xffd5c9aa 3d: 31 ff xor %edi,%edi 3f: 89 .byte 0x89