==================================================================
BUG: KASAN: slab-out-of-bounds in __bpf_get_stackid+0x6c9/0x920 kernel/bpf/stackmap.c:274
Write of size 32 at addr ffff888056c0b460 by task syz.5.759/8078

CPU: 0 PID: 8078 Comm: syz.5.759 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:316 [inline]
 print_report+0xa8/0x210 mm/kasan/report.c:420
 kasan_report+0x10b/0x140 mm/kasan/report.c:524
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x235/0x290 mm/kasan/generic.c:189
 memcpy+0x3c/0x60 mm/kasan/shadow.c:66
 __bpf_get_stackid+0x6c9/0x920 kernel/bpf/stackmap.c:274
 ____bpf_get_stackid_pe kernel/bpf/stackmap.c:377 [inline]
 bpf_get_stackid_pe+0x2ec/0x400 kernel/bpf/stackmap.c:334
 bpf_prog_0f157398db2fb47c+0x24/0x3c
 bpf_dispatcher_nop_func include/linux/bpf.h:1013 [inline]
 __bpf_prog_run include/linux/filter.h:608 [inline]
 bpf_prog_run include/linux/filter.h:615 [inline]
 bpf_overflow_handler+0x50b/0x790 kernel/events/core.c:10331
 __perf_event_overflow+0x457/0x630 kernel/events/core.c:9506
 perf_event_overflow kernel/events/core.c:9527 [inline]
 perf_swevent_hrtimer+0x472/0x630 kernel/events/core.c:10977
 __run_hrtimer kernel/time/hrtimer.c:1751 [inline]
 __hrtimer_run_queues+0x4e7/0xc90 kernel/time/hrtimer.c:1815
 hrtimer_interrupt+0x399/0x980 kernel/time/hrtimer.c:1877
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1107 [inline]
 __sysvec_apic_timer_interrupt+0x153/0x5a0 arch/x86/kernel/apic/apic.c:1124
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
 sysvec_apic_timer_interrupt+0x9b/0xc0 arch/x86/kernel/apic/apic.c:1118
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:vma_alloc_folio+0x0/0x900 mm/mempolicy.c:2165
Code: c3 44 89 e1 80 e1 07 fe c1 38 c1 0f 8c 61 ff ff ff 4c 89 e7 e8 31 f9 02 00 e9 54 ff ff ff 66 2e 0f 1f 84 00 00 00 00 00 66 90 <55> 41 57 41 56 41 55 41 54 53 48 83 ec 28 45 89 c4 49 89 cd 48 89
RSP: 0000:ffffc9000de07ad8 EFLAGS: 00000246
RAX: 1ffff92001bc0faf RBX: 00000000000383e2 RCX: 00007fe2f7867000
RDX: ffff88807e7a9bd0 RSI: 0000000000000000 RDI: 0000000000100cca
RBP: ffffc9000de07c70 R08: 0000000000000000 R09: ffffc9000de07bc0
R10: dffffc0000000000 R11: fffff52001bc0f7e R12: ffffc9000de07d60
R13: dffffc0000000000 R14: 0000000000010710 R15: ffffc9000de07d78
 alloc_page_vma include/linux/gfp.h:284 [inline]
 wp_page_copy+0x27a/0x1660 mm/memory.c:3151
 handle_pte_fault mm/memory.c:5047 [inline]
 __handle_mm_fault mm/memory.c:5171 [inline]
 handle_mm_fault+0x1b1b/0x3d40 mm/memory.c:5292
 do_user_addr_fault+0x58e/0xb20 arch/x86/mm/fault.c:1338
 handle_page_fault arch/x86/mm/fault.c:1429 [inline]
 exc_page_fault+0x60/0x100 arch/x86/mm/fault.c:1482
 asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:608
RIP: 0033:0x7ffd163679e9
Code: 48 8b 75 d0 48 89 c2 48 85 d2 79 ad e9 b1 00 00 00 48 89 d7 4c 29 d7 48 0f af f8 31 c0 4c 39 d2 48 0f 46 f8 4c 01 cf 48 d3 ef <48> 89 7d c8 48 81 ff 00 ca 9a 3b 72 1c 31 c9 48 81 c7 00 36 65 c4
RSP: 002b:00007fe2f7867ff0 EFLAGS: 00010206
RAX: 0000000000000000 RBX: 00007ffd163630b0 RCX: 0000000000000018
RDX: 0000007c3d6d5086 RSI: 00007fe2f78680b0 RDI: 000000002cd56fb1
RBP: 00007fe2f7868030 R08: 00000000000000e9 R09: 002c500b62174f06
R10: 0000007c3c47d4b7 R11: 000000000000ade6 R12: 0000000000000010
R13: 00007fe2f6c26128 R14: 00007ffd16363080 R15: 000000000000ade6
 </TASK>

Allocated by task 8077:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
 ____kasan_kmalloc mm/kasan/common.c:375 [inline]
 __kasan_kmalloc+0x8e/0xa0 mm/kasan/common.c:384
 kasan_kmalloc include/linux/kasan.h:211 [inline]
 __do_kmalloc_node mm/slab_common.c:936 [inline]
 __kmalloc_node+0xb2/0x240 mm/slab_common.c:943
 kmalloc_node include/linux/slab.h:589 [inline]
 __bpf_map_area_alloc kernel/bpf/syscall.c:328 [inline]
 bpf_map_area_alloc+0x47/0xe0 kernel/bpf/syscall.c:341
 prealloc_elems_and_freelist+0x86/0x1c0 kernel/bpf/stackmap.c:51
 stack_map_alloc+0x386/0x510 kernel/bpf/stackmap.c:117
 find_and_alloc_map kernel/bpf/syscall.c:133 [inline]
 map_create+0x524/0xff0 kernel/bpf/syscall.c:1149
 __sys_bpf+0x38b/0x780 kernel/bpf/syscall.c:5017
 __do_sys_bpf kernel/bpf/syscall.c:5139 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5137 [inline]
 __x64_sys_bpf+0x78/0x90 kernel/bpf/syscall.c:5137
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

Last potentially related work creation:
 kasan_save_stack+0x3a/0x60 mm/kasan/common.c:46
 __kasan_record_aux_stack+0xb2/0xc0 mm/kasan/generic.c:486
 kvfree_call_rcu+0x103/0x890 kernel/rcu/tree.c:3405
 drop_sysctl_table+0x359/0x4e0 fs/proc/proc_sysctl.c:1731
 unregister_sysctl_table+0x85/0x130 fs/proc/proc_sysctl.c:1769
 __ip_vs_lblc_exit+0x5e/0xb0 net/netfilter/ipvs/ip_vs_lblc.c:588
 ops_exit_list net/core/net_namespace.c:172 [inline]
 setup_net+0x91b/0xbd0 net/core/net_namespace.c:368
 copy_net_ns+0x33e/0x5b0 net/core/net_namespace.c:508
 create_new_namespaces+0x3ce/0x700 kernel/nsproxy.c:110
 copy_namespaces+0x3ae/0x410 kernel/nsproxy.c:178
 copy_process+0x199b/0x4070 kernel/fork.c:2361
 kernel_clone+0x24b/0x900 kernel/fork.c:2765
 __do_sys_clone kernel/fork.c:2906 [inline]
 __se_sys_clone kernel/fork.c:2890 [inline]
 __x64_sys_clone+0x1a7/0x220 kernel/fork.c:2890
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

Second to last potentially related work creation:
 kasan_save_stack+0x3a/0x60 mm/kasan/common.c:46
 __kasan_record_aux_stack+0xb2/0xc0 mm/kasan/generic.c:486
 call_rcu+0x14f/0x950 kernel/rcu/tree.c:2849
 nf_hook_entries_free net/netfilter/core.c:88 [inline]
 __nf_register_net_hook+0x787/0x910 net/netfilter/core.c:445
 nf_register_net_hook+0xae/0x190 net/netfilter/core.c:566
 nf_register_net_hooks+0x40/0x1a0 net/netfilter/core.c:582
 ip6t_register_table+0x51c/0x7c0 net/ipv6/netfilter/ip6_tables.c:1791
 ip6table_mangle_table_init+0x3d/0x60 net/ipv6/netfilter/ip6table_mangle.c:84
 xt_find_table_lock+0x220/0x360 net/netfilter/x_tables.c:1282
 xt_request_find_table_lock+0x22/0x100 net/netfilter/x_tables.c:1307
 get_info net/ipv6/netfilter/ip6_tables.c:984 [inline]
 do_ip6t_get_ctl+0x5e8/0x11c0 net/ipv6/netfilter/ip6_tables.c:1672
 nf_getsockopt+0x25e/0x280 net/netfilter/nf_sockopt.c:116
 ipv6_getsockopt+0x22f/0x2e0 net/ipv6/ipv6_sockglue.c:1512
 __sys_getsockopt+0x1b0/0x230 net/socket.c:2332
 __do_sys_getsockopt net/socket.c:2347 [inline]
 __se_sys_getsockopt net/socket.c:2344 [inline]
 __x64_sys_getsockopt+0xb1/0xc0 net/socket.c:2344
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

The buggy address belongs to the object at ffff888056c0b400
 which belongs to the cache kmalloc-cg-128 of size 128
The buggy address is located 96 bytes inside of
 128-byte region [ffff888056c0b400, ffff888056c0b480)

The buggy address belongs to the physical page:
page:ffffea00015b02c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x56c0b
memcg:ffff888030757501
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 ffffea0001658780 dead000000000002 ffff888018442a00
raw: 0000000000000000 0000000000100010 00000001ffffffff ffff888030757501
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 6299, tgid 6299 (syz-executor), ts 173079318329, free_ts 173079078017
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x173/0x1a0 mm/page_alloc.c:2560
 prep_new_page mm/page_alloc.c:2567 [inline]
 get_page_from_freelist+0x206b/0x2180 mm/page_alloc.c:4358
 __alloc_pages+0x1ec/0x4f0 mm/page_alloc.c:5658
 alloc_slab_page+0x5d/0x180 mm/slub.c:1799
 allocate_slab mm/slub.c:1944 [inline]
 new_slab+0x87/0x2d0 mm/slub.c:1997
 ___slab_alloc+0xbc5/0x1240 mm/slub.c:3154
 __slab_alloc mm/slub.c:3240 [inline]
 slab_alloc_node mm/slub.c:3325 [inline]
 __kmem_cache_alloc_node+0x126/0x270 mm/slub.c:3398
 __do_kmalloc_node mm/slab_common.c:935 [inline]
 __kmalloc_node+0xa2/0x240 mm/slab_common.c:943
 kmalloc_node include/linux/slab.h:589 [inline]
 kvmalloc_node+0x6c/0x180 mm/util.c:581
 kvmalloc include/linux/slab.h:716 [inline]
 kvzalloc include/linux/slab.h:724 [inline]
 allocate_hook_entries_size net/netfilter/core.c:61 [inline]
 nf_hook_entries_grow+0x31a/0x760 net/netfilter/core.c:128
 __nf_register_net_hook+0x2c9/0x910 net/netfilter/core.c:423
 nf_register_net_hook+0xae/0x190 net/netfilter/core.c:566
 nf_register_net_hooks+0x40/0x1a0 net/netfilter/core.c:582
 ipt_register_table+0x516/0x7b0 net/ipv4/netfilter/ip_tables.c:1780
 iptable_security_table_init+0x3d/0x60 net/ipv4/netfilter/iptable_security.c:46
 xt_find_table_lock+0x220/0x360 net/netfilter/x_tables.c:1282
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1487 [inline]
 free_pcp_prepare mm/page_alloc.c:1537 [inline]
 free_unref_page_prepare+0x8e5/0x9e0 mm/page_alloc.c:3414
 free_unref_page+0x2e/0x3f0 mm/page_alloc.c:3509
 __vunmap+0x874/0xa40 mm/vmalloc.c:2783
 copy_entries_to_user net/ipv4/netfilter/ip_tables.c:866 [inline]
 get_entries net/ipv4/netfilter/ip_tables.c:1022 [inline]
 do_ipt_get_ctl+0xe89/0x11a0 net/ipv4/netfilter/ip_tables.c:1667
 nf_getsockopt+0x25e/0x280 net/netfilter/nf_sockopt.c:116
 ip_getsockopt+0x19b/0x230 net/ipv4/ip_sockglue.c:1826
 __sys_getsockopt+0x1b0/0x230 net/socket.c:2332
 __do_sys_getsockopt net/socket.c:2347 [inline]
 __se_sys_getsockopt net/socket.c:2344 [inline]
 __x64_sys_getsockopt+0xb1/0xc0 net/socket.c:2344
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

Memory state around the buggy address:
 ffff888056c0b300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc
 ffff888056c0b380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888056c0b400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc
                                                                ^
 ffff888056c0b480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888056c0b500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc
==================================================================
----------------
Code disassembly (best guess):
   0:	c3                   	ret
   1:	44 89 e1             	mov    %r12d,%ecx
   4:	80 e1 07             	and    $0x7,%cl
   7:	fe c1                	inc    %cl
   9:	38 c1                	cmp    %al,%cl
   b:	0f 8c 61 ff ff ff    	jl     0xffffff72
  11:	4c 89 e7             	mov    %r12,%rdi
  14:	e8 31 f9 02 00       	call   0x2f94a
  19:	e9 54 ff ff ff       	jmp    0xffffff72
  1e:	66 2e 0f 1f 84 00 00 	cs nopw 0x0(%rax,%rax,1)
  25:	00 00 00
  28:	66 90                	xchg   %ax,%ax
* 2a:	55                   	push   %rbp <-- trapping instruction
  2b:	41 57                	push   %r15
  2d:	41 56                	push   %r14
  2f:	41 55                	push   %r13
  31:	41 54                	push   %r12
  33:	53                   	push   %rbx
  34:	48 83 ec 28          	sub    $0x28,%rsp
  38:	45 89 c4             	mov    %r8d,%r12d
  3b:	49 89 cd             	mov    %rcx,%r13
  3e:	48                   	rex.W
  3f:	89                   	.byte 0x89