==================================================================
BUG: KASAN: slab-out-of-bounds in __bpf_get_stackid+0x6c7/0x900 kernel/bpf/stackmap.c:271
Write of size 48 at addr ffff88802b7d4690 by task syz.2.9565/4802

CPU: 1 PID: 4802 Comm: syz.2.9565 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:364 [inline]
 print_report+0xa8/0x210 mm/kasan/report.c:468
 kasan_report+0x117/0x150 mm/kasan/report.c:581
 check_region_inline mm/kasan/generic.c:-1 [inline]
 kasan_check_range+0x241/0x290 mm/kasan/generic.c:187
 __asan_memcpy+0x40/0x70 mm/kasan/shadow.c:106
 __bpf_get_stackid+0x6c7/0x900 kernel/bpf/stackmap.c:271
 ____bpf_get_stackid_pe kernel/bpf/stackmap.c:362 [inline]
 bpf_get_stackid_pe+0x343/0x410 kernel/bpf/stackmap.c:331
 bpf_prog_6611c23d801ea08d+0x29/0x3e
 bpf_dispatcher_nop_func include/linux/bpf.h:1226 [inline]
 __bpf_prog_run include/linux/filter.h:617 [inline]
 bpf_prog_run include/linux/filter.h:624 [inline]
 bpf_overflow_handler+0x1fc/0x510 kernel/events/core.c:10584
 __perf_event_overflow+0x461/0x660 kernel/events/core.c:9720
 perf_event_overflow kernel/events/core.c:9741 [inline]
 perf_swevent_hrtimer+0x437/0x610 kernel/events/core.c:11230
 __run_hrtimer kernel/time/hrtimer.c:1754 [inline]
 __hrtimer_run_queues+0x4e8/0xc10 kernel/time/hrtimer.c:1818
 hrtimer_interrupt+0x39d/0x980 kernel/time/hrtimer.c:1880
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1077 [inline]
 __sysvec_apic_timer_interrupt+0xfb/0x3b0 arch/x86/kernel/apic/apic.c:1094
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
 sysvec_apic_timer_interrupt+0x9f/0xc0 arch/x86/kernel/apic/apic.c:1088
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:__perf_event_set_bpf_prog+0x3db/0x680 kernel/events/core.c:10713
Code: ff e8 89 07 d8 ff 45 08 fe 74 0e 85 ed 75 2a e8 5b 04 d8 ff e9 88 00 00 00 e8 51 04 d8 ff eb 05 e8 4a 04 d8 ff b8 ea ff ff ff <48> 83 c4 18 5b 41 5c 41 5d 41 5e 41 5f 5d c3 48 8b 7c 24 08 e8 8c
RSP: 0018:ffffc9000b837bd0 EFLAGS: 00000246
RAX: 0000000000000000 RBX: ffff888030b3ce68 RCX: 0000000000080000
RDX: ffffc9000d9f3000 RSI: 00000000000007c2 RDI: ffff888030b3ce78
RBP: 0000000000000000 R08: ffff8880621b2f5f R09: 1ffff1100c4365eb
R10: dffffc0000000000 R11: ffffed100c4365ec R12: dffffc0000000000
R13: ffff888030b3ce70 R14: ffff888030b3ce58 R15: ffffffff81aedb30
 _perf_ioctl kernel/events/core.c:6016 [inline]
 perf_ioctl+0x9c5/0x24b0 kernel/events/core.c:6076
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:871 [inline]
 __se_sys_ioctl+0xfd/0x170 fs/ioctl.c:857
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7f1cad99e199
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f1cae8ee028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f1cadc25fa0 RCX: 00007f1cad99e199
RDX: 0000000000000005 RSI: 0000000040042408 RDI: 0000000000000006
RBP: 00007f1cada358e0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f1cadc26038 R14: 00007f1cadc25fa0 R15: 00007ffcc82b56b8
 </TASK>

Allocated by task 4802:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4e/0x70 mm/kasan/common.c:53
 ____kasan_kmalloc mm/kasan/common.c:375 [inline]
 __kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:384
 kasan_kmalloc include/linux/kasan.h:198 [inline]
 __do_kmalloc_node mm/slab_common.c:1007 [inline]
 __kmalloc_node+0xb6/0x240 mm/slab_common.c:1014
 kmalloc_node include/linux/slab.h:620 [inline]
 __bpf_map_area_alloc kernel/bpf/syscall.c:303 [inline]
 bpf_map_area_alloc+0x5e/0x110 kernel/bpf/syscall.c:316
 prealloc_elems_and_freelist+0x86/0x1c0 kernel/bpf/stackmap.c:51
 stack_map_alloc+0x32b/0x4b0 kernel/bpf/stackmap.c:114
 map_create+0x877/0x12f0 kernel/bpf/syscall.c:1247
 __sys_bpf+0x651/0x890 kernel/bpf/syscall.c:5476
 __do_sys_bpf kernel/bpf/syscall.c:5598 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5596 [inline]
 __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5596
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

Last potentially related work creation:
 kasan_save_stack+0x3e/0x60 mm/kasan/common.c:46
 __kasan_record_aux_stack+0xaf/0xc0 mm/kasan/generic.c:492
 __call_rcu_common kernel/rcu/tree.c:2721 [inline]
 call_rcu+0x153/0x900 kernel/rcu/tree.c:2837
 nf_unregister_net_hook net/netfilter/core.c:-1 [inline]
 nf_unregister_net_hooks+0xcb/0x130 net/netfilter/core.c:613
 brnf_exit_net+0x61/0x120 net/bridge/br_netfilter_hooks.c:1312
 ops_exit_list net/core/net_namespace.c:173 [inline]
 cleanup_net+0x6f7/0xb00 net/core/net_namespace.c:656
 process_one_work kernel/workqueue.c:2657 [inline]
 process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734
 worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293

The buggy address belongs to the object at ffff88802b7d4680
 which belongs to the cache kmalloc-cg-64 of size 64
The buggy address is located 16 bytes inside of
 allocated 40-byte region [ffff88802b7d4680, ffff88802b7d46a8)

The buggy address belongs to the physical page:
page:ffffea0000adf500 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2b7d4
memcg:ffff888024cf4e01
anon flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000800 ffff888017c4da00 ffffea0000b31fc0 0000000000000005
raw: 0000000000000000 0000000080200020 00000001ffffffff ffff888024cf4e01
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 25925, tgid 25922 (syz.2.6016), ts 1213433439079, free_ts 1213299183436
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x1c1/0x200 mm/page_alloc.c:1582
 prep_new_page mm/page_alloc.c:1589 [inline]
 get_page_from_freelist+0x2181/0x22a0 mm/page_alloc.c:3221
 __alloc_pages+0x1f0/0x460 mm/page_alloc.c:4501
 alloc_slab_page+0x5d/0x180 mm/slub.c:1881
 allocate_slab mm/slub.c:2028 [inline]
 new_slab+0x87/0x2d0 mm/slub.c:2081
 ___slab_alloc+0xc5c/0x12f0 mm/slub.c:3253
 __slab_alloc mm/slub.c:3339 [inline]
 __slab_alloc_node mm/slub.c:3392 [inline]
 slab_alloc_node mm/slub.c:3485 [inline]
 __kmem_cache_alloc_node+0x11f/0x250 mm/slub.c:3534
 kmalloc_trace+0x2a/0xe0 mm/slab_common.c:1098
 kmalloc include/linux/slab.h:600 [inline]
 alloc_fdtable+0xca/0x2c0 fs/file.c:147
 dup_fd+0x747/0xa20 fs/file.c:346
 copy_files+0xaf/0x110 kernel/fork.c:1802
 copy_process+0x157d/0x3da0 kernel/fork.c:2498
 kernel_clone+0x24b/0x8a0 kernel/fork.c:2919
 __do_sys_clone kernel/fork.c:3062 [inline]
 __se_sys_clone kernel/fork.c:3046 [inline]
 __x64_sys_clone+0x1b7/0x230 kernel/fork.c:3046
 do_syscall_x64 arch/x86/entry/common.c:46 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1182 [inline]
 free_unref_page_prepare+0x7d7/0x8f0 mm/page_alloc.c:2366
 free_unref_page_list+0xbe/0x860 mm/page_alloc.c:2505
 release_pages+0x208a/0x2300 mm/swap.c:1022
 tlb_batch_pages_flush mm/mmu_gather.c:99 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:294 [inline]
 tlb_flush_mmu+0x379/0x510 mm/mmu_gather.c:301
 tlb_finish_mmu+0xf4/0x220 mm/mmu_gather.c:425
 exit_mmap+0x428/0xb90 mm/mmap.c:3315
 __mmput+0x118/0x3a0 kernel/fork.c:1362
 exit_mm+0x23f/0x340 kernel/exit.c:576
 do_exit+0x909/0x2530 kernel/exit.c:877
 do_group_exit+0x22d/0x2f0 kernel/exit.c:1032
 get_signal+0x12a6/0x1390 kernel/signal.c:2915
 arch_do_signal_or_restart+0xc2/0x7b0 arch/x86/kernel/signal.c:310
 exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:177
 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:213
 irqentry_exit_to_user_mode+0x9/0x30 kernel/entry/common.c:318
 exc_general_protection+0x168/0x1f0 arch/x86/kernel/traps.c:745

Memory state around the buggy address:
 ffff88802b7d4580: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
 ffff88802b7d4600: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff88802b7d4680: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc
                                  ^
 ffff88802b7d4700: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc
 ffff88802b7d4780: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
==================================================================
----------------
Code disassembly (best guess):
   0:	ff                   	ljmp   (bad)
   1:	e8 89 07 d8 ff       	call   0xffd8078f
   6:	45 08 fe             	or     %r15b,%r14b
   9:	74 0e                	je     0x19
   b:	85 ed                	test   %ebp,%ebp
   d:	75 2a                	jne    0x39
   f:	e8 5b 04 d8 ff       	call   0xffd8046f
  14:	e9 88 00 00 00       	jmp    0xa1
  19:	e8 51 04 d8 ff       	call   0xffd8046f
  1e:	eb 05                	jmp    0x25
  20:	e8 4a 04 d8 ff       	call   0xffd8046f
  25:	b8 ea ff ff ff       	mov    $0xffffffea,%eax
* 2a:	48 83 c4 18          	add    $0x18,%rsp <-- trapping instruction
  2e:	5b                   	pop    %rbx
  2f:	41 5c                	pop    %r12
  31:	41 5d                	pop    %r13
  33:	41 5e                	pop    %r14
  35:	41 5f                	pop    %r15
  37:	5d                   	pop    %rbp
  38:	c3                   	ret
  39:	48 8b 7c 24 08       	mov    0x8(%rsp),%rdi
  3e:	e8                   	.byte 0xe8
  3f:	8c                   	.byte 0x8c