input: syz1 as /devices/virtual/input/input123 ================================================================== BUG: KASAN: slab-use-after-free in string_nocheck lib/vsprintf.c:648 [inline] BUG: KASAN: slab-use-after-free in string+0x216/0x2d0 lib/vsprintf.c:730 Read of size 1 at addr ffff88807f4ca758 by task syz.0.6124/24141 CPU: 1 UID: 0 PID: 24141 Comm: syz.0.6124 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description+0x55/0x1e0 mm/kasan/report.c:378 print_report+0x58/0x70 mm/kasan/report.c:482 kasan_report+0x117/0x150 mm/kasan/report.c:595 string_nocheck lib/vsprintf.c:648 [inline] string+0x216/0x2d0 lib/vsprintf.c:730 vsnprintf+0x74a/0xef0 lib/vsprintf.c:2949 seq_vprintf fs/seq_file.c:392 [inline] seq_printf+0x188/0x290 fs/seq_file.c:407 input_devices_seq_show+0x10f/0x640 drivers/input/input.c:1178 traverse+0x229/0x620 fs/seq_file.c:112 seq_read_iter+0xb6a/0xca0 fs/seq_file.c:196 seq_read+0x367/0x480 fs/seq_file.c:163 pde_read fs/proc/inode.c:308 [inline] proc_reg_read+0x1e9/0x2e0 fs/proc/inode.c:320 do_loop_readv_writev fs/read_write.c:848 [inline] vfs_readv+0x57c/0x850 fs/read_write.c:1021 do_preadv fs/read_write.c:1133 [inline] __do_sys_preadv fs/read_write.c:1180 [inline] __se_sys_preadv fs/read_write.c:1175 [inline] __x64_sys_preadv+0x19c/0x2b0 fs/read_write.c:1175 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f31cd79e159 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f31ce5a6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 RAX: ffffffffffffffda RBX: 00007f31cda25fa0 RCX: 00007f31cd79e159 RDX: 0000000000000001 RSI: 00002000000000c0 RDI: 0000000000000006 RBP: 00007f31cd83503b R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000008000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f31cda26038 R14: 00007f31cda25fa0 R15: 00007f31cdb4fa48 Allocated by task 10456: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5414 [inline] __kmalloc_node_track_caller_noprof+0x4b4/0x720 mm/slub.c:5545 kmalloc_reserve net/core/skbuff.c:637 [inline] __alloc_skb+0x2c1/0x7a0 net/core/skbuff.c:715 alloc_skb include/linux/skbuff.h:1384 [inline] nsim_dev_trap_skb_build drivers/net/netdevsim/dev.c:744 [inline] nsim_dev_trap_report drivers/net/netdevsim/dev.c:801 [inline] nsim_dev_trap_report_work+0x25f/0xb40 drivers/net/netdevsim/dev.c:847 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Freed by task 10456: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2748 [inline] slab_free mm/slub.c:6508 [inline] kfree+0x1c5/0x650 mm/slub.c:6801 skb_kfree_head net/core/skbuff.c:1083 [inline] skb_free_head net/core/skbuff.c:1095 [inline] skb_release_data+0x85e/0xab0 net/core/skbuff.c:1122 skb_release_all net/core/skbuff.c:1197 [inline] __kfree_skb+0x5d/0x210 net/core/skbuff.c:1211 nsim_dev_trap_report drivers/net/netdevsim/dev.c:817 [inline] nsim_dev_trap_report_work+0x7ac/0xb40 drivers/net/netdevsim/dev.c:847 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 The buggy address belongs to the object at ffff88807f4ca000 which belongs to the cache kmalloc-4k of size 4096 The buggy address is located 1880 bytes inside of freed 4096-byte region [ffff88807f4ca000, ffff88807f4cb000) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7f4c8 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801b042140 dead000000000100 dead000000000122 raw: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000 head: 00fff00000000040 ffff88801b042140 dead000000000100 dead000000000122 head: 0000000000000000 0000000000040004 00000000f5000000 0000000000000000 head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 20086, tgid 20086 (kworker/u8:1), ts 881182593628 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1871 prep_new_page mm/page_alloc.c:1879 [inline] get_page_from_freelist+0x2209/0x2280 mm/page_alloc.c:3943 __alloc_frozen_pages_noprof+0x217/0x5a0 mm/page_alloc.c:5436 alloc_slab_page mm/slub.c:3347 [inline] allocate_slab+0x7d/0x620 mm/slub.c:3462 new_slab mm/slub.c:3513 [inline] refill_objects+0x2d5/0x350 mm/slub.c:7417 refill_sheaf mm/slub.c:2885 [inline] __pcs_replace_empty_main+0x2c8/0x6c0 mm/slub.c:4774 alloc_from_pcs mm/slub.c:4850 [inline] slab_alloc_node mm/slub.c:4984 [inline] __do_kmalloc_node mm/slub.c:5413 [inline] __kmalloc_node_track_caller_noprof+0x548/0x720 mm/slub.c:5545 kmalloc_reserve net/core/skbuff.c:637 [inline] __alloc_skb+0x2c1/0x7a0 net/core/skbuff.c:715 alloc_skb include/linux/skbuff.h:1384 [inline] nsim_dev_trap_skb_build drivers/net/netdevsim/dev.c:744 [inline] nsim_dev_trap_report drivers/net/netdevsim/dev.c:801 [inline] nsim_dev_trap_report_work+0x25f/0xb40 drivers/net/netdevsim/dev.c:847 process_one_work kernel/workqueue.c:3396 [inline] process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560 kthread+0x38b/0x480 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 page last free pid 5602 tgid 5602 ts 881127696196 stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] __free_pages_prepare mm/page_alloc.c:1418 [inline] __free_frozen_pages+0xc93/0xd90 mm/page_alloc.c:2962 __folio_put+0x4b3/0x590 mm/folio.c:105 folio_put include/linux/mm.h:2160 [inline] put_page include/linux/mm.h:2229 [inline] put_netmem include/net/netmem.h:394 [inline] skb_page_unref include/linux/skbuff_ref.h:43 [inline] __skb_frag_unref include/linux/skbuff_ref.h:56 [inline] skb_release_data+0x573/0xab0 net/core/skbuff.c:1116 skb_release_all net/core/skbuff.c:1197 [inline] __kfree_skb+0x5d/0x210 net/core/skbuff.c:1211 tcp_clean_rtx_queue net/ipv4/tcp_input.c:3698 [inline] tcp_ack+0x28f7/0x8050 net/ipv4/tcp_input.c:4400 tcp_rcv_established+0x1527/0x2910 net/ipv4/tcp_input.c:6589 tcp_v4_do_rcv+0x727/0x13b0 net/ipv4/tcp_ipv4.c:1854 tcp_v4_rcv+0x27d4/0x3170 net/ipv4/tcp_ipv4.c:2248 ip_protocol_deliver_rcu+0x21d/0x440 net/ipv4/ip_input.c:207 ip_local_deliver_finish+0x3bb/0x6f0 net/ipv4/ip_input.c:241 NF_HOOK+0x336/0x3c0 include/linux/netfilter.h:325 dst_input include/net/dst.h:481 [inline] ip_sublist_rcv_finish+0x1f0/0x240 net/ipv4/ip_input.c:623 ip_list_rcv_finish net/ipv4/ip_input.c:675 [inline] ip_sublist_rcv+0x767/0xa70 net/ipv4/ip_input.c:683 ip_list_rcv+0x3ec/0x440 net/ipv4/ip_input.c:717 __netif_receive_skb_list_ptype net/core/dev.c:6308 [inline] __netif_receive_skb_list_core+0x804/0x830 net/core/dev.c:6354 __netif_receive_skb_list net/core/dev.c:6406 [inline] netif_receive_skb_list_internal+0x995/0xcf0 net/core/dev.c:6497 Memory state around the buggy address: ffff88807f4ca600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88807f4ca680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88807f4ca700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88807f4ca780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88807f4ca800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================