================================================================== BUG: KASAN: slab-out-of-bounds in __write_once_size include/linux/compiler.h:295 [inline] BUG: KASAN: slab-out-of-bounds in __hlist_del include/linux/list.h:789 [inline] BUG: KASAN: slab-out-of-bounds in detach_timer kernel/time/timer.c:824 [inline] BUG: KASAN: slab-out-of-bounds in detach_if_pending+0x12d/0x330 kernel/time/timer.c:841 Write of size 8 at addr ffff8881eaaef1c0 by task kworker/u4:1/9 CPU: 0 PID: 9 Comm: kworker/u4:1 Not tainted 5.4.292-syzkaller-00021-gcd8e74fa0fa3 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Workqueue: netns cleanup_net Call Trace: __dump_stack+0x1e/0x20 lib/dump_stack.c:77 dump_stack+0x15b/0x1b8 lib/dump_stack.c:118 print_address_description+0x8d/0x4c0 mm/kasan/report.c:384 __kasan_report+0xef/0x120 mm/kasan/report.c:516 kasan_report+0x30/0x60 mm/kasan/common.c:653 __asan_report_store8_noabort+0x17/0x20 mm/kasan/generic_report.c:137 __write_once_size include/linux/compiler.h:295 [inline] __hlist_del include/linux/list.h:789 [inline] detach_timer kernel/time/timer.c:824 [inline] detach_if_pending+0x12d/0x330 kernel/time/timer.c:841 del_timer+0x75/0xb0 kernel/time/timer.c:1232 addrconf_del_rs_timer net/ipv6/addrconf.c:305 [inline] addrconf_ifdown+0x601/0x17e0 net/ipv6/addrconf.c:3834 addrconf_notify+0x399/0xeb0 net/ipv6/addrconf.c:3698 notifier_call_chain kernel/notifier.c:98 [inline] __raw_notifier_call_chain kernel/notifier.c:399 [inline] raw_notifier_call_chain+0xa0/0x120 kernel/notifier.c:406 call_netdevice_notifiers_info net/core/dev.c:1670 [inline] call_netdevice_notifiers_extack net/core/dev.c:1682 [inline] call_netdevice_notifiers net/core/dev.c:1696 [inline] dev_close_many+0x2c4/0x440 net/core/dev.c:1439 rollback_registered_many+0x451/0xf40 net/core/dev.c:8627 unregister_netdevice_many+0x4b/0x290 net/core/dev.c:9805 ip_tunnel_delete_nets+0x343/0x390 net/ipv4/ip_tunnel.c:1129 ipgre_tap_exit_batch_net+0x22/0x30 net/ipv4/ip_gre.c:1709 ops_exit_list net/core/net_namespace.c:187 [inline] cleanup_net+0x5fd/0xb40 net/core/net_namespace.c:612 process_one_work+0x73b/0xcc0 kernel/workqueue.c:2290 worker_thread+0xa5c/0x13b0 kernel/workqueue.c:2436 kthread+0x31e/0x3a0 kernel/kthread.c:288 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:354 The buggy address belongs to the page: page:ffffea0007aabb00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 compound_mapcount: 0 flags: 0x8000000000010000(head) raw: 8000000000010000 dead000000000100 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0x140dc0(GFP_USER|__GFP_COMP|__GFP_ZERO) set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook mm/page_alloc.c:2165 [inline] prep_new_page+0x35e/0x370 mm/page_alloc.c:2171 get_page_from_freelist+0x1296/0x1310 mm/page_alloc.c:3794 __alloc_pages_nodemask+0x202/0x4b0 mm/page_alloc.c:4894 __alloc_pages include/linux/gfp.h:503 [inline] __alloc_pages_node include/linux/gfp.h:516 [inline] alloc_pages_node include/linux/gfp.h:530 [inline] kmalloc_order mm/slab_common.c:1342 [inline] kmalloc_order_trace+0x31/0x100 mm/slab_common.c:1358 kmalloc_large include/linux/slab.h:485 [inline] kmalloc include/linux/slab.h:549 [inline] kzalloc include/linux/slab.h:690 [inline] tipc_nametbl_init+0x99/0x260 net/tipc/name_table.c:738 tipc_init_net+0x237/0x370 net/tipc/core.c:74 ops_init+0x1ba/0x4a0 net/core/net_namespace.c:141 setup_net+0x20c/0x9b0 net/core/net_namespace.c:348 copy_net_ns+0x314/0x520 net/core/net_namespace.c:489 create_new_namespaces+0x49c/0x590 kernel/nsproxy.c:103 unshare_nsproxy_namespaces+0x120/0x170 kernel/nsproxy.c:202 ksys_unshare+0x4a4/0x7d0 kernel/fork.c:2908 __do_sys_unshare kernel/fork.c:2976 [inline] __se_sys_unshare kernel/fork.c:2974 [inline] __x64_sys_unshare+0x38/0x40 kernel/fork.c:2974 do_syscall_64+0xcf/0x170 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x5c/0xc1 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1176 [inline] __free_pages_ok+0x7e4/0x910 mm/page_alloc.c:1438 free_the_page mm/page_alloc.c:4956 [inline] __free_pages+0x8c/0x110 mm/page_alloc.c:4962 kfree+0x1ca/0x260 mm/slub.c:4068 kvfree+0x4c/0x50 mm/util.c:625 netdev_freemem+0x3f/0x60 net/core/dev.c:9583 netdev_release+0x7f/0xb0 net/core/net-sysfs.c:1743 device_release+0x70/0x1a0 drivers/base/core.c:1776 kobject_cleanup lib/kobject.c:716 [inline] kobject_release lib/kobject.c:747 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1fe/0x2c0 lib/kobject.c:764 put_device+0x1f/0x30 drivers/base/core.c:3010 free_netdev+0x27e/0x320 net/core/dev.c:9746 tun_set_iff+0x87c/0xe00 drivers/net/tun.c:2924 __tun_chr_ioctl+0x771/0x18a0 drivers/net/tun.c:3187 tun_chr_ioctl+0x2a/0x40 drivers/net/tun.c:3470 do_vfs_ioctl+0x753/0x13f0 fs/ioctl.c:47 ksys_ioctl fs/ioctl.c:742 [inline] __do_sys_ioctl fs/ioctl.c:749 [inline] __se_sys_ioctl fs/ioctl.c:747 [inline] __x64_sys_ioctl+0xe1/0x120 fs/ioctl.c:747 do_syscall_64+0xcf/0x170 arch/x86/entry/common.c:290 Memory state around the buggy address: ffff8881eaaef080: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe ffff8881eaaef100: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe >ffff8881eaaef180: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe ^ ffff8881eaaef200: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe ffff8881eaaef280: fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe fe ================================================================== device bridge_slave_1 left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state device bridge_slave_0 left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state device bridge_slave_1 left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state device bridge_slave_0 left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state device bridge_slave_1 left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state device bridge_slave_0 left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state device bridge_slave_1 left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state device bridge_slave_0 left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state device bridge_slave_1 left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state device bridge_slave_0 left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state device bridge_slave_1 left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state device bridge_slave_0 left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state