==================================================================
BUG: KASAN: slab-use-after-free in read_pnet include/net/net_namespace.h:427 [inline]
BUG: KASAN: slab-use-after-free in dev_net include/linux/netdevice.h:2822 [inline]
BUG: KASAN: slab-use-after-free in xfrm_input+0x5ae2/0x7750 net/xfrm/xfrm_input.c:469
Read of size 8 at addr ffff888055b24108 by task syz.0.472/7171
CPU: 0 UID: 0 PID: 7171 Comm: syz.0.472 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0x13d/0x4b0 mm/kasan/report.c:482
kasan_report+0xdf/0x1c0 mm/kasan/report.c:595
read_pnet include/net/net_namespace.h:427 [inline]
dev_net include/linux/netdevice.h:2822 [inline]
xfrm_input+0x5ae2/0x7750 net/xfrm/xfrm_input.c:469
__input_process_payload.isra.0+0x147b/0x2290 net/xfrm/xfrm_iptfs.c:1198
iptfs_input_ordered+0x692/0x870 net/xfrm/xfrm_iptfs.c:1295
iptfs_drop_timer+0x4c7/0x710 net/xfrm/xfrm_iptfs.c:1707
__run_hrtimer kernel/time/hrtimer.c:2079 [inline]
__hrtimer_run_queues+0x448/0x9a0 kernel/time/hrtimer.c:2136
hrtimer_run_softirq+0x1ca/0x360 kernel/time/hrtimer.c:2153
handle_softirqs+0x216/0xa20 kernel/softirq.c:669
__do_softirq kernel/softirq.c:703 [inline]
invoke_softirq kernel/softirq.c:542 [inline]
__irq_exit_rcu+0x178/0x220 kernel/softirq.c:786
irq_exit_rcu+0x9/0x30 kernel/softirq.c:809
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1062 [inline]
sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1062
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:674
RIP: 0010:its_return_thunk+0x0/0x10 arch/x86/lib/retpoline.S:437
Code: cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 e9 bb e1 85 f5 cc
RSP: 0018:ffffc900052a6e88 EFLAGS: 00000246
RAX: 0000000000080000 RBX: ffff888061f6d2a8 RCX: ffffc90006561000
RDX: 0000000000080000 RSI: ffffffff81f9226a RDI: 0000000000000001
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000001
R10: ffffffff926a9d5f R11: 0000000000000000 R12: 0000000000000000
R13: ffffffff8d8225c0 R14: ffffffff9d10a300 R15: ffffffff8b228bd0
trace_timer_init include/trace/events/timer.h:33 [inline]
debug_init kernel/time/timer.c:838 [inline]
timer_init_key+0x26a/0x310 kernel/time/timer.c:881
sctp_transport_init net/sctp/transport.c:78 [inline]
sctp_transport_new+0x54b/0x760 net/sctp/transport.c:99
sctp_assoc_add_peer+0x34b/0x1550 net/sctp/associola.c:627
sctp_process_param net/sctp/sm_make_chunk.c:2574 [inline]
sctp_process_init+0x2738/0x2e50 net/sctp/sm_make_chunk.c:2400
sctp_cmd_process_init net/sctp/sm_sideeffect.c:719 [inline]
sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1406 [inline]
sctp_side_effects net/sctp/sm_sideeffect.c:1211 [inline]
sctp_do_sm+0x3ca8/0x5c30 net/sctp/sm_sideeffect.c:1182
sctp_assoc_bh_rcv+0x392/0x740 net/sctp/associola.c:1048
sctp_inq_push+0x25c/0x320 net/sctp/inqueue.c:91
sctp_backlog_rcv+0x169/0x590 net/sctp/input.c:331
sk_backlog_rcv include/net/sock.h:1194 [inline]
__release_sock+0x39d/0x440 net/core/sock.c:3341
release_sock+0x1e5/0x280 net/core/sock.c:3940
sctp_wait_for_connect+0x1ff/0x750 net/sctp/socket.c:9468
sctp_sendmsg_to_asoc+0x17fd/0x1b60 net/sctp/socket.c:1931
sctp_sendmsg+0x1144/0x22e0 net/sctp/socket.c:2086
inet_sendmsg+0x11c/0x140 net/ipv4/af_inet.c:864
sock_sendmsg_nosec net/socket.c:800 [inline]
__sock_sendmsg net/socket.c:818 [inline]
____sys_sendmsg+0xa23/0xc30 net/socket.c:2715
___sys_sendmsg+0x190/0x1e0 net/socket.c:2769
__sys_sendmmsg+0x20c/0x440 net/socket.c:2858
__do_sys_sendmmsg net/socket.c:2885 [inline]
__se_sys_sendmmsg net/socket.c:2882 [inline]
__x64_sys_sendmmsg+0x9c/0x100 net/socket.c:2882
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7effc5f9fb19
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007effc6d8f028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 00007effc6225fa0 RCX: 00007effc5f9fb19
RDX: 0000000000000001 RSI: 0000200000000300 RDI: 0000000000000004
RBP: 00007effc6037b70 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000020000014 R11: 0000000000000246 R12: 0000000000000000
R13: 00007effc6226038 R14: 00007effc6225fa0 R15: 00007fffbea305e8
Allocated by task 5769:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
unpoison_slab_object mm/kasan/common.c:351 [inline]
__kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:377
kasan_slab_alloc include/linux/kasan.h:253 [inline]
slab_post_alloc_hook mm/slub.c:4720 [inline]
slab_alloc_node mm/slub.c:5033 [inline]
kmem_cache_alloc_node_noprof+0x282/0x6e0 mm/slub.c:5105
kmalloc_reserve+0x148/0x350 net/core/skbuff.c:616
__alloc_skb+0x185/0x710 net/core/skbuff.c:716
__pskb_copy_fclone+0xfa/0xf40 net/core/skbuff.c:2229
__pskb_copy include/linux/skbuff.h:1454 [inline]
pskb_copy include/linux/skbuff.h:3863 [inline]
nf_dup_ipv4+0x1a2/0x8b0 net/ipv4/netfilter/nf_dup_ipv4.c:64
tee_tg4+0x10c/0x170 net/netfilter/xt_TEE.c:42
ipt_do_table+0xc41/0x1b10 net/ipv4/netfilter/ip_tables.c:345
nf_hook_entry_hookfn include/linux/netfilter.h:165 [inline]
nf_hook_slow+0xbf/0x220 net/netfilter/core.c:633
nf_hook include/linux/netfilter.h:280 [inline]
__ip_local_out+0x541/0xb80 net/ipv4/ip_output.c:120
ip_local_out+0x2a/0x1f0 net/ipv4/ip_output.c:129
__ip_queue_xmit+0x876/0x1f50 net/ipv4/ip_output.c:533
__tcp_transmit_skb+0x34d9/0x4f00 net/ipv4/tcp_output.c:1772
__tcp_send_ack.part.0+0x4e4/0x940 net/ipv4/tcp_output.c:4577
__tcp_send_ack net/ipv4/tcp_output.c:4583 [inline]
tcp_send_ack+0x84/0xa0 net/ipv4/tcp_output.c:4583
__tcp_ack_snd_check+0x210/0xa10 net/ipv4/tcp_input.c:6194
tcp_ack_snd_check net/ipv4/tcp_input.c:6248 [inline]
tcp_ack_snd_check net/ipv4/tcp_input.c:6242 [inline]
tcp_rcv_established+0xcf1/0x3900 net/ipv4/tcp_input.c:6744
tcp_v4_do_rcv+0xbc8/0x1270 net/ipv4/tcp_ipv4.c:1859
tcp_v4_rcv+0x2eb0/0x4810 net/ipv4/tcp_ipv4.c:2253
ip_protocol_deliver_rcu+0xba/0x4d0 net/ipv4/ip_input.c:207
ip_local_deliver_finish+0x3fb/0x6e0 net/ipv4/ip_input.c:241
NF_HOOK include/linux/netfilter.h:325 [inline]
NF_HOOK include/linux/netfilter.h:319 [inline]
ip_local_deliver+0x1a3/0x200 net/ipv4/ip_input.c:262
dst_input include/net/dst.h:481 [inline]
ip_rcv_finish net/ipv4/ip_input.c:492 [inline]
NF_HOOK include/linux/netfilter.h:325 [inline]
NF_HOOK include/linux/netfilter.h:319 [inline]
ip_rcv+0x33a/0x3c0 net/ipv4/ip_input.c:612
__netif_receive_skb_one_core+0x197/0x1e0 net/core/dev.c:6433
__netif_receive_skb+0x1f/0x120 net/core/dev.c:6546
process_backlog+0x487/0x1600 net/core/dev.c:6897
__napi_poll.constprop.0+0xaf/0x450 net/core/dev.c:7966
napi_poll net/core/dev.c:8029 [inline]
net_rx_action+0xa40/0xf20 net/core/dev.c:8186
handle_softirqs+0x216/0xa20 kernel/softirq.c:669
do_softirq kernel/softirq.c:569 [inline]
do_softirq+0xaf/0xf0 kernel/softirq.c:556
__local_bh_enable_ip+0xff/0x120 kernel/softirq.c:473
local_bh_enable include/linux/bottom_half.h:33 [inline]
rcu_read_unlock_bh include/linux/rcupdate.h:923 [inline]
__dev_queue_xmit+0xa43/0x48d0 net/core/dev.c:5121
dev_queue_xmit include/linux/netdevice.h:3483 [inline]
neigh_hh_output include/net/neighbour.h:538 [inline]
neigh_output include/net/neighbour.h:552 [inline]
ip_finish_output2+0xfa4/0x2740 net/ipv4/ip_output.c:236
__ip_finish_output.part.0+0x43b/0x6f0 net/ipv4/ip_output.c:314
__ip_finish_output net/ipv4/ip_output.c:302 [inline]
ip_finish_output net/ipv4/ip_output.c:324 [inline]
NF_HOOK_COND include/linux/netfilter.h:314 [inline]
ip_output+0x392/0xc00 net/ipv4/ip_output.c:437
dst_output include/net/dst.h:471 [inline]
ip_local_out+0x193/0x1f0 net/ipv4/ip_output.c:131
__ip_queue_xmit+0x876/0x1f50 net/ipv4/ip_output.c:533
__tcp_transmit_skb+0x34d9/0x4f00 net/ipv4/tcp_output.c:1772
tcp_transmit_skb net/ipv4/tcp_output.c:1790 [inline]
tcp_write_xmit+0x1133/0x84a0 net/ipv4/tcp_output.c:3126
tcp_sendmsg_locked+0x396a/0x46b0 net/ipv4/tcp.c:1405
tcp_sendmsg+0x2e/0x50 net/ipv4/tcp.c:1462
inet_sendmsg+0xb9/0x140 net/ipv4/af_inet.c:864
sock_sendmsg_nosec net/socket.c:800 [inline]
__sock_sendmsg net/socket.c:818 [inline]
sock_write_iter+0x4fd/0x5d0 net/socket.c:1269
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x6af/0x1050 fs/read_write.c:687
ksys_write+0x1f8/0x250 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 5769:
kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
kasan_save_track+0x14/0x30 mm/kasan/common.c:78
kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:264 [inline]
__kasan_slab_free+0x5f/0x80 mm/kasan/common.c:296
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2780 [inline]
slab_free mm/slub.c:6630 [inline]
kfree+0x22b/0x6d0 mm/slub.c:6923
skb_kfree_head net/core/skbuff.c:1084 [inline]
skb_free_head+0xb9/0x160 net/core/skbuff.c:1096
skb_release_data+0x698/0x860 net/core/skbuff.c:1124
skb_release_all net/core/skbuff.c:1188 [inline]
__kfree_skb+0x4f/0x70 net/core/skbuff.c:1202
tcp_data_queue+0x1964/0x4fa0 net/ipv4/tcp_input.c:5655
tcp_rcv_established+0xb96/0x3900 net/ipv4/tcp_input.c:6741
tcp_v4_do_rcv+0xbc8/0x1270 net/ipv4/tcp_ipv4.c:1859
sk_backlog_rcv include/net/sock.h:1194 [inline]
__release_sock+0x355/0x440 net/core/sock.c:3341
release_sock+0x1e5/0x280 net/core/sock.c:3940
tcp_sendmsg+0x38/0x50 net/ipv4/tcp.c:1463
inet_sendmsg+0xb9/0x140 net/ipv4/af_inet.c:864
sock_sendmsg_nosec net/socket.c:800 [inline]
__sock_sendmsg net/socket.c:818 [inline]
sock_write_iter+0x4fd/0x5d0 net/socket.c:1269
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x6af/0x1050 fs/read_write.c:687
ksys_write+0x1f8/0x250 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff888055b24000
which belongs to the cache skbuff_small_head of size 704
The buggy address is located 264 bytes inside of
freed 704-byte region [ffff888055b24000, ffff888055b242c0)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x55b24
head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff888100a82280 dead000000000100 dead000000000122
raw: 0000000000000000 0000000200130013 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff888100a82280 dead000000000100 dead000000000122
head: 0000000000000000 0000000200130013 00000000f5000000 0000000000000000
head: 00fff00000000002 ffffffffffffff01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xf2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_MEMALLOC|__GFP_COMP|__GFP_NOMEMALLOC), pid 5192, tgid 5192 (udevd), ts 75284032832
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1856
prep_new_page mm/page_alloc.c:1864 [inline]
get_page_from_freelist+0x1113/0x35e0 mm/page_alloc.c:3935
__alloc_frozen_pages_noprof+0x2bd/0x3280 mm/page_alloc.c:5444
alloc_slab_page mm/slub.c:3384 [inline]
allocate_slab mm/slub.c:3499 [inline]
new_slab+0xb1/0x6d0 mm/slub.c:3550
refill_objects+0xe3/0x410 mm/slub.c:7539
refill_sheaf mm/slub.c:2917 [inline]
__pcs_replace_empty_main+0x35e/0x650 mm/slub.c:4811
alloc_from_pcs mm/slub.c:4887 [inline]
slab_alloc_node mm/slub.c:5021 [inline]
kmem_cache_alloc_node_noprof+0x4ed/0x6e0 mm/slub.c:5105
kmalloc_reserve+0x148/0x350 net/core/skbuff.c:616
__alloc_skb+0x185/0x710 net/core/skbuff.c:716
__netdev_alloc_skb+0x7a/0x980 net/core/skbuff.c:778
netdev_alloc_skb include/linux/skbuff.h:3521 [inline]
dev_alloc_skb include/linux/skbuff.h:3534 [inline]
__ieee80211_beacon_get+0xba9/0x1f00 net/mac80211/tx.c:5947
ieee80211_beacon_get_tim+0xa6/0x280 net/mac80211/tx.c:6069
ieee80211_beacon_get include/net/mac80211.h:5936 [inline]
mac80211_hwsim_beacon_tx+0x4c8/0xa00 drivers/net/wireless/virtual/mac80211_hwsim_main.c:2512
__iterate_interfaces+0x2e6/0x650 net/mac80211/util.c:775
ieee80211_iterate_active_interfaces_atomic+0x71/0x1b0 net/mac80211/util.c:811
mac80211_hwsim_beacon+0xe5/0x2a0 drivers/net/wireless/virtual/mac80211_hwsim_main.c:2548
page last free pid 7136 tgid 7135 ts 74943132413 stack trace:
reset_page_owner include/linux/page_owner.h:26 [inline]
__free_pages_prepare mm/page_alloc.c:1403 [inline]
__free_frozen_pages+0x7b4/0x1110 mm/page_alloc.c:2954
device_release+0xd2/0x270 drivers/base/core.c:2640
kobject_cleanup lib/kobject.c:689 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x1f7/0x640 lib/kobject.c:737
netdev_run_todo+0xa36/0x1620 net/core/dev.c:12021
rtnl_unlock net/core/rtnetlink.c:157 [inline]
rtnl_net_unlock include/linux/rtnetlink.h:139 [inline]
rtnl_dellink+0x47e/0xb30 net/core/rtnetlink.c:3739
rtnetlink_rcv_msg+0x95e/0xe90 net/core/rtnetlink.c:7169
netlink_rcv_skb+0x159/0x420 net/netlink/af_netlink.c:2584
netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]
netlink_unicast+0x668/0x950 net/netlink/af_netlink.c:1361
netlink_sendmsg+0x9ac/0x10c0 net/netlink/af_netlink.c:1920
sock_sendmsg_nosec net/socket.c:800 [inline]
__sock_sendmsg net/socket.c:818 [inline]
____sys_sendmsg+0xa99/0xc30 net/socket.c:2715
___sys_sendmsg+0x190/0x1e0 net/socket.c:2769
__sys_sendmsg+0x160/0x210 net/socket.c:2801
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff888055b24000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888055b24080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888055b24100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888055b24180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888055b24200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess):
0: cc int3
1: cc int3
2: cc int3
3: cc int3
4: cc int3
5: cc int3
6: cc int3
7: cc int3
8: cc int3
9: cc int3
a: cc int3
b: cc int3
c: cc int3
d: cc int3
e: cc int3
f: cc int3
10: cc int3
11: cc int3
12: cc int3
13: cc int3
14: cc int3
15: cc int3
16: cc int3
17: cc int3
18: cc int3
19: cc int3
1a: cc int3
1b: cc int3
1c: cc int3
1d: cc int3
1e: cc int3
1f: cc int3
20: cc int3
21: cc int3
22: cc int3
23: cc int3
24: cc int3
25: cc int3
26: cc int3
27: cc int3
28: cc int3
29: cc int3
* 2a: c3 ret <-- trapping instruction
2b: cc int3
2c: 66 66 2e 0f 1f 84 00 data16 cs nopw 0x0(%rax,%rax,1)
33: 00 00 00 00
37: 0f 1f 00 nopl (%rax)
3a: e9 bb e1 85 f5 jmp 0xf585e1fa
3f: cc int3