==================================================================
BUG: KASAN: slab-use-after-free in macvlan_forward_source+0x512/0x630 drivers/net/macvlan.c:436
Read of size 2 at addr ffff8880529e8dfc by task syz-executor/10945
CPU: 1 UID: 0 PID: 10945 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Call Trace:
dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xca/0x240 mm/kasan/report.c:482
kasan_report+0x118/0x150 mm/kasan/report.c:595
macvlan_forward_source+0x512/0x630 drivers/net/macvlan.c:436
macvlan_handle_frame+0x2e2/0x12e0 drivers/net/macvlan.c:471
__netif_receive_skb_core+0x10b9/0x4380 net/core/dev.c:5966
__netif_receive_skb_one_core net/core/dev.c:6077 [inline]
__netif_receive_skb+0x72/0x380 net/core/dev.c:6192
process_backlog+0x60e/0x14f0 net/core/dev.c:6544
__napi_poll+0xc4/0x360 net/core/dev.c:7594
napi_poll net/core/dev.c:7657 [inline]
net_rx_action+0x5f7/0xdf0 net/core/dev.c:7784
handle_softirqs+0x283/0x870 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0xca/0x1f0 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1052 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1052
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:check_kcov_mode kernel/kcov.c:194 [inline]
RIP: 0010:write_comp_data kernel/kcov.c:246 [inline]
RIP: 0010:__sanitizer_cov_trace_const_cmp8+0x37/0x90 kernel/kcov.c:321
Code: 08 50 48 92 65 8b 15 b8 d4 89 10 81 e2 00 01 ff 00 74 11 81 fa 00 01 00 00 75 57 83 b9 7c 16 00 00 00 74 4e 8b 91 58 16 00 00 <83> fa 03 75 43 48 8b 91 60 16 00 00 44 8b 89 5c 16 00 00 49 c1 e1
RSP: 0000:ffffc9000c487a08 EFLAGS: 00000246
RAX: ffffffff82108f63 RBX: ffffea0000672d00 RCX: ffff88802ef75ac0
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc9000c487bf0 R08: ffffea0000672d07 R09: 1ffffd40000ce5a0
R10: dffffc0000000000 R11: fffff940000ce5a1 R12: dffffc0000000000
R13: ffff88803083d330 R14: ffff8880202bf3c0 R15: 00fff60000020029
constant_test_bit arch/x86/include/asm/bitops.h:206 [inline]
arch_test_bit arch/x86/include/asm/bitops.h:238 [inline]
_test_bit include/asm-generic/bitops/instrumented-non-atomic.h:142 [inline]
folio_test_locked include/linux/page-flags.h:551 [inline]
folio_move_anon_rmap+0xa3/0x120 mm/rmap.c:1334
wp_can_reuse_anon_folio mm/memory.c:3894 [inline]
do_wp_page+0x3811/0x5800 mm/memory.c:3992
handle_pte_fault mm/memory.c:6068 [inline]
__handle_mm_fault+0x1033/0x5440 mm/memory.c:6195
handle_mm_fault+0x40a/0x8e0 mm/memory.c:6364
do_user_addr_fault+0xa7c/0x1380 arch/x86/mm/fault.c:1336
handle_page_fault arch/x86/mm/fault.c:1476 [inline]
exc_page_fault+0x76/0xf0 arch/x86/mm/fault.c:1532
asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623
RIP: 0033:0x7f3b1a3852a7
Code: f7 fb ff 49 39 c4 0f 84 df 02 00 00 4c 89 e7 e8 4f f7 fb ff 8b 00 f6 c4 80 75 d8 4c 89 e7 e8 40 f7 fb ff 48 8b 80 88 00 00 00 <48> c7 00 00 00 00 00 48 c7 40 08 00 00 00 00 eb b8 0f 1f 84 00 00
RSP: 002b:00007ffc90040bb0 EFLAGS: 00010246
RAX: 00007f3b1b118710 RBX: 0000000000000000 RCX: 00007f3b1a5b7cc0
RDX: 0000000000000000 RSI: 00007f3b1a5b7cc0 RDI: 00007f3b1a5b7640
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000001
R10: 0000555573db67d0 R11: 0000000000000246 R12: 00007f3b1a5b7640
R13: 00000000000927c0 R14: 000000000002f90a R15: 00007ffc90040d40
Allocated by task 10854:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:388 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:405
kasan_kmalloc include/linux/kasan.h:260 [inline]
__do_kmalloc_node mm/slub.c:4376 [inline]
__kvmalloc_node_noprof+0x30d/0x5f0 mm/slub.c:5067
futex_hash_allocate+0x436/0xe50 kernel/futex/core.c:1812
copy_process+0x21aa/0x3c00 kernel/fork.c:2301
kernel_clone+0x21e/0x840 kernel/fork.c:2610
__do_sys_clone3 kernel/fork.c:2914 [inline]
__se_sys_clone3+0x256/0x2d0 kernel/fork.c:2893
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 10857:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576
poison_slab_object mm/kasan/common.c:243 [inline]
__kasan_slab_free+0x5b/0x80 mm/kasan/common.c:275
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2422 [inline]
slab_free mm/slub.c:4695 [inline]
kfree+0x18e/0x440 mm/slub.c:4894
__mmput+0x38d/0x430 kernel/fork.c:1141
exit_mm+0x1da/0x2c0 kernel/exit.c:582
do_exit+0x648/0x2300 kernel/exit.c:949
do_group_exit+0x21c/0x2d0 kernel/exit.c:1102
get_signal+0x1285/0x1340 kernel/signal.c:3034
arch_do_signal_or_restart+0xa0/0x790 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop+0x72/0x110 kernel/entry/common.c:40
exit_to_user_mode_prepare include/linux/irq-entry-common.h:225 [inline]
syscall_exit_to_user_mode_work include/linux/entry-common.h:175 [inline]
syscall_exit_to_user_mode include/linux/entry-common.h:210 [inline]
do_syscall_64+0x2bd/0x3b0 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff8880529e8000
which belongs to the cache kmalloc-cg-4k of size 4096
The buggy address is located 3580 bytes inside of
freed 4096-byte region [ffff8880529e8000, ffff8880529e9000)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x529e8
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff88802d9d96c1
anon flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801a04b500 0000000000000000 0000000000000001
raw: 0000000000000000 0000000000040004 00000000f5000000 ffff88802d9d96c1
head: 00fff00000000040 ffff88801a04b500 0000000000000000 0000000000000001
head: 0000000000000000 0000000000040004 00000000f5000000 ffff88802d9d96c1
head: 00fff00000000003 ffffea00014a7a01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd60c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 10172, tgid 10169 (syz.3.1193), ts 181406598066, free_ts 181351927231
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x240/0x2a0 mm/page_alloc.c:1851
prep_new_page mm/page_alloc.c:1859 [inline]
get_page_from_freelist+0x21e4/0x22c0 mm/page_alloc.c:3858
__alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5148
alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2416
alloc_slab_page mm/slub.c:2492 [inline]
allocate_slab+0x8a/0x370 mm/slub.c:2660
new_slab mm/slub.c:2714 [inline]
___slab_alloc+0xbeb/0x1420 mm/slub.c:3901
__slab_alloc mm/slub.c:3992 [inline]
__slab_alloc_node mm/slub.c:4067 [inline]
slab_alloc_node mm/slub.c:4228 [inline]
__do_kmalloc_node mm/slub.c:4375 [inline]
__kvmalloc_node_noprof+0x429/0x5f0 mm/slub.c:5067
alloc_netdev_mqs+0xa3/0x11b0 net/core/dev.c:11900
rtnl_create_link+0x31f/0xd10 net/core/rtnetlink.c:3641
rtnl_newlink_create+0x25c/0xb00 net/core/rtnetlink.c:3823
__rtnl_newlink net/core/rtnetlink.c:3950 [inline]
rtnl_newlink+0x16e4/0x1c80 net/core/rtnetlink.c:4065
rtnetlink_rcv_msg+0x7cc/0xb70 net/core/rtnetlink.c:6954
netlink_rcv_skb+0x205/0x470 net/netlink/af_netlink.c:2552
netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
netlink_unicast+0x82c/0x9e0 net/netlink/af_netlink.c:1346
netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg+0x219/0x270 net/socket.c:742
page last free pid 5501 tgid 5501 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1395 [inline]
__free_frozen_pages+0xbc4/0xd30 mm/page_alloc.c:2895
__slab_free+0x303/0x3c0 mm/slub.c:4606
qlink_free mm/kasan/quarantine.c:163 [inline]
qlist_free_all+0x97/0x140 mm/kasan/quarantine.c:179
kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
__kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:340
kasan_slab_alloc include/linux/kasan.h:250 [inline]
slab_post_alloc_hook mm/slub.c:4191 [inline]
slab_alloc_node mm/slub.c:4240 [inline]
__do_kmalloc_node mm/slub.c:4375 [inline]
__kmalloc_noprof+0x224/0x4f0 mm/slub.c:4388
kmalloc_noprof include/linux/slab.h:909 [inline]
tomoyo_realpath_from_path+0xe3/0x5d0 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_number_perm+0x1e8/0x5a0 security/tomoyo/file.c:723
security_file_ioctl+0xcb/0x2d0 security/security.c:2982
__do_sys_ioctl fs/ioctl.c:591 [inline]
__se_sys_ioctl+0x47/0x170 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Memory state around the buggy address:
ffff8880529e8c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880529e8d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8880529e8d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880529e8e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880529e8e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess):
0: 08 50 48 or %dl,0x48(%rax)
3: 92 xchg %eax,%edx
4: 65 8b 15 b8 d4 89 10 mov %gs:0x1089d4b8(%rip),%edx # 0x1089d4c3
b: 81 e2 00 01 ff 00 and $0xff0100,%edx
11: 74 11 je 0x24
13: 81 fa 00 01 00 00 cmp $0x100,%edx
19: 75 57 jne 0x72
1b: 83 b9 7c 16 00 00 00 cmpl $0x0,0x167c(%rcx)
22: 74 4e je 0x72
24: 8b 91 58 16 00 00 mov 0x1658(%rcx),%edx
* 2a: 83 fa 03 cmp $0x3,%edx <-- trapping instruction
2d: 75 43 jne 0x72
2f: 48 8b 91 60 16 00 00 mov 0x1660(%rcx),%rdx
36: 44 8b 89 5c 16 00 00 mov 0x165c(%rcx),%r9d
3d: 49 rex.WB
3e: c1 .byte 0xc1
3f: e1 .byte 0xe1