==================================================================
BUG: KASAN: slab-out-of-bounds in __hlist_del include/linux/list.h:791 [inline]
BUG: KASAN: slab-out-of-bounds in detach_timer kernel/time/timer.c:824 [inline]
BUG: KASAN: slab-out-of-bounds in expire_timers kernel/time/timer.c:1482 [inline]
BUG: KASAN: slab-out-of-bounds in __run_timers+0x759/0xb60 kernel/time/timer.c:1817
Write of size 8 at addr ffff8881c6df31c8 by task kworker/0:15/2730
CPU: 0 PID: 2730 Comm: kworker/0:15 Not tainted 5.4.292-syzkaller-00021-gcd8e74fa0fa3 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Workqueue: rcu_gp process_srcu
Call Trace:
__dump_stack+0x1e/0x20 lib/dump_stack.c:77
dump_stack+0x15b/0x1b8 lib/dump_stack.c:118
print_address_description+0x8d/0x4c0 mm/kasan/report.c:384
__kasan_report+0xef/0x120 mm/kasan/report.c:516
kasan_report+0x30/0x60 mm/kasan/common.c:653
__asan_report_store8_noabort+0x17/0x20 mm/kasan/generic_report.c:137
__hlist_del include/linux/list.h:791 [inline]
detach_timer kernel/time/timer.c:824 [inline]
expire_timers kernel/time/timer.c:1482 [inline]
__run_timers+0x759/0xb60 kernel/time/timer.c:1817
run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1830
__do_softirq+0x236/0x660 kernel/softirq.c:292
invoke_softirq kernel/softirq.c:373 [inline]
irq_exit+0x197/0x1c0 kernel/softirq.c:413
exiting_irq arch/x86/include/asm/apic.h:539 [inline]
smp_apic_timer_interrupt+0x11d/0x490 arch/x86/kernel/apic/apic.c:1161
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:834
RIP: 0010:delay_tsc+0x62/0xc0 arch/x86/lib/delay.c:68
Code: c1 e4 20 49 09 c4 4d 29 fc 49 39 dc 73 55 bf 01 00 00 00 e8 b0 43 1b fd 65 8b 05 c5 5c dc 7b 85 c0 74 1d f3 90 bf 01 00 00 00 e9 41 1b fd e8 a4 69 fa fd 41 39 c6 75 0e 0f 01 f9 66 90 eb bc
RSP: 0018:ffff8881d7cefb88 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 0000000080000000 RBX: 0000000000002af9 RCX: 0000000000000000
RDX: 0000000000000036 RSI: 0000000000000001 RDI: 0000000000000001
RBP: ffff8881d7cefba8 R08: dffffc0000000000 R09: ffffed103af9df79
R10: ffffed103af9df79 R11: 1ffff1103af9df78 R12: 000000000000165a
R13: 0000000000000e27 R14: 0000000000000000 R15: 0000003687448049
__delay arch/x86/lib/delay.c:161 [inline]
__const_udelay+0x61/0x70 arch/x86/lib/delay.c:175
try_check_zero+0x2dc/0x350 kernel/rcu/srcutree.c:708
srcu_advance_state kernel/rcu/srcutree.c:1146 [inline]
process_srcu+0x183/0xc60 kernel/rcu/srcutree.c:1241
process_one_work+0x73b/0xcc0 kernel/workqueue.c:2290
worker_thread+0xa5c/0x13b0 kernel/workqueue.c:2436
kthread+0x31e/0x3a0 kernel/kthread.c:288
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:354
Allocated by task 3069:
save_stack mm/kasan/common.c:70 [inline]
set_track mm/kasan/common.c:78 [inline]
__kasan_kmalloc+0x162/0x200 mm/kasan/common.c:529
kasan_slab_alloc+0x12/0x20 mm/kasan/common.c:537
slab_post_alloc_hook mm/slab.h:584 [inline]
slab_alloc_node mm/slub.c:2829 [inline]
slab_alloc mm/slub.c:2837 [inline]
kmem_cache_alloc+0xe2/0x270 mm/slub.c:2842
sk_prot_alloc+0x5c/0x410 net/core/sock.c:1616
sk_alloc+0x38/0x330 net/core/sock.c:1680
unix_create1+0x90/0x5a0 net/unix/af_unix.c:789
unix_create+0x135/0x1c0 net/unix/af_unix.c:850
__sock_create+0x3a8/0x740 net/socket.c:1427
sock_create net/socket.c:1478 [inline]
__sys_socketpair+0x21e/0x5a0 net/socket.c:1582
__do_sys_socketpair net/socket.c:1631 [inline]
__se_sys_socketpair net/socket.c:1628 [inline]
__x64_sys_socketpair+0x9b/0xb0 net/socket.c:1628
do_syscall_64+0xcf/0x170 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x5c/0xc1
Freed by task 3068:
save_stack mm/kasan/common.c:70 [inline]
set_track mm/kasan/common.c:78 [inline]
kasan_set_free_info mm/kasan/common.c:345 [inline]
__kasan_slab_free+0x1c3/0x280 mm/kasan/common.c:487
kasan_slab_free+0xe/0x10 mm/kasan/common.c:496
slab_free_hook mm/slub.c:1455 [inline]
slab_free_freelist_hook+0xb7/0x180 mm/slub.c:1494
slab_free mm/slub.c:3080 [inline]
kmem_cache_free+0x10c/0x2c0 mm/slub.c:3096
sk_prot_free net/core/sock.c:1661 [inline]
__sk_destruct+0x4b9/0x640 net/core/sock.c:1749
sk_destruct net/core/sock.c:1764 [inline]
__sk_free+0x384/0x460 net/core/sock.c:1775
sk_free+0x54/0x90 net/core/sock.c:1786
sock_put include/net/sock.h:1791 [inline]
unix_release_sock+0x8e5/0xad0 net/unix/af_unix.c:571
unix_release+0x4e/0x80 net/unix/af_unix.c:860
__sock_release net/socket.c:591 [inline]
sock_close+0xe0/0x270 net/socket.c:1277
__fput+0x2a3/0x730 fs/file_table.c:281
____fput+0x15/0x20 fs/file_table.c:314
task_work_run+0x146/0x170 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:188 [inline]
exit_to_usermode_loop+0x195/0x1b0 arch/x86/entry/common.c:163
prepare_exit_to_usermode+0x18e/0x1f0 arch/x86/entry/common.c:194
syscall_return_slowpath arch/x86/entry/common.c:274 [inline]
do_syscall_64+0x13e/0x170 arch/x86/entry/common.c:300
entry_SYSCALL_64_after_hwframe+0x5c/0xc1
The buggy address belongs to the object at ffff8881c6df2d00
which belongs to the cache UNIX of size 1152
The buggy address is located 72 bytes to the right of
1152-byte region [ffff8881c6df2d00, ffff8881c6df3180)
The buggy address belongs to the page:
page:ffffea00071b7c00 refcount:1 mapcount:0 mapping:ffff8881f50def00 index:0x0 compound_mapcount: 0
flags: 0x8000000000010200(slab|head)
raw: 8000000000010200 dead000000000100 dead000000000122 ffff8881f50def00
raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL)
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook mm/page_alloc.c:2165 [inline]
prep_new_page+0x35e/0x370 mm/page_alloc.c:2171
get_page_from_freelist+0x1296/0x1310 mm/page_alloc.c:3794
__alloc_pages_nodemask+0x202/0x4b0 mm/page_alloc.c:4894
alloc_slab_page+0x3c/0x3b0 mm/slub.c:343
allocate_slab mm/slub.c:1683 [inline]
new_slab+0x93/0x420 mm/slub.c:1749
new_slab_objects mm/slub.c:2505 [inline]
___slab_alloc+0x29e/0x420 mm/slub.c:2667
__slab_alloc+0x63/0xa0 mm/slub.c:2707
slab_alloc_node mm/slub.c:2792 [inline]
slab_alloc mm/slub.c:2837 [inline]
kmem_cache_alloc+0x12c/0x270 mm/slub.c:2842
sk_prot_alloc+0x5c/0x410 net/core/sock.c:1616
sk_alloc+0x38/0x330 net/core/sock.c:1680
unix_create1+0x90/0x5a0 net/unix/af_unix.c:789
unix_create+0x135/0x1c0 net/unix/af_unix.c:850
__sock_create+0x3a8/0x740 net/socket.c:1427
sock_create net/socket.c:1478 [inline]
__sys_socket+0xec/0x190 net/socket.c:1520
__do_sys_socket net/socket.c:1529 [inline]
__se_sys_socket net/socket.c:1527 [inline]
__x64_sys_socket+0x7a/0x90 net/socket.c:1527
do_syscall_64+0xcf/0x170 arch/x86/entry/common.c:290
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1176 [inline]
__free_pages_ok+0x7e4/0x910 mm/page_alloc.c:1438
free_the_page mm/page_alloc.c:4956 [inline]
__free_pages+0x8c/0x110 mm/page_alloc.c:4962
kfree+0x1ca/0x260 mm/slub.c:4068
kvfree+0x4c/0x50 mm/util.c:625
netdev_freemem+0x3f/0x60 net/core/dev.c:9583
netdev_release+0x7f/0xb0 net/core/net-sysfs.c:1743
device_release+0x70/0x1a0 drivers/base/core.c:1776
kobject_cleanup lib/kobject.c:716 [inline]
kobject_release lib/kobject.c:747 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x1fe/0x2c0 lib/kobject.c:764
put_device+0x1f/0x30 drivers/base/core.c:3010
free_netdev+0x27e/0x320 net/core/dev.c:9746
tun_set_iff+0x87c/0xe00 drivers/net/tun.c:2924
__tun_chr_ioctl+0x771/0x18a0 drivers/net/tun.c:3187
tun_chr_ioctl+0x2a/0x40 drivers/net/tun.c:3470
do_vfs_ioctl+0x753/0x13f0 fs/ioctl.c:47
ksys_ioctl fs/ioctl.c:742 [inline]
__do_sys_ioctl fs/ioctl.c:749 [inline]
__se_sys_ioctl fs/ioctl.c:747 [inline]
__x64_sys_ioctl+0xe1/0x120 fs/ioctl.c:747
do_syscall_64+0xcf/0x170 arch/x86/entry/common.c:290
Memory state around the buggy address:
ffff8881c6df3080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881c6df3100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8881c6df3180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff8881c6df3200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8881c6df3280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
BUG: kernel NULL pointer dereference, address: 0000000000000000
#PF: supervisor instruction fetch in kernel mode
#PF: error_code(0x0010) - not-present page
PGD 1dab07067 P4D 1dab07067 PUD 0
Oops: 0010 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 2730 Comm: kworker/0:15 Tainted: G B 5.4.292-syzkaller-00021-gcd8e74fa0fa3 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Workqueue: rcu_gp process_srcu
RIP: 0010:0x0
Code: Bad RIP value.
RSP: 0018:ffff8881f6e09cf0 EFLAGS: 00010206
RAX: ffffffff8150a590 RBX: 0000000000000100 RCX: ffff8881c1ea0fc0
RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffff8881c6df31c0
RBP: ffff8881f6e09d30 R08: 0000000000000004 R09: 0000000000000003
R10: ffffed103edc1398 R11: 1ffff1103edc1398 R12: 00000000ffffb2b0
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8881c6df31c0
FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 00000001ea5fc000 CR4: 00000000003406b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Call Trace:
call_timer_fn+0x3c/0x380 kernel/time/timer.c:1448
expire_timers kernel/time/timer.c:1493 [inline]
__run_timers+0x81d/0xb60 kernel/time/timer.c:1817
run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1830
__do_softirq+0x236/0x660 kernel/softirq.c:292
invoke_softirq kernel/softirq.c:373 [inline]
irq_exit+0x197/0x1c0 kernel/softirq.c:413
exiting_irq arch/x86/include/asm/apic.h:539 [inline]
smp_apic_timer_interrupt+0x11d/0x490 arch/x86/kernel/apic/apic.c:1161
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:834
RIP: 0010:delay_tsc+0x62/0xc0 arch/x86/lib/delay.c:68
Code: c1 e4 20 49 09 c4 4d 29 fc 49 39 dc 73 55 bf 01 00 00 00 e8 b0 43 1b fd 65 8b 05 c5 5c dc 7b 85 c0 74 1d f3 90 bf 01 00 00 00 e9 41 1b fd e8 a4 69 fa fd 41 39 c6 75 0e 0f 01 f9 66 90 eb bc
RSP: 0018:ffff8881d7cefb88 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 0000000080000000 RBX: 0000000000002af9 RCX: 0000000000000000
RDX: 0000000000000036 RSI: 0000000000000001 RDI: 0000000000000001
RBP: ffff8881d7cefba8 R08: dffffc0000000000 R09: ffffed103af9df79
R10: ffffed103af9df79 R11: 1ffff1103af9df78 R12: 000000000000165a
R13: 0000000000000e27 R14: 0000000000000000 R15: 0000003687448049
__delay arch/x86/lib/delay.c:161 [inline]
__const_udelay+0x61/0x70 arch/x86/lib/delay.c:175
try_check_zero+0x2dc/0x350 kernel/rcu/srcutree.c:708
srcu_advance_state kernel/rcu/srcutree.c:1146 [inline]
process_srcu+0x183/0xc60 kernel/rcu/srcutree.c:1241
process_one_work+0x73b/0xcc0 kernel/workqueue.c:2290
worker_thread+0xa5c/0x13b0 kernel/workqueue.c:2436
kthread+0x31e/0x3a0 kernel/kthread.c:288
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:354
Modules linked in:
CR2: 0000000000000000
---[ end trace 7cf6706f20dac874 ]---
RIP: 0010:0x0
Code: Bad RIP value.
RSP: 0018:ffff8881f6e09cf0 EFLAGS: 00010206
RAX: ffffffff8150a590 RBX: 0000000000000100 RCX: ffff8881c1ea0fc0
RDX: 0000000000000100 RSI: 0000000000000000 RDI: ffff8881c6df31c0
RBP: ffff8881f6e09d30 R08: 0000000000000004 R09: 0000000000000003
R10: ffffed103edc1398 R11: 1ffff1103edc1398 R12: 00000000ffffb2b0
R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8881c6df31c0
FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffd6 CR3: 00000001ea5fc000 CR4: 00000000003406b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
----------------
Code disassembly (best guess):
0: c1 e4 20 shl $0x20,%esp
3: 49 09 c4 or %rax,%r12
6: 4d 29 fc sub %r15,%r12
9: 49 39 dc cmp %rbx,%r12
c: 73 55 jae 0x63
e: bf 01 00 00 00 mov $0x1,%edi
13: e8 b0 43 1b fd call 0xfd1b43c8
18: 65 8b 05 c5 5c dc 7b mov %gs:0x7bdc5cc5(%rip),%eax # 0x7bdc5ce4
1f: 85 c0 test %eax,%eax
21: 74 1d je 0x40
23: f3 90 pause
25: bf 01 00 00 00 mov $0x1,%edi
* 2a: e8 e9 41 1b fd call 0xfd1b4218 <-- trapping instruction
2f: e8 a4 69 fa fd call 0xfdfa69d8
34: 41 39 c6 cmp %eax,%r14d
37: 75 0e jne 0x47
39: 0f 01 f9 rdtscp
3c: 66 90 xchg %ax,%ax
3e: eb bc jmp 0xfffffffc