================================================================== BUG: KASAN: slab-use-after-free in netdev_need_ops_lock include/net/netdev_lock.h:30 [inline] BUG: KASAN: slab-use-after-free in netdev_lock_ops include/net/netdev_lock.h:41 [inline] BUG: KASAN: slab-use-after-free in __ethtool_get_link_ksettings+0x1ec/0x21c net/ethtool/ioctl.c:463 Read of size 1 at addr ffff000010812df1 by task kworker/1:2/805 CPU: 1 UID: 0 PID: 805 Comm: kworker/1:2 Tainted: G W syzkaller #0 PREEMPT Tainted: [W]=WARN Hardware name: linux,dummy-virt (DT) Workqueue: events smc_ib_port_event_work Call trace: show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x7c/0xb0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x18c/0x4e8 mm/kasan/report.c:482 kasan_report+0xb8/0x15c mm/kasan/report.c:595 __asan_report_load1_noabort+0x20/0x2c mm/kasan/report_generic.c:378 netdev_need_ops_lock include/net/netdev_lock.h:30 [inline] netdev_lock_ops include/net/netdev_lock.h:41 [inline] __ethtool_get_link_ksettings+0x1ec/0x21c net/ethtool/ioctl.c:463 ipvlan_ethtool_get_link_ksettings+0x34/0x54 drivers/net/ipvlan/ipvlan_main.c:467 netif_get_link_ksettings+0x148/0x258 net/ethtool/ioctl.c:451 __ethtool_get_link_ksettings+0x90/0x21c net/ethtool/ioctl.c:464 ib_get_eth_speed+0xf8/0x9e0 drivers/infiniband/core/verbs.c:2061 rxe_query_port+0xfc/0x2a4 drivers/infiniband/sw/rxe/rxe_verbs.c:56 __ib_query_port drivers/infiniband/core/device.c:2304 [inline] ib_query_port drivers/infiniband/core/device.c:2336 [inline] ib_query_port+0x2fc/0x5e0 drivers/infiniband/core/device.c:2326 smc_ib_remember_port_attr net/smc/smc_ib.c:364 [inline] smc_ib_port_event_work+0xf4/0x940 net/smc/smc_ib.c:388 process_one_work+0x830/0x1c00 kernel/workqueue.c:3387 process_scheduled_works kernel/workqueue.c:3470 [inline] worker_thread+0x42c/0xc90 kernel/workqueue.c:3551 kthread+0x2ec/0x384 kernel/kthread.c:436 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854 Allocated by task 3391: kasan_save_stack+0x3c/0x70 mm/kasan/common.c:57 kasan_save_track+0x20/0x3c mm/kasan/common.c:78 kasan_save_alloc_info+0x40/0x5c mm/kasan/generic.c:570 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0xb8/0xc0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5414 [inline] __kvmalloc_node_noprof+0x2e8/0x8b8 mm/slub.c:7005 alloc_netdev_mqs+0x74/0x107c net/core/dev.c:12117 rtnl_create_link+0x934/0xc3c net/core/rtnetlink.c:3777 rtnl_newlink_create net/core/rtnetlink.c:3959 [inline] __rtnl_newlink net/core/rtnetlink.c:4098 [inline] rtnl_newlink+0x9b8/0x16a0 net/core/rtnetlink.c:4215 rtnetlink_rcv_msg+0x638/0x880 net/core/rtnetlink.c:7132 netlink_rcv_skb+0x1ac/0x360 net/netlink/af_netlink.c:2556 rtnetlink_rcv+0x18/0x24 net/core/rtnetlink.c:7159 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x418/0x6e0 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x638/0xa4c net/netlink/af_netlink.c:1900 sock_sendmsg_nosec net/socket.c:800 [inline] __sock_sendmsg+0xc8/0x1a4 net/socket.c:815 __sys_sendto+0x1d0/0x270 net/socket.c:2281 __do_sys_sendto net/socket.c:2288 [inline] __se_sys_sendto net/socket.c:2284 [inline] __arm64_sys_sendto+0xc4/0x140 net/socket.c:2284 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x74/0x240 arch/arm64/kernel/syscall.c:49 el0_svc_common.constprop.0+0xac/0x230 arch/arm64/kernel/syscall.c:121 do_el0_svc+0x40/0x58 arch/arm64/kernel/syscall.c:140 el0_svc+0x58/0x2a4 arch/arm64/kernel/entry-common.c:758 el0t_64_sync_handler+0xa0/0xe4 arch/arm64/kernel/entry-common.c:777 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590 Freed by task 6707: kasan_save_stack+0x3c/0x70 mm/kasan/common.c:57 kasan_save_track+0x20/0x3c mm/kasan/common.c:78 kasan_save_free_info+0x4c/0x80 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5c/0x88 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2748 [inline] slab_free mm/slub.c:6499 [inline] kfree+0x2e8/0x750 mm/slub.c:6792 kvfree+0x3c/0x4c mm/slub.c:7054 netdev_release+0x70/0x98 net/core/net-sysfs.c:2231 device_release+0x104/0x214 drivers/base/core.c:2640 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x17c/0x4a4 lib/kobject.c:737 netdev_run_todo+0x6e4/0xf58 net/core/dev.c:11818 rtnl_unlock+0x10/0x1c net/core/rtnetlink.c:157 default_device_exit_batch+0x5bc/0x7c4 net/core/dev.c:13289 ops_exit_list net/core/net_namespace.c:206 [inline] ops_undo_list+0x324/0x710 net/core/net_namespace.c:253 cleanup_net+0x38c/0x77c net/core/net_namespace.c:706 process_one_work+0x830/0x1c00 kernel/workqueue.c:3387 process_scheduled_works kernel/workqueue.c:3470 [inline] worker_thread+0x42c/0xc90 kernel/workqueue.c:3551 kthread+0x2ec/0x384 kernel/kthread.c:436 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854 The buggy address belongs to the object at ffff000010812000 which belongs to the cache kmalloc-cg-4k of size 4096 The buggy address is located 3569 bytes inside of freed 4096-byte region [ffff000010812000, ffff000010813000) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x50810 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0x1ffc00000000040(head|node=0|zone=0|lastcpupid=0x7ff) page_type: f5(slab) raw: 01ffc00000000040 ffff00000e00b500 dead000000000100 dead000000000122 raw: 0000000000000000 0000000200040004 00000000f5000000 0000000000000000 head: 01ffc00000000040 ffff00000e00b500 dead000000000100 dead000000000122 head: 0000000000000000 0000000200040004 00000000f5000000 0000000000000000 head: 01ffc00000000003 fffffdffc0420401 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff000010812c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff000010812d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff000010812d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff000010812e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff000010812e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Unable to handle kernel paging request at virtual address 00448052a000039d Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004, ISS2 = 0x00000000 CM = 0, WnR = 0, TnD = 0, TagAccess = 0 GCS = 0, Overlay = 0, DirtyBit = 0 [00448052a000039d] address between user and kernel address ranges Internal error: Oops: 0000000096000004 [#1] SMP Modules linked in: CPU: 1 UID: 0 PID: 805 Comm: kworker/1:2 Tainted: G B W syzkaller #0 PREEMPT Tainted: [B]=BAD_PAGE, [W]=WARN Hardware name: linux,dummy-virt (DT) Workqueue: events smc_ib_port_event_work pstate: 40000005 (nZcv daif -PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : netdev_need_ops_lock include/net/netdev_lock.h:33 [inline] pc : netdev_lock_ops include/net/netdev_lock.h:41 [inline] pc : __ethtool_get_link_ksettings+0x17c/0x21c net/ethtool/ioctl.c:463 lr : netdev_need_ops_lock include/net/netdev_lock.h:33 [inline] lr : netdev_lock_ops include/net/netdev_lock.h:41 [inline] lr : __ethtool_get_link_ksettings+0x1fc/0x21c net/ethtool/ioctl.c:463 sp : ffff80008ea877a0 x29: ffff80008ea877a0 x28: ffff00001422f000 x27: ffff000017504000 x26: 0000000000000000 x25: ffff00001a48a6d8 x24: 0228029500001a33 x23: ffff80008ea878c0 x22: 1fffe000021025be x21: 0000000000000001 x20: ffff000010812df1 x19: ffff000010812000 x18: 0000000000000000 x17: 1ffff00010f3b352 x16: 1fffe00002a977d3 x15: ffff8000877cb698 x14: 1ffff00010ef96d3 x13: 00000000003c0b80 x12: ffff700011269439 x11: 1ffff00011269438 x10: ffff700011269438 x9 : dfff800000000000 x8 : ffff80008ea87790 x7 : 0000000000000000 x6 : ffff700011269438 x5 : ffff80008934a1c0 x4 : 0000000000000000 x3 : 0000000000000000 x2 : 00450052a000039d x1 : dfff800000000000 x0 : 0228029500001ceb dump_backtrace(regs = 00000000f1fc9c4e tsk = 0000000000000000) Call trace: netdev_need_ops_lock include/net/netdev_lock.h:33 [inline] (P) netdev_lock_ops include/net/netdev_lock.h:41 [inline] (P) __ethtool_get_link_ksettings+0x17c/0x21c net/ethtool/ioctl.c:463 (P) ipvlan_ethtool_get_link_ksettings+0x34/0x54 drivers/net/ipvlan/ipvlan_main.c:467 netif_get_link_ksettings+0x148/0x258 net/ethtool/ioctl.c:451 __ethtool_get_link_ksettings+0x90/0x21c net/ethtool/ioctl.c:464 ib_get_eth_speed+0xf8/0x9e0 drivers/infiniband/core/verbs.c:2061 rxe_query_port+0xfc/0x2a4 drivers/infiniband/sw/rxe/rxe_verbs.c:56 __ib_query_port drivers/infiniband/core/device.c:2304 [inline] ib_query_port drivers/infiniband/core/device.c:2336 [inline] ib_query_port+0x2fc/0x5e0 drivers/infiniband/core/device.c:2326 smc_ib_remember_port_attr net/smc/smc_ib.c:364 [inline] smc_ib_port_event_work+0xf4/0x940 net/smc/smc_ib.c:388 process_one_work+0x830/0x1c00 kernel/workqueue.c:3387 process_scheduled_works kernel/workqueue.c:3470 [inline] worker_thread+0x42c/0xc90 kernel/workqueue.c:3551 kthread+0x2ec/0x384 kernel/kthread.c:436 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:854 Code: d2d00001 f2fbffe1 910ae300 d343fc02 (38e16841) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: d2d00001 mov x1, #0x800000000000 // #140737488355328 4: f2fbffe1 movk x1, #0xdfff, lsl #48 8: 910ae300 add x0, x24, #0x2b8 c: d343fc02 lsr x2, x0, #3 * 10: 38e16841 ldrsb w1, [x2, x1] <-- trapping instruction