================================================================== BUG: KASAN: use-after-free in __nf_ct_ext_exist include/net/netfilter/nf_conntrack_extend.h:47 [inline] BUG: KASAN: use-after-free in nf_ct_ext_exist include/net/netfilter/nf_conntrack_extend.h:52 [inline] BUG: KASAN: use-after-free in nf_ct_ecache_exist include/net/netfilter/nf_conntrack_ecache.h:42 [inline] BUG: KASAN: use-after-free in nf_conntrack_confirm include/net/netfilter/nf_conntrack_core.h:63 [inline] BUG: KASAN: use-after-free in nf_confirm+0x575/0x5b0 net/netfilter/nf_conntrack_proto.c:154 Read of size 1 at addr ffff88801c66d404 by task kworker/u4:6/2419 CPU: 1 PID: 2419 Comm: kworker/u4:6 Not tainted 5.18.0-syzkaller-11972-gd1dc87763f40 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: wg-kex-wg1 wg_packet_handshake_send_worker Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0xeb/0x495 mm/kasan/report.c:313 print_report mm/kasan/report.c:429 [inline] kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491 __nf_ct_ext_exist include/net/netfilter/nf_conntrack_extend.h:47 [inline] nf_ct_ext_exist include/net/netfilter/nf_conntrack_extend.h:52 [inline] nf_ct_ecache_exist include/net/netfilter/nf_conntrack_ecache.h:42 [inline] nf_conntrack_confirm include/net/netfilter/nf_conntrack_core.h:63 [inline] nf_confirm+0x575/0x5b0 net/netfilter/nf_conntrack_proto.c:154 ipv4_confirm+0x17a/0x390 net/netfilter/nf_conntrack_proto.c:182 nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline] nf_hook_slow+0xc5/0x1f0 net/netfilter/core.c:620 nf_hook+0x1cb/0x5b0 include/linux/netfilter.h:262 NF_HOOK_COND include/linux/netfilter.h:295 [inline] ip_output+0x21f/0x310 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:451 [inline] ip_local_out+0xaf/0x1a0 net/ipv4/ip_output.c:126 iptunnel_xmit+0x67a/0xa40 net/ipv4/ip_tunnel_core.c:82 send4+0x426/0xe60 drivers/net/wireguard/socket.c:85 wg_socket_send_skb_to_peer+0x192/0x220 drivers/net/wireguard/socket.c:175 wg_socket_send_buffer_to_peer+0x11e/0x170 drivers/net/wireguard/socket.c:200 wg_packet_send_handshake_initiation+0x212/0x340 drivers/net/wireguard/send.c:40 wg_packet_handshake_send_worker+0x18/0x30 drivers/net/wireguard/send.c:51 process_one_work+0x996/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302 Allocated by task 0: (stack is not available) Freed by task 2419: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track+0x21/0x30 mm/kasan/common.c:45 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370 ____kasan_slab_free mm/kasan/common.c:366 [inline] ____kasan_slab_free+0x166/0x1a0 mm/kasan/common.c:328 kasan_slab_free include/linux/kasan.h:200 [inline] slab_free_hook mm/slub.c:1727 [inline] slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1753 slab_free mm/slub.c:3507 [inline] kfree+0xd6/0x4d0 mm/slub.c:4555 nf_conntrack_free+0x100/0x630 net/netfilter/nf_conntrack_core.c:1680 nf_ct_destroy+0x1be/0x320 net/netfilter/nf_conntrack_core.c:610 nf_ct_put include/net/netfilter/nf_conntrack.h:184 [inline] nf_ct_put include/net/netfilter/nf_conntrack.h:181 [inline] __nf_ct_resolve_clash+0x624/0x785 net/netfilter/nf_conntrack_core.c:1013 nf_ct_resolve_clash+0x14a/0xa23 net/netfilter/nf_conntrack_core.c:1136 __nf_conntrack_confirm.cold+0x16/0x23e net/netfilter/nf_conntrack_core.c:1284 nf_conntrack_confirm include/net/netfilter/nf_conntrack_core.h:62 [inline] nf_confirm+0x4ce/0x5b0 net/netfilter/nf_conntrack_proto.c:154 ipv4_confirm+0x17a/0x390 net/netfilter/nf_conntrack_proto.c:182 nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline] nf_hook_slow+0xc5/0x1f0 net/netfilter/core.c:620 nf_hook+0x1cb/0x5b0 include/linux/netfilter.h:262 NF_HOOK_COND include/linux/netfilter.h:295 [inline] ip_output+0x21f/0x310 net/ipv4/ip_output.c:430 dst_output include/net/dst.h:451 [inline] ip_local_out+0xaf/0x1a0 net/ipv4/ip_output.c:126 iptunnel_xmit+0x67a/0xa40 net/ipv4/ip_tunnel_core.c:82 send4+0x426/0xe60 drivers/net/wireguard/socket.c:85 wg_socket_send_skb_to_peer+0x192/0x220 drivers/net/wireguard/socket.c:175 wg_socket_send_buffer_to_peer+0x11e/0x170 drivers/net/wireguard/socket.c:200 wg_packet_send_handshake_initiation+0x212/0x340 drivers/net/wireguard/send.c:40 wg_packet_handshake_send_worker+0x18/0x30 drivers/net/wireguard/send.c:51 process_one_work+0x996/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:302 The buggy address belongs to the object at ffff88801c66d400 which belongs to the cache kmalloc-128 of size 128 The buggy address is located 4 bytes inside of 128-byte region [ffff88801c66d400, ffff88801c66d480) The buggy address belongs to the physical page: page:ffffea0000719b40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1c66d flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000200 0000000000000000 dead000000000122 ffff888010c418c0 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_HARDWALL), pid 2419, tgid 2419 (kworker/u4:6), ts 155833924636, free_ts 155795807659 prep_new_page mm/page_alloc.c:2456 [inline] get_page_from_freelist+0x1290/0x3b70 mm/page_alloc.c:4198 __alloc_pages+0x1c7/0x510 mm/page_alloc.c:5426 alloc_pages+0x1aa/0x310 mm/mempolicy.c:2272 alloc_slab_page mm/slub.c:1797 [inline] allocate_slab+0x26c/0x3c0 mm/slub.c:1942 new_slab mm/slub.c:2002 [inline] ___slab_alloc+0x985/0xd90 mm/slub.c:3002 __slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3089 slab_alloc_node mm/slub.c:3180 [inline] slab_alloc mm/slub.c:3222 [inline] __kmalloc_track_caller+0x2e7/0x320 mm/slub.c:4919 __do_krealloc mm/slab_common.c:1185 [inline] krealloc+0x87/0xf0 mm/slab_common.c:1218 nf_ct_ext_add+0x19f/0x3d0 net/netfilter/nf_conntrack_extend.c:117 nf_ct_labels_ext_add include/net/netfilter/nf_conntrack_labels.h:45 [inline] init_conntrack.constprop.0+0x563/0x1270 net/netfilter/nf_conntrack_core.c:1734 resolve_normal_ct net/netfilter/nf_conntrack_core.c:1830 [inline] nf_conntrack_in+0xc86/0x1790 net/netfilter/nf_conntrack_core.c:1985 nf_hook_entry_hookfn include/linux/netfilter.h:142 [inline] nf_hook_slow+0xc5/0x1f0 net/netfilter/core.c:620 nf_hook include/linux/netfilter.h:262 [inline] __ip6_local_out+0x3e8/0x890 net/ipv6/output_core.c:149 ip6_local_out+0x26/0x1a0 net/ipv6/output_core.c:159 ip6tunnel_xmit include/net/ip6_tunnel.h:161 [inline] udp_tunnel6_xmit_skb+0x71c/0xc80 net/ipv6/ip6_udp_tunnel.c:109 send6+0x48f/0xcb0 drivers/net/wireguard/socket.c:152 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1371 [inline] free_pcp_prepare+0x549/0xd20 mm/page_alloc.c:1421 free_unref_page_prepare mm/page_alloc.c:3343 [inline] free_unref_page+0x19/0x6a0 mm/page_alloc.c:3438 qlink_free mm/kasan/quarantine.c:168 [inline] qlist_free_all+0x6a/0x170 mm/kasan/quarantine.c:187 kasan_quarantine_reduce+0x180/0x200 mm/kasan/quarantine.c:294 __kasan_slab_alloc+0xa2/0xc0 mm/kasan/common.c:446 kasan_slab_alloc include/linux/kasan.h:224 [inline] slab_post_alloc_hook mm/slab.h:750 [inline] slab_alloc_node mm/slub.c:3214 [inline] kmem_cache_alloc_node+0x255/0x3f0 mm/slub.c:3264 __alloc_skb+0x215/0x340 net/core/skbuff.c:414 alloc_skb include/linux/skbuff.h:1426 [inline] alloc_skb_with_frags+0x93/0x730 net/core/skbuff.c:5992 sock_alloc_send_pskb+0x793/0x920 net/core/sock.c:2662 sock_alloc_send_skb include/net/sock.h:1845 [inline] mld_newpack.isra.0+0x1c3/0x740 net/ipv6/mcast.c:1746 add_grhead+0x283/0x360 net/ipv6/mcast.c:1849 add_grec+0x106a/0x1530 net/ipv6/mcast.c:1987 mld_send_cr net/ipv6/mcast.c:2113 [inline] mld_ifc_work+0x452/0xdc0 net/ipv6/mcast.c:2651 process_one_work+0x996/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e9/0x3a0 kernel/kthread.c:376 Memory state around the buggy address: ffff88801c66d300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff88801c66d380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88801c66d400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88801c66d480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88801c66d500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================