==================================================================
BUG: KASAN: use-after-free in tcp_retransmit_timer+0x2ef3/0x3360 net/ipv4/tcp_timer.c:511
Read of size 8 at addr ffff8880510a82c0 by task swapper/2/0
CPU: 2 PID: 0 Comm: swapper/2 Not tainted 5.18.0-syzkaller-10037-g7e284070abe5 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_address_description.constprop.0.cold+0xeb/0x495 mm/kasan/report.c:313
print_report mm/kasan/report.c:429 [inline]
kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491
tcp_retransmit_timer+0x2ef3/0x3360 net/ipv4/tcp_timer.c:511
tcp_write_timer_handler+0x5e6/0xbc0 net/ipv4/tcp_timer.c:622
tcp_write_timer+0xa2/0x2b0 net/ipv4/tcp_timer.c:642
call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1474
expire_timers kernel/time/timer.c:1519 [inline]
__run_timers.part.0+0x679/0xa80 kernel/time/timer.c:1790
__run_timers kernel/time/timer.c:1768 [inline]
run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1803
__do_softirq+0x29b/0x9c2 kernel/softirq.c:571
invoke_softirq kernel/softirq.c:445 [inline]
__irq_exit_rcu+0x123/0x180 kernel/softirq.c:650
irq_exit_rcu+0x5/0x20 kernel/softirq.c:662
sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1106
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:default_idle+0xb/0x10 arch/x86/kernel/process.c:729
Code: ff ff ff 48 89 df e8 44 6d 4e f8 e9 55 ff ff ff 4c 89 e7 e8 37 6d 4e f8 eb 96 0f 1f 44 00 00 eb 07 0f 00 2d a7 fd 4d 00 fb f4 cc cc cc cc 41 55 41 54 55 48 89 fd 53 e8 02 b9 01 f8 e8 8d 11
RSP: 0018:ffffc9000047fe00 EFLAGS: 00000206
RAX: 0000000000350809 RBX: ffff888011521d80 RCX: ffffffff8975be91
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 0000000000000002 R08: 0000000000000001 R09: ffff88802cc3b013
R10: ffffed1005987602 R11: 0000000000000000 R12: ffffed10022a43b0
R13: 0000000000000002 R14: ffffffff8dbb90d0 R15: 0000000000000000
default_idle_call+0x80/0xc0 kernel/sched/idle.c:109
cpuidle_idle_call kernel/sched/idle.c:191 [inline]
do_idle+0x401/0x590 kernel/sched/idle.c:303
cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:400
start_secondary+0x21d/0x2b0 arch/x86/kernel/smpboot.c:266
secondary_startup_64_no_verify+0xce/0xdb
Allocated by task 3703:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track mm/kasan/common.c:45 [inline]
set_alloc_info mm/kasan/common.c:436 [inline]
__kasan_slab_alloc+0x90/0xc0 mm/kasan/common.c:469
kasan_slab_alloc include/linux/kasan.h:224 [inline]
slab_post_alloc_hook mm/slab.h:750 [inline]
slab_alloc_node mm/slub.c:3214 [inline]
slab_alloc mm/slub.c:3222 [inline]
__kmem_cache_alloc_lru mm/slub.c:3229 [inline]
kmem_cache_alloc+0x204/0x3b0 mm/slub.c:3239
kmem_cache_zalloc include/linux/slab.h:723 [inline]
net_alloc net/core/net_namespace.c:403 [inline]
copy_net_ns+0x125/0x760 net/core/net_namespace.c:458
create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110
unshare_nsproxy_namespaces+0xc1/0x1f0 kernel/nsproxy.c:226
ksys_unshare+0x445/0x920 kernel/fork.c:3135
__do_sys_unshare kernel/fork.c:3206 [inline]
__se_sys_unshare kernel/fork.c:3204 [inline]
__ia32_sys_unshare+0x2c/0x40 kernel/fork.c:3204
do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
__do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178
do_fast_syscall_32+0x2f/0x70 arch/x86/entry/common.c:203
entry_SYSENTER_compat_after_hwframe+0x53/0x62
Last potentially related work creation:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
__kasan_record_aux_stack+0xbe/0xd0 mm/kasan/generic.c:348
insert_work+0x48/0x350 kernel/workqueue.c:1358
__queue_work+0x62e/0x1140 kernel/workqueue.c:1517
call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1474
expire_timers kernel/time/timer.c:1514 [inline]
__run_timers.part.0+0x4a3/0xa80 kernel/time/timer.c:1790
__run_timers kernel/time/timer.c:1768 [inline]
run_timer_softirq+0x152/0x1d0 kernel/time/timer.c:1805
__do_softirq+0x29b/0x9c2 kernel/softirq.c:571
Second to last potentially related work creation:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
__kasan_record_aux_stack+0xbe/0xd0 mm/kasan/generic.c:348
insert_work+0x48/0x350 kernel/workqueue.c:1358
__queue_work+0x62e/0x1140 kernel/workqueue.c:1517
call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1474
expire_timers kernel/time/timer.c:1514 [inline]
__run_timers.part.0+0x4a3/0xa80 kernel/time/timer.c:1790
__run_timers kernel/time/timer.c:1768 [inline]
run_timer_softirq+0x152/0x1d0 kernel/time/timer.c:1805
__do_softirq+0x29b/0x9c2 kernel/softirq.c:571
The buggy address belongs to the object at ffff8880510a8000
which belongs to the cache net_namespace of size 6784
The buggy address is located 704 bytes inside of
6784-byte region [ffff8880510a8000, ffff8880510a9a80)
The buggy address belongs to the physical page:
page:ffffea0001442a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880510a8000 pfn:0x510a8
head:ffffea0001442a00 order:3 compound_mapcount:0 compound_pincount:0
memcg:ffff88806e983981
flags: 0x4fff00000010200(slab|head|node=1|zone=1|lastcpupid=0x7ff)
raw: 04fff00000010200 ffff888040005288 ffffea0001d87608 ffff888040042f00
raw: ffff8880510a8000 0000000000040000 00000001ffffffff ffff88806e983981
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3703, tgid 3703 (syz-executor.2), ts 167272282295, free_ts 123866233944
prep_new_page mm/page_alloc.c:2436 [inline]
get_page_from_freelist+0xbb3/0x3b80 mm/page_alloc.c:4178
__alloc_pages+0x1c7/0x510 mm/page_alloc.c:5406
alloc_pages+0x1aa/0x310 mm/mempolicy.c:2272
alloc_slab_page mm/slub.c:1797 [inline]
allocate_slab+0x26c/0x3c0 mm/slub.c:1942
new_slab mm/slub.c:2002 [inline]
___slab_alloc+0x985/0xd90 mm/slub.c:3002
__slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3089
slab_alloc_node mm/slub.c:3180 [inline]
slab_alloc mm/slub.c:3222 [inline]
__kmem_cache_alloc_lru mm/slub.c:3229 [inline]
kmem_cache_alloc+0x360/0x3b0 mm/slub.c:3239
kmem_cache_zalloc include/linux/slab.h:723 [inline]
net_alloc net/core/net_namespace.c:403 [inline]
copy_net_ns+0x125/0x760 net/core/net_namespace.c:458
create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110
unshare_nsproxy_namespaces+0xc1/0x1f0 kernel/nsproxy.c:226
ksys_unshare+0x445/0x920 kernel/fork.c:3135
__do_sys_unshare kernel/fork.c:3206 [inline]
__se_sys_unshare kernel/fork.c:3204 [inline]
__ia32_sys_unshare+0x2c/0x40 kernel/fork.c:3204
do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
__do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178
do_fast_syscall_32+0x2f/0x70 arch/x86/entry/common.c:203
entry_SYSENTER_compat_after_hwframe+0x53/0x62
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1351 [inline]
free_pcp_prepare+0x549/0xd20 mm/page_alloc.c:1401
free_unref_page_prepare mm/page_alloc.c:3323 [inline]
free_unref_page+0x19/0x6a0 mm/page_alloc.c:3418
__put_page+0x17d/0x280 mm/swap.c:127
folio_put include/linux/mm.h:1200 [inline]
put_page include/linux/mm.h:1233 [inline]
__skb_frag_unref include/linux/skbuff.h:3480 [inline]
skb_release_data+0x513/0x810 net/core/skbuff.c:672
skb_release_all net/core/skbuff.c:742 [inline]
__kfree_skb net/core/skbuff.c:756 [inline]
napi_consume_skb+0x256/0x340 net/core/skbuff.c:991
skb_defer_free_flush net/core/dev.c:6634 [inline]
net_rx_action+0x342/0xd90 net/core/dev.c:6655
__do_softirq+0x29b/0x9c2 kernel/softirq.c:571
Memory state around the buggy address:
ffff8880510a8180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880510a8200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8880510a8280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880510a8300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880510a8380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess), 2 bytes skipped:
0: ff 48 89 decl -0x77(%rax)
3: df e8 fucomip %st(0),%st
5: 44 6d rex.R insl (%dx),%es:(%rdi)
7: 4e f8 rex.WRX clc
9: e9 55 ff ff ff jmpq 0xffffff63
e: 4c 89 e7 mov %r12,%rdi
11: e8 37 6d 4e f8 callq 0xf84e6d4d
16: eb 96 jmp 0xffffffae
18: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
1d: eb 07 jmp 0x26
1f: 0f 00 2d a7 fd 4d 00 verw 0x4dfda7(%rip) # 0x4dfdcd
26: fb sti
27: f4 hlt
* 28: c3 retq <-- trapping instruction
29: cc int3
2a: cc int3
2b: cc int3
2c: cc int3
2d: 41 55 push %r13
2f: 41 54 push %r12
31: 55 push %rbp
32: 48 89 fd mov %rdi,%rbp
35: 53 push %rbx
36: e8 02 b9 01 f8 callq 0xf801b93d
3b: e8 .byte 0xe8
3c: 8d 11 lea (%rcx),%edx