general protection fault in tcp_sk

Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
android-5-10	general protection fault in tcp_sk_exit (2)				1	860d	860d	0/2	auto-obsoleted due to no activity on 2022/10/15 01:07
upstream	general protection fault in tcp_sk_exit mm				4	2300d	2300d	0/28	closed as invalid on 2018/09/05 11:21
upstream	KASAN: use-after-free Read in tcp_sk_exit (2) net	syz	error	error	6	1121d	1238d	0/28	closed as invalid on 2022/01/11 13:53

general protection fault, probably for non-canonical address 0xdffffc0010000051: 0000 [#1] PREEMPT SMP KASAN KASAN: probably user-memory-access in range [0x0000000080000288-0x000000008000028f] CPU: 0 PID: 9 Comm: kworker/u4:1 Not tainted 5.10.109-syzkaller-00693-g414e6c8e941c #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: netns cleanup_net RIP: 0010:inet_ctl_sock_destroy include/net/inet_common.h:63 [inline] RIP: 0010:tcp_sk_exit+0x188/0x280 net/ipv4/tcp_ipv4.c:2830 Code: 80 3c 28 00 74 08 4c 89 e7 e8 b4 c4 a2 fd 49 8b 1c 24 48 85 db 74 3b e8 c6 fe 68 fd 48 81 c3 88 02 00 00 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 df e8 89 c4 a2 fd 48 8b 3b e8 e1 84 b5 RSP: 0018:ffffc90000097bf8 EFLAGS: 00010202 RAX: 0000000010000051 RBX: 000000008000028b RCX: ffff8881002393c0 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000008 RBP: ffffc90000097c30 R08: ffffffff8403b5e3 R09: 0000000000000003 R10: fffff52000012f71 R11: 1ffff92000012f70 R12: ffffe8ffffc3d160 R13: dffffc0000000000 R14: ffff88810ea2e3c8 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000555555a1ab38 CR3: 0000000143484000 CR4: 00000000003506b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ops_exit_list net/core/net_namespace.c:187 [inline] cleanup_net+0x6e4/0xd70 net/core/net_namespace.c:608 process_one_work+0x726/0xc10 kernel/workqueue.c:2296 worker_thread+0xb27/0x1550 kernel/workqueue.c:2442 kthread+0x349/0x3d0 kernel/kthread.c:313 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296 Modules linked in: ---[ end trace a9fb546da2d2c77f ]--- RIP: 0010:inet_ctl_sock_destroy include/net/inet_common.h:63 [inline] RIP: 0010:tcp_sk_exit+0x188/0x280 net/ipv4/tcp_ipv4.c:2830 Code: 80 3c 28 00 74 08 4c 89 e7 e8 b4 c4 a2 fd 49 8b 1c 24 48 85 db 74 3b e8 c6 fe 68 fd 48 81 c3 88 02 00 00 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 df e8 89 c4 a2 fd 48 8b 3b e8 e1 84 b5 RSP: 0018:ffffc90000097bf8 EFLAGS: 00010202 RAX: 0000000010000051 RBX: 000000008000028b RCX: ffff8881002393c0 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000008 RBP: ffffc90000097c30 R08: ffffffff8403b5e3 R09: 0000000000000003 R10: fffff52000012f71 R11: 1ffff92000012f70 R12: ffffe8ffffc3d160 R13: dffffc0000000000 R14: ffff88810ea2e3c8 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f660b4b25a8 CR3: 000000010c53c000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 80 3c 28 00 cmpb $0x0,(%rax,%rbp,1) 4: 74 08 je 0xe 6: 4c 89 e7 mov %r12,%rdi 9: e8 b4 c4 a2 fd callq 0xfda2c4c2 e: 49 8b 1c 24 mov (%r12),%rbx 12: 48 85 db test %rbx,%rbx 15: 74 3b je 0x52 17: e8 c6 fe 68 fd callq 0xfd68fee2 1c: 48 81 c3 88 02 00 00 add $0x288,%rbx 23: 48 89 d8 mov %rbx,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) <-- trapping instruction 2f: 74 08 je 0x39 31: 48 89 df mov %rbx,%rdi 34: e8 89 c4 a2 fd callq 0xfda2c4c2 39: 48 8b 3b mov (%rbx),%rdi 3c: e8 .byte 0xe8 3d: e1 84 loope 0xffffffc3 3f: b5 .byte 0xb5