syzbot

==================================================================
BUG: KASAN: slab-use-after-free in rose_timer_expiry+0x45a/0x4d0 net/rose/rose_timer.c:183
Read of size 2 at addr ffff88803246202a by task rm/17107

CPU: 1 UID: 0 PID: 17107 Comm: rm Not tainted 6.16.0-rc5-syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:408 [inline]
 print_report+0xcd/0x680 mm/kasan/report.c:521
 kasan_report+0xe0/0x110 mm/kasan/report.c:634
 rose_timer_expiry+0x45a/0x4d0 net/rose/rose_timer.c:183
 call_timer_fn+0x197/0x620 kernel/time/timer.c:1747
 expire_timers kernel/time/timer.c:1798 [inline]
 __run_timers+0x6ef/0x960 kernel/time/timer.c:2372
 __run_timer_base kernel/time/timer.c:2384 [inline]
 __run_timer_base kernel/time/timer.c:2376 [inline]
 run_timer_base+0x114/0x190 kernel/time/timer.c:2393
 run_timer_softirq+0x1a/0x40 kernel/time/timer.c:2403
 handle_softirqs+0x219/0x8e0 kernel/softirq.c:579
 __do_softirq kernel/softirq.c:613 [inline]
 invoke_softirq kernel/softirq.c:453 [inline]
 __irq_exit_rcu+0x109/0x170 kernel/softirq.c:680
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1050 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1050
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:kmalloc_noprof include/linux/slab.h:905 [inline]
RIP: 0010:slab_free_hook mm/slub.c:2333 [inline]
RIP: 0010:slab_free mm/slub.c:4643 [inline]
RIP: 0010:kmem_cache_free+0x12f/0x4d0 mm/slub.c:4745
Code: 00 48 8b 55 08 48 89 de 4c 89 e7 e8 fb 94 0a 00 84 c0 75 54 44 89 e9 81 e1 00 02 00 00 0f 84 89 01 00 00 48 8b 3d e9 fd db 0b <ba> 18 00 00 00 be 00 28 00 00 89 4c 24 18 e8 ee be ff ff 8b 4c 24
RSP: 0018:ffffc9000403f9c0 EFLAGS: 00000206
RAX: 0000000000000000 RBX: ffff888043a18dd0 RCX: 0000000000000200
RDX: 0000000000000001 RSI: ffff888043a18dd0 RDI: ffff88801b841780
RBP: ffffc9000403fa20 R08: 0000000000000110 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000001 R12: ffff88814040a140
R13: 000000000021a300 R14: ffffea00010e8600 R15: 0000000000000000
 anon_vma_free mm/rmap.c:137 [inline]
 __put_anon_vma+0x114/0x3a0 mm/rmap.c:2756
 put_anon_vma include/linux/rmap.h:117 [inline]
 unlink_anon_vmas+0x58a/0x820 mm/rmap.c:444
 free_pgtables+0x373/0xcb0 mm/memory.c:402
 exit_mmap+0x3fb/0xb90 mm/mmap.c:1295
 __mmput+0x12a/0x410 kernel/fork.c:1121
 mmput+0x62/0x70 kernel/fork.c:1144
 exit_mm kernel/exit.c:581 [inline]
 do_exit+0x7c4/0x2bd0 kernel/exit.c:952
 do_group_exit+0xd3/0x2a0 kernel/exit.c:1105
 __do_sys_exit_group kernel/exit.c:1116 [inline]
 __se_sys_exit_group kernel/exit.c:1114 [inline]
 __x64_sys_exit_group+0x3e/0x50 kernel/exit.c:1114
 x64_sys_call+0x1530/0x1730 arch/x86/include/generated/asm/syscalls_64.h:232
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fecca6cd6c5
Code: Unable to access opcode bytes at 0x7fecca6cd69b.
RSP: 002b:00007ffc0a34f4f8 EFLAGS: 00000202 ORIG_RAX: 00000000000000e7
RAX: ffffffffffffffda RBX: 00007fecca7cefe8 RCX: 00007fecca6cd6c5
RDX: 00000000000000e7 RSI: ffffffffffffff88 RDI: 0000000000000000
RBP: 0000000000000001 R08: 00007ffc0a34f488 R09: 0000000000000000
R10: 00007ffc0a34f320 R11: 0000000000000202 R12: 0000000000000000
R13: 0000000000000000 R14: 00007fecca7cd680 R15: 00007fecca7cf000
 </TASK>

Allocated by task 12891:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 poison_kmalloc_redzone mm/kasan/common.c:377 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:394
 kmalloc_noprof include/linux/slab.h:905 [inline]
 rose_add_node net/rose/rose_route.c:85 [inline]
 rose_rt_ioctl+0x87e/0x1d40 net/rose/rose_route.c:740
 rose_ioctl+0x64d/0x7d0 net/rose/af_rose.c:1380
 sock_do_ioctl+0x115/0x280 net/socket.c:1190
 sock_ioctl+0x227/0x6b0 net/socket.c:1311
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:907 [inline]
 __se_sys_ioctl fs/ioctl.c:893 [inline]
 __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:893
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 16879:
 kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576
 poison_slab_object mm/kasan/common.c:247 [inline]
 __kasan_slab_free+0x51/0x70 mm/kasan/common.c:264
 kasan_slab_free include/linux/kasan.h:233 [inline]
 slab_free_hook mm/slub.c:2381 [inline]
 slab_free mm/slub.c:4643 [inline]
 kfree+0x2b4/0x4d0 mm/slub.c:4842
 rose_remove_neigh+0x25e/0x370 net/rose/rose_route.c:240
 rose_rt_device_down+0x2dc/0x430 net/rose/rose_route.c:515
 rose_device_event+0xfc/0x120 net/rose/af_rose.c:248
 notifier_call_chain+0xbc/0x410 kernel/notifier.c:85
 call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:2230
 call_netdevice_notifiers_extack net/core/dev.c:2268 [inline]
 call_netdevice_notifiers net/core/dev.c:2282 [inline]
 __dev_notify_flags+0x1f7/0x2e0 net/core/dev.c:9499
 netif_change_flags+0x108/0x160 net/core/dev.c:9526
 dev_change_flags+0xba/0x250 net/core/dev_api.c:68
 dev_ifsioc+0x1498/0x1f70 net/core/dev_ioctl.c:565
 dev_ioctl+0x223/0x10e0 net/core/dev_ioctl.c:823
 sock_do_ioctl+0x19d/0x280 net/socket.c:1204
 sock_ioctl+0x227/0x6b0 net/socket.c:1311
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:907 [inline]
 __se_sys_ioctl fs/ioctl.c:893 [inline]
 __x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:893
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff888032462000
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 42 bytes inside of
 freed 512-byte region [ffff888032462000, ffff888032462200)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888032461000 pfn:0x32460
head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000240 ffff88801b841c80 ffffea0001620410 ffffea000167cc10
raw: ffff888032461000 000000000010000f 00000000f5000000 0000000000000000
head: 00fff00000000240 ffff88801b841c80 ffffea0001620410 ffffea000167cc10
head: ffff888032461000 000000000010000f 00000000f5000000 0000000000000000
head: 00fff00000000002 ffffea0000c91801 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 6209, tgid 6209 (udevd), ts 180504747077, free_ts 180472126435
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1c0/0x230 mm/page_alloc.c:1704
 prep_new_page mm/page_alloc.c:1712 [inline]
 get_page_from_freelist+0x1321/0x3890 mm/page_alloc.c:3669
 __alloc_frozen_pages_noprof+0x261/0x23f0 mm/page_alloc.c:4959
 alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2419
 alloc_slab_page mm/slub.c:2451 [inline]
 allocate_slab mm/slub.c:2619 [inline]
 new_slab+0x23b/0x330 mm/slub.c:2673
 ___slab_alloc+0xd9c/0x1940 mm/slub.c:3859
 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3949
 __slab_alloc_node mm/slub.c:4024 [inline]
 slab_alloc_node mm/slub.c:4185 [inline]
 __kmalloc_cache_noprof+0xfb/0x3e0 mm/slub.c:4354
 kmalloc_noprof include/linux/slab.h:905 [inline]
 kzalloc_noprof include/linux/slab.h:1039 [inline]
 kernfs_fop_open+0x244/0xda0 fs/kernfs/file.c:623
 do_dentry_open+0x744/0x1c10 fs/open.c:964
 vfs_open+0x82/0x3f0 fs/open.c:1094
 do_open fs/namei.c:3896 [inline]
 path_openat+0x1de4/0x2cb0 fs/namei.c:4055
 do_filp_open+0x20b/0x470 fs/namei.c:4082
 do_sys_openat2+0x11b/0x1d0 fs/open.c:1437
 do_sys_open fs/open.c:1452 [inline]
 __do_sys_openat fs/open.c:1468 [inline]
 __se_sys_openat fs/open.c:1463 [inline]
 __x64_sys_openat+0x174/0x210 fs/open.c:1463
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
page last free pid 7480 tgid 7479 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1248 [inline]
 __free_frozen_pages+0x7fe/0x1180 mm/page_alloc.c:2706
 stack_depot_save_flags+0x354/0xa40 lib/stackdepot.c:678
 kasan_save_stack+0x42/0x60 mm/kasan/common.c:48
 kasan_save_track+0x14/0x30 mm/kasan/common.c:68
 unpoison_slab_object mm/kasan/common.c:319 [inline]
 __kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:345
 kasan_slab_alloc include/linux/kasan.h:250 [inline]
 slab_post_alloc_hook mm/slub.c:4148 [inline]
 slab_alloc_node mm/slub.c:4197 [inline]
 kmem_cache_alloc_noprof+0x1cb/0x3b0 mm/slub.c:4204
 radix_tree_node_alloc.constprop.0+0x7c/0x350 lib/radix-tree.c:276
 idr_get_free+0x528/0xa30 lib/radix-tree.c:1506
 idr_alloc_u32+0x190/0x2f0 lib/idr.c:46
 tcf_idr_check_alloc+0x136/0x770 net/sched/act_api.c:918
 tcf_mirred_init+0x1fc/0xee0 net/sched/act_mirred.c:155
 tcf_action_init_1+0x460/0x6c0 net/sched/act_api.c:1424
 tcf_action_init+0x432/0xa50 net/sched/act_api.c:1499
 tcf_action_add+0xee/0x5c0 net/sched/act_api.c:2093
 tc_ctl_action+0x35b/0x470 net/sched/act_api.c:2150
 rtnetlink_rcv_msg+0x3c9/0xe90 net/core/rtnetlink.c:6953

Memory state around the buggy address:
 ffff888032461f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888032461f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888032462000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                  ^
 ffff888032462080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888032462100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess):
   0:	00 48 8b             	add    %cl,-0x75(%rax)
   3:	55                   	push   %rbp
   4:	08 48 89             	or     %cl,-0x77(%rax)
   7:	de 4c 89 e7          	fimuls -0x19(%rcx,%rcx,4)
   b:	e8 fb 94 0a 00       	call   0xa950b
  10:	84 c0                	test   %al,%al
  12:	75 54                	jne    0x68
  14:	44 89 e9             	mov    %r13d,%ecx
  17:	81 e1 00 02 00 00    	and    $0x200,%ecx
  1d:	0f 84 89 01 00 00    	je     0x1ac
  23:	48 8b 3d e9 fd db 0b 	mov    0xbdbfde9(%rip),%rdi        # 0xbdbfe13
* 2a:	ba 18 00 00 00       	mov    $0x18,%edx <-- trapping instruction
  2f:	be 00 28 00 00       	mov    $0x2800,%esi
  34:	89 4c 24 18          	mov    %ecx,0x18(%rsp)
  38:	e8 ee be ff ff       	call   0xffffbf2b
  3d:	8b                   	.byte 0x8b
  3e:	4c                   	rex.WR
  3f:	24                   	.byte 0x24