general protection fault in tcp_sk

Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
android-5-10	general protection fault in tcp_sk_exit				1	960d	960d	0/2	auto-closed as invalid on 2022/07/07 14:15
upstream	general protection fault in tcp_sk_exit mm				4	2300d	2300d	0/28	closed as invalid on 2018/09/05 11:21
upstream	KASAN: use-after-free Read in tcp_sk_exit (2) net	syz	error	error	6	1121d	1238d	0/28	closed as invalid on 2022/01/11 13:53

general protection fault, probably for non-canonical address 0xdffffc00e0000051: 0000 [#1] PREEMPT SMP KASAN KASAN: probably user-memory-access in range [0x0000000700000288-0x000000070000028f] CPU: 1 PID: 2491 Comm: syz-executor.2 Not tainted 5.10.119-syzkaller-00334-gebc9fb07d294 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 RIP: 0010:inet_ctl_sock_destroy include/net/inet_common.h:63 [inline] RIP: 0010:tcp_sk_exit+0x188/0x280 net/ipv4/tcp_ipv4.c:2830 Code: 80 3c 28 00 74 08 4c 89 e7 e8 24 ca a2 fd 49 8b 1c 24 48 85 db 74 3b e8 16 ce 68 fd 48 81 c3 88 02 00 00 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 df e8 f9 c9 a2 fd 48 8b 3b e8 e1 78 b5 RSP: 0018:ffffc9000627f818 EFLAGS: 00010203 RAX: 00000000e0000051 RBX: 000000070000028f RCX: ffff888154b5bb40 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000008 RBP: ffffc9000627f850 R08: ffffffff8403e703 R09: 0000000000000003 R10: fffff52000c4fef5 R11: 1ffff92000c4fef4 R12: ffffe8ffffc44930 R13: dffffc0000000000 R14: ffff88810fb116c8 R15: 0000000000000000 FS: 00007f67d7619700(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f8113b4cc18 CR3: 00000001057ba000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: ops_exit_list net/core/net_namespace.c:187 [inline] setup_net+0x609/0xa70 net/core/net_namespace.c:367 copy_net_ns+0x317/0x520 net/core/net_namespace.c:485 create_new_namespaces+0x425/0x710 kernel/nsproxy.c:110 copy_namespaces+0x1d1/0x220 kernel/nsproxy.c:179 copy_process+0x1383/0x33a0 kernel/fork.c:2154 kernel_clone+0x22d/0x900 kernel/fork.c:2523 __do_sys_clone3 kernel/fork.c:2800 [inline] __se_sys_clone3 kernel/fork.c:2784 [inline] __x64_sys_clone3+0x375/0x3a0 kernel/fork.c:2784 do_syscall_64+0x34/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f67d8506199 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f67d7619038 EFLAGS: 00000246 ORIG_RAX: 00000000000001b3 RAX: ffffffffffffffda RBX: 00007f67d86191d0 RCX: 00007f67d8506199 RDX: 0000000000000000 RSI: 0000000000000058 RDI: 00007f67d7619050 RBP: 00007f67d856013b R08: 0000000000000000 R09: 0000000000000058 R10: 00007f67d7619050 R11: 0000000000000246 R12: 0000000000000058 R13: 00007fffcb84d88f R14: 00007f67d7619300 R15: 0000000000022000 Modules linked in: ---[ end trace 6c80ed8e80339cc1 ]--- RIP: 0010:inet_ctl_sock_destroy include/net/inet_common.h:63 [inline] RIP: 0010:tcp_sk_exit+0x188/0x280 net/ipv4/tcp_ipv4.c:2830 Code: 80 3c 28 00 74 08 4c 89 e7 e8 24 ca a2 fd 49 8b 1c 24 48 85 db 74 3b e8 16 ce 68 fd 48 81 c3 88 02 00 00 48 89 d8 48 c1 e8 03 <42> 80 3c 28 00 74 08 48 89 df e8 f9 c9 a2 fd 48 8b 3b e8 e1 78 b5 RSP: 0018:ffffc9000627f818 EFLAGS: 00010203 RAX: 00000000e0000051 RBX: 000000070000028f RCX: ffff888154b5bb40 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000008 RBP: ffffc9000627f850 R08: ffffffff8403e703 R09: 0000000000000003 R10: fffff52000c4fef5 R11: 1ffff92000c4fef4 R12: ffffe8ffffc44930 R13: dffffc0000000000 R14: ffff88810fb116c8 R15: 0000000000000000 FS: 00007f67d7619700(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f8113b4cc18 CR3: 00000001057ba000 CR4: 00000000003506a0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 80 3c 28 00 cmpb $0x0,(%rax,%rbp,1) 4: 74 08 je 0xe 6: 4c 89 e7 mov %r12,%rdi 9: e8 24 ca a2 fd callq 0xfda2ca32 e: 49 8b 1c 24 mov (%r12),%rbx 12: 48 85 db test %rbx,%rbx 15: 74 3b je 0x52 17: e8 16 ce 68 fd callq 0xfd68ce32 1c: 48 81 c3 88 02 00 00 add $0x288,%rbx 23: 48 89 d8 mov %rbx,%rax 26: 48 c1 e8 03 shr $0x3,%rax * 2a: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) <-- trapping instruction 2f: 74 08 je 0x39 31: 48 89 df mov %rbx,%rdi 34: e8 f9 c9 a2 fd callq 0xfda2ca32 39: 48 8b 3b mov (%rbx),%rdi 3c: e8 .byte 0xe8 3d: e1 78 loope 0xb7 3f: b5 .byte 0xb5