==================================================================
BUG: KASAN: use-after-free in nr_add_node+0x1d78/0x1fc4 net/netrom/nr_route.c:248
Read of size 2 at addr ffff0000c86f3732 by task syz-executor323/4347
CPU: 1 PID: 4347 Comm: syz-executor323 Not tainted 5.15.176-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
Call trace:
dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
print_address_description+0x7c/0x3f0 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:434 [inline]
kasan_report+0x174/0x1e4 mm/kasan/report.c:451
__asan_report_load2_noabort+0x44/0x50 mm/kasan/report_generic.c:307
nr_add_node+0x1d78/0x1fc4 net/netrom/nr_route.c:248
nr_rt_ioctl+0xe58/0x18c8 net/netrom/nr_route.c:651
nr_ioctl+0x14c/0x4b0 net/netrom/af_netrom.c:1253
sock_do_ioctl+0x134/0x2dc net/socket.c:1140
sock_ioctl+0x4f0/0x8ac net/socket.c:1257
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl fs/ioctl.c:860 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
Allocated by task 4338:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:46 [inline]
set_alloc_info mm/kasan/common.c:434 [inline]
____kasan_kmalloc+0xbc/0xfc mm/kasan/common.c:513
__kasan_kmalloc+0x10/0x1c mm/kasan/common.c:522
kasan_kmalloc include/linux/kasan.h:264 [inline]
kmem_cache_alloc_trace+0x27c/0x47c mm/slub.c:3247
kmalloc include/linux/slab.h:591 [inline]
nr_add_node+0x78c/0x1fc4 net/netrom/nr_route.c:146
nr_rt_ioctl+0xe58/0x18c8 net/netrom/nr_route.c:651
nr_ioctl+0x14c/0x4b0 net/netrom/af_netrom.c:1253
sock_do_ioctl+0x134/0x2dc net/socket.c:1140
sock_ioctl+0x4f0/0x8ac net/socket.c:1257
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl fs/ioctl.c:860 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
Freed by task 4347:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track+0x4c/0x84 mm/kasan/common.c:46
kasan_set_free_info+0x28/0x4c mm/kasan/generic.c:360
____kasan_slab_free+0x118/0x164 mm/kasan/common.c:366
__kasan_slab_free+0x18/0x28 mm/kasan/common.c:374
kasan_slab_free include/linux/kasan.h:230 [inline]
slab_free_hook mm/slub.c:1705 [inline]
slab_free_freelist_hook+0x128/0x1ec mm/slub.c:1731
slab_free mm/slub.c:3499 [inline]
kfree+0x178/0x410 mm/slub.c:4559
nr_neigh_put+0x154/0x1f4 include/net/netrom.h:142
nr_add_node+0x1290/0x1fc4 net/netrom/nr_route.c:246
nr_rt_ioctl+0xe58/0x18c8 net/netrom/nr_route.c:651
nr_ioctl+0x14c/0x4b0 net/netrom/af_netrom.c:1253
sock_do_ioctl+0x134/0x2dc net/socket.c:1140
sock_ioctl+0x4f0/0x8ac net/socket.c:1257
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl fs/ioctl.c:860 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
The buggy address belongs to the object at ffff0000c86f3700
which belongs to the cache kmalloc-128 of size 128
The buggy address is located 50 bytes inside of
128-byte region [ffff0000c86f3700, ffff0000c86f3780)
The buggy address belongs to the page:
page:000000008f95098a refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1086f3
flags: 0x5ffc00000000200(slab|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000200 fffffc00033cd4c0 0000000700000007 ffff0000c0002300
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff0000c86f3600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff0000c86f3680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff0000c86f3700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff0000c86f3780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff0000c86f3800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Unable to handle kernel paging request at virtual address 006f80638000021f
Mem abort info:
ESR = 0x0000000096000004
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
FSC = 0x04: level 0 translation fault
Data abort info:
ISV = 0, ISS = 0x00000004
CM = 0, WnR = 0
[006f80638000021f] address between user and kernel address ranges
Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 4347 Comm: syz-executor323 Tainted: G B 5.15.176-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--)
pc : __hlist_del include/linux/list.h:856 [inline]
pc : hlist_del_init include/linux/list.h:884 [inline]
pc : __nr_remove_neigh net/netrom/nr_route.c:298 [inline]
pc : nr_remove_neigh+0x6c/0xec net/netrom/nr_route.c:308
lr : __hlist_del include/linux/list.h:853 [inline]
lr : hlist_del_init include/linux/list.h:884 [inline]
lr : __nr_remove_neigh net/netrom/nr_route.c:298 [inline]
lr : nr_remove_neigh+0x64/0xec net/netrom/nr_route.c:308
sp : ffff800020c976d0
x29: ffff800020c976d0 x28: ffff0000c1631200 x27: 000000000000ffff
x26: 0000000000000000 x25: 1fffe0001917d143 x24: ffff0000c8be8a1f
x23: dfff800000000000 x22: dfff800000000000 x21: 0000000000000000
x20: ab80031c000010fb x19: ffff0000c86f3700 x18: 0000000000000203
x17: 0000000000000000 x16: ffff8000088d5500 x15: 00000000ffffffff
x14: ffff0000c8581b40 x13: 0000000000000001 x12: ffff700004192ebc
x11: 1ffff00004192ebc x10: 0000000000000004 x9 : ffff80001b8353d0
x8 : 157000638000021f x7 : 0000000000000000 x6 : ffff800010da1714
x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff800010da1748
x2 : 0000000000000000 x1 : 0000000000000008 x0 : 0000000000000000
Call trace:
__hlist_del include/linux/list.h:853 [inline]
hlist_del_init include/linux/list.h:884 [inline]
__nr_remove_neigh net/netrom/nr_route.c:298 [inline]
nr_remove_neigh+0x6c/0xec net/netrom/nr_route.c:308
nr_add_node+0x17e4/0x1fc4 net/netrom/nr_route.c:249
nr_rt_ioctl+0xe58/0x18c8 net/netrom/nr_route.c:651
nr_ioctl+0x14c/0x4b0 net/netrom/af_netrom.c:1253
sock_do_ioctl+0x134/0x2dc net/socket.c:1140
sock_ioctl+0x4f0/0x8ac net/socket.c:1257
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:874 [inline]
__se_sys_ioctl fs/ioctl.c:860 [inline]
__arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608
el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626
el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584
Code: aa1303e0 97c5cabb d343fe88 f9400275 (38766908)
---[ end trace da4c760d27ea920c ]---
----------------
Code disassembly (best guess):
0: aa1303e0 mov x0, x19
4: 97c5cabb bl 0xffffffffff172af0
8: d343fe88 lsr x8, x20, #3
c: f9400275 ldr x21, [x19]
* 10: 38766908 ldrb w8, [x8, x22] <-- trapping instruction