RDX: 0000000000000001 RSI: 0000000020005f00 RDI: 0000000000000003
RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f11f09996d4
R13: 00000000004c34d9 R14: 00000000004d52b0 R15: 0000000000000004
==================================================================
BUG: KASAN: slab-out-of-bounds in tls_fill_prepend include/net/tls.h:368 [inline]
BUG: KASAN: slab-out-of-bounds in tls_push_record+0x10b9/0x1480 net/tls/tls_sw.c:220
Write of size 1 at addr ffff8801800c8000 by task syz-executor4/17743
CPU: 1 PID: 17743 Comm: syz-executor4 Not tainted 4.19.0-rc8+ #286
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1c4/0x2b4 lib/dump_stack.c:113
print_address_description.cold.8+0x9/0x1ff mm/kasan/report.c:256
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report.cold.9+0x242/0x309 mm/kasan/report.c:412
__asan_report_store1_noabort+0x17/0x20 mm/kasan/report.c:435
tls_fill_prepend include/net/tls.h:368 [inline]
tls_push_record+0x10b9/0x1480 net/tls/tls_sw.c:220
tls_sw_push_pending_record+0x22/0x30 net/tls/tls_sw.c:257
tls_push_pending_closed_record+0x10c/0x150 net/tls/tls_main.c:203
tls_complete_pending_work include/net/tls.h:298 [inline]
tls_sk_proto_close+0x7c2/0xbb0 net/tls/tls_main.c:270
inet_release+0x104/0x1f0 net/ipv4/af_inet.c:428
inet6_release+0x50/0x70 net/ipv6/af_inet6.c:457
__sock_release+0xd7/0x250 net/socket.c:579
sock_close+0x19/0x20 net/socket.c:1141
__fput+0x385/0xa30 fs/file_table.c:278
____fput+0x15/0x20 fs/file_table.c:309
task_work_run+0x1e8/0x2a0 kernel/task_work.c:113
tracehook_notify_resume include/linux/tracehook.h:193 [inline]
exit_to_usermode_loop+0x318/0x380 arch/x86/entry/common.c:166
prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline]
syscall_return_slowpath arch/x86/entry/common.c:268 [inline]
do_syscall_64+0x6be/0x820 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x411021
Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 34 19 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01
RSP: 002b:0000000000a3fd90 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000411021
RDX: 0000001b2f220000 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 0000000000000000 R08: 000000005e4a43b7 R09: 000000005e4a43bb
R10: 0000000000a3fcc0 R11: 0000000000000293 R12: 0000000000000000
R13: 0000000000000001 R14: 00000000000001be R15: 0000000000000004
Allocated by task 5406:
save_stack+0x43/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:553
kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:490
kmem_cache_alloc+0x12e/0x730 mm/slab.c:3554
getname_flags+0xd0/0x5a0 fs/namei.c:140
getname fs/namei.c:211 [inline]
__do_sys_unlink fs/namei.c:4110 [inline]
__se_sys_unlink fs/namei.c:4108 [inline]
__x64_sys_unlink+0x35/0x50 fs/namei.c:4108
do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 5406:
save_stack+0x43/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
__kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
__cache_free mm/slab.c:3498 [inline]
kmem_cache_free+0x83/0x290 mm/slab.c:3756
putname+0xf2/0x130 fs/namei.c:261
do_unlinkat+0x236/0xa30 fs/namei.c:4084
__do_sys_unlink fs/namei.c:4110 [inline]
__se_sys_unlink fs/namei.c:4108 [inline]
__x64_sys_unlink+0x42/0x50 fs/namei.c:4108
do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
kobject: 'queues' (00000000740f9b8c): kobject_uevent_env: filter function caused the event to drop!
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff8801800c8140
which belongs to the cache names_cache of size 4096
The buggy address is located 320 bytes to the left of
4096-byte region [ffff8801800c8140, ffff8801800c9140)
The buggy address belongs to the page:
page:ffffea0006003200 count:1 mapcount:0 mapping:ffff8801da972d80 index:0x0 compound_mapcount: 0
flags: 0x2fffc0000008100(slab|head)
raw: 02fffc0000008100 ffffea000605db88 ffffea0006003288 ffff8801da972d80
kobject: 'rx-0' (000000006e906efd): kobject_add_internal: parent: 'queues', set: 'queues'
raw: 0000000000000000 ffff8801800c8140 0000000100000001 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8801800c7f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8801800c7f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8801800c8000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff8801800c8080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8801800c8100: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
==================================================================
kobject: 'rx-0' (000000006e906efd): kobject_uevent_env
kobject: 'kvm' (000000006921b291): kobject_uevent_env
kobject: 'loop5' (00000000d5fe803b): kobject_uevent_env
kobject: 'kvm' (000000006921b291): fill_kobj_path: path = '/devices/virtual/misc/kvm'
kobject: 'loop5' (00000000d5fe803b): fill_kobj_path: path = '/devices/virtual/block/loop5'