syzbot

binder: 14890:14895 transaction failed 29201/-28, size 24-8 line 3137
binder: 14909:14913 unknown command 536871488
binder: 14909:14913 ioctl c0306201 200001c0 returned -22
binder: undelivered TRANSACTION_ERROR: 29201
==================================================================
BUG: KASAN: use-after-free in tcp_skb_pcount include/net/tcp.h:798 [inline]
BUG: KASAN: use-after-free in tcp_init_tso_segs+0x1b9/0x200 net/ipv4/tcp_output.c:1631
Read of size 2 at addr ffff88009a0882b0 by task syz-executor.0/14924

CPU: 1 PID: 14924 Comm: syz-executor.0 Not tainted 4.4.174+ #4
 0000000000000000 14e825704970b683 ffff8800a5317678 ffffffff81aad1a1
 0000000000000000 ffffea0002682200 ffff88009a0882b0 0000000000000002
 ffff88009a088280 ffff8800a53176b0 ffffffff81490120 0000000000000000
Call Trace:
 [<ffffffff81aad1a1>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81aad1a1>] dump_stack+0xc1/0x120 lib/dump_stack.c:51
 [<ffffffff81490120>] print_address_description+0x6f/0x21b mm/kasan/report.c:252
 [<ffffffff81490358>] kasan_report_error mm/kasan/report.c:351 [inline]
 [<ffffffff81490358>] kasan_report mm/kasan/report.c:408 [inline]
 [<ffffffff81490358>] kasan_report.cold+0x8c/0x2be mm/kasan/report.c:393
 [<ffffffff81484e94>] __asan_report_load2_noabort+0x14/0x20 mm/kasan/report.c:427
 [<ffffffff82429649>] tcp_skb_pcount include/net/tcp.h:798 [inline]
 [<ffffffff82429649>] tcp_init_tso_segs+0x1b9/0x200 net/ipv4/tcp_output.c:1631
 [<ffffffff8243336e>] tcp_write_xmit+0x1ae/0x4570 net/ipv4/tcp_output.c:2068
 [<ffffffff82437fcb>] __tcp_push_pending_frames+0xab/0x2b0 net/ipv4/tcp_output.c:2323
 [<ffffffff8243eeab>] tcp_send_fin+0x15b/0xa90 net/ipv4/tcp_output.c:2899
 [<ffffffff823fe9a8>] tcp_close+0xcc8/0xfa0 net/ipv4/tcp.c:2112
 [<ffffffff824a6a3f>] inet_release+0xff/0x1d0 net/ipv4/af_inet.c:435
 [<ffffffff821d36a5>] __sock_release+0xd5/0x260 net/socket.c:592
 [<ffffffff821d384b>] sock_close+0x1b/0x30 net/socket.c:1050
 [<ffffffff8149c8c6>] __fput+0x246/0x710 fs/file_table.c:208
 [<ffffffff8149ce16>] ____fput+0x16/0x20 fs/file_table.c:244
 [<ffffffff8112f352>] task_work_run+0x202/0x2b0 kernel/task_work.c:115
 [<ffffffff810d8b2a>] exit_task_work include/linux/task_work.h:21 [inline]
 [<ffffffff810d8b2a>] do_exit+0x8ea/0x2c60 kernel/exit.c:763
 [<ffffffff810df091>] do_group_exit+0x111/0x300 kernel/exit.c:893
 [<ffffffff81100a97>] get_signal+0x517/0x1570 kernel/signal.c:2321
 [<ffffffff8100bd4c>] do_signal+0x9c/0x1840 arch/x86/kernel/signal.c:712
 [<ffffffff81003da7>] exit_to_usermode_loop+0x127/0x170 arch/x86/entry/common.c:184
 [<ffffffff8100569b>] prepare_exit_to_usermode arch/x86/entry/common.c:221 [inline]
 [<ffffffff8100569b>] syscall_return_slowpath+0x25b/0x2e0 arch/x86/entry/common.c:286
 [<ffffffff82718ce1>] int_ret_from_sys_call+0x25/0xa3

Allocated by task 14922:
 [<ffffffff8102e3c6>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63
 [<ffffffff81483f22>] save_stack mm/kasan/kasan.c:512 [inline]
 [<ffffffff81483f22>] set_track mm/kasan/kasan.c:524 [inline]
 [<ffffffff81483f22>] kasan_kmalloc.part.0+0x62/0xf0 mm/kasan/kasan.c:616
 [<ffffffff81484197>] kasan_kmalloc+0xb7/0xd0 mm/kasan/kasan.c:601
 [<ffffffff8148475f>] kasan_slab_alloc+0xf/0x20 mm/kasan/kasan.c:554
 [<ffffffff8147fe9c>] slab_post_alloc_hook mm/slub.c:1349 [inline]
 [<ffffffff8147fe9c>] slab_alloc_node mm/slub.c:2615 [inline]
 [<ffffffff8147fe9c>] slab_alloc mm/slub.c:2623 [inline]
 [<ffffffff8147fe9c>] kmem_cache_alloc+0xdc/0x2c0 mm/slub.c:2628
 [<ffffffff821f7b1c>] kmem_cache_alloc_node include/linux/slab.h:350 [inline]
 [<ffffffff821f7b1c>] __alloc_skb+0xec/0x5d0 net/core/skbuff.c:218
 [<ffffffff823f9043>] alloc_skb_fclone include/linux/skbuff.h:861 [inline]
 [<ffffffff823f9043>] sk_stream_alloc_skb+0xa3/0x5d0 net/ipv4/tcp.c:833
 [<ffffffff823fbcba>] tcp_sendmsg+0xf8a/0x2ab0 net/ipv4/tcp.c:1178
 [<ffffffff824a8b42>] inet_sendmsg+0x202/0x4d0 net/ipv4/af_inet.c:755
 [<ffffffff821d838e>] sock_sendmsg_nosec net/socket.c:638 [inline]
 [<ffffffff821d838e>] sock_sendmsg+0xbe/0x110 net/socket.c:648
 [<ffffffff821dc4f1>] SYSC_sendto net/socket.c:1678 [inline]
 [<ffffffff821dc4f1>] SyS_sendto+0x201/0x340 net/socket.c:1646
 [<ffffffff82718ba1>] entry_SYSCALL_64_fastpath+0x1e/0x9a

Freed by task 14923:
 [<ffffffff8102e3c6>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63
 [<ffffffff81484820>] save_stack mm/kasan/kasan.c:512 [inline]
 [<ffffffff81484820>] set_track mm/kasan/kasan.c:524 [inline]
 [<ffffffff81484820>] kasan_slab_free+0xb0/0x190 mm/kasan/kasan.c:589
 [<ffffffff8148157e>] slab_free_hook mm/slub.c:1383 [inline]
 [<ffffffff8148157e>] slab_free_freelist_hook mm/slub.c:1405 [inline]
 [<ffffffff8148157e>] slab_free mm/slub.c:2859 [inline]
 [<ffffffff8148157e>] kmem_cache_free+0xbe/0x350 mm/slub.c:2881
 [<ffffffff821ef749>] kfree_skbmem+0xd9/0x110 net/core/skbuff.c:635
 [<ffffffff821fd14e>] __kfree_skb+0x1e/0x30 net/core/skbuff.c:676
 [<ffffffff82438daa>] sk_wmem_free_skb include/net/sock.h:1451 [inline]
 [<ffffffff82438daa>] tcp_write_queue_purge include/net/tcp.h:1460 [inline]
 [<ffffffff82438daa>] tcp_connect_init net/ipv4/tcp_output.c:3138 [inline]
 [<ffffffff82438daa>] tcp_connect+0xafa/0x31b0 net/ipv4/tcp_output.c:3277
 [<ffffffff82446ec0>] tcp_v4_connect+0x1060/0x1930 net/ipv4/tcp_ipv4.c:246
 [<ffffffff824a7a2f>] __inet_stream_connect+0x2cf/0xc70 net/ipv4/af_inet.c:615
 [<ffffffff824a8425>] inet_stream_connect+0x55/0xa0 net/ipv4/af_inet.c:676
 [<ffffffff821dbd05>] SYSC_connect net/socket.c:1570 [inline]
 [<ffffffff821dbd05>] SyS_connect+0x1a5/0x2e0 net/socket.c:1551
 [<ffffffff82718ba1>] entry_SYSCALL_64_fastpath+0x1e/0x9a

The buggy address belongs to the object at ffff88009a088280
 which belongs to the cache skbuff_fclone_cache of size 456
The buggy address is located 48 bytes inside of
 456-byte region [ffff88009a088280, ffff88009a088448)
The buggy address belongs to the page:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral protection fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.4.174+ #4
task: ffffffff82e151c0 task.stack: ffffffff82e00000
RIP: 0010:[<ffffffff81b0c66f>]  [<ffffffff81b0c66f>] lookup_object lib/debugobjects.c:120 [inline]
RIP: 0010:[<ffffffff81b0c66f>]  [<ffffffff81b0c66f>] debug_object_deactivate+0x16f/0x360 lib/debugobjects.c:468
RSP: 0018:ffff8801db607ce0  EFLAGS: 00010006
RAX: 1ffffffff0817848 RBX: 0000000000000003 RCX: 0000000000006c6a
RDX: 05ccd86baba82b8b RSI: ffffffff82eafea0 RDI: 2e66c35d5d415c59
RBP: ffff8801db607dd0 R08: 0000000000000001 R09: ffffffff840bc248
R10: 0000000000000096 R11: 0000000000000000 R12: 2e66c35d5d415c41
R13: dffffc0000000000 R14: 1ffff1003b6c0fa0 R15: ffff8801d6a97df8
FS:  0000000000000000(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000002001f13f CR3: 00000001c1c6f000 CR4: 00000000001606b0
Stack:
 ffff880100000002 ffffffff83a80a10 ffffffff840bc248 ffffffff82eafea0
 0000000041b58ab3 ffffffff82c76921 ffffffff81b0c500 ffffffff82c4d560
 ffffffff811ff5b0 ffffffff00000001 ffffffff00000000 ffffffff83a821b0
Call Trace:
 <IRQ> 
 [<ffffffff8125f8cd>] debug_hrtimer_deactivate kernel/time/hrtimer.c:415 [inline]
 [<ffffffff8125f8cd>] debug_deactivate kernel/time/hrtimer.c:462 [inline]
 [<ffffffff8125f8cd>] __run_hrtimer kernel/time/hrtimer.c:1230 [inline]
 [<ffffffff8125f8cd>] __hrtimer_run_queues+0x1bd/0xfc0 kernel/time/hrtimer.c:1325
 [<ffffffff81262756>] hrtimer_interrupt+0x1b6/0x450 kernel/time/hrtimer.c:1359
 [<ffffffff8108a9d6>] local_apic_timer_interrupt+0x76/0xa0 arch/x86/kernel/apic/apic.c:901
 [<ffffffff8271b249>] smp_apic_timer_interrupt+0x79/0xb0 arch/x86/kernel/apic/apic.c:925
 [<ffffffff8271a59d>] apic_timer_interrupt+0x9d/0xb0 arch/x86/entry/entry_64.S:768
 <EOI> 
 [<ffffffff81022d50>] arch_cpu_idle+0x10/0x20 arch/x86/kernel/process.c:423
 [<ffffffff811eb4c8>] default_idle_call+0x48/0x70 kernel/sched/idle.c:93
 [<ffffffff811ebca1>] cpuidle_idle_call kernel/sched/idle.c:157 [inline]
 [<ffffffff811ebca1>] cpu_idle_loop kernel/sched/idle.c:253 [inline]
 [<ffffffff811ebca1>] cpu_startup_entry+0x6d1/0x810 kernel/sched/idle.c:301
 [<ffffffff827055f9>] rest_init+0x190/0x199 init/main.c:410
 [<ffffffff831d58a0>] start_kernel+0x64a/0x67e init/main.c:682
 [<ffffffff831d430a>] x86_64_start_reservations+0x29/0x2b arch/x86/kernel/head64.c:196
 [<ffffffff831d4443>] x86_64_start_kernel+0x137/0x15a arch/x86/kernel/head64.c:185
Code: 48 c1 ea 03 42 80 3c 2a 00 0f 85 8e 01 00 00 4d 8b 24 24 4d 85 e4 0f 84 e9 00 00 00 49 8d 7c 24 18 83 c3 01 48 89 fa 48 c1 ea 03 <42> 80 3c 2a 00 0f 85 3f 01 00 00 4d 3b 7c 24 18 75 c0 49 8d 7c 
RIP  [<ffffffff81b0c66f>] lookup_object lib/debugobjects.c:120 [inline]
RIP  [<ffffffff81b0c66f>] debug_object_deactivate+0x16f/0x360 lib/debugobjects.c:468
 RSP <ffff8801db607ce0>
---[ end trace d508202cda250343 ]---