==================================================================
BUG: KASAN: use-after-free in rht_key_hashfn include/linux/rhashtable.h:159 [inline]
BUG: KASAN: use-after-free in __rhashtable_lookup include/linux/rhashtable.h:604 [inline]
BUG: KASAN: use-after-free in rhashtable_lookup include/linux/rhashtable.h:646 [inline]
BUG: KASAN: use-after-free in rhashtable_lookup_fast+0x77a/0x9b0 include/linux/rhashtable.h:672
Read of size 4 at addr ffff888023b88008 by task kworker/u8:4/79
CPU: 1 PID: 79 Comm: kworker/u8:4 Not tainted 6.8.0-syzkaller-05204-g237bb5f7f7f5 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/29/2024
Workqueue: netns cleanup_net
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x169/0x550 mm/kasan/report.c:488
kasan_report+0x143/0x180 mm/kasan/report.c:601
rht_key_hashfn include/linux/rhashtable.h:159 [inline]
__rhashtable_lookup include/linux/rhashtable.h:604 [inline]
rhashtable_lookup include/linux/rhashtable.h:646 [inline]
rhashtable_lookup_fast+0x77a/0x9b0 include/linux/rhashtable.h:672
ila_lookup_wildcards net/ipv6/ila/ila_xlat.c:132 [inline]
ila_xlat_addr net/ipv6/ila/ila_xlat.c:652 [inline]
ila_nf_input+0x1fe/0x3c0 net/ipv6/ila/ila_xlat.c:190
nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]
nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626
nf_hook include/linux/netfilter.h:269 [inline]
NF_HOOK+0x29e/0x450 include/linux/netfilter.h:312
__netif_receive_skb_one_core net/core/dev.c:5538 [inline]
__netif_receive_skb+0x1ea/0x6a0 net/core/dev.c:5652
process_backlog+0x39d/0x7a0 net/core/dev.c:5981
__napi_poll+0xcb/0x490 net/core/dev.c:6632
napi_poll net/core/dev.c:6701 [inline]
net_rx_action+0x7bb/0x1090 net/core/dev.c:6813
__do_softirq+0x2bc/0x943 kernel/softirq.c:554
invoke_softirq kernel/softirq.c:428 [inline]
__irq_exit_rcu+0xf2/0x1c0 kernel/softirq.c:633
irq_exit_rcu+0x9/0x30 kernel/softirq.c:645
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043
</IRQ>
<TASK>
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xd8/0x140 kernel/locking/spinlock.c:194
Code: 9c 8f 44 24 20 42 80 3c 23 00 74 08 4c 89 f7 e8 7e 7c 7d f6 f6 44 24 21 02 75 52 41 f7 c7 00 02 00 00 74 01 fb bf 01 00 00 00 <e8> e3 33 ea f5 65 8b 05 34 16 89 74 85 c0 74 43 48 c7 04 24 0e 36
RSP: 0018:ffffc900020df780 EFLAGS: 00000206
RAX: 2883a4d970a3fe00 RBX: 1ffff9200041bef4 RCX: ffffffff81720c2a
RDX: dffffc0000000000 RSI: ffffffff8baac220 RDI: 0000000000000001
RBP: ffffc900020df810 R08: ffffffff92cc7507 R09: 1ffffffff2598ea0
R10: dffffc0000000000 R11: fffffbfff2598ea1 R12: dffffc0000000000
R13: 1ffff9200041bef0 R14: ffffc900020df7a0 R15: 0000000000000246
free_unref_page_commit+0x57d/0x1140 mm/page_alloc.c:2466
free_unref_page+0x17c/0x3f0 mm/page_alloc.c:2509
folio_put include/linux/mm.h:1494 [inline]
free_large_kmalloc+0x105/0x1c0 mm/slub.c:4380
kfree+0x1c1/0x380 mm/slub.c:4403
rhashtable_free_and_destroy+0x7c6/0x920 lib/rhashtable.c:1163
ila_xlat_exit_net+0x55/0x110 net/ipv6/ila/ila_xlat.c:626
ops_exit_list net/core/net_namespace.c:170 [inline]
cleanup_net+0x802/0xcc0 net/core/net_namespace.c:637
process_one_work kernel/workqueue.c:3254 [inline]
process_scheduled_works+0xa00/0x1770 kernel/workqueue.c:3335
worker_thread+0x86d/0xd70 kernel/workqueue.c:3416
kthread+0x2f0/0x390 kernel/kthread.c:388
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
</TASK>
The buggy address belongs to the physical page:
page:ffffea00008ee200 refcount:0 mapcount:-128 mapping:0000000000000000 index:0x0 pfn:0x23b88
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffff7f(buddy)
raw: 00fff00000000000 ffffea000129fc08 ffffea0000784e08 0000000000000000
raw: 0000000000000000 0000000000000003 00000000ffffff7f 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x152dc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_ZERO), pid 29326, tgid 29326 (syz-executor.2), ts 2479601449425, free_ts 2491794079065
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1533
prep_new_page mm/page_alloc.c:1540 [inline]
get_page_from_freelist+0x33ea/0x3580 mm/page_alloc.c:3311
__alloc_pages+0x256/0x680 mm/page_alloc.c:4569
__alloc_pages_node include/linux/gfp.h:238 [inline]
alloc_pages_node include/linux/gfp.h:261 [inline]
__kmalloc_large_node+0x91/0x1f0 mm/slub.c:3926
__do_kmalloc_node mm/slub.c:3969 [inline]
__kmalloc_node+0x33c/0x4e0 mm/slub.c:3988
kmalloc_node include/linux/slab.h:610 [inline]
kvmalloc_node+0x72/0x190 mm/util.c:634
kvmalloc include/linux/slab.h:728 [inline]
kvzalloc include/linux/slab.h:736 [inline]
bucket_table_alloc lib/rhashtable.c:184 [inline]
rhashtable_init+0x558/0xa90 lib/rhashtable.c:1065
ila_xlat_init_net+0xa0/0x110 net/ipv6/ila/ila_xlat.c:613
ops_init+0x352/0x610 net/core/net_namespace.c:136
setup_net+0x515/0xca0 net/core/net_namespace.c:340
copy_net_ns+0x4e4/0x7b0 net/core/net_namespace.c:505
create_new_namespaces+0x425/0x7b0 kernel/nsproxy.c:110
unshare_nsproxy_namespaces+0x124/0x180 kernel/nsproxy.c:228
ksys_unshare+0x619/0xc10 kernel/fork.c:3322
__do_sys_unshare kernel/fork.c:3393 [inline]
__se_sys_unshare kernel/fork.c:3391 [inline]
__x64_sys_unshare+0x38/0x40 kernel/fork.c:3391
do_syscall_64+0xfb/0x240
page last free pid 79 tgid 79 stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1140 [inline]
free_unref_page_prepare+0x968/0xa90 mm/page_alloc.c:2346
free_unref_page+0x37/0x3f0 mm/page_alloc.c:2486
folio_put include/linux/mm.h:1494 [inline]
free_large_kmalloc+0x105/0x1c0 mm/slub.c:4380
kfree+0x1c1/0x380 mm/slub.c:4403
rhashtable_free_and_destroy+0x7c6/0x920 lib/rhashtable.c:1163
ila_xlat_exit_net+0x55/0x110 net/ipv6/ila/ila_xlat.c:626
ops_exit_list net/core/net_namespace.c:170 [inline]
cleanup_net+0x802/0xcc0 net/core/net_namespace.c:637
process_one_work kernel/workqueue.c:3254 [inline]
process_scheduled_works+0xa00/0x1770 kernel/workqueue.c:3335
worker_thread+0x86d/0xd70 kernel/workqueue.c:3416
kthread+0x2f0/0x390 kernel/kthread.c:388
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:243
Memory state around the buggy address:
ffff888023b87f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888023b87f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888023b88000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888023b88080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888023b88100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess):
0: 9c pushf
1: 8f 44 24 20 pop 0x20(%rsp)
5: 42 80 3c 23 00 cmpb $0x0,(%rbx,%r12,1)
a: 74 08 je 0x14
c: 4c 89 f7 mov %r14,%rdi
f: e8 7e 7c 7d f6 call 0xf67d7c92
14: f6 44 24 21 02 testb $0x2,0x21(%rsp)
19: 75 52 jne 0x6d
1b: 41 f7 c7 00 02 00 00 test $0x200,%r15d
22: 74 01 je 0x25
24: fb sti
25: bf 01 00 00 00 mov $0x1,%edi
* 2a: e8 e3 33 ea f5 call 0xf5ea3412 <-- trapping instruction
2f: 65 8b 05 34 16 89 74 mov %gs:0x74891634(%rip),%eax # 0x7489166a
36: 85 c0 test %eax,%eax
38: 74 43 je 0x7d
3a: 48 rex.W
3b: c7 .byte 0xc7
3c: 04 24 add $0x24,%al
3e: 0e (bad)
3f: 36 ss