Warning: Permanently added '10.128.0.96' (ECDSA) to the list of known hosts. executing program syzkaller login: [ 30.884916] ================================================================== [ 30.892367] BUG: KASAN: use-after-free in padata_parallel_worker+0x2b0/0x2e0 [ 30.899538] Write of size 8 at addr ffff888095c704d8 by task kworker/0:2/3625 [ 30.906787] [ 30.908398] CPU: 0 PID: 3625 Comm: kworker/0:2 Not tainted 4.14.276-syzkaller #0 [ 30.915908] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 30.925250] Workqueue: pencrypt padata_parallel_worker [ 30.930505] Call Trace: [ 30.933075] dump_stack+0x1b2/0x281 [ 30.936683] print_address_description.cold+0x54/0x1d3 [ 30.941938] kasan_report_error.cold+0x8a/0x191 [ 30.946584] ? padata_parallel_worker+0x2b0/0x2e0 [ 30.951406] __asan_report_store8_noabort+0x68/0x70 [ 30.956399] ? padata_parallel_worker+0x2b0/0x2e0 [ 30.961228] padata_parallel_worker+0x2b0/0x2e0 [ 30.965896] ? lock_acquire+0x170/0x3f0 [ 30.969848] ? invoke_padata_reorder+0x40/0x40 [ 30.974417] ? rcu_lockdep_current_cpu_online+0xed/0x140 [ 30.979847] process_one_work+0x793/0x14a0 [ 30.984061] ? work_busy+0x320/0x320 [ 30.987753] ? worker_thread+0x158/0xff0 [ 30.991797] ? _raw_spin_unlock_irq+0x24/0x80 [ 30.996276] worker_thread+0x5cc/0xff0 [ 31.000150] ? rescuer_thread+0xc80/0xc80 [ 31.004276] kthread+0x30d/0x420 [ 31.007619] ? kthread_create_on_node+0xd0/0xd0 [ 31.012271] ret_from_fork+0x24/0x30 [ 31.015966] [ 31.017572] Allocated by task 7980: [ 31.021177] kasan_kmalloc+0xeb/0x160 [ 31.024957] __kmalloc+0x15a/0x400 [ 31.028478] tls_push_record+0xfa/0x1270 [ 31.032519] tls_sw_sendmsg+0xbb0/0xfd0 [ 31.036472] inet_sendmsg+0x11a/0x4e0 [ 31.040257] sock_sendmsg+0xb5/0x100 [ 31.043952] SyS_sendto+0x1c7/0x2c0 [ 31.047557] do_syscall_64+0x1d5/0x640 [ 31.051421] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 31.056586] [ 31.058191] Freed by task 7980: [ 31.061450] kasan_slab_free+0xc3/0x1a0 [ 31.065403] kfree+0xc9/0x250 [ 31.068489] tls_push_record+0xc3b/0x1270 [ 31.072614] tls_sw_sendmsg+0xbb0/0xfd0 [ 31.076567] inet_sendmsg+0x11a/0x4e0 [ 31.080348] sock_sendmsg+0xb5/0x100 [ 31.084041] SyS_sendto+0x1c7/0x2c0 [ 31.087647] do_syscall_64+0x1d5/0x640 [ 31.091521] entry_SYSCALL_64_after_hwframe+0x46/0xbb [ 31.096682] [ 31.098289] The buggy address belongs to the object at ffff888095c70480 [ 31.098289] which belongs to the cache kmalloc-256 of size 256 [ 31.110921] The buggy address is located 88 bytes inside of [ 31.110921] 256-byte region [ffff888095c70480, ffff888095c70580) [ 31.122686] The buggy address belongs to the page: [ 31.127595] page:ffffea0002571c00 count:1 mapcount:0 mapping:ffff888095c700c0 index:0xffff888095c700c0 [ 31.137017] flags: 0xfff00000000100(slab) [ 31.141144] raw: 00fff00000000100 ffff888095c700c0 ffff888095c700c0 000000010000000b [ 31.149001] raw: ffffea0002579a60 ffffea0002cd6ae0 ffff88813fe747c0 0000000000000000 [ 31.156856] page dumped because: kasan: bad access detected [ 31.162541] [ 31.164145] Memory state around the buggy address: [ 31.169050] ffff888095c70380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.176386] ffff888095c70400: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 31.183725] >ffff888095c70480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.191061] ^ [ 31.197267] ffff888095c70500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 31.204602] ffff888095c70580: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 31.211935] ================================================================== [ 31.219269] Disabling lock debugging due to kernel taint [ 31.224735] Kernel panic - not syncing: panic_on_warn set ... [ 31.224735] [ 31.232082] CPU: 0 PID: 3625 Comm: kworker/0:2 Tainted: G B 4.14.276-syzkaller #0 [ 31.240806] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 31.250143] Workqueue: pencrypt padata_parallel_worker [ 31.255400] Call Trace: [ 31.257965] dump_stack+0x1b2/0x281 [ 31.261575] panic+0x1f9/0x42d [ 31.264752] ? add_taint.cold+0x16/0x16 [ 31.268709] kasan_end_report+0x43/0x49 [ 31.272661] kasan_report_error.cold+0xa7/0x191 [ 31.277312] ? padata_parallel_worker+0x2b0/0x2e0 [ 31.282138] __asan_report_store8_noabort+0x68/0x70 [ 31.287133] ? padata_parallel_worker+0x2b0/0x2e0 [ 31.291970] padata_parallel_worker+0x2b0/0x2e0 [ 31.296614] ? lock_acquire+0x170/0x3f0 [ 31.300567] ? invoke_padata_reorder+0x40/0x40 [ 31.305124] ? rcu_lockdep_current_cpu_online+0xed/0x140 [ 31.310552] process_one_work+0x793/0x14a0 [ 31.314768] ? work_busy+0x320/0x320 [ 31.318459] ? worker_thread+0x158/0xff0 [ 31.322497] ? _raw_spin_unlock_irq+0x24/0x80 [ 31.326970] worker_thread+0x5cc/0xff0 [ 31.330839] ? rescuer_thread+0xc80/0xc80 [ 31.334962] kthread+0x30d/0x420 [ 31.338306] ? kthread_create_on_node+0xd0/0xd0 [ 31.342956] ret_from_fork+0x24/0x30 [ 31.346846] Kernel Offset: disabled [ 31.350459] Rebooting in 86400 seconds..