================================================================== BUG: KASAN: double-free or invalid-free in kfree_skbmem+0xef/0x1b0 net/core/skbuff.c:622 CPU: 1 PID: 792 Comm: kworker/1:1 Not tainted 5.9.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events nsim_dev_trap_report_work Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x198/0x1fd lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xae/0x497 mm/kasan/report.c:383 kasan_report_invalid_free+0x51/0x80 mm/kasan/report.c:477 __kasan_slab_free+0x107/0x120 mm/kasan/common.c:401 __cache_free mm/slab.c:3418 [inline] kmem_cache_free.part.0+0x74/0x1e0 mm/slab.c:3693 kfree_skbmem+0xef/0x1b0 net/core/skbuff.c:622 __kfree_skb net/core/skbuff.c:679 [inline] consume_skb net/core/skbuff.c:838 [inline] consume_skb+0xcf/0x160 net/core/skbuff.c:832 nsim_dev_trap_report drivers/net/netdevsim/dev.c:574 [inline] nsim_dev_trap_report_work+0x889/0xbe0 drivers/net/netdevsim/dev.c:599 process_one_work+0x94c/0x1670 kernel/workqueue.c:2269 worker_thread+0x64c/0x1120 kernel/workqueue.c:2415 kthread+0x3b5/0x4a0 kernel/kthread.c:292 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:294 Allocated by task 0: (stack is not available) The buggy address belongs to the object at ffff888000109e00 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 128 bytes inside of 256-byte region [ffff888000109e00, ffff888000109f00) The buggy address belongs to the page: page:000000005537b28a refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x109 flags: 0x7ffe0000000200(slab) raw: 007ffe0000000200 ffffea0002422ec8 ffffea0002a43fc8 ffff8880aa040500 raw: 0000000000000000 ffff888000109000 0000000100000008 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888000109d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888000109e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff888000109e80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ^ ffff888000109f00: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc ffff888000109f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================