================================================================== BUG: KASAN: slab-out-of-bounds in tcp_retransmit_timer+0x2a66/0x2e80 net/ipv4/tcp_timer.c:500 Read of size 8 at addr ffff8880724742d0 by task systemd-udevd/3884 CPU: 1 PID: 3884 Comm: systemd-udevd Not tainted 5.7.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x188/0x20d lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xd3/0x413 mm/kasan/report.c:383 __kasan_report mm/kasan/report.c:513 [inline] kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530 tcp_retransmit_timer+0x2a66/0x2e80 net/ipv4/tcp_timer.c:500 tcp_write_timer_handler+0x686/0x8a0 net/ipv4/tcp_timer.c:611 tcp_write_timer+0xa2/0x2b0 net/ipv4/tcp_timer.c:631 call_timer_fn+0x1ac/0x780 kernel/time/timer.c:1404 expire_timers kernel/time/timer.c:1449 [inline] __run_timers kernel/time/timer.c:1773 [inline] __run_timers kernel/time/timer.c:1740 [inline] run_timer_softirq+0x623/0x1600 kernel/time/timer.c:1786 __do_softirq+0x26c/0x9f7 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0x192/0x1d0 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:546 [inline] smp_apic_timer_interrupt+0x19e/0x600 arch/x86/kernel/apic/apic.c:1107 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829 RIP: 0010:orc_ip arch/x86/kernel/unwind_orc.c:29 [inline] RIP: 0010:__orc_find+0x6a/0xf0 arch/x86/kernel/unwind_orc.c:51 Code: 89 de 49 39 ec 72 4d 4c 89 e2 48 29 ea 48 89 d0 48 c1 ea 3f 48 c1 f8 02 48 01 c2 48 d1 fa 48 8d 5c 95 00 48 89 d8 48 c1 e8 03 <42> 0f b6 14 38 48 89 d8 83 e0 07 83 c0 03 38 d0 7c 04 84 d2 75 48 RSP: 0018:ffffc90001647488 EFLAGS: 00000a02 ORIG_RAX: ffffffffffffff13 RAX: 1ffffffff153fd32 RBX: ffffffff8a9fe990 RCX: ffffffff81be15c1 RDX: 000000000000000b RSI: ffffffff8afe6cc0 RDI: ffffffff8a9fe964 RBP: ffffffff8a9fe964 R08: 000000000002b848 R09: ffffffff8afe6d4a R10: 000000000002b832 R11: 000000000007001e R12: ffffffff8a9fe9bc R13: ffffffff8a9fe964 R14: ffffffff8a9fe964 R15: dffffc0000000000 orc_find arch/x86/kernel/unwind_orc.c:172 [inline] unwind_next_frame+0x33e/0x1df0 arch/x86/kernel/unwind_orc.c:446 arch_stack_walk+0x81/0xf0 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x8c/0xc0 kernel/stacktrace.c:123 save_stack+0x1b/0x40 mm/kasan/common.c:48 set_track mm/kasan/common.c:56 [inline] __kasan_kmalloc mm/kasan/common.c:494 [inline] __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:467 slab_post_alloc_hook mm/slab.h:586 [inline] slab_alloc mm/slab.c:3320 [inline] __do_kmalloc mm/slab.c:3654 [inline] __kmalloc+0x14b/0x7a0 mm/slab.c:3665 kmalloc include/linux/slab.h:560 [inline] kzalloc include/linux/slab.h:669 [inline] tomoyo_encode2.part.0+0xec/0x3b0 security/tomoyo/realpath.c:44 tomoyo_encode2 security/tomoyo/realpath.c:30 [inline] tomoyo_encode+0x28/0x50 security/tomoyo/realpath.c:79 tomoyo_realpath_from_path+0x184/0x620 security/tomoyo/realpath.c:286 tomoyo_get_realpath security/tomoyo/file.c:151 [inline] tomoyo_path_perm+0x214/0x400 security/tomoyo/file.c:822 security_inode_getattr+0xeb/0x150 security/security.c:1273 vfs_getattr+0x22/0x60 fs/stat.c:121 vfs_statx+0x177/0x370 fs/stat.c:206 vfs_lstat include/linux/fs.h:3308 [inline] __do_sys_newlstat+0x91/0x110 fs/stat.c:374 do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295 entry_SYSCALL_64_after_hwframe+0x49/0xb3 RIP: 0033:0x7fc5ba49b335 Code: 69 db 2b 00 64 c7 00 16 00 00 00 b8 ff ff ff ff c3 0f 1f 40 00 83 ff 01 48 89 f0 77 30 48 89 c7 48 89 d6 b8 06 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 03 f3 c3 90 48 8b 15 31 db 2b 00 f7 d8 64 89 RSP: 002b:00007fff996055c8 EFLAGS: 00000246 ORIG_RAX: 0000000000000006 RAX: ffffffffffffffda RBX: 000055910224b3c0 RCX: 00007fc5ba49b335 RDX: 00007fff99605600 RSI: 00007fff99605600 RDI: 000055910224a3c0 RBP: 00007fff996056c0 R08: 00007fc5ba75a258 R09: 0000000000001010 R10: 00007fc5ba759b58 R11: 0000000000000246 R12: 000055910224a3c0 R13: 000055910224a3cc R14: 0000559102226e25 R15: 0000559102226e2c Allocated by task 16858: save_stack+0x1b/0x40 mm/kasan/common.c:48 set_track mm/kasan/common.c:56 [inline] __kasan_kmalloc mm/kasan/common.c:494 [inline] __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:467 slab_post_alloc_hook mm/slab.h:586 [inline] slab_alloc mm/slab.c:3320 [inline] kmem_cache_alloc+0x11b/0x740 mm/slab.c:3484 getname_flags fs/namei.c:138 [inline] getname_flags+0xd2/0x5b0 fs/namei.c:128 do_sys_openat2+0x3fc/0x7d0 fs/open.c:1173 do_sys_open+0xc3/0x140 fs/open.c:1195 do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295 entry_SYSCALL_64_after_hwframe+0x49/0xb3 Freed by task 16858: save_stack+0x1b/0x40 mm/kasan/common.c:48 set_track mm/kasan/common.c:56 [inline] kasan_set_free_info mm/kasan/common.c:316 [inline] __kasan_slab_free+0xf7/0x140 mm/kasan/common.c:455 __cache_free mm/slab.c:3426 [inline] kmem_cache_free+0x7f/0x320 mm/slab.c:3694 putname+0xe1/0x120 fs/namei.c:259 getname_flags fs/namei.c:195 [inline] getname_flags+0x438/0x5b0 fs/namei.c:128 do_sys_openat2+0x3fc/0x7d0 fs/open.c:1173 do_sys_open+0xc3/0x140 fs/open.c:1195 do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295 entry_SYSCALL_64_after_hwframe+0x49/0xb3 The buggy address belongs to the object at ffff888072474740 which belongs to the cache names_cache of size 4096 The buggy address is located 1136 bytes to the left of 4096-byte region [ffff888072474740, ffff888072475740) The buggy address belongs to the page: page:ffffea0001c91d00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 head:ffffea0001c91d00 order:1 compound_mapcount:0 flags: 0xfffe0000010200(slab|head) raw: 00fffe0000010200 ffffea0001b1e488 ffffea00027cbb88 ffff8880aa1ec000 raw: 0000000000000000 ffff888072474740 0000000100000001 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888072474180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888072474200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888072474280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff888072474300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888072474380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================