==================================================================
BUG: KASAN: use-after-free in tcp_or_dccp_get_hashinfo include/net/inet_hashtables.h:181 [inline]
BUG: KASAN: use-after-free in reqsk_queue_unlink+0x320/0x350 net/ipv4/inet_connection_sock.c:913
Read of size 8 at addr ffff88804b438500 by task udevd/18900
CPU: 0 PID: 18900 Comm: udevd Not tainted 6.1.0-rc5-syzkaller-00081-ge493bec343fa #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:284 [inline]
print_report+0x15e/0x45d mm/kasan/report.c:395
kasan_report+0xbf/0x1f0 mm/kasan/report.c:495
tcp_or_dccp_get_hashinfo include/net/inet_hashtables.h:181 [inline]
reqsk_queue_unlink+0x320/0x350 net/ipv4/inet_connection_sock.c:913
inet_csk_reqsk_queue_drop net/ipv4/inet_connection_sock.c:927 [inline]
inet_csk_reqsk_queue_drop_and_put net/ipv4/inet_connection_sock.c:939 [inline]
reqsk_timer_handler+0x728/0x1160 net/ipv4/inet_connection_sock.c:1053
call_timer_fn+0x1da/0x7c0 kernel/time/timer.c:1474
expire_timers kernel/time/timer.c:1519 [inline]
__run_timers.part.0+0x6a2/0xaf0 kernel/time/timer.c:1790
__run_timers kernel/time/timer.c:1768 [inline]
run_timer_softirq+0xb7/0x1d0 kernel/time/timer.c:1803
__do_softirq+0x1fb/0xadc kernel/softirq.c:571
invoke_softirq kernel/softirq.c:445 [inline]
__irq_exit_rcu+0x123/0x180 kernel/softirq.c:650
irq_exit_rcu+0x9/0x20 kernel/softirq.c:662
sysvec_apic_timer_interrupt+0x97/0xc0 arch/x86/kernel/apic/apic.c:1107
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:find_stack lib/stackdepot.c:304 [inline]
RIP: 0010:__stack_depot_save+0x139/0x560 lib/stackdepot.c:452
Code: 89 da 23 15 a5 54 9e 0d 4c 8d 0c d0 49 8b 09 48 85 c9 75 11 e9 99 00 00 00 48 8b 09 48 85 c9 0f 84 8d 00 00 00 39 59 08 75 ef <44> 3b 41 0c 75 e9 31 c0 48 8b 74 c1 18 49 39 34 c7 75 dc 48 83 c0
RSP: 0018:ffffc900054cf6e8 EFLAGS: 00000246
RAX: ffff88823b400000 RBX: 00000000e29af0e9 RCX: ffff8880482b5e90
RDX: 00000000000af0e9 RSI: 0000000000000003 RDI: 000000007793b0c6
RBP: 0000000000000000 R08: 000000000000000f R09: ffff88823b978748
R10: 000000000000000f R11: 0000000000092080 R12: 0000000000000000
R13: 0000000000000001 R14: 0000000000012b20 R15: ffffc900054cf760
kasan_save_stack+0x35/0x40 mm/kasan/common.c:46
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
__kasan_slab_alloc+0x82/0x90 mm/kasan/common.c:325
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slab.h:737 [inline]
slab_alloc_node mm/slub.c:3398 [inline]
slab_alloc mm/slub.c:3406 [inline]
__kmem_cache_alloc_lru mm/slub.c:3413 [inline]
kmem_cache_alloc+0x2b4/0x3d0 mm/slub.c:3422
kmem_cache_zalloc include/linux/slab.h:679 [inline]
fill_pool+0x264/0x5c0 lib/debugobjects.c:168
__debug_object_init+0x7a/0xd10 lib/debugobjects.c:562
debug_object_init lib/debugobjects.c:617 [inline]
debug_object_activate+0x330/0x3e0 lib/debugobjects.c:703
debug_rcu_head_queue kernel/rcu/rcu.h:189 [inline]
call_rcu+0x30/0x820 kernel/rcu/tree.c:2783
destroy_inode+0x129/0x1b0 fs/inode.c:314
iput_final fs/inode.c:1747 [inline]
iput.part.0+0x59b/0x880 fs/inode.c:1773
iput+0x5c/0x80 fs/inode.c:1763
do_unlinkat+0x41f/0x660 fs/namei.c:4326
__do_sys_unlink fs/namei.c:4367 [inline]
__se_sys_unlink fs/namei.c:4365 [inline]
__x64_sys_unlink+0xca/0x110 fs/namei.c:4365
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7fb4357272d7
Code: f0 ff ff 73 01 c3 48 8b 0d 9e db 0c 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 b8 57 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 71 db 0c 00 f7 d8 64 89 01 48
RSP: 002b:00007ffe219fdb58 EFLAGS: 00000202 ORIG_RAX: 0000000000000057
RAX: ffffffffffffffda RBX: 0000556eeddd8120 RCX: 00007fb4357272d7
RDX: 00007ffe219fdb7c RSI: 0000556eeddbc4cd RDI: 00007ffe219fdb68
RBP: 0000556eee5c4330 R08: 0000000000000000 R09: 00007ffe219fda00
R10: 0000000000000c39 R11: 0000000000000202 R12: 0000000000000c39
R13: 00007ffe219fdb68 R14: 0000000003938700 R15: 0000556eeddd8160
Allocated by task 3667:
kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
__kasan_slab_alloc+0x82/0x90 mm/kasan/common.c:325
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slab.h:737 [inline]
slab_alloc_node mm/slub.c:3398 [inline]
slab_alloc mm/slub.c:3406 [inline]
__kmem_cache_alloc_lru mm/slub.c:3413 [inline]
kmem_cache_alloc+0x2b4/0x3d0 mm/slub.c:3422
kmem_cache_zalloc include/linux/slab.h:679 [inline]
net_alloc net/core/net_namespace.c:410 [inline]
copy_net_ns+0x129/0x760 net/core/net_namespace.c:465
create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110
unshare_nsproxy_namespaces+0xc5/0x1f0 kernel/nsproxy.c:226
ksys_unshare+0x449/0x920 kernel/fork.c:3188
__do_sys_unshare kernel/fork.c:3259 [inline]
__se_sys_unshare kernel/fork.c:3257 [inline]
__x64_sys_unshare+0x31/0x40 kernel/fork.c:3257
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Freed by task 14435:
kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
kasan_set_track+0x25/0x30 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x40 mm/kasan/generic.c:511
____kasan_slab_free mm/kasan/common.c:236 [inline]
____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200
kasan_slab_free include/linux/kasan.h:177 [inline]
slab_free_hook mm/slub.c:1724 [inline]
slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1750
slab_free mm/slub.c:3661 [inline]
kmem_cache_free+0xee/0x5c0 mm/slub.c:3683
net_free net/core/net_namespace.c:439 [inline]
net_free net/core/net_namespace.c:435 [inline]
cleanup_net+0x8be/0xb00 net/core/net_namespace.c:622
process_one_work+0x9bf/0x1710 kernel/workqueue.c:2289
worker_thread+0x669/0x1090 kernel/workqueue.c:2436
kthread+0x2e8/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
Last potentially related work creation:
kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
__kasan_record_aux_stack+0xbc/0xd0 mm/kasan/generic.c:481
insert_work+0x48/0x350 kernel/workqueue.c:1358
__queue_work+0x693/0x13b0 kernel/workqueue.c:1517
call_timer_fn+0x1da/0x7c0 kernel/time/timer.c:1474
expire_timers kernel/time/timer.c:1514 [inline]
__run_timers.part.0+0x4a3/0xaf0 kernel/time/timer.c:1790
__run_timers kernel/time/timer.c:1768 [inline]
run_timer_softirq+0x156/0x1d0 kernel/time/timer.c:1805
__do_softirq+0x1fb/0xadc kernel/softirq.c:571
Second to last potentially related work creation:
kasan_save_stack+0x22/0x40 mm/kasan/common.c:45
__kasan_record_aux_stack+0xbc/0xd0 mm/kasan/generic.c:481
insert_work+0x48/0x350 kernel/workqueue.c:1358
__queue_work+0x693/0x13b0 kernel/workqueue.c:1517
call_timer_fn+0x1da/0x7c0 kernel/time/timer.c:1474
expire_timers kernel/time/timer.c:1514 [inline]
__run_timers.part.0+0x4a3/0xaf0 kernel/time/timer.c:1790
__run_timers kernel/time/timer.c:1768 [inline]
run_timer_softirq+0x156/0x1d0 kernel/time/timer.c:1805
__do_softirq+0x1fb/0xadc kernel/softirq.c:571
The buggy address belongs to the object at ffff88804b438000
which belongs to the cache net_namespace of size 6976
The buggy address is located 1280 bytes inside of
6976-byte region [ffff88804b438000, ffff88804b439b40)
The buggy address belongs to the physical page:
page:ffffea00012d0e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88804b43d4c0 pfn:0x4b438
head:ffffea00012d0e00 order:3 compound_mapcount:0 compound_pincount:0
memcg:ffff88807c8b7781
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 0000000000000000 dead000000000001 ffff8880121e1500
raw: ffff88804b43d4c0 0000000080040003 00000001ffffffff ffff88807c8b7781
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3667, tgid 3667 (syz-executor.4), ts 147084717567, free_ts 13284951095
prep_new_page mm/page_alloc.c:2539 [inline]
get_page_from_freelist+0x10b5/0x2d50 mm/page_alloc.c:4288
__alloc_pages+0x1cb/0x5b0 mm/page_alloc.c:5555
alloc_pages+0x1aa/0x270 mm/mempolicy.c:2285
alloc_slab_page mm/slub.c:1794 [inline]
allocate_slab+0x213/0x300 mm/slub.c:1939
new_slab mm/slub.c:1992 [inline]
___slab_alloc+0xa91/0x1400 mm/slub.c:3180
__slab_alloc.constprop.0+0x56/0xa0 mm/slub.c:3279
slab_alloc_node mm/slub.c:3364 [inline]
slab_alloc mm/slub.c:3406 [inline]
__kmem_cache_alloc_lru mm/slub.c:3413 [inline]
kmem_cache_alloc+0x31a/0x3d0 mm/slub.c:3422
kmem_cache_zalloc include/linux/slab.h:679 [inline]
net_alloc net/core/net_namespace.c:410 [inline]
copy_net_ns+0x129/0x760 net/core/net_namespace.c:465
create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110
unshare_nsproxy_namespaces+0xc5/0x1f0 kernel/nsproxy.c:226
ksys_unshare+0x449/0x920 kernel/fork.c:3188
__do_sys_unshare kernel/fork.c:3259 [inline]
__se_sys_unshare kernel/fork.c:3257 [inline]
__x64_sys_unshare+0x31/0x40 kernel/fork.c:3257
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1459 [inline]
free_pcp_prepare+0x65c/0xd90 mm/page_alloc.c:1509
free_unref_page_prepare mm/page_alloc.c:3387 [inline]
free_unref_page+0x1d/0x4d0 mm/page_alloc.c:3483
free_contig_range+0xb5/0x180 mm/page_alloc.c:9493
destroy_args+0xa8/0x64c mm/debug_vm_pgtable.c:1031
debug_vm_pgtable+0x2958/0x29e9 mm/debug_vm_pgtable.c:1354
do_one_initcall+0x141/0x780 init/main.c:1303
do_initcall_level init/main.c:1376 [inline]
do_initcalls init/main.c:1392 [inline]
do_basic_setup init/main.c:1411 [inline]
kernel_init_freeable+0x6ff/0x788 init/main.c:1631
kernel_init+0x1e/0x1d0 init/main.c:1519
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
Memory state around the buggy address:
ffff88804b438400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88804b438480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff88804b438500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88804b438580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88804b438600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess):
0: 89 da mov %ebx,%edx
2: 23 15 a5 54 9e 0d and 0xd9e54a5(%rip),%edx # 0xd9e54ad
8: 4c 8d 0c d0 lea (%rax,%rdx,8),%r9
c: 49 8b 09 mov (%r9),%rcx
f: 48 85 c9 test %rcx,%rcx
12: 75 11 jne 0x25
14: e9 99 00 00 00 jmpq 0xb2
19: 48 8b 09 mov (%rcx),%rcx
1c: 48 85 c9 test %rcx,%rcx
1f: 0f 84 8d 00 00 00 je 0xb2
25: 39 59 08 cmp %ebx,0x8(%rcx)
28: 75 ef jne 0x19
* 2a: 44 3b 41 0c cmp 0xc(%rcx),%r8d <-- trapping instruction
2e: 75 e9 jne 0x19
30: 31 c0 xor %eax,%eax
32: 48 8b 74 c1 18 mov 0x18(%rcx,%rax,8),%rsi
37: 49 39 34 c7 cmp %rsi,(%r15,%rax,8)
3b: 75 dc jne 0x19
3d: 48 rex.W
3e: 83 .byte 0x83
3f: c0 .byte 0xc0