==================================================================
BUG: KASAN: use-after-free in tcp_probe_timer net/ipv4/tcp_timer.c:383 [inline]
BUG: KASAN: use-after-free in tcp_write_timer_handler+0xb91/0xbc0 net/ipv4/tcp_timer.c:626
Read of size 1 at addr ffff8880714e8795 by task swapper/3/0
CPU: 3 PID: 0 Comm: swapper/3 Not tainted 5.19.0-rc6-syzkaller-00115-g4a57a8400075 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_address_description.constprop.0.cold+0xeb/0x467 mm/kasan/report.c:313
print_report mm/kasan/report.c:429 [inline]
kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491
tcp_probe_timer net/ipv4/tcp_timer.c:383 [inline]
tcp_write_timer_handler+0xb91/0xbc0 net/ipv4/tcp_timer.c:626
tcp_write_timer+0xa2/0x2b0 net/ipv4/tcp_timer.c:642
call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1474
expire_timers kernel/time/timer.c:1519 [inline]
__run_timers.part.0+0x679/0xa80 kernel/time/timer.c:1790
__run_timers kernel/time/timer.c:1768 [inline]
run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1803
__do_softirq+0x29b/0x9c2 kernel/softirq.c:571
invoke_softirq kernel/softirq.c:445 [inline]
__irq_exit_rcu+0x123/0x180 kernel/softirq.c:650
irq_exit_rcu+0x5/0x20 kernel/softirq.c:662
sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1106
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:default_idle+0xb/0x10 arch/x86/kernel/process.c:731
Code: ff ff ff 48 89 df e8 d4 a2 4b f8 e9 55 ff ff ff 4c 89 e7 e8 c7 a2 4b f8 eb 96 0f 1f 44 00 00 66 90 0f 00 2d 37 a2 4c 00 fb f4 cc cc cc cc 41 55 41 54 55 48 89 fd 53 e8 72 87 ff f7 e8 8d 0d
RSP: 0018:ffffc9000069fe00 EFLAGS: 00000242
RAX: 0000000000570679 RBX: ffff888012548080 RCX: ffffffff897716e1
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 0000000000000003 R08: 0000000000000001 R09: ffff88802cb3af93
R10: ffffed10059675f2 R11: 0000000000000001 R12: ffffed10024a9010
R13: 0000000000000003 R14: ffffffff8dbb0610 R15: 0000000000000000
default_idle_call+0x80/0xc0 kernel/sched/idle.c:109
cpuidle_idle_call kernel/sched/idle.c:191 [inline]
do_idle+0x401/0x590 kernel/sched/idle.c:303
cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:400
start_secondary+0x21d/0x2b0 arch/x86/kernel/smpboot.c:266
secondary_startup_64_no_verify+0xce/0xdb
Allocated by task 6520:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track mm/kasan/common.c:45 [inline]
set_alloc_info mm/kasan/common.c:436 [inline]
__kasan_slab_alloc+0x85/0xb0 mm/kasan/common.c:469
kasan_slab_alloc include/linux/kasan.h:224 [inline]
slab_post_alloc_hook mm/slab.h:750 [inline]
slab_alloc mm/slab.c:3302 [inline]
__kmem_cache_alloc_lru mm/slab.c:3479 [inline]
kmem_cache_alloc+0x265/0x560 mm/slab.c:3499
kmem_cache_zalloc include/linux/slab.h:723 [inline]
net_alloc net/core/net_namespace.c:403 [inline]
copy_net_ns+0x125/0x760 net/core/net_namespace.c:458
create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110
unshare_nsproxy_namespaces+0xc1/0x1f0 kernel/nsproxy.c:226
ksys_unshare+0x445/0x920 kernel/fork.c:3165
__do_sys_unshare kernel/fork.c:3236 [inline]
__se_sys_unshare kernel/fork.c:3234 [inline]
__x64_sys_unshare+0x2d/0x40 kernel/fork.c:3234
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Last potentially related work creation:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
__kasan_record_aux_stack+0x7e/0x90 mm/kasan/generic.c:348
insert_work+0x48/0x350 kernel/workqueue.c:1358
__queue_work+0x62f/0x1150 kernel/workqueue.c:1517
call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1474
expire_timers kernel/time/timer.c:1514 [inline]
__run_timers.part.0+0x4a3/0xa80 kernel/time/timer.c:1790
__run_timers kernel/time/timer.c:1768 [inline]
run_timer_softirq+0x152/0x1d0 kernel/time/timer.c:1805
__do_softirq+0x29b/0x9c2 kernel/softirq.c:571
Second to last potentially related work creation:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
__kasan_record_aux_stack+0x7e/0x90 mm/kasan/generic.c:348
insert_work+0x48/0x350 kernel/workqueue.c:1358
__queue_work+0x62f/0x1150 kernel/workqueue.c:1517
call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1474
expire_timers kernel/time/timer.c:1514 [inline]
__run_timers.part.0+0x4a3/0xa80 kernel/time/timer.c:1790
__run_timers kernel/time/timer.c:1768 [inline]
run_timer_softirq+0x152/0x1d0 kernel/time/timer.c:1805
__do_softirq+0x29b/0x9c2 kernel/softirq.c:571
The buggy address belongs to the object at ffff8880714e8100
which belongs to the cache net_namespace of size 6784
The buggy address is located 1685 bytes inside of
6784-byte region [ffff8880714e8100, ffff8880714e9b80)
The buggy address belongs to the physical page:
page:ffffea0001c53a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880714e8100 pfn:0x714e8
head:ffffea0001c53a00 order:1 compound_mapcount:0 compound_pincount:0
memcg:ffff88804b0924c1
flags: 0x4fff00000010200(slab|head|node=1|zone=1|lastcpupid=0x7ff)
raw: 04fff00000010200 ffffea0001296388 ffffea0001c01908 ffff888012215400
raw: ffff8880714e8100 ffff8880714e8100 0000000100000000 ffff88804b0924c1
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 1, migratetype Unmovable, gfp_mask 0x40cc0(GFP_KERNEL|__GFP_COMP), pid 5980, tgid 5979 (syz-executor.0), ts 287931418711, free_ts 287924666038
prep_new_page mm/page_alloc.c:2456 [inline]
get_page_from_freelist+0x1290/0x3b70 mm/page_alloc.c:4198
__alloc_pages_slowpath.constprop.0+0x2e9/0x2160 mm/page_alloc.c:4973
__alloc_pages+0x436/0x510 mm/page_alloc.c:5439
__alloc_pages_node include/linux/gfp.h:587 [inline]
kmem_getpages mm/slab.c:1363 [inline]
cache_grow_begin+0x75/0x350 mm/slab.c:2569
fallback_alloc+0x1e4/0x2e0 mm/slab.c:3118
__do_cache_alloc mm/slab.c:3260 [inline]
slab_alloc mm/slab.c:3295 [inline]
__kmem_cache_alloc_lru mm/slab.c:3479 [inline]
kmem_cache_alloc+0x367/0x560 mm/slab.c:3499
kmem_cache_zalloc include/linux/slab.h:723 [inline]
net_alloc net/core/net_namespace.c:403 [inline]
copy_net_ns+0x125/0x760 net/core/net_namespace.c:458
create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110
unshare_nsproxy_namespaces+0xc1/0x1f0 kernel/nsproxy.c:226
ksys_unshare+0x445/0x920 kernel/fork.c:3165
__do_sys_unshare kernel/fork.c:3236 [inline]
__se_sys_unshare kernel/fork.c:3234 [inline]
__x64_sys_unshare+0x2d/0x40 kernel/fork.c:3234
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1371 [inline]
free_pcp_prepare+0x549/0xd20 mm/page_alloc.c:1421
free_unref_page_prepare mm/page_alloc.c:3343 [inline]
free_unref_page+0x19/0x6a0 mm/page_alloc.c:3438
slab_destroy mm/slab.c:1615 [inline]
slabs_destroy+0x89/0xc0 mm/slab.c:1635
__cache_free_alien mm/slab.c:774 [inline]
cache_free_alien mm/slab.c:790 [inline]
___cache_free+0x296/0x670 mm/slab.c:3453
qlink_free mm/kasan/quarantine.c:168 [inline]
qlist_free_all+0x4f/0x1b0 mm/kasan/quarantine.c:187
kasan_quarantine_reduce+0x180/0x200 mm/kasan/quarantine.c:294
__kasan_slab_alloc+0x97/0xb0 mm/kasan/common.c:446
kasan_slab_alloc include/linux/kasan.h:224 [inline]
slab_post_alloc_hook mm/slab.h:750 [inline]
slab_alloc mm/slab.c:3302 [inline]
__do_kmalloc mm/slab.c:3694 [inline]
__kmalloc+0x27a/0x4d0 mm/slab.c:3705
kmalloc include/linux/slab.h:605 [inline]
tomoyo_realpath_from_path+0xc3/0x620 security/tomoyo/realpath.c:254
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_check_open_permission+0x272/0x380 security/tomoyo/file.c:771
tomoyo_file_open security/tomoyo/tomoyo.c:320 [inline]
tomoyo_file_open+0x9d/0xc0 security/tomoyo/tomoyo.c:315
security_file_open+0x45/0xb0 security/security.c:1645
do_dentry_open+0x349/0x11f0 fs/open.c:835
do_open fs/namei.c:3520 [inline]
path_openat+0x1c71/0x2910 fs/namei.c:3653
do_filp_open+0x1aa/0x400 fs/namei.c:3680
do_sys_openat2+0x16d/0x4c0 fs/open.c:1278
Memory state around the buggy address:
ffff8880714e8680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880714e8700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8880714e8780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880714e8800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880714e8880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess), 3 bytes skipped:
0: 48 89 df mov %rbx,%rdi
3: e8 d4 a2 4b f8 callq 0xf84ba2dc
8: e9 55 ff ff ff jmpq 0xffffff62
d: 4c 89 e7 mov %r12,%rdi
10: e8 c7 a2 4b f8 callq 0xf84ba2dc
15: eb 96 jmp 0xffffffad
17: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
1c: 66 90 xchg %ax,%ax
1e: 0f 00 2d 37 a2 4c 00 verw 0x4ca237(%rip) # 0x4ca25c
25: fb sti
26: f4 hlt
* 27: c3 retq <-- trapping instruction
28: cc int3
29: cc int3
2a: cc int3
2b: cc int3
2c: 41 55 push %r13
2e: 41 54 push %r12
30: 55 push %rbp
31: 48 89 fd mov %rdi,%rbp
34: 53 push %rbx
35: e8 72 87 ff f7 callq 0xf7ff87ac
3a: e8 .byte 0xe8
3b: 8d .byte 0x8d
3c: 0d .byte 0xd