================================================================== BUG: KASAN: use-after-free in instrument_atomic_write include/linux/instrumented.h:71 [inline] BUG: KASAN: use-after-free in atomic_fetch_sub_release include/asm-generic/atomic-instrumented.h:220 [inline] BUG: KASAN: use-after-free in refcount_sub_and_test include/linux/refcount.h:266 [inline] BUG: KASAN: use-after-free in refcount_dec_and_test include/linux/refcount.h:294 [inline] BUG: KASAN: use-after-free in xp_put_pool+0x2c/0x1e0 net/xdp/xsk_buff_pool.c:262 Write of size 4 at addr ffff88808ffc1860 by task syz-executor.4/6843 CPU: 1 PID: 6843 Comm: syz-executor.4 Not tainted 5.9.0-rc3-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x198/0x1fd lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xae/0x497 mm/kasan/report.c:383 __kasan_report mm/kasan/report.c:513 [inline] kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530 check_memory_region_inline mm/kasan/generic.c:186 [inline] check_memory_region+0x13d/0x180 mm/kasan/generic.c:192 instrument_atomic_write include/linux/instrumented.h:71 [inline] atomic_fetch_sub_release include/asm-generic/atomic-instrumented.h:220 [inline] refcount_sub_and_test include/linux/refcount.h:266 [inline] refcount_dec_and_test include/linux/refcount.h:294 [inline] xp_put_pool+0x2c/0x1e0 net/xdp/xsk_buff_pool.c:262 xsk_destruct+0x7d/0xa0 net/xdp/xsk.c:1138 __sk_destruct+0x4b/0x860 net/core/sock.c:1764 rcu_do_batch kernel/rcu/tree.c:2428 [inline] rcu_core+0x5ca/0x1130 kernel/rcu/tree.c:2656 __do_softirq+0x1f7/0xa91 kernel/softirq.c:298 asm_call_on_stack+0xf/0x20 arch/x86/entry/entry_64.S:706 __run_on_irqstack arch/x86/include/asm/irq_stack.h:22 [inline] run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:48 [inline] do_softirq_own_stack+0x9d/0xd0 arch/x86/kernel/irq_64.c:77 invoke_softirq kernel/softirq.c:393 [inline] __irq_exit_rcu kernel/softirq.c:423 [inline] irq_exit_rcu+0x235/0x280 kernel/softirq.c:435 sysvec_apic_timer_interrupt+0x51/0xf0 arch/x86/kernel/apic/apic.c:1091 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:581 RIP: 0010:do_dentry_open+0xda3/0x11b0 fs/open.c:816 Code: 03 00 00 48 b9 00 00 00 00 00 fc ff df 48 8b 53 28 48 8d 7a 70 48 89 fe 48 c1 ee 03 80 3c 0e 00 0f 85 b5 03 00 00 48 8b 72 70 <48> 85 f6 48 89 74 24 20 0f 84 56 f7 ff ff e9 f1 f6 ff ff e8 e5 13 RSP: 0018:ffffc90001787a70 EFLAGS: 00000246 RAX: 000000000000801d RBX: ffff8880979b5d00 RCX: dffffc0000000000 RDX: ffffffff885d2ea0 RSI: ffffffff81fe4fc0 RDI: ffffffff885d2f10 RBP: ffff888054390678 R08: 0000000000000000 R09: ffff888054390678 R10: 0000000000000000 R11: 0000000000000001 R12: 0000000000000000 R13: ffff8880979b5d84 R14: ffff8880979b5d10 R15: ffff888054390678 do_open fs/namei.c:3251 [inline] path_openat+0x1b9a/0x2730 fs/namei.c:3368 do_filp_open+0x17e/0x3c0 fs/namei.c:3395 do_sys_openat2+0x16d/0x420 fs/open.c:1168 do_sys_open fs/open.c:1184 [inline] __do_sys_open fs/open.c:1192 [inline] __se_sys_open fs/open.c:1188 [inline] __x64_sys_open+0x119/0x1c0 fs/open.c:1188 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x45b570 Code: 31 c0 e9 45 ff ff ff 0f 1f 00 80 3f 00 0f 84 f7 00 00 00 55 53 b9 02 00 00 00 be 00 08 09 00 89 c8 48 81 ec 98 00 00 00 0f 05 <48> 3d 00 f0 ff ff 48 89 c3 0f 87 e9 00 00 00 85 db 0f 88 2f 01 00 RSP: 002b:00007fff7f956110 EFLAGS: 00000202 ORIG_RAX: 0000000000000002 RAX: ffffffffffffffda RBX: 0000000000094fc6 RCX: 000000000045b570 RDX: 000000000000000c RSI: 0000000000090800 RDI: 00007fff7f9572f0 RBP: 00000000000008ea R08: 0000000000000000 R09: 0000000002b41940 R10: 0000000000000000 R11: 0000000000000202 R12: 00007fff7f9572f0 R13: 00007fff7f9572e0 R14: 0000000000000000 R15: 00007fff7f9572f0 Allocated by task 27035: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48 kasan_set_track mm/kasan/common.c:56 [inline] __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:461 kmalloc_node include/linux/slab.h:577 [inline] kvmalloc_node+0x61/0xf0 mm/util.c:574 kvmalloc include/linux/mm.h:755 [inline] kvzalloc include/linux/mm.h:763 [inline] xp_create_and_assign_umem+0x58/0x8d0 net/xdp/xsk_buff_pool.c:54 xsk_bind+0x9a0/0xed0 net/xdp/xsk.c:709 __sys_bind+0x1e9/0x250 net/socket.c:1656 __do_sys_bind net/socket.c:1667 [inline] __se_sys_bind net/socket.c:1665 [inline] __x64_sys_bind+0x6f/0xb0 net/socket.c:1665 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Freed by task 27035: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48 kasan_set_track+0x1c/0x30 mm/kasan/common.c:56 kasan_set_free_info+0x1b/0x30 mm/kasan/generic.c:355 __kasan_slab_free+0xd8/0x120 mm/kasan/common.c:422 __cache_free mm/slab.c:3418 [inline] kfree+0x10e/0x2b0 mm/slab.c:3756 kvfree+0x42/0x50 mm/util.c:603 xp_destroy net/xdp/xsk_buff_pool.c:44 [inline] xp_destroy+0x45/0x60 net/xdp/xsk_buff_pool.c:38 xsk_bind+0xbdd/0xed0 net/xdp/xsk.c:719 __sys_bind+0x1e9/0x250 net/socket.c:1656 __do_sys_bind net/socket.c:1667 [inline] __se_sys_bind net/socket.c:1665 [inline] __x64_sys_bind+0x6f/0xb0 net/socket.c:1665 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 The buggy address belongs to the object at ffff88808ffc1800 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 96 bytes inside of 1024-byte region [ffff88808ffc1800, ffff88808ffc1c00) The buggy address belongs to the page: page:00000000778c9fc7 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8ffc1 flags: 0xfffe0000000200(slab) raw: 00fffe0000000200 ffffea00025bafc8 ffffea000247c448 ffff8880aa040700 raw: 0000000000000000 ffff88808ffc1000 0000000100000002 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88808ffc1700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88808ffc1780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88808ffc1800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88808ffc1880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88808ffc1900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================