================================================================== BUG: KASAN: slab-out-of-bounds in hlist_add_head include/linux/list.h:814 [inline] BUG: KASAN: slab-out-of-bounds in enqueue_timer+0xb7/0x300 kernel/time/timer.c:541 Write of size 8 at addr ffff8881e9d631c8 by task kworker/1:3/345 CPU: 1 PID: 345 Comm: kworker/1:3 Not tainted 5.4.274-syzkaller-00002-g6f97bd951d82 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 Workqueue: wg-crypt-wg0 wg_packet_tx_worker Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1d8/0x241 lib/dump_stack.c:118 print_address_description+0x8c/0x600 mm/kasan/report.c:384 __kasan_report+0xf3/0x120 mm/kasan/report.c:516 kasan_report+0x30/0x60 mm/kasan/common.c:653 hlist_add_head include/linux/list.h:814 [inline] enqueue_timer+0xb7/0x300 kernel/time/timer.c:541 __internal_add_timer kernel/time/timer.c:554 [inline] internal_add_timer+0x240/0x430 kernel/time/timer.c:604 __mod_timer+0x6f1/0x13e0 kernel/time/timer.c:1065 mod_peer_timer drivers/net/wireguard/timers.c:37 [inline] wg_timers_any_authenticated_packet_traversal+0x126/0x180 drivers/net/wireguard/timers.c:215 wg_packet_create_data_done drivers/net/wireguard/send.c:247 [inline] wg_packet_tx_worker+0x147/0x490 drivers/net/wireguard/send.c:276 process_one_work+0x765/0xd20 kernel/workqueue.c:2290 worker_thread+0xaef/0x1470 kernel/workqueue.c:2436 kthread+0x2da/0x360 kernel/kthread.c:288 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:354 Allocated by task 428: save_stack mm/kasan/common.c:70 [inline] set_track mm/kasan/common.c:78 [inline] __kasan_kmalloc+0x171/0x210 mm/kasan/common.c:529 slab_post_alloc_hook mm/slab.h:584 [inline] slab_alloc_node mm/slub.c:2829 [inline] slab_alloc mm/slub.c:2837 [inline] kmem_cache_alloc+0xd9/0x250 mm/slub.c:2842 sk_prot_alloc+0x63/0x3e0 net/core/sock.c:1616 sk_alloc+0x35/0x2f0 net/core/sock.c:1680 unix_create1+0x8e/0x590 net/unix/af_unix.c:802 unix_create+0x12c/0x1b0 net/unix/af_unix.c:863 __sock_create+0x3cb/0x7a0 net/socket.c:1427 sock_create net/socket.c:1478 [inline] __sys_socket+0x132/0x370 net/socket.c:1520 __do_sys_socket net/socket.c:1529 [inline] __se_sys_socket net/socket.c:1527 [inline] __x64_sys_socket+0x76/0x80 net/socket.c:1527 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x5c/0xc1 Freed by task 428: save_stack mm/kasan/common.c:70 [inline] set_track mm/kasan/common.c:78 [inline] kasan_set_free_info mm/kasan/common.c:345 [inline] __kasan_slab_free+0x1b5/0x270 mm/kasan/common.c:487 slab_free_hook mm/slub.c:1455 [inline] slab_free_freelist_hook mm/slub.c:1494 [inline] slab_free mm/slub.c:3080 [inline] kmem_cache_free+0x10b/0x2c0 mm/slub.c:3096 sk_prot_free net/core/sock.c:1661 [inline] __sk_destruct+0x460/0x5e0 net/core/sock.c:1749 sock_put include/net/sock.h:1789 [inline] unix_release_sock+0x825/0x9f0 net/unix/af_unix.c:577 unix_release+0x4a/0x80 net/unix/af_unix.c:873 __sock_release net/socket.c:591 [inline] sock_close+0xc7/0x220 net/socket.c:1277 __fput+0x262/0x680 fs/file_table.c:281 task_work_run+0x140/0x170 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_usermode_loop+0x190/0x1a0 arch/x86/entry/common.c:163 prepare_exit_to_usermode+0x199/0x200 arch/x86/entry/common.c:194 entry_SYSCALL_64_after_hwframe+0x5c/0xc1 The buggy address belongs to the object at ffff8881e9d62d00 which belongs to the cache UNIX of size 1152 The buggy address is located 72 bytes to the right of 1152-byte region [ffff8881e9d62d00, ffff8881e9d63180) The buggy address belongs to the page: page:ffffea0007a75800 refcount:1 mapcount:0 mapping:ffff8881f57f5b80 index:0x0 compound_mapcount: 0 flags: 0x8000000000010200(slab|head) raw: 8000000000010200 dead000000000100 dead000000000122 ffff8881f57f5b80 raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL) set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook mm/page_alloc.c:2165 [inline] prep_new_page+0x18f/0x370 mm/page_alloc.c:2171 get_page_from_freelist+0x2d13/0x2d90 mm/page_alloc.c:3794 __alloc_pages_nodemask+0x393/0x840 mm/page_alloc.c:4893 alloc_slab_page+0x39/0x3c0 mm/slub.c:343 allocate_slab mm/slub.c:1683 [inline] new_slab+0x97/0x440 mm/slub.c:1749 new_slab_objects mm/slub.c:2505 [inline] ___slab_alloc+0x2fe/0x490 mm/slub.c:2667 __slab_alloc+0x62/0xa0 mm/slub.c:2707 slab_alloc_node mm/slub.c:2792 [inline] slab_alloc mm/slub.c:2837 [inline] kmem_cache_alloc+0x109/0x250 mm/slub.c:2842 sk_prot_alloc+0x63/0x3e0 net/core/sock.c:1616 sk_alloc+0x35/0x2f0 net/core/sock.c:1680 unix_create1+0x8e/0x590 net/unix/af_unix.c:802 unix_create+0x12c/0x1b0 net/unix/af_unix.c:863 __sock_create+0x3cb/0x7a0 net/socket.c:1427 sock_create net/socket.c:1478 [inline] __sys_socket+0x132/0x370 net/socket.c:1520 __do_sys_socket net/socket.c:1529 [inline] __se_sys_socket net/socket.c:1527 [inline] __x64_sys_socket+0x76/0x80 net/socket.c:1527 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1176 [inline] __free_pages_ok+0x847/0x950 mm/page_alloc.c:1438 free_the_page mm/page_alloc.c:4955 [inline] __free_pages+0x91/0x140 mm/page_alloc.c:4961 device_release+0x6b/0x190 drivers/base/core.c:1776 kobject_cleanup lib/kobject.c:716 [inline] kobject_release lib/kobject.c:747 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1e6/0x2f0 lib/kobject.c:764 tun_set_iff+0x870/0xdc0 drivers/net/tun.c:2919 __tun_chr_ioctl+0x8a9/0x1d00 drivers/net/tun.c:3182 do_vfs_ioctl+0x742/0x1720 fs/ioctl.c:47 ksys_ioctl fs/ioctl.c:742 [inline] __do_sys_ioctl fs/ioctl.c:749 [inline] __se_sys_ioctl fs/ioctl.c:747 [inline] __x64_sys_ioctl+0xd4/0x110 fs/ioctl.c:747 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x5c/0xc1 Memory state around the buggy address: ffff8881e9d63080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8881e9d63100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8881e9d63180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff8881e9d63200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8881e9d63280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================