================================================================== BUG: KASAN: use-after-free in rpc_net_ns+0x174/0x180 net/sunrpc/clnt.c:1506 Read of size 8 at addr ffff8880a86708d8 by task kworker/0:38/2822 CPU: 0 PID: 2822 Comm: kworker/0:38 Not tainted 5.7.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events rpc_free_client_work Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x128/0x182 lib/dump_stack.c:118 print_address_description.constprop.8.cold.10+0x9/0x317 mm/kasan/report.c:382 __kasan_report.cold.11+0x35/0x4d mm/kasan/report.c:511 kasan_report+0x32/0x50 mm/kasan/common.c:625 rpc_net_ns+0x174/0x180 net/sunrpc/clnt.c:1506 rpc_clnt_remove_pipedir net/sunrpc/clnt.c:111 [inline] rpc_free_client_work+0x11/0x40 net/sunrpc/clnt.c:892 process_one_work+0x908/0x15d0 kernel/workqueue.c:2268 worker_thread+0x82/0xb50 kernel/workqueue.c:2414 kthread+0x340/0x410 kernel/kthread.c:268 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Allocated by task 24611: save_stack+0x19/0x40 mm/kasan/common.c:49 set_track mm/kasan/common.c:57 [inline] __kasan_kmalloc.constprop.17+0xc1/0xd0 mm/kasan/common.c:495 __do_kmalloc mm/slab.c:3656 [inline] __kmalloc+0x164/0x7b0 mm/slab.c:3665 kmalloc include/linux/slab.h:560 [inline] kzalloc include/linux/slab.h:669 [inline] xprt_alloc+0x26/0x720 net/sunrpc/xprt.c:1658 xs_setup_xprt.part.12+0x45/0x2b0 net/sunrpc/xprtsock.c:2734 xs_setup_xprt net/sunrpc/xprtsock.c:2844 [inline] xs_setup_udp+0x72/0x800 net/sunrpc/xprtsock.c:2849 xprt_create_transport+0x11b/0x41f net/sunrpc/xprt.c:1905 rpc_create+0x225/0x540 net/sunrpc/clnt.c:581 nfs_create_rpc_client+0x42d/0x640 fs/nfs/client.c:535 nfs_init_client+0x4c/0xd0 fs/nfs/client.c:652 nfs_init_server+0x2d9/0xd50 fs/nfs/client.c:691 nfs_create_server+0x12f/0x5e0 fs/nfs/client.c:978 nfs_try_get_tree+0x154/0x810 fs/nfs/super.c:922 vfs_get_tree+0x7e/0x2c0 fs/super.c:1547 do_new_mount fs/namespace.c:2816 [inline] do_mount+0x10c5/0x17b0 fs/namespace.c:3141 __do_sys_mount fs/namespace.c:3350 [inline] __se_sys_mount fs/namespace.c:3327 [inline] __x64_sys_mount+0x15d/0x1b0 fs/namespace.c:3327 do_syscall_64+0xc6/0x620 arch/x86/entry/common.c:295 entry_SYSCALL_64_after_hwframe+0x49/0xb3 Freed by task 3964: save_stack+0x19/0x40 mm/kasan/common.c:49 set_track mm/kasan/common.c:57 [inline] kasan_set_free_info mm/kasan/common.c:317 [inline] __kasan_slab_free+0xf7/0x140 mm/kasan/common.c:456 __cache_free mm/slab.c:3426 [inline] kmem_cache_free_bulk+0x7f/0x280 mm/slab.c:3721 kfree_bulk include/linux/slab.h:412 [inline] kfree_rcu_work+0x17d/0x450 kernel/rcu/tree.c:2859 process_one_work+0x908/0x15d0 kernel/workqueue.c:2268 worker_thread+0x82/0xb50 kernel/workqueue.c:2414 kthread+0x340/0x410 kernel/kthread.c:268 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 The buggy address belongs to the object at ffff8880a8670000 which belongs to the cache kmalloc-4k of size 4096 The buggy address is located 2264 bytes inside of 4096-byte region [ffff8880a8670000, ffff8880a8671000) The buggy address belongs to the page: page:ffffea0002a19c00 refcount:1 mapcount:0 mapping:000000003b9d48a9 index:0x0 head:ffffea0002a19c00 order:1 compound_mapcount:0 flags: 0xfffe0000010200(slab|head) raw: 00fffe0000010200 ffffea0001e08008 ffffea0001d95108 ffff8880aa402000 raw: 0000000000000000 ffff8880a8670000 0000000100000001 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880a8670780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880a8670800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8880a8670880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880a8670900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880a8670980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================