================================================================== BUG: KASAN: use-after-free in __rxrpc_put_peer net/rxrpc/peer_object.c:411 [inline] BUG: KASAN: use-after-free in rxrpc_put_peer+0x685/0x6a0 net/rxrpc/peer_object.c:435 Read of size 8 at addr ffff88805b645258 by task ksoftirqd/0/9 CPU: 0 PID: 9 Comm: ksoftirqd/0 Not tainted 5.3.0+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x172/0x1f0 lib/dump_stack.c:113 print_address_description.cold+0xd4/0x306 mm/kasan/report.c:351 __kasan_report.cold+0x1b/0x36 mm/kasan/report.c:482 kasan_report+0x12/0x17 mm/kasan/common.c:618 __asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:132 __rxrpc_put_peer net/rxrpc/peer_object.c:411 [inline] rxrpc_put_peer+0x685/0x6a0 net/rxrpc/peer_object.c:435 rxrpc_rcu_destroy_call+0x5e/0x140 net/rxrpc/call_object.c:566 __rcu_reclaim kernel/rcu/rcu.h:222 [inline] rcu_do_batch kernel/rcu/tree.c:2157 [inline] rcu_core+0x581/0x1560 kernel/rcu/tree.c:2377 rcu_core_si+0x9/0x10 kernel/rcu/tree.c:2386 __do_softirq+0x262/0x98c kernel/softirq.c:292 run_ksoftirqd kernel/softirq.c:603 [inline] run_ksoftirqd+0x8e/0x110 kernel/softirq.c:595 smpboot_thread_fn+0x6a3/0xa40 kernel/smpboot.c:165 kthread+0x361/0x430 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Allocated by task 8508: save_stack+0x23/0x90 mm/kasan/common.c:69 set_track mm/kasan/common.c:77 [inline] __kasan_kmalloc mm/kasan/common.c:493 [inline] __kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:466 kasan_kmalloc+0x9/0x10 mm/kasan/common.c:507 kmem_cache_alloc_trace+0x158/0x790 mm/slab.c:3550 kmalloc include/linux/slab.h:552 [inline] syslog_print kernel/printk/printk.c:1346 [inline] do_syslog kernel/printk/printk.c:1519 [inline] do_syslog+0x5fa/0x1820 kernel/printk/printk.c:1493 kmsg_read+0x8f/0xc0 fs/proc/kmsg.c:40 proc_reg_read+0x1fc/0x2c0 fs/proc/inode.c:223 __vfs_read+0x8a/0x110 fs/read_write.c:425 vfs_read+0x1f0/0x440 fs/read_write.c:461 ksys_read+0x14f/0x290 fs/read_write.c:587 __do_sys_read fs/read_write.c:597 [inline] __se_sys_read fs/read_write.c:595 [inline] __x64_sys_read+0x73/0xb0 fs/read_write.c:595 do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 8508: save_stack+0x23/0x90 mm/kasan/common.c:69 set_track mm/kasan/common.c:77 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/common.c:455 kasan_slab_free+0xe/0x10 mm/kasan/common.c:463 __cache_free mm/slab.c:3425 [inline] kfree+0x10a/0x2c0 mm/slab.c:3756 syslog_print kernel/printk/printk.c:1405 [inline] do_syslog kernel/printk/printk.c:1519 [inline] do_syslog+0x918/0x1820 kernel/printk/printk.c:1493 kmsg_read+0x8f/0xc0 fs/proc/kmsg.c:40 proc_reg_read+0x1fc/0x2c0 fs/proc/inode.c:223 __vfs_read+0x8a/0x110 fs/read_write.c:425 vfs_read+0x1f0/0x440 fs/read_write.c:461 ksys_read+0x14f/0x290 fs/read_write.c:587 __do_sys_read fs/read_write.c:597 [inline] __se_sys_read fs/read_write.c:595 [inline] __x64_sys_read+0x73/0xb0 fs/read_write.c:595 do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff88805b645240 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 24 bytes inside of 1024-byte region [ffff88805b645240, ffff88805b645640) The buggy address belongs to the page: page:ffffea00016d9100 refcount:1 mapcount:0 mapping:ffff8880aa400c40 index:0xffff88805b644940 compound_mapcount: 0 flags: 0x1fffc0000010200(slab|head) raw: 01fffc0000010200 ffffea00025cf788 ffffea00026ab488 ffff8880aa400c40 raw: ffff88805b644940 ffff88805b644040 0000000100000002 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88805b645100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88805b645180: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc >ffff88805b645200: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb ^ ffff88805b645280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88805b645300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================