================================================================== BUG: KASAN: slab-use-after-free in netdev_need_ops_lock include/net/netdev_lock.h:30 [inline] BUG: KASAN: slab-use-after-free in netdev_lock_ops include/net/netdev_lock.h:41 [inline] BUG: KASAN: slab-use-after-free in __ethtool_get_link_ksettings+0x230/0x250 net/ethtool/ioctl.c:463 Read of size 1 at addr ffff888053749011 by task kworker/1:6/5831 CPU: 1 UID: 0 PID: 5831 Comm: kworker/1:6 Tainted: G L syzkaller #0 PREEMPT_{RT,(full)} Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 Workqueue: infiniband ib_cache_event_task Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description+0x55/0x1e0 mm/kasan/report.c:378 print_report+0x58/0x70 mm/kasan/report.c:482 kasan_report+0x117/0x150 mm/kasan/report.c:595 netdev_need_ops_lock include/net/netdev_lock.h:30 [inline] netdev_lock_ops include/net/netdev_lock.h:41 [inline] __ethtool_get_link_ksettings+0x230/0x250 net/ethtool/ioctl.c:463 __ethtool_get_link_ksettings+0x11f/0x250 net/ethtool/ioctl.c:464 ib_get_eth_speed+0x180/0x800 drivers/infiniband/core/verbs.c:2052 rxe_query_port+0x93/0x3e0 drivers/infiniband/sw/rxe/rxe_verbs.c:56 __ib_query_port drivers/infiniband/core/device.c:2129 [inline] ib_query_port+0x16e/0x840 drivers/infiniband/core/device.c:2161 ib_cache_update+0x20f/0xd10 drivers/infiniband/core/cache.c:1456 ib_cache_event_task+0xd3/0x1c0 drivers/infiniband/core/cache.c:1535 process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379 process_scheduled_works kernel/workqueue.c:3462 [inline] worker_thread+0xb05/0x10d0 kernel/workqueue.c:3543 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Allocated by task 21372: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5339 [inline] __kvmalloc_node_noprof+0x5ac/0x880 mm/slub.c:6908 alloc_netdev_mqs+0xa9/0x1300 net/core/dev.c:12073 rtnl_create_link+0x321/0xd70 net/core/rtnetlink.c:3726 rtnl_newlink_create+0x258/0x7b0 net/core/rtnetlink.c:3908 __rtnl_newlink net/core/rtnetlink.c:4047 [inline] rtnl_newlink+0x167f/0x1bd0 net/core/rtnetlink.c:4162 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7079 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810 __sock_sendmsg net/socket.c:825 [inline] __sys_sendto+0x41e/0x5d0 net/socket.c:2292 __do_sys_sendto net/socket.c:2299 [inline] __se_sys_sendto net/socket.c:2295 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2295 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 11785: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2706 [inline] slab_free mm/slub.c:6380 [inline] kfree+0x1c5/0x6c0 mm/slub.c:6695 device_release+0xc4/0x1f0 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x222/0x550 lib/kobject.c:737 netdev_run_todo+0x1128/0x12a0 net/core/dev.c:11774 default_device_exit_batch+0x966/0x9e0 net/core/dev.c:13124 ops_exit_list net/core/net_namespace.c:205 [inline] ops_undo_list+0x4b4/0x8d0 net/core/net_namespace.c:252 cleanup_net+0x575/0x810 net/core/net_namespace.c:702 process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379 process_scheduled_works kernel/workqueue.c:3462 [inline] worker_thread+0xb05/0x10d0 kernel/workqueue.c:3543 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 The buggy address belongs to the object at ffff888053748000 which belongs to the cache kmalloc-cg-8k of size 8192 The buggy address is located 4113 bytes inside of freed 8192-byte region [ffff888053748000, ffff88805374a000) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x53748 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 memcg:ffff88805374a011 flags: 0x80000000000040(head|node=0|zone=1) page_type: f5(slab) raw: 0080000000000040 ffff88813fe0d640 dead000000000100 dead000000000122 raw: 0000000000000000 0000400000020002 00000000f5000000 ffff88805374a011 head: 0080000000000040 ffff88813fe0d640 dead000000000100 dead000000000122 head: 0000000000000000 0000400000020002 00000000f5000000 ffff88805374a011 head: 0080000000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000008 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd28c0(GFP_NOWAIT|__GFP_IO|__GFP_FS|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 8811, tgid 8805 (syz.0.918), ts 369093568931 set_page_owner include/linux/page_owner.h:33 [inline] post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1869 prep_new_page mm/page_alloc.c:1877 [inline] get_page_from_freelist+0x264c/0x26c0 mm/page_alloc.c:3953 __alloc_frozen_pages_noprof+0x222/0x5b0 mm/page_alloc.c:5392 alloc_slab_page mm/slub.c:3295 [inline] allocate_slab+0x7c/0x5e0 mm/slub.c:3410 new_slab mm/slub.c:3456 [inline] refill_objects+0x2d8/0x350 mm/slub.c:7313 refill_sheaf mm/slub.c:2833 [inline] __pcs_replace_empty_main+0x330/0x690 mm/slub.c:4699 alloc_from_pcs mm/slub.c:4775 [inline] slab_alloc_node mm/slub.c:4909 [inline] __do_kmalloc_node mm/slub.c:5338 [inline] __kvmalloc_node_noprof+0x6ec/0x880 mm/slub.c:6908 compute_subprog_args kernel/bpf/liveness.c:1642 [inline] analyze_subprog+0x898/0x9dd0 kernel/bpf/liveness.c:1890 bpf_compute_subprog_arg_access+0x2c9/0x1500 kernel/bpf/liveness.c:2032 bpf_compute_live_registers+0x761/0x1ed0 kernel/bpf/liveness.c:2244 bpf_check+0x3208/0x3b40 kernel/bpf/verifier.c:20195 bpf_prog_load+0x13ec/0x1ac0 kernel/bpf/syscall.c:3118 __sys_bpf+0xd0d/0xd90 kernel/bpf/syscall.c:6339 __do_sys_bpf kernel/bpf/syscall.c:6458 [inline] __se_sys_bpf kernel/bpf/syscall.c:6455 [inline] __x64_sys_bpf+0xba/0xd0 kernel/bpf/syscall.c:6455 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f page last free pid 8775 tgid 8775 ts 367395004265 stack trace: reset_page_owner include/linux/page_owner.h:26 [inline] __free_pages_prepare mm/page_alloc.c:1416 [inline] __free_frozen_pages+0x117d/0x1260 mm/page_alloc.c:2960 __slab_free+0x252/0x2a0 mm/slub.c:5738 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4608 [inline] slab_alloc_node mm/slub.c:4921 [inline] kmem_cache_alloc_noprof+0x358/0x680 mm/slub.c:4935 new_handle fs/jbd2/transaction.c:457 [inline] jbd2__journal_start+0x145/0x5c0 fs/jbd2/transaction.c:485 __ext4_journal_start_sb+0x203/0x5d0 fs/ext4/ext4_jbd2.c:114 __ext4_journal_start fs/ext4/ext4_jbd2.h:242 [inline] ext4_dirty_inode+0x93/0x110 fs/ext4/inode.c:6636 __mark_inode_dirty+0x3a8/0x13b0 fs/fs-writeback.c:2709 generic_update_time fs/inode.c:2254 [inline] file_update_time_flags+0x3f4/0x4b0 fs/inode.c:2484 ext4_page_mkwrite+0x225/0x1150 fs/ext4/inode.c:6805 do_page_mkwrite+0x14a/0x310 mm/memory.c:3677 do_shared_fault mm/memory.c:5916 [inline] do_fault mm/memory.c:5978 [inline] do_pte_missing+0x734/0x28f0 mm/memory.c:4561 handle_pte_fault mm/memory.c:6359 [inline] __handle_mm_fault mm/memory.c:6497 [inline] handle_mm_fault+0xe0b/0x1520 mm/memory.c:6666 do_user_addr_fault+0xa4d/0x1340 arch/x86/mm/fault.c:1343 Memory state around the buggy address: ffff888053748f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888053748f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888053749000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888053749080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888053749100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================