================================================================== BUG: KASAN: use-after-free in instrument_atomic_read_write include/linux/instrumented.h:101 [inline] BUG: KASAN: use-after-free in atomic_add_unless include/linux/atomic/atomic-instrumented.h:607 [inline] BUG: KASAN: use-after-free in _atomic_dec_and_lock_irqsave+0x27/0x150 lib/dec_and_lock.c:41 Write of size 4 at addr ffff88802e5ee41c by task ksoftirqd/0/13 CPU: 0 PID: 13 Comm: ksoftirqd/0 Not tainted 5.16.0-rc8-next-20220110-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0xa5/0x3e0 mm/kasan/report.c:255 __kasan_report mm/kasan/report.c:442 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:459 check_region_inline mm/kasan/generic.c:183 [inline] kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189 instrument_atomic_read_write include/linux/instrumented.h:101 [inline] atomic_add_unless include/linux/atomic/atomic-instrumented.h:607 [inline] _atomic_dec_and_lock_irqsave+0x27/0x150 lib/dec_and_lock.c:41 put_ucounts+0x73/0x1c0 kernel/ucount.c:206 put_cred_rcu+0x27a/0x520 kernel/cred.c:124 rcu_do_batch kernel/rcu/tree.c:2536 [inline] rcu_core+0x7b8/0x1540 kernel/rcu/tree.c:2787 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 run_ksoftirqd kernel/softirq.c:921 [inline] run_ksoftirqd+0x2d/0x60 kernel/softirq.c:913 smpboot_thread_fn+0x645/0x9c0 kernel/smpboot.c:164 kthread+0x2e9/0x3a0 kernel/kthread.c:377 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Allocated by task 7330: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:436 [inline] ____kasan_kmalloc mm/kasan/common.c:515 [inline] ____kasan_kmalloc mm/kasan/common.c:474 [inline] __kasan_kmalloc+0xa9/0xd0 mm/kasan/common.c:524 kmalloc include/linux/slab.h:581 [inline] kzalloc include/linux/slab.h:715 [inline] alloc_ucounts+0x1c3/0x590 kernel/ucount.c:175 set_cred_ucounts+0x163/0x320 kernel/cred.c:682 copy_creds+0x708/0xb50 kernel/cred.c:373 copy_process+0x1440/0x7300 kernel/fork.c:2034 kernel_clone+0xe7/0xab0 kernel/fork.c:2557 __do_sys_clone+0xc8/0x110 kernel/fork.c:2674 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Freed by task 5737: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track+0x21/0x30 mm/kasan/common.c:45 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370 ____kasan_slab_free mm/kasan/common.c:366 [inline] ____kasan_slab_free+0x166/0x1a0 mm/kasan/common.c:328 kasan_slab_free include/linux/kasan.h:236 [inline] slab_free_hook mm/slub.c:1728 [inline] slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1754 slab_free mm/slub.c:3509 [inline] kfree+0xce/0x380 mm/slub.c:4562 put_ucounts+0x153/0x1c0 kernel/ucount.c:209 do_dec_rlimit_put_ucounts+0xfb/0x1a0 kernel/ucount.c:299 __sigqueue_free kernel/signal.c:455 [inline] __sigqueue_free kernel/signal.c:450 [inline] flush_sigqueue+0x18e/0x280 kernel/signal.c:469 __exit_signal kernel/exit.c:155 [inline] release_task+0xbd0/0x17e0 kernel/exit.c:200 wait_task_zombie kernel/exit.c:1116 [inline] wait_consider_task+0x2fa6/0x3b80 kernel/exit.c:1343 do_wait_thread kernel/exit.c:1406 [inline] do_wait+0x6ca/0xce0 kernel/exit.c:1523 kernel_wait4+0x14c/0x260 kernel/exit.c:1686 __do_sys_wait4+0x13f/0x150 kernel/exit.c:1714 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Last potentially related work creation: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 __kasan_record_aux_stack+0xbe/0xd0 mm/kasan/generic.c:348 kvfree_call_rcu+0x74/0x990 kernel/rcu/tree.c:3593 drop_sysctl_table+0x3c0/0x4e0 fs/proc/proc_sysctl.c:1706 unregister_sysctl_table fs/proc/proc_sysctl.c:1744 [inline] unregister_sysctl_table+0xc0/0x190 fs/proc/proc_sysctl.c:1719 nf_ct_frags6_sysctl_unregister net/ipv6/netfilter/nf_conntrack_reasm.c:111 [inline] nf_ct_net_exit+0x241/0x550 net/ipv6/netfilter/nf_conntrack_reasm.c:523 ops_exit_list+0xb0/0x160 net/core/net_namespace.c:168 cleanup_net+0x4ea/0xb00 net/core/net_namespace.c:595 process_one_work+0x9ac/0x1650 kernel/workqueue.c:2307 worker_thread+0x657/0x1110 kernel/workqueue.c:2454 kthread+0x2e9/0x3a0 kernel/kthread.c:377 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 Second to last potentially related work creation: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 __kasan_record_aux_stack+0xbe/0xd0 mm/kasan/generic.c:348 call_rcu+0x99/0x730 kernel/rcu/tree.c:3072 neigh_parms_release net/core/neighbour.c:1706 [inline] neigh_parms_release+0x205/0x290 net/core/neighbour.c:1697 inetdev_destroy net/ipv4/devinet.c:327 [inline] inetdev_event+0xd30/0x15d0 net/ipv4/devinet.c:1600 notifier_call_chain+0xb5/0x200 kernel/notifier.c:84 call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:1919 call_netdevice_notifiers_extack net/core/dev.c:1931 [inline] call_netdevice_notifiers net/core/dev.c:1945 [inline] unregister_netdevice_many+0x964/0x1850 net/core/dev.c:10408 ip_tunnel_delete_nets+0x39f/0x5b0 net/ipv4/ip_tunnel.c:1123 ops_exit_list+0x10d/0x160 net/core/net_namespace.c:171 cleanup_net+0x4ea/0xb00 net/core/net_namespace.c:595 process_one_work+0x9ac/0x1650 kernel/workqueue.c:2307 worker_thread+0x657/0x1110 kernel/workqueue.c:2454 kthread+0x2e9/0x3a0 kernel/kthread.c:377 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 The buggy address belongs to the object at ffff88802e5ee400 which belongs to the cache kmalloc-192 of size 192 The buggy address is located 28 bytes inside of 192-byte region [ffff88802e5ee400, ffff88802e5ee4c0) The buggy address belongs to the page: page:ffffea0000b97b80 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2e5ee flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000200 ffffea0000b5ebc0 dead000000000007 ffff888010c41a00 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY|__GFP_HARDWALL), pid 4569, ts 256794476877, free_ts 256790848758 prep_new_page mm/page_alloc.c:2434 [inline] get_page_from_freelist+0xa72/0x2f40 mm/page_alloc.c:4165 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5381 __alloc_pages_node include/linux/gfp.h:568 [inline] alloc_slab_page mm/slub.c:1801 [inline] allocate_slab mm/slub.c:1944 [inline] new_slab+0xaf/0x380 mm/slub.c:2004 ___slab_alloc+0x6be/0xd60 mm/slub.c:3018 __slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3105 slab_alloc_node mm/slub.c:3196 [inline] __kmalloc_node+0x2cb/0x380 mm/slub.c:4468 kmalloc_array_node include/linux/slab.h:677 [inline] kcalloc_node include/linux/slab.h:682 [inline] memcg_alloc_slab_cgroups+0x8b/0x140 mm/memcontrol.c:2834 memcg_slab_post_alloc_hook+0xaa/0x480 mm/slab.h:522 slab_post_alloc_hook mm/slab.h:745 [inline] slab_alloc_node mm/slub.c:3230 [inline] slab_alloc mm/slub.c:3238 [inline] kmem_cache_alloc+0x15c/0x3a0 mm/slub.c:3243 kmem_cache_zalloc include/linux/slab.h:705 [inline] alloc_buffer_head+0x20/0x140 fs/buffer.c:3362 alloc_page_buffers+0x285/0x7b0 fs/buffer.c:832 create_empty_buffers+0x2c/0x1060 fs/buffer.c:1597 ext4_block_write_begin+0x117a/0x16e0 fs/ext4/inode.c:1062 ext4_da_write_begin+0x3e9/0xba0 fs/ext4/inode.c:2949 generic_perform_write+0x205/0x510 mm/filemap.c:3767 ext4_buffered_write_iter+0x1a2/0x390 fs/ext4/file.c:268 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1352 [inline] free_pcp_prepare+0x414/0xb60 mm/page_alloc.c:1404 free_unref_page_prepare mm/page_alloc.c:3325 [inline] free_unref_page+0x19/0x690 mm/page_alloc.c:3404 __vunmap+0x854/0xd30 mm/vmalloc.c:2637 __vfree+0x3c/0xd0 mm/vmalloc.c:2685 vfree+0x5a/0x90 mm/vmalloc.c:2716 __do_replace+0x16b/0x890 net/ipv6/netfilter/ip6_tables.c:1117 do_replace net/ipv6/netfilter/ip6_tables.c:1157 [inline] do_ip6t_set_ctl+0x90d/0xb90 net/ipv6/netfilter/ip6_tables.c:1639 nf_setsockopt+0x83/0xe0 net/netfilter/nf_sockopt.c:101 ipv6_setsockopt+0x122/0x180 net/ipv6/ipv6_sockglue.c:1024 tcp_setsockopt+0x136/0x2520 net/ipv4/tcp.c:3685 __sys_setsockopt+0x2db/0x610 net/socket.c:2180 __do_sys_setsockopt net/socket.c:2191 [inline] __se_sys_setsockopt net/socket.c:2188 [inline] __x64_sys_setsockopt+0xba/0x150 net/socket.c:2188 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Memory state around the buggy address: ffff88802e5ee300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff88802e5ee380: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88802e5ee400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88802e5ee480: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff88802e5ee500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================