ieee802154 phy0 wpan0: encryption failed: -22 ieee802154 phy1 wpan1: encryption failed: -22 ================================================================== BUG: KASAN: slab-use-after-free in skb_update_prio net/core/dev.c:3861 [inline] BUG: KASAN: slab-use-after-free in __dev_queue_xmit+0x675/0x3b10 net/core/dev.c:4278 Read of size 8 at addr ffff888074e48ba8 by task aoe_tx0/1241 CPU: 1 PID: 1241 Comm: aoe_tx0 Not tainted 6.8.0-rc4-syzkaller-00003-g716f4aaa7b48 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:377 [inline] print_report+0x167/0x540 mm/kasan/report.c:488 kasan_report+0x142/0x180 mm/kasan/report.c:601 skb_update_prio net/core/dev.c:3861 [inline] __dev_queue_xmit+0x675/0x3b10 net/core/dev.c:4278 dev_queue_xmit include/linux/netdevice.h:3171 [inline] tx+0x6a/0x110 drivers/block/aoe/aoenet.c:62 kthread+0x239/0x440 drivers/block/aoe/aoecmd.c:1229 kthread+0x2ef/0x390 kernel/kthread.c:388 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242 Allocated by task 23: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:372 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:389 kasan_kmalloc include/linux/kasan.h:211 [inline] __do_kmalloc_node mm/slub.c:3981 [inline] __kmalloc_node+0x24e/0x4e0 mm/slub.c:3988 kmalloc_node include/linux/slab.h:610 [inline] kvmalloc_node+0x72/0x190 mm/util.c:617 kvmalloc include/linux/slab.h:728 [inline] kvzalloc include/linux/slab.h:736 [inline] alloc_netdev_mqs+0x9d/0xf80 net/core/dev.c:10826 usbnet_probe+0x207/0x2830 drivers/net/usb/usbnet.c:1698 usb_probe_interface+0x5cb/0xb00 drivers/usb/core/driver.c:399 really_probe+0x29e/0xc50 drivers/base/dd.c:658 __driver_probe_device+0x1a2/0x3e0 drivers/base/dd.c:800 driver_probe_device+0x50/0x430 drivers/base/dd.c:830 __device_attach_driver+0x2d6/0x530 drivers/base/dd.c:958 bus_for_each_drv+0x24e/0x2e0 drivers/base/bus.c:457 __device_attach+0x333/0x520 drivers/base/dd.c:1030 bus_probe_device+0x189/0x260 drivers/base/bus.c:532 device_add+0x8ff/0xca0 drivers/base/core.c:3625 usb_set_configuration+0x1976/0x1fb0 drivers/usb/core/message.c:2207 usb_generic_driver_probe+0x88/0x140 drivers/usb/core/generic.c:254 usb_probe_device+0x13e/0x2d0 drivers/usb/core/driver.c:294 really_probe+0x29e/0xc50 drivers/base/dd.c:658 __driver_probe_device+0x1a2/0x3e0 drivers/base/dd.c:800 driver_probe_device+0x50/0x430 drivers/base/dd.c:830 __device_attach_driver+0x2d6/0x530 drivers/base/dd.c:958 bus_for_each_drv+0x24e/0x2e0 drivers/base/bus.c:457 __device_attach+0x333/0x520 drivers/base/dd.c:1030 bus_probe_device+0x189/0x260 drivers/base/bus.c:532 device_add+0x8ff/0xca0 drivers/base/core.c:3625 usb_new_device+0x104a/0x19a0 drivers/usb/core/hub.c:2614 hub_port_connect drivers/usb/core/hub.c:5483 [inline] hub_port_connect_change drivers/usb/core/hub.c:5623 [inline] port_event drivers/usb/core/hub.c:5783 [inline] hub_event+0x2d13/0x50f0 drivers/usb/core/hub.c:5865 process_one_work kernel/workqueue.c:2633 [inline] process_scheduled_works+0x913/0x1420 kernel/workqueue.c:2706 worker_thread+0xa5f/0x1000 kernel/workqueue.c:2787 kthread+0x2ef/0x390 kernel/kthread.c:388 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242 Freed by task 13220: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x4e/0x60 mm/kasan/generic.c:640 poison_slab_object+0xa6/0xe0 mm/kasan/common.c:241 __kasan_slab_free+0x34/0x70 mm/kasan/common.c:257 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2121 [inline] slab_free mm/slub.c:4299 [inline] kfree+0x14a/0x380 mm/slub.c:4409 device_release+0x99/0x1c0 kobject_cleanup lib/kobject.c:682 [inline] kobject_release lib/kobject.c:716 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1f5/0x430 lib/kobject.c:733 usb_unbind_interface+0x1d4/0x850 drivers/usb/core/driver.c:461 device_remove drivers/base/dd.c:569 [inline] __device_release_driver drivers/base/dd.c:1272 [inline] device_release_driver_internal+0x503/0x7c0 drivers/base/dd.c:1295 bus_remove_device+0x34f/0x420 drivers/base/bus.c:574 device_del+0x580/0xa30 drivers/base/core.c:3814 usb_disable_device+0x3bf/0x850 drivers/usb/core/message.c:1416 usb_disconnect+0x340/0x950 drivers/usb/core/hub.c:2267 hub_port_connect drivers/usb/core/hub.c:5323 [inline] hub_port_connect_change drivers/usb/core/hub.c:5623 [inline] port_event drivers/usb/core/hub.c:5783 [inline] hub_event+0x1e62/0x50f0 drivers/usb/core/hub.c:5865 process_one_work kernel/workqueue.c:2633 [inline] process_scheduled_works+0x913/0x1420 kernel/workqueue.c:2706 worker_thread+0xa5f/0x1000 kernel/workqueue.c:2787 kthread+0x2ef/0x390 kernel/kthread.c:388 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1b/0x30 arch/x86/entry/entry_64.S:242 The buggy address belongs to the object at ffff888074e48000 which belongs to the cache kmalloc-cg-8k of size 8192 The buggy address is located 2984 bytes inside of freed 8192-byte region [ffff888074e48000, ffff888074e4a000) The buggy address belongs to the physical page: page:ffffea0001d39200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x74e48 head:ffffea0001d39200 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 memcg:ffff888024bc6961 anon flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 00fff00000000840 ffff888014c4f640 0000000000000000 dead000000000001 raw: 0000000000000000 0000000080020002 00000001ffffffff ffff888024bc6961 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d60c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_RETRY_MAYFAIL|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 13220, tgid 13220 (kworker/0:11), ts 847390170238, free_ts 846640327966 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1533 prep_new_page mm/page_alloc.c:1540 [inline] get_page_from_freelist+0x33ea/0x3580 mm/page_alloc.c:3311 __alloc_pages+0x255/0x680 mm/page_alloc.c:4567 __alloc_pages_node include/linux/gfp.h:238 [inline] alloc_pages_node include/linux/gfp.h:261 [inline] alloc_slab_page+0x5f/0x160 mm/slub.c:2190 allocate_slab mm/slub.c:2354 [inline] new_slab+0x84/0x2f0 mm/slub.c:2407 ___slab_alloc+0xd17/0x13e0 mm/slub.c:3540 __slab_alloc mm/slub.c:3625 [inline] __slab_alloc_node mm/slub.c:3678 [inline] slab_alloc_node mm/slub.c:3850 [inline] __do_kmalloc_node mm/slub.c:3980 [inline] __kmalloc_node+0x2d6/0x4e0 mm/slub.c:3988 kmalloc_node include/linux/slab.h:610 [inline] kvmalloc_node+0x72/0x190 mm/util.c:617 kvmalloc include/linux/slab.h:728 [inline] kvzalloc include/linux/slab.h:736 [inline] alloc_netdev_mqs+0x9d/0xf80 net/core/dev.c:10826 usbnet_probe+0x207/0x2830 drivers/net/usb/usbnet.c:1698 usb_probe_interface+0x5cb/0xb00 drivers/usb/core/driver.c:399 really_probe+0x29e/0xc50 drivers/base/dd.c:658 __driver_probe_device+0x1a2/0x3e0 drivers/base/dd.c:800 driver_probe_device+0x50/0x430 drivers/base/dd.c:830 __device_attach_driver+0x2d6/0x530 drivers/base/dd.c:958 bus_for_each_drv+0x24e/0x2e0 drivers/base/bus.c:457 page last free pid 13220 tgid 13220 stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1140 [inline] free_unref_page_prepare+0x968/0xa90 mm/page_alloc.c:2346 free_unref_page+0x37/0x3f0 mm/page_alloc.c:2486 __slab_free+0x349/0x410 mm/slub.c:4211 qlink_free mm/kasan/quarantine.c:160 [inline] qlist_free_all+0x6d/0xd0 mm/kasan/quarantine.c:176 kasan_quarantine_reduce+0x14f/0x170 mm/kasan/quarantine.c:283 __kasan_slab_alloc+0x23/0x80 mm/kasan/common.c:324 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook mm/slub.c:3813 [inline] slab_alloc_node mm/slub.c:3860 [inline] kmalloc_trace+0x16a/0x360 mm/slub.c:4007 kmalloc include/linux/slab.h:590 [inline] usb_control_msg+0xbb/0x4c0 drivers/usb/core/message.c:144 get_port_status drivers/usb/core/hub.c:604 [inline] hub_ext_port_status+0x108/0x670 drivers/usb/core/hub.c:621 hub_port_reset+0x905/0x1b30 drivers/usb/core/hub.c:3010 hub_port_init+0xf5b/0x2620 drivers/usb/core/hub.c:4973 hub_port_connect drivers/usb/core/hub.c:5412 [inline] hub_port_connect_change drivers/usb/core/hub.c:5623 [inline] port_event drivers/usb/core/hub.c:5783 [inline] hub_event+0x2908/0x50f0 drivers/usb/core/hub.c:5865 process_one_work kernel/workqueue.c:2633 [inline] process_scheduled_works+0x913/0x1420 kernel/workqueue.c:2706 worker_thread+0xa5f/0x1000 kernel/workqueue.c:2787 kthread+0x2ef/0x390 kernel/kthread.c:388 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 Memory state around the buggy address: ffff888074e48a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888074e48b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888074e48b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888074e48c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888074e48c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================