================================================================== BUG: KASAN: use-after-free in ip_icmp_error+0x52a/0x5a0 net/ipv4/ip_sockglue.c:404 Read of size 1 at addr ffff88809325afff by task ksoftirqd/1/16 CPU: 1 PID: 16 Comm: ksoftirqd/1 Not tainted 5.7.0-rc6-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x188/0x20d lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xd3/0x413 mm/kasan/report.c:382 __kasan_report.cold+0x20/0x38 mm/kasan/report.c:511 kasan_report+0x33/0x50 mm/kasan/common.c:625 ip_icmp_error+0x52a/0x5a0 net/ipv4/ip_sockglue.c:404 tcp_v4_err+0x9b2/0x1d00 net/ipv4/tcp_ipv4.c:576 icmp_socket_deliver+0x1e4/0x360 net/ipv4/icmp.c:803 icmp_unreach+0x33b/0xab0 net/ipv4/icmp.c:920 icmp_rcv+0xee6/0x15f0 net/ipv4/icmp.c:1102 ip_protocol_deliver_rcu+0x57/0x880 net/ipv4/ip_input.c:204 ip_local_deliver_finish+0x220/0x360 net/ipv4/ip_input.c:231 NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ip_local_deliver+0x1c8/0x4e0 net/ipv4/ip_input.c:252 dst_input include/net/dst.h:441 [inline] ip_rcv_finish+0x1da/0x2f0 net/ipv4/ip_input.c:428 NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ip_rcv+0xd0/0x3c0 net/ipv4/ip_input.c:539 __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5268 __netif_receive_skb+0x27/0x1c0 net/core/dev.c:5382 process_backlog+0x21e/0x7a0 net/core/dev.c:6214 napi_poll net/core/dev.c:6659 [inline] net_rx_action+0x4c2/0x1070 net/core/dev.c:6727 __do_softirq+0x26c/0x9f7 kernel/softirq.c:292 run_ksoftirqd kernel/softirq.c:604 [inline] run_ksoftirqd+0x89/0x100 kernel/softirq.c:596 smpboot_thread_fn+0x653/0x9e0 kernel/smpboot.c:165 kthread+0x388/0x470 kernel/kthread.c:268 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:351 Allocated by task 4114: save_stack+0x1b/0x40 mm/kasan/common.c:49 set_track mm/kasan/common.c:57 [inline] __kasan_kmalloc mm/kasan/common.c:495 [inline] __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:468 slab_post_alloc_hook mm/slab.h:586 [inline] slab_alloc mm/slab.c:3320 [inline] kmem_cache_alloc+0x11b/0x740 mm/slab.c:3484 getname_flags fs/namei.c:138 [inline] getname_flags+0xd2/0x5b0 fs/namei.c:128 do_sys_openat2+0x3fc/0x7d0 fs/open.c:1142 do_sys_open+0xc3/0x140 fs/open.c:1164 do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295 entry_SYSCALL_64_after_hwframe+0x49/0xb3 Freed by task 4114: save_stack+0x1b/0x40 mm/kasan/common.c:49 set_track mm/kasan/common.c:57 [inline] kasan_set_free_info mm/kasan/common.c:317 [inline] __kasan_slab_free+0xf7/0x140 mm/kasan/common.c:456 __cache_free mm/slab.c:3426 [inline] kmem_cache_free+0x7f/0x320 mm/slab.c:3694 putname+0xe1/0x120 fs/namei.c:259 do_sys_openat2+0x467/0x7d0 fs/open.c:1157 do_sys_open+0xc3/0x140 fs/open.c:1164 do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295 entry_SYSCALL_64_after_hwframe+0x49/0xb3 The buggy address belongs to the object at ffff88809325a200 which belongs to the cache names_cache of size 4096 The buggy address is located 3583 bytes inside of 4096-byte region [ffff88809325a200, ffff88809325b200) The buggy address belongs to the page: page:ffffea00024c9680 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 head:ffffea00024c9680 order:1 compound_mapcount:0 flags: 0xfffe0000010200(slab|head) raw: 00fffe0000010200 ffffea00024ca208 ffffea00024ba708 ffff8880aa1ec000 raw: 0000000000000000 ffff88809325a200 0000000100000001 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88809325ae80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88809325af00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88809325af80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88809325b000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88809325b080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================