================================================================== BUG: KASAN: use-after-free in ccid_hc_tx_delete+0xde/0x100 net/dccp/ccid.c:188 Read of size 8 at addr ffff88808c663a00 by task kworker/1:0/17 CPU: 1 PID: 17 Comm: kworker/1:0 Not tainted 5.0.0-rc5+ #65 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: rcu_gp process_srcu Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x172/0x1f0 lib/dump_stack.c:113 print_address_description.cold+0x7c/0x20d mm/kasan/report.c:187 kasan_report.cold+0x1b/0x40 mm/kasan/report.c:317 __asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:135 ccid_hc_tx_delete+0xde/0x100 net/dccp/ccid.c:188 dccp_sk_destruct+0x3f/0x90 net/dccp/proto.c:181 __sk_destruct+0x55/0x6d0 net/core/sock.c:1569 __rcu_reclaim kernel/rcu/rcu.h:240 [inline] rcu_do_batch kernel/rcu/tree.c:2452 [inline] invoke_rcu_callbacks kernel/rcu/tree.c:2773 [inline] rcu_process_callbacks+0x928/0x1390 kernel/rcu/tree.c:2754 __do_softirq+0x266/0x95a kernel/softirq.c:292 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0x180/0x1d0 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x14a/0x570 arch/x86/kernel/apic/apic.c:1062 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807 RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:766 [inline] RIP: 0010:queue_delayed_work_on+0x11d/0x200 kernel/workqueue.c:1582 Code: 00 fc ff df 48 c1 e8 03 80 3c 10 00 0f 85 d8 00 00 00 48 83 3d 63 be 47 07 00 0f 84 9a 00 00 00 e8 e8 1c 25 00 48 89 df 57 9d <0f> 1f 44 00 00 e8 d9 1c 25 00 44 89 f8 48 83 c4 10 5b 41 5c 41 5d RSP: 0018:ffff8880a98c7be0 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13 RAX: ffff8880a98b8480 RBX: 0000000000000293 RCX: 1ffff110153171a9 RDX: 0000000000000000 RSI: ffffffff814ac398 RDI: 0000000000000293 RBP: ffff8880a98c7c18 R08: ffff8880a98b8480 R09: ffff8880a98b8d48 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000200 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000001 queue_delayed_work include/linux/workqueue.h:527 [inline] srcu_reschedule+0xd7/0x130 kernel/rcu/srcutree.c:1249 srcu_gp_end kernel/rcu/srcutree.c:610 [inline] srcu_advance_state kernel/rcu/srcutree.c:1171 [inline] process_srcu+0xbb0/0xec0 kernel/rcu/srcutree.c:1261 process_one_work+0x98e/0x1790 kernel/workqueue.c:2173 worker_thread+0x98/0xe40 kernel/workqueue.c:2319 kthread+0x357/0x430 kernel/kthread.c:246 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352 Allocated by task 10605: save_stack+0x45/0xd0 mm/kasan/common.c:73 set_track mm/kasan/common.c:85 [inline] __kasan_kmalloc mm/kasan/common.c:496 [inline] __kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:469 kasan_kmalloc mm/kasan/common.c:504 [inline] kasan_slab_alloc+0xf/0x20 mm/kasan/common.c:411 kmem_cache_alloc+0x12d/0x710 mm/slab.c:3543 ccid_new+0x256/0x3f0 net/dccp/ccid.c:151 dccp_hdlr_ccid+0x27/0x150 net/dccp/feat.c:44 __dccp_feat_activate+0x17a/0x270 net/dccp/feat.c:344 dccp_feat_activate_values+0x33a/0x766 net/dccp/feat.c:1538 dccp_rcv_request_sent_state_process net/dccp/input.c:472 [inline] dccp_rcv_state_process+0x116f/0x1931 net/dccp/input.c:680 dccp_v6_do_rcv+0x269/0xbf0 net/dccp/ipv6.c:641 sk_backlog_rcv include/net/sock.h:936 [inline] __release_sock+0x12e/0x3a0 net/core/sock.c:2284 release_sock+0x59/0x1c0 net/core/sock.c:2800 inet_wait_for_connect net/ipv4/af_inet.c:588 [inline] __inet_stream_connect+0x59f/0xea0 net/ipv4/af_inet.c:680 inet_stream_connect+0x58/0xa0 net/ipv4/af_inet.c:719 __sys_connect+0x266/0x330 net/socket.c:1662 __do_sys_connect net/socket.c:1673 [inline] __se_sys_connect net/socket.c:1670 [inline] __x64_sys_connect+0x73/0xb0 net/socket.c:1670 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 10605: save_stack+0x45/0xd0 mm/kasan/common.c:73 set_track mm/kasan/common.c:85 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/common.c:458 kasan_slab_free+0xe/0x10 mm/kasan/common.c:466 __cache_free mm/slab.c:3487 [inline] kmem_cache_free+0x86/0x260 mm/slab.c:3749 ccid_hc_tx_delete+0xc1/0x100 net/dccp/ccid.c:190 dccp_hdlr_ccid+0x7d/0x150 net/dccp/feat.c:53 __dccp_feat_activate+0x17a/0x270 net/dccp/feat.c:344 dccp_feat_activate_values+0x33a/0x766 net/dccp/feat.c:1538 dccp_create_openreq_child+0x40c/0x570 net/dccp/minisocks.c:127 dccp_v6_request_recv_sock+0x214/0x1da0 net/dccp/ipv6.c:469 dccp_check_req+0x35c/0x6f0 net/dccp/minisocks.c:196 dccp_v6_rcv+0x6d7/0x191e net/dccp/ipv6.c:747 ip6_protocol_deliver_rcu+0x303/0x16c0 net/ipv6/ip6_input.c:394 ip6_input_finish+0x84/0x170 net/ipv6/ip6_input.c:434 NF_HOOK include/linux/netfilter.h:289 [inline] NF_HOOK include/linux/netfilter.h:283 [inline] ip6_input+0xe4/0x3f0 net/ipv6/ip6_input.c:443 dst_input include/net/dst.h:450 [inline] ip6_rcv_finish+0x1e7/0x320 net/ipv6/ip6_input.c:76 NF_HOOK include/linux/netfilter.h:289 [inline] NF_HOOK include/linux/netfilter.h:283 [inline] ipv6_rcv+0x10e/0x420 net/ipv6/ip6_input.c:272 __netif_receive_skb_one_core+0x115/0x1a0 net/core/dev.c:4973 __netif_receive_skb+0x2c/0x1c0 net/core/dev.c:5083 process_backlog+0x206/0x750 net/core/dev.c:5923 napi_poll net/core/dev.c:6346 [inline] net_rx_action+0x4fa/0x1070 net/core/dev.c:6412 __do_softirq+0x266/0x95a kernel/softirq.c:292 The buggy address belongs to the object at ffff88808c663a00 which belongs to the cache ccid2_hc_tx_sock of size 1240 The buggy address is located 0 bytes inside of 1240-byte region [ffff88808c663a00, ffff88808c663ed8) The buggy address belongs to the page: page:ffffea0002319880 count:1 mapcount:0 mapping:ffff888216099300 index:0x0 compound_mapcount: 0 flags: 0x1fffc0000010200(slab|head) raw: 01fffc0000010200 ffffea0002172308 ffffea0002a5a188 ffff888216099300 raw: 0000000000000000 ffff88808c662400 0000000100000005 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88808c663900: fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc ffff88808c663980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88808c663a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88808c663a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88808c663b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================