================================================================== BUG: KASAN: use-after-free in ovs_ct_limit_exit net/openvswitch/conntrack.c:1922 [inline] BUG: KASAN: use-after-free in ovs_ct_exit+0x2df/0x4a0 net/openvswitch/conntrack.c:2316 Read of size 8 at addr ffff8880433f4300 by task kworker/u4:5/1034 CPU: 0 PID: 1034 Comm: kworker/u4:5 Not tainted 6.0.0-rc2-syzkaller-00213-g8a7d61bdc2fa #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 Workqueue: netns cleanup_net Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:317 [inline] print_report.cold+0x2ba/0x719 mm/kasan/report.c:433 kasan_report+0xb1/0x1e0 mm/kasan/report.c:495 ovs_ct_limit_exit net/openvswitch/conntrack.c:1922 [inline] ovs_ct_exit+0x2df/0x4a0 net/openvswitch/conntrack.c:2316 ovs_exit_net+0x19c/0xbc0 net/openvswitch/datapath.c:2614 ops_exit_list+0xb0/0x170 net/core/net_namespace.c:163 cleanup_net+0x4ea/0xb00 net/core/net_namespace.c:595 process_one_work+0x991/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e4/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 Allocated by task 7822: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:437 [inline] ____kasan_kmalloc mm/kasan/common.c:516 [inline] ____kasan_kmalloc mm/kasan/common.c:475 [inline] __kasan_kmalloc+0xa9/0xd0 mm/kasan/common.c:525 kmalloc include/linux/slab.h:600 [inline] ovs_ct_limit_set_zone_limit net/openvswitch/conntrack.c:1985 [inline] ovs_ct_limit_cmd_set+0x3dd/0xc70 net/openvswitch/conntrack.c:2161 genl_family_rcv_msg_doit+0x228/0x320 net/netlink/genetlink.c:731 genl_family_rcv_msg net/netlink/genetlink.c:775 [inline] genl_rcv_msg+0x328/0x580 net/netlink/genetlink.c:792 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501 genl_rcv+0x24/0x40 net/netlink/genetlink.c:803 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:734 ____sys_sendmsg+0x6eb/0x810 net/socket.c:2482 ___sys_sendmsg+0x110/0x1b0 net/socket.c:2536 __sys_sendmsg+0xf3/0x1c0 net/socket.c:2565 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Freed by task 3684: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track+0x21/0x30 mm/kasan/common.c:45 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:370 ____kasan_slab_free mm/kasan/common.c:367 [inline] ____kasan_slab_free+0x166/0x1c0 mm/kasan/common.c:329 kasan_slab_free include/linux/kasan.h:200 [inline] slab_free_hook mm/slub.c:1754 [inline] slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1780 slab_free mm/slub.c:3534 [inline] kmem_cache_free_bulk.part.0+0x205/0x880 mm/slub.c:3660 kfree_bulk include/linux/slab.h:456 [inline] kfree_rcu_work+0x56c/0xa60 kernel/rcu/tree.c:3035 process_one_work+0x991/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e4/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 Last potentially related work creation: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 __kasan_record_aux_stack+0xbe/0xd0 mm/kasan/generic.c:348 kvfree_call_rcu+0x74/0x940 kernel/rcu/tree.c:3322 ovs_ct_limit_exit net/openvswitch/conntrack.c:1924 [inline] ovs_ct_exit+0x21e/0x4a0 net/openvswitch/conntrack.c:2316 ovs_exit_net+0x19c/0xbc0 net/openvswitch/datapath.c:2614 ops_exit_list+0xb0/0x170 net/core/net_namespace.c:163 cleanup_net+0x4ea/0xb00 net/core/net_namespace.c:595 process_one_work+0x991/0x1610 kernel/workqueue.c:2289 worker_thread+0x665/0x1080 kernel/workqueue.c:2436 kthread+0x2e4/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306 The buggy address belongs to the object at ffff8880433f4300 which belongs to the cache kmalloc-64 of size 64 The buggy address is located 0 bytes inside of 64-byte region [ffff8880433f4300, ffff8880433f4340) The buggy address belongs to the physical page: page:ffffea00010cfd00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880433f4b80 pfn:0x433f4 flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000200 ffffea0001f85008 ffffea0001336e48 ffff888011841640 raw: ffff8880433f4b80 0000000000200001 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 7822, tgid 7820 (syz-executor.4), ts 229703172586, free_ts 229696483397 prep_new_page mm/page_alloc.c:2532 [inline] get_page_from_freelist+0x109b/0x2ce0 mm/page_alloc.c:4283 __alloc_pages+0x1c7/0x510 mm/page_alloc.c:5515 alloc_pages+0x1a6/0x270 mm/mempolicy.c:2270 alloc_slab_page mm/slub.c:1824 [inline] allocate_slab+0x27e/0x3d0 mm/slub.c:1969 new_slab mm/slub.c:2029 [inline] ___slab_alloc+0x7f1/0xe10 mm/slub.c:3031 __slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3118 slab_alloc_node mm/slub.c:3209 [inline] slab_alloc mm/slub.c:3251 [inline] kmem_cache_alloc_trace+0x323/0x3e0 mm/slub.c:3282 kmalloc include/linux/slab.h:600 [inline] ovs_ct_limit_set_zone_limit net/openvswitch/conntrack.c:1985 [inline] ovs_ct_limit_cmd_set+0x3dd/0xc70 net/openvswitch/conntrack.c:2161 genl_family_rcv_msg_doit+0x228/0x320 net/netlink/genetlink.c:731 genl_family_rcv_msg net/netlink/genetlink.c:775 [inline] genl_rcv_msg+0x328/0x580 net/netlink/genetlink.c:792 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2501 genl_rcv+0x24/0x40 net/netlink/genetlink.c:803 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline] netlink_unicast+0x543/0x7f0 net/netlink/af_netlink.c:1345 netlink_sendmsg+0x917/0xe10 net/netlink/af_netlink.c:1921 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:734 ____sys_sendmsg+0x6eb/0x810 net/socket.c:2482 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1449 [inline] free_pcp_prepare+0x5e4/0xd20 mm/page_alloc.c:1499 free_unref_page_prepare mm/page_alloc.c:3380 [inline] free_unref_page+0x19/0x4d0 mm/page_alloc.c:3476 __vunmap+0x85d/0xd30 mm/vmalloc.c:2696 __vfree+0x3c/0xd0 mm/vmalloc.c:2744 vfree+0x5a/0x90 mm/vmalloc.c:2775 kvfree+0x2e/0x50 mm/util.c:653 btf_free+0x102/0x150 kernel/bpf/btf.c:1652 btf_parse kernel/bpf/btf.c:5051 [inline] btf_new_fd+0x77e/0x1e70 kernel/bpf/btf.c:6710 bpf_btf_load kernel/bpf/syscall.c:4314 [inline] __sys_bpf+0x13bd/0x6130 kernel/bpf/syscall.c:4998 __do_sys_bpf kernel/bpf/syscall.c:5057 [inline] __se_sys_bpf kernel/bpf/syscall.c:5055 [inline] __x64_sys_bpf+0x75/0xb0 kernel/bpf/syscall.c:5055 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd Memory state around the buggy address: ffff8880433f4200: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff8880433f4280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc >ffff8880433f4300: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ^ ffff8880433f4380: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff8880433f4400: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ==================================================================