================================================================== BUG: KFENCE: use-after-free read in xsk_diag_put_info net/xdp/xsk_diag.c:21 [inline] BUG: KFENCE: use-after-free read in xsk_diag_fill net/xdp/xsk_diag.c:114 [inline] BUG: KFENCE: use-after-free read in xsk_diag_dump+0x9f1/0x15c0 net/xdp/xsk_diag.c:163 Use-after-free read at 0xffff88823bdca0e0 (in kfence-#228): xsk_diag_put_info net/xdp/xsk_diag.c:21 [inline] xsk_diag_fill net/xdp/xsk_diag.c:114 [inline] xsk_diag_dump+0x9f1/0x15c0 net/xdp/xsk_diag.c:163 netlink_dump+0x588/0xca0 net/netlink/af_netlink.c:2269 __netlink_dump_start+0x6d0/0x9c0 net/netlink/af_netlink.c:2376 netlink_dump_start include/linux/netlink.h:330 [inline] xsk_diag_handler_dump+0x1a6/0x240 net/xdp/xsk_diag.c:190 __sock_diag_cmd net/core/sock_diag.c:238 [inline] sock_diag_rcv_msg+0x316/0x440 net/core/sock_diag.c:269 netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2549 sock_diag_rcv+0x2a/0x40 net/core/sock_diag.c:280 netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] netlink_unicast+0x539/0x800 net/netlink/af_netlink.c:1365 netlink_sendmsg+0x93c/0xe30 net/netlink/af_netlink.c:1914 sock_sendmsg_nosec net/socket.c:725 [inline] sock_sendmsg+0xd9/0x180 net/socket.c:748 sock_write_iter+0x29b/0x3d0 net/socket.c:1129 call_write_iter include/linux/fs.h:1877 [inline] do_iter_readv_writev+0x21e/0x3c0 fs/read_write.c:735 do_iter_write+0x17f/0x830 fs/read_write.c:860 vfs_writev+0x221/0x700 fs/read_write.c:933 do_writev+0x285/0x370 fs/read_write.c:976 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd kfence-#228: 0xffff88823bdca000-0xffff88823bdcacc6, size=3271, cache=kmalloc-cg-4k allocated by task 5007 on cpu 0 at 74.455802s: kmalloc_node include/linux/slab.h:602 [inline] kvmalloc_node+0x99/0x1a0 mm/util.c:604 kvmalloc include/linux/slab.h:720 [inline] kvzalloc include/linux/slab.h:728 [inline] alloc_netdev_mqs+0x9b/0x1240 net/core/dev.c:10594 rtnl_create_link+0xc9c/0xfd0 net/core/rtnetlink.c:3350 rtnl_newlink_create net/core/rtnetlink.c:3476 [inline] __rtnl_newlink+0x108e/0x1940 net/core/rtnetlink.c:3706 rtnl_newlink+0x67/0xa0 net/core/rtnetlink.c:3719 rtnetlink_rcv_msg+0x439/0xd30 net/core/rtnetlink.c:6445 netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2549 netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] netlink_unicast+0x539/0x800 net/netlink/af_netlink.c:1365 netlink_sendmsg+0x93c/0xe30 net/netlink/af_netlink.c:1914 sock_sendmsg_nosec net/socket.c:725 [inline] sock_sendmsg+0xd9/0x180 net/socket.c:748 ____sys_sendmsg+0x6ac/0x940 net/socket.c:2494 ___sys_sendmsg+0x135/0x1d0 net/socket.c:2548 __sys_sendmsg+0x117/0x1e0 net/socket.c:2577 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd freed by task 5007 on cpu 0 at 74.803171s: kvfree+0x47/0x50 mm/util.c:650 device_release+0xa1/0x240 drivers/base/core.c:2484 kobject_cleanup lib/kobject.c:682 [inline] kobject_release lib/kobject.c:713 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x1f7/0x5b0 lib/kobject.c:730 netdev_run_todo+0x7dd/0x11d0 net/core/dev.c:10366 rtnl_unlock net/core/rtnetlink.c:151 [inline] rtnetlink_rcv_msg+0x446/0xd30 net/core/rtnetlink.c:6446 netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2549 netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] netlink_unicast+0x539/0x800 net/netlink/af_netlink.c:1365 netlink_sendmsg+0x93c/0xe30 net/netlink/af_netlink.c:1914 sock_sendmsg_nosec net/socket.c:725 [inline] sock_sendmsg+0xd9/0x180 net/socket.c:748 ____sys_sendmsg+0x6ac/0x940 net/socket.c:2494 ___sys_sendmsg+0x135/0x1d0 net/socket.c:2548 __sys_sendmsg+0x117/0x1e0 net/socket.c:2577 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd CPU: 0 PID: 5007 Comm: syz-executor198 Not tainted 6.5.0-rc7-syzkaller-00168-g7d2f353b2682 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023 RIP: 0010:xsk_diag_put_info net/xdp/xsk_diag.c:21 [inline] RIP: 0010:xsk_diag_fill net/xdp/xsk_diag.c:114 [inline] RIP: 0010:xsk_diag_dump+0x9f1/0x15c0 net/xdp/xsk_diag.c:163 Code: c0 48 85 db 74 2a e8 de c4 6f f7 48 8d bb e0 00 00 00 48 89 f8 48 c1 e8 03 42 0f b6 04 20 84 c0 74 08 3c 03 0f 8e 7d 0b 00 00 <8b> 83 e0 00 00 00 89 44 24 48 e8 b0 c4 6f f7 8b 44 24 48 48 8d bd RSP: 0018:ffffc900033bf1d0 EFLAGS: 00010246 RAX: 0000000000000000 RBX: ffff88823bdca000 RCX: 0000000000000000 RDX: ffff888018aa6200 RSI: ffffffff8a155be2 RDI: ffff88823bdca0e0 RBP: ffff8880146b7000 R08: 0000000000000005 R09: 0000000000000000 R10: 0000000000000001 R11: 000000000000000a R12: dffffc0000000000 R13: ffff88807e2b3918 R14: ffff88801e9c6000 R15: 0000000000000000 FS: 000055555569e380(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff88823bdca0e0 CR3: 000000001bbe9000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: netlink_dump+0x588/0xca0 net/netlink/af_netlink.c:2269 __netlink_dump_start+0x6d0/0x9c0 net/netlink/af_netlink.c:2376 netlink_dump_start include/linux/netlink.h:330 [inline] xsk_diag_handler_dump+0x1a6/0x240 net/xdp/xsk_diag.c:190 __sock_diag_cmd net/core/sock_diag.c:238 [inline] sock_diag_rcv_msg+0x316/0x440 net/core/sock_diag.c:269 netlink_rcv_skb+0x16b/0x440 net/netlink/af_netlink.c:2549 sock_diag_rcv+0x2a/0x40 net/core/sock_diag.c:280 netlink_unicast_kernel net/netlink/af_netlink.c:1339 [inline] netlink_unicast+0x539/0x800 net/netlink/af_netlink.c:1365 netlink_sendmsg+0x93c/0xe30 net/netlink/af_netlink.c:1914 sock_sendmsg_nosec net/socket.c:725 [inline] sock_sendmsg+0xd9/0x180 net/socket.c:748 sock_write_iter+0x29b/0x3d0 net/socket.c:1129 call_write_iter include/linux/fs.h:1877 [inline] do_iter_readv_writev+0x21e/0x3c0 fs/read_write.c:735 do_iter_write+0x17f/0x830 fs/read_write.c:860 vfs_writev+0x221/0x700 fs/read_write.c:933 do_writev+0x285/0x370 fs/read_write.c:976 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd RIP: 0033:0x7f841c982e39 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 c1 17 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fff1f9b3d48 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f841c982e39 RDX: 0000000000000001 RSI: 00000000200003c0 RDI: 0000000000000006 RBP: 0000000000000000 R08: 0000000000000006 R09: 0000000000000006 R10: 0000000000000006 R11: 0000000000000246 R12: 0000000000000000 R13: 431bde82d7b634db R14: 0000000000000001 R15: 0000000000000001 ================================================================== ---------------- Code disassembly (best guess): 0: c0 48 85 db rorb $0xdb,-0x7b(%rax) 4: 74 2a je 0x30 6: e8 de c4 6f f7 call 0xf76fc4e9 b: 48 8d bb e0 00 00 00 lea 0xe0(%rbx),%rdi 12: 48 89 f8 mov %rdi,%rax 15: 48 c1 e8 03 shr $0x3,%rax 19: 42 0f b6 04 20 movzbl (%rax,%r12,1),%eax 1e: 84 c0 test %al,%al 20: 74 08 je 0x2a 22: 3c 03 cmp $0x3,%al 24: 0f 8e 7d 0b 00 00 jle 0xba7 * 2a: 8b 83 e0 00 00 00 mov 0xe0(%rbx),%eax <-- trapping instruction 30: 89 44 24 48 mov %eax,0x48(%rsp) 34: e8 b0 c4 6f f7 call 0xf76fc4e9 39: 8b 44 24 48 mov 0x48(%rsp),%eax 3d: 48 rex.W 3e: 8d .byte 0x8d 3f: bd .byte 0xbd