================================================================== BUG: KASAN: use-after-free in tcp_retransmit_timer+0x2ef3/0x3360 net/ipv4/tcp_timer.c:511 Read of size 8 at addr ffff88801eee39c0 by task syz-fuzzer/3589 CPU: 0 PID: 3589 Comm: syz-fuzzer Not tainted 5.18.0-rc3-syzkaller-01616-g834650b50ed2 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0xeb/0x495 mm/kasan/report.c:313 print_report mm/kasan/report.c:429 [inline] kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491 tcp_retransmit_timer+0x2ef3/0x3360 net/ipv4/tcp_timer.c:511 tcp_write_timer_handler+0x5e6/0xbc0 net/ipv4/tcp_timer.c:622 tcp_write_timer+0xa2/0x2b0 net/ipv4/tcp_timer.c:642 call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1421 expire_timers kernel/time/timer.c:1466 [inline] __run_timers.part.0+0x679/0xa80 kernel/time/timer.c:1737 __run_timers kernel/time/timer.c:1715 [inline] run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1750 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 invoke_softirq kernel/softirq.c:432 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637 irq_exit_rcu+0x5/0x20 kernel/softirq.c:649 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:645 RIP: 0010:orc_find arch/x86/kernel/unwind_orc.c:166 [inline] RIP: 0010:unwind_next_frame+0x2dc/0x1ce0 arch/x86/kernel/unwind_orc.c:443 Code: 24 30 89 4c 24 28 44 89 5c 24 20 e8 2e 86 90 00 48 8b 54 24 38 48 8b 74 24 30 8b 4c 24 28 44 8b 5c 24 20 8b 14 95 e4 c3 d5 8e <89> c8 48 8d 3c 40 4c 8d 84 3f 4c db 30 8e 83 c2 01 49 81 f8 e2 c3 RSP: 0018:ffffc90002f4f518 EFLAGS: 00000246 RAX: 0000000000000003 RBX: 1ffff920005e9eab RCX: 000000000002bfcb RDX: 000000000002bfcb RSI: 000000000000bc7a RDI: ffffffff8ed8b5d0 RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000001 R10: fffff520005e9ec9 R11: 000000000008a079 R12: ffffc90002f4f638 R13: ffffc90002f4f625 R14: ffffc90002f4f5f0 R15: ffffffff81bc7ab3 arch_stack_walk+0x7d/0xe0 arch/x86/kernel/stacktrace.c:25 stack_trace_save+0x8c/0xc0 kernel/stacktrace.c:122 save_stack+0x151/0x1e0 mm/page_owner.c:124 __reset_page_owner+0x5d/0x180 mm/page_owner.c:145 reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1356 [inline] free_pcp_prepare+0x549/0xd20 mm/page_alloc.c:1406 free_unref_page_prepare mm/page_alloc.c:3328 [inline] free_unref_page_list+0x16f/0xf80 mm/page_alloc.c:3460 release_pages+0xff1/0x2290 mm/swap.c:980 tlb_batch_pages_flush mm/mmu_gather.c:50 [inline] tlb_flush_mmu_free mm/mmu_gather.c:243 [inline] tlb_flush_mmu mm/mmu_gather.c:250 [inline] tlb_finish_mmu+0x165/0x8c0 mm/mmu_gather.c:341 zap_page_range+0x37e/0x4a0 mm/memory.c:1672 madvise_dontneed_single_vma mm/madvise.c:777 [inline] madvise_dontneed_free mm/madvise.c:860 [inline] madvise_vma_behavior+0xfd2/0x1cf0 mm/madvise.c:999 madvise_walk_vmas+0x1d5/0x2d0 mm/madvise.c:1221 do_madvise mm/madvise.c:1399 [inline] do_madvise+0x2d4/0x3c0 mm/madvise.c:1357 __do_sys_madvise mm/madvise.c:1412 [inline] __se_sys_madvise mm/madvise.c:1410 [inline] __x64_sys_madvise+0xa6/0x110 mm/madvise.c:1410 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x466897 Code: 8b 24 24 48 8b 6c 24 10 48 83 c4 18 c3 cc cc cc cc cc cc 48 8b 7c 24 08 48 8b 74 24 10 8b 54 24 18 48 c7 c0 1c 00 00 00 0f 05 <89> 44 24 20 c3 cc cc cc cc 48 8b 7c 24 08 8b 74 24 10 8b 54 24 14 RSP: 002b:000000c00003ddf8 EFLAGS: 00000202 ORIG_RAX: 000000000000001c RAX: ffffffffffffffda RBX: 0000000000020000 RCX: 0000000000466897 RDX: 0000000000000004 RSI: 0000000000020000 RDI: 000000c00765a000 RBP: 000000c00003de38 R08: 0000000000200000 R09: 0000000000000200 R10: 000000000000013d R11: 0000000000000202 R12: 00007f3d9ac9d000 R13: 0000000000000e80 R14: 000000c000001040 R15: 0000000000001018 Allocated by task 3614: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:436 [inline] __kasan_slab_alloc+0x90/0xc0 mm/kasan/common.c:469 kasan_slab_alloc include/linux/kasan.h:224 [inline] slab_post_alloc_hook mm/slab.h:749 [inline] slab_alloc_node mm/slub.c:3217 [inline] slab_alloc mm/slub.c:3225 [inline] __kmem_cache_alloc_lru mm/slub.c:3232 [inline] kmem_cache_alloc+0x204/0x3b0 mm/slub.c:3242 kmem_cache_zalloc include/linux/slab.h:704 [inline] net_alloc net/core/net_namespace.c:403 [inline] copy_net_ns+0x125/0x760 net/core/net_namespace.c:458 create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0xc1/0x1f0 kernel/nsproxy.c:226 ksys_unshare+0x445/0x920 kernel/fork.c:3132 __do_sys_unshare kernel/fork.c:3203 [inline] __se_sys_unshare kernel/fork.c:3201 [inline] __x64_sys_unshare+0x2d/0x40 kernel/fork.c:3201 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Last potentially related work creation: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 __kasan_record_aux_stack+0xbe/0xd0 mm/kasan/generic.c:348 insert_work+0x48/0x350 kernel/workqueue.c:1358 __queue_work+0x62e/0x1140 kernel/workqueue.c:1517 call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1421 expire_timers kernel/time/timer.c:1461 [inline] __run_timers.part.0+0x4a3/0xa80 kernel/time/timer.c:1737 __run_timers kernel/time/timer.c:1715 [inline] run_timer_softirq+0x152/0x1d0 kernel/time/timer.c:1752 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 The buggy address belongs to the object at ffff88801eee3700 which belongs to the cache net_namespace of size 6784 The buggy address is located 704 bytes inside of 6784-byte region [ffff88801eee3700, ffff88801eee5180) The buggy address belongs to the physical page: page:ffffea00007bb800 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88801eee3700 pfn:0x1eee0 head:ffffea00007bb800 order:3 compound_mapcount:0 compound_pincount:0 memcg:ffff8880247f2a01 flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000010200 0000000000000000 dead000000000001 ffff888010dcd3c0 raw: ffff88801eee3700 0000000080040001 00000001ffffffff ffff8880247f2a01 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3612, tgid 3612 (syz-executor.1), ts 89784528158, free_ts 89783555055 prep_new_page mm/page_alloc.c:2441 [inline] get_page_from_freelist+0xba2/0x3e00 mm/page_alloc.c:4182 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5408 alloc_pages+0x1aa/0x310 mm/mempolicy.c:2272 alloc_slab_page mm/slub.c:1799 [inline] allocate_slab+0x26c/0x3c0 mm/slub.c:1944 new_slab mm/slub.c:2004 [inline] ___slab_alloc+0x8df/0xf20 mm/slub.c:3005 __slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3092 slab_alloc_node mm/slub.c:3183 [inline] slab_alloc mm/slub.c:3225 [inline] __kmem_cache_alloc_lru mm/slub.c:3232 [inline] kmem_cache_alloc+0x360/0x3b0 mm/slub.c:3242 kmem_cache_zalloc include/linux/slab.h:704 [inline] net_alloc net/core/net_namespace.c:403 [inline] copy_net_ns+0x125/0x760 net/core/net_namespace.c:458 create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0xc1/0x1f0 kernel/nsproxy.c:226 ksys_unshare+0x445/0x920 kernel/fork.c:3132 __do_sys_unshare kernel/fork.c:3203 [inline] __se_sys_unshare kernel/fork.c:3201 [inline] __x64_sys_unshare+0x2d/0x40 kernel/fork.c:3201 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1356 [inline] free_pcp_prepare+0x549/0xd20 mm/page_alloc.c:1406 free_unref_page_prepare mm/page_alloc.c:3328 [inline] free_unref_page+0x19/0x6a0 mm/page_alloc.c:3423 skb_free_head+0xac/0x110 net/core/skbuff.c:655 skb_release_data+0x67a/0x810 net/core/skbuff.c:677 skb_release_all net/core/skbuff.c:742 [inline] __kfree_skb net/core/skbuff.c:756 [inline] consume_skb net/core/skbuff.c:915 [inline] consume_skb+0xc2/0x160 net/core/skbuff.c:909 skb_free_datagram+0x1b/0x1f0 net/core/datagram.c:324 netlink_recvmsg+0x61a/0xea0 net/netlink/af_netlink.c:1999 sock_recvmsg_nosec net/socket.c:948 [inline] sock_recvmsg net/socket.c:966 [inline] sock_recvmsg net/socket.c:962 [inline] ____sys_recvmsg+0x2be/0x5f0 net/socket.c:2632 ___sys_recvmsg+0x127/0x200 net/socket.c:2674 __sys_recvmsg+0xe2/0x1a0 net/socket.c:2704 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Memory state around the buggy address: ffff88801eee3880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88801eee3900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88801eee3980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88801eee3a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88801eee3a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== ---------------- Code disassembly (best guess): 0: 24 30 and $0x30,%al 2: 89 4c 24 28 mov %ecx,0x28(%rsp) 6: 44 89 5c 24 20 mov %r11d,0x20(%rsp) b: e8 2e 86 90 00 callq 0x90863e 10: 48 8b 54 24 38 mov 0x38(%rsp),%rdx 15: 48 8b 74 24 30 mov 0x30(%rsp),%rsi 1a: 8b 4c 24 28 mov 0x28(%rsp),%ecx 1e: 44 8b 5c 24 20 mov 0x20(%rsp),%r11d 23: 8b 14 95 e4 c3 d5 8e mov -0x712a3c1c(,%rdx,4),%edx * 2a: 89 c8 mov %ecx,%eax <-- trapping instruction 2c: 48 8d 3c 40 lea (%rax,%rax,2),%rdi 30: 4c 8d 84 3f 4c db 30 lea -0x71cf24b4(%rdi,%rdi,1),%r8 37: 8e 38: 83 c2 01 add $0x1,%edx 3b: 49 rex.WB 3c: 81 .byte 0x81 3d: f8 clc 3e: e2 c3 loop 0x3