================================================================== BUG: KASAN: use-after-free in tcp_probe_timer net/ipv4/tcp_timer.c:388 [inline] BUG: KASAN: use-after-free in tcp_write_timer_handler+0x6ec/0x808 net/ipv4/tcp_timer.c:652 Read of size 1 at addr ffff0000d1063fc5 by task syz-executor.2/22443 CPU: 0 PID: 22443 Comm: syz-executor.2 Not tainted 6.1.82-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 Call trace: dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:284 [inline] print_report+0x174/0x4c0 mm/kasan/report.c:395 kasan_report+0xd4/0x130 mm/kasan/report.c:495 __asan_report_load1_noabort+0x2c/0x38 mm/kasan/report_generic.c:348 tcp_probe_timer net/ipv4/tcp_timer.c:388 [inline] tcp_write_timer_handler+0x6ec/0x808 net/ipv4/tcp_timer.c:652 tcp_write_timer+0x170/0x2e4 net/ipv4/tcp_timer.c:665 call_timer_fn+0x1c0/0xa1c kernel/time/timer.c:1474 expire_timers kernel/time/timer.c:1519 [inline] __run_timers+0x554/0x718 kernel/time/timer.c:1790 run_timer_softirq+0x7c/0x114 kernel/time/timer.c:1803 __do_softirq+0x314/0xe38 kernel/softirq.c:571 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80 call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:893 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85 invoke_softirq kernel/softirq.c:452 [inline] __irq_exit_rcu+0x264/0x4d4 kernel/softirq.c:650 irq_exit_rcu+0x14/0x84 kernel/softirq.c:662 el0_interrupt+0x80/0x260 arch/arm64/kernel/entry-common.c:717 __el0_irq_handler_common+0x18/0x24 arch/arm64/kernel/entry-common.c:724 el0t_64_irq_handler+0x10/0x1c arch/arm64/kernel/entry-common.c:729 el0t_64_irq+0x18c/0x190 arch/arm64/kernel/entry.S:586 Allocated by task 21746: kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x4c/0x80 mm/kasan/common.c:52 kasan_save_alloc_info+0x24/0x30 mm/kasan/generic.c:505 __kasan_slab_alloc+0x74/0x8c mm/kasan/common.c:328 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook+0x74/0x458 mm/slab.h:737 slab_alloc_node mm/slub.c:3398 [inline] slab_alloc mm/slub.c:3406 [inline] __kmem_cache_alloc_lru mm/slub.c:3413 [inline] kmem_cache_alloc+0x230/0x37c mm/slub.c:3422 kmem_cache_zalloc include/linux/slab.h:682 [inline] net_alloc net/core/net_namespace.c:410 [inline] copy_net_ns+0x124/0x590 net/core/net_namespace.c:465 create_new_namespaces+0x344/0x614 kernel/nsproxy.c:110 copy_namespaces+0x354/0x3bc kernel/nsproxy.c:178 copy_process+0x186c/0x38d0 kernel/fork.c:2270 kernel_clone+0x1d8/0x98c kernel/fork.c:2682 __do_sys_clone3 kernel/fork.c:2981 [inline] __se_sys_clone3 kernel/fork.c:2965 [inline] __arm64_sys_clone3+0x358/0x3a0 kernel/fork.c:2965 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2c0 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x64/0x218 arch/arm64/kernel/syscall.c:206 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585 Freed by task 5151: kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x4c/0x80 mm/kasan/common.c:52 kasan_save_free_info+0x38/0x5c mm/kasan/generic.c:516 ____kasan_slab_free+0x144/0x1c0 mm/kasan/common.c:236 __kasan_slab_free+0x18/0x28 mm/kasan/common.c:244 kasan_slab_free include/linux/kasan.h:177 [inline] slab_free_hook mm/slub.c:1724 [inline] slab_free_freelist_hook mm/slub.c:1750 [inline] slab_free mm/slub.c:3661 [inline] kmem_cache_free+0x2f0/0x588 mm/slub.c:3683 net_free net/core/net_namespace.c:439 [inline] cleanup_net+0x888/0x994 net/core/net_namespace.c:622 process_one_work+0x7ac/0x1404 kernel/workqueue.c:2292 worker_thread+0x8e4/0xfec kernel/workqueue.c:2439 kthread+0x250/0x2d8 kernel/kthread.c:376 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864 Last potentially related work creation: kasan_save_stack+0x40/0x70 mm/kasan/common.c:45 __kasan_record_aux_stack+0xcc/0xe8 mm/kasan/generic.c:486 kasan_record_aux_stack_noalloc+0x14/0x20 mm/kasan/generic.c:496 insert_work+0x64/0x384 kernel/workqueue.c:1361 __queue_work+0xd48/0x136c kernel/workqueue.c:1520 delayed_work_timer_fn+0x74/0x90 kernel/workqueue.c:1646 call_timer_fn+0x1c0/0xa1c kernel/time/timer.c:1474 expire_timers kernel/time/timer.c:1514 [inline] __run_timers+0x584/0x718 kernel/time/timer.c:1790 run_timer_softirq+0xcc/0x114 kernel/time/timer.c:1805 __do_softirq+0x314/0xe38 kernel/softirq.c:571 Second to last potentially related work creation: kasan_save_stack+0x40/0x70 mm/kasan/common.c:45 __kasan_record_aux_stack+0xcc/0xe8 mm/kasan/generic.c:486 kasan_record_aux_stack_noalloc+0x14/0x20 mm/kasan/generic.c:496 insert_work+0x64/0x384 kernel/workqueue.c:1361 __queue_work+0xd48/0x136c kernel/workqueue.c:1520 delayed_work_timer_fn+0x74/0x90 kernel/workqueue.c:1646 call_timer_fn+0x1c0/0xa1c kernel/time/timer.c:1474 expire_timers kernel/time/timer.c:1514 [inline] __run_timers+0x584/0x718 kernel/time/timer.c:1790 run_timer_softirq+0xcc/0x114 kernel/time/timer.c:1805 __do_softirq+0x314/0xe38 kernel/softirq.c:571 The buggy address belongs to the object at ffff0000d1063880 which belongs to the cache net_namespace of size 6976 The buggy address is located 1861 bytes inside of 6976-byte region [ffff0000d1063880, ffff0000d10653c0) The buggy address belongs to the physical page: page:00000000ba7965ba refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x111060 head:00000000ba7965ba order:3 compound_mapcount:0 compound_pincount:0 memcg:ffff0000fbe91901 flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000010200 0000000000000000 dead000000000001 ffff0000c03de180 raw: 0000000000000000 0000000000040004 00000001ffffffff ffff0000fbe91901 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000d1063e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff0000d1063f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff0000d1063f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff0000d1064000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff0000d1064080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Unable to handle kernel paging request at virtual address fffffbffefe49e1c KASAN: maybe wild-memory-access in range [0x0003dfff7f24f0e0-0x0003dfff7f24f0e7] Mem abort info: ESR = 0x0000000096000007 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x07: level 3 translation fault Data abort info: ISV = 0, ISS = 0x00000007 CM = 0, WnR = 0 swapper pgtable: 4k pages, 48-bit VAs, pgdp=00000001b19d5000 [fffffbffefe49e1c] pgd=00000001b497a003, p4d=00000001b497a003, pud=00000001b497b003, pmd=1000000104439003, pte=0000000000000000 Internal error: Oops: 0000000096000007 [#1] PREEMPT SMP Modules linked in: CPU: 0 PID: 22443 Comm: syz-executor.2 Tainted: G B 6.1.82-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024 pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __percpu_add_case_32 arch/arm64/include/asm/percpu.h:127 [inline] pc : sock_prot_inuse_add include/net/sock.h:1560 [inline] pc : inet_unhash+0x4e8/0x908 net/ipv4/inet_hashtables.c:794 lr : sock_prot_inuse_add include/net/sock.h:1560 [inline] lr : inet_unhash+0x4d4/0x908 net/ipv4/inet_hashtables.c:794 sp : ffff800008007970 x29: ffff800008007980 x28: ffff800019cea620 x27: 1fffe0001abd5dd6 x26: 1fffe0001abd5dcd x25: dfff800000000000 x24: 0000000000000303 x23: 1fffe0001a21f6f1 x22: ffff0000c4a9f280 x21: 00007bfe51280df8 x20: ffff0000d10fb788 x19: 0000000000000008 x18: ffff8000080073e4 x17: 0000000000000000 x16: ffff8000084fb154 x15: 0000000000000000 x14: 0000000000000008 x13: ffff0000d10fb780 x12: ffff700001000f14 x11: 0000000000ff0100 x10: 0000000000000000 x9 : 00000000ffffffff x8 : fffffbffefe49e1c x7 : 0000000000000001 x6 : ffff800010ba2530 x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff800010ba2808 x2 : 0000000000000000 x1 : 0000000000000008 x0 : 0000000000000041 Call trace: sock_prot_inuse_add include/net/sock.h:1560 [inline] inet_unhash+0x4e8/0x908 net/ipv4/inet_hashtables.c:794 tcp_set_state+0x48c/0x99c net/ipv4/tcp.c:2766 tcp_done+0x188/0x2f4 net/ipv4/tcp.c:4683 tcp_out_of_resources+0x1b8/0x348 net/ipv4/tcp_timer.c:132 tcp_probe_timer net/ipv4/tcp_timer.c:395 [inline] tcp_write_timer_handler+0x4b0/0x808 net/ipv4/tcp_timer.c:652 tcp_write_timer+0x170/0x2e4 net/ipv4/tcp_timer.c:665 call_timer_fn+0x1c0/0xa1c kernel/time/timer.c:1474 expire_timers kernel/time/timer.c:1519 [inline] __run_timers+0x554/0x718 kernel/time/timer.c:1790 run_timer_softirq+0x7c/0x114 kernel/time/timer.c:1803 __do_softirq+0x314/0xe38 kernel/softirq.c:571 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:80 call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:893 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:85 invoke_softirq kernel/softirq.c:452 [inline] __irq_exit_rcu+0x264/0x4d4 kernel/softirq.c:650 irq_exit_rcu+0x14/0x84 kernel/softirq.c:662 el0_interrupt+0x80/0x260 arch/arm64/kernel/entry-common.c:717 __el0_irq_handler_common+0x18/0x24 arch/arm64/kernel/entry-common.c:724 el0t_64_irq_handler+0x10/0x1c arch/arm64/kernel/entry-common.c:729 el0t_64_irq+0x18c/0x190 arch/arm64/kernel/entry.S:586 Code: 8b130aa9 8b080128 12800009 91001108 (b829011f) ---[ end trace 0000000000000000 ]--- ---------------- Code disassembly (best guess): 0: 8b130aa9 add x9, x21, x19, lsl #2 4: 8b080128 add x8, x9, x8 8: 12800009 mov w9, #0xffffffff // #-1 c: 91001108 add x8, x8, #0x4 * 10: b829011f stadd w9, [x8] <-- trapping instruction