================================================================== BUG: KASAN: use-after-free in tcp_retransmit_timer+0x2ef3/0x3360 net/ipv4/tcp_timer.c:511 Read of size 8 at addr ffff88806adf1e40 by task syz-executor.1/13925 CPU: 1 PID: 13925 Comm: syz-executor.1 Not tainted 5.18.0-rc3-syzkaller-01609-g418fbe82578e #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description.constprop.0.cold+0xeb/0x495 mm/kasan/report.c:313 print_report mm/kasan/report.c:429 [inline] kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491 tcp_retransmit_timer+0x2ef3/0x3360 net/ipv4/tcp_timer.c:511 tcp_write_timer_handler+0x5e6/0xbc0 net/ipv4/tcp_timer.c:622 tcp_write_timer+0xa2/0x2b0 net/ipv4/tcp_timer.c:642 call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1421 expire_timers kernel/time/timer.c:1466 [inline] __run_timers.part.0+0x679/0xa80 kernel/time/timer.c:1737 __run_timers kernel/time/timer.c:1715 [inline] run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1750 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 invoke_softirq kernel/softirq.c:432 [inline] __irq_exit_rcu+0x123/0x180 kernel/softirq.c:637 irq_exit_rcu+0x5/0x20 kernel/softirq.c:649 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1097 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:645 RIP: 0010:filter_irq_stacks+0x1b/0x90 kernel/stacktrace.c:395 Code: 34 24 e9 59 ff ff ff 0f 1f 84 00 00 00 00 00 41 54 41 89 f4 55 53 48 83 ec 08 85 f6 74 30 48 bd 00 00 00 00 00 fc ff df 31 db <48> 89 f8 48 c1 e8 03 80 3c 28 00 75 4b 48 8b 07 48 3d 00 01 80 89 RSP: 0018:ffffc90003aef850 EFLAGS: 00000202 RAX: ffffffff81459b24 RBX: 0000000000000004 RCX: 0000000000000001 RDX: 0000000000000dc0 RSI: 0000000000000008 RDI: ffffc90003aef908 RBP: dffffc0000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000008 R13: 0000000000000dc0 R14: ffffc90003aef8e8 R15: 0000000000000001 __stack_depot_save+0x35/0x500 lib/stackdepot.c:360 kasan_save_stack+0x2e/0x40 mm/kasan/common.c:39 kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:436 [inline] __kasan_slab_alloc+0x90/0xc0 mm/kasan/common.c:469 kasan_slab_alloc include/linux/kasan.h:224 [inline] slab_post_alloc_hook mm/slab.h:749 [inline] slab_alloc_node mm/slub.c:3217 [inline] slab_alloc mm/slub.c:3225 [inline] __kmem_cache_alloc_lru mm/slub.c:3232 [inline] kmem_cache_alloc+0x204/0x3b0 mm/slub.c:3242 kmem_cache_zalloc include/linux/slab.h:704 [inline] copy_signal kernel/fork.c:1686 [inline] copy_process+0x26a4/0x6fe0 kernel/fork.c:2231 kernel_clone+0xe7/0xab0 kernel/fork.c:2639 __do_sys_clone+0xc8/0x110 kernel/fork.c:2756 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae RIP: 0033:0x7f88a68876db Code: ed 0f 85 60 01 00 00 64 4c 8b 0c 25 10 00 00 00 45 31 c0 4d 8d 91 d0 02 00 00 31 d2 31 f6 bf 11 00 20 01 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 89 00 00 00 41 89 c5 85 c0 0f 85 90 00 00 RSP: 002b:00007ffcf9a4ae80 EFLAGS: 00000246 ORIG_RAX: 0000000000000038 RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f88a68876db RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011 RBP: 0000000000000001 R08: 0000000000000000 R09: 000055555632c400 R10: 000055555632c6d0 R11: 0000000000000246 R12: 0000000000000001 R13: 0000000000000000 R14: 0000000000000001 R15: 00007ffcf9a4af60 Allocated by task 18248: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:436 [inline] __kasan_slab_alloc+0x90/0xc0 mm/kasan/common.c:469 kasan_slab_alloc include/linux/kasan.h:224 [inline] slab_post_alloc_hook mm/slab.h:749 [inline] slab_alloc_node mm/slub.c:3217 [inline] slab_alloc mm/slub.c:3225 [inline] __kmem_cache_alloc_lru mm/slub.c:3232 [inline] kmem_cache_alloc+0x204/0x3b0 mm/slub.c:3242 kmem_cache_zalloc include/linux/slab.h:704 [inline] net_alloc net/core/net_namespace.c:403 [inline] copy_net_ns+0x125/0x760 net/core/net_namespace.c:458 create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0xc1/0x1f0 kernel/nsproxy.c:226 ksys_unshare+0x445/0x920 kernel/fork.c:3132 __do_sys_unshare kernel/fork.c:3203 [inline] __se_sys_unshare kernel/fork.c:3201 [inline] __x64_sys_unshare+0x2d/0x40 kernel/fork.c:3201 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Last potentially related work creation: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 __kasan_record_aux_stack+0xbe/0xd0 mm/kasan/generic.c:348 insert_work+0x48/0x350 kernel/workqueue.c:1358 __queue_work+0x62e/0x1140 kernel/workqueue.c:1517 call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1421 expire_timers kernel/time/timer.c:1461 [inline] __run_timers.part.0+0x4a3/0xa80 kernel/time/timer.c:1737 __run_timers kernel/time/timer.c:1715 [inline] run_timer_softirq+0x152/0x1d0 kernel/time/timer.c:1752 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 Second to last potentially related work creation: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38 __kasan_record_aux_stack+0xbe/0xd0 mm/kasan/generic.c:348 insert_work+0x48/0x350 kernel/workqueue.c:1358 __queue_work+0x62e/0x1140 kernel/workqueue.c:1517 call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1421 expire_timers kernel/time/timer.c:1461 [inline] __run_timers.part.0+0x4a3/0xa80 kernel/time/timer.c:1737 __run_timers kernel/time/timer.c:1715 [inline] run_timer_softirq+0x152/0x1d0 kernel/time/timer.c:1752 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 The buggy address belongs to the object at ffff88806adf1b80 which belongs to the cache net_namespace of size 6784 The buggy address is located 704 bytes inside of 6784-byte region [ffff88806adf1b80, ffff88806adf3600) The buggy address belongs to the physical page: page:ffffea0001ab7c00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88806adf1b80 pfn:0x6adf0 head:ffffea0001ab7c00 order:3 compound_mapcount:0 compound_pincount:0 memcg:ffff88806c9525c1 flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000010200 ffffea0001b76608 ffff888010dce288 ffff888010dcd3c0 raw: ffff88806adf1b80 0000000000040000 00000001ffffffff ffff88806c9525c1 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3620, tgid 3620 (syz-executor.0), ts 102397470584, free_ts 102396500426 prep_new_page mm/page_alloc.c:2441 [inline] get_page_from_freelist+0xba2/0x3e00 mm/page_alloc.c:4182 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5408 alloc_pages+0x1aa/0x310 mm/mempolicy.c:2272 alloc_slab_page mm/slub.c:1799 [inline] allocate_slab+0x26c/0x3c0 mm/slub.c:1944 new_slab mm/slub.c:2004 [inline] ___slab_alloc+0x8df/0xf20 mm/slub.c:3005 __slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3092 slab_alloc_node mm/slub.c:3183 [inline] slab_alloc mm/slub.c:3225 [inline] __kmem_cache_alloc_lru mm/slub.c:3232 [inline] kmem_cache_alloc+0x360/0x3b0 mm/slub.c:3242 kmem_cache_zalloc include/linux/slab.h:704 [inline] net_alloc net/core/net_namespace.c:403 [inline] copy_net_ns+0x125/0x760 net/core/net_namespace.c:458 create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0xc1/0x1f0 kernel/nsproxy.c:226 ksys_unshare+0x445/0x920 kernel/fork.c:3132 __do_sys_unshare kernel/fork.c:3203 [inline] __se_sys_unshare kernel/fork.c:3201 [inline] __x64_sys_unshare+0x2d/0x40 kernel/fork.c:3201 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1356 [inline] free_pcp_prepare+0x549/0xd20 mm/page_alloc.c:1406 free_unref_page_prepare mm/page_alloc.c:3328 [inline] free_unref_page+0x19/0x6a0 mm/page_alloc.c:3423 skb_free_head+0xac/0x110 net/core/skbuff.c:655 skb_release_data+0x67a/0x810 net/core/skbuff.c:677 skb_release_all net/core/skbuff.c:742 [inline] __kfree_skb net/core/skbuff.c:756 [inline] consume_skb net/core/skbuff.c:915 [inline] consume_skb+0xc2/0x160 net/core/skbuff.c:909 skb_free_datagram+0x1b/0x1f0 net/core/datagram.c:324 netlink_recvmsg+0x61a/0xea0 net/netlink/af_netlink.c:1999 sock_recvmsg_nosec net/socket.c:948 [inline] sock_recvmsg net/socket.c:966 [inline] sock_recvmsg net/socket.c:962 [inline] ____sys_recvmsg+0x2be/0x5f0 net/socket.c:2632 ___sys_recvmsg+0x127/0x200 net/socket.c:2674 __sys_recvmsg+0xe2/0x1a0 net/socket.c:2704 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Memory state around the buggy address: ffff88806adf1d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88806adf1d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88806adf1e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88806adf1e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88806adf1f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== ---------------- Code disassembly (best guess): 0: 34 24 xor $0x24,%al 2: e9 59 ff ff ff jmpq 0xffffff60 7: 0f 1f 84 00 00 00 00 nopl 0x0(%rax,%rax,1) e: 00 f: 41 54 push %r12 11: 41 89 f4 mov %esi,%r12d 14: 55 push %rbp 15: 53 push %rbx 16: 48 83 ec 08 sub $0x8,%rsp 1a: 85 f6 test %esi,%esi 1c: 74 30 je 0x4e 1e: 48 bd 00 00 00 00 00 movabs $0xdffffc0000000000,%rbp 25: fc ff df 28: 31 db xor %ebx,%ebx * 2a: 48 89 f8 mov %rdi,%rax <-- trapping instruction 2d: 48 c1 e8 03 shr $0x3,%rax 31: 80 3c 28 00 cmpb $0x0,(%rax,%rbp,1) 35: 75 4b jne 0x82 37: 48 8b 07 mov (%rdi),%rax 3a: 48 3d 00 01 80 89 cmp $0xffffffff89800100,%rax