8021q: adding VLAN 0 to HW filter on device team0 8021q: adding VLAN 0 to HW filter on device team0 8021q: adding VLAN 0 to HW filter on device team0 protocol 0000 is buggy, dev sit0 ================================================================== BUG: KASAN: use-after-free in atomic_sub_return include/asm-generic/atomic-instrumented.h:258 [inline] BUG: KASAN: use-after-free in skb_release_data+0x19b/0x860 net/core/skbuff.c:559 Write of size 4 at addr ffff8801b4671ba0 by task syz-executor267/4553 CPU: 1 PID: 4553 Comm: syz-executor267 Not tainted 4.17.0-rc5+ #59 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1b9/0x294 lib/dump_stack.c:113 print_address_description+0x6c/0x20b mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412 check_memory_region_inline mm/kasan/kasan.c:260 [inline] check_memory_region+0x13e/0x1b0 mm/kasan/kasan.c:267 kasan_check_write+0x14/0x20 mm/kasan/kasan.c:278 atomic_sub_return include/asm-generic/atomic-instrumented.h:258 [inline] skb_release_data+0x19b/0x860 net/core/skbuff.c:559 skb_release_all+0x4a/0x60 net/core/skbuff.c:627 __kfree_skb net/core/skbuff.c:641 [inline] kfree_skb+0x195/0x560 net/core/skbuff.c:659 sit_tunnel_xmit+0x16b/0x30b0 net/ipv6/sit.c:1044 __netdev_start_xmit include/linux/netdevice.h:4087 [inline] netdev_start_xmit include/linux/netdevice.h:4096 [inline] xmit_one net/core/dev.c:3053 [inline] dev_hard_start_xmit+0x264/0xc10 net/core/dev.c:3069 __dev_queue_xmit+0x2724/0x34c0 net/core/dev.c:3584 protocol 0000 is buggy, dev sit0 protocol 0000 is buggy, dev sit0 protocol 0000 is buggy, dev sit0 dev_queue_xmit+0x17/0x20 net/core/dev.c:3617 packet_snd net/packet/af_packet.c:2951 [inline] packet_sendmsg+0x40f8/0x6070 net/packet/af_packet.c:2976 protocol 0000 is buggy, dev sit0 protocol 0000 is buggy, dev sit0 protocol 0000 is buggy, dev sit0 protocol 0000 is buggy, dev sit0 protocol 0000 is buggy, dev sit0 protocol 0000 is buggy, dev sit0 sock_sendmsg_nosec net/socket.c:629 [inline] sock_sendmsg+0xd5/0x120 net/socket.c:639 __sys_sendto+0x3d7/0x670 net/socket.c:1789 __do_sys_sendto net/socket.c:1801 [inline] __se_sys_sendto net/socket.c:1797 [inline] __x64_sys_sendto+0xe1/0x1a0 net/socket.c:1797 do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x441279 RSP: 002b:00007ffd15f24e58 EFLAGS: 00000212 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000441279 RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 0000000000000004 RBP: 00000000006cc018 R08: 0000000020000040 R09: 000000000000001c R10: 0000000000000000 R11: 0000000000000212 R12: 00000000004020d0 R13: 0000000000402160 R14: 0000000000000000 R15: 0000000000000000 Allocated by task 4553: save_stack+0x43/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc+0xc4/0xe0 mm/kasan/kasan.c:553 __do_kmalloc_node mm/slab.c:3682 [inline] __kmalloc_node_track_caller+0x47/0x70 mm/slab.c:3696 __kmalloc_reserve.isra.38+0x3a/0xe0 net/core/skbuff.c:137 __alloc_skb+0x14d/0x780 net/core/skbuff.c:205 alloc_skb include/linux/skbuff.h:987 [inline] alloc_skb_with_frags+0x137/0x760 net/core/skbuff.c:5249 sock_alloc_send_pskb+0x87a/0xae0 net/core/sock.c:2088 packet_alloc_skb net/packet/af_packet.c:2810 [inline] packet_snd net/packet/af_packet.c:2901 [inline] packet_sendmsg+0x1b98/0x6070 net/packet/af_packet.c:2976 sock_sendmsg_nosec net/socket.c:629 [inline] sock_sendmsg+0xd5/0x120 net/socket.c:639 __sys_sendto+0x3d7/0x670 net/socket.c:1789 __do_sys_sendto net/socket.c:1801 [inline] __se_sys_sendto net/socket.c:1797 [inline] __x64_sys_sendto+0xe1/0x1a0 net/socket.c:1797 do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 4553: save_stack+0x43/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] __kasan_slab_free+0x11a/0x170 mm/kasan/kasan.c:521 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528 __cache_free mm/slab.c:3498 [inline] kfree+0xd9/0x260 mm/slab.c:3813 skb_free_head+0x99/0xc0 net/core/skbuff.c:550 skb_release_data+0x690/0x860 net/core/skbuff.c:570 skb_release_all+0x4a/0x60 net/core/skbuff.c:627 __kfree_skb net/core/skbuff.c:641 [inline] consume_skb+0x18b/0x550 net/core/skbuff.c:701 packet_rcv+0x16a/0x1810 net/packet/af_packet.c:2169 dev_queue_xmit_nit+0x891/0xb90 net/core/dev.c:2018 xmit_one net/core/dev.c:3049 [inline] dev_hard_start_xmit+0x16b/0xc10 net/core/dev.c:3069 __dev_queue_xmit+0x2724/0x34c0 net/core/dev.c:3584 dev_queue_xmit+0x17/0x20 net/core/dev.c:3617 packet_snd net/packet/af_packet.c:2951 [inline] packet_sendmsg+0x40f8/0x6070 net/packet/af_packet.c:2976 sock_sendmsg_nosec net/socket.c:629 [inline] sock_sendmsg+0xd5/0x120 net/socket.c:639 __sys_sendto+0x3d7/0x670 net/socket.c:1789 __do_sys_sendto net/socket.c:1801 [inline] __se_sys_sendto net/socket.c:1797 [inline] __x64_sys_sendto+0xe1/0x1a0 net/socket.c:1797 do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff8801b4671ac0 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 224 bytes inside of 512-byte region [ffff8801b4671ac0, ffff8801b4671cc0) The buggy address belongs to the page: page:ffffea0006d19c40 count:1 mapcount:0 mapping:ffff8801b46710c0 index:0x0 flags: 0x2fffc0000000100(slab) raw: 02fffc0000000100 ffff8801b46710c0 0000000000000000 0000000100000006 raw: ffffea0006d19ae0 ffffea00071eab60 ffff8801da800940 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8801b4671a80: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb ffff8801b4671b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8801b4671b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8801b4671c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8801b4671c80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ==================================================================