================================================================== BUG: KASAN: use-after-free in eth_header_parse_protocol+0xad/0xd0 net/ethernet/eth.c:282 Read of size 2 at addr ffff8881e8e0000b by task syz-executor915/338 CPU: 1 PID: 338 Comm: syz-executor915 Not tainted 5.4.106-syzkaller-00698-g3941336d0e38 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1d8/0x24e lib/dump_stack.c:118 print_address_description+0x9b/0x650 mm/kasan/report.c:384 __kasan_report+0x182/0x260 mm/kasan/report.c:516 kasan_report+0x30/0x60 mm/kasan/common.c:641 eth_header_parse_protocol+0xad/0xd0 net/ethernet/eth.c:282 dev_parse_header_protocol include/linux/netdevice.h:2984 [inline] virtio_net_hdr_to_skb+0x6de/0xd70 include/linux/virtio_net.h:83 packet_snd net/packet/af_packet.c:2976 [inline] packet_sendmsg+0x483a/0x6780 net/packet/af_packet.c:3013 sock_sendmsg_nosec net/socket.c:638 [inline] sock_sendmsg net/socket.c:658 [inline] __sys_sendto+0x4f1/0x6c0 net/socket.c:1953 __do_sys_sendto net/socket.c:1965 [inline] __se_sys_sendto net/socket.c:1961 [inline] __x64_sys_sendto+0xda/0xf0 net/socket.c:1961 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Code: 28 c3 e8 4a 15 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RAX: ffffffffffffffda RBX: 00007ffdd88701e8 RCX: 0000000000443229 RDX: 0000000000000040 RSI: 0000000020000140 RDI: 0000000000000003 RBP: 0000000000000003 R08: 0000000020000100 R09: 0000000000000014 R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdd88701f0 R13: 00007ffdd8870210 R14: 00000000004b8018 R15: 00000000004004b8 Allocated by task 338: save_stack mm/kasan/common.c:70 [inline] set_track mm/kasan/common.c:78 [inline] __kasan_kmalloc+0x137/0x1e0 mm/kasan/common.c:517 sk_prot_alloc+0x58/0x260 net/core/sock.c:1594 sk_alloc+0x30/0x330 net/core/sock.c:1654 unix_create1+0x8e/0x530 net/unix/af_unix.c:779 unix_create+0x129/0x1b0 net/unix/af_unix.c:840 __sock_create+0x393/0x730 net/socket.c:1419 sock_create net/socket.c:1470 [inline] __sys_socket+0x133/0x370 net/socket.c:1512 __do_sys_socket net/socket.c:1521 [inline] __se_sys_socket net/socket.c:1519 [inline] __x64_sys_socket+0x76/0x80 net/socket.c:1519 do_syscall_64+0xcb/0x1e0 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Freed by task 338: save_stack mm/kasan/common.c:70 [inline] set_track mm/kasan/common.c:78 [inline] kasan_set_free_info mm/kasan/common.c:333 [inline] __kasan_slab_free+0x18a/0x240 mm/kasan/common.c:475 slab_free_hook mm/slub.c:1454 [inline] slab_free_freelist_hook+0x7b/0x150 mm/slub.c:1492 slab_free mm/slub.c:3072 [inline] kmem_cache_free+0xb8/0x5f0 mm/slub.c:3088 sk_prot_free net/core/sock.c:1635 [inline] __sk_destruct+0x418/0x4b0 net/core/sock.c:1722 sock_put include/net/sock.h:1749 [inline] unix_release_sock+0x8b2/0xa30 net/unix/af_unix.c:576 unix_release+0x4a/0x80 net/unix/af_unix.c:850 __sock_release net/socket.c:591 [inline] sock_close+0xd2/0x250 net/socket.c:1269 __fput+0x27d/0x6c0 fs/file_table.c:281 task_work_run+0x186/0x1b0 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_usermode_loop arch/x86/entry/common.c:163 [inline] prepare_exit_to_usermode+0x2b0/0x310 arch/x86/entry/common.c:194 entry_SYSCALL_64_after_hwframe+0x44/0xa9 The buggy address belongs to the object at ffff8881e8e00000 which belongs to the cache UNIX of size 1152 The buggy address is located 11 bytes inside of 1152-byte region [ffff8881e8e00000, ffff8881e8e00480) The buggy address belongs to the page: page:ffffea0007a38000 refcount:1 mapcount:0 mapping:ffff8881f40dfb80 index:0x0 compound_mapcount: 0 flags: 0x8000000000010200(slab|head) raw: 8000000000010200 dead000000000100 dead000000000122 ffff8881f40dfb80 raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8881e8dfff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8881e8dfff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff8881e8e00000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb