==================================================================
BUG: KASAN: use-after-free in tcp_probe_timer net/ipv4/tcp_timer.c:384 [inline]
BUG: KASAN: use-after-free in tcp_write_timer_handler+0xb91/0xbc0 net/ipv4/tcp_timer.c:630
Read of size 1 at addr ffff888074c70695 by task swapper/3/0
CPU: 3 PID: 0 Comm: swapper/3 Not tainted 5.19.0-syzkaller-02972-g200e340f2196 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_address_description.constprop.0.cold+0xeb/0x495 mm/kasan/report.c:313
print_report mm/kasan/report.c:429 [inline]
kasan_report.cold+0xf4/0x1c6 mm/kasan/report.c:491
tcp_probe_timer net/ipv4/tcp_timer.c:384 [inline]
tcp_write_timer_handler+0xb91/0xbc0 net/ipv4/tcp_timer.c:630
tcp_write_timer+0xa2/0x2b0 net/ipv4/tcp_timer.c:646
call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1474
expire_timers kernel/time/timer.c:1519 [inline]
__run_timers.part.0+0x679/0xa80 kernel/time/timer.c:1790
__run_timers kernel/time/timer.c:1768 [inline]
run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1803
__do_softirq+0x29b/0x9c2 kernel/softirq.c:571
invoke_softirq kernel/softirq.c:445 [inline]
__irq_exit_rcu+0x123/0x180 kernel/softirq.c:650
irq_exit_rcu+0x5/0x20 kernel/softirq.c:662
sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1106
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:default_idle+0xb/0x10 arch/x86/kernel/process.c:731
Code: ff ff ff 48 89 df e8 d4 a8 4c f8 e9 55 ff ff ff 4c 89 e7 e8 c7 a8 4c f8 eb 96 0f 1f 44 00 00 66 90 0f 00 2d 67 be 4b 00 fb f4 cc cc cc cc 41 55 41 54 55 48 89 fd 53 e8 12 e1 ff f7 e8 5d 10
RSP: 0018:ffffc9000047fe00 EFLAGS: 00000242
RAX: 0000000000459d57 RBX: ffff888012141d80 RCX: ffffffff8977fe45
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: 0000000000000003 R08: 0000000000000001 R09: ffff88802cb34c4b
R10: ffffed1005966989 R11: 0000000000000001 R12: ffffed10024283b0
R13: 0000000000000003 R14: ffffffff8dbc0c10 R15: 0000000000000000
default_idle_call+0x80/0xc0 kernel/sched/idle.c:109
cpuidle_idle_call kernel/sched/idle.c:191 [inline]
do_idle+0x401/0x590 kernel/sched/idle.c:303
cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:400
start_secondary+0x21d/0x2b0 arch/x86/kernel/smpboot.c:266
secondary_startup_64_no_verify+0xce/0xdb
Allocated by task 3712:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track mm/kasan/common.c:45 [inline]
set_alloc_info mm/kasan/common.c:437 [inline]
__kasan_slab_alloc+0x90/0xc0 mm/kasan/common.c:470
kasan_slab_alloc include/linux/kasan.h:224 [inline]
slab_post_alloc_hook mm/slab.h:727 [inline]
slab_alloc_node mm/slub.c:3243 [inline]
slab_alloc mm/slub.c:3251 [inline]
__kmem_cache_alloc_lru mm/slub.c:3258 [inline]
kmem_cache_alloc+0x280/0x4d0 mm/slub.c:3268
kmem_cache_zalloc include/linux/slab.h:723 [inline]
net_alloc net/core/net_namespace.c:403 [inline]
copy_net_ns+0x125/0x760 net/core/net_namespace.c:458
create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110
unshare_nsproxy_namespaces+0xc1/0x1f0 kernel/nsproxy.c:227
ksys_unshare+0x445/0x920 kernel/fork.c:3169
__do_sys_unshare kernel/fork.c:3240 [inline]
__se_sys_unshare kernel/fork.c:3238 [inline]
__ia32_sys_unshare+0x2c/0x40 kernel/fork.c:3238
do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
__do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178
do_fast_syscall_32+0x2f/0x70 arch/x86/entry/common.c:203
entry_SYSENTER_compat_after_hwframe+0x70/0x82
The buggy address belongs to the object at ffff888074c70000
which belongs to the cache net_namespace of size 6784
The buggy address is located 1685 bytes inside of
6784-byte region [ffff888074c70000, ffff888074c71a80)
The buggy address belongs to the physical page:
page:ffffea0001d31c00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888074c75280 pfn:0x74c70
head:ffffea0001d31c00 order:3 compound_mapcount:0 compound_pincount:0
memcg:ffff888076971741
flags: 0x4fff00000010200(slab|head|node=1|zone=1|lastcpupid=0x7ff)
raw: 04fff00000010200 0000000000000000 dead000000000122 ffff8880119f2f00
raw: ffff888074c75280 0000000080040003 00000001ffffffff ffff888076971741
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3712, tgid 3712 (syz-executor.0), ts 236582522150, free_ts 0
prep_new_page mm/page_alloc.c:2457 [inline]
get_page_from_freelist+0x1298/0x3b80 mm/page_alloc.c:4203
__alloc_pages+0x1c7/0x510 mm/page_alloc.c:5431
alloc_pages+0x1aa/0x310 mm/mempolicy.c:2272
alloc_slab_page mm/slub.c:1824 [inline]
allocate_slab+0x26c/0x3c0 mm/slub.c:1969
new_slab mm/slub.c:2029 [inline]
___slab_alloc+0x99f/0xe10 mm/slub.c:3031
__slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3118
slab_alloc_node mm/slub.c:3209 [inline]
slab_alloc mm/slub.c:3251 [inline]
__kmem_cache_alloc_lru mm/slub.c:3258 [inline]
kmem_cache_alloc+0x3e6/0x4d0 mm/slub.c:3268
kmem_cache_zalloc include/linux/slab.h:723 [inline]
net_alloc net/core/net_namespace.c:403 [inline]
copy_net_ns+0x125/0x760 net/core/net_namespace.c:458
create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110
unshare_nsproxy_namespaces+0xc1/0x1f0 kernel/nsproxy.c:227
ksys_unshare+0x445/0x920 kernel/fork.c:3169
__do_sys_unshare kernel/fork.c:3240 [inline]
__se_sys_unshare kernel/fork.c:3238 [inline]
__ia32_sys_unshare+0x2c/0x40 kernel/fork.c:3238
do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
__do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178
do_fast_syscall_32+0x2f/0x70 arch/x86/entry/common.c:203
entry_SYSENTER_compat_after_hwframe+0x70/0x82
page_owner free stack trace missing
Memory state around the buggy address:
ffff888074c70580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888074c70600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888074c70680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888074c70700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888074c70780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess), 3 bytes skipped:
0: 48 89 df mov %rbx,%rdi
3: e8 d4 a8 4c f8 callq 0xf84ca8dc
8: e9 55 ff ff ff jmpq 0xffffff62
d: 4c 89 e7 mov %r12,%rdi
10: e8 c7 a8 4c f8 callq 0xf84ca8dc
15: eb 96 jmp 0xffffffad
17: 0f 1f 44 00 00 nopl 0x0(%rax,%rax,1)
1c: 66 90 xchg %ax,%ax
1e: 0f 00 2d 67 be 4b 00 verw 0x4bbe67(%rip) # 0x4bbe8c
25: fb sti
26: f4 hlt
* 27: c3 retq <-- trapping instruction
28: cc int3
29: cc int3
2a: cc int3
2b: cc int3
2c: 41 55 push %r13
2e: 41 54 push %r12
30: 55 push %rbp
31: 48 89 fd mov %rdi,%rbp
34: 53 push %rbx
35: e8 12 e1 ff f7 callq 0xf7ffe14c
3a: e8 .byte 0xe8
3b: 5d pop %rbp
3c: 10 .byte 0x10