===================================================== BUG: KMSAN: use-after-free in do_slab_free mm/slub.c:3025 [inline] BUG: KMSAN: use-after-free in slab_free mm/slub.c:3048 [inline] BUG: KMSAN: use-after-free in kmem_cache_free+0x3df/0x2b70 mm/slub.c:3063 CPU: 1 PID: 16 Comm: ksoftirqd/1 Not tainted 5.4.0-rc5+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x191/0x1f0 lib/dump_stack.c:113 kmsan_report+0x128/0x220 mm/kmsan/kmsan_report.c:108 __msan_warning+0x73/0xe0 mm/kmsan/kmsan_instr.c:245 do_slab_free mm/slub.c:3025 [inline] slab_free mm/slub.c:3048 [inline] kmem_cache_free+0x3df/0x2b70 mm/slub.c:3063 kfree_skbmem net/core/skbuff.c:644 [inline] __kfree_skb net/core/skbuff.c:680 [inline] kfree_skb+0x473/0x4c0 net/core/skbuff.c:697 packet_rcv_spkt+0x68d/0x7c0 net/packet/af_packet.c:1847 deliver_skb net/core/dev.c:1969 [inline] deliver_ptype_list_skb net/core/dev.c:1984 [inline] __netif_receive_skb_core+0x3aed/0x51a0 net/core/dev.c:4968 __netif_receive_skb_one_core net/core/dev.c:5008 [inline] __netif_receive_skb net/core/dev.c:5124 [inline] netif_receive_skb_internal+0x3cc/0xc20 net/core/dev.c:5214 napi_skb_finish net/core/dev.c:5677 [inline] napi_gro_receive+0x67f/0xbb0 net/core/dev.c:5710 receive_buf+0x653b/0x8810 drivers/net/virtio_net.c:1061 virtnet_receive drivers/net/virtio_net.c:1323 [inline] virtnet_poll+0x666/0x1a10 drivers/net/virtio_net.c:1428 napi_poll net/core/dev.c:6392 [inline] net_rx_action+0x7a6/0x1aa0 net/core/dev.c:6460 __do_softirq+0x4a1/0x83a kernel/softirq.c:293 run_ksoftirqd+0x25/0x40 kernel/softirq.c:607 smpboot_thread_fn+0x4a3/0x990 kernel/smpboot.c:165 kthread+0x4b5/0x4f0 kernel/kthread.c:256 ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:355 Uninit was stored to memory at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:151 [inline] kmsan_internal_chain_origin+0xbd/0x180 mm/kmsan/kmsan.c:319 __msan_chain_origin+0x6b/0xd0 mm/kmsan/kmsan_instr.c:179 ___slab_alloc+0x1dbc/0x1fb0 mm/slub.c:2636 __slab_alloc mm/slub.c:2689 [inline] slab_alloc_node mm/slub.c:2763 [inline] slab_alloc mm/slub.c:2808 [inline] kmem_cache_alloc+0xadf/0xd20 mm/slub.c:2813 skb_clone+0x326/0x5d0 net/core/skbuff.c:1448 skb_share_check include/linux/skbuff.h:1670 [inline] packet_rcv_spkt+0x23f/0x7c0 net/packet/af_packet.c:1816 deliver_skb net/core/dev.c:1969 [inline] deliver_ptype_list_skb net/core/dev.c:1984 [inline] __netif_receive_skb_core+0x3aed/0x51a0 net/core/dev.c:4968 __netif_receive_skb_one_core net/core/dev.c:5008 [inline] __netif_receive_skb net/core/dev.c:5124 [inline] netif_receive_skb_internal+0x3cc/0xc20 net/core/dev.c:5214 napi_skb_finish net/core/dev.c:5677 [inline] napi_gro_receive+0x67f/0xbb0 net/core/dev.c:5710 receive_buf+0x653b/0x8810 drivers/net/virtio_net.c:1061 virtnet_receive drivers/net/virtio_net.c:1323 [inline] virtnet_poll+0x666/0x1a10 drivers/net/virtio_net.c:1428 napi_poll net/core/dev.c:6392 [inline] net_rx_action+0x7a6/0x1aa0 net/core/dev.c:6460 __do_softirq+0x4a1/0x83a kernel/softirq.c:293 run_ksoftirqd+0x25/0x40 kernel/softirq.c:607 smpboot_thread_fn+0x4a3/0x990 kernel/smpboot.c:165 kthread+0x4b5/0x4f0 kernel/kthread.c:256 ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:355 Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:151 [inline] kmsan_internal_poison_shadow+0x60/0x120 mm/kmsan/kmsan.c:134 kmsan_slab_free+0x8d/0xf0 mm/kmsan/kmsan_hooks.c:108 slab_free_freelist_hook mm/slub.c:1473 [inline] slab_free mm/slub.c:3047 [inline] kmem_cache_free_bulk+0x3ad9/0x3f10 mm/slub.c:3172 __kfree_skb_flush+0xb0/0x100 net/core/skbuff.c:862 net_rx_action+0x1a5e/0x1aa0 net/core/dev.c:6483 __do_softirq+0x4a1/0x83a kernel/softirq.c:293 run_ksoftirqd+0x25/0x40 kernel/softirq.c:607 smpboot_thread_fn+0x4a3/0x990 kernel/smpboot.c:165 kthread+0x4b5/0x4f0 kernel/kthread.c:256 ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:355 =====================================================