Process accounting resumed 9pnet: p9_fd_create_tcp (13617): problem connecting socket to 127.0.0.1 9pnet: p9_fd_create_tcp (13616): problem connecting socket to 127.0.0.1 Process accounting resumed ====================================================== WARNING: possible circular locking dependency detected 4.14.288-syzkaller #0 Not tainted ------------------------------------------------------ kworker/0:1/24 is trying to acquire lock: (&sb->s_type->i_mutex_key#26){++++}, at: [] inode_lock include/linux/fs.h:719 [inline] (&sb->s_type->i_mutex_key#26){++++}, at: [] __generic_file_fsync+0x9e/0x190 fs/libfs.c:989 but task is already holding lock: ((&dio->complete_work)){+.+.}, at: [] process_one_work+0x6e6/0x14a0 kernel/workqueue.c:2092 which lock already depends on the new lock. the existing dependency chain (in reverse order) is: -> #2 ((&dio->complete_work)){+.+.}: process_one_work+0x736/0x14a0 kernel/workqueue.c:2093 worker_thread+0x5cc/0xff0 kernel/workqueue.c:2251 kthread+0x30d/0x420 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 -> #1 ("dio/%s"sb->s_id){+.+.}: flush_workqueue+0xfa/0x1310 kernel/workqueue.c:2625 drain_workqueue+0x177/0x3e0 kernel/workqueue.c:2790 destroy_workqueue+0x71/0x710 kernel/workqueue.c:4116 __alloc_workqueue_key+0xd50/0x1080 kernel/workqueue.c:4093 sb_init_dio_done_wq+0x34/0x80 fs/direct-io.c:624 do_blockdev_direct_IO fs/direct-io.c:1287 [inline] __blockdev_direct_IO+0x3df1/0xdcb0 fs/direct-io.c:1423 blockdev_direct_IO include/linux/fs.h:2994 [inline] fat_direct_IO+0x19b/0x320 fs/fat/inode.c:275 generic_file_direct_write+0x1df/0x420 mm/filemap.c:2958 __generic_file_write_iter+0x2a2/0x590 mm/filemap.c:3137 generic_file_write_iter+0x36f/0x650 mm/filemap.c:3208 call_write_iter include/linux/fs.h:1780 [inline] aio_write+0x2ed/0x560 fs/aio.c:1553 io_submit_one fs/aio.c:1641 [inline] do_io_submit+0x847/0x1570 fs/aio.c:1709 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb -> #0 (&sb->s_type->i_mutex_key#26){++++}: lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 down_write+0x34/0x90 kernel/locking/rwsem.c:54 inode_lock include/linux/fs.h:719 [inline] __generic_file_fsync+0x9e/0x190 fs/libfs.c:989 fat_file_fsync+0x73/0x1f0 fs/fat/file.c:165 vfs_fsync_range+0x103/0x260 fs/sync.c:196 generic_write_sync include/linux/fs.h:2684 [inline] dio_complete+0x561/0x8d0 fs/direct-io.c:330 process_one_work+0x793/0x14a0 kernel/workqueue.c:2117 worker_thread+0x5cc/0xff0 kernel/workqueue.c:2251 kthread+0x30d/0x420 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 other info that might help us debug this: Chain exists of: &sb->s_type->i_mutex_key#26 --> "dio/%s"sb->s_id --> (&dio->complete_work) Possible unsafe locking scenario: CPU0 CPU1 ---- ---- lock((&dio->complete_work)); lock("dio/%s"sb->s_id); lock((&dio->complete_work)); lock(&sb->s_type->i_mutex_key#26); *** DEADLOCK *** 2 locks held by kworker/0:1/24: #0: ("dio/%s"sb->s_id){+.+.}, at: [] process_one_work+0x6b0/0x14a0 kernel/workqueue.c:2088 #1: ((&dio->complete_work)){+.+.}, at: [] process_one_work+0x6e6/0x14a0 kernel/workqueue.c:2092 stack backtrace: CPU: 0 PID: 24 Comm: kworker/0:1 Not tainted 4.14.288-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 Workqueue: dio/loop2 dio_aio_complete_work Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x281 lib/dump_stack.c:58 print_circular_bug.constprop.0.cold+0x2d7/0x41e kernel/locking/lockdep.c:1258 check_prev_add kernel/locking/lockdep.c:1905 [inline] check_prevs_add kernel/locking/lockdep.c:2022 [inline] validate_chain kernel/locking/lockdep.c:2464 [inline] __lock_acquire+0x2e0e/0x3f20 kernel/locking/lockdep.c:3491 lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 down_write+0x34/0x90 kernel/locking/rwsem.c:54 inode_lock include/linux/fs.h:719 [inline] __generic_file_fsync+0x9e/0x190 fs/libfs.c:989 fat_file_fsync+0x73/0x1f0 fs/fat/file.c:165 vfs_fsync_range+0x103/0x260 fs/sync.c:196 generic_write_sync include/linux/fs.h:2684 [inline] dio_complete+0x561/0x8d0 fs/direct-io.c:330 process_one_work+0x793/0x14a0 kernel/workqueue.c:2117 worker_thread+0x5cc/0xff0 kernel/workqueue.c:2251 kthread+0x30d/0x420 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 attempt to access beyond end of device loop2: rw=1, want=18616, limit=16256 attempt to access beyond end of device loop2: rw=1, want=22712, limit=16256 attempt to access beyond end of device loop2: rw=1, want=26808, limit=16256 attempt to access beyond end of device 9pnet: p9_fd_create_tcp (13642): problem connecting socket to 127.0.0.1 loop2: rw=1, want=30904, limit=16256 attempt to access beyond end of device loop2: rw=1, want=32896, limit=16256 nla_parse: 3 callbacks suppressed netlink: 140 bytes leftover after parsing attributes in process `syz-executor.3'. netlink: 140 bytes leftover after parsing attributes in process `syz-executor.3'. 9pnet: p9_fd_create_tcp (13679): problem connecting socket to 127.0.0.1 Process accounting resumed Process accounting resumed 9pnet: p9_fd_create_tcp (13642): problem connecting socket to 127.0.0.1 Process accounting resumed attempt to access beyond end of device loop2: rw=1, want=18616, limit=16256 attempt to access beyond end of device loop2: rw=1, want=22712, limit=16256 attempt to access beyond end of device loop2: rw=1, want=26808, limit=16256 attempt to access beyond end of device loop2: rw=1, want=30904, limit=16256 attempt to access beyond end of device loop2: rw=1, want=32896, limit=16256 9pnet: p9_fd_create_tcp (13679): problem connecting socket to 127.0.0.1 Process accounting resumed netlink: 140 bytes leftover after parsing attributes in process `syz-executor.4'. netlink: 140 bytes leftover after parsing attributes in process `syz-executor.3'. FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 0 PID: 13740 Comm: syz-executor.1 Not tainted 4.14.288-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x281 lib/dump_stack.c:58 fail_dump lib/fault-inject.c:51 [inline] should_fail.cold+0x10a/0x149 lib/fault-inject.c:149 should_failslab+0xd6/0x130 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc_node mm/slab.c:3297 [inline] kmem_cache_alloc_node+0x263/0x410 mm/slab.c:3640 __alloc_skb+0x5c/0x510 net/core/skbuff.c:193 alloc_skb include/linux/skbuff.h:980 [inline] netlink_alloc_large_skb net/netlink/af_netlink.c:1168 [inline] netlink_sendmsg+0x91e/0xbc0 net/netlink/af_netlink.c:1868 sock_sendmsg_nosec net/socket.c:646 [inline] sock_sendmsg+0xb5/0x100 net/socket.c:656 ___sys_sendmsg+0x6c8/0x800 net/socket.c:2062 netlink: 140 bytes leftover after parsing attributes in process `syz-executor.4'. __sys_sendmsg+0xa3/0x120 net/socket.c:2096 SYSC_sendmsg net/socket.c:2107 [inline] SyS_sendmsg+0x27/0x40 net/socket.c:2103 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7f97263e5109 RSP: 002b:00007f9724d5a168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f97264f7f60 RCX: 00007f97263e5109 RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000003 RBP: 00007f9724d5a1d0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007ffc0614e3bf R14: 00007f9724d5a300 R15: 0000000000022000 netlink: 140 bytes leftover after parsing attributes in process `syz-executor.3'. netlink: 140 bytes leftover after parsing attributes in process `syz-executor.3'. netlink: 140 bytes leftover after parsing attributes in process `syz-executor.4'. netlink: 140 bytes leftover after parsing attributes in process `syz-executor.3'. FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 netlink: 140 bytes leftover after parsing attributes in process `syz-executor.3'. CPU: 0 PID: 13793 Comm: syz-executor.1 Not tainted 4.14.288-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x281 lib/dump_stack.c:58 fail_dump lib/fault-inject.c:51 [inline] should_fail.cold+0x10a/0x149 lib/fault-inject.c:149 should_failslab+0xd6/0x130 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc_node mm/slab.c:3297 [inline] kmem_cache_alloc_node_trace+0x25a/0x400 mm/slab.c:3659 __do_kmalloc_node mm/slab.c:3681 [inline] __kmalloc_node_track_caller+0x38/0x70 mm/slab.c:3696 __kmalloc_reserve net/core/skbuff.c:137 [inline] __alloc_skb+0x96/0x510 net/core/skbuff.c:205 alloc_skb include/linux/skbuff.h:980 [inline] netlink_alloc_large_skb net/netlink/af_netlink.c:1168 [inline] netlink_sendmsg+0x91e/0xbc0 net/netlink/af_netlink.c:1868 sock_sendmsg_nosec net/socket.c:646 [inline] sock_sendmsg+0xb5/0x100 net/socket.c:656 ___sys_sendmsg+0x6c8/0x800 net/socket.c:2062 __sys_sendmsg+0xa3/0x120 net/socket.c:2096 SYSC_sendmsg net/socket.c:2107 [inline] SyS_sendmsg+0x27/0x40 net/socket.c:2103 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7f97263e5109 RSP: 002b:00007f9724d5a168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f97264f7f60 RCX: 00007f97263e5109 RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000003 RBP: 00007f9724d5a1d0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007ffc0614e3bf R14: 00007f9724d5a300 R15: 0000000000022000 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 PID: 13866 Comm: syz-executor.1 Not tainted 4.14.288-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x281 lib/dump_stack.c:58 fail_dump lib/fault-inject.c:51 [inline] should_fail.cold+0x10a/0x149 lib/fault-inject.c:149 should_failslab+0xd6/0x130 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc mm/slab.c:3376 [inline] kmem_cache_alloc+0x40/0x3c0 mm/slab.c:3550 skb_clone+0x126/0x9a0 net/core/skbuff.c:1291 __netlink_deliver_tap_skb net/netlink/af_netlink.c:268 [inline] __netlink_deliver_tap net/netlink/af_netlink.c:293 [inline] netlink_deliver_tap+0x67e/0x860 net/netlink/af_netlink.c:304 netlink_deliver_tap_kernel net/netlink/af_netlink.c:313 [inline] netlink_unicast_kernel net/netlink/af_netlink.c:1295 [inline] netlink_unicast+0x485/0x610 net/netlink/af_netlink.c:1322 netlink_sendmsg+0x648/0xbc0 net/netlink/af_netlink.c:1893 sock_sendmsg_nosec net/socket.c:646 [inline] sock_sendmsg+0xb5/0x100 net/socket.c:656 ___sys_sendmsg+0x6c8/0x800 net/socket.c:2062 __sys_sendmsg+0xa3/0x120 net/socket.c:2096 SYSC_sendmsg net/socket.c:2107 [inline] SyS_sendmsg+0x27/0x40 net/socket.c:2103 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7f97263e5109 RSP: 002b:00007f9724d5a168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f97264f7f60 RCX: 00007f97263e5109 RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000003 RBP: 00007f9724d5a1d0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007ffc0614e3bf R14: 00007f9724d5a300 R15: 0000000000022000 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 0 PID: 13917 Comm: syz-executor.1 Not tainted 4.14.288-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x281 lib/dump_stack.c:58 fail_dump lib/fault-inject.c:51 [inline] should_fail.cold+0x10a/0x149 lib/fault-inject.c:149 should_failslab+0xd6/0x130 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc mm/slab.c:3376 [inline] kmem_cache_alloc_trace+0x47/0x3d0 mm/slab.c:3616 kmalloc include/linux/slab.h:488 [inline] kzalloc include/linux/slab.h:661 [inline] xfrm_state_alloc+0x44/0x5a0 net/xfrm/xfrm_state.c:568 xfrm_state_construct net/xfrm/xfrm_user.c:561 [inline] xfrm_add_sa+0xb47/0x2f30 net/xfrm/xfrm_user.c:667 xfrm_user_rcv_msg+0x37d/0x5f0 net/xfrm/xfrm_user.c:2619 netlink_rcv_skb+0x125/0x390 net/netlink/af_netlink.c:2454 xfrm_netlink_rcv+0x6b/0x90 net/xfrm/xfrm_user.c:2627 netlink_unicast_kernel net/netlink/af_netlink.c:1296 [inline] netlink_unicast+0x437/0x610 net/netlink/af_netlink.c:1322 netlink_sendmsg+0x648/0xbc0 net/netlink/af_netlink.c:1893 sock_sendmsg_nosec net/socket.c:646 [inline] sock_sendmsg+0xb5/0x100 net/socket.c:656 ___sys_sendmsg+0x6c8/0x800 net/socket.c:2062 __sys_sendmsg+0xa3/0x120 net/socket.c:2096 SYSC_sendmsg net/socket.c:2107 [inline] SyS_sendmsg+0x27/0x40 net/socket.c:2103 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7f97263e5109 RSP: 002b:00007f9724d5a168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f97264f7f60 RCX: 00007f97263e5109 RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000003 RBP: 00007f9724d5a1d0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007ffc0614e3bf R14: 00007f9724d5a300 R15: 0000000000022000 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 PID: 13962 Comm: syz-executor.1 Not tainted 4.14.288-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x281 lib/dump_stack.c:58 fail_dump lib/fault-inject.c:51 [inline] should_fail.cold+0x10a/0x149 lib/fault-inject.c:149 should_failslab+0xd6/0x130 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc_node mm/slab.c:3297 [inline] kmem_cache_alloc_node+0x263/0x410 mm/slab.c:3640 __alloc_skb+0x5c/0x510 net/core/skbuff.c:193 alloc_skb include/linux/skbuff.h:980 [inline] nlmsg_new include/net/netlink.h:511 [inline] netlink_ack+0x216/0x9a0 net/netlink/af_netlink.c:2381 netlink_rcv_skb+0x2c5/0x390 net/netlink/af_netlink.c:2460 xfrm_netlink_rcv+0x6b/0x90 net/xfrm/xfrm_user.c:2627 netlink_unicast_kernel net/netlink/af_netlink.c:1296 [inline] netlink_unicast+0x437/0x610 net/netlink/af_netlink.c:1322 netlink_sendmsg+0x648/0xbc0 net/netlink/af_netlink.c:1893 sock_sendmsg_nosec net/socket.c:646 [inline] sock_sendmsg+0xb5/0x100 net/socket.c:656 ___sys_sendmsg+0x6c8/0x800 net/socket.c:2062 __sys_sendmsg+0xa3/0x120 net/socket.c:2096 SYSC_sendmsg net/socket.c:2107 [inline] SyS_sendmsg+0x27/0x40 net/socket.c:2103 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7f97263e5109 RSP: 002b:00007f9724d5a168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f97264f7f60 RCX: 00007f97263e5109 RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000003 RBP: 00007f9724d5a1d0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007ffc0614e3bf R14: 00007f9724d5a300 R15: 0000000000022000 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 0 PID: 14009 Comm: syz-executor.1 Not tainted 4.14.288-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x281 lib/dump_stack.c:58 fail_dump lib/fault-inject.c:51 [inline] should_fail.cold+0x10a/0x149 lib/fault-inject.c:149 should_failslab+0xd6/0x130 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc_node mm/slab.c:3297 [inline] kmem_cache_alloc_node_trace+0x25a/0x400 mm/slab.c:3659 __do_kmalloc_node mm/slab.c:3681 [inline] __kmalloc_node_track_caller+0x38/0x70 mm/slab.c:3696 __kmalloc_reserve net/core/skbuff.c:137 [inline] __alloc_skb+0x96/0x510 net/core/skbuff.c:205 alloc_skb include/linux/skbuff.h:980 [inline] nlmsg_new include/net/netlink.h:511 [inline] netlink_ack+0x216/0x9a0 net/netlink/af_netlink.c:2381 netlink_rcv_skb+0x2c5/0x390 net/netlink/af_netlink.c:2460 xfrm_netlink_rcv+0x6b/0x90 net/xfrm/xfrm_user.c:2627 netlink_unicast_kernel net/netlink/af_netlink.c:1296 [inline] netlink_unicast+0x437/0x610 net/netlink/af_netlink.c:1322 netlink_sendmsg+0x648/0xbc0 net/netlink/af_netlink.c:1893 sock_sendmsg_nosec net/socket.c:646 [inline] sock_sendmsg+0xb5/0x100 net/socket.c:656 ___sys_sendmsg+0x6c8/0x800 net/socket.c:2062 __sys_sendmsg+0xa3/0x120 net/socket.c:2096 SYSC_sendmsg net/socket.c:2107 [inline] SyS_sendmsg+0x27/0x40 net/socket.c:2103 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7f97263e5109 RSP: 002b:00007f9724d5a168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f97264f7f60 RCX: 00007f97263e5109 RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000003 RBP: 00007f9724d5a1d0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007ffc0614e3bf R14: 00007f9724d5a300 R15: 0000000000022000 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 1 PID: 14060 Comm: syz-executor.1 Not tainted 4.14.288-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x281 lib/dump_stack.c:58 fail_dump lib/fault-inject.c:51 [inline] should_fail.cold+0x10a/0x149 lib/fault-inject.c:149 should_failslab+0xd6/0x130 mm/failslab.c:32 slab_pre_alloc_hook mm/slab.h:421 [inline] slab_alloc mm/slab.c:3376 [inline] kmem_cache_alloc+0x40/0x3c0 mm/slab.c:3550 skb_clone+0x126/0x9a0 net/core/skbuff.c:1291 __netlink_deliver_tap_skb net/netlink/af_netlink.c:268 [inline] __netlink_deliver_tap net/netlink/af_netlink.c:293 [inline] netlink_deliver_tap+0x67e/0x860 net/netlink/af_netlink.c:304 __netlink_sendskb net/netlink/af_netlink.c:1240 [inline] netlink_sendskb+0x45/0xd0 net/netlink/af_netlink.c:1249 netlink_unicast+0x50a/0x610 net/netlink/af_netlink.c:1337 netlink_ack+0x514/0x9a0 net/netlink/af_netlink.c:2424 netlink_rcv_skb+0x2c5/0x390 net/netlink/af_netlink.c:2460 xfrm_netlink_rcv+0x6b/0x90 net/xfrm/xfrm_user.c:2627 netlink_unicast_kernel net/netlink/af_netlink.c:1296 [inline] netlink_unicast+0x437/0x610 net/netlink/af_netlink.c:1322 netlink_sendmsg+0x648/0xbc0 net/netlink/af_netlink.c:1893 sock_sendmsg_nosec net/socket.c:646 [inline] sock_sendmsg+0xb5/0x100 net/socket.c:656 ___sys_sendmsg+0x6c8/0x800 net/socket.c:2062 __sys_sendmsg+0xa3/0x120 net/socket.c:2096 SYSC_sendmsg net/socket.c:2107 [inline] SyS_sendmsg+0x27/0x40 net/socket.c:2103 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7f97263e5109 RSP: 002b:00007f9724d5a168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f97264f7f60 RCX: 00007f97263e5109 RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000003 RBP: 00007f9724d5a1d0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 R13: 00007ffc0614e3bf R14: 00007f9724d5a300 R15: 0000000000022000 print_req_error: 253 callbacks suppressed print_req_error: I/O error, dev loop7, sector 0 buffer_io_error: 249 callbacks suppressed Buffer I/O error on dev loop7, logical block 0, lost async page write print_req_error: I/O error, dev loop7, sector 4 Buffer I/O error on dev loop7, logical block 1, lost async page write print_req_error: I/O error, dev loop7, sector 8 Buffer I/O error on dev loop7, logical block 2, lost async page write print_req_error: I/O error, dev loop7, sector 12 Buffer I/O error on dev loop7, logical block 3, lost async page write print_req_error: I/O error, dev loop7, sector 16 Buffer I/O error on dev loop7, logical block 4, lost async page write print_req_error: I/O error, dev loop7, sector 20 Buffer I/O error on dev loop7, logical block 5, lost async page write print_req_error: I/O error, dev loop7, sector 24 Buffer I/O error on dev loop7, logical block 6, lost async page write print_req_error: I/O error, dev loop7, sector 28 Buffer I/O error on dev loop7, logical block 7, lost async page write print_req_error: I/O error, dev loop7, sector 32 print_req_error: I/O error, dev loop7, sector 36 Buffer I/O error on dev loop7, logical block 8, lost async page write Buffer I/O error on dev loop7, logical block 9, lost async page write nla_parse: 4 callbacks suppressed netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. netlink: 24 bytes leftover after parsing attributes in process `syz-executor.3'. netlink: 12 bytes leftover after parsing attributes in process `syz-executor.3'. ================================================================== BUG: KASAN: slab-out-of-bounds in tipc_nametbl_lookup_dst_nodes+0x44c/0x4c0 net/tipc/name_table.c:670 Read of size 4 at addr ffff8880afe7c3d0 by task syz-executor.2/14673 CPU: 0 PID: 14673 Comm: syz-executor.2 Not tainted 4.14.288-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/29/2022 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x281 lib/dump_stack.c:58 print_address_description.cold+0x54/0x1d3 mm/kasan/report.c:252 kasan_report_error.cold+0x8a/0x191 mm/kasan/report.c:351 kasan_report mm/kasan/report.c:409 [inline] __asan_report_load4_noabort+0x68/0x70 mm/kasan/report.c:429 IPVS: ftp: loaded support on port[0] = 21 tipc_nametbl_lookup_dst_nodes+0x44c/0x4c0 net/tipc/name_table.c:670 tipc_sendmcast+0x51a/0xac0 net/tipc/socket.c:767 __tipc_sendmsg+0xbab/0xf90 net/tipc/socket.c:974 tipc_sendmsg+0x4c/0x70 net/tipc/socket.c:922 sock_sendmsg_nosec net/socket.c:646 [inline] sock_sendmsg+0xb5/0x100 net/socket.c:656 ___sys_sendmsg+0x6c8/0x800 net/socket.c:2062 __sys_sendmsg+0xa3/0x120 net/socket.c:2096 SYSC_sendmsg net/socket.c:2107 [inline] SyS_sendmsg+0x27/0x40 net/socket.c:2103 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb RIP: 0033:0x7f44c3639109 RSP: 002b:00007f44c1fae168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f44c374bf60 RCX: 00007f44c3639109 RDX: 0000000000000000 RSI: 0000000020002040 RDI: 0000000000000003 RBP: 00007f44c36930ed R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fffcfd54a7f R14: 00007f44c1fae300 R15: 0000000000022000 Allocated by task 7969: save_stack mm/kasan/kasan.c:447 [inline] set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:551 __do_kmalloc mm/slab.c:3720 [inline] __kmalloc+0x15a/0x400 mm/slab.c:3729 tipc_nameseq_create+0x53/0x290 net/tipc/name_table.c:152 tipc_nametbl_insert_publ+0xb37/0x14e0 net/tipc/name_table.c:476 tipc_nametbl_publish+0x211/0x3f0 net/tipc/name_table.c:701 tipc_sk_publish net/tipc/socket.c:2205 [inline] tipc_bind+0x2c4/0x600 net/tipc/socket.c:629 tipc_create_listen_sock net/tipc/server.c:338 [inline] tipc_open_listening_sock net/tipc/server.c:396 [inline] tipc_server_start+0x31f/0x880 net/tipc/server.c:611 tipc_topsrv_start net/tipc/subscr.c:382 [inline] tipc_topsrv_init_net+0x53b/0x730 net/tipc/subscr.c:397 ops_init+0xaa/0x3e0 net/core/net_namespace.c:118 setup_net+0x22f/0x530 net/core/net_namespace.c:298 copy_net_ns+0x19b/0x440 net/core/net_namespace.c:422 create_new_namespaces+0x375/0x720 kernel/nsproxy.c:107 unshare_nsproxy_namespaces+0xa1/0x1d0 kernel/nsproxy.c:206 SYSC_unshare kernel/fork.c:2413 [inline] SyS_unshare+0x308/0x7f0 kernel/fork.c:2363 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb Freed by task 4628: save_stack mm/kasan/kasan.c:447 [inline] set_track mm/kasan/kasan.c:459 [inline] kasan_slab_free+0xc3/0x1a0 mm/kasan/kasan.c:524 __cache_free mm/slab.c:3496 [inline] kfree+0xc9/0x250 mm/slab.c:3815 kobject_uevent_env+0x26c/0xf30 lib/kobject_uevent.c:537 kobject_synth_uevent+0x5b6/0x6d0 lib/kobject_uevent.c:205 uevent_store+0x3c/0x80 drivers/base/bus.c:621 drv_attr_store+0x6d/0xa0 drivers/base/bus.c:78 sysfs_kf_write+0x106/0x160 fs/sysfs/file.c:142 kernfs_fop_write+0x289/0x440 fs/kernfs/file.c:316 __vfs_write+0xe4/0x630 fs/read_write.c:480 vfs_write+0x17f/0x4d0 fs/read_write.c:544 SYSC_write fs/read_write.c:590 [inline] SyS_write+0xf2/0x210 fs/read_write.c:582 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x46/0xbb The buggy address belongs to the object at ffff8880afe7c3c0 which belongs to the cache kmalloc-32 of size 32 The buggy address is located 16 bytes inside of 32-byte region [ffff8880afe7c3c0, ffff8880afe7c3e0) The buggy address belongs to the page: page:ffffea0002bf9f00 count:1 mapcount:0 mapping:ffff8880afe7c000 index:0xffff8880afe7cfc1 flags: 0xfff00000000100(slab) raw: 00fff00000000100 ffff8880afe7c000 ffff8880afe7cfc1 000000010000003e raw: ffffea0002cb56a0 ffffea0002a992a0 ffff88813fe741c0 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880afe7c280: 00 00 fc fc fc fc fc fc fb fb fb fb fc fc fc fc ffff8880afe7c300: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc >ffff8880afe7c380: 00 01 fc fc fc fc fc fc 00 00 fc fc fc fc fc fc ^ ffff8880afe7c400: fb fb fb fb fc fc fc fc 05 fc fc fc fc fc fc fc ffff8880afe7c480: fb fb fb fb fc fc fc fc 05 fc fc fc fc fc fc fc ==================================================================