================================================================== BUG: KASAN: use-after-free in do_csum+0x2db/0x2e0 lib/checksum.c:73 Read of size 4 at addr ffff88805d440000 by task ksoftirqd/0/15 CPU: 0 PID: 15 Comm: ksoftirqd/0 Not tainted 6.1.0-syzkaller-04256-g609d3bc62305 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:306 [inline] print_report+0x15e/0x45d mm/kasan/report.c:417 kasan_report+0xbf/0x1f0 mm/kasan/report.c:517 do_csum+0x2db/0x2e0 lib/checksum.c:73 csum_partial+0x24/0x60 lib/checksum.c:128 __skb_checksum+0x4b6/0x890 net/core/skbuff.c:3094 skb_checksum net/core/skbuff.c:3146 [inline] __skb_checksum_complete+0xaf/0x3e0 net/core/skbuff.c:3268 __skb_checksum_validate_complete include/linux/skbuff.h:4436 [inline] icmp_rcv+0x55f/0x1030 net/ipv4/icmp.c:1205 ip_protocol_deliver_rcu+0x9f/0x460 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x2ec/0x4c0 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:302 [inline] NF_HOOK include/linux/netfilter.h:296 [inline] ip_local_deliver+0x1ae/0x200 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:454 [inline] ip_rcv_finish+0x1cf/0x2f0 net/ipv4/ip_input.c:449 NF_HOOK include/linux/netfilter.h:302 [inline] NF_HOOK include/linux/netfilter.h:296 [inline] ip_rcv+0xae/0xd0 net/ipv4/ip_input.c:569 __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5482 __netif_receive_skb+0x1f/0x1c0 net/core/dev.c:5596 process_backlog+0x3e4/0x810 net/core/dev.c:5924 __napi_poll+0xb8/0x770 net/core/dev.c:6485 napi_poll net/core/dev.c:6552 [inline] net_rx_action+0xa00/0xde0 net/core/dev.c:6663 __do_softirq+0x1fb/0xadc kernel/softirq.c:571 run_ksoftirqd kernel/softirq.c:934 [inline] run_ksoftirqd+0x31/0x60 kernel/softirq.c:926 smpboot_thread_fn+0x659/0xa20 kernel/smpboot.c:164 kthread+0x2e8/0x3a0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:308 The buggy address belongs to the physical page: page:ffffea0001751000 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5d440 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000000 ffffea0000acf008 ffff8880b9842260 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1528c0(GFP_NOWAIT|__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 8843, tgid 8837 (syz-executor.3), ts 282018699992, free_ts 282019840753 prep_new_page mm/page_alloc.c:2531 [inline] get_page_from_freelist+0x119c/0x2ce0 mm/page_alloc.c:4283 __alloc_pages+0x1cb/0x5b0 mm/page_alloc.c:5549 alloc_pages+0x1aa/0x270 mm/mempolicy.c:2285 skb_page_frag_refill net/core/sock.c:2865 [inline] skb_page_frag_refill+0x195/0x360 net/core/sock.c:2849 sk_page_frag_refill+0x58/0x300 net/core/sock.c:2885 __ip_append_data+0x9c1/0x39f0 net/ipv4/ip_output.c:1213 ip_append_data net/ipv4/ip_output.c:1343 [inline] ip_append_data+0x115/0x1a0 net/ipv4/ip_output.c:1322 ping_v4_sendmsg+0xaac/0x1790 net/ipv4/ping.c:837 inet_sendmsg+0x9d/0xe0 net/ipv4/af_inet.c:827 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg+0xd3/0x120 net/socket.c:734 ____sys_sendmsg+0x712/0x8c0 net/socket.c:2476 ___sys_sendmsg+0x110/0x1b0 net/socket.c:2530 __sys_sendmsg+0xf7/0x1c0 net/socket.c:2559 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x39/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1446 [inline] free_pcp_prepare+0x65c/0xc00 mm/page_alloc.c:1496 free_unref_page_prepare mm/page_alloc.c:3369 [inline] free_unref_page+0x1d/0x490 mm/page_alloc.c:3464 __folio_put_large mm/swap.c:119 [inline] __folio_put+0x109/0x140 mm/swap.c:127 folio_put include/linux/mm.h:1250 [inline] put_page include/linux/mm.h:1319 [inline] __skb_frag_unref include/linux/skbuff.h:3388 [inline] skb_release_data+0x522/0x870 net/core/skbuff.c:845 skb_release_all net/core/skbuff.c:916 [inline] __kfree_skb net/core/skbuff.c:930 [inline] consume_skb net/core/skbuff.c:1098 [inline] consume_skb+0xcb/0x170 net/core/skbuff.c:1092 icmp_rcv+0x8a9/0x1030 net/ipv4/icmp.c:1269 ip_protocol_deliver_rcu+0x9f/0x460 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x2ec/0x4c0 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:302 [inline] NF_HOOK include/linux/netfilter.h:296 [inline] ip_local_deliver+0x1ae/0x200 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:454 [inline] ip_rcv_finish+0x1cf/0x2f0 net/ipv4/ip_input.c:449 NF_HOOK include/linux/netfilter.h:302 [inline] NF_HOOK include/linux/netfilter.h:296 [inline] ip_rcv+0xae/0xd0 net/ipv4/ip_input.c:569 __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5482 __netif_receive_skb+0x1f/0x1c0 net/core/dev.c:5596 process_backlog+0x3e4/0x810 net/core/dev.c:5924 __napi_poll+0xb8/0x770 net/core/dev.c:6485 napi_poll net/core/dev.c:6552 [inline] net_rx_action+0xa00/0xde0 net/core/dev.c:6663 Memory state around the buggy address: ffff88805d43ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88805d43ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88805d440000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff88805d440080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff88805d440100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ==================================================================