audit: type=1400 audit(1565429832.573:28): avc: denied { syslog } for pid=5001 comm="syz-executor.2" capability=34 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=capability2 permissive=1 ================================================================== BUG: KASAN: use-after-free in ____bpf_skb_change_tail net/core/filter.c:2371 [inline] BUG: KASAN: use-after-free in bpf_skb_change_tail+0xa62/0xb80 net/core/filter.c:2368 Read of size 8 at addr ffff8881cc3861d0 by task syz-executor.2/5005 CPU: 0 PID: 5005 Comm: syz-executor.2 Not tainted 4.14.138+ #30 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0xca/0x134 lib/dump_stack.c:53 print_address_description+0x60/0x226 mm/kasan/report.c:187 __kasan_report.cold+0x1a/0x41 mm/kasan/report.c:316 ____bpf_skb_change_tail net/core/filter.c:2371 [inline] bpf_skb_change_tail+0xa62/0xb80 net/core/filter.c:2368 ___bpf_prog_run+0x2478/0x5510 kernel/bpf/core.c:1033 Allocated by task 3541: save_stack mm/kasan/common.c:76 [inline] set_track mm/kasan/common.c:85 [inline] __kasan_kmalloc.part.0+0x53/0xc0 mm/kasan/common.c:495 slab_post_alloc_hook mm/slab.h:439 [inline] slab_alloc_node mm/slub.c:2758 [inline] slab_alloc mm/slub.c:2766 [inline] kmem_cache_alloc+0xd2/0x2e0 mm/slub.c:2771 kmem_cache_alloc_node include/linux/slab.h:361 [inline] __alloc_skb+0xea/0x5c0 net/core/skbuff.c:193 alloc_skb include/linux/skbuff.h:980 [inline] nlmsg_new include/net/netlink.h:511 [inline] rtmsg_fib+0x155/0x3f0 net/ipv4/fib_semantics.c:415 fib_table_delete+0x69b/0xf10 net/ipv4/fib_trie.c:1579 fib_magic.isra.0+0x1bb/0x2e0 net/ipv4/fib_frontend.c:863 fib_del_ifaddr+0x64e/0xff0 net/ipv4/fib_frontend.c:947 fib_inetaddr_event+0xa5/0x1f1 net/ipv4/fib_frontend.c:1174 notifier_call_chain+0x10c/0x1a0 kernel/notifier.c:93 __blocking_notifier_call_chain kernel/notifier.c:317 [inline] __blocking_notifier_call_chain kernel/notifier.c:304 [inline] blocking_notifier_call_chain kernel/notifier.c:328 [inline] blocking_notifier_call_chain+0x79/0x90 kernel/notifier.c:325 __inet_del_ifa+0x4c1/0xaf0 net/ipv4/devinet.c:408 inet_del_ifa net/ipv4/devinet.c:438 [inline] inetdev_destroy net/ipv4/devinet.c:303 [inline] inetdev_event+0x23a/0x10e0 net/ipv4/devinet.c:1528 notifier_call_chain+0x10c/0x1a0 kernel/notifier.c:93 call_netdevice_notifiers net/core/dev.c:1687 [inline] rollback_registered_many+0x6ac/0xab0 net/core/dev.c:7213 unregister_netdevice_many.part.0+0x16/0x1d0 net/core/dev.c:8265 unregister_netdevice_many net/core/dev.c:8264 [inline] default_device_exit_batch+0x2f2/0x3b0 net/core/dev.c:8726 ops_exit_list.isra.0+0xfd/0x150 net/core/net_namespace.c:145 cleanup_net+0x3ce/0x870 net/core/net_namespace.c:484 process_one_work+0x7f1/0x1580 kernel/workqueue.c:2134 worker_thread+0xdd/0xdf0 kernel/workqueue.c:2271 kthread+0x31f/0x430 kernel/kthread.c:232 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:404 0xffffffffffffffff Freed by task 3541: save_stack mm/kasan/common.c:76 [inline] set_track mm/kasan/common.c:85 [inline] __kasan_slab_free+0x164/0x210 mm/kasan/common.c:457 slab_free_hook mm/slub.c:1403 [inline] slab_free_freelist_hook mm/slub.c:1430 [inline] slab_free mm/slub.c:3005 [inline] kmem_cache_free+0xcb/0x340 mm/slub.c:3021 kfree_skbmem net/core/skbuff.c:586 [inline] kfree_skbmem+0xa0/0x110 net/core/skbuff.c:580 __kfree_skb net/core/skbuff.c:646 [inline] consume_skb+0xe4/0x360 net/core/skbuff.c:705 netlink_broadcast_filtered+0x2c0/0xa00 net/netlink/af_netlink.c:1488 netlink_broadcast+0x35/0x40 net/netlink/af_netlink.c:1510 nlmsg_multicast include/net/netlink.h:591 [inline] nlmsg_notify+0x76/0x170 net/netlink/af_netlink.c:2475 rtmsg_fib+0x2b2/0x3f0 net/ipv4/fib_semantics.c:428 fib_table_delete+0x69b/0xf10 net/ipv4/fib_trie.c:1579 fib_magic.isra.0+0x1bb/0x2e0 net/ipv4/fib_frontend.c:863 fib_del_ifaddr+0x64e/0xff0 net/ipv4/fib_frontend.c:947 fib_inetaddr_event+0xa5/0x1f1 net/ipv4/fib_frontend.c:1174 notifier_call_chain+0x10c/0x1a0 kernel/notifier.c:93 __blocking_notifier_call_chain kernel/notifier.c:317 [inline] __blocking_notifier_call_chain kernel/notifier.c:304 [inline] blocking_notifier_call_chain kernel/notifier.c:328 [inline] blocking_notifier_call_chain+0x79/0x90 kernel/notifier.c:325 __inet_del_ifa+0x4c1/0xaf0 net/ipv4/devinet.c:408 inet_del_ifa net/ipv4/devinet.c:438 [inline] inetdev_destroy net/ipv4/devinet.c:303 [inline] inetdev_event+0x23a/0x10e0 net/ipv4/devinet.c:1528 notifier_call_chain+0x10c/0x1a0 kernel/notifier.c:93 call_netdevice_notifiers net/core/dev.c:1687 [inline] rollback_registered_many+0x6ac/0xab0 net/core/dev.c:7213 unregister_netdevice_many.part.0+0x16/0x1d0 net/core/dev.c:8265 unregister_netdevice_many net/core/dev.c:8264 [inline] default_device_exit_batch+0x2f2/0x3b0 net/core/dev.c:8726 ops_exit_list.isra.0+0xfd/0x150 net/core/net_namespace.c:145 cleanup_net+0x3ce/0x870 net/core/net_namespace.c:484 process_one_work+0x7f1/0x1580 kernel/workqueue.c:2134 worker_thread+0xdd/0xdf0 kernel/workqueue.c:2271 kthread+0x31f/0x430 kernel/kthread.c:232 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:404 0xffffffffffffffff audit: type=1400 audit(1565429833.063:29): avc: denied { create } for pid=5028 comm="syz-executor.1" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_connector_socket permissive=1 The buggy address belongs to the object at ffff8881cc386140 which belongs to the cache skbuff_head_cache of size 224 The buggy address is located 144 bytes inside of 224-byte region [ffff8881cc386140, ffff8881cc386220) The buggy address belongs to the page: page:ffffea000730e180 count:1 mapcount:0 mapping: (null) index:0x0 flags: 0x4000000000000200(slab) raw: 4000000000000200 0000000000000000 0000000000000000 00000001800c000c raw: dead000000000100 dead000000000200 ffff8881dab70200 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8881cc386080: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ffff8881cc386100: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb >ffff8881cc386180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8881cc386200: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc ffff8881cc386280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================