binder: 5894:5895 transaction failed 29189/-22, size 0-0 line 3011 binder: undelivered TRANSACTION_ERROR: 29189 ================================================================== BUG: KASAN: use-after-free in __read_once_size include/linux/compiler.h:218 [inline] BUG: KASAN: use-after-free in atomic_read arch/x86/include/asm/atomic.h:27 [inline] BUG: KASAN: use-after-free in __atomic_add_unless arch/x86/include/asm/atomic.h:212 [inline] BUG: KASAN: use-after-free in atomic_add_unless include/linux/atomic.h:437 [inline] BUG: KASAN: use-after-free in sk_dst_get include/net/sock.h:1741 [inline] BUG: KASAN: use-after-free in pppol2tp_connect+0x1631/0x1930 net/l2tp/l2tp_ppp.c:755 Read of size 4 at addr ffff8801cf19b440 by task syz-executor7/5901 CPU: 0 PID: 5901 Comm: syz-executor7 Not tainted 4.4.124-g851fb4d #18 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 0000000000000000 e819d6a6406fd0bf ffff8800a90a7ab0 ffffffff81d0663d ffffea00073c66c0 ffff8801cf19b440 0000000000000000 ffff8801cf19b440 1ffff10015214f73 ffff8800a90a7ae8 ffffffff814fe8f3 ffff8801cf19b440 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x124 lib/dump_stack.c:51 [] print_address_description+0x73/0x260 mm/kasan/report.c:252 [] kasan_report_error mm/kasan/report.c:351 [inline] [] kasan_report+0x285/0x370 mm/kasan/report.c:408 [] __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:428 [] __read_once_size include/linux/compiler.h:218 [inline] [] atomic_read arch/x86/include/asm/atomic.h:27 [inline] [] __atomic_add_unless arch/x86/include/asm/atomic.h:212 [inline] [] atomic_add_unless include/linux/atomic.h:437 [inline] [] sk_dst_get include/net/sock.h:1741 [inline] [] pppol2tp_connect+0x1631/0x1930 net/l2tp/l2tp_ppp.c:755 [] SYSC_connect+0x1b6/0x310 net/socket.c:1557 [] SyS_connect+0x24/0x30 net/socket.c:1538 [] do_syscall_32_irqs_on arch/x86/entry/common.c:392 [inline] [] do_fast_syscall_32+0x321/0x8a0 arch/x86/entry/common.c:459 [] sysenter_flags_fixed+0xd/0x17 Allocated by task 5873: [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63 [] save_stack+0x43/0xd0 mm/kasan/kasan.c:512 [] set_track mm/kasan/kasan.c:524 [inline] [] kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:616 [] kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:554 [] slab_post_alloc_hook mm/slub.c:1349 [inline] [] slab_alloc_node mm/slub.c:2615 [inline] [] slab_alloc mm/slub.c:2623 [inline] [] kmem_cache_alloc+0xba/0x290 mm/slub.c:2628 [] dst_alloc+0x11f/0x1a0 net/core/dst.c:210 [] rt_dst_alloc+0x78/0x430 net/ipv4/route.c:1470 [] __mkroute_output net/ipv4/route.c:2123 [inline] [] __ip_route_output_key_hash+0xa4e/0x2390 net/ipv4/route.c:2335 [] __ip_route_output_key include/net/route.h:123 [inline] [] ip_route_output_flow+0x29/0xa0 net/ipv4/route.c:2421 [] ip_route_output_ports include/net/route.h:160 [inline] [] ip_queue_xmit+0x12e9/0x16c0 net/ipv4/ip_output.c:417 [] l2tp_xmit_core net/l2tp/l2tp_core.c:1087 [inline] [] l2tp_xmit_skb+0x9e8/0xea0 net/l2tp/l2tp_core.c:1179 [] pppol2tp_sendmsg+0x584/0x7f0 net/l2tp/l2tp_ppp.c:355 [] sock_sendmsg_nosec net/socket.c:625 [inline] [] sock_sendmsg+0xca/0x110 net/socket.c:635 [] ___sys_sendmsg+0x6c1/0x7c0 net/socket.c:1962 [] __sys_sendmsg+0xd3/0x190 net/socket.c:1996 [] C_SYSC_sendmsg net/compat.c:720 [inline] [] compat_SyS_sendmsg+0x2a/0x40 net/compat.c:718 [] do_syscall_32_irqs_on arch/x86/entry/common.c:392 [inline] [] do_fast_syscall_32+0x321/0x8a0 arch/x86/entry/common.c:459 [] sysenter_flags_fixed+0xd/0x17 Freed by task 14: [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63 [] save_stack+0x43/0xd0 mm/kasan/kasan.c:512 [] set_track mm/kasan/kasan.c:524 [inline] [] kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:589 [] slab_free_hook mm/slub.c:1383 [inline] [] slab_free_freelist_hook mm/slub.c:1405 [inline] [] slab_free mm/slub.c:2859 [inline] [] kmem_cache_free+0xc7/0x320 mm/slub.c:2881 [] dst_destroy+0x20e/0x330 net/core/dst.c:270 [] dst_destroy_rcu+0x15/0x40 net/core/dst.c:295 [] __rcu_reclaim kernel/rcu/rcu.h:118 [inline] [] rcu_do_batch kernel/rcu/tree.c:2705 [inline] [] invoke_rcu_callbacks kernel/rcu/tree.c:2973 [inline] [] __rcu_process_callbacks kernel/rcu/tree.c:2940 [inline] [] rcu_process_callbacks+0x7f4/0x14a0 kernel/rcu/tree.c:2957 [] __do_softirq+0x227/0xa38 kernel/softirq.c:273 The buggy address belongs to the object at ffff8801cf19b3c0 which belongs to the cache ip_dst_cache of size 208 The buggy address is located 128 bytes inside of 208-byte region [ffff8801cf19b3c0, ffff8801cf19b490) The buggy address belongs to the page: