================================================================== BUG: KASAN: use-after-free in rxrpc_send_keepalive+0xe2/0x3c0 net/rxrpc/output.c:634 Read of size 8 at addr ffff888096b62818 by task kworker/0:2/16419 CPU: 0 PID: 16419 Comm: kworker/0:2 Not tainted 5.4.0-rc2+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: krxrpcd rxrpc_peer_keepalive_worker Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1d8/0x2f8 lib/dump_stack.c:113 print_address_description+0x75/0x5c0 mm/kasan/report.c:374 __kasan_report+0x14b/0x1c0 mm/kasan/report.c:506 kasan_report+0x26/0x50 mm/kasan/common.c:634 __asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:132 rxrpc_send_keepalive+0xe2/0x3c0 net/rxrpc/output.c:634 rxrpc_peer_keepalive_dispatch net/rxrpc/peer_event.c:369 [inline] rxrpc_peer_keepalive_worker+0x76e/0xb40 net/rxrpc/peer_event.c:430 process_one_work+0x7ef/0x10e0 kernel/workqueue.c:2269 worker_thread+0xc01/0x1630 kernel/workqueue.c:2415 kthread+0x332/0x350 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Allocated by task 20335: save_stack mm/kasan/common.c:69 [inline] set_track mm/kasan/common.c:77 [inline] __kasan_kmalloc+0x11c/0x1b0 mm/kasan/common.c:510 kasan_kmalloc+0x9/0x10 mm/kasan/common.c:524 __do_kmalloc_node mm/slab.c:3615 [inline] __kmalloc_node_track_caller+0x4d/0x60 mm/slab.c:3629 __kmalloc_reserve net/core/skbuff.c:141 [inline] __alloc_skb+0xe8/0x500 net/core/skbuff.c:209 alloc_skb_fclone include/linux/skbuff.h:1099 [inline] sk_stream_alloc_skb+0x419/0xa60 net/ipv4/tcp.c:875 tcp_sendmsg_locked+0x16c2/0x4100 net/ipv4/tcp.c:1283 tcp_sendmsg+0x2f/0x50 net/ipv4/tcp.c:1434 inet_sendmsg+0x147/0x310 net/ipv4/af_inet.c:807 sock_sendmsg_nosec net/socket.c:637 [inline] sock_sendmsg net/socket.c:657 [inline] sock_write_iter+0x2a6/0x3a0 net/socket.c:989 call_write_iter include/linux/fs.h:1895 [inline] new_sync_write fs/read_write.c:483 [inline] __vfs_write+0x5a1/0x740 fs/read_write.c:496 vfs_write+0x275/0x590 fs/read_write.c:558 ksys_write+0x117/0x220 fs/read_write.c:611 __do_sys_write fs/read_write.c:623 [inline] __se_sys_write fs/read_write.c:620 [inline] __x64_sys_write+0x7b/0x90 fs/read_write.c:620 do_syscall_64+0xf7/0x1c0 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 20335: save_stack mm/kasan/common.c:69 [inline] set_track mm/kasan/common.c:77 [inline] kasan_set_free_info mm/kasan/common.c:332 [inline] __kasan_slab_free+0x12a/0x1e0 mm/kasan/common.c:471 kasan_slab_free+0xe/0x10 mm/kasan/common.c:480 __cache_free mm/slab.c:3425 [inline] kfree+0x115/0x200 mm/slab.c:3756 skb_free_head net/core/skbuff.c:591 [inline] skb_release_data+0x5bd/0x700 net/core/skbuff.c:611 skb_release_all net/core/skbuff.c:665 [inline] __kfree_skb+0x59/0x170 net/core/skbuff.c:679 sk_wmem_free_skb+0x4a2/0x630 include/net/sock.h:1478 tcp_rtx_queue_unlink_and_free include/net/tcp.h:1801 [inline] tcp_clean_rtx_queue net/ipv4/tcp_input.c:3161 [inline] tcp_ack+0x20b6/0x6990 net/ipv4/tcp_input.c:3688 tcp_rcv_established+0x6eb/0x2120 net/ipv4/tcp_input.c:5696 tcp_v4_do_rcv+0x3ba/0x8d0 net/ipv4/tcp_ipv4.c:1561 sk_backlog_rcv include/net/sock.h:945 [inline] __release_sock+0x1c1/0x4a0 net/core/sock.c:2435 release_sock+0x65/0x1d0 net/core/sock.c:2951 sk_stream_wait_memory+0x635/0xd10 net/core/stream.c:145 tcp_sendmsg_locked+0x14a1/0x4100 net/ipv4/tcp.c:1393 tcp_sendmsg+0x2f/0x50 net/ipv4/tcp.c:1434 inet_sendmsg+0x147/0x310 net/ipv4/af_inet.c:807 sock_sendmsg_nosec net/socket.c:637 [inline] sock_sendmsg net/socket.c:657 [inline] sock_write_iter+0x2a6/0x3a0 net/socket.c:989 call_write_iter include/linux/fs.h:1895 [inline] new_sync_write fs/read_write.c:483 [inline] __vfs_write+0x5a1/0x740 fs/read_write.c:496 vfs_write+0x275/0x590 fs/read_write.c:558 ksys_write+0x117/0x220 fs/read_write.c:611 __do_sys_write fs/read_write.c:623 [inline] __se_sys_write fs/read_write.c:620 [inline] __x64_sys_write+0x7b/0x90 fs/read_write.c:620 do_syscall_64+0xf7/0x1c0 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff888096b62800 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 24 bytes inside of 1024-byte region [ffff888096b62800, ffff888096b62c00) The buggy address belongs to the page: page:ffffea00025ad880 refcount:1 mapcount:0 mapping:ffff8880aa400c40 index:0x0 flags: 0x1fffc0000000200(slab) raw: 01fffc0000000200 ffffea00026ac7c8 ffffea0002701808 ffff8880aa400c40 raw: 0000000000000000 ffff888096b62000 0000000100000002 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888096b62700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888096b62780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888096b62800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888096b62880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888096b62900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================