syz-executor1 (8402) used greatest stack depth: 16376 bytes left syz-executor2 (8578) used greatest stack depth: 14776 bytes left ================================================================== BUG: KASAN: use-after-free in tls_write_space+0x316/0x3b0 net/tls/tls_main.c:232 Read of size 1 at addr ffff8880904295e0 by task syz-executor0/9405 CPU: 1 PID: 9405 Comm: syz-executor0 Not tainted 5.0.0-rc3+ #41 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1db/0x2d0 lib/dump_stack.c:113 print_address_description.cold+0x7c/0x20d mm/kasan/report.c:187 kasan_report.cold+0x1b/0x40 mm/kasan/report.c:317 __asan_report_load1_noabort+0x14/0x20 mm/kasan/generic_report.c:132 tls_write_space+0x316/0x3b0 net/tls/tls_main.c:232 tcp_new_space net/ipv4/tcp_input.c:5146 [inline] tcp_check_space+0x52e/0x920 net/ipv4/tcp_input.c:5157 tcp_data_snd_check net/ipv4/tcp_input.c:5167 [inline] tcp_rcv_established+0x9fb/0x2180 net/ipv4/tcp_input.c:5658 tcp_v4_do_rcv+0x616/0x8d0 net/ipv4/tcp_ipv4.c:1538 tcp_v4_rcv+0x3151/0x3c40 net/ipv4/tcp_ipv4.c:1912 ip_protocol_deliver_rcu+0xb6/0xa20 net/ipv4/ip_input.c:208 ip_local_deliver_finish+0x23b/0x390 net/ipv4/ip_input.c:234 NF_HOOK include/linux/netfilter.h:289 [inline] NF_HOOK include/linux/netfilter.h:283 [inline] ip_local_deliver+0x1f0/0x740 net/ipv4/ip_input.c:255 dst_input include/net/dst.h:450 [inline] ip_rcv_finish+0x1f4/0x2f0 net/ipv4/ip_input.c:414 NF_HOOK include/linux/netfilter.h:289 [inline] NF_HOOK include/linux/netfilter.h:283 [inline] ip_rcv+0xed/0x620 net/ipv4/ip_input.c:524 __netif_receive_skb_one_core+0x160/0x210 net/core/dev.c:4973 __netif_receive_skb+0x2c/0x1c0 net/core/dev.c:5083 process_backlog+0x206/0x750 net/core/dev.c:5923 napi_poll net/core/dev.c:6346 [inline] net_rx_action+0x76d/0x1930 net/core/dev.c:6412 __do_softirq+0x30b/0xb11 kernel/softirq.c:292 do_softirq_own_stack+0x2a/0x40 arch/x86/entry/entry_64.S:1027 do_softirq.part.0+0x11a/0x170 kernel/softirq.c:337 do_softirq kernel/softirq.c:329 [inline] __local_bh_enable_ip+0x211/0x270 kernel/softirq.c:189 __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:176 [inline] _raw_spin_unlock_bh+0x31/0x40 kernel/locking/spinlock.c:200 spin_unlock_bh include/linux/spinlock.h:374 [inline] release_sock+0x1e8/0x2b0 net/core/sock.c:2811 tls_sk_proto_close+0x3fb/0x770 net/tls/tls_main.c:302 inet_release+0x105/0x1f0 net/ipv4/af_inet.c:428 __sock_release+0x1d3/0x250 net/socket.c:579 sock_release+0x18/0x20 net/socket.c:598 smc_release+0x2f3/0x950 net/smc/af_smc.c:158 __sock_release+0xd3/0x250 net/socket.c:579 sock_close+0x1b/0x30 net/socket.c:1141 __fput+0x3c5/0xb10 fs/file_table.c:278 ____fput+0x16/0x20 fs/file_table.c:309 task_work_run+0x1f4/0x2b0 kernel/task_work.c:113 get_signal+0x168d/0x19b0 kernel/signal.c:2347 do_signal+0x91/0x1ea0 arch/x86/kernel/signal.c:816 exit_to_usermode_loop+0x2f7/0x3b0 arch/x86/entry/common.c:162 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline] syscall_return_slowpath arch/x86/entry/common.c:268 [inline] do_syscall_32_irqs_on arch/x86/entry/common.c:341 [inline] do_fast_syscall_32+0xc97/0xf98 arch/x86/entry/common.c:397 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139 RIP: 0023:0xf7f35869 Code: 85 d2 74 02 89 0a 5b 5d c3 8b 04 24 c3 8b 14 24 c3 8b 3c 24 c3 90 90 90 90 90 90 90 90 90 90 90 90 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 eb 0d 90 90 90 90 90 90 90 90 90 90 90 90 RSP: 002b:00000000f7f310cc EFLAGS: 00000296 ORIG_RAX: 0000000000000004 RAX: 0000000000270000 RBX: 0000000000000006 RCX: 0000000020000040 RDX: 00000000ffffffc4 RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Allocated by task 9406: save_stack+0x45/0xd0 mm/kasan/common.c:73 set_track mm/kasan/common.c:85 [inline] __kasan_kmalloc mm/kasan/common.c:496 [inline] __kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:469 kasan_kmalloc+0x9/0x10 mm/kasan/common.c:504 kmem_cache_alloc_trace+0x151/0x760 mm/slab.c:3609 kmalloc include/linux/slab.h:545 [inline] kzalloc include/linux/slab.h:740 [inline] create_ctx+0x46/0x1f0 net/tls/tls_main.c:543 tls_init+0x1dd/0xd40 net/tls/tls_main.c:688 __tcp_set_ulp net/ipv4/tcp_ulp.c:125 [inline] tcp_set_ulp+0x3de/0x540 net/ipv4/tcp_ulp.c:146 do_tcp_setsockopt.isra.0+0x44c/0x26a0 net/ipv4/tcp.c:2756 tcp_setsockopt+0xc4/0xf0 net/ipv4/tcp.c:3070 sock_common_setsockopt+0x9a/0xe0 net/core/sock.c:2991 smc_setsockopt+0xd1/0x7a0 net/smc/af_smc.c:1656 __compat_sys_setsockopt+0x320/0x830 net/compat.c:407 __do_compat_sys_setsockopt net/compat.c:417 [inline] __se_compat_sys_setsockopt net/compat.c:414 [inline] __ia32_compat_sys_setsockopt+0xbd/0x150 net/compat.c:414 do_syscall_32_irqs_on arch/x86/entry/common.c:326 [inline] do_fast_syscall_32+0x333/0xf98 arch/x86/entry/common.c:397 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139 Freed by task 9405: save_stack+0x45/0xd0 mm/kasan/common.c:73 set_track mm/kasan/common.c:85 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/common.c:458 kasan_slab_free+0xe/0x10 mm/kasan/common.c:466 __cache_free mm/slab.c:3487 [inline] kfree+0xcf/0x230 mm/slab.c:3806 tls_ctx_free.part.0+0x32/0x40 net/tls/tls_main.c:254 tls_ctx_free net/tls/tls_main.c:249 [inline] tls_sk_proto_close+0x3ee/0x770 net/tls/tls_main.c:297 inet_release+0x105/0x1f0 net/ipv4/af_inet.c:428 __sock_release+0x1d3/0x250 net/socket.c:579 sock_release+0x18/0x20 net/socket.c:598 smc_release+0x2f3/0x950 net/smc/af_smc.c:158 __sock_release+0xd3/0x250 net/socket.c:579 sock_close+0x1b/0x30 net/socket.c:1141 __fput+0x3c5/0xb10 fs/file_table.c:278 ____fput+0x16/0x20 fs/file_table.c:309 task_work_run+0x1f4/0x2b0 kernel/task_work.c:113 get_signal+0x168d/0x19b0 kernel/signal.c:2347 do_signal+0x91/0x1ea0 arch/x86/kernel/signal.c:816 exit_to_usermode_loop+0x2f7/0x3b0 arch/x86/entry/common.c:162 prepare_exit_to_usermode arch/x86/entry/common.c:197 [inline] syscall_return_slowpath arch/x86/entry/common.c:268 [inline] do_syscall_32_irqs_on arch/x86/entry/common.c:341 [inline] do_fast_syscall_32+0xc97/0xf98 arch/x86/entry/common.c:397 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139 The buggy address belongs to the object at ffff888090429500 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 224 bytes inside of 512-byte region [ffff888090429500, ffff888090429700) The buggy address belongs to the page: page:ffffea0002410a40 count:1 mapcount:0 mapping:ffff88812c3f0940 index:0x0 flags: 0x1fffc0000000200(slab) raw: 01fffc0000000200 ffffea00024efbc8 ffffea00027a8c48 ffff88812c3f0940 raw: 0000000000000000 ffff888090429000 0000000100000006 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888090429480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888090429500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888090429580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888090429600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888090429680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================