================================================================== BUG: KASAN: use-after-free in tcp_retransmit_timer+0x291b/0x30e0 net/ipv4/tcp_timer.c:511 Read of size 8 at addr ffff88802b1537d8 by task swapper/1/0 CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.14.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x57/0x7d lib/dump_stack.c:105 print_address_description.constprop.0.cold+0x6c/0x309 mm/kasan/report.c:233 __kasan_report mm/kasan/report.c:419 [inline] kasan_report.cold+0x83/0xdf mm/kasan/report.c:436 tcp_retransmit_timer+0x291b/0x30e0 net/ipv4/tcp_timer.c:511 tcp_write_timer_handler+0x495/0x8a0 net/ipv4/tcp_timer.c:622 tcp_write_timer+0x79/0x1b0 net/ipv4/tcp_timer.c:642 call_timer_fn+0x163/0x4a0 kernel/time/timer.c:1417 expire_timers kernel/time/timer.c:1462 [inline] __run_timers.part.0+0x524/0x8a0 kernel/time/timer.c:1731 __run_timers kernel/time/timer.c:1712 [inline] run_timer_softirq+0x9c/0x190 kernel/time/timer.c:1744 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558 invoke_softirq kernel/softirq.c:432 [inline] __irq_exit_rcu+0x16e/0x1c0 kernel/softirq.c:636 irq_exit_rcu+0x5/0x20 kernel/softirq.c:648 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1100 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638 RIP: 0010:native_save_fl arch/x86/include/asm/irqflags.h:29 [inline] RIP: 0010:arch_local_save_flags arch/x86/include/asm/irqflags.h:70 [inline] RIP: 0010:arch_irqs_disabled arch/x86/include/asm/irqflags.h:132 [inline] RIP: 0010:acpi_safe_halt drivers/acpi/processor_idle.c:110 [inline] RIP: 0010:acpi_idle_do_entry+0x15e/0x1c0 drivers/acpi/processor_idle.c:553 Code: 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 75 6a 48 8b 45 00 a8 08 75 c9 e8 1d 6b 0e f9 eb 07 0f 00 2d 04 e0 c8 00 fb f4 <9c> 58 fa f6 c4 02 74 b1 5d e9 94 67 0e f9 48 89 ef 5d e9 cb f9 ff RSP: 0018:ffffc90000d57d30 EFLAGS: 00000202 RAX: 000000000019e5d3 RBX: ffff8881419a1065 RCX: 1ffffffff18f95b1 RDX: 0000000000000000 RSI: ffffffff88cb2920 RDI: ffffffff891fde20 RBP: ffff88800fe6d4c0 R08: 0000000000000001 R09: 0000000000000001 R10: ffffed1001fcda98 R11: 0000000000000001 R12: 0000000000000001 R13: ffff8881419a1064 R14: ffffffff8b4f2f60 R15: ffff888145c81004 acpi_idle_enter+0x2c0/0x4b0 drivers/acpi/processor_idle.c:688 cpuidle_enter_state+0x152/0xb40 drivers/cpuidle/cpuidle.c:237 cpuidle_enter+0x45/0xa0 drivers/cpuidle/cpuidle.c:351 call_cpuidle kernel/sched/idle.c:158 [inline] cpuidle_idle_call kernel/sched/idle.c:239 [inline] do_idle+0x3e8/0x590 kernel/sched/idle.c:306 cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:403 start_secondary+0x265/0x340 arch/x86/kernel/smpboot.c:270 secondary_startup_64_no_verify+0xb0/0xbb Allocated by task 5858: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:434 [inline] __kasan_slab_alloc+0x84/0xa0 mm/kasan/common.c:467 kasan_slab_alloc include/linux/kasan.h:254 [inline] slab_post_alloc_hook mm/slab.h:519 [inline] slab_alloc_node mm/slub.c:2956 [inline] slab_alloc mm/slub.c:2964 [inline] kmem_cache_alloc+0x285/0x4a0 mm/slub.c:2969 kmem_cache_zalloc include/linux/slab.h:711 [inline] net_alloc net/core/net_namespace.c:409 [inline] copy_net_ns+0xfe/0x5c0 net/core/net_namespace.c:461 create_new_namespaces+0x35a/0x920 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0x86/0x1a0 kernel/nsproxy.c:226 ksys_unshare+0x309/0x6b0 kernel/fork.c:3002 __do_sys_unshare kernel/fork.c:3076 [inline] __se_sys_unshare kernel/fork.c:3074 [inline] __x64_sys_unshare+0x28/0x40 kernel/fork.c:3074 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Freed by task 8: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38 kasan_set_track+0x1c/0x30 mm/kasan/common.c:46 kasan_set_free_info+0x20/0x30 mm/kasan/generic.c:360 ____kasan_slab_free mm/kasan/common.c:366 [inline] ____kasan_slab_free mm/kasan/common.c:328 [inline] __kasan_slab_free+0xfb/0x130 mm/kasan/common.c:374 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:1625 [inline] slab_free_freelist_hook+0xdf/0x240 mm/slub.c:1650 slab_free mm/slub.c:3210 [inline] kmem_cache_free+0x8e/0x5a0 mm/slub.c:3226 net_free net/core/net_namespace.c:437 [inline] net_drop_ns net/core/net_namespace.c:444 [inline] net_drop_ns net/core/net_namespace.c:440 [inline] cleanup_net+0x723/0x990 net/core/net_namespace.c:614 process_one_work+0x84c/0x13d0 kernel/workqueue.c:2276 worker_thread+0x598/0x1040 kernel/workqueue.c:2422 kthread+0x38b/0x460 kernel/kthread.c:319 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295 The buggy address belongs to the object at ffff88802b153580 which belongs to the cache net_namespace of size 6592 The buggy address is located 600 bytes inside of 6592-byte region [ffff88802b153580, ffff88802b154f40) The buggy address belongs to the page: page:ffffea0000ac5400 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88802b150000 pfn:0x2b150 head:ffffea0000ac5400 order:3 compound_mapcount:0 compound_pincount:0 memcg:ffff8880177e7981 flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000010200 0000000000000000 dead000000000122 ffff888010f69000 raw: ffff88802b150000 0000000080040003 00000001ffffffff ffff8880177e7981 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 5855, ts 64612656247, free_ts 64610558398 prep_new_page mm/page_alloc.c:2433 [inline] get_page_from_freelist+0xa6f/0x2f50 mm/page_alloc.c:4166 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5388 alloc_slab_page mm/slub.c:1688 [inline] allocate_slab+0x32e/0x4b0 mm/slub.c:1828 new_slab mm/slub.c:1891 [inline] new_slab_objects mm/slub.c:2637 [inline] ___slab_alloc+0x4ba/0x820 mm/slub.c:2800 __slab_alloc.constprop.0+0xa7/0xf0 mm/slub.c:2840 slab_alloc_node mm/slub.c:2922 [inline] slab_alloc mm/slub.c:2964 [inline] kmem_cache_alloc+0x3e1/0x4a0 mm/slub.c:2969 kmem_cache_zalloc include/linux/slab.h:711 [inline] net_alloc net/core/net_namespace.c:409 [inline] copy_net_ns+0xfe/0x5c0 net/core/net_namespace.c:461 create_new_namespaces+0x35a/0x920 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0x86/0x1a0 kernel/nsproxy.c:226 ksys_unshare+0x309/0x6b0 kernel/fork.c:3002 __do_sys_unshare kernel/fork.c:3076 [inline] __se_sys_unshare kernel/fork.c:3074 [inline] __x64_sys_unshare+0x28/0x40 kernel/fork.c:3074 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1343 [inline] free_pcp_prepare+0x2c5/0x780 mm/page_alloc.c:1394 free_unref_page_prepare mm/page_alloc.c:3329 [inline] free_unref_page+0x19/0x690 mm/page_alloc.c:3408 unfreeze_partials+0x17c/0x1d0 mm/slub.c:2418 put_cpu_partial+0x13d/0x230 mm/slub.c:2454 qlink_free mm/kasan/quarantine.c:146 [inline] qlist_free_all+0x5a/0xc0 mm/kasan/quarantine.c:165 kasan_quarantine_reduce+0x180/0x200 mm/kasan/quarantine.c:272 __kasan_slab_alloc+0x8e/0xa0 mm/kasan/common.c:444 kasan_slab_alloc include/linux/kasan.h:254 [inline] slab_post_alloc_hook mm/slab.h:519 [inline] slab_alloc_node mm/slub.c:2956 [inline] slab_alloc mm/slub.c:2964 [inline] __kmalloc+0x1f4/0x330 mm/slub.c:4100 kmalloc include/linux/slab.h:596 [inline] tomoyo_realpath_from_path+0xb0/0x6a0 security/tomoyo/realpath.c:254 tomoyo_get_realpath security/tomoyo/file.c:151 [inline] tomoyo_path_number_perm+0x1a6/0x4d0 security/tomoyo/file.c:723 security_file_ioctl+0x44/0x80 security/security.c:1539 __do_sys_ioctl fs/ioctl.c:1063 [inline] __se_sys_ioctl fs/ioctl.c:1055 [inline] __x64_sys_ioctl+0x99/0x190 fs/ioctl.c:1055 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x44/0xae Memory state around the buggy address: ffff88802b153680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88802b153700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88802b153780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88802b153800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88802b153880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== ---------------- Code disassembly (best guess): 0: 00 00 add %al,(%rax) 2: 00 00 add %al,(%rax) 4: 00 fc add %bh,%ah 6: ff (bad) 7: df 48 c1 fisttps -0x3f(%rax) a: ea (bad) b: 03 80 3c 02 00 75 add 0x7500023c(%rax),%eax 11: 6a 48 pushq $0x48 13: 8b 45 00 mov 0x0(%rbp),%eax 16: a8 08 test $0x8,%al 18: 75 c9 jne 0xffffffe3 1a: e8 1d 6b 0e f9 callq 0xf90e6b3c 1f: eb 07 jmp 0x28 21: 0f 00 2d 04 e0 c8 00 verw 0xc8e004(%rip) # 0xc8e02c 28: fb sti 29: f4 hlt * 2a: 9c pushfq <-- trapping instruction 2b: 58 pop %rax 2c: fa cli 2d: f6 c4 02 test $0x2,%ah 30: 74 b1 je 0xffffffe3 32: 5d pop %rbp 33: e9 94 67 0e f9 jmpq 0xf90e67cc 38: 48 89 ef mov %rbp,%rdi 3b: 5d pop %rbp 3c: e9 .byte 0xe9 3d: cb lret 3e: f9 stc 3f: ff .byte 0xff