==================================================================
BUG: KASAN: use-after-free in tipc_conn_close+0x42/0x140 net/tipc/topsrv.c:157
Read of size 8 at addr ffff8881587a7b08 by task kworker/u4:7/9305
CPU: 1 PID: 9305 Comm: kworker/u4:7 Not tainted 5.15.106-syzkaller-00249-g19c0ed55a470 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023
Workqueue: netns cleanup_net
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x151/0x1b7 lib/dump_stack.c:106
print_address_description+0x87/0x3b0 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:427 [inline]
kasan_report+0x179/0x1c0 mm/kasan/report.c:444
__asan_report_load8_noabort+0x14/0x20 mm/kasan/report_generic.c:309
tipc_conn_close+0x42/0x140 net/tipc/topsrv.c:157
tipc_topsrv_stop net/tipc/topsrv.c:703 [inline]
tipc_topsrv_exit_net+0x139/0x320 net/tipc/topsrv.c:725
ops_exit_list net/core/net_namespace.c:169 [inline]
cleanup_net+0x64b/0xc00 net/core/net_namespace.c:596
process_one_work+0x6bb/0xc10 kernel/workqueue.c:2313
worker_thread+0xad5/0x12a0 kernel/workqueue.c:2460
kthread+0x421/0x510 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
Allocated by task 9305:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track mm/kasan/common.c:45 [inline]
set_alloc_info mm/kasan/common.c:433 [inline]
____kasan_kmalloc+0xdb/0x110 mm/kasan/common.c:512
__kasan_kmalloc+0x9/0x10 mm/kasan/common.c:521
kasan_kmalloc include/linux/kasan.h:227 [inline]
kmem_cache_alloc_trace+0x115/0x210 mm/slub.c:3265
kmalloc include/linux/slab.h:608 [inline]
kzalloc include/linux/slab.h:738 [inline]
tipc_conn_alloc+0x5a/0x460 net/tipc/topsrv.c:184
tipc_topsrv_accept+0x12c/0x2c0 net/tipc/topsrv.c:472
process_one_work+0x6bb/0xc10 kernel/workqueue.c:2313
worker_thread+0xad5/0x12a0 kernel/workqueue.c:2460
kthread+0x421/0x510 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
Freed by task 21879:
kasan_save_stack mm/kasan/common.c:38 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:45
kasan_set_free_info+0x23/0x40 mm/kasan/generic.c:370
____kasan_slab_free+0x126/0x160 mm/kasan/common.c:365
__kasan_slab_free+0x11/0x20 mm/kasan/common.c:373
kasan_slab_free include/linux/kasan.h:193 [inline]
slab_free_hook mm/slub.c:1723 [inline]
slab_free_freelist_hook+0xbd/0x190 mm/slub.c:1749
slab_free mm/slub.c:3517 [inline]
kfree+0xc8/0x220 mm/slub.c:4577
tipc_conn_kref_release net/tipc/topsrv.c:142 [inline]
kref_put include/linux/kref.h:65 [inline]
conn_put+0x2a9/0x310 net/tipc/topsrv.c:147
tipc_conn_recv_work+0x430/0x490 net/tipc/topsrv.c:432
process_one_work+0x6bb/0xc10 kernel/workqueue.c:2313
worker_thread+0xad5/0x12a0 kernel/workqueue.c:2460
kthread+0x421/0x510 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
Last potentially related work creation:
kasan_save_stack+0x3b/0x60 mm/kasan/common.c:38
__kasan_record_aux_stack+0xd3/0xf0 mm/kasan/generic.c:348
kasan_record_aux_stack_noalloc+0xb/0x10 mm/kasan/generic.c:358
insert_work+0x56/0x320 kernel/workqueue.c:1369
__queue_work+0x923/0xcd0 kernel/workqueue.c:1535
queue_work_on+0x105/0x170 kernel/workqueue.c:1562
queue_work include/linux/workqueue.h:507 [inline]
tipc_conn_data_ready+0x136/0x190 net/tipc/topsrv.c:446
tipc_sk_filter_rcv+0x10db/0x3380 net/tipc/socket.c:2388
tipc_sk_enqueue net/tipc/socket.c:2445 [inline]
tipc_sk_rcv+0x80c/0x1b50 net/tipc/socket.c:2497
tipc_node_xmit+0x34e/0xe40 net/tipc/node.c:1703
tipc_node_xmit_skb+0x153/0x1b0 net/tipc/node.c:1768
__tipc_shutdown+0x1205/0x1510 net/tipc/socket.c:598
tipc_release+0xd7/0x1300 net/tipc/socket.c:642
__sock_release net/socket.c:649 [inline]
sock_close+0xdf/0x270 net/socket.c:1317
__fput+0x3fe/0x910 fs/file_table.c:280
____fput+0x15/0x20 fs/file_table.c:308
task_work_run+0x129/0x190 kernel/task_work.c:164
exit_task_work include/linux/task_work.h:32 [inline]
do_exit+0xc60/0x2b60 kernel/exit.c:875
do_group_exit+0x141/0x310 kernel/exit.c:997
get_signal+0x7a3/0x1630 kernel/signal.c:2891
arch_do_signal_or_restart+0xbd/0x1680 arch/x86/kernel/signal.c:865
handle_signal_work kernel/entry/common.c:148 [inline]
exit_to_user_mode_loop+0xa0/0xe0 kernel/entry/common.c:172
exit_to_user_mode_prepare+0x5a/0xa0 kernel/entry/common.c:208
__syscall_exit_to_user_mode_work kernel/entry/common.c:290 [inline]
syscall_exit_to_user_mode+0x26/0x160 kernel/entry/common.c:301
do_syscall_64+0x49/0xb0 arch/x86/entry/common.c:86
entry_SYSCALL_64_after_hwframe+0x61/0xcb
Second to last potentially related work creation:
kasan_save_stack+0x3b/0x60 mm/kasan/common.c:38
__kasan_record_aux_stack+0xd3/0xf0 mm/kasan/generic.c:348
kasan_record_aux_stack_noalloc+0xb/0x10 mm/kasan/generic.c:358
insert_work+0x56/0x320 kernel/workqueue.c:1369
__queue_work+0x923/0xcd0 kernel/workqueue.c:1535
queue_work_on+0x105/0x170 kernel/workqueue.c:1562
queue_work include/linux/workqueue.h:507 [inline]
tipc_conn_data_ready+0x136/0x190 net/tipc/topsrv.c:446
tipc_topsrv_accept+0x21f/0x2c0 net/tipc/topsrv.c:487
process_one_work+0x6bb/0xc10 kernel/workqueue.c:2313
worker_thread+0xad5/0x12a0 kernel/workqueue.c:2460
kthread+0x421/0x510 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
The buggy address belongs to the object at ffff8881587a7b00
which belongs to the cache kmalloc-192 of size 192
The buggy address is located 8 bytes inside of
192-byte region [ffff8881587a7b00, ffff8881587a7bc0)
The buggy address belongs to the page:
page:ffffea000561e9c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8881587a7800 pfn:0x1587a7
flags: 0x4000000000000200(slab|zone=1)
raw: 4000000000000200 ffffea000415eac8 ffffea00045a6a08 ffff888100042c00
raw: ffff8881587a7800 000000000010000e 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 3658, ts 281963843337, free_ts 281925051265
set_page_owner include/linux/page_owner.h:33 [inline]
post_alloc_hook+0x1a3/0x1b0 mm/page_alloc.c:2502
prep_new_page mm/page_alloc.c:2508 [inline]
get_page_from_freelist+0x2c14/0x2cf0 mm/page_alloc.c:4291
__alloc_pages+0x386/0x7b0 mm/page_alloc.c:5569
allocate_slab mm/slub.c:1930 [inline]
new_slab+0x92/0x490 mm/slub.c:1993
___slab_alloc+0x39e/0x830 mm/slub.c:3026
__slab_alloc+0x4a/0x90 mm/slub.c:3113
slab_alloc_node mm/slub.c:3204 [inline]
slab_alloc mm/slub.c:3246 [inline]
kmem_cache_alloc_trace+0x142/0x210 mm/slub.c:3263
kmalloc include/linux/slab.h:608 [inline]
kzalloc include/linux/slab.h:738 [inline]
____ip_mc_inc_group+0x215/0x8d0 net/ipv4/igmp.c:1449
__ip_mc_inc_group net/ipv4/igmp.c:1484 [inline]
ip_mc_inc_group net/ipv4/igmp.c:1490 [inline]
ip_mc_up+0x10f/0x1e0 net/ipv4/igmp.c:1789
inetdev_event+0xbed/0x1040 net/ipv4/devinet.c:1573
notifier_call_chain kernel/notifier.c:83 [inline]
raw_notifier_call_chain+0x8c/0xf0 kernel/notifier.c:391
__dev_notify_flags+0x304/0x610
dev_change_flags+0xf0/0x1a0 net/core/dev.c:8866
do_setlink+0xcd1/0x3af0 net/core/rtnetlink.c:2721
__rtnl_newlink net/core/rtnetlink.c:3395 [inline]
rtnl_newlink+0x1763/0x2040 net/core/rtnetlink.c:3510
rtnetlink_rcv_msg+0x951/0xc40 net/core/rtnetlink.c:5587
page last free stack trace:
reset_page_owner include/linux/page_owner.h:26 [inline]
free_pages_prepare mm/page_alloc.c:1370 [inline]
free_pcp_prepare mm/page_alloc.c:1442 [inline]
free_unref_page_prepare+0x7c8/0x7d0 mm/page_alloc.c:3441
free_unref_page+0xac/0x2c0 mm/page_alloc.c:3521
free_the_page mm/page_alloc.c:711 [inline]
__free_pages+0x61/0xf0 mm/page_alloc.c:5645
__free_slab+0xec/0x1d0 mm/slub.c:2018
free_slab mm/slub.c:2033 [inline]
discard_slab+0x29/0x40 mm/slub.c:2039
__slab_free+0x205/0x290 mm/slub.c:3422
do_slab_free mm/slub.c:3505 [inline]
___cache_free+0x109/0x120 mm/slub.c:3524
qlink_free+0x4d/0x90 mm/kasan/quarantine.c:157
qlist_free_all+0x44/0xb0 mm/kasan/quarantine.c:176
kasan_quarantine_reduce+0x15a/0x180 mm/kasan/quarantine.c:283
__kasan_slab_alloc+0x2f/0xe0 mm/kasan/common.c:443
kasan_slab_alloc include/linux/kasan.h:217 [inline]
slab_post_alloc_hook+0x53/0x2c0 mm/slab.h:550
slab_alloc_node mm/slub.c:3238 [inline]
slab_alloc mm/slub.c:3246 [inline]
kmem_cache_alloc_trace+0xf9/0x210 mm/slub.c:3263
kmalloc include/linux/slab.h:608 [inline]
kzalloc include/linux/slab.h:738 [inline]
kset_create lib/kobject.c:977 [inline]
kset_create_and_add+0x5c/0x2b0 lib/kobject.c:1020
register_queue_kobjects net/core/net-sysfs.c:1759 [inline]
netdev_register_kobject+0x1a6/0x320 net/core/net-sysfs.c:2018
register_netdevice+0xda5/0x1350 net/core/dev.c:10334
Memory state around the buggy address:
ffff8881587a7a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff8881587a7a80: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8881587a7b00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8881587a7b80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff8881587a7c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
general protection fault, probably for non-canonical address 0xf58bfc4760000ab1: 0000 [#1] PREEMPT SMP KASAN
KASAN: maybe wild-memory-access in range [0xac60023b00005588-0xac60023b0000558f]
CPU: 1 PID: 9305 Comm: kworker/u4:7 Tainted: G B 5.15.106-syzkaller-00249-g19c0ed55a470 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/25/2023
Workqueue: netns cleanup_net
RIP: 0010:tipc_conn_close+0x54/0x140 net/tipc/topsrv.c:157
Code: d8 48 c1 e8 03 48 89 45 c8 42 80 3c 38 00 74 08 48 89 df e8 fe dd 07 fd 48 89 5d d0 48 8b 1b 48 83 c3 18 48 89 d8 48 c1 e8 03 <42> 80 3c 38 00 74 08 48 89 df e8 dd dd 07 fd 4c 8b 2b 4d 8d b5 40
RSP: 0018:ffffc90000ca7ba0 EFLAGS: 00010a07
RAX: 158c004760000ab1 RBX: ac60023b0000558f RCX: ffff88811055cf00
RDX: 0000000000000000 RSI: 0000000000000282 RDI: 00000000ffffffff
RBP: ffffc90000ca7bd8 R08: ffffffff8141671b R09: 0000000000000003
R10: fffffbfff0e4f84c R11: dffffc0000000001 R12: ffff8881587a7b00
R13: ffff8881195bbf18 R14: ffff8881195bbf1c R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fb934f795b0 CR3: 0000000133d28000 CR4: 00000000003506a0
DR0: 00000000ffff070c DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Call Trace:
tipc_topsrv_stop net/tipc/topsrv.c:703 [inline]
tipc_topsrv_exit_net+0x139/0x320 net/tipc/topsrv.c:725
ops_exit_list net/core/net_namespace.c:169 [inline]
cleanup_net+0x64b/0xc00 net/core/net_namespace.c:596
process_one_work+0x6bb/0xc10 kernel/workqueue.c:2313
worker_thread+0xad5/0x12a0 kernel/workqueue.c:2460
kthread+0x421/0x510 kernel/kthread.c:319
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:298
Modules linked in:
---[ end trace 84913efab3026c92 ]---
RIP: 0010:tipc_conn_close+0x54/0x140 net/tipc/topsrv.c:157
Code: d8 48 c1 e8 03 48 89 45 c8 42 80 3c 38 00 74 08 48 89 df e8 fe dd 07 fd 48 89 5d d0 48 8b 1b 48 83 c3 18 48 89 d8 48 c1 e8 03 <42> 80 3c 38 00 74 08 48 89 df e8 dd dd 07 fd 4c 8b 2b 4d 8d b5 40
RSP: 0018:ffffc90000ca7ba0 EFLAGS: 00010a07
RAX: 158c004760000ab1 RBX: ac60023b0000558f RCX: ffff88811055cf00
RDX: 0000000000000000 RSI: 0000000000000282 RDI: 00000000ffffffff
RBP: ffffc90000ca7bd8 R08: ffffffff8141671b R09: 0000000000000003
R10: fffffbfff0e4f84c R11: dffffc0000000001 R12: ffff8881587a7b00
R13: ffff8881195bbf18 R14: ffff8881195bbf1c R15: dffffc0000000000
FS: 0000000000000000(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000c032140000 CR3: 000000015969e000 CR4: 00000000003506b0
DR0: 00000000ffff070c DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
----------------
Code disassembly (best guess):
0: d8 48 c1 fmuls -0x3f(%rax)
3: e8 03 48 89 45 callq 0x4589480b
8: c8 42 80 3c enterq $0x8042,$0x3c
c: 38 00 cmp %al,(%rax)
e: 74 08 je 0x18
10: 48 89 df mov %rbx,%rdi
13: e8 fe dd 07 fd callq 0xfd07de16
18: 48 89 5d d0 mov %rbx,-0x30(%rbp)
1c: 48 8b 1b mov (%rbx),%rbx
1f: 48 83 c3 18 add $0x18,%rbx
23: 48 89 d8 mov %rbx,%rax
26: 48 c1 e8 03 shr $0x3,%rax
* 2a: 42 80 3c 38 00 cmpb $0x0,(%rax,%r15,1) <-- trapping instruction
2f: 74 08 je 0x39
31: 48 89 df mov %rbx,%rdi
34: e8 dd dd 07 fd callq 0xfd07de16
39: 4c 8b 2b mov (%rbx),%r13
3c: 4d rex.WRB
3d: 8d .byte 0x8d
3e: b5 40 mov $0x40,%ch