================================================================== BUG: KASAN: use-after-free in hlist_add_head include/linux/list.h:814 [inline] BUG: KASAN: use-after-free in enqueue_timer+0x9e/0x2c0 kernel/time/timer.c:541 Write of size 8 at addr ffff8881e05671c8 by task syz.3.377/1889 CPU: 0 PID: 1889 Comm: syz.3.377 Not tainted 5.4.292-syzkaller-00021-gcd8e74fa0fa3 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 Call Trace: __dump_stack+0x1e/0x20 lib/dump_stack.c:77 dump_stack+0x15b/0x1b8 lib/dump_stack.c:118 print_address_description+0x8d/0x4c0 mm/kasan/report.c:384 __kasan_report+0xef/0x120 mm/kasan/report.c:516 kasan_report+0x30/0x60 mm/kasan/common.c:653 __asan_report_store8_noabort+0x17/0x20 mm/kasan/generic_report.c:137 hlist_add_head include/linux/list.h:814 [inline] enqueue_timer+0x9e/0x2c0 kernel/time/timer.c:541 __internal_add_timer kernel/time/timer.c:554 [inline] internal_add_timer+0x208/0x3e0 kernel/time/timer.c:604 __mod_timer+0x5ab/0x1150 kernel/time/timer.c:1065 mod_timer+0x1f/0x30 kernel/time/timer.c:1117 can_stat_update+0xbab/0xc40 net/can/proc.c:186 call_timer_fn+0x3c/0x380 kernel/time/timer.c:1448 expire_timers kernel/time/timer.c:1493 [inline] __run_timers+0x81d/0xb60 kernel/time/timer.c:1817 run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1830 __do_softirq+0x236/0x660 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0x197/0x1c0 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:539 [inline] smp_apic_timer_interrupt+0x11d/0x490 arch/x86/kernel/apic/apic.c:1161 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:834 RIP: 0010:sock_net_set include/net/sock.h:2580 [inline] RIP: 0010:sk_alloc+0x1ca/0x330 net/core/sock.c:1696 Code: fc ff df 48 8b 45 c8 4c 8d b8 68 01 00 00 4c 89 f8 48 c1 e8 03 42 80 3c 28 00 74 08 4c 89 ff e8 5c 03 36 fe 49 8b 07 65 ff 00 <49> 8d 7e 30 48 89 f8 48 c1 e8 03 42 80 3c 28 00 74 05 e8 df 03 36 RSP: 0018:ffff8881e8edfd68 EFLAGS: 00000296 ORIG_RAX: ffffffffffffff13 RAX: 0000607e08e16e14 RBX: ffff8881e6072000 RCX: 0000000000080000 RDX: ffffc9000314c000 RSI: 0000000000011a70 RDI: 0000000000011a71 RBP: ffff8881e8edfda0 R08: dffffc0000000000 R09: ffffed103add1481 R10: ffffed103add1481 R11: 1ffff1103add1480 R12: ffff8881d6e8a400 R13: dffffc0000000000 R14: ffff8881e6072000 R15: ffff8881d6e8a568 packet_create+0x109/0x820 net/packet/af_packet.c:3337 __sock_create+0x3a8/0x740 net/socket.c:1427 sock_create net/socket.c:1478 [inline] __sys_socketpair+0x1a7/0x5a0 net/socket.c:1578 __do_sys_socketpair net/socket.c:1631 [inline] __se_sys_socketpair net/socket.c:1628 [inline] __x64_sys_socketpair+0x9b/0xb0 net/socket.c:1628 do_syscall_64+0xcf/0x170 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x5c/0xc1 RIP: 0033:0x7f572cd1e969 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f572b387038 EFLAGS: 00000246 ORIG_RAX: 0000000000000035 RAX: ffffffffffffffda RBX: 00007f572cf45fa0 RCX: 00007f572cd1e969 RDX: 0000000002000000 RSI: 000000000000080a RDI: 0000000000000011 RBP: 00007f572cda0ab1 R08: 0000000000000000 R09: 0000000000000000 R10: 0000200000000040 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007f572cf45fa0 R15: 00007fffb26c70b8 The buggy address belongs to the page: page:ffffea00078159c0 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 flags: 0x8000000000000000() raw: 8000000000000000 ffffea00072ae0c8 ffffea0007815988 0000000000000000 raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 0, migratetype Unmovable, gfp_mask 0x102dc2(GFP_HIGHUSER|__GFP_NOWARN|__GFP_ZERO) set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook mm/page_alloc.c:2165 [inline] prep_new_page+0x35e/0x370 mm/page_alloc.c:2171 get_page_from_freelist+0x1296/0x1310 mm/page_alloc.c:3794 __alloc_pages_nodemask+0x202/0x4b0 mm/page_alloc.c:4894 __alloc_pages include/linux/gfp.h:503 [inline] __alloc_pages_node include/linux/gfp.h:516 [inline] alloc_pages_node include/linux/gfp.h:530 [inline] __vmalloc_area_node mm/vmalloc.c:-1 [inline] __vmalloc_node_range+0x36a/0x6e0 mm/vmalloc.c:2499 vmalloc_user+0x73/0x80 mm/vmalloc.c:2629 kcov_mmap+0x2b/0x120 kernel/kcov.c:450 call_mmap include/linux/fs.h:1996 [inline] mmap_region+0x101b/0x15a0 mm/mmap.c:1812 do_mmap+0x826/0xd90 mm/mmap.c:1581 do_mmap_pgoff include/linux/mm.h:2480 [inline] vm_mmap_pgoff+0x195/0x230 mm/util.c:528 ksys_mmap_pgoff+0x16f/0x1e0 mm/mmap.c:1631 __do_sys_mmap arch/x86/kernel/sys_x86_64.c:97 [inline] __se_sys_mmap arch/x86/kernel/sys_x86_64.c:88 [inline] __x64_sys_mmap+0xfa/0x110 arch/x86/kernel/sys_x86_64.c:88 do_syscall_64+0xcf/0x170 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x5c/0xc1 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1176 [inline] free_pcp_prepare mm/page_alloc.c:1233 [inline] free_unref_page_prepare+0x2a9/0x3a0 mm/page_alloc.c:3085 free_unref_page mm/page_alloc.c:3134 [inline] free_the_page mm/page_alloc.c:4954 [inline] __free_pages+0xaa/0x110 mm/page_alloc.c:4962 __vunmap+0x76a/0x8a0 mm/vmalloc.c:2260 __vfree mm/vmalloc.c:2308 [inline] vfree+0x61/0x90 mm/vmalloc.c:2338 kcov_mmap+0x8c/0x120 kernel/kcov.c:474 call_mmap include/linux/fs.h:1996 [inline] mmap_region+0x101b/0x15a0 mm/mmap.c:1812 do_mmap+0x826/0xd90 mm/mmap.c:1581 do_mmap_pgoff include/linux/mm.h:2480 [inline] vm_mmap_pgoff+0x195/0x230 mm/util.c:528 ksys_mmap_pgoff+0x16f/0x1e0 mm/mmap.c:1631 __do_sys_mmap arch/x86/kernel/sys_x86_64.c:97 [inline] __se_sys_mmap arch/x86/kernel/sys_x86_64.c:88 [inline] __x64_sys_mmap+0xfa/0x110 arch/x86/kernel/sys_x86_64.c:88 do_syscall_64+0xcf/0x170 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x5c/0xc1 Memory state around the buggy address: ffff8881e0567080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff8881e0567100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff8881e0567180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff8881e0567200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff8881e0567280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor instruction fetch in kernel mode #PF: error_code(0x0010) - not-present page PGD 0 P4D 0 Oops: 0010 [#1] PREEMPT SMP KASAN CPU: 0 PID: 10 Comm: ksoftirqd/0 Tainted: G B 5.4.292-syzkaller-00021-gcd8e74fa0fa3 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025 RIP: 0010:0x0 Code: Bad RIP value. RSP: 0018:ffff8881f5dd7bd0 EFLAGS: 00010206 RAX: ffffffff8150a590 RBX: 0000000000000100 RCX: ffff8881f5dc1f80 RDX: 0000000080000100 RSI: 0000000000000000 RDI: ffff8881e05671c0 RBP: ffff8881f5dd7c10 R08: 0000000000000004 R09: 0000000000000003 R10: ffffed103ebbaf74 R11: 1ffff1103ebbaf74 R12: 00000000ffffa310 R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8881e05671c0 FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffd6 CR3: 0000000005c0e000 CR4: 00000000003406b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 Call Trace: call_timer_fn+0x3c/0x380 kernel/time/timer.c:1448 expire_timers kernel/time/timer.c:1493 [inline] __run_timers+0x81d/0xb60 kernel/time/timer.c:1817 run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1830 __do_softirq+0x236/0x660 kernel/softirq.c:292 run_ksoftirqd+0x23/0x30 kernel/softirq.c:603 smpboot_thread_fn+0x474/0x850 kernel/smpboot.c:165 kthread+0x31e/0x3a0 kernel/kthread.c:288 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:354 Modules linked in: CR2: 0000000000000000 ---[ end trace a4e31a5de1ee870e ]--- RIP: 0010:0x0 Code: Bad RIP value. RSP: 0018:ffff8881f5dd7bd0 EFLAGS: 00010206 RAX: ffffffff8150a590 RBX: 0000000000000100 RCX: ffff8881f5dc1f80 RDX: 0000000080000100 RSI: 0000000000000000 RDI: ffff8881e05671c0 RBP: ffff8881f5dd7c10 R08: 0000000000000004 R09: 0000000000000003 R10: ffffed103ebbaf74 R11: 1ffff1103ebbaf74 R12: 00000000ffffa310 R13: dffffc0000000000 R14: 0000000000000000 R15: ffff8881e05671c0 FS: 0000000000000000(0000) GS:ffff8881f6e00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffffffffffffffd6 CR3: 0000000005c0e000 CR4: 00000000003406b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600 ---------------- Code disassembly (best guess), 2 bytes skipped: 0: df 48 8b fisttps -0x75(%rax) 3: 45 c8 4c 8d b8 rex.RB enter $0x8d4c,$0xb8 8: 68 01 00 00 4c push $0x4c000001 d: 89 f8 mov %edi,%eax f: 48 c1 e8 03 shr $0x3,%rax 13: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) 18: 74 08 je 0x22 1a: 4c 89 ff mov %r15,%rdi 1d: e8 5c 03 36 fe call 0xfe36037e 22: 49 8b 07 mov (%r15),%rax 25: 65 ff 00 incl %gs:(%rax) * 28: 49 8d 7e 30 lea 0x30(%r14),%rdi <-- trapping instruction 2c: 48 89 f8 mov %rdi,%rax 2f: 48 c1 e8 03 shr $0x3,%rax 33: 42 80 3c 28 00 cmpb $0x0,(%rax,%r13,1) 38: 74 05 je 0x3f 3a: e8 .byte 0xe8 3b: df 03 filds (%rbx) 3d: 36 ss