==================================================================
BUG: KASAN: slab-use-after-free in sk_fullsock include/net/sock.h:2837 [inline]
BUG: KASAN: slab-use-after-free in ip_skb_dst_mtu+0x830/0x9b0 include/net/ip.h:499
Read of size 1 at addr ffff888030168012 by task swapper/1/0
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.8.0-rc5-syzkaller-01567-gd662c5b3ce6d #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e7/0x2e0 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x167/0x540 mm/kasan/report.c:488
kasan_report+0x142/0x180 mm/kasan/report.c:601
sk_fullsock include/net/sock.h:2837 [inline]
ip_skb_dst_mtu+0x830/0x9b0 include/net/ip.h:499
__ip_finish_output+0x12b/0x400 net/ipv4/ip_output.c:306
ipvlan_process_v4_outbound+0x3ef/0x700 drivers/net/ipvlan/ipvlan_core.c:442
ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:540 [inline]
ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline]
ipvlan_queue_xmit+0xaa2/0x11f0 drivers/net/ipvlan/ipvlan_core.c:668
ipvlan_start_xmit+0x4a/0x150 drivers/net/ipvlan/ipvlan_main.c:222
__netdev_start_xmit include/linux/netdevice.h:4990 [inline]
netdev_start_xmit include/linux/netdevice.h:5004 [inline]
xmit_one net/core/dev.c:3530 [inline]
dev_hard_start_xmit+0x242/0x770 net/core/dev.c:3546
sch_direct_xmit+0x2b6/0x5f0 net/sched/sch_generic.c:342
qdisc_restart net/sched/sch_generic.c:407 [inline]
__qdisc_run+0xbed/0x2150 net/sched/sch_generic.c:415
qdisc_run+0xda/0x270 include/net/pkt_sched.h:127
net_tx_action+0x877/0xa30 net/core/dev.c:5213
__do_softirq+0x2bb/0x942 kernel/softirq.c:553
invoke_softirq kernel/softirq.c:427 [inline]
__irq_exit_rcu+0xf1/0x1c0 kernel/softirq.c:632
irq_exit_rcu+0x9/0x30 kernel/softirq.c:644
sysvec_apic_timer_interrupt+0x97/0xb0 arch/x86/kernel/apic/apic.c:1076
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:native_irq_disable arch/x86/include/asm/irqflags.h:37 [inline]
RIP: 0010:arch_local_irq_disable arch/x86/include/asm/irqflags.h:72 [inline]
RIP: 0010:acpi_safe_halt+0x20/0x30 drivers/acpi/processor_idle.c:113
Code: 90 90 90 90 90 90 90 90 90 90 65 48 8b 05 a8 59 99 74 48 f7 00 08 00 00 00 75 10 66 90 0f 00 2d d6 ae 9d 00 f3 0f 1e fa fb f4 c3 cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90
RSP: 0018:ffffc90000187d08 EFLAGS: 00000246
RAX: ffff88801768bb80 RBX: ffff88801baaa864 RCX: 0000000000026291
RDX: 0000000000000001 RSI: ffff88801baaa800 RDI: ffff88801baaa864
RBP: 0000000000038f98 R08: ffff8880b9536d8b R09: 1ffff110172a6db1
R10: dffffc0000000000 R11: ffffffff8b6a6120 R12: ffff888018fc4000
R13: 0000000000000000 R14: 0000000000000001 R15: ffffffff8e898f80
acpi_idle_enter+0xe4/0x140 drivers/acpi/processor_idle.c:707
cpuidle_enter_state+0x118/0x490 drivers/cpuidle/cpuidle.c:267
cpuidle_enter+0x5d/0xa0 drivers/cpuidle/cpuidle.c:388
call_cpuidle kernel/sched/idle.c:134 [inline]
cpuidle_idle_call kernel/sched/idle.c:215 [inline]
do_idle+0x374/0x5d0 kernel/sched/idle.c:312
cpu_startup_entry+0x41/0x60 kernel/sched/idle.c:410
start_secondary+0x100/0x100 arch/x86/kernel/smpboot.c:336
secondary_startup_64_no_verify+0x171/0x17b
Allocated by task 5133:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:372 [inline]
__kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:389
kasan_kmalloc include/linux/kasan.h:211 [inline]
__do_kmalloc_node mm/slub.c:3981 [inline]
__kmalloc+0x22e/0x490 mm/slub.c:3994
kmalloc include/linux/slab.h:594 [inline]
sk_prot_alloc+0xe0/0x210 net/core/sock.c:2078
sk_alloc+0x38/0x370 net/core/sock.c:2131
packet_create+0x104/0x790 net/packet/af_packet.c:3352
__sock_create+0x48f/0x920 net/socket.c:1571
sock_create net/socket.c:1622 [inline]
__sys_socket_create net/socket.c:1659 [inline]
__sys_socket+0x14f/0x3c0 net/socket.c:1706
__do_sys_socket net/socket.c:1720 [inline]
__se_sys_socket net/socket.c:1718 [inline]
__x64_sys_socket+0x7a/0x90 net/socket.c:1718
do_syscall_64+0xf9/0x240
entry_SYSCALL_64_after_hwframe+0x6f/0x77
Freed by task 0:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
kasan_save_free_info+0x4e/0x60 mm/kasan/generic.c:640
poison_slab_object+0xa6/0xe0 mm/kasan/common.c:241
__kasan_slab_free+0x34/0x70 mm/kasan/common.c:257
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2121 [inline]
slab_free mm/slub.c:4299 [inline]
kfree+0x14a/0x380 mm/slub.c:4409
sk_prot_free net/core/sock.c:2114 [inline]
__sk_destruct+0x476/0x5f0 net/core/sock.c:2206
skb_orphan include/linux/skbuff.h:3180 [inline]
ip_defrag+0x20a/0x26b0 net/ipv4/ip_fragment.c:490
nf_ct_ipv4_gather_frags net/ipv4/netfilter/nf_defrag_ipv4.c:32 [inline]
ipv4_conntrack_defrag+0x3de/0x5a0 net/ipv4/netfilter/nf_defrag_ipv4.c:87
nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]
nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626
nf_hook+0x2c4/0x450 include/linux/netfilter.h:269
__ip_local_out+0x3d9/0x4e0 net/ipv4/ip_output.c:118
ip_local_out+0x26/0x70 net/ipv4/ip_output.c:127
ipvlan_process_v4_outbound+0x3ef/0x700 drivers/net/ipvlan/ipvlan_core.c:442
ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:540 [inline]
ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline]
ipvlan_queue_xmit+0xaa2/0x11f0 drivers/net/ipvlan/ipvlan_core.c:668
ipvlan_start_xmit+0x4a/0x150 drivers/net/ipvlan/ipvlan_main.c:222
__netdev_start_xmit include/linux/netdevice.h:4990 [inline]
netdev_start_xmit include/linux/netdevice.h:5004 [inline]
xmit_one net/core/dev.c:3530 [inline]
dev_hard_start_xmit+0x242/0x770 net/core/dev.c:3546
sch_direct_xmit+0x2b6/0x5f0 net/sched/sch_generic.c:342
qdisc_restart net/sched/sch_generic.c:407 [inline]
__qdisc_run+0xbed/0x2150 net/sched/sch_generic.c:415
qdisc_run+0xda/0x270 include/net/pkt_sched.h:127
net_tx_action+0x877/0xa30 net/core/dev.c:5213
__do_softirq+0x2bb/0x942 kernel/softirq.c:553
The buggy address belongs to the object at ffff888030168000
which belongs to the cache kmalloc-4k of size 4096
The buggy address is located 18 bytes inside of
freed 4096-byte region [ffff888030168000, ffff888030169000)
The buggy address belongs to the physical page:
page:ffffea0000c05a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x30168
head:ffffea0000c05a00 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000840 ffff888014c42140 dead000000000100 dead000000000122
raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4537, tgid 4537 (udevadm), ts 21443201908, free_ts 21411931920
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x1ea/0x210 mm/page_alloc.c:1533
prep_new_page mm/page_alloc.c:1540 [inline]
get_page_from_freelist+0x33ea/0x3580 mm/page_alloc.c:3311
__alloc_pages+0x255/0x680 mm/page_alloc.c:4567
__alloc_pages_node include/linux/gfp.h:238 [inline]
alloc_pages_node include/linux/gfp.h:261 [inline]
alloc_slab_page+0x5f/0x160 mm/slub.c:2190
allocate_slab mm/slub.c:2354 [inline]
new_slab+0x84/0x2f0 mm/slub.c:2407
___slab_alloc+0xd17/0x13e0 mm/slub.c:3540
__slab_alloc mm/slub.c:3625 [inline]
__slab_alloc_node mm/slub.c:3678 [inline]
slab_alloc_node mm/slub.c:3850 [inline]
__do_kmalloc_node mm/slub.c:3980 [inline]
__kmalloc+0x2e0/0x490 mm/slub.c:3994
kmalloc include/linux/slab.h:594 [inline]
tomoyo_realpath_from_path+0xcf/0x5e0 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_check_open_permission+0x255/0x500 security/tomoyo/file.c:771
security_file_open+0x69/0x570 security/security.c:2933
do_dentry_open+0x327/0x15a0 fs/open.c:940
do_open fs/namei.c:3641 [inline]
path_openat+0x285f/0x3240 fs/namei.c:3798
do_filp_open+0x234/0x490 fs/namei.c:3825
do_sys_openat2+0x13e/0x1d0 fs/open.c:1404
do_sys_open fs/open.c:1419 [inline]
__do_sys_openat fs/open.c:1435 [inline]
__se_sys_openat fs/open.c:1430 [inline]
__x64_sys_openat+0x247/0x2a0 fs/open.c:1430
do_syscall_64+0xf9/0x240
page last free pid 4535 tgid 4535 stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1140 [inline]
free_unref_page_prepare+0x968/0xa90 mm/page_alloc.c:2346
free_unref_page+0x37/0x3f0 mm/page_alloc.c:2486
__slab_free+0x349/0x410 mm/slub.c:4211
qlink_free mm/kasan/quarantine.c:160 [inline]
qlist_free_all+0x6d/0xd0 mm/kasan/quarantine.c:176
kasan_quarantine_reduce+0x14f/0x170 mm/kasan/quarantine.c:283
__kasan_slab_alloc+0x23/0x80 mm/kasan/common.c:324
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slub.c:3813 [inline]
slab_alloc_node mm/slub.c:3860 [inline]
kmem_cache_alloc+0x16f/0x340 mm/slub.c:3867
getname_flags+0xbc/0x4f0 fs/namei.c:140
getname fs/namei.c:219 [inline]
__do_sys_symlink fs/namei.c:4527 [inline]
__se_sys_symlink fs/namei.c:4525 [inline]
__x64_sys_symlink+0x5f/0x90 fs/namei.c:4525
do_syscall_64+0xf9/0x240
entry_SYSCALL_64_after_hwframe+0x6f/0x77
Memory state around the buggy address:
ffff888030167f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888030167f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888030168000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888030168080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888030168100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess):
0: 90 nop
1: 90 nop
2: 90 nop
3: 90 nop
4: 90 nop
5: 90 nop
6: 90 nop
7: 90 nop
8: 90 nop
9: 90 nop
a: 65 48 8b 05 a8 59 99 mov %gs:0x749959a8(%rip),%rax # 0x749959ba
11: 74
12: 48 f7 00 08 00 00 00 testq $0x8,(%rax)
19: 75 10 jne 0x2b
1b: 66 90 xchg %ax,%ax
1d: 0f 00 2d d6 ae 9d 00 verw 0x9daed6(%rip) # 0x9daefa
24: f3 0f 1e fa endbr64
28: fb sti
29: f4 hlt
* 2a: fa cli <-- trapping instruction
2b: c3 ret
2c: cc int3
2d: cc int3
2e: cc int3
2f: cc int3
30: 66 2e 0f 1f 84 00 00 cs nopw 0x0(%rax,%rax,1)
37: 00 00 00
3a: 90 nop
3b: 90 nop
3c: 90 nop
3d: 90 nop
3e: 90 nop
3f: 90 nop