==================================================================
BUG: KASAN: use-after-free in tcp_probe_timer net/ipv4/tcp_timer.c:378 [inline]
BUG: KASAN: use-after-free in tcp_write_timer_handler+0x7e2/0x920 net/ipv4/tcp_timer.c:624
Read of size 1 at addr ffff888078a43fc5 by task swapper/1/0
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.1.0-rc1-syzkaller-00427-gd47136c28015 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/11/2022
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e3/0x2cb lib/dump_stack.c:106
print_address_description+0x74/0x340 mm/kasan/report.c:284
print_report+0x107/0x220 mm/kasan/report.c:395
kasan_report+0x139/0x170 mm/kasan/report.c:495
tcp_probe_timer net/ipv4/tcp_timer.c:378 [inline]
tcp_write_timer_handler+0x7e2/0x920 net/ipv4/tcp_timer.c:624
tcp_write_timer+0x176/0x280 net/ipv4/tcp_timer.c:637
call_timer_fn+0xf5/0x210 kernel/time/timer.c:1474
expire_timers kernel/time/timer.c:1519 [inline]
__run_timers+0x76a/0x980 kernel/time/timer.c:1790
run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1803
__do_softirq+0x277/0x75b kernel/softirq.c:571
__irq_exit_rcu+0xec/0x170 kernel/softirq.c:650
irq_exit_rcu+0x5/0x20 kernel/softirq.c:662
sysvec_apic_timer_interrupt+0x91/0xb0 arch/x86/kernel/apic/apic.c:1107
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:cpuidle_enter_state+0x620/0xf50 drivers/cpuidle/cpuidle.c:261
Code: ea 1b fa 4c 21 f3 0f 85 b0 05 00 00 e8 79 e5 1b fa 31 ff e8 e2 a8 0e fa eb 05 e8 6b e5 1b fa e8 26 a9 22 fa fb bf ff ff ff ff <44> 89 fe e8 78 e9 1b fa 45 85 ff 0f 88 9a 01 00 00 44 89 fb bf 0a
RSP: 0018:ffffc90000177ca0 EFLAGS: 00000286
RAX: b2b6f2b2198ef200 RBX: 0000000000000000 RCX: ffff888012391d40
RDX: dffffc0000000000 RSI: 0000000000000000 RDI: 00000000ffffffff
RBP: ffffc90000177db0 R08: ffffffff876dbf18 R09: fffffbfff1c4f036
R10: fffffbfff1c4f036 R11: 1ffffffff1c4f035 R12: dffffc0000000000
R13: 0000000000000000 R14: ffffffff8d4050e0 R15: 0000000000000001
cpuidle_enter+0x59/0x90 drivers/cpuidle/cpuidle.c:356
call_cpuidle kernel/sched/idle.c:155 [inline]
cpuidle_idle_call kernel/sched/idle.c:236 [inline]
do_idle+0x3da/0x680 kernel/sched/idle.c:303
cpu_startup_entry+0x15/0x20 kernel/sched/idle.c:400
start_secondary+0xe4/0xf0 arch/x86/kernel/smpboot.c:262
secondary_startup_64_no_verify+0xcf/0xdb
Allocated by task 8207:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4c/0x70 mm/kasan/common.c:52
__kasan_slab_alloc+0x65/0x70 mm/kasan/common.c:325
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slab.h:737 [inline]
slab_alloc_node mm/slub.c:3398 [inline]
slab_alloc mm/slub.c:3406 [inline]
__kmem_cache_alloc_lru mm/slub.c:3413 [inline]
kmem_cache_alloc+0x1cc/0x300 mm/slub.c:3422
kmem_cache_zalloc include/linux/slab.h:702 [inline]
net_alloc net/core/net_namespace.c:403 [inline]
copy_net_ns+0x13c/0x5b0 net/core/net_namespace.c:458
create_new_namespaces+0x4db/0x8e0 kernel/nsproxy.c:110
unshare_nsproxy_namespaces+0x11e/0x180 kernel/nsproxy.c:226
ksys_unshare+0x57f/0xb30 kernel/fork.c:3188
__do_sys_unshare kernel/fork.c:3259 [inline]
__se_sys_unshare kernel/fork.c:3257 [inline]
__x64_sys_unshare+0x34/0x40 kernel/fork.c:3257
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Freed by task 4231:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4c/0x70 mm/kasan/common.c:52
kasan_save_free_info+0x27/0x40 mm/kasan/generic.c:511
____kasan_slab_free+0xd6/0x120 mm/kasan/common.c:236
kasan_slab_free include/linux/kasan.h:177 [inline]
slab_free_hook mm/slub.c:1724 [inline]
slab_free_freelist_hook+0x12e/0x1a0 mm/slub.c:1750
slab_free mm/slub.c:3661 [inline]
kmem_cache_free+0x94/0x1d0 mm/slub.c:3683
net_free net/core/net_namespace.c:432 [inline]
cleanup_net+0xb8b/0xc50 net/core/net_namespace.c:615
process_one_work+0x81c/0xd10 kernel/workqueue.c:2289
worker_thread+0xb14/0x1330 kernel/workqueue.c:2436
kthread+0x266/0x300 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
The buggy address belongs to the object at ffff888078a43880
which belongs to the cache net_namespace of size 6976
The buggy address is located 1861 bytes inside of
6976-byte region [ffff888078a43880, ffff888078a453c0)
The buggy address belongs to the physical page:
page:ffffea0001e29000 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78a40
head:ffffea0001e29000 order:3 compound_mapcount:0 compound_pincount:0
memcg:ffff88807ce90701
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 0000000000000000 dead000000000001 ffff8880121d5640
raw: 0000000000000000 0000000080040004 00000001ffffffff ffff88807ce90701
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3639, tgid 3639 (syz-executor.5), ts 328263763316, free_ts 328237734982
prep_new_page mm/page_alloc.c:2538 [inline]
get_page_from_freelist+0x72b/0x7a0 mm/page_alloc.c:4287
__alloc_pages+0x259/0x560 mm/page_alloc.c:5554
alloc_slab_page+0x70/0xf0 mm/slub.c:1794
allocate_slab+0x5e/0x4b0 mm/slub.c:1939
new_slab mm/slub.c:1992 [inline]
___slab_alloc+0x7f4/0xeb0 mm/slub.c:3180
__slab_alloc mm/slub.c:3279 [inline]
slab_alloc_node mm/slub.c:3364 [inline]
slab_alloc mm/slub.c:3406 [inline]
__kmem_cache_alloc_lru mm/slub.c:3413 [inline]
kmem_cache_alloc+0x24c/0x300 mm/slub.c:3422
kmem_cache_zalloc include/linux/slab.h:702 [inline]
net_alloc net/core/net_namespace.c:403 [inline]
copy_net_ns+0x13c/0x5b0 net/core/net_namespace.c:458
create_new_namespaces+0x4db/0x8e0 kernel/nsproxy.c:110
unshare_nsproxy_namespaces+0x11e/0x180 kernel/nsproxy.c:226
ksys_unshare+0x57f/0xb30 kernel/fork.c:3188
__do_sys_unshare kernel/fork.c:3259 [inline]
__se_sys_unshare kernel/fork.c:3257 [inline]
__x64_sys_unshare+0x34/0x40 kernel/fork.c:3257
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1458 [inline]
free_pcp_prepare+0x80c/0x8f0 mm/page_alloc.c:1508
free_unref_page_prepare mm/page_alloc.c:3386 [inline]
free_unref_page+0x7d/0x630 mm/page_alloc.c:3482
free_slab mm/slub.c:2031 [inline]
discard_slab mm/slub.c:2037 [inline]
__unfreeze_partials+0x1ab/0x200 mm/slub.c:2586
put_cpu_partial+0x116/0x180 mm/slub.c:2662
qlist_free_all+0x2b/0x70 mm/kasan/quarantine.c:187
kasan_quarantine_reduce+0x169/0x180 mm/kasan/quarantine.c:294
__kasan_slab_alloc+0x1f/0x70 mm/kasan/common.c:302
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook mm/slab.h:737 [inline]
slab_alloc_node mm/slub.c:3398 [inline]
__kmem_cache_alloc_node+0x1d7/0x310 mm/slub.c:3437
__do_kmalloc_node mm/slab_common.c:954 [inline]
__kmalloc_node+0x9e/0x190 mm/slab_common.c:962
kmalloc_node include/linux/slab.h:602 [inline]
kvmalloc_node+0x6e/0x180 mm/util.c:581
kvmalloc include/linux/slab.h:729 [inline]
kvzalloc include/linux/slab.h:737 [inline]
proc_sys_call_handler+0x3d5/0x880 fs/proc/proc_sysctl.c:587
call_write_iter include/linux/fs.h:2191 [inline]
new_sync_write fs/read_write.c:491 [inline]
vfs_write+0x7b5/0xbb0 fs/read_write.c:584
ksys_write+0x19b/0x2c0 fs/read_write.c:637
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Memory state around the buggy address:
ffff888078a43e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888078a43f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888078a43f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888078a44000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888078a44080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 1b fa sbb %edx,%edi
2: 4c 21 f3 and %r14,%rbx
5: 0f 85 b0 05 00 00 jne 0x5bb
b: e8 79 e5 1b fa callq 0xfa1be589
10: 31 ff xor %edi,%edi
12: e8 e2 a8 0e fa callq 0xfa0ea8f9
17: eb 05 jmp 0x1e
19: e8 6b e5 1b fa callq 0xfa1be589
1e: e8 26 a9 22 fa callq 0xfa22a949
23: fb sti
24: bf ff ff ff ff mov $0xffffffff,%edi
* 29: 44 89 fe mov %r15d,%esi <-- trapping instruction
2c: e8 78 e9 1b fa callq 0xfa1be9a9
31: 45 85 ff test %r15d,%r15d
34: 0f 88 9a 01 00 00 js 0x1d4
3a: 44 89 fb mov %r15d,%ebx
3d: bf .byte 0xbf
3e: 0a .byte 0xa