================================================================== BUG: KASAN: use-after-free in __vunmap+0x322/0x380 mm/vmalloc.c:1535 Read of size 8 at addr ffff8801c1e6b110 by task syz-executor5/7980 CPU: 1 PID: 7980 Comm: syz-executor5 Not tainted 4.16.0-rc2+ #237 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x24d lib/dump_stack.c:53 print_address_description+0x73/0x250 mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report+0x23b/0x360 mm/kasan/report.c:412 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433 __vunmap+0x322/0x380 mm/vmalloc.c:1535 vfree+0x50/0xe0 mm/vmalloc.c:1606 do_replace_finish+0x1c41/0x2620 net/bridge/netfilter/ebtables.c:1062 compat_do_replace+0x5e5/0x7c0 net/bridge/netfilter/ebtables.c:2289 compat_do_ebt_set_ctl+0x22a/0x2d0 net/bridge/netfilter/ebtables.c:2330 compat_nf_sockopt net/netfilter/nf_sockopt.c:144 [inline] compat_nf_setsockopt+0x88/0x130 net/netfilter/nf_sockopt.c:156 compat_ip_setsockopt+0x8b/0xd0 net/ipv4/ip_sockglue.c:1285 inet_csk_compat_setsockopt+0x95/0x120 net/ipv4/inet_connection_sock.c:1041 compat_tcp_setsockopt+0x3d/0x70 net/ipv4/tcp.c:2916 compat_sock_common_setsockopt+0xb2/0x140 net/core/sock.c:2986 C_SYSC_setsockopt net/compat.c:403 [inline] compat_SyS_setsockopt net/compat.c:386 [inline] C_SYSC_socketcall net/compat.c:853 [inline] compat_SyS_socketcall+0xbf7/0x17c0 net/compat.c:788 do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline] do_fast_syscall_32+0x3ec/0xf9f arch/x86/entry/common.c:392 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139 RIP: 0023:0xf7fcbc99 RSP: 002b:000000000844eb30 EFLAGS: 00000202 ORIG_RAX: 0000000000000066 RAX: ffffffffffffffda RBX: 000000000000000e RCX: 000000000844eb4c RDX: 0000000000000001 RSI: 0000000000000000 RDI: 000000000000000e RBP: 0000000000000020 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Allocated by task 15727: save_stack+0x43/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:552 kmem_cache_alloc_trace+0x136/0x740 mm/slab.c:3607 kmalloc include/linux/slab.h:512 [inline] kzalloc include/linux/slab.h:701 [inline] netlbl_secattr_alloc include/net/netlabel.h:396 [inline] selinux_netlbl_sock_genattr+0xb6/0x3d0 security/selinux/netlabel.c:90 selinux_netlbl_socket_post_create+0x6a/0x140 security/selinux/netlabel.c:340 selinux_socket_post_create+0x356/0x970 security/selinux/hooks.c:4399 security_socket_post_create+0x8b/0xc0 security/security.c:1344 __sock_create+0x6a4/0x850 net/socket.c:1301 sock_create net/socket.c:1325 [inline] SYSC_socket net/socket.c:1355 [inline] SyS_socket+0xeb/0x1d0 net/socket.c:1335 C_SYSC_socketcall net/compat.c:813 [inline] compat_SyS_socketcall+0x4cc/0x17c0 net/compat.c:788 do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline] do_fast_syscall_32+0x3ec/0xf9f arch/x86/entry/common.c:392 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139 Freed by task 15727: save_stack+0x43/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] __kasan_slab_free+0x11a/0x170 mm/kasan/kasan.c:520 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:527 __cache_free mm/slab.c:3485 [inline] kfree+0xd9/0x260 mm/slab.c:3800 netlbl_secattr_free include/net/netlabel.h:410 [inline] selinux_netlbl_sk_security_free+0x104/0x2f0 security/selinux/netlabel.c:170 selinux_sk_free_security+0x47/0x60 security/selinux/hooks.c:4907 security_sk_free+0x48/0x80 security/security.c:1431 sk_prot_free net/core/sock.c:1504 [inline] __sk_destruct+0x60f/0x920 net/core/sock.c:1590 sk_destruct+0x47/0x80 net/core/sock.c:1598 __sk_free+0xf1/0x2b0 net/core/sock.c:1609 sk_free+0x2a/0x40 net/core/sock.c:1620 sock_put include/net/sock.h:1658 [inline] tcp_close+0x966/0x1190 net/ipv4/tcp.c:2346 inet_release+0xed/0x1c0 net/ipv4/af_inet.c:427 sock_release+0x8d/0x1e0 net/socket.c:595 sock_close+0x16/0x20 net/socket.c:1149 __fput+0x327/0x7e0 fs/file_table.c:209 ____fput+0x15/0x20 fs/file_table.c:243 task_work_run+0x199/0x270 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:191 [inline] exit_to_usermode_loop+0x275/0x2f0 arch/x86/entry/common.c:166 prepare_exit_to_usermode arch/x86/entry/common.c:196 [inline] syscall_return_slowpath arch/x86/entry/common.c:265 [inline] do_syscall_32_irqs_on arch/x86/entry/common.c:336 [inline] do_fast_syscall_32+0xbe6/0xf9f arch/x86/entry/common.c:392 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139 The buggy address belongs to the object at ffff8801c1e6b100 which belongs to the cache kmalloc-64 of size 64 The buggy address is located 16 bytes inside of 64-byte region [ffff8801c1e6b100, ffff8801c1e6b140) The buggy address belongs to the page: page:ffffea0007079ac0 count:1 mapcount:0 mapping:ffff8801c1e6b000 index:0x0 flags: 0x2fffc0000000100(slab) raw: 02fffc0000000100 ffff8801c1e6b000 0000000000000000 0000000100000020 raw: ffffea0007194fe0 ffffea00068c6b20 ffff8801dac00340 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8801c1e6b000: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff8801c1e6b080: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc >ffff8801c1e6b100: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ^ ffff8801c1e6b180: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff8801c1e6b200: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ==================================================================