netlink: 4 bytes leftover after parsing attributes in process `syz-executor.5'. BUG: sleeping function called from invalid context at drivers/tty/vt/vt.c:2245 in_atomic(): 1, irqs_disabled(): 1, pid: 9723, name: syz-executor.4 3 locks held by syz-executor.4/9723: #0: (&tty->ldisc_sem){++++}, at: [] tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:284 #1: (&(&gsm->control_lock)->rlock){....}, at: [] gsm_control_send+0xf6/0x480 drivers/tty/n_gsm.c:1434 #2: (&(&gsm->tx_lock)->rlock){....}, at: [] gsm_data_queue drivers/tty/n_gsm.c:845 [inline] #2: (&(&gsm->tx_lock)->rlock){....}, at: [] gsm_control_transmit+0x1f1/0x2d0 drivers/tty/n_gsm.c:1375 irq event stamp: 24 hardirqs last enabled at (23): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] hardirqs last enabled at (23): [] _raw_spin_unlock_irqrestore+0x79/0xe0 kernel/locking/spinlock.c:192 hardirqs last disabled at (24): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (24): [] _raw_spin_lock_irqsave+0x66/0xc0 kernel/locking/spinlock.c:160 softirqs last enabled at (0): [] copy_process.part.0+0x12d0/0x71c0 kernel/fork.c:1734 softirqs last disabled at (0): [< (null)>] (null) Preemption disabled at: [< (null)>] (null) CPU: 0 PID: 9723 Comm: syz-executor.4 Not tainted 4.14.304-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x281 lib/dump_stack.c:58 ___might_sleep.cold+0x235/0x250 kernel/sched/core.c:6041 do_con_write+0xd0/0x19b0 drivers/tty/vt/vt.c:2245 con_write+0x21/0xa0 drivers/tty/vt/vt.c:2822 gsmld_output+0xc3/0x190 drivers/tty/n_gsm.c:2312 gsm_data_kick+0x266/0x9b0 drivers/tty/n_gsm.c:761 gsm_data_queue drivers/tty/n_gsm.c:846 [inline] gsm_control_transmit+0x1ff/0x2d0 drivers/tty/n_gsm.c:1375 gsm_control_send+0x38a/0x480 drivers/tty/n_gsm.c:1451 gsm_disconnect drivers/tty/n_gsm.c:2110 [inline] gsmld_config.constprop.0+0x568/0xf90 drivers/tty/n_gsm.c:2636 gsmld_ioctl+0x375/0x410 drivers/tty/n_gsm.c:2700 tty_ioctl+0x5af/0x1430 drivers/tty/tty_io.c:2670 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:500 [inline] do_vfs_ioctl+0x75a/0xff0 fs/ioctl.c:684 SYSC_ioctl fs/ioctl.c:701 [inline] SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x5e/0xd3 RIP: 0033:0x7f14991e10c9 RSP: 002b:00007f1497732168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f1499301050 RCX: 00007f14991e10c9 RDX: 0000000020000040 RSI: 00000000404c4701 RDI: 0000000000000003 RBP: 00007f149923cae9 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffee37d88df R14: 00007f1497732300 R15: 0000000000022000 ======================================================== WARNING: possible irq lock inversion dependency detected 4.14.304-syzkaller #0 Tainted: G W -------------------------------------------------------- syz-executor.4/9723 just changed the state of lock: (&(&gsm->control_lock)->rlock){..-.}, at: [] gsm_control_retransmit+0x25/0x2c0 drivers/tty/n_gsm.c:1394 but this lock took another, SOFTIRQ-unsafe lock in the past: (console_lock){+.+.} and interrupts could create inverse lock ordering between them. other info that might help us debug this: Chain exists of: &(&gsm->control_lock)->rlock --> &(&gsm->tx_lock)->rlock --> console_lock Possible interrupt unsafe locking scenario: CPU0 CPU1 ---- ---- lock(console_lock); local_irq_disable(); lock(&(&gsm->control_lock)->rlock); lock(&(&gsm->tx_lock)->rlock); lock(&(&gsm->control_lock)->rlock); *** DEADLOCK *** 2 locks held by syz-executor.4/9723: #0: (&tty->ldisc_sem){++++}, at: [] tty_ldisc_ref_wait+0x22/0x80 drivers/tty/tty_ldisc.c:284 #1: (((&gsm->t2_timer))){+.-.}, at: [] lockdep_copy_map include/linux/lockdep.h:174 [inline] #1: (((&gsm->t2_timer))){+.-.}, at: [] call_timer_fn+0xb8/0x650 kernel/time/timer.c:1270 the shortest dependencies between 2nd lock and 1st lock: -> (console_lock){+.+.} ops: 4968 { HARDIRQ-ON-W at: lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 console_lock+0x42/0x70 kernel/printk/printk.c:2228 con_init+0x12/0x5d6 drivers/tty/vt/vt.c:3022 console_init+0x46/0x53 kernel/printk/printk.c:2809 start_kernel+0x521/0x763 init/main.c:638 secondary_startup_64+0xa5/0xb0 arch/x86/kernel/head_64.S:240 SOFTIRQ-ON-W at: lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 console_lock+0x42/0x70 kernel/printk/printk.c:2228 con_init+0x12/0x5d6 drivers/tty/vt/vt.c:3022 console_init+0x46/0x53 kernel/printk/printk.c:2809 start_kernel+0x521/0x763 init/main.c:638 secondary_startup_64+0xa5/0xb0 arch/x86/kernel/head_64.S:240 INITIAL USE at: } ... key at: [] console_lock_dep_map+0x0/0x40 ... acquired at: console_lock+0x42/0x70 kernel/printk/printk.c:2228 do_con_write+0xd5/0x19b0 drivers/tty/vt/vt.c:2247 con_write+0x21/0xa0 drivers/tty/vt/vt.c:2822 gsmld_output+0xc3/0x190 drivers/tty/n_gsm.c:2312 gsm_data_kick+0x266/0x9b0 drivers/tty/n_gsm.c:761 gsm_data_queue drivers/tty/n_gsm.c:846 [inline] gsm_control_transmit+0x1ff/0x2d0 drivers/tty/n_gsm.c:1375 gsm_control_send+0x38a/0x480 drivers/tty/n_gsm.c:1451 gsm_disconnect drivers/tty/n_gsm.c:2110 [inline] gsmld_config.constprop.0+0x568/0xf90 drivers/tty/n_gsm.c:2636 gsmld_ioctl+0x375/0x410 drivers/tty/n_gsm.c:2700 tty_ioctl+0x5af/0x1430 drivers/tty/tty_io.c:2670 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:500 [inline] do_vfs_ioctl+0x75a/0xff0 fs/ioctl.c:684 SYSC_ioctl fs/ioctl.c:701 [inline] SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x5e/0xd3 -> (&(&gsm->tx_lock)->rlock){....} ops: 1 { INITIAL USE at: lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:160 gsm_data_queue drivers/tty/n_gsm.c:845 [inline] gsm_control_transmit+0x1f1/0x2d0 drivers/tty/n_gsm.c:1375 gsm_control_send+0x38a/0x480 drivers/tty/n_gsm.c:1451 gsm_disconnect drivers/tty/n_gsm.c:2110 [inline] gsmld_config.constprop.0+0x568/0xf90 drivers/tty/n_gsm.c:2636 gsmld_ioctl+0x375/0x410 drivers/tty/n_gsm.c:2700 tty_ioctl+0x5af/0x1430 drivers/tty/tty_io.c:2670 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:500 [inline] do_vfs_ioctl+0x75a/0xff0 fs/ioctl.c:684 SYSC_ioctl fs/ioctl.c:701 [inline] SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x5e/0xd3 } ... key at: [] __key.4+0x0/0x40 ... acquired at: __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:160 gsm_data_queue drivers/tty/n_gsm.c:845 [inline] gsm_control_transmit+0x1f1/0x2d0 drivers/tty/n_gsm.c:1375 gsm_control_send+0x38a/0x480 drivers/tty/n_gsm.c:1451 gsm_disconnect drivers/tty/n_gsm.c:2110 [inline] gsmld_config.constprop.0+0x568/0xf90 drivers/tty/n_gsm.c:2636 gsmld_ioctl+0x375/0x410 drivers/tty/n_gsm.c:2700 tty_ioctl+0x5af/0x1430 drivers/tty/tty_io.c:2670 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:500 [inline] do_vfs_ioctl+0x75a/0xff0 fs/ioctl.c:684 SYSC_ioctl fs/ioctl.c:701 [inline] SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x5e/0xd3 -> (&(&gsm->control_lock)->rlock){..-.} ops: 2 { IN-SOFTIRQ-W at: lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:160 gsm_control_retransmit+0x25/0x2c0 drivers/tty/n_gsm.c:1394 call_timer_fn+0x14a/0x650 kernel/time/timer.c:1280 expire_timers+0x232/0x4d0 kernel/time/timer.c:1319 __run_timers kernel/time/timer.c:1637 [inline] run_timer_softirq+0x1d5/0x5a0 kernel/time/timer.c:1650 __do_softirq+0x24d/0x9ff kernel/softirq.c:288 invoke_softirq kernel/softirq.c:368 [inline] irq_exit+0x193/0x240 kernel/softirq.c:409 exiting_irq arch/x86/include/asm/apic.h:638 [inline] smp_apic_timer_interrupt+0x141/0x5e0 arch/x86/kernel/apic/apic.c:1106 apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:796 arch_local_irq_restore arch/x86/include/asm/paravirt.h:779 [inline] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] _raw_spin_unlock_irqrestore+0xa3/0xe0 kernel/locking/spinlock.c:192 spin_unlock_irqrestore include/linux/spinlock.h:372 [inline] gsm_control_send+0x395/0x480 drivers/tty/n_gsm.c:1452 gsm_disconnect drivers/tty/n_gsm.c:2110 [inline] gsmld_config.constprop.0+0x568/0xf90 drivers/tty/n_gsm.c:2636 gsmld_ioctl+0x375/0x410 drivers/tty/n_gsm.c:2700 tty_ioctl+0x5af/0x1430 drivers/tty/tty_io.c:2670 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:500 [inline] do_vfs_ioctl+0x75a/0xff0 fs/ioctl.c:684 SYSC_ioctl fs/ioctl.c:701 [inline] SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x5e/0xd3 INITIAL USE at: lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:160 gsm_control_send+0xf6/0x480 drivers/tty/n_gsm.c:1434 gsm_disconnect drivers/tty/n_gsm.c:2110 [inline] gsmld_config.constprop.0+0x568/0xf90 drivers/tty/n_gsm.c:2636 gsmld_ioctl+0x375/0x410 drivers/tty/n_gsm.c:2700 tty_ioctl+0x5af/0x1430 drivers/tty/tty_io.c:2670 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:500 [inline] do_vfs_ioctl+0x75a/0xff0 fs/ioctl.c:684 SYSC_ioctl fs/ioctl.c:701 [inline] SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x5e/0xd3 } ... key at: [] __key.5+0x0/0x40 ... acquired at: mark_lock_irq kernel/locking/lockdep.c:2804 [inline] mark_lock+0x3c7/0x1050 kernel/locking/lockdep.c:3194 mark_irqflags kernel/locking/lockdep.c:3072 [inline] __lock_acquire+0xc81/0x3f20 kernel/locking/lockdep.c:3448 lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:160 gsm_control_retransmit+0x25/0x2c0 drivers/tty/n_gsm.c:1394 call_timer_fn+0x14a/0x650 kernel/time/timer.c:1280 expire_timers+0x232/0x4d0 kernel/time/timer.c:1319 __run_timers kernel/time/timer.c:1637 [inline] run_timer_softirq+0x1d5/0x5a0 kernel/time/timer.c:1650 __do_softirq+0x24d/0x9ff kernel/softirq.c:288 invoke_softirq kernel/softirq.c:368 [inline] irq_exit+0x193/0x240 kernel/softirq.c:409 exiting_irq arch/x86/include/asm/apic.h:638 [inline] smp_apic_timer_interrupt+0x141/0x5e0 arch/x86/kernel/apic/apic.c:1106 apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:796 arch_local_irq_restore arch/x86/include/asm/paravirt.h:779 [inline] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] _raw_spin_unlock_irqrestore+0xa3/0xe0 kernel/locking/spinlock.c:192 spin_unlock_irqrestore include/linux/spinlock.h:372 [inline] gsm_control_send+0x395/0x480 drivers/tty/n_gsm.c:1452 gsm_disconnect drivers/tty/n_gsm.c:2110 [inline] gsmld_config.constprop.0+0x568/0xf90 drivers/tty/n_gsm.c:2636 gsmld_ioctl+0x375/0x410 drivers/tty/n_gsm.c:2700 tty_ioctl+0x5af/0x1430 drivers/tty/tty_io.c:2670 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:500 [inline] do_vfs_ioctl+0x75a/0xff0 fs/ioctl.c:684 SYSC_ioctl fs/ioctl.c:701 [inline] SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x5e/0xd3 stack backtrace: CPU: 0 PID: 9723 Comm: syz-executor.4 Tainted: G W 4.14.304-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x281 lib/dump_stack.c:58 print_irq_inversion_bug.cold+0x313/0x346 kernel/locking/lockdep.c:2670 check_usage_forwards+0x18f/0x2d0 kernel/locking/lockdep.c:2695 mark_lock_irq kernel/locking/lockdep.c:2804 [inline] mark_lock+0x3c7/0x1050 kernel/locking/lockdep.c:3194 mark_irqflags kernel/locking/lockdep.c:3072 [inline] __lock_acquire+0xc81/0x3f20 kernel/locking/lockdep.c:3448 lock_acquire+0x170/0x3f0 kernel/locking/lockdep.c:3998 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x8c/0xc0 kernel/locking/spinlock.c:160 gsm_control_retransmit+0x25/0x2c0 drivers/tty/n_gsm.c:1394 call_timer_fn+0x14a/0x650 kernel/time/timer.c:1280 expire_timers+0x232/0x4d0 kernel/time/timer.c:1319 __run_timers kernel/time/timer.c:1637 [inline] run_timer_softirq+0x1d5/0x5a0 kernel/time/timer.c:1650 __do_softirq+0x24d/0x9ff kernel/softirq.c:288 invoke_softirq kernel/softirq.c:368 [inline] irq_exit+0x193/0x240 kernel/softirq.c:409 exiting_irq arch/x86/include/asm/apic.h:638 [inline] smp_apic_timer_interrupt+0x141/0x5e0 arch/x86/kernel/apic/apic.c:1106 apic_timer_interrupt+0x93/0xa0 arch/x86/entry/entry_64.S:796 RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:779 [inline] RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] RIP: 0010:_raw_spin_unlock_irqrestore+0xa3/0xe0 kernel/locking/spinlock.c:192 RSP: 0018:ffff8880434cf940 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff10 RAX: 1ffffffff11e13d9 RBX: 0000000000000282 RCX: 1ffff11013aec52d RDX: dffffc0000000000 RSI: ffff88809d762948 RDI: 0000000000000282 RBP: ffff8880a2cbf160 R08: ffffffff8ba3e2bc R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000282 R13: 0000000000000003 R14: ffff8880a2cbee08 R15: ffff8880a2cbf160 spin_unlock_irqrestore include/linux/spinlock.h:372 [inline] gsm_control_send+0x395/0x480 drivers/tty/n_gsm.c:1452 gsm_disconnect drivers/tty/n_gsm.c:2110 [inline] gsmld_config.constprop.0+0x568/0xf90 drivers/tty/n_gsm.c:2636 gsmld_ioctl+0x375/0x410 drivers/tty/n_gsm.c:2700 tty_ioctl+0x5af/0x1430 drivers/tty/tty_io.c:2670 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:500 [inline] do_vfs_ioctl+0x75a/0xff0 fs/ioctl.c:684 SYSC_ioctl fs/ioctl.c:701 [inline] SyS_ioctl+0x7f/0xb0 fs/ioctl.c:692 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x5e/0xd3 RIP: 0033:0x7f14991e10c9 RSP: 002b:00007f1497732168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f1499301050 RCX: 00007f14991e10c9 RDX: 0000000020000040 RSI: 00000000404c4701 RDI: 0000000000000003 RBP: 00007f149923cae9 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffee37d88df R14: 00007f1497732300 R15: 0000000000022000 hrtimer: interrupt took 26684 ns overlayfs: fs on 'file0' does not support file handles, falling back to index=off. L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. overlayfs: fs on './file0' does not support file handles, falling back to index=off. audit: type=1800 audit(1675618090.359:2): pid=10018 uid=0 auid=4294967295 ses=4294967295 op="collect_data" cause="failed(directio)" comm="syz-executor.2" name="file0" dev="sda1" ino=13917 res=0 audit: type=1804 audit(1675618090.359:3): pid=10018 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="open_writers" comm="syz-executor.2" name="/root/syzkaller-testdir647730475/syzkaller.eUZiFF/27/file0" dev="sda1" ino=13917 res=1 audit: type=1804 audit(1675618090.469:4): pid=10045 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="open_writers" comm="syz-executor.2" name="/root/syzkaller-testdir647730475/syzkaller.eUZiFF/28/file0" dev="sda1" ino=13916 res=1 audit: type=1800 audit(1675618091.109:5): pid=10091 uid=0 auid=4294967295 ses=4294967295 op="collect_data" cause="failed(directio)" comm="syz-executor.2" name="file0" dev="sda1" ino=13844 res=0 audit: type=1804 audit(1675618091.139:6): pid=10091 uid=0 auid=4294967295 ses=4294967295 op="invalid_pcr" cause="open_writers" comm="syz-executor.2" name="/root/syzkaller-testdir647730475/syzkaller.eUZiFF/29/file0" dev="sda1" ino=13844 res=1 ================================================================== BUG: KASAN: slab-out-of-bounds in tipc_nametbl_lookup_dst_nodes+0x44c/0x4c0 net/tipc/name_table.c:670 Read of size 4 at addr ffff88809d23f950 by task syz-executor.4/10192 CPU: 0 PID: 10192 Comm: syz-executor.4 Tainted: G W 4.14.304-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x1b2/0x281 lib/dump_stack.c:58 print_address_description.cold+0x54/0x1d3 mm/kasan/report.c:252 kasan_report_error.cold+0x8a/0x191 mm/kasan/report.c:351 kasan_report mm/kasan/report.c:409 [inline] __asan_report_load4_noabort+0x68/0x70 mm/kasan/report.c:429 tipc_nametbl_lookup_dst_nodes+0x44c/0x4c0 net/tipc/name_table.c:670 tipc_sendmcast+0x51a/0xac0 net/tipc/socket.c:768 __tipc_sendmsg+0xbab/0xf90 net/tipc/socket.c:975 tipc_sendmsg+0x4c/0x70 net/tipc/socket.c:923 sock_sendmsg_nosec net/socket.c:646 [inline] sock_sendmsg+0xb5/0x100 net/socket.c:656 ___sys_sendmsg+0x6c8/0x800 net/socket.c:2062 __sys_sendmsg+0xa3/0x120 net/socket.c:2096 SYSC_sendmsg net/socket.c:2107 [inline] SyS_sendmsg+0x27/0x40 net/socket.c:2103 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x5e/0xd3 RIP: 0033:0x7f14991e10c9 RSP: 002b:00007f1497753168 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f1499300f80 RCX: 00007f14991e10c9 RDX: 0000000000000000 RSI: 0000000020002640 RDI: 0000000000000003 RBP: 00007f149923cae9 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007ffee37d88df R14: 00007f1497753300 R15: 0000000000022000 Allocated by task 8017: save_stack mm/kasan/kasan.c:447 [inline] set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc+0xeb/0x160 mm/kasan/kasan.c:551 __do_kmalloc mm/slab.c:3720 [inline] __kmalloc+0x15a/0x400 mm/slab.c:3729 tipc_nameseq_create+0x53/0x290 net/tipc/name_table.c:152 tipc_nametbl_insert_publ+0xb37/0x14e0 net/tipc/name_table.c:476 tipc_nametbl_publish+0x211/0x3f0 net/tipc/name_table.c:701 tipc_sk_publish net/tipc/socket.c:2206 [inline] tipc_bind+0x2c4/0x600 net/tipc/socket.c:630 tipc_create_listen_sock net/tipc/server.c:338 [inline] tipc_open_listening_sock net/tipc/server.c:396 [inline] tipc_server_start+0x31f/0x880 net/tipc/server.c:611 tipc_topsrv_start net/tipc/subscr.c:382 [inline] tipc_topsrv_init_net+0x53b/0x730 net/tipc/subscr.c:397 ops_init+0xaa/0x3e0 net/core/net_namespace.c:118 setup_net+0x22f/0x530 net/core/net_namespace.c:298 copy_net_ns+0x19b/0x440 net/core/net_namespace.c:422 create_new_namespaces+0x375/0x720 kernel/nsproxy.c:107 unshare_nsproxy_namespaces+0xa1/0x1d0 kernel/nsproxy.c:206 SYSC_unshare kernel/fork.c:2413 [inline] SyS_unshare+0x308/0x7f0 kernel/fork.c:2363 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x5e/0xd3 Freed by task 7950: save_stack mm/kasan/kasan.c:447 [inline] set_track mm/kasan/kasan.c:459 [inline] kasan_slab_free+0xc3/0x1a0 mm/kasan/kasan.c:524 __cache_free mm/slab.c:3496 [inline] kfree+0xc9/0x250 mm/slab.c:3815 aa_free_task_context+0xda/0x130 security/apparmor/context.c:54 apparmor_cred_free+0x34/0x70 security/apparmor/lsm.c:58 security_cred_free+0x71/0xb0 security/security.c:1003 put_cred_rcu+0xe3/0x300 kernel/cred.c:117 __put_cred+0x1a1/0x210 kernel/cred.c:151 put_cred include/linux/cred.h:274 [inline] SYSC_faccessat fs/open.c:444 [inline] SyS_faccessat+0x52a/0x680 fs/open.c:353 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x5e/0xd3 The buggy address belongs to the object at ffff88809d23f940 which belongs to the cache kmalloc-32 of size 32 The buggy address is located 16 bytes inside of 32-byte region [ffff88809d23f940, ffff88809d23f960) The buggy address belongs to the page: page:ffffea0002748fc0 count:1 mapcount:0 mapping:ffff88809d23f000 index:0xffff88809d23ffc1 flags: 0xfff00000000100(slab) raw: 00fff00000000100 ffff88809d23f000 ffff88809d23ffc1 0000000100000037 raw: ffffea0002c01ae0 ffffea000267f820 ffff88813fe741c0 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88809d23f800: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc ffff88809d23f880: 05 fc fc fc fc fc fc fc fb fb fb fb fc fc fc fc >ffff88809d23f900: fb fb fb fb fc fc fc fc 00 00 fc fc fc fc fc fc ^ ffff88809d23f980: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc ffff88809d23fa00: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc ==================================================================