================================================================== BUG: KASAN: slab-out-of-bounds in __write_once_size include/linux/compiler.h:295 [inline] BUG: KASAN: slab-out-of-bounds in __hlist_del include/linux/list.h:789 [inline] BUG: KASAN: slab-out-of-bounds in detach_timer kernel/time/timer.c:824 [inline] BUG: KASAN: slab-out-of-bounds in detach_if_pending+0x160/0x360 kernel/time/timer.c:841 Write of size 8 at addr ffff8881d9a431c0 by task kworker/u4:2/103 CPU: 1 PID: 103 Comm: kworker/u4:2 Not tainted 5.4.290-syzkaller-00017-g6b07fcd94a6a #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 Workqueue: netns cleanup_net Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1d8/0x241 lib/dump_stack.c:118 print_address_description+0x8c/0x600 mm/kasan/report.c:384 __kasan_report+0xf3/0x120 mm/kasan/report.c:516 kasan_report+0x30/0x60 mm/kasan/common.c:653 __write_once_size include/linux/compiler.h:295 [inline] __hlist_del include/linux/list.h:789 [inline] detach_timer kernel/time/timer.c:824 [inline] detach_if_pending+0x160/0x360 kernel/time/timer.c:841 del_timer+0xcf/0x140 kernel/time/timer.c:1232 addrconf_del_rs_timer net/ipv6/addrconf.c:305 [inline] addrconf_ifdown+0x640/0x1a90 net/ipv6/addrconf.c:3834 addrconf_notify+0x375/0xe50 net/ipv6/addrconf.c:3698 notifier_call_chain kernel/notifier.c:98 [inline] __raw_notifier_call_chain kernel/notifier.c:399 [inline] raw_notifier_call_chain+0x95/0x110 kernel/notifier.c:406 call_netdevice_notifiers_info net/core/dev.c:1670 [inline] call_netdevice_notifiers_extack net/core/dev.c:1682 [inline] call_netdevice_notifiers net/core/dev.c:1696 [inline] dev_close_many+0x354/0x4f0 net/core/dev.c:1439 rollback_registered_many+0x493/0x1330 net/core/dev.c:8627 unregister_netdevice_many+0x46/0x250 net/core/dev.c:9805 xfrmi_destroy_interfaces net/xfrm/xfrm_interface_core.c:779 [inline] xfrmi_exit_net+0x143/0x190 net/xfrm/xfrm_interface_core.c:787 ops_exit_list net/core/net_namespace.c:182 [inline] cleanup_net+0x665/0xc90 net/core/net_namespace.c:612 process_one_work+0x765/0xd20 kernel/workqueue.c:2290 worker_thread+0xaef/0x1470 kernel/workqueue.c:2436 kthread+0x2da/0x360 kernel/kthread.c:288 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:354 Allocated by task 3565: save_stack mm/kasan/common.c:70 [inline] set_track mm/kasan/common.c:78 [inline] __kasan_kmalloc+0x171/0x210 mm/kasan/common.c:529 slab_post_alloc_hook mm/slab.h:584 [inline] slab_alloc_node mm/slub.c:2829 [inline] slab_alloc mm/slub.c:2837 [inline] kmem_cache_alloc+0xd9/0x250 mm/slub.c:2842 sk_prot_alloc+0x63/0x3e0 net/core/sock.c:1616 sk_alloc+0x35/0x2f0 net/core/sock.c:1680 unix_create1+0x8e/0x590 net/unix/af_unix.c:789 unix_create+0x12c/0x1b0 net/unix/af_unix.c:850 __sock_create+0x3cb/0x7a0 net/socket.c:1427 sock_create net/socket.c:1478 [inline] __sys_socketpair+0x308/0x6e0 net/socket.c:1582 __do_sys_socketpair net/socket.c:1631 [inline] __se_sys_socketpair net/socket.c:1628 [inline] __x64_sys_socketpair+0x97/0xb0 net/socket.c:1628 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x5c/0xc1 Freed by task 3564: save_stack mm/kasan/common.c:70 [inline] set_track mm/kasan/common.c:78 [inline] kasan_set_free_info mm/kasan/common.c:345 [inline] __kasan_slab_free+0x1b5/0x270 mm/kasan/common.c:487 slab_free_hook mm/slub.c:1455 [inline] slab_free_freelist_hook mm/slub.c:1494 [inline] slab_free mm/slub.c:3080 [inline] kmem_cache_free+0x10b/0x2c0 mm/slub.c:3096 sk_prot_free net/core/sock.c:1661 [inline] __sk_destruct+0x460/0x5e0 net/core/sock.c:1749 sock_put include/net/sock.h:1791 [inline] unix_release_sock+0x825/0x9f0 net/unix/af_unix.c:571 unix_release+0x4a/0x80 net/unix/af_unix.c:860 __sock_release net/socket.c:591 [inline] sock_close+0xc7/0x220 net/socket.c:1277 __fput+0x262/0x680 fs/file_table.c:281 task_work_run+0x140/0x170 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_usermode_loop+0x190/0x1a0 arch/x86/entry/common.c:163 prepare_exit_to_usermode+0x199/0x200 arch/x86/entry/common.c:194 entry_SYSCALL_64_after_hwframe+0x5c/0xc1 The buggy address belongs to the object at ffff8881d9a42d00 which belongs to the cache UNIX of size 1152 The buggy address is located 64 bytes to the right of 1152-byte region [ffff8881d9a42d00, ffff8881d9a43180) The buggy address belongs to the page: page:ffffea0007669000 refcount:1 mapcount:0 mapping:ffff8881f55c8000 index:0x0 compound_mapcount: 0 flags: 0x8000000000010200(slab|head) raw: 8000000000010200 dead000000000100 dead000000000122 ffff8881f55c8000 raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL) set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook mm/page_alloc.c:2165 [inline] prep_new_page+0x18f/0x370 mm/page_alloc.c:2171 get_page_from_freelist+0x2d13/0x2d90 mm/page_alloc.c:3794 __alloc_pages_nodemask+0x393/0x840 mm/page_alloc.c:4893 alloc_slab_page+0x39/0x3c0 mm/slub.c:343 allocate_slab mm/slub.c:1683 [inline] new_slab+0x97/0x440 mm/slub.c:1749 new_slab_objects mm/slub.c:2505 [inline] ___slab_alloc+0x2fe/0x490 mm/slub.c:2667 __slab_alloc+0x62/0xa0 mm/slub.c:2707 slab_alloc_node mm/slub.c:2792 [inline] slab_alloc mm/slub.c:2837 [inline] kmem_cache_alloc+0x109/0x250 mm/slub.c:2842 sk_prot_alloc+0x63/0x3e0 net/core/sock.c:1616 sk_alloc+0x35/0x2f0 net/core/sock.c:1680 unix_create1+0x8e/0x590 net/unix/af_unix.c:789 unix_create+0x12c/0x1b0 net/unix/af_unix.c:850 __sock_create+0x3cb/0x7a0 net/socket.c:1427 sock_create net/socket.c:1478 [inline] __sys_socket+0x132/0x370 net/socket.c:1520 __do_sys_socket net/socket.c:1529 [inline] __se_sys_socket net/socket.c:1527 [inline] __x64_sys_socket+0x76/0x80 net/socket.c:1527 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1176 [inline] __free_pages_ok+0x847/0x950 mm/page_alloc.c:1438 free_the_page mm/page_alloc.c:4955 [inline] __free_pages+0x91/0x140 mm/page_alloc.c:4961 netdev_freemem net/core/dev.c:9583 [inline] alloc_netdev_mqs+0x189/0xc70 net/core/dev.c:9701 tun_set_iff+0x51f/0xdc0 drivers/net/tun.c:2893 __tun_chr_ioctl+0x8a9/0x1d00 drivers/net/tun.c:3187 do_vfs_ioctl+0x742/0x1720 fs/ioctl.c:47 ksys_ioctl fs/ioctl.c:742 [inline] __do_sys_ioctl fs/ioctl.c:749 [inline] __se_sys_ioctl fs/ioctl.c:747 [inline] __x64_sys_ioctl+0xd4/0x110 fs/ioctl.c:747 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x5c/0xc1 Memory state around the buggy address: ffff8881d9a43080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8881d9a43100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8881d9a43180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff8881d9a43200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8881d9a43280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================