batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_1 bridge0: port 2(bridge_slave_1) entered disabled state bridge0: port 1(bridge_slave_0) entered disabled state ================================================================== BUG: KASAN: use-after-free in u32_clear_hnode+0x386/0x420 net/sched/cls_u32.c:590 Read of size 8 at addr ffff8880a878d730 by task kworker/u4:5/7626 CPU: 1 PID: 7626 Comm: kworker/u4:5 Not tainted 4.14.172-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: netns cleanup_net Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x13e/0x194 lib/dump_stack.c:58 print_address_description.cold+0x7c/0x1e2 mm/kasan/report.c:252 kasan_report_error mm/kasan/report.c:351 [inline] kasan_report mm/kasan/report.c:409 [inline] kasan_report.cold+0xa9/0x2ae mm/kasan/report.c:393 u32_clear_hnode+0x386/0x420 net/sched/cls_u32.c:590 u32_destroy+0x228/0x460 net/sched/cls_u32.c:655 tcf_proto_destroy+0x4f/0xd0 net/sched/cls_api.c:180 tcf_chain_flush+0x120/0x270 net/sched/cls_api.c:208 tcf_block_put+0xd0/0x2b0 net/sched/cls_api.c:302 hfsc_destroy_qdisc+0xd7/0x260 net/sched/sch_hfsc.c:1504 qdisc_destroy+0x13c/0x310 net/sched/sch_generic.c:725 dev_shutdown+0x27d/0x42d net/sched/sch_generic.c:1000 rollback_registered_many+0x684/0xa70 net/core/dev.c:7199 unregister_netdevice_many.part.0+0x16/0x1d0 net/core/dev.c:8278 unregister_netdevice_many net/core/dev.c:8277 [inline] default_device_exit_batch+0x2dd/0x380 net/core/dev.c:8739 ops_exit_list.isra.0+0xef/0x140 net/core/net_namespace.c:145 cleanup_net+0x3bb/0x820 net/core/net_namespace.c:484 process_one_work+0x813/0x1540 kernel/workqueue.c:2114 worker_thread+0x5d1/0x1070 kernel/workqueue.c:2248 kthread+0x30d/0x420 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 Allocated by task 15186: save_stack+0x32/0xa0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc mm/kasan/kasan.c:551 [inline] kasan_kmalloc+0xbf/0xe0 mm/kasan/kasan.c:529 kmem_cache_alloc_trace+0x14d/0x7b0 mm/slab.c:3618 kmalloc include/linux/slab.h:488 [inline] kzalloc include/linux/slab.h:661 [inline] u32_init+0x3e9/0x910 net/sched/cls_u32.c:367 tcf_proto_create net/sched/cls_api.c:166 [inline] tc_ctl_tfilter+0xa68/0x18e6 net/sched/cls_api.c:677 rtnetlink_rcv_msg+0x3be/0xb10 net/core/rtnetlink.c:4315 netlink_rcv_skb+0x127/0x370 net/netlink/af_netlink.c:2432 netlink_unicast_kernel net/netlink/af_netlink.c:1286 [inline] netlink_unicast+0x437/0x620 net/netlink/af_netlink.c:1312 netlink_sendmsg+0x733/0xbe0 net/netlink/af_netlink.c:1877 sock_sendmsg_nosec net/socket.c:646 [inline] sock_sendmsg+0xc5/0x100 net/socket.c:656 ___sys_sendmsg+0x70a/0x840 net/socket.c:2062 __sys_sendmsg+0xa3/0x120 net/socket.c:2096 SYSC_sendmsg net/socket.c:2107 [inline] SyS_sendmsg+0x27/0x40 net/socket.c:2103 do_syscall_64+0x1d5/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 Freed by task 7626: save_stack+0x32/0xa0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_slab_free+0x75/0xc0 mm/kasan/kasan.c:524 __cache_free mm/slab.c:3496 [inline] kfree+0xcb/0x260 mm/slab.c:3815 u32_destroy_key.constprop.0+0xfd/0x1e0 net/sched/cls_u32.c:406 u32_clear_hnode+0x2e7/0x420 net/sched/cls_u32.c:598 u32_destroy+0x228/0x460 net/sched/cls_u32.c:655 tcf_proto_destroy+0x4f/0xd0 net/sched/cls_api.c:180 tcf_chain_flush+0x120/0x270 net/sched/cls_api.c:208 tcf_block_put+0xd0/0x2b0 net/sched/cls_api.c:302 hfsc_destroy_qdisc+0xd7/0x260 net/sched/sch_hfsc.c:1504 qdisc_destroy+0x13c/0x310 net/sched/sch_generic.c:725 dev_shutdown+0x27d/0x42d net/sched/sch_generic.c:1000 rollback_registered_many+0x684/0xa70 net/core/dev.c:7199 unregister_netdevice_many.part.0+0x16/0x1d0 net/core/dev.c:8278 unregister_netdevice_many net/core/dev.c:8277 [inline] default_device_exit_batch+0x2dd/0x380 net/core/dev.c:8739 ops_exit_list.isra.0+0xef/0x140 net/core/net_namespace.c:145 cleanup_net+0x3bb/0x820 net/core/net_namespace.c:484 process_one_work+0x813/0x1540 kernel/workqueue.c:2114 worker_thread+0x5d1/0x1070 kernel/workqueue.c:2248 kthread+0x30d/0x420 kernel/kthread.c:232 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 The buggy address belongs to the object at ffff8880a878d700 which belongs to the cache kmalloc-64 of size 64 The buggy address is located 48 bytes inside of 64-byte region [ffff8880a878d700, ffff8880a878d740) The buggy address belongs to the page: page:ffffea0002a1e340 count:1 mapcount:0 mapping:ffff8880a878d000 index:0x0 flags: 0xfffe0000000100(slab) raw: 00fffe0000000100 ffff8880a878d000 0000000000000000 0000000100000020 raw: ffffea00022c0220 ffffea0002a41360 ffff88812fe56340 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880a878d600: 00 00 00 00 00 00 00 06 fc fc fc fc fc fc fc fc ffff8880a878d680: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc >ffff8880a878d700: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ^ ffff8880a878d780: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff8880a878d800: 00 00 00 00 00 00 00 06 fc fc fc fc fc fc fc fc ==================================================================