================================================================== BUG: KASAN: use-after-free in do_shrink_slab+0xbe6/0xce0 mm/vmscan.c:785 Read of size 8 at addr ffff88802549d5b8 by task syz-fuzzer/3663 CPU: 1 PID: 3663 Comm: syz-fuzzer Not tainted 6.1.0-rc1-syzkaller-00025-gaae703b02f92 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:284 [inline] print_report+0x15e/0x45d mm/kasan/report.c:395 kasan_report+0xbb/0x1f0 mm/kasan/report.c:495 do_shrink_slab+0xbe6/0xce0 mm/vmscan.c:785 shrink_slab+0x175/0x660 mm/vmscan.c:1002 shrink_node_memcgs mm/vmscan.c:6076 [inline] shrink_node+0x93d/0x1f30 mm/vmscan.c:6105 shrink_zones mm/vmscan.c:6343 [inline] do_try_to_free_pages+0x3b4/0x17a0 mm/vmscan.c:6405 try_to_free_pages+0x2e1/0x960 mm/vmscan.c:6640 __perform_reclaim mm/page_alloc.c:4754 [inline] __alloc_pages_direct_reclaim mm/page_alloc.c:4776 [inline] __alloc_pages_slowpath.constprop.0+0x8b6/0x23d0 mm/page_alloc.c:5182 __alloc_pages+0x4a6/0x5a0 mm/page_alloc.c:5567 alloc_pages+0x1a6/0x270 mm/mempolicy.c:2280 folio_alloc+0x1c/0x70 mm/mempolicy.c:2290 filemap_alloc_folio+0x306/0x3a0 mm/filemap.c:971 page_cache_ra_unbounded+0x1aa/0x5e0 mm/readahead.c:248 do_page_cache_ra mm/readahead.c:300 [inline] page_cache_ra_order+0x6e8/0xa00 mm/readahead.c:560 do_sync_mmap_readahead mm/filemap.c:3043 [inline] filemap_fault+0x153b/0x2400 mm/filemap.c:3135 __do_fault+0x107/0x600 mm/memory.c:4203 do_read_fault mm/memory.c:4554 [inline] do_fault mm/memory.c:4683 [inline] handle_pte_fault mm/memory.c:4955 [inline] __handle_mm_fault+0x2184/0x3a40 mm/memory.c:5097 handle_mm_fault+0x1c8/0x780 mm/memory.c:5218 do_user_addr_fault+0x475/0x1210 arch/x86/mm/fault.c:1428 handle_page_fault arch/x86/mm/fault.c:1519 [inline] exc_page_fault+0x94/0x170 arch/x86/mm/fault.c:1575 asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:570 RIP: 0033:0x403469 Code: cc 49 3b 66 10 0f 86 dc 00 00 00 48 83 ec 30 48 89 6c 24 28 48 8d 6c 24 28 48 8b 10 0f 1f 44 00 00 48 85 d2 74 7d 48 8b 52 08 <48> 83 7a 18 00 74 7f 0f b6 72 17 40 f6 c6 20 74 34 48 8d 70 08 48 RSP: 002b:000000c001495578 EFLAGS: 00010206 RAX: 000000c001495668 RBX: 00000000d4e0101f RCX: 000000c001492000 RDX: 00000000009ed620 RSI: 0000000000000000 RDI: 000000c000491040 RBP: 000000c0014955a0 R08: 0000000000000001 R09: 00007ffe56bba080 R10: 00007ffe56bba090 R11: 000000000000ad90 R12: 000000c00008dbf8 R13: 0000000000000001 R14: 000000c000491040 R15: ffffffffffffffff Allocated by task 4010: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:45 kasan_set_track+0x21/0x30 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:371 [inline] ____kasan_kmalloc mm/kasan/common.c:330 [inline] __kasan_kmalloc+0xa1/0xb0 mm/kasan/common.c:380 kasan_kmalloc include/linux/kasan.h:211 [inline] __do_kmalloc_node mm/slab_common.c:955 [inline] __kmalloc+0x54/0xc0 mm/slab_common.c:968 kmalloc include/linux/slab.h:581 [inline] kzalloc include/linux/slab.h:712 [inline] ops_init+0xfb/0x470 net/core/net_namespace.c:124 setup_net+0x5d1/0xc50 net/core/net_namespace.c:325 copy_net_ns+0x318/0x760 net/core/net_namespace.c:471 create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110 copy_namespaces+0x391/0x450 kernel/nsproxy.c:178 copy_process+0x306e/0x7190 kernel/fork.c:2256 kernel_clone+0xe7/0x980 kernel/fork.c:2671 __do_compat_sys_ia32_clone+0x9e/0xd0 arch/x86/kernel/sys_ia32.c:254 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178 do_fast_syscall_32+0x2f/0x70 arch/x86/entry/common.c:203 entry_SYSENTER_compat_after_hwframe+0x70/0x82 Freed by task 4010: kasan_save_stack+0x1e/0x40 mm/kasan/common.c:45 kasan_set_track+0x21/0x30 mm/kasan/common.c:52 kasan_save_free_info+0x2a/0x40 mm/kasan/generic.c:511 ____kasan_slab_free mm/kasan/common.c:236 [inline] ____kasan_slab_free+0x160/0x1c0 mm/kasan/common.c:200 kasan_slab_free include/linux/kasan.h:177 [inline] slab_free_hook mm/slub.c:1724 [inline] slab_free_freelist_hook+0x8b/0x1c0 mm/slub.c:1750 slab_free mm/slub.c:3661 [inline] __kmem_cache_free+0xab/0x3b0 mm/slub.c:3674 ops_init+0xcd/0x470 net/core/net_namespace.c:139 setup_net+0x5d1/0xc50 net/core/net_namespace.c:325 copy_net_ns+0x318/0x760 net/core/net_namespace.c:471 create_new_namespaces+0x3f6/0xb20 kernel/nsproxy.c:110 copy_namespaces+0x391/0x450 kernel/nsproxy.c:178 copy_process+0x306e/0x7190 kernel/fork.c:2256 kernel_clone+0xe7/0x980 kernel/fork.c:2671 __do_compat_sys_ia32_clone+0x9e/0xd0 arch/x86/kernel/sys_ia32.c:254 do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline] __do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178 do_fast_syscall_32+0x2f/0x70 arch/x86/entry/common.c:203 entry_SYSENTER_compat_after_hwframe+0x70/0x82 The buggy address belongs to the object at ffff88802549d000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 1464 bytes inside of 2048-byte region [ffff88802549d000, ffff88802549d800) The buggy address belongs to the physical page: page:ffffea0000952600 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x25498 head:ffffea0000952600 order:3 compound_mapcount:0 compound_pincount:0 flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000010200 0000000000000000 dead000000000001 ffff888011842f00 raw: 0000000000000000 0000000000080008 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3709, tgid 3709 (syz-executor.1), ts 226690886863, free_ts 225148542257 prep_new_page mm/page_alloc.c:2538 [inline] get_page_from_freelist+0x10b5/0x2d50 mm/page_alloc.c:4287 __alloc_pages+0x1c7/0x5a0 mm/page_alloc.c:5554 alloc_pages+0x1a6/0x270 mm/mempolicy.c:2280 alloc_slab_page mm/slub.c:1794 [inline] allocate_slab+0x213/0x300 mm/slub.c:1939 new_slab mm/slub.c:1992 [inline] ___slab_alloc+0xa91/0x1400 mm/slub.c:3180 __slab_alloc.constprop.0+0x56/0xa0 mm/slub.c:3279 slab_alloc_node mm/slub.c:3364 [inline] __kmem_cache_alloc_node+0x191/0x3e0 mm/slub.c:3437 __do_kmalloc_node mm/slab_common.c:954 [inline] __kmalloc_node_track_caller+0x45/0xc0 mm/slab_common.c:975 kmalloc_reserve net/core/skbuff.c:437 [inline] __alloc_skb+0xd9/0x2f0 net/core/skbuff.c:509 alloc_skb include/linux/skbuff.h:1267 [inline] nlmsg_new include/net/netlink.h:964 [inline] inet6_ifinfo_notify+0x72/0x150 net/ipv6/addrconf.c:6047 addrconf_notify+0x4a4/0x1c10 net/ipv6/addrconf.c:3657 notifier_call_chain+0xb5/0x200 kernel/notifier.c:87 call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:1945 call_netdevice_notifiers_extack net/core/dev.c:1983 [inline] call_netdevice_notifiers net/core/dev.c:1997 [inline] __dev_notify_flags+0x110/0x2b0 net/core/dev.c:8577 dev_change_flags+0x112/0x170 net/core/dev.c:8615 do_setlink+0x9f1/0x3bb0 net/core/rtnetlink.c:2788 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1458 [inline] free_pcp_prepare+0x65c/0xd90 mm/page_alloc.c:1508 free_unref_page_prepare mm/page_alloc.c:3386 [inline] free_unref_page+0x19/0x4d0 mm/page_alloc.c:3482 qlink_free mm/kasan/quarantine.c:168 [inline] qlist_free_all+0x6a/0x170 mm/kasan/quarantine.c:187 kasan_quarantine_reduce+0x180/0x200 mm/kasan/quarantine.c:294 __kasan_slab_alloc+0x62/0x80 mm/kasan/common.c:302 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook mm/slab.h:737 [inline] slab_alloc_node mm/slub.c:3398 [inline] __kmem_cache_alloc_node+0x2da/0x3e0 mm/slub.c:3437 kmalloc_trace+0x22/0x60 mm/slab_common.c:1046 kmalloc include/linux/slab.h:576 [inline] kzalloc include/linux/slab.h:712 [inline] ref_tracker_alloc+0x14c/0x550 lib/ref_tracker.c:85 __netdev_tracker_alloc include/linux/netdevice.h:3993 [inline] netdev_hold include/linux/netdevice.h:4022 [inline] netdev_hold include/linux/netdevice.h:4017 [inline] rx_queue_add_kobject net/core/net-sysfs.c:1060 [inline] net_rx_queue_update_kobjects+0x20a/0x510 net/core/net-sysfs.c:1114 register_queue_kobjects net/core/net-sysfs.c:1774 [inline] netdev_register_kobject+0x275/0x400 net/core/net-sysfs.c:2019 register_netdevice+0xd95/0x1670 net/core/dev.c:10053 veth_newlink+0x4cf/0x990 drivers/net/veth.c:1795 rtnl_newlink_create net/core/rtnetlink.c:3364 [inline] __rtnl_newlink+0x1087/0x17e0 net/core/rtnetlink.c:3581 rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3594 rtnetlink_rcv_msg+0x43a/0xca0 net/core/rtnetlink.c:6091 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2540 Memory state around the buggy address: ffff88802549d480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88802549d500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88802549d580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88802549d600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88802549d680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================