================================================================== BUG: KASAN: use-after-free in ccid_hc_tx_delete+0xde/0x100 net/dccp/ccid.c:188 Read of size 8 at addr ffff88808a17f4c0 by task modprobe/6591 CPU: 0 PID: 6591 Comm: modprobe Not tainted 5.1.0-rc2 #36 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x172/0x1f0 lib/dump_stack.c:113 print_address_description.cold+0x7c/0x20d mm/kasan/report.c:187 kasan_report.cold+0x1b/0x40 mm/kasan/report.c:317 __asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:132 ccid_hc_tx_delete+0xde/0x100 net/dccp/ccid.c:188 dccp_sk_destruct+0x3f/0x90 net/dccp/proto.c:181 __sk_destruct+0x55/0x6d0 net/core/sock.c:1699 __rcu_reclaim kernel/rcu/rcu.h:227 [inline] rcu_do_batch kernel/rcu/tree.c:2475 [inline] invoke_rcu_callbacks kernel/rcu/tree.c:2788 [inline] rcu_core+0x928/0x1390 kernel/rcu/tree.c:2769 __do_softirq+0x266/0x95a kernel/softirq.c:293 invoke_softirq kernel/softirq.c:374 [inline] irq_exit+0x180/0x1d0 kernel/softirq.c:414 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x14a/0x570 arch/x86/kernel/apic/apic.c:1062 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807 RIP: 0010:get_current arch/x86/include/asm/current.h:15 [inline] RIP: 0010:write_comp_data+0x0/0x70 kernel/kcov.c:122 Code: 83 fa 02 75 20 48 8b 88 e8 12 00 00 8b 80 e4 12 00 00 48 8b 11 48 83 c2 01 48 39 d0 76 07 48 89 34 d1 48 89 11 5d c3 0f 1f 00 <65> 4c 8b 04 25 00 ee 01 00 65 8b 05 b0 7b 91 7e a9 00 01 1f 00 75 RSP: 0018:ffff888099d7faa8 EFLAGS: 00000292 ORIG_RAX: ffffffffffffff13 RAX: ffff8880893b4140 RBX: 00007fc95de10000 RCX: ffffffff819e4dc7 RDX: 00007fc95de10000 RSI: 00007fc95de45000 RDI: 0000000000000006 RBP: ffff888099d7fab0 R08: ffff8880893b4140 R09: ffffed10133aff46 R10: ffffed10133aff45 R11: 0000000000000003 R12: dffffc0000000000 R13: 0000000000000000 R14: 00007fc95de45000 R15: 00007fc95de45000 change_pte_range mm/mprotect.c:158 [inline] change_pmd_range mm/mprotect.c:211 [inline] change_pud_range mm/mprotect.c:239 [inline] change_p4d_range mm/mprotect.c:259 [inline] change_protection_range mm/mprotect.c:284 [inline] change_protection+0x1697/0x2620 mm/mprotect.c:305 mprotect_fixup+0x523/0xa70 mm/mprotect.c:432 do_mprotect_pkey+0x594/0xa30 mm/mprotect.c:556 __do_sys_mprotect mm/mprotect.c:581 [inline] __se_sys_mprotect mm/mprotect.c:578 [inline] __x64_sys_mprotect+0x78/0xb0 mm/mprotect.c:578 do_syscall_64+0x103/0x610 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x7fc95e07b447 Code: 73 01 c3 48 8d 0d 5d ad 20 00 31 d2 48 29 c2 89 11 48 83 c8 ff eb eb 90 90 90 90 90 90 90 90 90 90 90 90 b8 0a 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8d 0d 2d ad 20 00 31 d2 48 29 c2 89 RSP: 002b:00007ffeb2778df8 EFLAGS: 00000206 ORIG_RAX: 000000000000000a RAX: ffffffffffffffda RBX: 00007fc95e2839a8 RCX: 00007fc95e07b447 RDX: 0000000000000000 RSI: 00000000001ff000 RDI: 00007fc95dc46000 RBP: 00007ffeb2779150 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000001 R11: 0000000000000206 R12: 00007ffeb2779238 R13: 0000000000000002 R14: 0000000000000030 R15: 00007ffeb2778e40 Allocated by task 6361: save_stack+0x45/0xd0 mm/kasan/common.c:75 set_track mm/kasan/common.c:87 [inline] __kasan_kmalloc mm/kasan/common.c:497 [inline] __kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:470 kasan_slab_alloc+0xf/0x20 mm/kasan/common.c:505 slab_post_alloc_hook mm/slab.h:436 [inline] slab_alloc mm/slab.c:3392 [inline] kmem_cache_alloc+0x11a/0x6f0 mm/slab.c:3554 ccid_new+0x256/0x3f0 net/dccp/ccid.c:151 dccp_hdlr_ccid+0x27/0x150 net/dccp/feat.c:44 __dccp_feat_activate+0x17a/0x270 net/dccp/feat.c:344 dccp_feat_activate_values+0x33a/0x766 net/dccp/feat.c:1538 dccp_create_openreq_child+0x40c/0x570 net/dccp/minisocks.c:127 dccp_v6_request_recv_sock+0x214/0x1da0 net/dccp/ipv6.c:469 dccp_check_req+0x35c/0x6f0 net/dccp/minisocks.c:196 dccp_v6_rcv+0x6d7/0x191e net/dccp/ipv6.c:747 ip6_protocol_deliver_rcu+0x303/0x16c0 net/ipv6/ip6_input.c:394 ip6_input_finish+0x84/0x170 net/ipv6/ip6_input.c:434 NF_HOOK include/linux/netfilter.h:289 [inline] NF_HOOK include/linux/netfilter.h:283 [inline] ip6_input+0xe4/0x3f0 net/ipv6/ip6_input.c:443 dst_input include/net/dst.h:450 [inline] ip6_rcv_finish+0x1e7/0x320 net/ipv6/ip6_input.c:76 NF_HOOK include/linux/netfilter.h:289 [inline] NF_HOOK include/linux/netfilter.h:283 [inline] ipv6_rcv+0x10e/0x420 net/ipv6/ip6_input.c:272 __netif_receive_skb_one_core+0x115/0x1a0 net/core/dev.c:4973 __netif_receive_skb+0x2c/0x1c0 net/core/dev.c:5083 process_backlog+0x206/0x750 net/core/dev.c:5923 napi_poll net/core/dev.c:6346 [inline] net_rx_action+0x4fa/0x1070 net/core/dev.c:6412 __do_softirq+0x266/0x95a kernel/softirq.c:293 Freed by task 6361: save_stack+0x45/0xd0 mm/kasan/common.c:75 set_track mm/kasan/common.c:87 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/common.c:459 kasan_slab_free+0xe/0x10 mm/kasan/common.c:467 __cache_free mm/slab.c:3498 [inline] kmem_cache_free+0x86/0x260 mm/slab.c:3764 ccid_hc_tx_delete+0xc1/0x100 net/dccp/ccid.c:190 dccp_hdlr_ccid+0x7d/0x150 net/dccp/feat.c:53 __dccp_feat_activate+0x17a/0x270 net/dccp/feat.c:344 dccp_feat_activate_values+0x33a/0x766 net/dccp/feat.c:1538 dccp_create_openreq_child+0x40c/0x570 net/dccp/minisocks.c:127 dccp_v6_request_recv_sock+0x214/0x1da0 net/dccp/ipv6.c:469 dccp_check_req+0x35c/0x6f0 net/dccp/minisocks.c:196 dccp_v6_rcv+0x6d7/0x191e net/dccp/ipv6.c:747 ip6_protocol_deliver_rcu+0x303/0x16c0 net/ipv6/ip6_input.c:394 ip6_input_finish+0x84/0x170 net/ipv6/ip6_input.c:434 NF_HOOK include/linux/netfilter.h:289 [inline] NF_HOOK include/linux/netfilter.h:283 [inline] ip6_input+0xe4/0x3f0 net/ipv6/ip6_input.c:443 dst_input include/net/dst.h:450 [inline] ip6_rcv_finish+0x1e7/0x320 net/ipv6/ip6_input.c:76 NF_HOOK include/linux/netfilter.h:289 [inline] NF_HOOK include/linux/netfilter.h:283 [inline] ipv6_rcv+0x10e/0x420 net/ipv6/ip6_input.c:272 __netif_receive_skb_one_core+0x115/0x1a0 net/core/dev.c:4973 __netif_receive_skb+0x2c/0x1c0 net/core/dev.c:5083 process_backlog+0x206/0x750 net/core/dev.c:5923 napi_poll net/core/dev.c:6346 [inline] net_rx_action+0x4fa/0x1070 net/core/dev.c:6412 __do_softirq+0x266/0x95a kernel/softirq.c:293 The buggy address belongs to the object at ffff88808a17f4c0 which belongs to the cache ccid2_hc_tx_sock of size 1240 The buggy address is located 0 bytes inside of 1240-byte region [ffff88808a17f4c0, ffff88808a17f998) The buggy address belongs to the page: page:ffffea0002285f80 count:1 mapcount:0 mapping:ffff8882166a3180 index:0x0 compound_mapcount: 0 flags: 0x1fffc0000010200(slab|head) raw: 01fffc0000010200 ffff88809b2b0048 ffff88809b2b0048 ffff8882166a3180 raw: 0000000000000000 ffff88808a17e440 0000000100000005 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88808a17f380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88808a17f400: fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88808a17f480: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb ^ ffff88808a17f500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88808a17f580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================