IPVS: rr: UDP 224.0.0.2:0 - no destination available
==================================================================
BUG: KASAN: slab-use-after-free in rose_timer_expiry+0x46a/0x4b0 net/rose/rose_timer.c:183
Read of size 2 at addr ffff88805e10c82a by task swapper/1/0
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.6.101-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Call Trace:
dump_stack_lvl+0x16c/0x230 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:364 [inline]
print_report+0xac/0x220 mm/kasan/report.c:468
kasan_report+0x117/0x150 mm/kasan/report.c:581
rose_timer_expiry+0x46a/0x4b0 net/rose/rose_timer.c:183
call_timer_fn+0x16e/0x530 kernel/time/timer.c:1700
expire_timers kernel/time/timer.c:1751 [inline]
__run_timers+0x52d/0x7d0 kernel/time/timer.c:2022
run_timer_softirq+0x67/0xf0 kernel/time/timer.c:2035
handle_softirqs+0x280/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xc7/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
RIP: 0010:sched_core_balance+0x150/0xff0 kernel/sched/core.c:6376
Code: 14 03 00 00 48 c7 c2 e0 6b aa 8a e8 da ee 09 00 e9 29 0e 00 00 48 8b 7c 24 38 e8 7b f3 18 09 e8 36 2c 2e 00 fb 4c 8b 74 24 50 <41> 83 fe 08 0f 83 f1 0d 00 00 48 89 5c 24 78 4c 8d 3c dd 30 0a 7d
RSP: 0018:ffffc900001879e0 EFLAGS: 00000282
RAX: 1077c09ce8b27f00 RBX: 0000000000000001 RCX: 1077c09ce8b27f00
RDX: dffffc0000000000 RSI: ffffffff8aaaba40 RDI: ffffffff8afc6780
RBP: ffffc90000187b68 R08: ffffffff8e4a84ef R09: 1ffffffff1c9509d
R10: dffffc0000000000 R11: fffffbfff1c9509e R12: ffff8880b8f3c440
R13: dffffc0000000000 R14: 0000000000000001 R15: 0000000000000000
do_balance_callbacks kernel/sched/core.c:5024 [inline]
__balance_callbacks kernel/sched/core.c:5078 [inline]
finish_lock_switch kernel/sched/core.c:5134 [inline]
finish_task_switch+0x399/0x920 kernel/sched/core.c:5253
context_switch kernel/sched/core.c:5384 [inline]
__schedule+0x14da/0x44d0 kernel/sched/core.c:6700
schedule_idle+0x4e/0x80 kernel/sched/core.c:6802
do_idle+0x4ac/0x510 kernel/sched/idle.c:310
cpu_startup_entry+0x43/0x60 kernel/sched/idle.c:380
start_secondary+0xee/0xf0 arch/x86/kernel/smpboot.c:323
secondary_startup_64_no_verify+0x179/0x17b
Allocated by task 21650:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4e/0x70 mm/kasan/common.c:52
____kasan_kmalloc mm/kasan/common.c:374 [inline]
__kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:383
kmalloc include/linux/slab.h:600 [inline]
rose_add_node+0x23a/0xdd0 net/rose/rose_route.c:85
rose_rt_ioctl+0xa42/0xfb0 net/rose/rose_route.c:740
rose_ioctl+0x3cf/0x8b0 net/rose/af_rose.c:1380
sock_do_ioctl+0xd7/0x2f0 net/socket.c:1222
sock_ioctl+0x623/0x7a0 net/socket.c:1341
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl+0xfd/0x170 fs/ioctl.c:857
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
Freed by task 24676:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4e/0x70 mm/kasan/common.c:52
kasan_save_free_info+0x2e/0x50 mm/kasan/generic.c:522
____kasan_slab_free+0x126/0x1e0 mm/kasan/common.c:236
kasan_slab_free include/linux/kasan.h:164 [inline]
slab_free_hook mm/slub.c:1806 [inline]
slab_free_freelist_hook+0x130/0x1b0 mm/slub.c:1832
slab_free mm/slub.c:3816 [inline]
__kmem_cache_free+0xba/0x1f0 mm/slub.c:3829
rose_rt_device_down+0x43d/0x490 net/rose/rose_route.c:515
rose_device_event+0x604/0x690 net/rose/af_rose.c:248
notifier_call_chain+0x197/0x390 kernel/notifier.c:93
call_netdevice_notifiers_extack net/core/dev.c:2064 [inline]
call_netdevice_notifiers net/core/dev.c:2078 [inline]
__dev_notify_flags+0x18e/0x2e0 net/core/dev.c:-1
dev_change_flags+0xe8/0x1a0 net/core/dev.c:8750
dev_ifsioc+0x6a7/0xe20 net/core/dev_ioctl.c:529
dev_ioctl+0x7e2/0x1170 net/core/dev_ioctl.c:786
sock_do_ioctl+0x226/0x2f0 net/socket.c:1236
sock_ioctl+0x623/0x7a0 net/socket.c:1341
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:871 [inline]
__se_sys_ioctl+0xfd/0x170 fs/ioctl.c:857
do_syscall_x64 arch/x86/entry/common.c:51 [inline]
do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
entry_SYSCALL_64_after_hwframe+0x68/0xd2
Last potentially related work creation:
kasan_save_stack+0x3e/0x60 mm/kasan/common.c:45
__kasan_record_aux_stack+0xaf/0xc0 mm/kasan/generic.c:492
insert_work+0x3d/0x310 kernel/workqueue.c:1651
__queue_work+0xd2c/0x1020 kernel/workqueue.c:1804
call_timer_fn+0x16e/0x530 kernel/time/timer.c:1700
expire_timers kernel/time/timer.c:1746 [inline]
__run_timers+0x558/0x7d0 kernel/time/timer.c:2022
run_timer_softirq+0x67/0xf0 kernel/time/timer.c:2035
handle_softirqs+0x280/0x820 kernel/softirq.c:578
__do_softirq kernel/softirq.c:612 [inline]
invoke_softirq kernel/softirq.c:452 [inline]
__irq_exit_rcu+0xc7/0x190 kernel/softirq.c:661
irq_exit_rcu+0x9/0x20 kernel/softirq.c:673
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1088 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1088
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:687
Second to last potentially related work creation:
kasan_save_stack+0x3e/0x60 mm/kasan/common.c:45
__kasan_record_aux_stack+0xaf/0xc0 mm/kasan/generic.c:492
kvfree_call_rcu+0xee/0x780 kernel/rcu/tree.c:3452
drop_sysctl_table+0x356/0x4b0 fs/proc/proc_sysctl.c:1515
drop_sysctl_table+0x36d/0x4b0 fs/proc/proc_sysctl.c:1518
unregister_sysctl_table+0x41/0x60 fs/proc/proc_sysctl.c:1536
mpls_dev_sysctl_unregister+0x8b/0xc0 net/mpls/af_mpls.c:1431
mpls_dev_notify+0x533/0x7a0 net/mpls/af_mpls.c:1643
notifier_call_chain+0x197/0x390 kernel/notifier.c:93
call_netdevice_notifiers_extack net/core/dev.c:2064 [inline]
call_netdevice_notifiers net/core/dev.c:2078 [inline]
unregister_netdevice_many_notify+0xf36/0x1810 net/core/dev.c:11074
unregister_netdevice_many net/core/dev.c:11130 [inline]
unregister_netdevice_queue+0x324/0x360 net/core/dev.c:11010
unregister_netdevice include/linux/netdevice.h:3137 [inline]
__tun_detach+0xd45/0x1500 drivers/net/tun.c:685
tun_detach drivers/net/tun.c:701 [inline]
tun_chr_close+0x10d/0x1c0 drivers/net/tun.c:3511
__fput+0x234/0x970 fs/file_table.c:384
task_work_run+0x1ce/0x250 kernel/task_work.c:239
get_signal+0x1235/0x1400 kernel/signal.c:2678
arch_do_signal_or_restart+0x96/0x780 arch/x86/kernel/signal.c:310
exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:174
exit_to_user_mode_prepare+0xb1/0x140 kernel/entry/common.c:210
__syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:302
do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:87
entry_SYSCALL_64_after_hwframe+0x68/0xd2
The buggy address belongs to the object at ffff88805e10c800
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 42 bytes inside of
freed 512-byte region [ffff88805e10c800, ffff88805e10ca00)
The buggy address belongs to the physical page:
page:ffffea0001784300 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5e10c
head:ffffea0001784300 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0
anon flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000840 ffff888017841c80 0000000000000000 dead000000000001
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3468, tgid 3468 (kworker/u4:9), ts 88691202828, free_ts 27212889150
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x1cd/0x210 mm/page_alloc.c:1554
prep_new_page mm/page_alloc.c:1561 [inline]
get_page_from_freelist+0x195c/0x19f0 mm/page_alloc.c:3191
__alloc_pages+0x1e3/0x460 mm/page_alloc.c:4457
alloc_slab_page+0x5d/0x170 mm/slub.c:1876
allocate_slab mm/slub.c:2023 [inline]
new_slab+0x87/0x2e0 mm/slub.c:2076
___slab_alloc+0xc6d/0x12f0 mm/slub.c:3230
__slab_alloc mm/slub.c:3329 [inline]
__slab_alloc_node mm/slub.c:3382 [inline]
slab_alloc_node mm/slub.c:3475 [inline]
__kmem_cache_alloc_node+0x1a2/0x260 mm/slub.c:3524
kmalloc_trace+0x2a/0xe0 mm/slab_common.c:1098
kmalloc include/linux/slab.h:600 [inline]
kzalloc include/linux/slab.h:721 [inline]
mca_alloc net/ipv6/mcast.c:880 [inline]
__ipv6_dev_mc_inc+0x413/0xac0 net/ipv6/mcast.c:936
addrconf_join_solict net/ipv6/addrconf.c:2206 [inline]
addrconf_dad_begin net/ipv6/addrconf.c:4067 [inline]
addrconf_dad_work+0x3c5/0x14e0 net/ipv6/addrconf.c:4192
process_one_work kernel/workqueue.c:2634 [inline]
process_scheduled_works+0xa45/0x15b0 kernel/workqueue.c:2711
worker_thread+0xa55/0xfc0 kernel/workqueue.c:2792
kthread+0x2fa/0x390 kernel/kthread.c:388
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1154 [inline]
free_unref_page_prepare+0x7ce/0x8e0 mm/page_alloc.c:2336
free_unref_page+0x32/0x2e0 mm/page_alloc.c:2429
free_contig_range+0xa1/0x160 mm/page_alloc.c:6369
destroy_args+0x87/0x770 mm/debug_vm_pgtable.c:1015
debug_vm_pgtable+0x3cc/0x410 mm/debug_vm_pgtable.c:1395
do_one_initcall+0x1fd/0x750 init/main.c:1238
do_initcall_level+0x137/0x1f0 init/main.c:1300
do_initcalls+0x69/0xd0 init/main.c:1316
kernel_init_freeable+0x3d2/0x570 init/main.c:1553
kernel_init+0x1d/0x1c0 init/main.c:1443
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293
Memory state around the buggy address:
ffff88805e10c700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88805e10c780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88805e10c800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88805e10c880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff88805e10c900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess):
0: 14 03 adc $0x3,%al
2: 00 00 add %al,(%rax)
4: 48 c7 c2 e0 6b aa 8a mov $0xffffffff8aaa6be0,%rdx
b: e8 da ee 09 00 call 0x9eeea
10: e9 29 0e 00 00 jmp 0xe3e
15: 48 8b 7c 24 38 mov 0x38(%rsp),%rdi
1a: e8 7b f3 18 09 call 0x918f39a
1f: e8 36 2c 2e 00 call 0x2e2c5a
24: fb sti
25: 4c 8b 74 24 50 mov 0x50(%rsp),%r14
* 2a: 41 83 fe 08 cmp $0x8,%r14d <-- trapping instruction
2e: 0f 83 f1 0d 00 00 jae 0xe25
34: 48 89 5c 24 78 mov %rbx,0x78(%rsp)
39: 4c rex.WR
3a: 8d .byte 0x8d
3b: 3c dd cmp $0xdd,%al
3d: 30 0a xor %cl,(%rdx)
3f: 7d .byte 0x7d