===================================================== BUG: KMSAN: use-after-free in do_slab_free mm/slub.c:3024 [inline] BUG: KMSAN: use-after-free in slab_free mm/slub.c:3047 [inline] BUG: KMSAN: use-after-free in kmem_cache_free+0x3df/0x2b70 mm/slub.c:3062 CPU: 0 PID: 9 Comm: ksoftirqd/0 Not tainted 5.4.0-rc5+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x191/0x1f0 lib/dump_stack.c:113 kmsan_report+0x128/0x220 mm/kmsan/kmsan_report.c:108 __msan_warning+0x73/0xe0 mm/kmsan/kmsan_instr.c:245 do_slab_free mm/slub.c:3024 [inline] slab_free mm/slub.c:3047 [inline] kmem_cache_free+0x3df/0x2b70 mm/slub.c:3062 kfree_skbmem net/core/skbuff.c:644 [inline] __kfree_skb net/core/skbuff.c:680 [inline] kfree_skb+0x473/0x4c0 net/core/skbuff.c:697 packet_rcv_spkt+0x68d/0x7c0 net/packet/af_packet.c:1847 deliver_skb net/core/dev.c:1969 [inline] deliver_ptype_list_skb net/core/dev.c:1984 [inline] __netif_receive_skb_core+0x3aed/0x51a0 net/core/dev.c:4968 __netif_receive_skb_one_core net/core/dev.c:5008 [inline] __netif_receive_skb net/core/dev.c:5124 [inline] netif_receive_skb_internal+0x3cc/0xc20 net/core/dev.c:5214 napi_skb_finish net/core/dev.c:5677 [inline] napi_gro_receive+0x67f/0xbb0 net/core/dev.c:5710 receive_buf+0x653b/0x8810 drivers/net/virtio_net.c:1061 virtnet_receive drivers/net/virtio_net.c:1323 [inline] virtnet_poll+0x666/0x1a10 drivers/net/virtio_net.c:1428 napi_poll net/core/dev.c:6392 [inline] net_rx_action+0x7a6/0x1aa0 net/core/dev.c:6460 __do_softirq+0x4a1/0x83a kernel/softirq.c:293 run_ksoftirqd+0x25/0x40 kernel/softirq.c:607 smpboot_thread_fn+0x4a3/0x990 kernel/smpboot.c:165 kthread+0x4b5/0x4f0 kernel/kthread.c:256 ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:355 Uninit was stored to memory at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:151 [inline] kmsan_internal_chain_origin+0xbd/0x180 mm/kmsan/kmsan.c:319 __msan_chain_origin+0x6b/0xd0 mm/kmsan/kmsan_instr.c:179 ___slab_alloc+0x1dbc/0x1fb0 mm/slub.c:2636 __slab_alloc mm/slub.c:2689 [inline] slab_alloc_node mm/slub.c:2763 [inline] slab_alloc mm/slub.c:2808 [inline] kmem_cache_alloc+0xadf/0xd20 mm/slub.c:2813 skb_clone+0x326/0x5d0 net/core/skbuff.c:1448 skb_share_check include/linux/skbuff.h:1670 [inline] packet_rcv_spkt+0x23f/0x7c0 net/packet/af_packet.c:1816 deliver_skb net/core/dev.c:1969 [inline] deliver_ptype_list_skb net/core/dev.c:1984 [inline] __netif_receive_skb_core+0x3aed/0x51a0 net/core/dev.c:4968 __netif_receive_skb_one_core net/core/dev.c:5008 [inline] __netif_receive_skb net/core/dev.c:5124 [inline] netif_receive_skb_internal+0x3cc/0xc20 net/core/dev.c:5214 napi_skb_finish net/core/dev.c:5677 [inline] napi_gro_receive+0x67f/0xbb0 net/core/dev.c:5710 receive_buf+0x653b/0x8810 drivers/net/virtio_net.c:1061 virtnet_receive drivers/net/virtio_net.c:1323 [inline] virtnet_poll+0x666/0x1a10 drivers/net/virtio_net.c:1428 napi_poll net/core/dev.c:6392 [inline] net_rx_action+0x7a6/0x1aa0 net/core/dev.c:6460 __do_softirq+0x4a1/0x83a kernel/softirq.c:293 run_ksoftirqd+0x25/0x40 kernel/softirq.c:607 smpboot_thread_fn+0x4a3/0x990 kernel/smpboot.c:165 kthread+0x4b5/0x4f0 kernel/kthread.c:256 ret_from_fork+0x35/0x40 arch/x86/entry/entry_64.S:355 Uninit was created at: kmsan_save_stack_with_flags mm/kmsan/kmsan.c:151 [inline] kmsan_internal_poison_shadow+0x60/0x120 mm/kmsan/kmsan.c:134 kmsan_slab_free+0x8d/0xf0 mm/kmsan/kmsan_hooks.c:108 slab_free_freelist_hook mm/slub.c:1473 [inline] slab_free mm/slub.c:3046 [inline] kmem_cache_free_bulk+0x3ad9/0x3f10 mm/slub.c:3171 __kfree_skb_flush+0xb0/0x100 net/core/skbuff.c:862 net_rx_action+0x1a5e/0x1aa0 net/core/dev.c:6483 __do_softirq+0x4a1/0x83a kernel/softirq.c:293 invoke_softirq kernel/softirq.c:375 [inline] irq_exit+0x230/0x280 kernel/softirq.c:416 exiting_irq arch/x86/include/asm/apic.h:536 [inline] do_IRQ+0x123/0x360 arch/x86/kernel/irq.c:263 ret_from_intr+0x0/0x33 kmsan_internal_is_module_addr+0xa/0x20 mm/kmsan/kmsan.c:564 __msan_metadata_ptr_for_load_2+0x10/0x20 mm/kmsan/kmsan_instr.c:53 skb_network_header include/linux/skbuff.h:2462 [inline] ip_hdr include/linux/ip.h:21 [inline] ipt_mangle_out net/ipv4/netfilter/iptable_mangle.c:51 [inline] iptable_mangle_hook+0x106/0x700 net/ipv4/netfilter/iptable_mangle.c:81 nf_hook_entry_hookfn include/linux/netfilter.h:135 [inline] nf_hook_slow+0x18b/0x3f0 net/netfilter/core.c:512 nf_hook include/linux/netfilter.h:260 [inline] __ip_local_out+0x69b/0x800 net/ipv4/ip_output.c:114 ip_local_out net/ipv4/ip_output.c:123 [inline] __ip_queue_xmit+0x1bdc/0x21f0 net/ipv4/ip_output.c:532 ip_queue_xmit+0xcc/0xf0 include/net/ip.h:237 __tcp_transmit_skb+0x40e3/0x5d90 net/ipv4/tcp_output.c:1169 __tcp_send_ack+0x701/0x840 net/ipv4/tcp_output.c:3696 tcp_send_ack+0x68/0x90 net/ipv4/tcp_output.c:3702 tcp_cleanup_rbuf+0x764/0x800 net/ipv4/tcp.c:1578 tcp_recvmsg+0x334d/0x4ff0 net/ipv4/tcp.c:2182 inet_recvmsg+0x237/0x7d0 net/ipv4/af_inet.c:838 sock_recvmsg_nosec net/socket.c:871 [inline] sock_recvmsg net/socket.c:889 [inline] sock_read_iter+0x5be/0x660 net/socket.c:967 call_read_iter include/linux/fs.h:1889 [inline] new_sync_read fs/read_write.c:414 [inline] __vfs_read+0xa67/0xc90 fs/read_write.c:427 vfs_read+0x359/0x6f0 fs/read_write.c:461 ksys_read+0x265/0x430 fs/read_write.c:587 __do_sys_read fs/read_write.c:597 [inline] __se_sys_read+0x92/0xb0 fs/read_write.c:595 __x64_sys_read+0x4a/0x70 fs/read_write.c:595 do_syscall_64+0xb6/0x160 arch/x86/entry/common.c:291 entry_SYSCALL_64_after_hwframe+0x63/0xe7 =====================================================