syzkaller995118 uses obsolete (PF_INET,SOCK_PACKET) device lo entered promiscuous mode ================================================================== BUG: KASAN: use-after-free in ip6_dst_idev include/net/ip6_fib.h:187 [inline] BUG: KASAN: use-after-free in ip6_xmit+0x2048/0x2090 net/ipv6/ip6_output.c:256 Read of size 8 at addr ffff8801bcd78e98 by task swapper/0/0 CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.15.0-rc7+ #171 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 print_address_description+0x73/0x250 mm/kasan/report.c:252 kasan_report_error mm/kasan/report.c:351 [inline] kasan_report+0x25b/0x340 mm/kasan/report.c:409 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:430 ip6_dst_idev include/net/ip6_fib.h:187 [inline] ip6_xmit+0x2048/0x2090 net/ipv6/ip6_output.c:256 inet6_csk_xmit+0x2fc/0x580 net/ipv6/inet6_connection_sock.c:139 tcp_transmit_skb+0x1b1b/0x38c0 net/ipv4/tcp_output.c:1176 __tcp_retransmit_skb+0x684/0x2700 net/ipv4/tcp_output.c:2907 tcp_retransmit_skb+0x2e/0x230 net/ipv4/tcp_output.c:2922 tcp_retransmit_timer+0xd0e/0x2a00 net/ipv4/tcp_timer.c:480 tcp_write_timer_handler+0x335/0x820 net/ipv4/tcp_timer.c:565 tcp_write_timer+0x152/0x170 net/ipv4/tcp_timer.c:585 call_timer_fn+0x228/0x820 kernel/time/timer.c:1318 expire_timers kernel/time/timer.c:1355 [inline] __run_timers+0x7ee/0xb70 kernel/time/timer.c:1658 run_timer_softirq+0x4c/0x70 kernel/time/timer.c:1684 __do_softirq+0x2d7/0xb85 kernel/softirq.c:285 invoke_softirq kernel/softirq.c:365 [inline] irq_exit+0x1cc/0x200 kernel/softirq.c:405 exiting_irq arch/x86/include/asm/apic.h:540 [inline] smp_apic_timer_interrupt+0x16b/0x700 arch/x86/kernel/apic/apic.c:1052 apic_timer_interrupt+0xa9/0xb0 arch/x86/entry/entry_64.S:920 RIP: 0010:native_safe_halt+0x6/0x10 arch/x86/include/asm/irqflags.h:54 RSP: 0018:ffffffff86807c38 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff11 RAX: dffffc0000000000 RBX: 1ffffffff0d00f8a RCX: 0000000000000000 RDX: 1ffffffff0d19080 RSI: 0000000000000001 RDI: ffffffff868c8400 RBP: ffffffff86807c38 R08: ffffffff8666eae0 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: ffffffff86807cf0 R14: ffffffff87037160 R15: 0000000000000000 arch_safe_halt arch/x86/include/asm/paravirt.h:93 [inline] default_idle+0xbf/0x460 arch/x86/kernel/process.c:355 arch_cpu_idle+0xa/0x10 arch/x86/kernel/process.c:346 default_idle_call+0x36/0x90 kernel/sched/idle.c:98 cpuidle_idle_call kernel/sched/idle.c:156 [inline] do_idle+0x24a/0x3b0 kernel/sched/idle.c:246 cpu_startup_entry+0x104/0x120 kernel/sched/idle.c:351 rest_init+0xed/0xf0 init/main.c:436 start_kernel+0x7f1/0x819 init/main.c:716 x86_64_start_reservations+0x2a/0x2c arch/x86/kernel/head64.c:378 x86_64_start_kernel+0x77/0x7a arch/x86/kernel/head64.c:359 secondary_startup_64+0xa5/0xb0 arch/x86/kernel/head_64.S:237 Allocated by task 3658: save_stack+0x43/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:489 kmem_cache_alloc+0x12e/0x760 mm/slab.c:3544 dst_alloc+0x11f/0x1a0 net/core/dst.c:107 rt_dst_alloc+0xe9/0x540 net/ipv4/route.c:1500 __mkroute_output net/ipv4/route.c:2242 [inline] ip_route_output_key_hash_rcu+0xa40/0x2c40 net/ipv4/route.c:2470 ip_route_output_key_hash+0x20b/0x370 net/ipv4/route.c:2299 __ip_route_output_key include/net/route.h:125 [inline] ip_route_connect include/net/route.h:300 [inline] tcp_v4_connect+0x11ac/0x1e80 net/ipv4/tcp_ipv4.c:175 __inet_stream_connect+0x2d4/0xf00 net/ipv4/af_inet.c:619 tcp_sendmsg_fastopen net/ipv4/tcp.c:1169 [inline] tcp_sendmsg_locked+0x280e/0x3b60 net/ipv4/tcp.c:1214 tcp_sendmsg+0x2f/0x50 net/ipv4/tcp.c:1461 inet_sendmsg+0x11f/0x5e0 net/ipv4/af_inet.c:763 sock_sendmsg_nosec net/socket.c:638 [inline] sock_sendmsg+0xca/0x110 net/socket.c:648 ___sys_sendmsg+0x320/0x8b0 net/socket.c:2028 __sys_sendmmsg+0x31b/0x620 net/socket.c:2111 C_SYSC_sendmmsg net/compat.c:745 [inline] compat_SyS_sendmmsg+0x32/0x40 net/compat.c:742 do_syscall_32_irqs_on arch/x86/entry/common.c:327 [inline] do_fast_syscall_32+0x3ee/0xf9d arch/x86/entry/common.c:389 entry_SYSENTER_compat+0x54/0x63 arch/x86/entry/entry_64_compat.S:129 Freed by task 0: save_stack+0x43/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524 __cache_free mm/slab.c:3488 [inline] kmem_cache_free+0x83/0x2a0 mm/slab.c:3746 dst_destroy+0x216/0x330 net/core/dst.c:138 dst_destroy_rcu+0x16/0x20 net/core/dst.c:151 __rcu_reclaim kernel/rcu/rcu.h:195 [inline] rcu_do_batch kernel/rcu/tree.c:2758 [inline] invoke_rcu_callbacks kernel/rcu/tree.c:3012 [inline] __rcu_process_callbacks kernel/rcu/tree.c:2979 [inline] rcu_process_callbacks+0xd6c/0x17f0 kernel/rcu/tree.c:2996 __do_softirq+0x2d7/0xb85 kernel/softirq.c:285 The buggy address belongs to the object at ffff8801bcd78e80 which belongs to the cache ip_dst_cache of size 216 The buggy address is located 24 bytes inside of 216-byte region [ffff8801bcd78e80, ffff8801bcd78f58) The buggy address belongs to the page: page:ffffea0006f35e00 count:1 mapcount:0 mapping:ffff8801bcd780c0 index:0x0 flags: 0x2fffc0000000100(slab) raw: 02fffc0000000100 ffff8801bcd780c0 0000000000000000 000000010000000c raw: ffffea0007133320 ffff8801d6cbc648 ffff8801d6fadb00 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8801bcd78d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8801bcd78e00: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff8801bcd78e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8801bcd78f00: fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc ffff8801bcd78f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================