================================================================== BUG: KASAN: slab-out-of-bounds in selinux_sock security/selinux/include/objsec.h:207 [inline] BUG: KASAN: slab-out-of-bounds in selinux_ip_output+0x1e0/0x1f0 security/selinux/hooks.c:5761 Read of size 8 at addr ffff8880281cc498 by task ksoftirqd/0/16 CPU: 0 UID: 0 PID: 16 Comm: ksoftirqd/0 Not tainted 6.13.0-rc1-syzkaller-00025-gfeffde684ac2 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xc3/0x620 mm/kasan/report.c:489 kasan_report+0xd9/0x110 mm/kasan/report.c:602 selinux_sock security/selinux/include/objsec.h:207 [inline] selinux_ip_output+0x1e0/0x1f0 security/selinux/hooks.c:5761 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline] nf_hook_slow+0xbb/0x200 net/netfilter/core.c:626 nf_hook+0x386/0x6d0 include/linux/netfilter.h:269 __ip_local_out+0x339/0x640 net/ipv4/ip_output.c:119 ip_local_out net/ipv4/ip_output.c:128 [inline] ip_send_skb net/ipv4/ip_output.c:1505 [inline] ip_push_pending_frames+0xa0/0x5b0 net/ipv4/ip_output.c:1525 ip_send_unicast_reply+0xd0e/0x1650 net/ipv4/ip_output.c:1672 tcp_v4_send_ack+0x976/0x13f0 net/ipv4/tcp_ipv4.c:1024 tcp_v4_timewait_ack net/ipv4/tcp_ipv4.c:1077 [inline] tcp_v4_rcv+0x2f8e/0x4380 net/ipv4/tcp_ipv4.c:2428 ip_protocol_deliver_rcu+0xba/0x4c0 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x316/0x570 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:314 [inline] NF_HOOK include/linux/netfilter.h:308 [inline] ip_local_deliver+0x18e/0x1f0 net/ipv4/ip_input.c:254 dst_input include/net/dst.h:460 [inline] ip_rcv_finish net/ipv4/ip_input.c:447 [inline] NF_HOOK include/linux/netfilter.h:314 [inline] NF_HOOK include/linux/netfilter.h:308 [inline] ip_rcv+0x2c3/0x5d0 net/ipv4/ip_input.c:567 __netif_receive_skb_one_core+0x199/0x1e0 net/core/dev.c:5672 __netif_receive_skb+0x1d/0x160 net/core/dev.c:5785 process_backlog+0x443/0x15f0 net/core/dev.c:6117 __napi_poll.constprop.0+0xb7/0x550 net/core/dev.c:6877 napi_poll net/core/dev.c:6946 [inline] net_rx_action+0xa94/0x1010 net/core/dev.c:7068 handle_softirqs+0x213/0x8f0 kernel/softirq.c:554 run_ksoftirqd kernel/softirq.c:943 [inline] run_ksoftirqd+0x3a/0x60 kernel/softirq.c:935 smpboot_thread_fn+0x661/0xa30 kernel/smpboot.c:164 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 The buggy address belongs to the object at ffff8880281cc420 which belongs to the cache tw_sock_TCP of size 288 The buggy address is located 120 bytes inside of allocated 288-byte region [ffff8880281cc420, ffff8880281cc540) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x281cc head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 memcg:ffff88802b34cd01 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801e2cc280 dead000000000122 0000000000000000 raw: 0000000000000000 0000000080170017 00000001f5000000 ffff88802b34cd01 head: 00fff00000000040 ffff88801e2cc280 dead000000000122 0000000000000000 head: 0000000000000000 0000000080170017 00000001f5000000 ffff88802b34cd01 head: 00fff00000000001 ffffea0000a07301 ffffffffffffffff 0000000000000000 head: ffff888000000002 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 1, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 16, tgid 16 (ksoftirqd/0), ts 87490040820, free_ts 87451382952 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1556 prep_new_page mm/page_alloc.c:1564 [inline] get_page_from_freelist+0xfce/0x2f80 mm/page_alloc.c:3474 __alloc_pages_noprof+0x223/0x25b0 mm/page_alloc.c:4751 alloc_pages_mpol_noprof+0x2c9/0x610 mm/mempolicy.c:2265 alloc_slab_page mm/slub.c:2408 [inline] allocate_slab mm/slub.c:2574 [inline] new_slab+0x2c9/0x410 mm/slub.c:2627 ___slab_alloc+0xdac/0x1870 mm/slub.c:3815 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3905 __slab_alloc_node mm/slub.c:3980 [inline] slab_alloc_node mm/slub.c:4141 [inline] kmem_cache_alloc_noprof+0xfa/0x3d0 mm/slub.c:4160 inet_twsk_alloc+0x120/0x970 net/ipv4/inet_timewait_sock.c:188 tcp_time_wait+0x5f/0xe10 net/ipv4/tcp_minisocks.c:309 tcp_rcv_state_process+0x1fda/0x4c40 net/ipv4/tcp_input.c:6925 tcp_v4_do_rcv+0x1ad/0xa90 net/ipv4/tcp_ipv4.c:1939 tcp_v4_rcv+0x33a0/0x4380 net/ipv4/tcp_ipv4.c:2351 ip_protocol_deliver_rcu+0xba/0x4c0 net/ipv4/ip_input.c:205 ip_local_deliver_finish+0x316/0x570 net/ipv4/ip_input.c:233 NF_HOOK include/linux/netfilter.h:314 [inline] NF_HOOK include/linux/netfilter.h:308 [inline] ip_local_deliver+0x18e/0x1f0 net/ipv4/ip_input.c:254 page last free pid 8699 tgid 8698 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1127 [inline] free_unref_page+0x661/0x1080 mm/page_alloc.c:2657 mm_free_pgd kernel/fork.c:809 [inline] __mmdrop+0xd5/0x460 kernel/fork.c:925 mmdrop include/linux/sched/mm.h:55 [inline] mmdrop_sched include/linux/sched/mm.h:83 [inline] mmdrop_lazy_tlb_sched include/linux/sched/mm.h:110 [inline] finish_task_switch.isra.0+0x7af/0xcc0 kernel/sched/core.c:5268 context_switch kernel/sched/core.c:5372 [inline] __schedule+0xe60/0x5ad0 kernel/sched/core.c:6756 __schedule_loop kernel/sched/core.c:6833 [inline] schedule+0xe7/0x350 kernel/sched/core.c:6848 schedule_timeout+0x244/0x280 kernel/time/sleep_timeout.c:75 do_wait_for_common kernel/sched/completion.c:95 [inline] __wait_for_common+0x3e1/0x600 kernel/sched/completion.c:116 wait_for_common kernel/sched/completion.c:127 [inline] wait_for_completion_state+0x1c/0x40 kernel/sched/completion.c:264 call_usermodehelper_exec+0x3c4/0x4d0 kernel/umh.c:441 call_modprobe kernel/module/kmod.c:102 [inline] __request_module+0x3f6/0x6c0 kernel/module/kmod.c:172 crypto_larval_lookup crypto/api.c:297 [inline] crypto_alg_mod_lookup+0x340/0x4e0 crypto/api.c:348 crypto_find_alg crypto/api.c:597 [inline] crypto_alloc_tfm_node+0xd3/0x260 crypto/api.c:634 esp_init_authenc.constprop.0+0x1de/0xb80 net/ipv4/esp4.c:1082 esp6_init_state+0x3fd/0x510 net/ipv6/esp6.c:1189 __xfrm_init_state+0x845/0x1ac0 net/xfrm/xfrm_state.c:3056 xfrm_state_construct net/xfrm/xfrm_user.c:854 [inline] xfrm_add_sa+0x2c5b/0x4f80 net/xfrm/xfrm_user.c:912 Memory state around the buggy address: ffff8880281cc380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8880281cc400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff8880281cc480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff8880281cc500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8880281cc580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================