bisecting cause commit starting from 14f2cf607ccd1fa05e767f0191fd5d07b35534c2 building syzkaller on d4ea592f78feb8f04941a301b93e09880c3546a3 testing commit 14f2cf607ccd1fa05e767f0191fd5d07b35534c2 with gcc (GCC) 8.1.0 all runs: crashed: general protection fault in find_match testing release v5.3 testing commit 4d856f72c10ecb060868ed10ff1b1453943fc6c8 with gcc (GCC) 8.1.0 all runs: crashed: general protection fault in find_match testing release v5.2 testing commit 0ecfebd2b52404ae0c54a878c872bb93363ada36 with gcc (GCC) 8.1.0 all runs: crashed: general protection fault in __find_rr_leaf testing release v5.1 testing commit e93c9c99a629c61837d5a7fc2120cd2b6c70dbdd with gcc (GCC) 8.1.0 all runs: crashed: general protection fault in find_match testing release v5.0 testing commit 1c163f4c7b3f621efff9b28a47abb36f7378d783 with gcc (GCC) 8.1.0 all runs: crashed: general protection fault in find_match testing release v4.20 testing commit 8fe28cb58bcb235034b64cbbb7550a8a43fd88be with gcc (GCC) 8.1.0 all runs: crashed: general protection fault in find_match testing release v4.19 testing commit 84df9525b0c27f3ebc2ebb1864fa62a97fdedb7d with gcc (GCC) 8.1.0 all runs: crashed: general protection fault in find_match testing release v4.18 testing commit 94710cac0ef4ee177a63b5227664b38c95bbf703 with gcc (GCC) 8.1.0 all runs: crashed: general protection fault in find_match testing release v4.17 testing commit 29dcea88779c856c7dc92040a0c01233263101d4 with gcc (GCC) 8.1.0 all runs: OK # git bisect start v4.18 v4.17 Bisecting: 7032 revisions left to test after this (roughly 13 steps) [3036bc45364f98515a2c446d7fac2c34dcfbeff4] Merge tag 'media/v4.18-2' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media testing commit 3036bc45364f98515a2c446d7fac2c34dcfbeff4 with gcc (GCC) 8.1.0 run #0: crashed: KASAN: use-after-free Read in fib6_table_lookup run #1: crashed: KASAN: use-after-free Read in fib6_table_lookup run #2: crashed: KASAN: use-after-free Read in find_match run #3: crashed: KASAN: use-after-free Read in fib6_table_lookup run #4: boot failed: KASAN: use-after-free Write in call_usermodehelper_exec_work run #5: boot failed: KASAN: use-after-free Write in call_usermodehelper_exec_work run #6: boot failed: KASAN: use-after-free Write in call_usermodehelper_exec_work run #7: boot failed: KASAN: use-after-free Write in call_usermodehelper_exec_work run #8: boot failed: KASAN: use-after-free Write in call_usermodehelper_exec_work run #9: boot failed: KASAN: use-after-free Write in call_usermodehelper_exec_work # git bisect bad 3036bc45364f98515a2c446d7fac2c34dcfbeff4 Bisecting: 3644 revisions left to test after this (roughly 12 steps) [135c5504a600ff9b06e321694fbcac78a9530cd4] Merge tag 'drm-next-2018-06-06-1' of git://anongit.freedesktop.org/drm/drm testing commit 135c5504a600ff9b06e321694fbcac78a9530cd4 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 135c5504a600ff9b06e321694fbcac78a9530cd4 Bisecting: 1830 revisions left to test after this (roughly 11 steps) [f39c6b29ae1d3727d9c65a4ab99d5150b558be5e] Merge tag 'mlx5e-updates-2018-06-01' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux testing commit f39c6b29ae1d3727d9c65a4ab99d5150b558be5e with gcc (GCC) 8.1.0 run #0: crashed: KASAN: use-after-free Read in find_match run #1: crashed: KASAN: use-after-free Read in fib6_table_lookup run #2: crashed: KASAN: use-after-free Read in find_match run #3: crashed: KASAN: use-after-free Read in find_match run #4: crashed: KASAN: use-after-free Read in find_match run #5: crashed: KASAN: use-after-free Read in fib6_table_lookup run #6: crashed: KASAN: use-after-free Read in fib6_table_lookup run #7: crashed: KASAN: use-after-free Read in find_match run #8: boot failed: KASAN: use-after-free Write in call_usermodehelper_exec_work run #9: boot failed: KASAN: use-after-free Write in call_usermodehelper_exec_work # git bisect bad f39c6b29ae1d3727d9c65a4ab99d5150b558be5e Bisecting: 901 revisions left to test after this (roughly 10 steps) [7d6541fba19c970cf5ebbc2c56b0fb04eab89f98] Merge tag 'mlx5e-updates-2018-05-14' of git://git.kernel.org/pub/scm/linux/kernel/git/saeed/linux testing commit 7d6541fba19c970cf5ebbc2c56b0fb04eab89f98 with gcc (GCC) 8.1.0 run #0: crashed: KASAN: use-after-free Read in ip6_pol_route run #1: crashed: KASAN: use-after-free Read in find_match run #2: crashed: KASAN: use-after-free Read in ip6_pol_route run #3: crashed: KASAN: use-after-free Read in ip6_pol_route run #4: crashed: KASAN: use-after-free Read in find_match run #5: crashed: KASAN: use-after-free Read in find_match run #6: crashed: KASAN: use-after-free Read in find_match run #7: crashed: KASAN: use-after-free Read in ip6_pol_route run #8: crashed: KASAN: use-after-free Read in ip6_pol_route run #9: crashed: KASAN: use-after-free Read in ip6_pol_route # git bisect bad 7d6541fba19c970cf5ebbc2c56b0fb04eab89f98 Bisecting: 455 revisions left to test after this (roughly 9 steps) [dbafb0c488ee02893764c14783e26574ee8f1a96] Merge branch 'liquidio-enhanced-ethtool-set-channels-feature' testing commit dbafb0c488ee02893764c14783e26574ee8f1a96 with gcc (GCC) 8.1.0 all runs: crashed: KASAN: use-after-free Read in find_match # git bisect bad dbafb0c488ee02893764c14783e26574ee8f1a96 Bisecting: 227 revisions left to test after this (roughly 8 steps) [8a14e46f140230ca889c2b0a4753ae8ea45fd770] net/ipv6: Fix missing rcu dereferences on from testing commit 8a14e46f140230ca889c2b0a4753ae8ea45fd770 with gcc (GCC) 8.1.0 all runs: basic kernel testing failed: KASAN: null-ptr-deref Read in llc_ui_release # git bisect skip 8a14e46f140230ca889c2b0a4753ae8ea45fd770 Bisecting: 227 revisions left to test after this (roughly 8 steps) [16962b2404ac88cde0281fe2176d6ae3820ed320] bpf: sockmap, add selftests testing commit 16962b2404ac88cde0281fe2176d6ae3820ed320 with gcc (GCC) 8.1.0 all runs: basic kernel testing failed: KASAN: null-ptr-deref Read in llc_ui_release # git bisect skip 16962b2404ac88cde0281fe2176d6ae3820ed320 Bisecting: 227 revisions left to test after this (roughly 8 steps) [8b0b37c5644e1c0e0feac5bbf673337cefa3efb2] ipconfig: Document /proc/net/pnp testing commit 8b0b37c5644e1c0e0feac5bbf673337cefa3efb2 with gcc (GCC) 8.1.0 all runs: basic kernel testing failed: KASAN: null-ptr-deref Read in llc_ui_release # git bisect skip 8b0b37c5644e1c0e0feac5bbf673337cefa3efb2 Bisecting: 227 revisions left to test after this (roughly 8 steps) [c88da20f95ad0bfa49e3e9035c26aaac0b05d11d] sctp: remove an if() that is always true testing commit c88da20f95ad0bfa49e3e9035c26aaac0b05d11d with gcc (GCC) 8.1.0 run #0: crashed: KASAN: use-after-free Read in find_match run #1: crashed: KASAN: use-after-free Read in ip6_pol_route run #2: crashed: KASAN: use-after-free Read in ip6_pol_route run #3: crashed: KASAN: use-after-free Read in find_match run #4: crashed: KASAN: use-after-free Read in ip6_pol_route run #5: crashed: KASAN: use-after-free Read in ip6_pol_route run #6: crashed: KASAN: use-after-free Read in find_match run #7: crashed: KASAN: use-after-free Read in find_match run #8: crashed: KASAN: use-after-free Read in find_match run #9: crashed: KASAN: use-after-free Read in ip6_pol_route # git bisect bad c88da20f95ad0bfa49e3e9035c26aaac0b05d11d Bisecting: 186 revisions left to test after this (roughly 8 steps) [1b80f86ed6b0e98a7e3d1e7d547f66163aa8a1af] Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next testing commit 1b80f86ed6b0e98a7e3d1e7d547f66163aa8a1af with gcc (GCC) 8.1.0 run #0: crashed: KASAN: use-after-free Read in find_match run #1: crashed: KASAN: use-after-free Read in ip6_pol_route run #2: crashed: KASAN: use-after-free Read in find_match run #3: crashed: KASAN: use-after-free Read in ip6_pol_route run #4: crashed: KASAN: use-after-free Read in find_match run #5: crashed: KASAN: use-after-free Read in ip6_pol_route run #6: crashed: KASAN: use-after-free Read in find_match run #7: crashed: KASAN: use-after-free Read in ip6_pol_route run #8: crashed: KASAN: use-after-free Read in ip6_pol_route run #9: crashed: KASAN: use-after-free Read in find_match # git bisect bad 1b80f86ed6b0e98a7e3d1e7d547f66163aa8a1af Bisecting: 101 revisions left to test after this (roughly 7 steps) [6ed0e08f9e2a90ab455d897e4679b903c82dac67] r8169: remove jumbo_tx_csum from chip config struct testing commit 6ed0e08f9e2a90ab455d897e4679b903c82dac67 with gcc (GCC) 8.1.0 all runs: crashed: KASAN: use-after-free Read in ip6_pol_route # git bisect bad 6ed0e08f9e2a90ab455d897e4679b903c82dac67 Bisecting: 51 revisions left to test after this (roughly 6 steps) [43b059a312f35799ef7e3a49aba4f1e0128e30ca] vrf: Move fib6_table into net_vrf testing commit 43b059a312f35799ef7e3a49aba4f1e0128e30ca with gcc (GCC) 8.1.0 all runs: OK # git bisect good 43b059a312f35799ef7e3a49aba4f1e0128e30ca Bisecting: 25 revisions left to test after this (roughly 5 steps) [65c450642c4991ab456ebd157e14d52c81106695] net: netcp: ethss: map vlan priorities to zero flow testing commit 65c450642c4991ab456ebd157e14d52c81106695 with gcc (GCC) 8.1.0 run #0: crashed: KASAN: use-after-free Read in ip6_pol_route run #1: crashed: KASAN: use-after-free Read in rt6_score_route run #2: crashed: KASAN: use-after-free Read in ip6_pol_route run #3: crashed: KASAN: use-after-free Read in ip6_pol_route run #4: crashed: KASAN: use-after-free Read in ip6_pol_route run #5: crashed: KASAN: use-after-free Read in ip6_pol_route run #6: crashed: KASAN: use-after-free Read in ip6_pol_route run #7: crashed: KASAN: use-after-free Read in ip6_pol_route run #8: crashed: KASAN: use-after-free Read in ip6_pol_route run #9: crashed: KASAN: use-after-free Read in ip6_pol_route # git bisect bad 65c450642c4991ab456ebd157e14d52c81106695 Bisecting: 12 revisions left to test after this (roughly 4 steps) [acb54e3cba404c20f07733f3222c0418a7724a5b] net/ipv6: Add gfp_flags to route add functions testing commit acb54e3cba404c20f07733f3222c0418a7724a5b with gcc (GCC) 8.1.0 all runs: OK # git bisect good acb54e3cba404c20f07733f3222c0418a7724a5b Bisecting: 6 revisions left to test after this (roughly 3 steps) [0565de29cbd65b378147d36f9642f93a046240dc] Merge branch 'ipv6-Separate-data-structures-for-FIB-and-data-path' testing commit 0565de29cbd65b378147d36f9642f93a046240dc with gcc (GCC) 8.1.0 run #0: crashed: KASAN: use-after-free Read in find_match run #1: crashed: KASAN: use-after-free Read in ip6_pol_route run #2: crashed: KASAN: use-after-free Read in ip6_pol_route run #3: crashed: KASAN: use-after-free Read in ip6_pol_route run #4: crashed: KASAN: use-after-free Read in ip6_pol_route run #5: crashed: KASAN: use-after-free Read in ip6_pol_route run #6: crashed: KASAN: use-after-free Read in ip6_pol_route run #7: crashed: KASAN: use-after-free Read in ip6_pol_route run #8: crashed: KASAN: use-after-free Read in ip6_pol_route run #9: crashed: KASAN: use-after-free Read in ip6_pol_route # git bisect bad 0565de29cbd65b378147d36f9642f93a046240dc Bisecting: 2 revisions left to test after this (roughly 2 steps) [93531c6743157d7e8c5792f8ed1a57641149d62c] net/ipv6: separate handling of FIB entries from dst based routes testing commit 93531c6743157d7e8c5792f8ed1a57641149d62c with gcc (GCC) 8.1.0 run #0: crashed: KASAN: use-after-free Read in ip6_pol_route run #1: crashed: KASAN: use-after-free Read in ip6_pol_route run #2: crashed: KASAN: use-after-free Read in ip6_pol_route run #3: crashed: KASAN: use-after-free Read in ip6_pol_route run #4: crashed: KASAN: use-after-free Read in find_match run #5: crashed: KASAN: use-after-free Read in ip6_pol_route run #6: crashed: KASAN: use-after-free Read in ip6_pol_route run #7: crashed: KASAN: use-after-free Read in ip6_pol_route run #8: crashed: KASAN: use-after-free Read in ip6_pol_route run #9: crashed: KASAN: use-after-free Read in ip6_pol_route # git bisect bad 93531c6743157d7e8c5792f8ed1a57641149d62c Bisecting: 1 revision left to test after this (roughly 1 step) [23fb93a4d3f118a900790066d03368a296dce0d6] net/ipv6: Cleanup exception and cache route handling testing commit 23fb93a4d3f118a900790066d03368a296dce0d6 with gcc (GCC) 8.1.0 all runs: OK # git bisect good 23fb93a4d3f118a900790066d03368a296dce0d6 Bisecting: 0 revisions left to test after this (roughly 0 steps) [a64efe142f5e70b7e39276a414bbb3b96691c608] net/ipv6: introduce fib6_info struct and helpers testing commit a64efe142f5e70b7e39276a414bbb3b96691c608 with gcc (GCC) 8.1.0 all runs: OK # git bisect good a64efe142f5e70b7e39276a414bbb3b96691c608 93531c6743157d7e8c5792f8ed1a57641149d62c is the first bad commit commit 93531c6743157d7e8c5792f8ed1a57641149d62c Author: David Ahern Date: Tue Apr 17 17:33:25 2018 -0700 net/ipv6: separate handling of FIB entries from dst based routes Last step before flipping the data type for FIB entries: - use fib6_info_alloc to create FIB entries in ip6_route_info_create and addrconf_dst_alloc - use fib6_info_release in place of dst_release, ip6_rt_put and rt6_release - remove the dst_hold before calling __ip6_ins_rt or ip6_del_rt - when purging routes, drop per-cpu routes - replace inc and dec of rt6i_ref with fib6_info_hold and fib6_info_release - use rt->from since it points to the FIB entry - drop references to exception bucket, fib6_metrics and per-cpu from dst entries (those are relevant for fib entries only) Signed-off-by: David Ahern Signed-off-by: David S. Miller :040000 040000 82d5017f2b15e2f06b479b463021a2bdd1326703 e580da641335472ceb3c789b6cdc44ce2fc645c9 M include :040000 040000 4fd74db19c62825b12e3ba22a67dc2b1521e25f1 c80846f9403dd8590a0e29b42c57a8593a0ca1f7 M net revisions tested: 27, total time: 5h17m22.62242625s (build: 2h26m40.358867197s, test: 2h42m54.244688843s) first bad commit: 93531c6743157d7e8c5792f8ed1a57641149d62c net/ipv6: separate handling of FIB entries from dst based routes cc: ["davem@davemloft.net" "dsahern@gmail.com" "kuznet@ms2.inr.ac.ru" "linux-kernel@vger.kernel.org" "netdev@vger.kernel.org" "yoshfuji@linux-ipv6.org"] crash: KASAN: use-after-free Read in ip6_pol_route ================================================================== BUG: KASAN: use-after-free in find_rr_leaf net/ipv6/route.c:711 [inline] BUG: KASAN: use-after-free in rt6_select net/ipv6/route.c:766 [inline] BUG: KASAN: use-after-free in ip6_pol_route+0x16f3/0x1a70 net/ipv6/route.c:1833 Read of size 4 at addr ffff8800a819be70 by task syz-executor.1/16967 CPU: 0 PID: 16967 Comm: syz-executor.1 Not tainted 4.16.0+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x109/0x15a lib/dump_stack.c:113 print_address_description.cold.8+0x9/0x1ff mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report.cold.9+0x242/0x2fe mm/kasan/report.c:412 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:432 find_rr_leaf net/ipv6/route.c:711 [inline] rt6_select net/ipv6/route.c:766 [inline] ip6_pol_route+0x16f3/0x1a70 net/ipv6/route.c:1833 ip6_pol_route_output+0x3c/0x70 net/ipv6/route.c:2072 fib6_rule_lookup+0xee/0x410 net/ipv6/fib6_rules.c:85 ip6_route_output_flags+0x22a/0x2c0 net/ipv6/route.c:2100 ip6_dst_lookup_tail+0x3cd/0x1680 net/ipv6/ip6_output.c:992 ip6_dst_lookup_flow+0x9b/0x1e0 net/ipv6/ip6_output.c:1093 ip6_sk_dst_lookup_flow+0x452/0x910 net/ipv6/ip6_output.c:1131 udpv6_sendmsg+0x1365/0x26a0 net/ipv6/udp.c:1311 inet_sendmsg+0x108/0x440 net/ipv4/af_inet.c:798 sock_sendmsg_nosec net/socket.c:629 [inline] sock_sendmsg+0xb5/0xf0 net/socket.c:639 ___sys_sendmsg+0x28e/0x950 net/socket.c:2117 __sys_sendmmsg+0x160/0x370 net/socket.c:2212 SYSC_sendmmsg net/socket.c:2241 [inline] SyS_sendmmsg+0xf/0x20 net/socket.c:2238 do_syscall_64+0x1c7/0x690 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x459a59 RSP: 002b:00007f15c613ac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000459a59 RDX: 00000000000000c6 RSI: 0000000020006d00 RDI: 0000000000000004 RBP: 000000000075c070 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f15c613b6d4 R13: 00000000004c74b8 R14: 00000000004dd1a8 R15: 00000000ffffffff Allocated by task 16954: save_stack+0x43/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:553 kmem_cache_alloc_trace+0x152/0x790 mm/slab.c:3620 kmalloc include/linux/slab.h:512 [inline] kzalloc include/linux/slab.h:701 [inline] fib6_info_alloc+0x4e/0x1a0 net/ipv6/ip6_fib.c:152 ip6_route_info_create+0x564/0x34e0 net/ipv6/route.c:2914 ip6_route_add+0x18/0x80 net/ipv6/route.c:3053 addrconf_add_mroute+0x1bd/0x280 net/ipv6/addrconf.c:2402 addrconf_add_dev+0xea/0x170 net/ipv6/addrconf.c:2420 addrconf_dev_config+0x92/0x1b0 net/ipv6/addrconf.c:3278 addrconf_notify+0x2ec/0x1da0 net/ipv6/addrconf.c:3517 notifier_call_chain+0x8a/0x160 kernel/notifier.c:93 __raw_notifier_call_chain kernel/notifier.c:394 [inline] raw_notifier_call_chain+0x11/0x20 kernel/notifier.c:401 call_netdevice_notifiers_info+0x28/0x60 net/core/dev.c:1734 call_netdevice_notifiers net/core/dev.c:1752 [inline] dev_set_mtu+0x266/0x4b0 net/core/dev.c:7085 team_change_mtu+0xe2/0x2e0 drivers/net/team/team.c:1776 __dev_set_mtu net/core/dev.c:7039 [inline] dev_set_mtu+0x243/0x4b0 net/core/dev.c:7082 dev_ifsioc+0x48f/0x7c0 net/core/dev_ioctl.c:244 dev_ioctl+0x149/0xad0 net/core/dev_ioctl.c:500 sock_do_ioctl+0x16f/0x230 net/socket.c:980 sock_ioctl+0x281/0x500 net/socket.c:1081 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:500 [inline] do_vfs_ioctl+0x196/0xff0 fs/ioctl.c:684 ksys_ioctl+0x62/0x90 fs/ioctl.c:701 SYSC_ioctl fs/ioctl.c:708 [inline] SyS_ioctl+0x9/0x10 fs/ioctl.c:706 do_syscall_64+0x1c7/0x690 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x42/0xb7 Freed by task 16964: save_stack+0x43/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528 __cache_free mm/slab.c:3498 [inline] kfree+0xcf/0x270 mm/slab.c:3813 fib6_info_destroy+0x29b/0x370 net/ipv6/ip6_fib.c:209 fib6_info_release include/net/ip6_fib.h:344 [inline] fib6_del_route net/ipv6/ip6_fib.c:1784 [inline] fib6_del+0xad5/0xf30 net/ipv6/ip6_fib.c:1810 fib6_clean_node+0x2db/0x490 net/ipv6/ip6_fib.c:1971 fib6_walk_continue+0x3e0/0x7c0 net/ipv6/ip6_fib.c:1894 fib6_walk+0x90/0xe0 net/ipv6/ip6_fib.c:1942 fib6_clean_tree+0x93/0xc0 net/ipv6/ip6_fib.c:2019 __fib6_clean_all+0xdb/0x1d0 net/ipv6/ip6_fib.c:2035 fib6_clean_all+0xe/0x10 net/ipv6/ip6_fib.c:2046 rt6_sync_down_dev net/ipv6/route.c:3956 [inline] rt6_disable_ip+0xa8/0x5e0 net/ipv6/route.c:3961 addrconf_ifdown+0x7a/0xfa0 net/ipv6/addrconf.c:3631 addrconf_notify+0x4fa/0x1da0 net/ipv6/addrconf.c:3555 notifier_call_chain+0x8a/0x160 kernel/notifier.c:93 __raw_notifier_call_chain kernel/notifier.c:394 [inline] raw_notifier_call_chain+0x11/0x20 kernel/notifier.c:401 call_netdevice_notifiers_info+0x28/0x60 net/core/dev.c:1734 call_netdevice_notifiers net/core/dev.c:1752 [inline] dev_set_mtu+0x266/0x4b0 net/core/dev.c:7085 team_change_mtu+0xe2/0x2e0 drivers/net/team/team.c:1776 __dev_set_mtu net/core/dev.c:7039 [inline] dev_set_mtu+0x243/0x4b0 net/core/dev.c:7082 dev_ifsioc+0x48f/0x7c0 net/core/dev_ioctl.c:244 dev_ioctl+0x149/0xad0 net/core/dev_ioctl.c:500 sock_do_ioctl+0x16f/0x230 net/socket.c:980 sock_ioctl+0x281/0x500 net/socket.c:1081 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:500 [inline] do_vfs_ioctl+0x196/0xff0 fs/ioctl.c:684 ksys_ioctl+0x62/0x90 fs/ioctl.c:701 SYSC_ioctl fs/ioctl.c:708 [inline] SyS_ioctl+0x9/0x10 fs/ioctl.c:706 do_syscall_64+0x1c7/0x690 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x42/0xb7 The buggy address belongs to the object at ffff8800a819bd40 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 304 bytes inside of 512-byte region [ffff8800a819bd40, ffff8800a819bf40) The buggy address belongs to the page: page:ffffea0002a066c0 count:1 mapcount:0 mapping:ffff8800a819b0c0 index:0x0 flags: 0x1fffc0000000100(slab) raw: 01fffc0000000100 ffff8800a819b0c0 0000000000000000 0000000100000006 raw: ffffea0002588e60 ffffea0002819b60 ffff88012fe48940 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8800a819bd00: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb ffff8800a819bd80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8800a819be00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8800a819be80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8800a819bf00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ==================================================================