bisecting fixing commit since dce0f88600e49746b4bda873965b671a23ff4313 building syzkaller on ada108d08bee29122bf15427630464265c555cbc testing commit dce0f88600e49746b4bda873965b671a23ff4313 with gcc (GCC) 8.4.1 20210217 kernel signature: 1a791096778aace6a04dd23bf54a4a20205bbc4f807aabbbf3009f490b4e6c9f run #0: crashed: KASAN: use-after-free Write in tls_push_record run #1: crashed: WARNING in corrupted run #2: crashed: KASAN: use-after-free Write in tls_push_record run #3: crashed: KASAN: use-after-free Write in tls_push_record run #4: crashed: KASAN: slab-out-of-bounds Write in tls_push_record run #5: crashed: KASAN: use-after-free Write in tls_push_record run #6: crashed: KASAN: use-after-free Write in tls_push_record run #7: crashed: KASAN: use-after-free Write in tls_push_record run #8: crashed: KASAN: use-after-free Write in tls_push_record run #9: crashed: KASAN: use-after-free Write in tls_push_record run #10: crashed: KASAN: out-of-bounds Write in tls_push_record run #11: crashed: KASAN: use-after-free Write in tls_push_record run #12: crashed: KASAN: use-after-free Write in tls_push_record run #13: crashed: KASAN: slab-out-of-bounds Write in tls_push_record run #14: crashed: KASAN: use-after-free Write in tls_push_record run #15: crashed: KASAN: use-after-free Write in tls_push_record run #16: crashed: KASAN: use-after-free Write in tls_push_record run #17: crashed: KASAN: use-after-free Write in tls_push_record run #18: crashed: KASAN: use-after-free Write in tls_push_record run #19: crashed: KASAN: use-after-free Write in tls_push_record testing current HEAD 2034d6f0838e465dd8f120c4e946d8444b4bb5df testing commit 2034d6f0838e465dd8f120c4e946d8444b4bb5df with gcc (GCC) 8.4.1 20210217 kernel signature: 7a78c272ba2ea7d50514d2ff169ae2a14c6913efb76d79bdf2464036d80ca735 all runs: crashed: KASAN: use-after-free Write in tls_push_record revisions tested: 2, total time: 23m7.262626612s (build: 16m25.991218498s, test: 6m11.980397776s) the crash still happens on HEAD commit msg: Linux 4.19.184 crash: KASAN: use-after-free Write in tls_push_record FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 ================================================================== FAULT_INJECTION: forcing a failure. name fail_page_alloc, interval 1, probability 0, space 0, times 1 BUG: KASAN: use-after-free in tls_fill_prepend include/net/tls.h:379 [inline] BUG: KASAN: use-after-free in tls_push_record+0x116e/0x15f0 net/tls/tls_sw.c:220 Write of size 1 at addr ffff8881d9f60000 by task syz-executor.4/7185 CPU: 1 PID: 7185 Comm: syz-executor.4 Not tainted 4.19.184-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x17c/0x226 lib/dump_stack.c:118 print_address_description.cold.6+0x9/0x211 mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report mm/kasan/report.c:412 [inline] kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:396 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 __asan_report_store1_noabort+0x17/0x20 mm/kasan/report.c:435 tls_fill_prepend include/net/tls.h:379 [inline] tls_push_record+0x116e/0x15f0 net/tls/tls_sw.c:220 tls_sw_push_pending_record+0xe/0x10 net/tls/tls_sw.c:257 tls_push_pending_closed_record net/tls/tls_main.c:203 [inline] tls_push_pending_closed_record+0xbc/0x100 net/tls/tls_main.c:196 tls_complete_pending_work include/net/tls.h:309 [inline] tls_sk_proto_close+0x479/0x980 net/tls/tls_main.c:270 inet_release+0xb4/0x1b0 net/ipv4/af_inet.c:427 inet6_release+0x46/0x60 net/ipv6/af_inet6.c:472 __sock_release+0xc2/0x290 net/socket.c:579 sock_close+0x10/0x20 net/socket.c:1140 __fput+0x249/0x7f0 fs/file_table.c:278 ____fput+0x9/0x10 fs/file_table.c:309 task_work_run+0x108/0x180 kernel/task_work.c:113 get_signal+0x1352/0x1970 kernel/signal.c:2400 do_signal+0x87/0x1870 arch/x86/kernel/signal.c:799 exit_to_usermode_loop+0x159/0x1e0 arch/x86/entry/common.c:163 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline] syscall_return_slowpath arch/x86/entry/common.c:271 [inline] do_syscall_64+0x413/0x4e0 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4645a9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f11b730e198 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: 0000000000004000 RBX: 0000000000000000 RCX: 00000000004645a9 RDX: 00000000e0ffffff RSI: 00000000200005c0 RDI: 0000000000000003 RBP: 000000000051d8e0 R08: 0000000000000000 R09: 00000000000000d8 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000055bf00 R13: 00007f11b730e6bc R14: 0000000000000005 R15: 0000000000000001 The buggy address belongs to the page: page:ffffea000767d800 count:2 mapcount:0 mapping:0000000000000000 index:0x0 compound_mapcount: 0 flags: 0x17ffe0000008000(head) raw: 017ffe0000008000 dead000000000100 dead000000000200 0000000000000000 raw: 0000000000000000 0000000000000000 00000002ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8881d9f5ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8881d9f5ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff8881d9f60000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ^ ffff8881d9f60080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8881d9f60100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ================================================================== CPU: 0 PID: 7224 Comm: syz-executor.1 Tainted: G B 4.19.184-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x17c/0x226 lib/dump_stack.c:118 ------------[ cut here ]------------ fail_dump lib/fault-inject.c:51 [inline] should_fail.cold.2+0x5/0xa lib/fault-inject.c:149 __should_failslab+0xba/0xf0 mm/failslab.c:32 should_failslab+0x9/0x20 mm/slab_common.c:1588 slab_pre_alloc_hook mm/slab.h:424 [inline] slab_alloc mm/slab.c:3383 [inline] kmem_cache_alloc+0x28e/0x390 mm/slab.c:3557 ptlock_alloc+0x1d/0x70 mm/memory.c:4928 WARNING: CPU: 1 PID: 7185 at net/core/stream.c:208 sk_stream_kill_queues.cold.1+0xc/0x39 net/core/stream.c:208 ptlock_init include/linux/mm.h:1897 [inline] pgtable_page_ctor include/linux/mm.h:1931 [inline] pte_alloc_one+0x4e/0x130 arch/x86/mm/pgtable.c:38 Modules linked in: __pte_alloc+0x1d/0x2b0 mm/memory.c:665 CPU: 1 PID: 7185 Comm: syz-executor.4 Tainted: G B 4.19.184-syzkaller #0 do_anonymous_page+0xdac/0x1f40 mm/memory.c:3241 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:sk_stream_kill_queues.cold.1+0xc/0x39 net/core/stream.c:208 Code: 8b ed ff 0f 0b 44 8b 95 40 ff ff ff 8b 8d 38 ff ff ff 44 8b 8d 30 ff ff ff e9 14 09 7e fe 48 c7 c7 40 26 c0 87 e8 74 8b ed ff <0f> 0b e9 66 3b 7e fe 48 c7 c7 40 26 c0 87 e8 61 8b ed ff 0f 0b e9 handle_pte_fault mm/memory.c:4132 [inline] __handle_mm_fault+0x1cd4/0x4100 mm/memory.c:4258 RSP: 0018:ffff8881db8bf940 EFLAGS: 00010286 RAX: 0000000000000024 RBX: ffff8881da200f70 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff87679d40 RDI: ffffffff8a199aa0 handle_mm_fault+0x3dd/0x8b0 mm/memory.c:4295 __do_page_fault+0x50e/0xb30 arch/x86/mm/fault.c:1412 RBP: ffff8881db8bf980 R08: ffffed103ed25081 R09: ffffed103ed25080 R10: ffffed103ed25080 R11: ffff8881f6928407 R12: ffff8881da200d80 R13: ffff8881da200f08 R14: 0000000000000007 R15: ffff8881da200d80 FS: 00007f11b730e700(0000) GS:ffff8881f6900000(0000) knlGS:0000000000000000 do_page_fault+0x64/0x3b0 arch/x86/mm/fault.c:1487 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffc8ff62c20 CR3: 00000001d8b33001 CR4: 00000000001606e0 page_fault+0x1e/0x30 arch/x86/entry/entry_64.S:1205 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 RIP: 0010:copy_user_enhanced_fast_string+0xe/0x20 arch/x86/lib/copy_user_64.S:181 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Code: 89 d1 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 31 c0 0f 1f 00 c3 0f 1f 80 00 00 00 00 0f 1f 00 83 fa 40 0f 82 70 ff ff ff 89 d1 a4 31 c0 0f 1f 00 c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 83 Call Trace: RSP: 0018:ffff8881d7087908 EFLAGS: 00010202 RAX: 0000000000000000 RBX: 00000000200005c0 RCX: 0000000000000580 inet_csk_destroy_sock+0x129/0x390 net/ipv4/inet_connection_sock.c:874 RDX: 0000000000000580 RSI: 00000000200005c0 RDI: ffff8881d8e33640 tcp_close+0x821/0xf00 net/ipv4/tcp.c:2498 RBP: ffff8881d7087930 R08: 0000000000000000 R09: 0000000000000016 R10: ffffed103b1c6777 R11: ffff8881d8e33bbf R12: ffff8881d8e33640 tls_sk_proto_close+0x62a/0x980 net/tls/tls_main.c:312 R13: ffff8881d76e2580 R14: ffff8881d7087d78 R15: ffff8881d7087d28 _copy_from_iter_full+0x166/0x770 lib/iov_iter.c:724 inet_release+0xb4/0x1b0 net/ipv4/af_inet.c:427 inet6_release+0x46/0x60 net/ipv6/af_inet6.c:472 copy_from_iter_full include/linux/uio.h:124 [inline] skb_do_copy_data_nocache include/net/sock.h:1968 [inline] skb_add_data_nocache include/net/sock.h:1979 [inline] tcp_sendmsg_locked+0x18e3/0x3710 net/ipv4/tcp.c:1339 __sock_release+0xc2/0x290 net/socket.c:579 sock_close+0x10/0x20 net/socket.c:1140 __fput+0x249/0x7f0 fs/file_table.c:278 ____fput+0x9/0x10 fs/file_table.c:309 task_work_run+0x108/0x180 kernel/task_work.c:113 get_signal+0x1352/0x1970 kernel/signal.c:2400 do_signal+0x87/0x1870 arch/x86/kernel/signal.c:799 tcp_sendmsg+0x27/0x40 net/ipv4/tcp.c:1462 inet_sendmsg+0x108/0x440 net/ipv4/af_inet.c:798 sock_sendmsg_nosec net/socket.c:622 [inline] sock_sendmsg+0xac/0xf0 net/socket.c:632 __sys_sendto+0x1f2/0x2e0 net/socket.c:1787 exit_to_usermode_loop+0x159/0x1e0 arch/x86/entry/common.c:163 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline] syscall_return_slowpath arch/x86/entry/common.c:271 [inline] do_syscall_64+0x413/0x4e0 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4645a9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f11b730e198 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: 0000000000004000 RBX: 0000000000000000 RCX: 00000000004645a9 RDX: 00000000e0ffffff RSI: 00000000200005c0 RDI: 0000000000000003 __do_sys_sendto net/socket.c:1799 [inline] __se_sys_sendto net/socket.c:1795 [inline] __x64_sys_sendto+0xdc/0x1a0 net/socket.c:1795 RBP: 000000000051d8e0 R08: 0000000000000000 R09: 00000000000000d8 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000055bf00 R13: 00007f11b730e6bc R14: 0000000000000005 R15: 0000000000000001 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 irq event stamp: 5850 entry_SYSCALL_64_after_hwframe+0x49/0xbe hardirqs last enabled at (5849): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] hardirqs last enabled at (5849): [] _raw_spin_unlock_irqrestore+0x82/0xd0 kernel/locking/spinlock.c:184 hardirqs last disabled at (5850): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (5850): [] _raw_spin_lock_irqsave+0x74/0xd0 kernel/locking/spinlock.c:152 RIP: 0033:0x4645a9 softirqs last enabled at (5842): [] lock_sock_nested+0x82/0x100 net/core/sock.c:2867 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 softirqs last disabled at (5840): [] spin_lock_bh include/linux/spinlock.h:334 [inline] softirqs last disabled at (5840): [] lock_sock_nested+0x3a/0x100 net/core/sock.c:2864 RSP: 002b:00007fc7f84b9198 EFLAGS: 00000246 ORIG_RAX: 000000000000002c ---[ end trace 44e49370257a12d7 ]--- RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004645a9 RDX: 00000000e0ffffff RSI: 00000000200005c0 RDI: 0000000000000003 RBP: 000000000051d8e0 R08: 0000000000000000 R09: 00000000000000d8 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000055bfa0 R13: 00007fc7f84b96bc R14: 0000000000000005 R15: 0000000000000001 CPU: 1 PID: 7236 Comm: syz-executor.3 Tainted: G B W 4.19.184-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x17c/0x226 lib/dump_stack.c:118 fail_dump lib/fault-inject.c:51 [inline] should_fail.cold.2+0x5/0xa lib/fault-inject.c:149 __should_failslab+0xba/0xf0 mm/failslab.c:32 should_failslab+0x9/0x20 mm/slab_common.c:1588 slab_pre_alloc_hook mm/slab.h:424 [inline] slab_alloc mm/slab.c:3383 [inline] __do_kmalloc mm/slab.c:3725 [inline] __kmalloc+0x6f/0x3d0 mm/slab.c:3736 kmalloc include/linux/slab.h:520 [inline] gcmaes_encrypt.constprop.5+0x630/0xda0 arch/x86/crypto/aesni-intel_glue.c:952 generic_gcmaes_encrypt+0xfd/0x150 arch/x86/crypto/aesni-intel_glue.c:1297 crypto_aead_encrypt include/crypto/aead.h:335 [inline] gcmaes_wrapper_encrypt+0x109/0x180 arch/x86/crypto/aesni-intel_glue.c:1130 crypto_aead_encrypt include/crypto/aead.h:335 [inline] tls_do_encryption net/tls/tls_sw.c:193 [inline] tls_push_record+0x9ae/0x15f0 net/tls/tls_sw.c:228 tls_sw_sendmsg+0xb35/0x1010 net/tls/tls_sw.c:467 inet_sendmsg+0x108/0x440 net/ipv4/af_inet.c:798 sock_sendmsg_nosec net/socket.c:622 [inline] sock_sendmsg+0xac/0xf0 net/socket.c:632 __sys_sendto+0x1f2/0x2e0 net/socket.c:1787 __do_sys_sendto net/socket.c:1799 [inline] __se_sys_sendto net/socket.c:1795 [inline] __x64_sys_sendto+0xdc/0x1a0 net/socket.c:1795 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4645a9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd3b4126198 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004645a9 RDX: 00000000e0ffffff RSI: 00000000200005c0 RDI: 0000000000000003 RBP: 000000000051d8e0 R08: 0000000000000000 R09: 00000000000000d8 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000055bf00 R13: 00007fd3b41266bc R14: 0000000000000005 R15: 0000000000000001 ------------[ cut here ]------------ CPU: 0 PID: 7228 Comm: syz-executor.0 Tainted: G B W 4.19.184-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x17c/0x226 lib/dump_stack.c:118 fail_dump lib/fault-inject.c:51 [inline] should_fail.cold.2+0x5/0xa lib/fault-inject.c:149 should_fail_alloc_page mm/page_alloc.c:3088 [inline] prepare_alloc_pages mm/page_alloc.c:4346 [inline] __alloc_pages_nodemask+0x23c/0x25a0 mm/page_alloc.c:4393 TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. alloc_pages_current+0xd6/0x1b0 mm/mempolicy.c:2197 alloc_pages include/linux/gfp.h:532 [inline] skb_page_frag_refill+0x1e8/0x490 net/core/sock.c:2220 sk_page_frag_refill+0x46/0x1d0 net/core/sock.c:2240 tcp_sendmsg_locked+0xc83/0x3710 net/ipv4/tcp.c:1347 tcp_sendmsg+0x27/0x40 net/ipv4/tcp.c:1462 inet_sendmsg+0x108/0x440 net/ipv4/af_inet.c:798 sock_sendmsg_nosec net/socket.c:622 [inline] sock_sendmsg+0xac/0xf0 net/socket.c:632 __sys_sendto+0x1f2/0x2e0 net/socket.c:1787 __do_sys_sendto net/socket.c:1799 [inline] __se_sys_sendto net/socket.c:1795 [inline] __x64_sys_sendto+0xdc/0x1a0 net/socket.c:1795 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4645a9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ff2818e3198 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004645a9 RDX: 00000000e0ffffff RSI: 00000000200005c0 RDI: 0000000000000003 RBP: 000000000051d8e0 R08: 0000000000000000 R09: 00000000000000d8 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000055bfa0 R13: 00007ff2818e36bc R14: 0000000000000005 R15: 0000000000000001 TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. WARNING: CPU: 1 PID: 7185 at net/ipv4/af_inet.c:156 inet_sock_destruct.cold.3+0x9d/0xa4 net/ipv4/af_inet.c:156 Modules linked in: CPU: 1 PID: 7185 Comm: syz-executor.4 Tainted: G B W 4.19.184-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:inet_sock_destruct.cold.3+0x9d/0xa4 net/ipv4/af_inet.c:156 Code: 62 61 ec ff 0f 0b e9 d7 a8 ea fe 48 c7 c7 e0 de c7 87 e8 4f 61 ec ff 0f 0b e9 fa a8 ea fe 48 c7 c7 e0 de c7 87 e8 3c 61 ec ff <0f> 0b e9 1d a9 ea fe 48 c7 c7 e0 de c7 87 48 89 95 70 ff ff ff e8 RSP: 0018:ffff8881db8bf8d0 EFLAGS: 00010286 RAX: 0000000000000024 RBX: ffff8881da200d80 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff87679d40 RDI: ffffffff8a199aa0 RBP: ffff8881db8bf910 R08: ffffed103ed25081 R09: ffffed103ed25080 R10: ffffed103ed25080 R11: ffff8881f6928407 R12: ffff8881da200fbc R13: ffff8881da200f08 R14: 0000000000000007 R15: ffff8881da200d80 FS: 00007f11b730e700(0000) GS:ffff8881f6900000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f14dda30000 CR3: 00000001d8b33002 CR4: 00000000001606e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __sk_destruct+0x48/0x600 net/core/sock.c:1559 sk_destruct+0x83/0xb0 net/core/sock.c:1599 __sk_free+0x9e/0x230 net/core/sock.c:1610 sk_free+0x1a/0x20 net/core/sock.c:1621 sock_put include/net/sock.h:1711 [inline] tcp_close+0x9db/0xf00 net/ipv4/tcp.c:2506 tls_sk_proto_close+0x62a/0x980 net/tls/tls_main.c:312 inet_release+0xb4/0x1b0 net/ipv4/af_inet.c:427 inet6_release+0x46/0x60 net/ipv6/af_inet6.c:472 __sock_release+0xc2/0x290 net/socket.c:579 sock_close+0x10/0x20 net/socket.c:1140 __fput+0x249/0x7f0 fs/file_table.c:278 ____fput+0x9/0x10 fs/file_table.c:309 task_work_run+0x108/0x180 kernel/task_work.c:113 get_signal+0x1352/0x1970 kernel/signal.c:2400 do_signal+0x87/0x1870 arch/x86/kernel/signal.c:799 exit_to_usermode_loop+0x159/0x1e0 arch/x86/entry/common.c:163 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline] syscall_return_slowpath arch/x86/entry/common.c:271 [inline] do_syscall_64+0x413/0x4e0 arch/x86/entry/common.c:296 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4645a9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f11b730e198 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: 0000000000004000 RBX: 0000000000000000 RCX: 00000000004645a9 RDX: 00000000e0ffffff RSI: 00000000200005c0 RDI: 0000000000000003 RBP: 000000000051d8e0 R08: 0000000000000000 R09: 00000000000000d8 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000055bf00 R13: 00007f11b730e6bc R14: 0000000000000005 R15: 0000000000000001 irq event stamp: 5850 hardirqs last enabled at (5849): [] __raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline] hardirqs last enabled at (5849): [] _raw_spin_unlock_irqrestore+0x82/0xd0 kernel/locking/spinlock.c:184 hardirqs last disabled at (5850): [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:108 [inline] hardirqs last disabled at (5850): [] _raw_spin_lock_irqsave+0x74/0xd0 kernel/locking/spinlock.c:152 softirqs last enabled at (5842): [] lock_sock_nested+0x82/0x100 net/core/sock.c:2867 softirqs last disabled at (5840): [] spin_lock_bh include/linux/spinlock.h:334 [inline] softirqs last disabled at (5840): [] lock_sock_nested+0x3a/0x100 net/core/sock.c:2864 ---[ end trace 44e49370257a12d8 ]--- page:ffffea000767d800 count:0 mapcount:-128 mapping:0000000000000000 index:0x0 flags: 0x17ffe0000000000() raw: 017ffe0000000000 ffffea000752fa08 ffffea0007362808 0000000000000000 raw: 0000000000000000 0000000000000003 00000000ffffff7f 0000000000000000 page dumped because: VM_BUG_ON_PAGE(page_ref_count(page) == 0) ------------[ cut here ]------------ kernel BUG at include/linux/mm.h:519! invalid opcode: 0000 [#1] PREEMPT SMP KASAN CPU: 0 PID: 7236 Comm: syz-executor.3 Tainted: G B W 4.19.184-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:put_page_testzero include/linux/mm.h:519 [inline] RIP: 0010:put_page include/linux/mm.h:962 [inline] RIP: 0010:trim_sg+0x2d4/0x4f0 net/tls/tls_sw.c:84 Code: 5c ff ff ff 0f 0b 0f 85 c0 b7 02 01 48 83 c4 40 5b 41 5c 41 5d 41 5e 41 5f 5d c3 48 c7 c6 a0 7e c9 87 4c 89 f7 e8 8c 0f b2 fb <0f> 0b be 00 00 10 00 4c 89 ef 48 89 45 a0 e8 e9 d0 7b ff 48 8b 45 TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. RSP: 0018:ffff8881d8a2f9c0 EFLAGS: 00010246 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 RDX: 1ffffd4000ecfb07 RSI: 0000000000000000 RDI: ffffea000767d838 RBP: ffff8881d8a2fa28 R08: ffffed103ed05081 R09: ffffed103ed05080 R10: ffffed103ed05080 R11: ffff8881f6828407 R12: ffffea000767d834 R13: ffff8881d890c200 R14: ffffea000767d800 R15: dffffc0000000000 FS: 00007fd3b4126700(0000) GS:ffff8881f6800000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000000000055c061 CR3: 00000001dc51e004 CR4: 00000000001606f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: trim_both_sgl+0xd1/0x100 net/tls/tls_sw.c:111 tls_sw_sendmsg+0xdc2/0x1010 net/tls/tls_sw.c:484 inet_sendmsg+0x108/0x440 net/ipv4/af_inet.c:798 sock_sendmsg_nosec net/socket.c:622 [inline] sock_sendmsg+0xac/0xf0 net/socket.c:632 __sys_sendto+0x1f2/0x2e0 net/socket.c:1787 __do_sys_sendto net/socket.c:1799 [inline] __se_sys_sendto net/socket.c:1795 [inline] __x64_sys_sendto+0xdc/0x1a0 net/socket.c:1795 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4645a9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd3b4126198 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004645a9 RDX: 00000000e0ffffff RSI: 00000000200005c0 RDI: 0000000000000003 RBP: 000000000051d8e0 R08: 0000000000000000 R09: 00000000000000d8 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000055bf00 R13: 00007fd3b41266bc R14: 0000000000000005 R15: 0000000000000001 Modules linked in: ---[ end trace 44e49370257a12d9 ]--- RIP: 0010:put_page_testzero include/linux/mm.h:519 [inline] RIP: 0010:put_page include/linux/mm.h:962 [inline] RIP: 0010:trim_sg+0x2d4/0x4f0 net/tls/tls_sw.c:84 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 Code: 5c ff ff ff 0f 0b 0f 85 c0 b7 02 01 48 83 c4 40 5b 41 5c 41 5d 41 5e 41 5f 5d c3 48 c7 c6 a0 7e c9 87 4c 89 f7 e8 8c 0f b2 fb <0f> 0b be 00 00 10 00 4c 89 ef 48 89 45 a0 e8 e9 d0 7b ff 48 8b 45 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 CPU: 0 PID: 7268 Comm: syz-executor.1 Tainted: G B D W 4.19.184-syzkaller #0 FAULT_INJECTION: forcing a failure. name failslab, interval 1, probability 0, space 0, times 0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x17c/0x226 lib/dump_stack.c:118 fail_dump lib/fault-inject.c:51 [inline] should_fail.cold.2+0x5/0xa lib/fault-inject.c:149 __should_failslab+0xba/0xf0 mm/failslab.c:32 should_failslab+0x9/0x20 mm/slab_common.c:1588 slab_pre_alloc_hook mm/slab.h:424 [inline] slab_alloc mm/slab.c:3383 [inline] __do_kmalloc mm/slab.c:3725 [inline] __kmalloc+0x6f/0x3d0 mm/slab.c:3736 kmalloc include/linux/slab.h:520 [inline] gcmaes_encrypt.constprop.5+0x630/0xda0 arch/x86/crypto/aesni-intel_glue.c:952 generic_gcmaes_encrypt+0xfd/0x150 arch/x86/crypto/aesni-intel_glue.c:1297 crypto_aead_encrypt include/crypto/aead.h:335 [inline] gcmaes_wrapper_encrypt+0x109/0x180 arch/x86/crypto/aesni-intel_glue.c:1130 crypto_aead_encrypt include/crypto/aead.h:335 [inline] tls_do_encryption net/tls/tls_sw.c:193 [inline] tls_push_record+0x9ae/0x15f0 net/tls/tls_sw.c:228 tls_sw_sendmsg+0xb35/0x1010 net/tls/tls_sw.c:467 RSP: 0018:ffff8881d8a2f9c0 EFLAGS: 00010246 inet_sendmsg+0x108/0x440 net/ipv4/af_inet.c:798 sock_sendmsg_nosec net/socket.c:622 [inline] sock_sendmsg+0xac/0xf0 net/socket.c:632 __sys_sendto+0x1f2/0x2e0 net/socket.c:1787 __do_sys_sendto net/socket.c:1799 [inline] __se_sys_sendto net/socket.c:1795 [inline] __x64_sys_sendto+0xdc/0x1a0 net/socket.c:1795 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4645a9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fc7f84da198 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004645a9 RDX: 00000000e0ffffff RSI: 00000000200005c0 RDI: 0000000000000003 RBP: 000000000051d8e0 R08: 0000000000000000 R09: 00000000000000d8 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000055bf00 R13: 00007fc7f84da6bc R14: 0000000000000005 R15: 0000000000000001 CPU: 0 PID: 7277 Comm: syz-executor.0 Tainted: G B D W 4.19.184-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000000000 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x17c/0x226 lib/dump_stack.c:118 fail_dump lib/fault-inject.c:51 [inline] should_fail.cold.2+0x5/0xa lib/fault-inject.c:149 RDX: 1ffffd4000ecfb07 RSI: 0000000000000000 RDI: ffffea000767d838 __should_failslab+0xba/0xf0 mm/failslab.c:32 should_failslab+0x9/0x20 mm/slab_common.c:1588 RBP: ffff8881d8a2fa28 R08: ffffed103ed05081 R09: ffffed103ed05080 slab_pre_alloc_hook mm/slab.h:424 [inline] slab_alloc mm/slab.c:3383 [inline] __do_kmalloc mm/slab.c:3725 [inline] __kmalloc+0x6f/0x3d0 mm/slab.c:3736 kmalloc include/linux/slab.h:520 [inline] gcmaes_encrypt.constprop.5+0x630/0xda0 arch/x86/crypto/aesni-intel_glue.c:952 generic_gcmaes_encrypt+0xfd/0x150 arch/x86/crypto/aesni-intel_glue.c:1297 crypto_aead_encrypt include/crypto/aead.h:335 [inline] gcmaes_wrapper_encrypt+0x109/0x180 arch/x86/crypto/aesni-intel_glue.c:1130 crypto_aead_encrypt include/crypto/aead.h:335 [inline] tls_do_encryption net/tls/tls_sw.c:193 [inline] tls_push_record+0x9ae/0x15f0 net/tls/tls_sw.c:228 tls_sw_sendmsg+0xb35/0x1010 net/tls/tls_sw.c:467 inet_sendmsg+0x108/0x440 net/ipv4/af_inet.c:798 sock_sendmsg_nosec net/socket.c:622 [inline] sock_sendmsg+0xac/0xf0 net/socket.c:632 __sys_sendto+0x1f2/0x2e0 net/socket.c:1787 __do_sys_sendto net/socket.c:1799 [inline] __se_sys_sendto net/socket.c:1795 [inline] __x64_sys_sendto+0xdc/0x1a0 net/socket.c:1795 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293 entry_SYSCALL_64_after_hwframe+0x49/0xbe RIP: 0033:0x4645a9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ff281904198 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000004645a9 RDX: 00000000e0ffffff RSI: 00000000200005c0 RDI: 0000000000000003 RBP: 000000000051d8e0 R08: 0000000000000000 R09: 00000000000000d8 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000055bf00 R13: 00007ff2819046bc R14: 0000000000000005 R15: 0000000000000001 CPU: 0 PID: 7283 Comm: syz-executor.2 Tainted: G B D W 4.19.184-syzkaller #0 R10: ffffed103ed05080 R11: ffff8881f6828407 R12: ffffea000767d834 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x17c/0x226 lib/dump_stack.c:118 fail_dump lib/fault-inject.c:51 [inline] should_fail.cold.2+0x5/0xa lib/fault-inject.c:149 R13: ffff8881d890c200 R14: ffffea000767d800 R15: dffffc0000000000 __should_failslab+0xba/0xf0 mm/failslab.c:32 should_failslab+0x9/0x20 mm/slab_common.c:1588 slab_pre_alloc_hook mm/slab.h:424 [inline] slab_alloc mm/slab.c:3383 [inline] __do_kmalloc mm/slab.c:3725 [inline] __kmalloc+0x6f/0x3d0 mm/slab.c:3736 FS: 00007fd3b4126700(0000) GS:ffff8881f6900000(0000) knlGS:0000000000000000 kmalloc include/linux/slab.h:520 [inline] gcmaes_encrypt.constprop.5+0x630/0xda0 arch/x86/crypto/aesni-intel_glue.c:952 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f14dda48000 CR3: 00000001dc51e003 CR4: 00000000001606e0 generic_gcmaes_encrypt+0xfd/0x150 arch/x86/crypto/aesni-intel_glue.c:1297 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 crypto_aead_encrypt include/crypto/aead.h:335 [inline] gcmaes_wrapper_encrypt+0x109/0x180 arch/x86/crypto/aesni-intel_glue.c:1130 crypto_aead_encrypt include/crypto/aead.h:335 [inline] tls_do_encryption net/tls/tls_sw.c:193 [inline] tls_push_record+0x9ae/0x15f0 net/tls/tls_sw.c:228 tls_sw_sendmsg+0xb35/0x1010 net/tls/tls_sw.c:467 inet_sendmsg+0x108/0x440 net/ipv4/af_inet.c:798 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 sock_sendmsg_nosec net/socket.c:622 [inline] sock_sendmsg+0xac/0xf0 net/socket.c:632 __sys_sendto+0x1f2/0x2e0 net/socket.c:1787