[ 56.933573] audit: type=1800 audit(1560690493.666:28): pid=6701 uid=0 auid=4294967295 ses=4294967295 op="collect_data" cause="failed(directio)" comm="startpar" name="ssh" dev="sda1" ino=2417 res=0 [....] Starting periodic command scheduler: cron[?25l[?1c7[ ok 8[?25h[?0c. [....] Starting OpenBSD Secure Shell server: sshd[?25l[?1c7[ ok 8[?25h[?0c. [ 57.759133] audit: type=1800 audit(1560690494.496:29): pid=6701 uid=0 auid=4294967295 ses=4294967295 op="collect_data" cause="failed(directio)" comm="startpar" name="rc.local" dev="sda1" ino=2432 res=0 [ 57.780389] audit: type=1800 audit(1560690494.516:30): pid=6701 uid=0 auid=4294967295 ses=4294967295 op="collect_data" cause="failed(directio)" comm="startpar" name="rmnologin" dev="sda1" ino=2423 res=0 Debian GNU/Linux 7 syzkaller ttyS0 syzkaller login: [ 90.804352] IPVS: Creating netns size=2720 id=1 [ 90.809210] IPVS: ftp: loaded support on port[0] = 21 Warning: Permanently added '10.128.10.62' (ECDSA) to the list of known hosts. 2019/06/16 13:08:56 parsed 1 programs 2019/06/16 13:08:56 executed programs: 0 [ 99.782050] IPv6: ADDRCONF(NETDEV_CHANGE): nr3: link becomes ready [ 99.794821] IPv6: ADDRCONF(NETDEV_CHANGE): nr4: link becomes ready [ 99.800276] IPVS: Creating netns size=2720 id=2 [ 99.800401] IPVS: ftp: loaded support on port[0] = 21 [ 99.820515] IPv6: ADDRCONF(NETDEV_CHANGE): nr2: link becomes ready [ 99.828177] IPv6: ADDRCONF(NETDEV_CHANGE): nr1: link becomes ready [ 99.836176] IPv6: ADDRCONF(NETDEV_CHANGE): nr0: link becomes ready [ 99.843906] IPv6: ADDRCONF(NETDEV_CHANGE): nr5: link becomes ready [ 99.926068] IPVS: Creating netns size=2720 id=3 [ 99.930911] IPVS: ftp: loaded support on port[0] = 21 [ 100.036897] chnl_net:caif_netlink_parms(): no params data found [ 100.164446] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.172051] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.173971] IPVS: Creating netns size=2720 id=4 [ 100.174083] IPVS: ftp: loaded support on port[0] = 21 [ 100.191426] device bridge_slave_0 entered promiscuous mode [ 100.204654] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.211133] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.220032] device bridge_slave_1 entered promiscuous mode [ 100.266224] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 100.285865] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 100.386444] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 100.394560] team0: Port device team_slave_0 added [ 100.442060] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 100.450034] team0: Port device team_slave_1 added [ 100.493432] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 100.509950] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 100.518291] IPVS: Creating netns size=2720 id=5 [ 100.523096] IPVS: ftp: loaded support on port[0] = 21 [ 100.558279] chnl_net:caif_netlink_parms(): no params data found [ 100.610513] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 100.630678] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 100.814468] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.820868] bridge0: port 2(bridge_slave_1) entered forwarding state [ 100.827941] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.834303] bridge0: port 1(bridge_slave_0) entered forwarding state [ 100.843905] bridge0: port 1(bridge_slave_0) entered blocking state [ 100.850411] bridge0: port 1(bridge_slave_0) entered disabled state [ 100.860300] device bridge_slave_0 entered promiscuous mode [ 100.891835] bridge0: port 2(bridge_slave_1) entered blocking state [ 100.898648] bridge0: port 2(bridge_slave_1) entered disabled state [ 100.907836] device bridge_slave_1 entered promiscuous mode [ 100.922564] chnl_net:caif_netlink_parms(): no params data found [ 100.973425] IPVS: Creating netns size=2720 id=6 [ 100.978314] IPVS: ftp: loaded support on port[0] = 21 [ 101.011750] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.018765] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.042520] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 101.086720] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 101.253072] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.259969] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.268800] device bridge_slave_0 entered promiscuous mode [ 101.314481] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 101.322706] team0: Port device team_slave_0 added [ 101.342115] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.349438] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.359258] device bridge_slave_1 entered promiscuous mode [ 101.373924] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 101.382188] team0: Port device team_slave_1 added [ 101.430136] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 101.461746] chnl_net:caif_netlink_parms(): no params data found [ 101.475944] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 101.493454] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 101.499312] IPVS: Creating netns size=2720 id=7 [ 101.499424] IPVS: ftp: loaded support on port[0] = 21 [ 101.540888] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 101.620914] 8021q: adding VLAN 0 to HW filter on device bond0 [ 101.630332] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 101.639746] team0: Port device team_slave_0 added [ 101.673761] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 101.682560] team0: Port device team_slave_1 added [ 101.712059] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 101.748426] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 101.761346] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 101.783183] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 101.809032] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 101.830861] bridge0: port 1(bridge_slave_0) entered blocking state [ 101.837579] bridge0: port 1(bridge_slave_0) entered disabled state [ 101.846818] device bridge_slave_0 entered promiscuous mode [ 101.929886] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 101.941150] bridge0: port 2(bridge_slave_1) entered blocking state [ 101.948291] bridge0: port 2(bridge_slave_1) entered disabled state [ 101.957691] device bridge_slave_1 entered promiscuous mode [ 102.031899] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 102.096347] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 102.102425] 8021q: adding VLAN 0 to HW filter on device team0 [ 102.111702] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 102.130498] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 102.137892] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 102.148036] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 102.169499] chnl_net:caif_netlink_parms(): no params data found [ 102.233373] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 102.269458] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 102.278836] team0: Port device team_slave_0 added [ 102.296349] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 102.304074] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.310593] bridge0: port 1(bridge_slave_0) entered forwarding state [ 102.318699] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 102.326688] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.333035] bridge0: port 2(bridge_slave_1) entered forwarding state [ 102.387420] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 102.399692] team0: Port device team_slave_1 added [ 102.459448] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 102.470859] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 102.479006] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 102.517847] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 102.549132] chnl_net:caif_netlink_parms(): no params data found [ 102.654207] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 102.678257] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.684788] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.698088] device bridge_slave_0 entered promiscuous mode [ 102.707566] bridge0: port 2(bridge_slave_1) entered blocking state [ 102.714017] bridge0: port 2(bridge_slave_1) entered disabled state [ 102.723594] device bridge_slave_1 entered promiscuous mode [ 102.738263] 8021q: adding VLAN 0 to HW filter on device bond0 [ 102.748528] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 102.756397] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 102.784949] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 102.838585] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 102.848129] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 102.882813] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 102.894265] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 102.931743] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 102.972130] 8021q: adding VLAN 0 to HW filter on device bond0 [ 102.979125] bridge0: port 1(bridge_slave_0) entered blocking state [ 102.986659] bridge0: port 1(bridge_slave_0) entered disabled state [ 102.996399] device bridge_slave_0 entered promiscuous mode [ 103.003546] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 103.014942] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 103.021772] 8021q: adding VLAN 0 to HW filter on device team0 [ 103.050501] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.056964] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.066340] device bridge_slave_1 entered promiscuous mode [ 103.074476] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 103.083278] team0: Port device team_slave_0 added [ 103.111539] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 103.118879] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 103.127605] team0: Port device team_slave_1 added [ 103.154859] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 103.163722] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.170253] bridge0: port 1(bridge_slave_0) entered forwarding state [ 103.178470] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 103.187687] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 103.200330] bond0: Enslaving bond_slave_0 as an active interface with an up link [ 103.212894] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 103.224291] bond0: Enslaving bond_slave_1 as an active interface with an up link [ 103.286834] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 103.293929] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 103.302681] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.309091] bridge0: port 2(bridge_slave_1) entered forwarding state [ 103.322527] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 103.328903] 8021q: adding VLAN 0 to HW filter on device team0 [ 103.386577] IPv6: ADDRCONF(NETDEV_UP): team_slave_0: link is not ready [ 103.398117] team0: Port device team_slave_0 added [ 103.408128] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 103.417345] IPv6: ADDRCONF(NETDEV_UP): team_slave_1: link is not ready [ 103.425248] team0: Port device team_slave_1 added [ 103.446998] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 103.455120] bridge0: port 1(bridge_slave_0) entered blocking state [ 103.461649] bridge0: port 1(bridge_slave_0) entered forwarding state [ 103.469190] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 103.477632] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 103.485808] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 103.493430] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 103.500906] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 103.508863] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 103.526554] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_0: link is not ready [ 103.546199] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 103.555054] bridge0: port 2(bridge_slave_1) entered blocking state [ 103.561443] bridge0: port 2(bridge_slave_1) entered forwarding state [ 103.574684] IPv6: ADDRCONF(NETDEV_UP): bridge_slave_1: link is not ready [ 103.623339] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 103.631901] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 103.639683] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 103.649486] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 103.710232] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 103.719049] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 103.733098] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready [ 103.753176] IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready [ 103.763049] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 103.794124] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 103.817512] 8021q: adding VLAN 0 to HW filter on device bond0 [ 103.844337] IPv6: ADDRCONF(NETDEV_UP): bridge0: link is not ready [ 103.857894] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 103.920817] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 103.948148] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 103.954265] 8021q: adding VLAN 0 to HW filter on device team0 [ 104.011721] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 104.021194] bridge0: port 1(bridge_slave_0) entered blocking state [ 104.027761] bridge0: port 1(bridge_slave_0) entered forwarding state [ 104.036861] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 104.054974] 8021q: adding VLAN 0 to HW filter on device bond0 [ 104.073686] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 104.081838] bridge0: port 2(bridge_slave_1) entered blocking state [ 104.088249] bridge0: port 2(bridge_slave_1) entered forwarding state [ 104.129830] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 104.152129] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 104.183018] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 104.196077] 8021q: adding VLAN 0 to HW filter on device team0 [ 104.202570] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 104.215087] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 104.260256] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 104.291814] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 104.300439] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 104.310086] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 104.319047] bridge0: port 1(bridge_slave_0) entered blocking state [ 104.325458] bridge0: port 1(bridge_slave_0) entered forwarding state [ 104.343361] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 104.372118] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 104.387037] bridge0: port 2(bridge_slave_1) entered blocking state [ 104.393562] bridge0: port 2(bridge_slave_1) entered forwarding state [ 104.473359] 8021q: adding VLAN 0 to HW filter on device bond0 [ 104.502187] IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready [ 104.517661] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 104.528204] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 104.566924] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 104.574403] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 104.583677] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 104.609069] IPv6: ADDRCONF(NETDEV_UP): team0: link is not ready [ 104.615952] 8021q: adding VLAN 0 to HW filter on device team0 [ 104.642769] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 104.672206] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 104.680839] bridge0: port 1(bridge_slave_0) entered blocking state [ 104.687625] bridge0: port 1(bridge_slave_0) entered forwarding state 2019/06/16 13:09:01 executed programs: 9 [ 104.712977] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 104.721160] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 104.729470] bridge0: port 2(bridge_slave_1) entered blocking state [ 104.736041] bridge0: port 2(bridge_slave_1) entered forwarding state [ 104.835920] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 104.844097] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 104.900808] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 104.910810] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 104.954142] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready 2019/06/16 13:09:06 executed programs: 113 2019/06/16 13:09:11 executed programs: 238 2019/06/16 13:09:16 executed programs: 359 2019/06/16 13:09:21 executed programs: 484 2019/06/16 13:09:26 executed programs: 606 2019/06/16 13:09:31 executed programs: 729 2019/06/16 13:09:36 executed programs: 854 2019/06/16 13:09:41 executed programs: 977 2019/06/16 13:09:46 executed programs: 1100 2019/06/16 13:09:51 executed programs: 1222 2019/06/16 13:09:56 executed programs: 1344 2019/06/16 13:10:01 executed programs: 1465 2019/06/16 13:10:06 executed programs: 1587 2019/06/16 13:10:12 executed programs: 1704 2019/06/16 13:10:17 executed programs: 1827 2019/06/16 13:10:22 executed programs: 1949 2019/06/16 13:10:27 executed programs: 2073 2019/06/16 13:10:32 executed programs: 2193 2019/06/16 13:10:37 executed programs: 2312 2019/06/16 13:10:42 executed programs: 2434 2019/06/16 13:10:47 executed programs: 2556 2019/06/16 13:10:52 executed programs: 2669 2019/06/16 13:10:57 executed programs: 2793 2019/06/16 13:11:02 executed programs: 2913 2019/06/16 13:11:07 executed programs: 3037 2019/06/16 13:11:12 executed programs: 3153 2019/06/16 13:11:17 executed programs: 3272 2019/06/16 13:11:22 executed programs: 3393 2019/06/16 13:11:27 executed programs: 3515 2019/06/16 13:11:32 executed programs: 3640 2019/06/16 13:11:37 executed programs: 3760 2019/06/16 13:11:42 executed programs: 3886 2019/06/16 13:11:47 executed programs: 4006 2019/06/16 13:11:52 executed programs: 4132 2019/06/16 13:11:57 executed programs: 4256 2019/06/16 13:12:02 executed programs: 4380 2019/06/16 13:12:07 executed programs: 4495 2019/06/16 13:12:12 executed programs: 4615 2019/06/16 13:12:17 executed programs: 4740 2019/06/16 13:12:23 executed programs: 4865 2019/06/16 13:12:28 executed programs: 4986 2019/06/16 13:12:33 executed programs: 5112 2019/06/16 13:12:38 executed programs: 5239 2019/06/16 13:12:43 executed programs: 5355 2019/06/16 13:12:48 executed programs: 5479 2019/06/16 13:12:53 executed programs: 5603 2019/06/16 13:12:58 executed programs: 5722 2019/06/16 13:13:03 executed programs: 5848 2019/06/16 13:13:08 executed programs: 5967 2019/06/16 13:13:13 executed programs: 6092 2019/06/16 13:13:18 executed programs: 6211 2019/06/16 13:13:23 executed programs: 6326 2019/06/16 13:13:28 executed programs: 6449 2019/06/16 13:13:33 executed programs: 6570 2019/06/16 13:13:38 executed programs: 6697 2019/06/16 13:13:43 executed programs: 6822 2019/06/16 13:13:48 executed programs: 6944 2019/06/16 13:13:53 executed programs: 7065 2019/06/16 13:13:58 executed programs: 7181 2019/06/16 13:14:03 executed programs: 7305 2019/06/16 13:14:08 executed programs: 7427 2019/06/16 13:14:13 executed programs: 7546 2019/06/16 13:14:18 executed programs: 7665 2019/06/16 13:14:24 executed programs: 7786 2019/06/16 13:14:29 executed programs: 7906 2019/06/16 13:14:34 executed programs: 8031 [ 440.825060] ================================================================== [ 440.832540] BUG: KASAN: use-after-free in pneigh_get_next.isra.18+0x214/0x320 at addr ffff8800b14abf80 [ 440.841958] Read of size 8 by task syz-executor.2/12203 [ 440.847296] CPU: 1 PID: 12203 Comm: syz-executor.2 Not tainted 4.7.0+ #1 [ 440.854103] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 440.863430] 1ffffffff0d56312 ffff8800aef371c0 ffffffff829e0956 ffff8800b14abf80 [ 440.871421] ffff8800aef37250 ffff8800b14abf80 ffff88012bc00200 ffff8800aef37240 [ 440.879453] ffffffff8174e667 ffff8800aef37268 ffff8800aef37310 0000000000000282 [ 440.887490] Call Trace: [ 440.890104] [] dump_stack+0xe6/0x120 [ 440.895464] [] kasan_report_error+0x1e7/0x5b0 [ 440.901581] [] __asan_report_load8_noabort+0x3e/0x40 [ 440.908313] [] ? pneigh_get_next.isra.18+0x214/0x320 [ 440.915036] [] pneigh_get_next.isra.18+0x214/0x320 [ 440.921589] [] ? neigh_connected_output+0x510/0x510 [ 440.928293] [] ? mutex_lock_killable_nested+0xce0/0xce0 [ 440.935286] [] neigh_seq_next+0x91/0x1c0 [ 440.940994] [] seq_read+0x9e4/0x11a0 [ 440.946331] [] ? seq_hlist_next_rcu+0x130/0x130 [ 440.952652] [] ? rw_copy_check_uvector+0x97/0x280 [ 440.959161] [] ? rcu_read_lock_sched_held+0x9e/0x120 [ 440.965904] [] proc_reg_read+0xbc/0x180 [ 440.971515] [] do_loop_readv_writev+0x134/0x210 [ 440.977835] [] ? security_file_permission+0x148/0x1a0 [ 440.984648] [] ? proc_reg_write+0x180/0x180 [ 440.990586] [] ? proc_reg_write+0x180/0x180 [ 440.996527] [] do_readv_writev+0x565/0x660 [ 441.002385] [] ? vfs_write+0x4a0/0x4a0 [ 441.007956] [] ? perf_event_fork+0x20/0x20 [ 441.013828] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 441.020594] [] ? alloc_pages_current+0x1b0/0x490 [ 441.026975] [] vfs_readv+0x67/0xa0 [ 441.032149] [] default_file_splice_read+0x42d/0x800 [ 441.038786] [] ? __generic_file_splice_read+0xef0/0xef0 [ 441.045816] [] ? mark_held_locks+0xc8/0x120 [ 441.051802] [] ? debug_check_no_obj_freed+0x15f/0x760 [ 441.058624] [] ? _raw_spin_unlock_irqrestore+0x6a/0xd0 [ 441.065529] [] ? page_cache_pipe_buf_release+0x120/0x120 [ 441.072613] [] ? _raw_spin_unlock_irqrestore+0xa6/0xd0 [ 441.079523] [] ? mark_held_locks+0xc8/0x120 [ 441.085531] [] ? free_hot_cold_page+0x502/0xa70 [ 441.091828] [] ? trace_hardirqs_on_caller+0x44c/0x5e0 [ 441.098652] [] ? trace_hardirqs_on+0xd/0x10 [ 441.104610] [] ? __put_page+0x67/0x80 [ 441.110042] [] ? rw_verify_area+0xb8/0x2b0 [ 441.115905] [] do_splice_to+0xe3/0x140 [ 441.121412] [] splice_direct_to_actor+0x235/0x7c0 [ 441.127876] [] ? generic_pipe_buf_nosteal+0x10/0x10 [ 441.134511] [] ? do_splice_to+0x140/0x140 [ 441.140280] [] ? security_file_permission+0x6a/0x1a0 [ 441.147002] [] ? rw_verify_area+0xb8/0x2b0 [ 441.152855] [] do_splice_direct+0x14e/0x260 [ 441.158799] [] ? splice_direct_to_actor+0x7c0/0x7c0 [ 441.165449] [] ? percpu_down_read+0x52/0x90 [ 441.171398] [] ? __sb_start_write+0xb2/0xf0 [ 441.177337] [] ? __sb_start_write+0xb2/0xf0 [ 441.183276] [] do_sendfile+0x4c0/0xe40 [ 441.188783] [] ? do_compat_pwritev64.isra.24+0xc0/0xc0 [ 441.195749] [] ? __might_fault+0xf1/0x1b0 [ 441.201521] [] SyS_sendfile64+0x11d/0x120 [ 441.207289] [] ? SyS_sendfile+0x110/0x110 [ 441.213060] [] ? trace_hardirqs_on_caller+0x44c/0x5e0 [ 441.219888] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 441.226443] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 441.232994] Object at ffff8800b14abf80, in cache kmalloc-64 [ 441.238675] Object freed, allocated with size 36 bytes [ 441.243923] Allocation: [ 441.246475] PID = 12208 [ 441.249032] [] save_stack_trace+0x26/0x50 [ 441.254948] [] save_stack+0x46/0xd0 [ 441.260318] [] kasan_kmalloc+0xda/0x100 [ 441.266043] [] __kmalloc+0x169/0x7a0 [ 441.271506] [] pneigh_lookup+0x15e/0x3b0 [ 441.277486] [] arp_req_set+0x323/0x540 [ 441.283154] [] arp_ioctl+0x1c5/0x5c0 [ 441.288612] [] inet_ioctl+0x6b/0x170 [ 441.294067] [] sock_do_ioctl+0x62/0xa0 [ 441.299730] [] sock_ioctl+0x2a3/0x390 [ 441.305278] [] do_vfs_ioctl+0x17f/0xec0 [ 441.311029] [] SyS_ioctl+0x74/0x80 [ 441.316332] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 441.323016] Deallocation: [ 441.325752] PID = 12198 [ 441.328311] [] save_stack_trace+0x26/0x50 [ 441.334203] [] save_stack+0x46/0xd0 [ 441.339578] [] kasan_slab_free+0x9b/0xd0 [ 441.350004] [] kfree+0xcf/0x2c0 [ 441.356373] [] neigh_ifdown+0x162/0x220 [ 441.362096] [] arp_ifdown+0x13/0x20 [ 441.367468] [] inetdev_event+0x573/0xf60 [ 441.373279] [] notifier_call_chain+0x8b/0x170 [ 441.379582] [] raw_notifier_call_chain+0x11/0x20 [ 441.386097] [] call_netdevice_notifiers_info+0x47/0x80 [ 441.393122] [] rollback_registered_many+0x3fa/0x740 [ 441.399885] [] rollback_registered+0x6f/0x90 [ 441.406033] [] unregister_netdevice_queue+0x68/0x120 [ 441.412889] [] __tun_detach+0x73e/0x9c0 [ 441.418657] [] tun_chr_close+0x40/0x60 [ 441.424283] [] __fput+0x20e/0x750 [ 441.429484] [] ____fput+0x9/0x10 [ 441.434601] [] task_work_run+0xd9/0x150 [ 441.440326] [] exit_to_usermode_loop+0x183/0x1c0 [ 441.446836] [] syscall_return_slowpath+0x275/0x2f0 [ 441.453534] [] entry_SYSCALL_64_fastpath+0xbf/0xc1 [ 441.460220] Memory state around the buggy address: [ 441.465122] ffff8800b14abe80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 441.472455] ffff8800b14abf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 441.479793] >ffff8800b14abf80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 441.487139] ^ [ 441.490482] ffff8800b14ac000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 441.497826] ffff8800b14ac080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 441.505157] ================================================================== [ 441.512487] Disabling lock debugging due to kernel taint [ 441.517949] ================================================================== [ 441.526797] BUG: KASAN: use-after-free in pneigh_get_next.isra.18+0x1f7/0x320 at addr ffff8800a7868848 [ 441.536212] Read of size 8 by task syz-executor.2/12203 [ 441.541548] CPU: 1 PID: 12203 Comm: syz-executor.2 Tainted: G B 4.7.0+ #1 [ 441.549572] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 441.558910] 1ffffffff0d56312 ffff8800aef371c0 ffffffff829e0956 ffff8800a7868840 [ 441.566906] ffff8800aef37250 ffff8800a7868840 ffff88012bc00500 ffff8800aef37240 [ 441.574898] ffffffff8174e667 0000000000000010 ffff880000000000 0000000000000282 [ 441.582890] Call Trace: [ 441.585452] [] dump_stack+0xe6/0x120 [ 441.590811] [] kasan_report_error+0x1e7/0x5b0 [ 441.596927] [] __asan_report_load8_noabort+0x3e/0x40 [ 441.603649] [] ? pneigh_get_next.isra.18+0x1f7/0x320 [ 441.610374] [] pneigh_get_next.isra.18+0x1f7/0x320 [ 441.616938] [] ? neigh_connected_output+0x510/0x510 [ 441.623580] [] ? mutex_lock_killable_nested+0xce0/0xce0 [ 441.630566] [] neigh_seq_next+0x91/0x1c0 [ 441.636251] [] seq_read+0x9e4/0x11a0 [ 441.641584] [] ? seq_hlist_next_rcu+0x130/0x130 [ 441.647874] [] ? rw_copy_check_uvector+0x97/0x280 [ 441.654341] [] ? rcu_read_lock_sched_held+0x9e/0x120 [ 441.661066] [] proc_reg_read+0xbc/0x180 [ 441.666664] [] do_loop_readv_writev+0x134/0x210 [ 441.672954] [] ? security_file_permission+0x148/0x1a0 [ 441.679762] [] ? proc_reg_write+0x180/0x180 [ 441.685718] [] ? proc_reg_write+0x180/0x180 [ 441.691660] [] do_readv_writev+0x565/0x660 [ 441.697514] [] ? vfs_write+0x4a0/0x4a0 [ 441.703032] [] ? perf_event_fork+0x20/0x20 [ 441.708905] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 441.715634] [] ? alloc_pages_current+0x1b0/0x490 [ 441.722009] [] vfs_readv+0x67/0xa0 [ 441.727173] [] default_file_splice_read+0x42d/0x800 [ 441.733811] [] ? __generic_file_splice_read+0xef0/0xef0 [ 441.740798] [] ? mark_held_locks+0xc8/0x120 [ 441.746751] [] ? debug_check_no_obj_freed+0x15f/0x760 [ 441.753574] [] ? _raw_spin_unlock_irqrestore+0x6a/0xd0 [ 441.760485] [] ? page_cache_pipe_buf_release+0x120/0x120 [ 441.767574] [] ? _raw_spin_unlock_irqrestore+0xa6/0xd0 [ 441.774474] [] ? mark_held_locks+0xc8/0x120 [ 441.780419] [] ? free_hot_cold_page+0x502/0xa70 [ 441.786710] [] ? trace_hardirqs_on_caller+0x44c/0x5e0 [ 441.793535] [] ? trace_hardirqs_on+0xd/0x10 [ 441.799482] [] ? __put_page+0x67/0x80 [ 441.804904] [] ? rw_verify_area+0xb8/0x2b0 [ 441.810759] [] do_splice_to+0xe3/0x140 [ 441.816281] [] splice_direct_to_actor+0x235/0x7c0 [ 441.822745] [] ? generic_pipe_buf_nosteal+0x10/0x10 [ 441.829382] [] ? do_splice_to+0x140/0x140 [ 441.835153] [] ? security_file_permission+0x6a/0x1a0 [ 441.841877] [] ? rw_verify_area+0xb8/0x2b0 [ 441.847734] [] do_splice_direct+0x14e/0x260 [ 441.853675] [] ? splice_direct_to_actor+0x7c0/0x7c0 [ 441.860312] [] ? percpu_down_read+0x52/0x90 [ 441.866261] [] ? __sb_start_write+0xb2/0xf0 [ 441.872208] [] ? __sb_start_write+0xb2/0xf0 [ 441.878148] [] do_sendfile+0x4c0/0xe40 [ 441.883660] [] ? do_compat_pwritev64.isra.24+0xc0/0xc0 [ 441.890555] [] ? __might_fault+0xf1/0x1b0 [ 441.896337] [] SyS_sendfile64+0x11d/0x120 [ 441.902105] [] ? SyS_sendfile+0x110/0x110 [ 441.907878] [] ? trace_hardirqs_on_caller+0x44c/0x5e0 [ 441.914694] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 441.921244] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 441.927792] Object at ffff8800a7868840, in cache kmalloc-256 [ 441.933558] Object freed, allocated with size 198 bytes [ 441.938890] Allocation: [ 441.941442] PID = 12203 [ 441.943998] [] save_stack_trace+0x26/0x50 [ 441.949894] [] save_stack+0x46/0xd0 [ 441.955269] [] kasan_kmalloc+0xda/0x100 [ 441.960982] [] __kmalloc+0x169/0x7a0 [ 441.966437] [] __proc_create+0x136/0x570 [ 441.972240] [] proc_create_data+0x55/0x140 [ 441.978223] [] snmp6_register_dev+0xb0/0x130 [ 441.984433] [] ipv6_add_dev+0x55c/0xfd0 [ 441.990176] [] addrconf_notify+0x764/0x1cf0 [ 441.996239] [] notifier_call_chain+0x8b/0x170 [ 442.002476] [] raw_notifier_call_chain+0x11/0x20 [ 442.008973] [] call_netdevice_notifiers_info+0x47/0x80 [ 442.015992] [] register_netdevice+0x907/0xd60 [ 442.022227] [] __tun_chr_ioctl+0x13e0/0x3540 [ 442.028373] [] tun_chr_ioctl+0xe/0x10 [ 442.033923] [] do_vfs_ioctl+0x17f/0xec0 [ 442.039640] [] SyS_ioctl+0x74/0x80 [ 442.044932] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 442.051608] Deallocation: [ 442.054338] PID = 12198 [ 442.056892] [] save_stack_trace+0x26/0x50 [ 442.062798] [] save_stack+0x46/0xd0 [ 442.068166] [] kasan_slab_free+0x9b/0xd0 [ 442.073982] [] kfree+0xcf/0x2c0 [ 442.079003] [] pde_put+0x73/0xc0 [ 442.084125] [] remove_proc_subtree+0x1cb/0x240 [ 442.090462] [] proc_remove+0x38/0x50 [ 442.095916] [] snmp6_unregister_dev+0xac/0x120 [ 442.102252] [] addrconf_ifdown+0xa51/0xcd0 [ 442.108234] [] addrconf_notify+0x710/0x1cf0 [ 442.114298] [] notifier_call_chain+0x8b/0x170 [ 442.120535] [] raw_notifier_call_chain+0x11/0x20 [ 442.127029] [] call_netdevice_notifiers_info+0x47/0x80 [ 442.134044] [] rollback_registered_many+0x3fa/0x740 [ 442.140803] [] rollback_registered+0x6f/0x90 [ 442.146958] [] unregister_netdevice_queue+0x68/0x120 [ 442.153799] [] __tun_detach+0x73e/0x9c0 [ 442.159524] [] tun_chr_close+0x40/0x60 [ 442.165153] [] __fput+0x20e/0x750 [ 442.170348] [] ____fput+0x9/0x10 [ 442.175452] [] task_work_run+0xd9/0x150 [ 442.181195] [] exit_to_usermode_loop+0x183/0x1c0 [ 442.187704] [] syscall_return_slowpath+0x275/0x2f0 [ 442.194383] [] entry_SYSCALL_64_fastpath+0xbf/0xc1 [ 442.201059] Memory state around the buggy address: [ 442.205958] ffff8800a7868700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 442.213297] ffff8800a7868780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 fc [ 442.220624] >ffff8800a7868800: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 442.227954] ^ [ 442.233632] ffff8800a7868880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 442.240961] ffff8800a7868900: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 442.248291] ================================================================== [ 442.255656] ================================================================== [ 442.262999] BUG: KASAN: use-after-free in pneigh_get_next.isra.18+0x214/0x320 at addr ffff8800a7868840 [ 442.272430] Read of size 8 by task syz-executor.2/12203 [ 442.277780] CPU: 1 PID: 12203 Comm: syz-executor.2 Tainted: G B 4.7.0+ #1 [ 442.285803] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 442.295128] 1ffffffff0d56312 ffff8800aef371c0 ffffffff829e0956 ffff8800a7868840 [ 442.303114] ffff8800aef37250 ffff8800a7868840 ffff88012bc00500 ffff8800aef37240 [ 442.311106] ffffffff8174e667 0000000000000010 ffff880000000000 0000000000000282 [ 442.319084] Call Trace: [ 442.321647] [] dump_stack+0xe6/0x120 [ 442.327003] [] kasan_report_error+0x1e7/0x5b0 [ 442.333122] [] __asan_report_load8_noabort+0x3e/0x40 [ 442.339849] [] ? pneigh_get_next.isra.18+0x214/0x320 [ 442.346589] [] pneigh_get_next.isra.18+0x214/0x320 [ 442.353143] [] ? neigh_connected_output+0x510/0x510 [ 442.359781] [] ? mutex_lock_killable_nested+0xce0/0xce0 [ 442.366780] [] neigh_seq_next+0x91/0x1c0 [ 442.372464] [] seq_read+0x9e4/0x11a0 [ 442.377798] [] ? seq_hlist_next_rcu+0x130/0x130 [ 442.384089] [] ? rw_copy_check_uvector+0x97/0x280 [ 442.390555] [] ? rcu_read_lock_sched_held+0x9e/0x120 [ 442.397281] [] proc_reg_read+0xbc/0x180 [ 442.402875] [] do_loop_readv_writev+0x134/0x210 [ 442.409165] [] ? security_file_permission+0x148/0x1a0 [ 442.415993] [] ? proc_reg_write+0x180/0x180 [ 442.421937] [] ? proc_reg_write+0x180/0x180 [ 442.427892] [] do_readv_writev+0x565/0x660 [ 442.433754] [] ? vfs_write+0x4a0/0x4a0 [ 442.439275] [] ? perf_event_fork+0x20/0x20 [ 442.445129] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 442.451857] [] ? alloc_pages_current+0x1b0/0x490 [ 442.458234] [] vfs_readv+0x67/0xa0 [ 442.463398] [] default_file_splice_read+0x42d/0x800 [ 442.470036] [] ? __generic_file_splice_read+0xef0/0xef0 [ 442.477038] [] ? mark_held_locks+0xc8/0x120 [ 442.482982] [] ? debug_check_no_obj_freed+0x15f/0x760 [ 442.489793] [] ? _raw_spin_unlock_irqrestore+0x6a/0xd0 [ 442.496688] [] ? page_cache_pipe_buf_release+0x120/0x120 [ 442.503756] [] ? _raw_spin_unlock_irqrestore+0xa6/0xd0 [ 442.510657] [] ? mark_held_locks+0xc8/0x120 [ 442.516607] [] ? free_hot_cold_page+0x502/0xa70 [ 442.522895] [] ? trace_hardirqs_on_caller+0x44c/0x5e0 [ 442.529719] [] ? trace_hardirqs_on+0xd/0x10 [ 442.535671] [] ? __put_page+0x67/0x80 [ 442.541098] [] ? rw_verify_area+0xb8/0x2b0 [ 442.546963] [] do_splice_to+0xe3/0x140 [ 442.552470] [] splice_direct_to_actor+0x235/0x7c0 [ 442.558943] [] ? generic_pipe_buf_nosteal+0x10/0x10 [ 442.565580] [] ? do_splice_to+0x140/0x140 [ 442.571356] [] ? security_file_permission+0x6a/0x1a0 [ 442.578080] [] ? rw_verify_area+0xb8/0x2b0 [ 442.583932] [] do_splice_direct+0x14e/0x260 [ 442.589872] [] ? splice_direct_to_actor+0x7c0/0x7c0 [ 442.596506] [] ? percpu_down_read+0x52/0x90 [ 442.602447] [] ? __sb_start_write+0xb2/0xf0 [ 442.608410] [] ? __sb_start_write+0xb2/0xf0 [ 442.614357] [] do_sendfile+0x4c0/0xe40 [ 442.619878] [] ? do_compat_pwritev64.isra.24+0xc0/0xc0 [ 442.626775] [] ? __might_fault+0xf1/0x1b0 [ 442.632544] [] SyS_sendfile64+0x11d/0x120 [ 442.638311] [] ? SyS_sendfile+0x110/0x110 [ 442.644080] [] ? trace_hardirqs_on_caller+0x44c/0x5e0 [ 442.650905] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 442.657456] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 442.664005] Object at ffff8800a7868840, in cache kmalloc-256 [ 442.669774] Object freed, allocated with size 198 bytes [ 442.675111] Allocation: [ 442.677671] PID = 12203 [ 442.680227] [] save_stack_trace+0x26/0x50 [ 442.686116] [] save_stack+0x46/0xd0 [ 442.691481] [] kasan_kmalloc+0xda/0x100 [ 442.697199] [] __kmalloc+0x169/0x7a0 [ 442.702661] [] __proc_create+0x136/0x570 [ 442.708464] [] proc_create_data+0x55/0x140 [ 442.714440] [] snmp6_register_dev+0xb0/0x130 [ 442.720587] [] ipv6_add_dev+0x55c/0xfd0 [ 442.726308] [] addrconf_notify+0x764/0x1cf0 [ 442.732370] [] notifier_call_chain+0x8b/0x170 [ 442.738610] [] raw_notifier_call_chain+0x11/0x20 [ 442.745113] [] call_netdevice_notifiers_info+0x47/0x80 [ 442.752135] [] register_netdevice+0x907/0xd60 [ 442.758373] [] __tun_chr_ioctl+0x13e0/0x3540 [ 442.764519] [] tun_chr_ioctl+0xe/0x10 [ 442.770057] [] do_vfs_ioctl+0x17f/0xec0 [ 442.775780] [] SyS_ioctl+0x74/0x80 [ 442.781060] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 442.787736] Deallocation: [ 442.790473] PID = 12198 [ 442.793028] [] save_stack_trace+0x26/0x50 [ 442.798928] [] save_stack+0x46/0xd0 [ 442.804300] [] kasan_slab_free+0x9b/0xd0 [ 442.810101] [] kfree+0xcf/0x2c0 [ 442.815141] [] pde_put+0x73/0xc0 [ 442.820248] [] remove_proc_subtree+0x1cb/0x240 [ 442.826689] [] proc_remove+0x38/0x50 [ 442.832174] [] snmp6_unregister_dev+0xac/0x120 [ 442.838523] [] addrconf_ifdown+0xa51/0xcd0 [ 442.844501] [] addrconf_notify+0x710/0x1cf0 [ 442.850568] [] notifier_call_chain+0x8b/0x170 [ 442.856809] [] raw_notifier_call_chain+0x11/0x20 [ 442.863303] [] call_netdevice_notifiers_info+0x47/0x80 [ 442.870317] [] rollback_registered_many+0x3fa/0x740 [ 442.877091] [] rollback_registered+0x6f/0x90 [ 442.883240] [] unregister_netdevice_queue+0x68/0x120 [ 442.890084] [] __tun_detach+0x73e/0x9c0 [ 442.895820] [] tun_chr_close+0x40/0x60 [ 442.901452] [] __fput+0x20e/0x750 [ 442.906677] [] ____fput+0x9/0x10 [ 442.911786] [] task_work_run+0xd9/0x150 [ 442.917515] [] exit_to_usermode_loop+0x183/0x1c0 [ 442.924017] [] syscall_return_slowpath+0x275/0x2f0 [ 442.930705] [] entry_SYSCALL_64_fastpath+0xbf/0xc1 [ 442.937391] Memory state around the buggy address: [ 442.942289] ffff8800a7868700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 442.949616] ffff8800a7868780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 06 fc [ 442.956945] >ffff8800a7868800: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 442.964273] ^ [ 442.969705] ffff8800a7868880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 442.977039] ffff8800a7868900: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 442.984368] ================================================================== [ 442.991746] ================================================================== [ 442.999088] BUG: KASAN: use-after-free in pneigh_get_next.isra.18+0x1f7/0x320 at addr ffff8800a7868348 [ 443.008502] Read of size 8 by task syz-executor.2/12203 [ 443.013840] CPU: 1 PID: 12203 Comm: syz-executor.2 Tainted: G B 4.7.0+ #1 [ 443.021869] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 443.031193] 1ffffffff0d56312 ffff8800aef371c0 ffffffff829e0956 ffff8800a7868340 [ 443.039203] ffff8800aef37250 ffff8800a7868340 ffff88012bc00500 ffff8800aef37240 [ 443.047209] ffffffff8174e667 0000000000000010 ffff880000000000 0000000000000282 [ 443.055213] Call Trace: [ 443.057773] [] dump_stack+0xe6/0x120 [ 443.063109] [] kasan_report_error+0x1e7/0x5b0 [ 443.069227] [] __asan_report_load8_noabort+0x3e/0x40 [ 443.075953] [] ? pneigh_get_next.isra.18+0x1f7/0x320 [ 443.082675] [] pneigh_get_next.isra.18+0x1f7/0x320 [ 443.089223] [] ? neigh_connected_output+0x510/0x510 [ 443.095861] [] ? mutex_lock_killable_nested+0xce0/0xce0 [ 443.102845] [] neigh_seq_next+0x91/0x1c0 [ 443.108530] [] seq_read+0x9e4/0x11a0 [ 443.113864] [] ? seq_hlist_next_rcu+0x130/0x130 [ 443.120153] [] ? rw_copy_check_uvector+0x97/0x280 [ 443.126618] [] ? rcu_read_lock_sched_held+0x9e/0x120 [ 443.133345] [] proc_reg_read+0xbc/0x180 [ 443.138941] [] do_loop_readv_writev+0x134/0x210 [ 443.145234] [] ? security_file_permission+0x148/0x1a0 [ 443.152044] [] ? proc_reg_write+0x180/0x180 [ 443.157984] [] ? proc_reg_write+0x180/0x180 [ 443.163926] [] do_readv_writev+0x565/0x660 [ 443.169782] [] ? vfs_write+0x4a0/0x4a0 [ 443.175292] [] ? perf_event_fork+0x20/0x20 [ 443.181150] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 443.187874] [] ? alloc_pages_current+0x1b0/0x490 [ 443.194248] [] vfs_readv+0x67/0xa0 [ 443.199407] [] default_file_splice_read+0x42d/0x800 [ 443.206047] [] ? __generic_file_splice_read+0xef0/0xef0 [ 443.213035] [] ? mark_held_locks+0xc8/0x120 [ 443.218981] [] ? debug_check_no_obj_freed+0x15f/0x760 [ 443.225792] [] ? _raw_spin_unlock_irqrestore+0x6a/0xd0 [ 443.232686] [] ? page_cache_pipe_buf_release+0x120/0x120 [ 443.239757] [] ? _raw_spin_unlock_irqrestore+0xa6/0xd0 [ 443.246654] [] ? mark_held_locks+0xc8/0x120 [ 443.252599] [] ? free_hot_cold_page+0x502/0xa70 [ 443.258898] [] ? trace_hardirqs_on_caller+0x44c/0x5e0 [ 443.265708] [] ? trace_hardirqs_on+0xd/0x10 [ 443.271651] [] ? __put_page+0x67/0x80 [ 443.277073] [] ? rw_verify_area+0xb8/0x2b0 [ 443.282930] [] do_splice_to+0xe3/0x140 [ 443.288440] [] splice_direct_to_actor+0x235/0x7c0 [ 443.294903] [] ? generic_pipe_buf_nosteal+0x10/0x10 [ 443.301538] [] ? do_splice_to+0x140/0x140 [ 443.307321] [] ? security_file_permission+0x6a/0x1a0 [ 443.314045] [] ? rw_verify_area+0xb8/0x2b0 [ 443.319900] [] do_splice_direct+0x14e/0x260 [ 443.325839] [] ? splice_direct_to_actor+0x7c0/0x7c0 [ 443.332473] [] ? percpu_down_read+0x52/0x90 [ 443.338417] [] ? __sb_start_write+0xb2/0xf0 [ 443.344358] [] ? __sb_start_write+0xb2/0xf0 [ 443.350298] [] do_sendfile+0x4c0/0xe40 [ 443.356985] [] ? do_compat_pwritev64.isra.24+0xc0/0xc0 [ 443.363886] [] ? __might_fault+0xf1/0x1b0 [ 443.369656] [] SyS_sendfile64+0x11d/0x120 [ 443.375422] [] ? SyS_sendfile+0x110/0x110 [ 443.381194] [] ? trace_hardirqs_on_caller+0x44c/0x5e0 [ 443.388006] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 443.394557] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 443.401112] Object at ffff8800a7868340, in cache kmalloc-256 [ 443.406880] Object freed, allocated with size 240 bytes [ 443.412211] Allocation: [ 443.414769] PID = 12203 [ 443.417327] [] save_stack_trace+0x26/0x50 [ 443.423218] [] save_stack+0x46/0xd0 [ 443.428588] [] kasan_kmalloc+0xda/0x100 [ 443.434301] [] kmem_cache_alloc_trace+0x142/0x780 [ 443.440894] [] ipv6_dev_mc_inc+0x294/0xde0 [ 443.446927] [] ipv6_add_dev+0xa96/0xfd0 [ 443.452644] [] addrconf_notify+0x764/0x1cf0 [ 443.458712] [] notifier_call_chain+0x8b/0x170 [ 443.464951] [] raw_notifier_call_chain+0x11/0x20 [ 443.471450] [] call_netdevice_notifiers_info+0x47/0x80 [ 443.478472] [] register_netdevice+0x907/0xd60 [ 443.484710] [] __tun_chr_ioctl+0x13e0/0x3540 [ 443.490879] [] tun_chr_ioctl+0xe/0x10 [ 443.496418] [] do_vfs_ioctl+0x17f/0xec0 [ 443.502151] [] SyS_ioctl+0x74/0x80 [ 443.507430] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 443.514113] Deallocation: [ 443.516841] PID = 12198 [ 443.519395] [] save_stack_trace+0x26/0x50 [ 443.526733] [] save_stack+0x46/0xd0 [ 443.532112] [] kasan_slab_free+0x9b/0xd0 [ 443.537921] [] kfree+0xcf/0x2c0 [ 443.542946] [] ma_put+0x42/0x60 [ 443.547969] [] __ipv6_dev_mc_dec+0x216/0x380 [ 443.554121] [] ipv6_mc_destroy_dev+0x28/0x150 [ 443.560355] [] addrconf_ifdown+0x7f8/0xcd0 [ 443.566328] [] addrconf_notify+0x710/0x1cf0 [ 443.572396] [] notifier_call_chain+0x8b/0x170 [ 443.578631] [] raw_notifier_call_chain+0x11/0x20 [ 443.585129] [] call_netdevice_notifiers_info+0x47/0x80 [ 443.592147] [] rollback_registered_many+0x3fa/0x740 [ 443.598903] [] rollback_registered+0x6f/0x90 [ 443.605094] [] unregister_netdevice_queue+0x68/0x120 [ 443.611939] [] __tun_detach+0x73e/0x9c0 [ 443.617660] [] tun_chr_close+0x40/0x60 [ 443.623299] [] __fput+0x20e/0x750 [ 443.628504] [] ____fput+0x9/0x10 [ 443.633620] [] task_work_run+0xd9/0x150 [ 443.639345] [] exit_to_usermode_loop+0x183/0x1c0 [ 443.645849] [] syscall_return_slowpath+0x275/0x2f0 [ 443.652528] [] entry_SYSCALL_64_fastpath+0xbf/0xc1 [ 443.659207] Memory state around the buggy address: [ 443.664110] ffff8800a7868200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 443.671440] ffff8800a7868280: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 443.678768] >ffff8800a7868300: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 443.686095] ^ [ 443.691773] ffff8800a7868380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 443.699104] ffff8800a7868400: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 443.706436] ================================================================== [ 443.713783] ================================================================== [ 443.721128] BUG: KASAN: use-after-free in pneigh_get_next.isra.18+0x214/0x320 at addr ffff8800a7868340 [ 443.730555] Read of size 8 by task syz-executor.2/12203 [ 443.735894] CPU: 1 PID: 12203 Comm: syz-executor.2 Tainted: G B 4.7.0+ #1 [ 443.743929] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 443.753273] 1ffffffff0d56312 ffff8800aef371c0 ffffffff829e0956 ffff8800a7868340 [ 443.761282] ffff8800aef37250 ffff8800a7868340 ffff88012bc00500 ffff8800aef37240 [ 443.769286] ffffffff8174e667 0000000000000010 ffff880000000000 0000000000000282 [ 443.777297] Call Trace: [ 443.779858] [] dump_stack+0xe6/0x120 [ 443.785190] [] kasan_report_error+0x1e7/0x5b0 [ 443.791305] [] __asan_report_load8_noabort+0x3e/0x40 [ 443.798034] [] ? pneigh_get_next.isra.18+0x214/0x320 [ 443.804757] [] pneigh_get_next.isra.18+0x214/0x320 [ 443.811306] [] ? neigh_connected_output+0x510/0x510 [ 443.817942] [] ? mutex_lock_killable_nested+0xce0/0xce0 [ 443.824931] [] neigh_seq_next+0x91/0x1c0 [ 443.830631] [] seq_read+0x9e4/0x11a0 [ 443.835967] [] ? seq_hlist_next_rcu+0x130/0x130 [ 443.842257] [] ? rw_copy_check_uvector+0x97/0x280 [ 443.848727] [] ? rcu_read_lock_sched_held+0x9e/0x120 [ 443.855452] [] proc_reg_read+0xbc/0x180 [ 443.861046] [] do_loop_readv_writev+0x134/0x210 [ 443.867353] [] ? security_file_permission+0x148/0x1a0 [ 443.874168] [] ? proc_reg_write+0x180/0x180 [ 443.880109] [] ? proc_reg_write+0x180/0x180 [ 443.886051] [] do_readv_writev+0x565/0x660 [ 443.891904] [] ? vfs_write+0x4a0/0x4a0 [ 443.897609] [] ? perf_event_fork+0x20/0x20 [ 443.903466] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 443.910208] [] ? alloc_pages_current+0x1b0/0x490 [ 443.916591] [] vfs_readv+0x67/0xa0 [ 443.921750] [] default_file_splice_read+0x42d/0x800 [ 443.928384] [] ? __generic_file_splice_read+0xef0/0xef0 [ 443.935370] [] ? mark_held_locks+0xc8/0x120 [ 443.941312] [] ? debug_check_no_obj_freed+0x15f/0x760 [ 443.948124] [] ? _raw_spin_unlock_irqrestore+0x6a/0xd0 [ 443.955047] [] ? page_cache_pipe_buf_release+0x120/0x120 [ 443.962216] [] ? _raw_spin_unlock_irqrestore+0xa6/0xd0 [ 443.969128] [] ? mark_held_locks+0xc8/0x120 [ 443.975074] [] ? free_hot_cold_page+0x502/0xa70 [ 443.981359] [] ? trace_hardirqs_on_caller+0x44c/0x5e0 [ 443.988170] [] ? trace_hardirqs_on+0xd/0x10 [ 443.994111] [] ? __put_page+0x67/0x80 [ 443.999530] [] ? rw_verify_area+0xb8/0x2b0 [ 444.005391] [] do_splice_to+0xe3/0x140 [ 444.010902] [] splice_direct_to_actor+0x235/0x7c0 [ 444.017361] [] ? generic_pipe_buf_nosteal+0x10/0x10 [ 444.023993] [] ? do_splice_to+0x140/0x140 [ 444.029758] [] ? security_file_permission+0x6a/0x1a0 [ 444.036482] [] ? rw_verify_area+0xb8/0x2b0 [ 444.042333] [] do_splice_direct+0x14e/0x260 [ 444.048272] [] ? splice_direct_to_actor+0x7c0/0x7c0 [ 444.054907] [] ? percpu_down_read+0x52/0x90 [ 444.060848] [] ? __sb_start_write+0xb2/0xf0 [ 444.066789] [] ? __sb_start_write+0xb2/0xf0 [ 444.072726] [] do_sendfile+0x4c0/0xe40 [ 444.078236] [] ? do_compat_pwritev64.isra.24+0xc0/0xc0 [ 444.085132] [] ? __might_fault+0xf1/0x1b0 [ 444.090896] [] SyS_sendfile64+0x11d/0x120 [ 444.096665] [] ? SyS_sendfile+0x110/0x110 [ 444.102433] [] ? trace_hardirqs_on_caller+0x44c/0x5e0 [ 444.109243] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 444.115803] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 444.122352] Object at ffff8800a7868340, in cache kmalloc-256 [ 444.128118] Object freed, allocated with size 240 bytes [ 444.133449] Allocation: [ 444.136002] PID = 12203 [ 444.138557] [] save_stack_trace+0x26/0x50 [ 444.144459] [] save_stack+0x46/0xd0 [ 444.149827] [] kasan_kmalloc+0xda/0x100 [ 444.155537] [] kmem_cache_alloc_trace+0x142/0x780 [ 444.162117] [] ipv6_dev_mc_inc+0x294/0xde0 [ 444.168092] [] ipv6_add_dev+0xa96/0xfd0 [ 444.173804] [] addrconf_notify+0x764/0x1cf0 [ 444.179870] [] notifier_call_chain+0x8b/0x170 [ 444.186126] [] raw_notifier_call_chain+0x11/0x20 [ 444.192624] [] call_netdevice_notifiers_info+0x47/0x80 [ 444.199661] [] register_netdevice+0x907/0xd60 [ 444.205925] [] __tun_chr_ioctl+0x13e0/0x3540 [ 444.212071] [] tun_chr_ioctl+0xe/0x10 [ 444.217629] [] do_vfs_ioctl+0x17f/0xec0 [ 444.223357] [] SyS_ioctl+0x74/0x80 [ 444.228649] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 444.235323] Deallocation: [ 444.238052] PID = 12198 [ 444.240608] [] save_stack_trace+0x26/0x50 [ 444.246497] [] save_stack+0x46/0xd0 [ 444.251865] [] kasan_slab_free+0x9b/0xd0 [ 444.257665] [] kfree+0xcf/0x2c0 [ 444.262712] [] ma_put+0x42/0x60 [ 444.267733] [] __ipv6_dev_mc_dec+0x216/0x380 [ 444.273900] [] ipv6_mc_destroy_dev+0x28/0x150 [ 444.280139] [] addrconf_ifdown+0x7f8/0xcd0 [ 444.286114] [] addrconf_notify+0x710/0x1cf0 [ 444.292172] [] notifier_call_chain+0x8b/0x170 [ 444.298410] [] raw_notifier_call_chain+0x11/0x20 [ 444.304913] [] call_netdevice_notifiers_info+0x47/0x80 [ 444.311929] [] rollback_registered_many+0x3fa/0x740 [ 444.318682] [] rollback_registered+0x6f/0x90 [ 444.324825] [] unregister_netdevice_queue+0x68/0x120 [ 444.331691] [] __tun_detach+0x73e/0x9c0 [ 444.337532] [] tun_chr_close+0x40/0x60 [ 444.344722] [] __fput+0x20e/0x750 [ 444.349920] [] ____fput+0x9/0x10 [ 444.355041] [] task_work_run+0xd9/0x150 [ 444.360783] [] exit_to_usermode_loop+0x183/0x1c0 [ 444.367288] [] syscall_return_slowpath+0x275/0x2f0 [ 444.373952] [] entry_SYSCALL_64_fastpath+0xbf/0xc1 [ 444.380620] Memory state around the buggy address: [ 444.385527] ffff8800a7868200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 444.392872] ffff8800a7868280: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc [ 444.400213] >ffff8800a7868300: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 444.407562] ^ [ 444.412987] ffff8800a7868380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 444.420314] ffff8800a7868400: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 444.427642] ================================================================== [ 444.435007] ================================================================== [ 444.442353] BUG: KASAN: use-after-free in pneigh_get_next.isra.18+0x1f7/0x320 at addr ffff8800a7868488 [ 444.451781] Read of size 8 by task syz-executor.2/12203 [ 444.457116] CPU: 1 PID: 12203 Comm: syz-executor.2 Tainted: G B 4.7.0+ #1 [ 444.465156] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 444.474485] 1ffffffff0d56312 ffff8800aef371c0 ffffffff829e0956 ffff8800a7868480 [ 444.482489] ffff8800aef37250 ffff8800a7868480 ffff88012bc00500 ffff8800aef37240 [ 444.490500] ffffffff8174e667 0000000000000010 ffff880000000000 0000000000000282 [ 444.498479] Call Trace: [ 444.501036] [] dump_stack+0xe6/0x120 [ 444.506373] [] kasan_report_error+0x1e7/0x5b0 [ 444.512486] [] __asan_report_load8_noabort+0x3e/0x40 [ 444.519208] [] ? pneigh_get_next.isra.18+0x1f7/0x320 [ 444.525934] [] pneigh_get_next.isra.18+0x1f7/0x320 [ 444.532482] [] ? neigh_connected_output+0x510/0x510 [ 444.539118] [] ? mutex_lock_killable_nested+0xce0/0xce0 [ 444.546101] [] neigh_seq_next+0x91/0x1c0 [ 444.551779] [] seq_read+0x9e4/0x11a0 [ 444.557113] [] ? seq_hlist_next_rcu+0x130/0x130 [ 444.563400] [] ? rw_copy_check_uvector+0x97/0x280 [ 444.569863] [] ? rcu_read_lock_sched_held+0x9e/0x120 [ 444.576588] [] proc_reg_read+0xbc/0x180 [ 444.582182] [] do_loop_readv_writev+0x134/0x210 [ 444.588470] [] ? security_file_permission+0x148/0x1a0 [ 444.595281] [] ? proc_reg_write+0x180/0x180 [ 444.601224] [] ? proc_reg_write+0x180/0x180 [ 444.607162] [] do_readv_writev+0x565/0x660 [ 444.613034] [] ? vfs_write+0x4a0/0x4a0 [ 444.618555] [] ? perf_event_fork+0x20/0x20 [ 444.624408] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 444.631145] [] ? alloc_pages_current+0x1b0/0x490 [ 444.637519] [] vfs_readv+0x67/0xa0 [ 444.642677] [] default_file_splice_read+0x42d/0x800 [ 444.649326] [] ? __generic_file_splice_read+0xef0/0xef0 [ 444.656315] [] ? mark_held_locks+0xc8/0x120 [ 444.662255] [] ? debug_check_no_obj_freed+0x15f/0x760 [ 444.669064] [] ? _raw_spin_unlock_irqrestore+0x6a/0xd0 [ 444.675981] [] ? page_cache_pipe_buf_release+0x120/0x120 [ 444.683055] [] ? _raw_spin_unlock_irqrestore+0xa6/0xd0 [ 444.689956] [] ? mark_held_locks+0xc8/0x120 [ 444.695900] [] ? free_hot_cold_page+0x502/0xa70 [ 444.702184] [] ? trace_hardirqs_on_caller+0x44c/0x5e0 [ 444.708993] [] ? trace_hardirqs_on+0xd/0x10 [ 444.714931] [] ? __put_page+0x67/0x80 [ 444.720366] [] ? rw_verify_area+0xb8/0x2b0 [ 444.726226] [] do_splice_to+0xe3/0x140 [ 444.731731] [] splice_direct_to_actor+0x235/0x7c0 [ 444.738193] [] ? generic_pipe_buf_nosteal+0x10/0x10 [ 444.744829] [] ? do_splice_to+0x140/0x140 [ 444.750595] [] ? security_file_permission+0x6a/0x1a0 [ 444.757327] [] ? rw_verify_area+0xb8/0x2b0 [ 444.763178] [] do_splice_direct+0x14e/0x260 [ 444.769120] [] ? splice_direct_to_actor+0x7c0/0x7c0 [ 444.775756] [] ? percpu_down_read+0x52/0x90 [ 444.781693] [] ? __sb_start_write+0xb2/0xf0 [ 444.787632] [] ? __sb_start_write+0xb2/0xf0 [ 444.793572] [] do_sendfile+0x4c0/0xe40 [ 444.799097] [] ? do_compat_pwritev64.isra.24+0xc0/0xc0 [ 444.806000] [] ? __might_fault+0xf1/0x1b0 [ 444.811766] [] SyS_sendfile64+0x11d/0x120 [ 444.817533] [] ? SyS_sendfile+0x110/0x110 [ 444.824436] [] ? trace_hardirqs_on_caller+0x44c/0x5e0 [ 444.831345] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 444.837896] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 444.844442] Object at ffff8800a7868480, in cache kmalloc-256 [ 444.850206] Object freed, allocated with size 240 bytes [ 444.855535] Allocation: [ 444.858090] PID = 12203 [ 444.860641] [] save_stack_trace+0x26/0x50 [ 444.866531] [] save_stack+0x46/0xd0 [ 444.871892] [] kasan_kmalloc+0xda/0x100 [ 444.877600] [] kmem_cache_alloc_trace+0x142/0x780 [ 444.884198] [] ipv6_dev_mc_inc+0x294/0xde0 [ 444.890174] [] ipv6_add_dev+0xa87/0xfd0 [ 444.895888] [] addrconf_notify+0x764/0x1cf0 [ 444.901946] [] notifier_call_chain+0x8b/0x170 [ 444.908182] [] raw_notifier_call_chain+0x11/0x20 [ 444.914684] [] call_netdevice_notifiers_info+0x47/0x80 [ 444.921702] [] register_netdevice+0x907/0xd60 [ 444.927936] [] __tun_chr_ioctl+0x13e0/0x3540 [ 444.934080] [] tun_chr_ioctl+0xe/0x10 [ 444.939620] [] do_vfs_ioctl+0x17f/0xec0 [ 444.945338] [] SyS_ioctl+0x74/0x80 [ 444.950619] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 444.957288] Deallocation: [ 444.960013] PID = 12198 [ 444.962563] [] save_stack_trace+0x26/0x50 [ 444.968452] [] save_stack+0x46/0xd0 [ 444.973835] [] kasan_slab_free+0x9b/0xd0 [ 444.979640] [] kfree+0xcf/0x2c0 [ 444.984657] [] ma_put+0x42/0x60 [ 444.989682] [] ipv6_mc_destroy_dev+0xe1/0x150 [ 444.995920] [] addrconf_ifdown+0x7f8/0xcd0 [ 445.001894] [] addrconf_notify+0x710/0x1cf0 [ 445.007952] [] notifier_call_chain+0x8b/0x170 [ 445.014194] [] raw_notifier_call_chain+0x11/0x20 [ 445.020689] [] call_netdevice_notifiers_info+0x47/0x80 [ 445.027702] [] rollback_registered_many+0x3fa/0x740 [ 445.034458] [] rollback_registered+0x6f/0x90 [ 445.040601] [] unregister_netdevice_queue+0x68/0x120 [ 445.047444] [] __tun_detach+0x73e/0x9c0 [ 445.053161] [] tun_chr_close+0x40/0x60 [ 445.058788] [] __fput+0x20e/0x750 [ 445.063978] [] ____fput+0x9/0x10 [ 445.069090] [] task_work_run+0xd9/0x150 [ 445.074824] [] exit_to_usermode_loop+0x183/0x1c0 [ 445.081331] [] syscall_return_slowpath+0x275/0x2f0 [ 445.088000] [] entry_SYSCALL_64_fastpath+0xbf/0xc1 [ 445.094671] Memory state around the buggy address: [ 445.099575] ffff8800a7868380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 445.106905] ffff8800a7868400: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 445.114231] >ffff8800a7868480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 445.121646] ^ [ 445.125242] ffff8800a7868500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 445.132569] ffff8800a7868580: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00 [ 445.139895] ================================================================== [ 445.147260] ================================================================== [ 445.154621] BUG: KASAN: use-after-free in pneigh_get_next.isra.18+0x214/0x320 at addr ffff8800a7868480 [ 445.164032] Read of size 8 by task syz-executor.2/12203 [ 445.169365] CPU: 1 PID: 12203 Comm: syz-executor.2 Tainted: G B 4.7.0+ #1 [ 445.177398] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 445.186819] 1ffffffff0d56312 ffff8800aef371c0 ffffffff829e0956 ffff8800a7868480 [ 445.194813] ffff8800aef37250 ffff8800a7868480 ffff88012bc00500 ffff8800aef37240 [ 445.202795] ffffffff8174e667 0000000000000010 ffff880000000000 0000000000000282 [ 445.210796] Call Trace: [ 445.213358] [] dump_stack+0xe6/0x120 [ 445.218694] [] kasan_report_error+0x1e7/0x5b0 [ 445.224819] [] __asan_report_load8_noabort+0x3e/0x40 [ 445.231549] [] ? pneigh_get_next.isra.18+0x214/0x320 [ 445.238268] [] pneigh_get_next.isra.18+0x214/0x320 [ 445.244814] [] ? neigh_connected_output+0x510/0x510 [ 445.251461] [] ? mutex_lock_killable_nested+0xce0/0xce0 [ 445.258446] [] neigh_seq_next+0x91/0x1c0 [ 445.264127] [] seq_read+0x9e4/0x11a0 [ 445.269469] [] ? seq_hlist_next_rcu+0x130/0x130 [ 445.275849] [] ? rw_copy_check_uvector+0x97/0x280 [ 445.282311] [] ? rcu_read_lock_sched_held+0x9e/0x120 [ 445.289050] [] proc_reg_read+0xbc/0x180 [ 445.294645] [] do_loop_readv_writev+0x134/0x210 [ 445.300936] [] ? security_file_permission+0x148/0x1a0 [ 445.307742] [] ? proc_reg_write+0x180/0x180 [ 445.313687] [] ? proc_reg_write+0x180/0x180 [ 445.319647] [] do_readv_writev+0x565/0x660 [ 445.325509] [] ? vfs_write+0x4a0/0x4a0 [ 445.331021] [] ? perf_event_fork+0x20/0x20 [ 445.336874] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 445.343595] [] ? alloc_pages_current+0x1b0/0x490 [ 445.349968] [] vfs_readv+0x67/0xa0 [ 445.356266] [] default_file_splice_read+0x42d/0x800 [ 445.362900] [] ? __generic_file_splice_read+0xef0/0xef0 [ 445.369882] [] ? mark_held_locks+0xc8/0x120 [ 445.375825] [] ? debug_check_no_obj_freed+0x15f/0x760 [ 445.382637] [] ? _raw_spin_unlock_irqrestore+0x6a/0xd0 [ 445.389533] [] ? page_cache_pipe_buf_release+0x120/0x120 [ 445.396601] [] ? _raw_spin_unlock_irqrestore+0xa6/0xd0 [ 445.403499] [] ? mark_held_locks+0xc8/0x120 [ 445.409455] [] ? free_hot_cold_page+0x502/0xa70 [ 445.415746] [] ? trace_hardirqs_on_caller+0x44c/0x5e0 [ 445.422552] [] ? trace_hardirqs_on+0xd/0x10 [ 445.428500] [] ? __put_page+0x67/0x80 [ 445.434004] [] ? rw_verify_area+0xb8/0x2b0 [ 445.439857] [] do_splice_to+0xe3/0x140 [ 445.445364] [] splice_direct_to_actor+0x235/0x7c0 [ 445.451833] [] ? generic_pipe_buf_nosteal+0x10/0x10 [ 445.458469] [] ? do_splice_to+0x140/0x140 [ 445.464247] [] ? security_file_permission+0x6a/0x1a0 [ 445.470975] [] ? rw_verify_area+0xb8/0x2b0 [ 445.476835] [] do_splice_direct+0x14e/0x260 [ 445.482774] [] ? splice_direct_to_actor+0x7c0/0x7c0 [ 445.489410] [] ? percpu_down_read+0x52/0x90 [ 445.495352] [] ? __sb_start_write+0xb2/0xf0 [ 445.501297] [] ? __sb_start_write+0xb2/0xf0 [ 445.507237] [] do_sendfile+0x4c0/0xe40 [ 445.512759] [] ? do_compat_pwritev64.isra.24+0xc0/0xc0 [ 445.519657] [] ? __might_fault+0xf1/0x1b0 [ 445.525428] [] SyS_sendfile64+0x11d/0x120 [ 445.531987] [] ? SyS_sendfile+0x110/0x110 [ 445.537756] [] ? trace_hardirqs_on_caller+0x44c/0x5e0 [ 445.544563] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 445.551114] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 445.557663] Object at ffff8800a7868480, in cache kmalloc-256 [ 445.563426] Object freed, allocated with size 240 bytes [ 445.568758] Allocation: [ 445.571311] PID = 12203 [ 445.573864] [] save_stack_trace+0x26/0x50 [ 445.579753] [] save_stack+0x46/0xd0 [ 445.585118] [] kasan_kmalloc+0xda/0x100 [ 445.590831] [] kmem_cache_alloc_trace+0x142/0x780 [ 445.597417] [] ipv6_dev_mc_inc+0x294/0xde0 [ 445.603401] [] ipv6_add_dev+0xa87/0xfd0 [ 445.609129] [] addrconf_notify+0x764/0x1cf0 [ 445.615205] [] notifier_call_chain+0x8b/0x170 [ 445.621437] [] raw_notifier_call_chain+0x11/0x20 [ 445.627926] [] call_netdevice_notifiers_info+0x47/0x80 [ 445.634954] [] register_netdevice+0x907/0xd60 [ 445.641197] [] __tun_chr_ioctl+0x13e0/0x3540 [ 445.647347] [] tun_chr_ioctl+0xe/0x10 [ 445.652881] [] do_vfs_ioctl+0x17f/0xec0 [ 445.658592] [] SyS_ioctl+0x74/0x80 [ 445.663871] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 445.670549] Deallocation: [ 445.673274] PID = 12198 [ 445.675847] [] save_stack_trace+0x26/0x50 [ 445.681743] [] save_stack+0x46/0xd0 [ 445.687108] [] kasan_slab_free+0x9b/0xd0 [ 445.692911] [] kfree+0xcf/0x2c0 [ 445.697934] [] ma_put+0x42/0x60 [ 445.702954] [] ipv6_mc_destroy_dev+0xe1/0x150 [ 445.709188] [] addrconf_ifdown+0x7f8/0xcd0 [ 445.715212] [] addrconf_notify+0x710/0x1cf0 [ 445.721270] [] notifier_call_chain+0x8b/0x170 [ 445.727504] [] raw_notifier_call_chain+0x11/0x20 [ 445.734015] [] call_netdevice_notifiers_info+0x47/0x80 [ 445.741035] [] rollback_registered_many+0x3fa/0x740 [ 445.747791] [] rollback_registered+0x6f/0x90 [ 445.753941] [] unregister_netdevice_queue+0x68/0x120 [ 445.760786] [] __tun_detach+0x73e/0x9c0 [ 445.766513] [] tun_chr_close+0x40/0x60 [ 445.772139] [] __fput+0x20e/0x750 [ 445.777338] [] ____fput+0x9/0x10 [ 445.782447] [] task_work_run+0xd9/0x150 [ 445.788162] [] exit_to_usermode_loop+0x183/0x1c0 [ 445.794661] [] syscall_return_slowpath+0x275/0x2f0 [ 445.801328] [] entry_SYSCALL_64_fastpath+0xbf/0xc1 [ 445.807997] Memory state around the buggy address: [ 445.812895] ffff8800a7868380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 445.820222] ffff8800a7868400: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 445.827563] >ffff8800a7868480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 445.834892] ^ [ 445.838228] ffff8800a7868500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 445.845557] ffff8800a7868580: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00 [ 445.852888] ================================================================== [ 445.860263] ================================================================== [ 445.867607] BUG: KASAN: use-after-free in pneigh_get_next.isra.18+0x1f7/0x320 at addr ffff8800a21546c8 [ 445.877023] Read of size 8 by task syz-executor.2/12203 [ 445.882368] CPU: 1 PID: 12203 Comm: syz-executor.2 Tainted: G B 4.7.0+ #1 [ 445.890393] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 445.899728] 1ffffffff0d56312 ffff8800aef371c0 ffffffff829e0956 ffff8800a21546c0 [ 445.907713] ffff8800aef37250 ffff8800a21546c0 ffff88012bc00900 ffff8800aef37240 [ 445.915710] ffffffff8174e667 0000000000000010 ffff880000000000 0000000000000282 [ 445.923712] Call Trace: [ 445.926274] [] dump_stack+0xe6/0x120 [ 445.931607] [] kasan_report_error+0x1e7/0x5b0 [ 445.937723] [] __asan_report_load8_noabort+0x3e/0x40 [ 445.944463] [] ? pneigh_get_next.isra.18+0x1f7/0x320 [ 445.951186] [] pneigh_get_next.isra.18+0x1f7/0x320 [ 445.957746] [] ? neigh_connected_output+0x510/0x510 [ 445.964387] [] ? mutex_lock_killable_nested+0xce0/0xce0 [ 445.971371] [] neigh_seq_next+0x91/0x1c0 [ 445.977049] [] seq_read+0x9e4/0x11a0 [ 445.982380] [] ? seq_hlist_next_rcu+0x130/0x130 [ 445.988669] [] ? rw_copy_check_uvector+0x97/0x280 [ 445.995133] [] ? rcu_read_lock_sched_held+0x9e/0x120 [ 446.001868] [] proc_reg_read+0xbc/0x180 [ 446.007465] [] do_loop_readv_writev+0x134/0x210 [ 446.013754] [] ? security_file_permission+0x148/0x1a0 [ 446.020563] [] ? proc_reg_write+0x180/0x180 [ 446.026516] [] ? proc_reg_write+0x180/0x180 [ 446.032456] [] do_readv_writev+0x565/0x660 [ 446.038308] [] ? vfs_write+0x4a0/0x4a0 [ 446.043815] [] ? perf_event_fork+0x20/0x20 [ 446.049670] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 446.056397] [] ? alloc_pages_current+0x1b0/0x490 [ 446.062787] [] vfs_readv+0x67/0xa0 [ 446.067948] [] default_file_splice_read+0x42d/0x800 [ 446.074598] [] ? __generic_file_splice_read+0xef0/0xef0 [ 446.081586] [] ? mark_held_locks+0xc8/0x120 [ 446.087528] [] ? debug_check_no_obj_freed+0x15f/0x760 [ 446.094339] [] ? _raw_spin_unlock_irqrestore+0x6a/0xd0 [ 446.101236] [] ? page_cache_pipe_buf_release+0x120/0x120 [ 446.108307] [] ? _raw_spin_unlock_irqrestore+0xa6/0xd0 [ 446.115201] [] ? mark_held_locks+0xc8/0x120 [ 446.121146] [] ? free_hot_cold_page+0x502/0xa70 [ 446.127440] [] ? trace_hardirqs_on_caller+0x44c/0x5e0 [ 446.134247] [] ? trace_hardirqs_on+0xd/0x10 [ 446.140187] [] ? __put_page+0x67/0x80 [ 446.145609] [] ? rw_verify_area+0xb8/0x2b0 [ 446.151469] [] do_splice_to+0xe3/0x140 [ 446.156975] [] splice_direct_to_actor+0x235/0x7c0 [ 446.163444] [] ? generic_pipe_buf_nosteal+0x10/0x10 [ 446.170079] [] ? do_splice_to+0x140/0x140 [ 446.175861] [] ? security_file_permission+0x6a/0x1a0 [ 446.182581] [] ? rw_verify_area+0xb8/0x2b0 [ 446.188434] [] do_splice_direct+0x14e/0x260 [ 446.194375] [] ? splice_direct_to_actor+0x7c0/0x7c0 [ 446.201009] [] ? percpu_down_read+0x52/0x90 [ 446.206963] [] ? __sb_start_write+0xb2/0xf0 [ 446.212903] [] ? __sb_start_write+0xb2/0xf0 [ 446.218843] [] do_sendfile+0x4c0/0xe40 [ 446.224360] [] ? do_compat_pwritev64.isra.24+0xc0/0xc0 [ 446.231258] [] ? __might_fault+0xf1/0x1b0 [ 446.237024] [] SyS_sendfile64+0x11d/0x120 [ 446.242788] [] ? SyS_sendfile+0x110/0x110 [ 446.248553] [] ? trace_hardirqs_on_caller+0x44c/0x5e0 [ 446.255367] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 446.261915] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 446.268462] Object at ffff8800a21546c0, in cache kmalloc-4096 [ 446.274314] Object freed, allocated with size 2816 bytes [ 446.279732] Allocation: [ 446.282285] PID = 12203 [ 446.284836] [] save_stack_trace+0x26/0x50 [ 446.290751] [] save_stack+0x46/0xd0 [ 446.296115] [] kasan_kmalloc+0xda/0x100 [ 446.301823] [] __kmalloc_track_caller+0x165/0x790 [ 446.308402] [] kmemdup+0x1b/0x40 [ 446.313569] [] __addrconf_sysctl_register+0x86/0x340 [ 446.320416] [] addrconf_sysctl_register+0x104/0x1a0 [ 446.327168] [] ipv6_add_dev+0x978/0xfd0 [ 446.332894] [] addrconf_notify+0x764/0x1cf0 [ 446.338961] [] notifier_call_chain+0x8b/0x170 [ 446.347514] [] raw_notifier_call_chain+0x11/0x20 [ 446.354015] [] call_netdevice_notifiers_info+0x47/0x80 [ 446.361036] [] register_netdevice+0x907/0xd60 [ 446.367271] [] __tun_chr_ioctl+0x13e0/0x3540 [ 446.373425] [] tun_chr_ioctl+0xe/0x10 [ 446.378966] [] do_vfs_ioctl+0x17f/0xec0 [ 446.384685] [] SyS_ioctl+0x74/0x80 [ 446.389964] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 446.396634] Deallocation: [ 446.399360] PID = 12198 [ 446.401911] [] save_stack_trace+0x26/0x50 [ 446.407822] [] save_stack+0x46/0xd0 [ 446.413191] [] kasan_slab_free+0x9b/0xd0 [ 446.418992] [] kfree+0xcf/0x2c0 [ 446.424010] [] __addrconf_sysctl_unregister.isra.42+0x7a/0xa0 [ 446.431642] [] addrconf_ifdown+0x856/0xcd0 [ 446.437619] [] addrconf_notify+0x710/0x1cf0 [ 446.443679] [] notifier_call_chain+0x8b/0x170 [ 446.449911] [] raw_notifier_call_chain+0x11/0x20 [ 446.456406] [] call_netdevice_notifiers_info+0x47/0x80 [ 446.463442] [] rollback_registered_many+0x3fa/0x740 [ 446.470203] [] rollback_registered+0x6f/0x90 [ 446.476351] [] unregister_netdevice_queue+0x68/0x120 [ 446.483194] [] __tun_detach+0x73e/0x9c0 [ 446.488904] [] tun_chr_close+0x40/0x60 [ 446.494529] [] __fput+0x20e/0x750 [ 446.499744] [] ____fput+0x9/0x10 [ 446.504850] [] task_work_run+0xd9/0x150 [ 446.510567] [] exit_to_usermode_loop+0x183/0x1c0 [ 446.517073] [] syscall_return_slowpath+0x275/0x2f0 [ 446.523752] [] entry_SYSCALL_64_fastpath+0xbf/0xc1 [ 446.530419] Memory state around the buggy address: [ 446.535322] ffff8800a2154580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 446.542654] ffff8800a2154600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 446.549995] >ffff8800a2154680: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 446.557328] ^ [ 446.563008] ffff8800a2154700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 446.570425] ffff8800a2154780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 446.577755] ================================================================== [ 446.585130] ================================================================== [ 446.592473] BUG: KASAN: use-after-free in pneigh_get_next.isra.18+0x214/0x320 at addr ffff8800a21546c0 [ 446.601885] Read of size 8 by task syz-executor.2/12203 [ 446.607220] CPU: 1 PID: 12203 Comm: syz-executor.2 Tainted: G B 4.7.0+ #1 [ 446.615244] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 446.624573] 1ffffffff0d56312 ffff8800aef371c0 ffffffff829e0956 ffff8800a21546c0 [ 446.632575] ffff8800aef37250 ffff8800a21546c0 ffff88012bc00900 ffff8800aef37240 [ 446.640566] ffffffff8174e667 0000000000000010 ffff880000000000 0000000000000282 [ 446.648561] Call Trace: [ 446.651121] [] dump_stack+0xe6/0x120 [ 446.656805] [] kasan_report_error+0x1e7/0x5b0 [ 446.662938] [] __asan_report_load8_noabort+0x3e/0x40 [ 446.669663] [] ? pneigh_get_next.isra.18+0x214/0x320 [ 446.676387] [] pneigh_get_next.isra.18+0x214/0x320 [ 446.682939] [] ? neigh_connected_output+0x510/0x510 [ 446.689575] [] ? mutex_lock_killable_nested+0xce0/0xce0 [ 446.696560] [] neigh_seq_next+0x91/0x1c0 [ 446.702240] [] seq_read+0x9e4/0x11a0 [ 446.707592] [] ? seq_hlist_next_rcu+0x130/0x130 [ 446.713882] [] ? rw_copy_check_uvector+0x97/0x280 [ 446.720348] [] ? rcu_read_lock_sched_held+0x9e/0x120 [ 446.727069] [] proc_reg_read+0xbc/0x180 [ 446.732664] [] do_loop_readv_writev+0x134/0x210 [ 446.738951] [] ? security_file_permission+0x148/0x1a0 [ 446.745761] [] ? proc_reg_write+0x180/0x180 [ 446.751700] [] ? proc_reg_write+0x180/0x180 [ 446.757639] [] do_readv_writev+0x565/0x660 [ 446.763492] [] ? vfs_write+0x4a0/0x4a0 [ 446.768999] [] ? perf_event_fork+0x20/0x20 [ 446.774854] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 446.781580] [] ? alloc_pages_current+0x1b0/0x490 [ 446.787955] [] vfs_readv+0x67/0xa0 [ 446.793115] [] default_file_splice_read+0x42d/0x800 [ 446.799752] [] ? __generic_file_splice_read+0xef0/0xef0 [ 446.806748] [] ? mark_held_locks+0xc8/0x120 [ 446.812692] [] ? debug_check_no_obj_freed+0x15f/0x760 [ 446.819499] [] ? _raw_spin_unlock_irqrestore+0x6a/0xd0 [ 446.826411] [] ? page_cache_pipe_buf_release+0x120/0x120 [ 446.833480] [] ? _raw_spin_unlock_irqrestore+0xa6/0xd0 [ 446.840380] [] ? mark_held_locks+0xc8/0x120 [ 446.846326] [] ? free_hot_cold_page+0x502/0xa70 [ 446.852612] [] ? trace_hardirqs_on_caller+0x44c/0x5e0 [ 446.859422] [] ? trace_hardirqs_on+0xd/0x10 [ 446.865363] [] ? __put_page+0x67/0x80 [ 446.870785] [] ? rw_verify_area+0xb8/0x2b0 [ 446.876641] [] do_splice_to+0xe3/0x140 [ 446.882150] [] splice_direct_to_actor+0x235/0x7c0 [ 446.888619] [] ? generic_pipe_buf_nosteal+0x10/0x10 [ 446.895254] [] ? do_splice_to+0x140/0x140 [ 446.901023] [] ? security_file_permission+0x6a/0x1a0 [ 446.907747] [] ? rw_verify_area+0xb8/0x2b0 [ 446.913615] [] do_splice_direct+0x14e/0x260 [ 446.919555] [] ? splice_direct_to_actor+0x7c0/0x7c0 [ 446.926202] [] ? percpu_down_read+0x52/0x90 [ 446.932144] [] ? __sb_start_write+0xb2/0xf0 [ 446.938085] [] ? __sb_start_write+0xb2/0xf0 [ 446.944044] [] do_sendfile+0x4c0/0xe40 [ 446.949550] [] ? do_compat_pwritev64.isra.24+0xc0/0xc0 [ 446.956446] [] ? __might_fault+0xf1/0x1b0 [ 446.962212] [] SyS_sendfile64+0x11d/0x120 [ 446.967980] [] ? SyS_sendfile+0x110/0x110 [ 446.973750] [] ? trace_hardirqs_on_caller+0x44c/0x5e0 [ 446.980564] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 446.987113] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 446.993665] Object at ffff8800a21546c0, in cache kmalloc-4096 [ 446.999518] Object freed, allocated with size 2816 bytes [ 447.004939] Allocation: [ 447.007498] PID = 12203 [ 447.010067] [] save_stack_trace+0x26/0x50 [ 447.015962] [] save_stack+0x46/0xd0 [ 447.021331] [] kasan_kmalloc+0xda/0x100 [ 447.027046] [] __kmalloc_track_caller+0x165/0x790 [ 447.033633] [] kmemdup+0x1b/0x40 [ 447.038747] [] __addrconf_sysctl_register+0x86/0x340 [ 447.045592] [] addrconf_sysctl_register+0x104/0x1a0 [ 447.052351] [] ipv6_add_dev+0x978/0xfd0 [ 447.058066] [] addrconf_notify+0x764/0x1cf0 [ 447.064133] [] notifier_call_chain+0x8b/0x170 [ 447.070371] [] raw_notifier_call_chain+0x11/0x20 [ 447.076871] [] call_netdevice_notifiers_info+0x47/0x80 [ 447.083893] [] register_netdevice+0x907/0xd60 [ 447.090130] [] __tun_chr_ioctl+0x13e0/0x3540 [ 447.096283] [] tun_chr_ioctl+0xe/0x10 [ 447.101825] [] do_vfs_ioctl+0x17f/0xec0 [ 447.107544] [] SyS_ioctl+0x74/0x80 [ 447.112825] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 447.119503] Deallocation: [ 447.122231] PID = 12198 [ 447.124784] [] save_stack_trace+0x26/0x50 [ 447.130677] [] save_stack+0x46/0xd0 [ 447.136048] [] kasan_slab_free+0x9b/0xd0 [ 447.141851] [] kfree+0xcf/0x2c0 [ 447.146890] [] __addrconf_sysctl_unregister.isra.42+0x7a/0xa0 [ 447.154534] [] addrconf_ifdown+0x856/0xcd0 [ 447.160516] [] addrconf_notify+0x710/0x1cf0 [ 447.166578] [] notifier_call_chain+0x8b/0x170 [ 447.172813] [] raw_notifier_call_chain+0x11/0x20 [ 447.179311] [] call_netdevice_notifiers_info+0x47/0x80 [ 447.186334] [] rollback_registered_many+0x3fa/0x740 [ 447.193092] [] rollback_registered+0x6f/0x90 [ 447.199242] [] unregister_netdevice_queue+0x68/0x120 [ 447.206083] [] __tun_detach+0x73e/0x9c0 [ 447.211802] [] tun_chr_close+0x40/0x60 [ 447.217435] [] __fput+0x20e/0x750 [ 447.222627] [] ____fput+0x9/0x10 [ 447.227738] [] task_work_run+0xd9/0x150 [ 447.233457] [] exit_to_usermode_loop+0x183/0x1c0 [ 447.239955] [] syscall_return_slowpath+0x275/0x2f0 [ 447.246629] [] entry_SYSCALL_64_fastpath+0xbf/0xc1 [ 447.253303] Memory state around the buggy address: [ 447.258202] ffff8800a2154580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 447.265530] ffff8800a2154600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 447.272857] >ffff8800a2154680: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 447.280184] ^ [ 447.285605] ffff8800a2154700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 447.292936] ffff8800a2154780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 447.300267] ================================================================== [ 447.307616] ================================================================== [ 447.314958] BUG: KASAN: use-after-free in pneigh_get_next.isra.18+0x1f7/0x320 at addr ffff8800a2153308 [ 447.324370] Read of size 8 by task syz-executor.2/12203 [ 447.329775] CPU: 1 PID: 12203 Comm: syz-executor.2 Tainted: G B 4.7.0+ #1 [ 447.337806] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 447.347134] 1ffffffff0d56312 ffff8800aef371c0 ffffffff829e0956 ffff8800a2153300 [ 447.356252] ffff8800aef37250 ffff8800a2153300 ffff88012bc00800 ffff8800aef37240 [ 447.364244] ffffffff8174e667 0000000000000010 ffff880000000000 0000000000000282 [ 447.372225] Call Trace: [ 447.374787] [] dump_stack+0xe6/0x120 [ 447.380121] [] kasan_report_error+0x1e7/0x5b0 [ 447.386234] [] __asan_report_load8_noabort+0x3e/0x40 [ 447.392958] [] ? pneigh_get_next.isra.18+0x1f7/0x320 [ 447.399680] [] pneigh_get_next.isra.18+0x1f7/0x320 [ 447.406230] [] ? neigh_connected_output+0x510/0x510 [ 447.412867] [] ? mutex_lock_killable_nested+0xce0/0xce0 [ 447.419861] [] neigh_seq_next+0x91/0x1c0 [ 447.425544] [] seq_read+0x9e4/0x11a0 [ 447.430881] [] ? seq_hlist_next_rcu+0x130/0x130 [ 447.437171] [] ? rw_copy_check_uvector+0x97/0x280 [ 447.443635] [] ? rcu_read_lock_sched_held+0x9e/0x120 [ 447.450356] [] proc_reg_read+0xbc/0x180 [ 447.455949] [] do_loop_readv_writev+0x134/0x210 [ 447.462238] [] ? security_file_permission+0x148/0x1a0 [ 447.469045] [] ? proc_reg_write+0x180/0x180 [ 447.474989] [] ? proc_reg_write+0x180/0x180 [ 447.480930] [] do_readv_writev+0x565/0x660 [ 447.486781] [] ? vfs_write+0x4a0/0x4a0 [ 447.492291] [] ? perf_event_fork+0x20/0x20 [ 447.498147] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 447.504869] [] ? alloc_pages_current+0x1b0/0x490 [ 447.511245] [] vfs_readv+0x67/0xa0 [ 447.516406] [] default_file_splice_read+0x42d/0x800 [ 447.523698] [] ? __generic_file_splice_read+0xef0/0xef0 [ 447.530686] [] ? mark_held_locks+0xc8/0x120 [ 447.536629] [] ? debug_check_no_obj_freed+0x15f/0x760 [ 447.543447] [] ? _raw_spin_unlock_irqrestore+0x6a/0xd0 [ 447.550342] [] ? page_cache_pipe_buf_release+0x120/0x120 [ 447.557410] [] ? _raw_spin_unlock_irqrestore+0xa6/0xd0 [ 447.564303] [] ? mark_held_locks+0xc8/0x120 [ 447.570246] [] ? free_hot_cold_page+0x502/0xa70 [ 447.576534] [] ? trace_hardirqs_on_caller+0x44c/0x5e0 [ 447.583343] [] ? trace_hardirqs_on+0xd/0x10 [ 447.589300] [] ? __put_page+0x67/0x80 [ 447.594725] [] ? rw_verify_area+0xb8/0x2b0 [ 447.600579] [] do_splice_to+0xe3/0x140 [ 447.606085] [] splice_direct_to_actor+0x235/0x7c0 [ 447.612547] [] ? generic_pipe_buf_nosteal+0x10/0x10 [ 447.619180] [] ? do_splice_to+0x140/0x140 [ 447.624947] [] ? security_file_permission+0x6a/0x1a0 [ 447.631669] [] ? rw_verify_area+0xb8/0x2b0 [ 447.637526] [] do_splice_direct+0x14e/0x260 [ 447.643465] [] ? splice_direct_to_actor+0x7c0/0x7c0 [ 447.650106] [] ? percpu_down_read+0x52/0x90 [ 447.656045] [] ? __sb_start_write+0xb2/0xf0 [ 447.661986] [] ? __sb_start_write+0xb2/0xf0 [ 447.667928] [] do_sendfile+0x4c0/0xe40 [ 447.673433] [] ? do_compat_pwritev64.isra.24+0xc0/0xc0 [ 447.680328] [] ? __might_fault+0xf1/0x1b0 [ 447.686094] [] SyS_sendfile64+0x11d/0x120 [ 447.691859] [] ? SyS_sendfile+0x110/0x110 [ 447.697626] [] ? trace_hardirqs_on_caller+0x44c/0x5e0 [ 447.704433] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 447.710987] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 447.717536] Object at ffff8800a2153300, in cache kmalloc-2048 [ 447.723388] Object freed, allocated with size 1352 bytes [ 447.728806] Allocation: [ 447.731359] PID = 12203 [ 447.733910] [] save_stack_trace+0x26/0x50 [ 447.739798] [] save_stack+0x46/0xd0 [ 447.745182] [] kasan_kmalloc+0xda/0x100 [ 447.750906] [] __kmalloc_track_caller+0x165/0x790 [ 447.757506] [] kmemdup+0x1b/0x40 [ 447.762634] [] neigh_sysctl_register+0x89/0x7c0 [ 447.769051] [] addrconf_sysctl_register+0xa4/0x1a0 [ 447.775716] [] ipv6_add_dev+0x978/0xfd0 [ 447.781424] [] addrconf_notify+0x764/0x1cf0 [ 447.787483] [] notifier_call_chain+0x8b/0x170 [ 447.793717] [] raw_notifier_call_chain+0x11/0x20 [ 447.800209] [] call_netdevice_notifiers_info+0x47/0x80 [ 447.807226] [] register_netdevice+0x907/0xd60 [ 447.813461] [] __tun_chr_ioctl+0x13e0/0x3540 [ 447.819610] [] tun_chr_ioctl+0xe/0x10 [ 447.825145] [] do_vfs_ioctl+0x17f/0xec0 [ 447.830871] [] SyS_ioctl+0x74/0x80 [ 447.836162] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 447.842828] Deallocation: [ 447.845569] PID = 12198 [ 447.848130] [] save_stack_trace+0x26/0x50 [ 447.854013] [] save_stack+0x46/0xd0 [ 447.859388] [] kasan_slab_free+0x9b/0xd0 [ 447.865191] [] kfree+0xcf/0x2c0 [ 447.870206] [] neigh_sysctl_unregister+0x5f/0x80 [ 447.876702] [] addrconf_ifdown+0x884/0xcd0 [ 447.882693] [] addrconf_notify+0x710/0x1cf0 [ 447.888754] [] notifier_call_chain+0x8b/0x170 [ 447.894984] [] raw_notifier_call_chain+0x11/0x20 [ 447.901477] [] call_netdevice_notifiers_info+0x47/0x80 [ 447.908518] [] rollback_registered_many+0x3fa/0x740 [ 447.915271] [] rollback_registered+0x6f/0x90 [ 447.921422] [] unregister_netdevice_queue+0x68/0x120 [ 447.928268] [] __tun_detach+0x73e/0x9c0 [ 447.933980] [] tun_chr_close+0x40/0x60 [ 447.939608] [] __fput+0x20e/0x750 [ 447.944797] [] ____fput+0x9/0x10 [ 447.949910] [] task_work_run+0xd9/0x150 [ 447.955633] [] exit_to_usermode_loop+0x183/0x1c0 [ 447.962129] [] syscall_return_slowpath+0x275/0x2f0 [ 447.968798] [] entry_SYSCALL_64_fastpath+0xbf/0xc1 [ 447.975469] Memory state around the buggy address: [ 447.980465] ffff8800a2153200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 447.987796] ffff8800a2153280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 447.995123] >ffff8800a2153300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 448.002449] ^ [ 448.006044] ffff8800a2153380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 448.013375] ffff8800a2153400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 448.020701] ================================================================== [ 448.028064] ================================================================== [ 448.035411] BUG: KASAN: use-after-free in pneigh_get_next.isra.18+0x214/0x320 at addr ffff8800a2153300 [ 448.044825] Read of size 8 by task syz-executor.2/12203 [ 448.050159] CPU: 1 PID: 12203 Comm: syz-executor.2 Tainted: G B 4.7.0+ #1 [ 448.058182] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 448.067522] 1ffffffff0d56312 ffff8800aef371c0 ffffffff829e0956 ffff8800a2153300 [ 448.075523] ffff8800aef37250 ffff8800a2153300 ffff88012bc00800 ffff8800aef37240 [ 448.083503] ffffffff8174e667 0000000000000010 ffff880000000000 0000000000000282 [ 448.091506] Call Trace: [ 448.094064] [] dump_stack+0xe6/0x120 [ 448.099396] [] kasan_report_error+0x1e7/0x5b0 [ 448.105518] [] __asan_report_load8_noabort+0x3e/0x40 [ 448.112245] [] ? pneigh_get_next.isra.18+0x214/0x320 [ 448.118970] [] pneigh_get_next.isra.18+0x214/0x320 [ 448.125520] [] ? neigh_connected_output+0x510/0x510 [ 448.132162] [] ? mutex_lock_killable_nested+0xce0/0xce0 [ 448.139146] [] neigh_seq_next+0x91/0x1c0 [ 448.144837] [] seq_read+0x9e4/0x11a0 [ 448.150170] [] ? seq_hlist_next_rcu+0x130/0x130 [ 448.156464] [] ? rw_copy_check_uvector+0x97/0x280 [ 448.162925] [] ? rcu_read_lock_sched_held+0x9e/0x120 [ 448.169654] [] proc_reg_read+0xbc/0x180 [ 448.175244] [] do_loop_readv_writev+0x134/0x210 [ 448.181534] [] ? security_file_permission+0x148/0x1a0 [ 448.188341] [] ? proc_reg_write+0x180/0x180 [ 448.194281] [] ? proc_reg_write+0x180/0x180 [ 448.200220] [] do_readv_writev+0x565/0x660 [ 448.206073] [] ? vfs_write+0x4a0/0x4a0 [ 448.211579] [] ? perf_event_fork+0x20/0x20 [ 448.217433] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 448.224169] [] ? alloc_pages_current+0x1b0/0x490 [ 448.230546] [] vfs_readv+0x67/0xa0 [ 448.235706] [] default_file_splice_read+0x42d/0x800 [ 448.242339] [] ? __generic_file_splice_read+0xef0/0xef0 [ 448.249329] [] ? mark_held_locks+0xc8/0x120 [ 448.255273] [] ? debug_check_no_obj_freed+0x15f/0x760 [ 448.262092] [] ? _raw_spin_unlock_irqrestore+0x6a/0xd0 [ 448.269001] [] ? page_cache_pipe_buf_release+0x120/0x120 [ 448.276075] [] ? _raw_spin_unlock_irqrestore+0xa6/0xd0 [ 448.282969] [] ? mark_held_locks+0xc8/0x120 [ 448.288910] [] ? free_hot_cold_page+0x502/0xa70 [ 448.295199] [] ? trace_hardirqs_on_caller+0x44c/0x5e0 [ 448.302007] [] ? trace_hardirqs_on+0xd/0x10 [ 448.307948] [] ? __put_page+0x67/0x80 [ 448.313369] [] ? rw_verify_area+0xb8/0x2b0 [ 448.319233] [] do_splice_to+0xe3/0x140 [ 448.324750] [] splice_direct_to_actor+0x235/0x7c0 [ 448.331227] [] ? generic_pipe_buf_nosteal+0x10/0x10 [ 448.337864] [] ? do_splice_to+0x140/0x140 [ 448.343630] [] ? security_file_permission+0x6a/0x1a0 [ 448.350352] [] ? rw_verify_area+0xb8/0x2b0 [ 448.356210] [] do_splice_direct+0x14e/0x260 [ 448.362163] [] ? splice_direct_to_actor+0x7c0/0x7c0 [ 448.368795] [] ? percpu_down_read+0x52/0x90 [ 448.374737] [] ? __sb_start_write+0xb2/0xf0 [ 448.380677] [] ? __sb_start_write+0xb2/0xf0 [ 448.386617] [] do_sendfile+0x4c0/0xe40 [ 448.392123] [] ? do_compat_pwritev64.isra.24+0xc0/0xc0 [ 448.399020] [] ? __might_fault+0xf1/0x1b0 [ 448.404787] [] SyS_sendfile64+0x11d/0x120 [ 448.410554] [] ? SyS_sendfile+0x110/0x110 [ 448.416319] [] ? trace_hardirqs_on_caller+0x44c/0x5e0 [ 448.423130] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 448.429681] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 448.436232] Object at ffff8800a2153300, in cache kmalloc-2048 [ 448.442084] Object freed, allocated with size 1352 bytes [ 448.447505] Allocation: [ 448.450057] PID = 12203 [ 448.452608] [] save_stack_trace+0x26/0x50 [ 448.458509] [] save_stack+0x46/0xd0 [ 448.463874] [] kasan_kmalloc+0xda/0x100 [ 448.469592] [] __kmalloc_track_caller+0x165/0x790 [ 448.476179] [] kmemdup+0x1b/0x40 [ 448.481287] [] neigh_sysctl_register+0x89/0x7c0 [ 448.487702] [] addrconf_sysctl_register+0xa4/0x1a0 [ 448.494467] [] ipv6_add_dev+0x978/0xfd0 [ 448.500190] [] addrconf_notify+0x764/0x1cf0 [ 448.506288] [] notifier_call_chain+0x8b/0x170 [ 448.512522] [] raw_notifier_call_chain+0x11/0x20 [ 448.519018] [] call_netdevice_notifiers_info+0x47/0x80 [ 448.526035] [] register_netdevice+0x907/0xd60 [ 448.532271] [] __tun_chr_ioctl+0x13e0/0x3540 [ 448.538423] [] tun_chr_ioctl+0xe/0x10 [ 448.543960] [] do_vfs_ioctl+0x17f/0xec0 [ 448.549684] [] SyS_ioctl+0x74/0x80 [ 448.554960] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 448.561631] Deallocation: [ 448.564356] PID = 12198 [ 448.566907] [] save_stack_trace+0x26/0x50 [ 448.572789] [] save_stack+0x46/0xd0 [ 448.578155] [] kasan_slab_free+0x9b/0xd0 [ 448.583956] [] kfree+0xcf/0x2c0 [ 448.588986] [] neigh_sysctl_unregister+0x5f/0x80 [ 448.595481] [] addrconf_ifdown+0x884/0xcd0 [ 448.601454] [] addrconf_notify+0x710/0x1cf0 [ 448.607513] [] notifier_call_chain+0x8b/0x170 [ 448.613753] [] raw_notifier_call_chain+0x11/0x20 [ 448.620244] [] call_netdevice_notifiers_info+0x47/0x80 [ 448.627260] [] rollback_registered_many+0x3fa/0x740 [ 448.634027] [] rollback_registered+0x6f/0x90 [ 448.640175] [] unregister_netdevice_queue+0x68/0x120 [ 448.647018] [] __tun_detach+0x73e/0x9c0 [ 448.652728] [] tun_chr_close+0x40/0x60 [ 448.658371] [] __fput+0x20e/0x750 [ 448.663567] [] ____fput+0x9/0x10 [ 448.668670] [] task_work_run+0xd9/0x150 [ 448.674384] [] exit_to_usermode_loop+0x183/0x1c0 [ 448.680893] [] syscall_return_slowpath+0x275/0x2f0 [ 448.687572] [] entry_SYSCALL_64_fastpath+0xbf/0xc1 [ 448.694256] Memory state around the buggy address: [ 448.699160] ffff8800a2153200: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 448.706489] ffff8800a2153280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 448.713835] >ffff8800a2153300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 448.721164] ^ [ 448.724498] ffff8800a2153380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 448.731825] ffff8800a2153400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 448.739153] ================================================================== [ 448.746513] ================================================================== [ 448.753912] BUG: KASAN: use-after-free in pneigh_get_next.isra.18+0x1f7/0x320 at addr ffff8800ae433e08 [ 448.763326] Read of size 8 by task syz-executor.2/12203 [ 448.768672] CPU: 1 PID: 12203 Comm: syz-executor.2 Tainted: G B 4.7.0+ #1 [ 448.776706] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 448.786032] 1ffffffff0d56312 ffff8800aef371c0 ffffffff829e0956 ffff8800ae433e00 [ 448.794009] ffff8800aef37250 ffff8800ae433e00 ffff88012bc00000 ffff8800aef37240 [ 448.802026] ffffffff8174e667 0000000000000010 ffff880000000000 0000000000000282 [ 448.810004] Call Trace: [ 448.812578] [] dump_stack+0xe6/0x120 [ 448.817913] [] kasan_report_error+0x1e7/0x5b0 [ 448.824031] [] __asan_report_load8_noabort+0x3e/0x40 [ 448.830758] [] ? pneigh_get_next.isra.18+0x1f7/0x320 [ 448.837500] [] pneigh_get_next.isra.18+0x1f7/0x320 [ 448.844047] [] ? neigh_connected_output+0x510/0x510 [ 448.850682] [] ? mutex_lock_killable_nested+0xce0/0xce0 [ 448.857663] [] neigh_seq_next+0x91/0x1c0 [ 448.863341] [] seq_read+0x9e4/0x11a0 [ 448.868674] [] ? seq_hlist_next_rcu+0x130/0x130 [ 448.874963] [] ? rw_copy_check_uvector+0x97/0x280 [ 448.881424] [] ? rcu_read_lock_sched_held+0x9e/0x120 [ 448.888158] [] proc_reg_read+0xbc/0x180 [ 448.893751] [] do_loop_readv_writev+0x134/0x210 [ 448.900038] [] ? security_file_permission+0x148/0x1a0 [ 448.906845] [] ? proc_reg_write+0x180/0x180 [ 448.912783] [] ? proc_reg_write+0x180/0x180 [ 448.918726] [] do_readv_writev+0x565/0x660 [ 448.924576] [] ? vfs_write+0x4a0/0x4a0 [ 448.930081] [] ? perf_event_fork+0x20/0x20 [ 448.935936] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 448.942662] [] ? alloc_pages_current+0x1b0/0x490 [ 448.949050] [] vfs_readv+0x67/0xa0 [ 448.954209] [] default_file_splice_read+0x42d/0x800 [ 448.960841] [] ? __generic_file_splice_read+0xef0/0xef0 [ 448.967822] [] ? mark_held_locks+0xc8/0x120 [ 448.973761] [] ? debug_check_no_obj_freed+0x15f/0x760 [ 448.980569] [] ? _raw_spin_unlock_irqrestore+0x6a/0xd0 [ 448.987464] [] ? page_cache_pipe_buf_release+0x120/0x120 [ 448.994529] [] ? _raw_spin_unlock_irqrestore+0xa6/0xd0 [ 449.001436] [] ? mark_held_locks+0xc8/0x120 [ 449.007381] [] ? free_hot_cold_page+0x502/0xa70 [ 449.013671] [] ? trace_hardirqs_on_caller+0x44c/0x5e0 [ 449.020478] [] ? trace_hardirqs_on+0xd/0x10 [ 449.026420] [] ? __put_page+0x67/0x80 [ 449.031840] [] ? rw_verify_area+0xb8/0x2b0 [ 449.037697] [] do_splice_to+0xe3/0x140 [ 449.043203] [] splice_direct_to_actor+0x235/0x7c0 [ 449.049676] [] ? generic_pipe_buf_nosteal+0x10/0x10 [ 449.056314] [] ? do_splice_to+0x140/0x140 [ 449.062088] [] ? security_file_permission+0x6a/0x1a0 [ 449.068808] [] ? rw_verify_area+0xb8/0x2b0 [ 449.074659] [] do_splice_direct+0x14e/0x260 [ 449.080600] [] ? splice_direct_to_actor+0x7c0/0x7c0 [ 449.087234] [] ? percpu_down_read+0x52/0x90 [ 449.093172] [] ? __sb_start_write+0xb2/0xf0 [ 449.099110] [] ? __sb_start_write+0xb2/0xf0 [ 449.105048] [] do_sendfile+0x4c0/0xe40 [ 449.110553] [] ? do_compat_pwritev64.isra.24+0xc0/0xc0 [ 449.117447] [] ? __might_fault+0xf1/0x1b0 [ 449.123214] [] SyS_sendfile64+0x11d/0x120 [ 449.128994] [] ? SyS_sendfile+0x110/0x110 [ 449.134762] [] ? trace_hardirqs_on_caller+0x44c/0x5e0 [ 449.141568] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 449.148119] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 449.154665] Object at ffff8800ae433e00, in cache kmalloc-node [ 449.160518] Object freed, allocated with size 160 bytes [ 449.165849] Allocation: [ 449.168403] PID = 12198 [ 449.170957] [] save_stack_trace+0x26/0x50 [ 449.176843] [] save_stack+0x46/0xd0 [ 449.182223] [] kasan_kmalloc+0xda/0x100 [ 449.187938] [] kmem_cache_alloc_trace+0x142/0x780 [ 449.194520] [] netdevice_event+0x24f/0x7c0 [ 449.200556] [] notifier_call_chain+0x8b/0x170 [ 449.206789] [] raw_notifier_call_chain+0x11/0x20 [ 449.213284] [] call_netdevice_notifiers_info+0x47/0x80 [ 449.220299] [] rollback_registered_many+0x3fa/0x740 [ 449.227052] [] rollback_registered+0x6f/0x90 [ 449.233220] [] unregister_netdevice_queue+0x68/0x120 [ 449.240073] [] __tun_detach+0x73e/0x9c0 [ 449.245814] [] tun_chr_close+0x40/0x60 [ 449.251439] [] __fput+0x20e/0x750 [ 449.256630] [] ____fput+0x9/0x10 [ 449.261732] [] task_work_run+0xd9/0x150 [ 449.267451] [] exit_to_usermode_loop+0x183/0x1c0 [ 449.273947] [] syscall_return_slowpath+0x275/0x2f0 [ 449.280613] [] entry_SYSCALL_64_fastpath+0xbf/0xc1 [ 449.287283] Deallocation: [ 449.290013] PID = 8554 [ 449.292477] [] save_stack_trace+0x26/0x50 [ 449.298376] [] save_stack+0x46/0xd0 [ 449.303754] [] kasan_slab_free+0x9b/0xd0 [ 449.309572] [] kfree+0xcf/0x2c0 [ 449.314594] [] netdevice_event_work_handler+0x11c/0x1d0 [ 449.321706] [] process_one_work+0x6a2/0x1580 [ 449.327854] [] worker_thread+0xd7/0xf10 [ 449.333587] [] kthread+0x209/0x2d0 [ 449.339053] [] ret_from_fork+0x1f/0x40 [ 449.345391] Memory state around the buggy address: [ 449.350295] ffff8800ae433d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 449.357623] ffff8800ae433d80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 449.364948] >ffff8800ae433e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 449.372273] ^ [ 449.375877] ffff8800ae433e80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 449.383203] ffff8800ae433f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 449.390530] ================================================================== [ 449.397906] ================================================================== [ 449.405263] BUG: KASAN: use-after-free in pneigh_get_next.isra.18+0x214/0x320 at addr ffff8800ae433e00 [ 449.414679] Read of size 8 by task syz-executor.2/12203 [ 449.420097] CPU: 1 PID: 12203 Comm: syz-executor.2 Tainted: G B 4.7.0+ #1 [ 449.428120] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 449.437445] 1ffffffff0d56312 ffff8800aef371c0 ffffffff829e0956 ffff8800ae433e00 [ 449.445445] ffff8800aef37250 ffff8800ae433e00 ffff88012bc00000 ffff8800aef37240 [ 449.453440] ffffffff8174e667 0000000000000010 ffff880000000000 0000000000000282 [ 449.461427] Call Trace: [ 449.463983] [] dump_stack+0xe6/0x120 [ 449.469336] [] kasan_report_error+0x1e7/0x5b0 [ 449.475452] [] __asan_report_load8_noabort+0x3e/0x40 [ 449.482174] [] ? pneigh_get_next.isra.18+0x214/0x320 [ 449.488894] [] pneigh_get_next.isra.18+0x214/0x320 [ 449.495449] [] ? neigh_connected_output+0x510/0x510 [ 449.502086] [] ? mutex_lock_killable_nested+0xce0/0xce0 [ 449.509067] [] neigh_seq_next+0x91/0x1c0 [ 449.514748] [] seq_read+0x9e4/0x11a0 [ 449.520083] [] ? seq_hlist_next_rcu+0x130/0x130 [ 449.527202] [] ? rw_copy_check_uvector+0x97/0x280 [ 449.533662] [] ? rcu_read_lock_sched_held+0x9e/0x120 [ 449.540384] [] proc_reg_read+0xbc/0x180 [ 449.545990] [] do_loop_readv_writev+0x134/0x210 [ 449.552284] [] ? security_file_permission+0x148/0x1a0 [ 449.559091] [] ? proc_reg_write+0x180/0x180 [ 449.565034] [] ? proc_reg_write+0x180/0x180 [ 449.570973] [] do_readv_writev+0x565/0x660 [ 449.576842] [] ? vfs_write+0x4a0/0x4a0 [ 449.582351] [] ? perf_event_fork+0x20/0x20 [ 449.588206] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 449.594931] [] ? alloc_pages_current+0x1b0/0x490 [ 449.601305] [] vfs_readv+0x67/0xa0 [ 449.606467] [] default_file_splice_read+0x42d/0x800 [ 449.613103] [] ? __generic_file_splice_read+0xef0/0xef0 [ 449.620086] [] ? mark_held_locks+0xc8/0x120 [ 449.626030] [] ? debug_check_no_obj_freed+0x15f/0x760 [ 449.632836] [] ? _raw_spin_unlock_irqrestore+0x6a/0xd0 [ 449.639735] [] ? page_cache_pipe_buf_release+0x120/0x120 [ 449.646818] [] ? _raw_spin_unlock_irqrestore+0xa6/0xd0 [ 449.653715] [] ? mark_held_locks+0xc8/0x120 [ 449.659656] [] ? free_hot_cold_page+0x502/0xa70 [ 449.665947] [] ? trace_hardirqs_on_caller+0x44c/0x5e0 [ 449.672756] [] ? trace_hardirqs_on+0xd/0x10 [ 449.678710] [] ? __put_page+0x67/0x80 [ 449.684136] [] ? rw_verify_area+0xb8/0x2b0 [ 449.689989] [] do_splice_to+0xe3/0x140 [ 449.695510] [] splice_direct_to_actor+0x235/0x7c0 [ 449.701972] [] ? generic_pipe_buf_nosteal+0x10/0x10 [ 449.708608] [] ? do_splice_to+0x140/0x140 [ 449.714375] [] ? security_file_permission+0x6a/0x1a0 [ 449.721097] [] ? rw_verify_area+0xb8/0x2b0 [ 449.726951] [] do_splice_direct+0x14e/0x260 [ 449.732890] [] ? splice_direct_to_actor+0x7c0/0x7c0 [ 449.739538] [] ? percpu_down_read+0x52/0x90 [ 449.745486] [] ? __sb_start_write+0xb2/0xf0 [ 449.751433] [] ? __sb_start_write+0xb2/0xf0 [ 449.757376] [] do_sendfile+0x4c0/0xe40 [ 449.762880] [] ? do_compat_pwritev64.isra.24+0xc0/0xc0 [ 449.769790] [] ? __might_fault+0xf1/0x1b0 [ 449.775576] [] SyS_sendfile64+0x11d/0x120 [ 449.781363] [] ? SyS_sendfile+0x110/0x110 [ 449.787147] [] ? trace_hardirqs_on_caller+0x44c/0x5e0 [ 449.793955] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 449.800589] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 449.807136] Object at ffff8800ae433e00, in cache kmalloc-node [ 449.812988] Object freed, allocated with size 160 bytes [ 449.818329] Allocation: [ 449.820882] PID = 12198 [ 449.823434] [] save_stack_trace+0x26/0x50 [ 449.829323] [] save_stack+0x46/0xd0 [ 449.834690] [] kasan_kmalloc+0xda/0x100 [ 449.840402] [] kmem_cache_alloc_trace+0x142/0x780 [ 449.846987] [] netdevice_event+0x24f/0x7c0 [ 449.852963] [] notifier_call_chain+0x8b/0x170 [ 449.859211] [] raw_notifier_call_chain+0x11/0x20 [ 449.865708] [] call_netdevice_notifiers_info+0x47/0x80 [ 449.872722] [] rollback_registered_many+0x3fa/0x740 [ 449.879472] [] rollback_registered+0x6f/0x90 [ 449.885619] [] unregister_netdevice_queue+0x68/0x120 [ 449.892459] [] __tun_detach+0x73e/0x9c0 [ 449.898181] [] tun_chr_close+0x40/0x60 [ 449.903808] [] __fput+0x20e/0x750 [ 449.909012] [] ____fput+0x9/0x10 [ 449.914120] [] task_work_run+0xd9/0x150 [ 449.919832] [] exit_to_usermode_loop+0x183/0x1c0 [ 449.926326] [] syscall_return_slowpath+0x275/0x2f0 [ 449.932996] [] entry_SYSCALL_64_fastpath+0xbf/0xc1 [ 449.939663] Deallocation: [ 449.942389] PID = 8554 [ 449.944854] [] save_stack_trace+0x26/0x50 [ 449.950741] [] save_stack+0x46/0xd0 [ 449.956109] [] kasan_slab_free+0x9b/0xd0 [ 449.961908] [] kfree+0xcf/0x2c0 [ 449.966925] [] netdevice_event_work_handler+0x11c/0x1d0 [ 449.974030] [] process_one_work+0x6a2/0x1580 [ 449.980175] [] worker_thread+0xd7/0xf10 [ 449.985887] [] kthread+0x209/0x2d0 [ 449.991166] [] ret_from_fork+0x1f/0x40 [ 449.996795] Memory state around the buggy address: [ 450.001691] ffff8800ae433d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 450.009028] ffff8800ae433d80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 450.016357] >ffff8800ae433e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 450.023690] ^ [ 450.027030] ffff8800ae433e80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc [ 450.034359] ffff8800ae433f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 450.041684] ================================================================== [ 450.049052] ================================================================== [ 450.056395] BUG: KASAN: use-after-free in pneigh_get_next.isra.18+0x1f7/0x320 at addr ffff8800ad2f7b48 [ 450.065808] Read of size 8 by task syz-executor.2/12203 [ 450.071142] CPU: 1 PID: 12203 Comm: syz-executor.2 Tainted: G B 4.7.0+ #1 [ 450.079163] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 450.088491] 1ffffffff0d56312 ffff8800aef371c0 ffffffff829e0956 ffff8800ad2f7b40 [ 450.096500] ffff8800aef37250 ffff8800ad2f7b40 ffff88012bc00700 ffff8800aef37240 [ 450.104497] ffffffff8174e667 0000000000000010 ffff880000000000 0000000000000282 [ 450.112489] Call Trace: [ 450.115049] [] dump_stack+0xe6/0x120 [ 450.120384] [] kasan_report_error+0x1e7/0x5b0 [ 450.126499] [] __asan_report_load8_noabort+0x3e/0x40 [ 450.133222] [] ? pneigh_get_next.isra.18+0x1f7/0x320 [ 450.139944] [] pneigh_get_next.isra.18+0x1f7/0x320 [ 450.146491] [] ? neigh_connected_output+0x510/0x510 [ 450.153129] [] ? mutex_lock_killable_nested+0xce0/0xce0 [ 450.160114] [] neigh_seq_next+0x91/0x1c0 [ 450.165793] [] seq_read+0x9e4/0x11a0 [ 450.171126] [] ? seq_hlist_next_rcu+0x130/0x130 [ 450.177413] [] ? rw_copy_check_uvector+0x97/0x280 [ 450.183875] [] ? rcu_read_lock_sched_held+0x9e/0x120 [ 450.190615] [] proc_reg_read+0xbc/0x180 [ 450.196207] [] do_loop_readv_writev+0x134/0x210 [ 450.202495] [] ? security_file_permission+0x148/0x1a0 [ 450.209302] [] ? proc_reg_write+0x180/0x180 [ 450.215244] [] ? proc_reg_write+0x180/0x180 [ 450.221184] [] do_readv_writev+0x565/0x660 [ 450.227041] [] ? vfs_write+0x4a0/0x4a0 [ 450.232550] [] ? perf_event_fork+0x20/0x20 [ 450.238406] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 450.245133] [] ? alloc_pages_current+0x1b0/0x490 [ 450.251510] [] vfs_readv+0x67/0xa0 [ 450.256672] [] default_file_splice_read+0x42d/0x800 [ 450.263310] [] ? __generic_file_splice_read+0xef0/0xef0 [ 450.270296] [] ? mark_held_locks+0xc8/0x120 [ 450.276241] [] ? debug_check_no_obj_freed+0x15f/0x760 [ 450.283051] [] ? _raw_spin_unlock_irqrestore+0x6a/0xd0 [ 450.289948] [] ? page_cache_pipe_buf_release+0x120/0x120 [ 450.297019] [] ? _raw_spin_unlock_irqrestore+0xa6/0xd0 [ 450.303913] [] ? mark_held_locks+0xc8/0x120 [ 450.309860] [] ? free_hot_cold_page+0x502/0xa70 [ 450.316148] [] ? trace_hardirqs_on_caller+0x44c/0x5e0 [ 450.322955] [] ? trace_hardirqs_on+0xd/0x10 [ 450.328901] [] ? __put_page+0x67/0x80 [ 450.334322] [] ? rw_verify_area+0xb8/0x2b0 [ 450.340174] [] do_splice_to+0xe3/0x140 [ 450.345680] [] splice_direct_to_actor+0x235/0x7c0 [ 450.352143] [] ? generic_pipe_buf_nosteal+0x10/0x10 [ 450.358777] [] ? do_splice_to+0x140/0x140 [ 450.364546] [] ? security_file_permission+0x6a/0x1a0 [ 450.371266] [] ? rw_verify_area+0xb8/0x2b0 [ 450.377123] [] do_splice_direct+0x14e/0x260 [ 450.383065] [] ? splice_direct_to_actor+0x7c0/0x7c0 [ 450.389701] [] ? percpu_down_read+0x52/0x90 [ 450.395654] [] ? __sb_start_write+0xb2/0xf0 [ 450.401683] [] ? __sb_start_write+0xb2/0xf0 [ 450.407627] [] do_sendfile+0x4c0/0xe40 [ 450.413135] [] ? do_compat_pwritev64.isra.24+0xc0/0xc0 [ 450.420041] [] ? __might_fault+0xf1/0x1b0 [ 450.425809] [] SyS_sendfile64+0x11d/0x120 [ 450.431574] [] ? SyS_sendfile+0x110/0x110 [ 450.437345] [] ? trace_hardirqs_on_caller+0x44c/0x5e0 [ 450.444159] [] ? trace_hardirqs_on_thunk+0x1a/0x1c [ 450.450711] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 450.457261] Object at ffff8800ad2f7b40, in cache kmalloc-1024 [ 450.463115] Object freed, allocated with size 1024 bytes [ 450.468535] Allocation: [ 450.471091] PID = 6739 [ 450.473559] [] save_stack_trace+0x26/0x50 [ 450.479453] [] save_stack+0x46/0xd0 [ 450.484825] [] kasan_kmalloc+0xda/0x100 [ 450.490544] [] kmem_cache_alloc_trace+0x142/0x780 [ 450.497138] [] do_syslog+0x47b/0x990 [ 450.502596] [] kmsg_read+0x65/0x80 [ 450.507929] [] proc_reg_read+0xbc/0x180 [ 450.513644] [] __vfs_read+0xdb/0x730 [ 450.519101] [] vfs_read+0xea/0x2d0 [ 450.524392] [] SyS_read+0xcb/0x1a0 [ 450.529671] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 450.536338] Deallocation: [ 450.539067] PID = 6739 [ 450.541537] [] save_stack_trace+0x26/0x50 [ 450.547449] [] save_stack+0x46/0xd0 [ 450.552816] [] kasan_slab_free+0x9b/0xd0 [ 450.558617] [] kfree+0xcf/0x2c0 [ 450.563665] [] do_syslog+0x7d5/0x990 [ 450.569129] [] kmsg_read+0x65/0x80 [ 450.574419] [] proc_reg_read+0xbc/0x180 [ 450.580132] [] __vfs_read+0xdb/0x730 [ 450.585594] [] vfs_read+0xea/0x2d0 [ 450.590878] [] SyS_read+0xcb/0x1a0 [ 450.596157] [] entry_SYSCALL_64_fastpath+0x23/0xc1 [ 450.602831] Memory state around the buggy address: [ 450.607736] ffff8800ad2f7a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 450.615064] ffff8800ad2f7a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 450.622392] >ffff8800ad2f7b00: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb [ 450.629720] ^ [ 450.635404] ffff8800ad2f7b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 450.642736] ffff8800ad2f7c00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 450.650062] ================================================================== [ 450.657411] ================================================================== [ 450.664772] BUG: KASAN: use-after-free in pneigh_get_next.isra.18+0x214/0x320 at addr ffff8800ad2f7b40 [ 450.674184] Read of size 8 by task syz-executor.2/12203 [ 450.679523] CPU: 1 PID: 12203 Comm: syz-executor.2 Tainted: G B 4.7.0+ #1 [ 450.687545] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 450.696873] 1ffffffff0d56312 ffff8800aef371c0 ffffffff829e0956 ffff8800ad2f7b40 [ 450.704871] ffff8800aef37250 ffff8800ad2f7b40 ffff88012bc00700 ffff8800aef37240 [ 450.712859] ffffffff8174e667 0000000000000010 ffff880000000000 0000000000000282 [ 450.720870] Call Trace: [ 450.723434] [] dump_stack+0xe6/0x120 [ 450.728781] [] kasan_report_error+0x1e7/0x5b0 [ 450.734899] [] __asan_report_load8_noabort+0x3e/0x40 [ 450.741621] [] ? pneigh_get_next.isra.18+0x214/0x320 [ 450.748357] [] pneigh_get_next.isra.18+0x214/0x320 [ 450.754909] [] ? neigh_connected_output+0x510/0x510 [ 450.761543] [] ? mutex_lock_killable_nested+0xce0/0xce0 [ 450.768524] [] neigh_seq_next+0x91/0x1c0 [ 450.774205] [] seq_read+0x9e4/0x11a0 [ 450.779537] [] ? seq_hlist_next_rcu+0x130/0x130 [ 450.785839] [] ? rw_copy_check_uvector+0x97/0x280 [ 450.792305] [] ? rcu_read_lock_sched_held+0x9e/0x120 [ 450.799028] [] proc_reg_read+0xbc/0x180 [ 450.804620] [] do_loop_readv_writev+0x134/0x210 [ 450.810907] [] ? security_file_permission+0x148/0x1a0 [ 450.817716] [] ? proc_reg_write+0x180/0x180 [ 450.823658] [] ? proc_reg_write+0x180/0x180 [ 450.829699] [] do_readv_writev+0x565/0x660 [ 450.835567] [] ? vfs_write+0x4a0/0x4a0 [ 450.841081] [] ? perf_event_fork+0x20/0x20 [ 450.846948] [] ? debug_lockdep_rcu_enabled+0x77/0x90 [ 450.853671] [] ? alloc_pages_current+0x1b0/0x490 [ 450.860047] [] vfs_readv+0x67/0xa0