Warning: Permanently added '10.128.10.11' (ED25519) to the list of known hosts. 2024/07/02 22:49:57 ignoring optional flag "sandboxArg"="0" 2024/07/02 22:49:57 parsed 1 programs [ 53.953924][ T2658] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k 2024/07/02 22:50:02 executed programs: 0 [ 58.419717][ T1035] ================================================================== [ 58.427910][ T1035] BUG: KASAN: slab-use-after-free in l2tp_session_delete+0x23/0x830 [ 58.435908][ T1035] Write of size 8 at addr ffff888046a5b808 by task kworker/u8:6/1035 [ 58.443956][ T1035] [ 58.446266][ T1035] CPU: 0 PID: 1035 Comm: kworker/u8:6 Not tainted 6.10.0-rc4-syzkaller #0 [ 58.455033][ T1035] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 [ 58.465110][ T1035] Workqueue: l2tp l2tp_tunnel_del_work [ 58.470564][ T1035] Call Trace: [ 58.473920][ T1035] [ 58.476923][ T1035] dump_stack_lvl+0x108/0x280 [ 58.481681][ T1035] ? __pfx_dump_stack_lvl+0x10/0x10 [ 58.486878][ T1035] ? __pfx__printk+0x10/0x10 [ 58.491554][ T1035] ? _printk+0xce/0x120 [ 58.495707][ T1035] ? __virt_addr_valid+0x141/0x260 [ 58.500815][ T1035] ? __virt_addr_valid+0x219/0x260 [ 58.506099][ T1035] print_report+0x169/0x550 [ 58.510683][ T1035] ? __virt_addr_valid+0x141/0x260 [ 58.515931][ T1035] ? __virt_addr_valid+0x219/0x260 [ 58.521128][ T1035] ? l2tp_session_delete+0x23/0x830 [ 58.526323][ T1035] kasan_report+0x143/0x180 [ 58.530827][ T1035] ? l2tp_session_delete+0x23/0x830 [ 58.536023][ T1035] kasan_check_range+0x282/0x290 [ 58.540968][ T1035] l2tp_session_delete+0x23/0x830 [ 58.545990][ T1035] l2tp_tunnel_del_work+0xf3/0x3a0 [ 58.551106][ T1035] ? process_scheduled_works+0x855/0x1320 [ 58.556908][ T1035] process_scheduled_works+0x8cf/0x1320 [ 58.562456][ T1035] ? __pfx_process_scheduled_works+0x10/0x10 [ 58.568441][ T1035] ? assign_work+0x23f/0x350 [ 58.573036][ T1035] worker_thread+0x869/0xca0 [ 58.577632][ T1035] ? __pfx_worker_thread+0x10/0x10 [ 58.582745][ T1035] kthread+0x268/0x2c0 [ 58.586982][ T1035] ? __pfx_worker_thread+0x10/0x10 [ 58.592343][ T1035] ? __pfx_kthread+0x10/0x10 [ 58.596923][ T1035] ret_from_fork+0x32/0x60 [ 58.601331][ T1035] ? __pfx_kthread+0x10/0x10 [ 58.605917][ T1035] ret_from_fork_asm+0x1a/0x30 [ 58.610678][ T1035] [ 58.613688][ T1035] [ 58.616003][ T1035] Allocated by task 3142: [ 58.620315][ T1035] kasan_save_track+0x3f/0x80 [ 58.624991][ T1035] __kasan_kmalloc+0x98/0xb0 [ 58.629748][ T1035] __kmalloc_noprof+0x1d5/0x440 [ 58.634598][ T1035] l2tp_session_create+0x34/0xb90 [ 58.639614][ T1035] pppol2tp_connect+0xb4e/0x1650 [ 58.644809][ T1035] __sys_connect+0x318/0x390 [ 58.649485][ T1035] __x64_sys_connect+0x75/0x90 [ 58.654243][ T1035] do_syscall_64+0x8d/0x170 [ 58.658745][ T1035] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 58.664628][ T1035] [ 58.666957][ T1035] Freed by task 2728: [ 58.670933][ T1035] kasan_save_track+0x3f/0x80 [ 58.675616][ T1035] kasan_save_free_info+0x40/0x50 [ 58.680637][ T1035] poison_slab_object+0xe0/0x150 [ 58.685575][ T1035] __kasan_slab_free+0x37/0x60 [ 58.690361][ T1035] kfree+0x12f/0x310 [ 58.694254][ T1035] __sk_destruct+0x4b/0x550 [ 58.698752][ T1035] rcu_core+0xc3c/0x1470 [ 58.702991][ T1035] handle_softirqs+0x1b7/0x570 [ 58.708093][ T1035] __irq_exit_rcu+0x45/0xe0 [ 58.712601][ T1035] sysvec_apic_timer_interrupt+0x92/0xb0 [ 58.718318][ T1035] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 58.724299][ T1035] [ 58.726714][ T1035] Last potentially related work creation: [ 58.732478][ T1035] kasan_save_stack+0x3f/0x60 [ 58.737156][ T1035] __kasan_record_aux_stack+0xac/0xc0 [ 58.742706][ T1035] call_rcu+0x159/0x8e0 [ 58.746878][ T1035] pppol2tp_release+0x1c5/0x250 [ 58.751729][ T1035] sock_close+0xb4/0x220 [ 58.755969][ T1035] __fput+0x337/0x700 [ 58.759950][ T1035] task_work_run+0x20f/0x290 [ 58.764546][ T1035] syscall_exit_to_user_mode+0xb5/0x1c0 [ 58.770090][ T1035] do_syscall_64+0x9a/0x170 [ 58.774589][ T1035] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 58.780479][ T1035] [ 58.782801][ T1035] The buggy address belongs to the object at ffff888046a5b800 [ 58.782801][ T1035] which belongs to the cache kmalloc-1k of size 1024 [ 58.797229][ T1035] The buggy address is located 8 bytes inside of [ 58.797229][ T1035] freed 1024-byte region [ffff888046a5b800, ffff888046a5bc00) [ 58.811191][ T1035] [ 58.813541][ T1035] The buggy address belongs to the physical page: [ 58.820039][ T1035] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x46a58 [ 58.828984][ T1035] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 58.837653][ T1035] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 58.845392][ T1035] page_type: 0xffffefff(slab) [ 58.850061][ T1035] raw: 00fff00000000040 ffff888009841dc0 ffffea00017d2600 dead000000000002 [ 58.858635][ T1035] raw: 0000000000000000 0000000000100010 00000001ffffefff 0000000000000000 [ 58.867212][ T1035] head: 00fff00000000040 ffff888009841dc0 ffffea00017d2600 dead000000000002 [ 58.875875][ T1035] head: 0000000000000000 0000000000100010 00000001ffffefff 0000000000000000 [ 58.884809][ T1035] head: 00fff00000000003 ffffea00011a9601 ffffffffffffffff 0000000000000000 [ 58.893565][ T1035] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 [ 58.902321][ T1035] page dumped because: kasan: bad access detected [ 58.908741][ T1035] page_owner tracks the page as allocated [ 58.914540][ T1035] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 1881, tgid 1881 (kworker/u8:4), ts 28236816161, free_ts 28167340684 [ 58.937480][ T1035] post_alloc_hook+0x10f/0x130 [ 58.942407][ T1035] get_page_from_freelist+0x2c3f/0x2cf0 [ 58.947956][ T1035] __alloc_pages_noprof+0x256/0x670 [ 58.953420][ T1035] alloc_slab_page+0x5f/0x120 [ 58.958545][ T1035] allocate_slab+0x5d/0x290 [ 58.963920][ T1035] ___slab_alloc+0xa7f/0x11d0 [ 58.968814][ T1035] __kmalloc_noprof+0x25a/0x440 [ 58.973852][ T1035] load_elf_phdrs+0xe1/0x1f0 [ 58.979915][ T1035] load_elf_binary+0x81c/0x2390 [ 58.984781][ T1035] bprm_execve+0x891/0x12f0 [ 58.989367][ T1035] kernel_execve+0x532/0x610 [ 58.994130][ T1035] call_usermodehelper_exec_async+0x204/0x320 [ 59.000200][ T1035] ret_from_fork+0x32/0x60 [ 59.004618][ T1035] ret_from_fork_asm+0x1a/0x30 [ 59.009550][ T1035] page last free pid 1872 tgid 1872 stack trace: [ 59.015868][ T1035] free_unref_page+0xb6f/0xca0 [ 59.020755][ T1035] __put_partials+0x18e/0x1d0 [ 59.025600][ T1035] put_cpu_partial+0x151/0x1b0 [ 59.030363][ T1035] __slab_free+0x2b8/0x3a0 [ 59.034816][ T1035] qlist_free_all+0x9e/0x140 [ 59.039407][ T1035] kasan_quarantine_reduce+0x14f/0x170 [ 59.044872][ T1035] __kasan_slab_alloc+0x23/0x80 [ 59.049726][ T1035] kmem_cache_alloc_noprof+0x12b/0x350 [ 59.055173][ T1035] getname_flags+0xa1/0x440 [ 59.059669][ T1035] user_path_at_empty+0x1f/0x50 [ 59.064496][ T1035] do_faccessat+0x49f/0x930 [ 59.069530][ T1035] do_syscall_64+0x8d/0x170 [ 59.074027][ T1035] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 59.079945][ T1035] [ 59.082299][ T1035] Memory state around the buggy address: [ 59.088013][ T1035] ffff888046a5b700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 59.096241][ T1035] ffff888046a5b780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 59.104380][ T1035] >ffff888046a5b800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 59.112439][ T1035] ^ [ 59.116768][ T1035] ffff888046a5b880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 59.124827][ T1035] ffff888046a5b900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 59.133140][ T1035] ================================================================== [ 59.144358][ T1035] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 59.152100][ T1035] Kernel Offset: disabled [ 59.156430][ T1035] Rebooting in 86400 seconds..