[ 420.865278][T13141] netlink: 'syz-executor.3': attribute type 4 has an invalid length. [ 420.904769][T13146] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 420.914321][T13147] netlink: 'syz-executor.4': attribute type 4 has an invalid length. [ 420.927984][T13150] netlink: 'syz-executor.2': attribute type 4 has an invalid length. [ 420.970232][T13152] netlink: 'syz-executor.1': attribute type 4 has an invalid length. [ 420.983509][T13154] netlink: 'syz-executor.5': attribute type 4 has an invalid length. [ 421.016199][T13158] netlink: 'syz-executor.4': attribute type 4 has an invalid length. [ 421.043742][T13164] netlink: 'syz-executor.3': attribute type 4 has an invalid length. [ 421.108680][T13170] netlink: 'syz-executor.2': attribute type 4 has an invalid length. [ 421.124400][T13169] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 425.886560][T13730] validate_nla: 275 callbacks suppressed [ 425.886577][T13730] netlink: 'syz-executor.4': attribute type 4 has an invalid length. [ 425.931272][T13731] netlink: 'syz-executor.5': attribute type 4 has an invalid length. [ 425.940391][T13732] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 425.954674][T13733] netlink: 'syz-executor.3': attribute type 4 has an invalid length. [ 425.973287][T13736] netlink: 'syz-executor.1': attribute type 4 has an invalid length. [ 425.987748][T13737] netlink: 'syz-executor.2': attribute type 4 has an invalid length. [ 426.050427][T13745] netlink: 'syz-executor.4': attribute type 4 has an invalid length. [ 426.087637][T13751] netlink: 'syz-executor.1': attribute type 4 has an invalid length. [ 426.113948][T13753] netlink: 'syz-executor.0': attribute type 4 has an invalid length. [ 426.122303][T13748] netlink: 'syz-executor.5': attribute type 4 has an invalid length. [ 428.358542][ T44] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 428.468076][ T44] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 428.581541][ T44] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 428.689282][ T44] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 Warning: Permanently added '10.128.0.41' (ECDSA) to the list of known hosts. [ 429.748115][ T44] device hsr_slave_0 left promiscuous mode [ 429.765453][ T44] device hsr_slave_1 left promiscuous mode [ 429.775447][ T44] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 429.783626][ T44] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 429.808444][ T44] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 429.836270][ T44] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 429.847632][ T44] device bridge_slave_1 left promiscuous mode [ 429.853880][ T44] bridge0: port 2(bridge_slave_1) entered disabled state [ 429.886489][ T44] device bridge_slave_0 left promiscuous mode [ 429.892738][ T44] bridge0: port 1(bridge_slave_0) entered disabled state [ 429.908525][ T44] device veth1_macvtap left promiscuous mode [ 429.914587][ T44] device veth0_macvtap left promiscuous mode [ 429.933768][ T44] device veth1_vlan left promiscuous mode [ 429.942491][ T44] device veth0_vlan left promiscuous mode [ 430.407643][ T44] team0 (unregistering): Port device team_slave_1 removed [ 430.438150][ T44] team0 (unregistering): Port device team_slave_0 removed [ 430.461982][ T44] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 430.492319][ T44] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 430.704911][ T44] bond0 (unregistering): Released all slaves [ 430.909049][T13780] validate_nla: 15 callbacks suppressed [ 430.909066][T13780] netlink: 'syz-executor329': attribute type 4 has an invalid length. [ 430.944367][T13781] netlink: 'syz-executor329': attribute type 4 has an invalid length. [ 430.984044][T13782] netlink: 'syz-executor329': attribute type 4 has an invalid length. [ 431.009119][T13783] netlink: 'syz-executor329': attribute type 4 has an invalid length. [ 431.032340][T13784] netlink: 'syz-executor329': attribute type 4 has an invalid length. [ 431.065626][T13785] netlink: 'syz-executor329': attribute type 4 has an invalid length. [ 431.080152][T13786] netlink: 'syz-executor329': attribute type 4 has an invalid length. [ 431.097056][T13787] netlink: 'syz-executor329': attribute type 4 has an invalid length. [ 431.131917][T13788] netlink: 'syz-executor329': attribute type 4 has an invalid length. [ 431.179264][T13789] netlink: 'syz-executor329': attribute type 4 has an invalid length. [ 434.094637][ T44] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 434.174777][ T44] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 434.245898][ T44] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 434.324568][ T44] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 434.485897][ T44] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 434.552870][ T44] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 434.585439][ C0] ================================================================== [ 434.593876][ C0] BUG: KASAN: use-after-free in tcp_retransmit_timer+0x2ea2/0x3320 [ 434.601796][ C0] Read of size 8 at addr ffff88807d990338 by task swapper/0/0 [ 434.609263][ C0] [ 434.611592][ C0] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 5.17.0-rc6-syzkaller-00226-g07ebd38a0da2-dirty #0 [ 434.621842][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 434.631911][ C0] Call Trace: [ 434.635219][ C0] [ 434.638071][ C0] dump_stack_lvl+0xcd/0x134 [ 434.642687][ C0] print_address_description.constprop.0.cold+0x8d/0x303 [ 434.649744][ C0] ? tcp_retransmit_timer+0x2ea2/0x3320 [ 434.655310][ C0] ? tcp_retransmit_timer+0x2ea2/0x3320 [ 434.660969][ C0] kasan_report.cold+0x83/0xdf [ 434.665770][ C0] ? tcp_retransmit_timer+0x2ea2/0x3320 [ 434.671337][ C0] tcp_retransmit_timer+0x2ea2/0x3320 [ 434.676728][ C0] ? tcp_mstamp_refresh+0x12/0xa0 [ 434.681783][ C0] ? tcp_delack_timer+0x320/0x320 [ 434.686825][ C0] ? ktime_get+0x38a/0x470 [ 434.691280][ C0] ? lockdep_hardirqs_on+0x79/0x100 [ 434.696500][ C0] ? __sanitizer_cov_trace_cmp4+0x1c/0x70 [ 434.702254][ C0] ? ktime_get+0x30b/0x470 [ 434.706701][ C0] tcp_write_timer_handler+0x5e6/0xbc0 [ 434.712181][ C0] tcp_write_timer+0xa2/0x2b0 [ 434.716880][ C0] ? tcp_write_timer_handler+0xbc0/0xbc0 [ 434.722529][ C0] call_timer_fn+0x1a5/0x6b0 [ 434.727138][ C0] ? timer_fixup_activate+0x350/0x350 [ 434.732537][ C0] ? lock_downgrade+0x6e0/0x6e0 [ 434.737427][ C0] ? _raw_spin_unlock_irq+0x1f/0x40 [ 434.742646][ C0] ? tcp_write_timer_handler+0xbc0/0xbc0 [ 434.748298][ C0] __run_timers.part.0+0x67c/0xa30 [ 434.753441][ C0] ? call_timer_fn+0x6b0/0x6b0 [ 434.758311][ C0] ? kvm_sched_clock_read+0x14/0x40 [ 434.763528][ C0] ? sched_clock_cpu+0x15/0x1f0 [ 434.768399][ C0] run_timer_softirq+0xb3/0x1d0 [ 434.773270][ C0] __do_softirq+0x29b/0x9c2 [ 434.777798][ C0] __irq_exit_rcu+0x123/0x180 [ 434.782506][ C0] irq_exit_rcu+0x5/0x20 [ 434.786775][ C0] sysvec_apic_timer_interrupt+0x93/0xc0 [ 434.792434][ C0] [ 434.795367][ C0] [ 434.798308][ C0] asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 434.804310][ C0] RIP: 0010:acpi_idle_do_entry+0x1c6/0x250 [ 434.810134][ C0] Code: 89 de e8 5d 1d 29 f8 84 db 75 ac e8 f4 19 29 f8 e8 2f 58 2f f8 eb 0c e8 e8 19 29 f8 0f 00 2d 41 33 c2 00 e8 dc 19 29 f8 fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 d7 1b 29 f8 48 85 db [ 434.829757][ C0] RSP: 0018:ffffffff8b807d60 EFLAGS: 00000293 [ 434.835848][ C0] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 434.843833][ C0] RDX: ffffffff8b8bc6c0 RSI: ffffffff894ec924 RDI: 0000000000000000 [ 434.851825][ C0] RBP: ffff888012bb4864 R08: 0000000000000001 R09: 0000000000000001 [ 434.859814][ C0] R10: ffffffff817e2178 R11: 0000000000000000 R12: 0000000000000001 [ 434.867801][ C0] R13: ffff888012bb4800 R14: ffff888012bb4864 R15: ffff888018f68804 [ 434.875881][ C0] ? trace_hardirqs_on+0x38/0x1c0 [ 434.880921][ C0] ? acpi_idle_do_entry+0x1c4/0x250 [ 434.886230][ C0] acpi_idle_enter+0x361/0x500 [ 434.891015][ C0] cpuidle_enter_state+0x1b1/0xc80 [ 434.896253][ C0] cpuidle_enter+0x4a/0xa0 [ 434.900692][ C0] do_idle+0x3e8/0x590 [ 434.904783][ C0] ? arch_cpu_idle_exit+0x30/0x30 [ 434.909842][ C0] ? trace_init_perf_perm_irq_work_exit+0xe/0xe [ 434.916105][ C0] cpu_startup_entry+0x14/0x20 [ 434.920888][ C0] start_kernel+0x47a/0x49b [ 434.925420][ C0] secondary_startup_64_no_verify+0xc3/0xcb [ 434.931339][ C0] [ 434.934366][ C0] [ 434.936689][ C0] Allocated by task 3882: [ 434.941019][ C0] kasan_save_stack+0x1e/0x40 [ 434.945719][ C0] __kasan_slab_alloc+0x85/0xb0 [ 434.950586][ C0] kmem_cache_alloc+0x265/0x560 [ 434.955459][ C0] copy_net_ns+0x125/0x760 [ 434.959983][ C0] create_new_namespaces+0x3f6/0xb20 [ 434.965295][ C0] unshare_nsproxy_namespaces+0xc1/0x1f0 [ 434.970945][ C0] ksys_unshare+0x445/0x920 [ 434.975483][ C0] __x64_sys_unshare+0x2d/0x40 [ 434.980267][ C0] do_syscall_64+0x35/0xb0 [ 434.984702][ C0] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 434.990620][ C0] [ 434.992950][ C0] Freed by task 44: [ 434.996760][ C0] kasan_save_stack+0x1e/0x40 [ 435.001459][ C0] kasan_set_track+0x21/0x30 [ 435.006074][ C0] kasan_set_free_info+0x20/0x30 [ 435.011036][ C0] ____kasan_slab_free+0xff/0x140 [ 435.016098][ C0] kmem_cache_free.part.0+0x91/0x200 [ 435.021403][ C0] cleanup_net+0x8ba/0xb00 [ 435.025835][ C0] process_one_work+0x9ac/0x1650 [ 435.030786][ C0] worker_thread+0x657/0x1110 [ 435.035486][ C0] kthread+0x2e9/0x3a0 [ 435.039578][ C0] ret_from_fork+0x1f/0x30 [ 435.044015][ C0] [ 435.046380][ C0] The buggy address belongs to the object at ffff88807d990080 [ 435.046380][ C0] which belongs to the cache net_namespace of size 6528 [ 435.060709][ C0] The buggy address is located 696 bytes inside of [ 435.060709][ C0] 6528-byte region [ffff88807d990080, ffff88807d991a00) [ 435.074085][ C0] The buggy address belongs to the page: [ 435.079720][ C0] page:ffffea0001f66400 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7d990 [ 435.089889][ C0] head:ffffea0001f66400 order:1 compound_mapcount:0 [ 435.096484][ C0] memcg:ffff88807ba05541 [ 435.100729][ C0] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 435.108733][ C0] raw: 00fff00000010200 ffff8880161a9850 ffffea0001c6e488 ffff8881400a2a00 [ 435.117330][ C0] raw: 0000000000000000 ffff88807d990080 0000000100000001 ffff88807ba05541 [ 435.126181][ C0] page dumped because: kasan: bad access detected [ 435.132596][ C0] page_owner tracks the page as allocated [ 435.138310][ C0] page last allocated via order 1, migratetype Unmovable, gfp_mask 0x3420c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_COMP|__GFP_HARDWALL|__GFP_THISNODE), pid 3882, ts 64369149646, free_ts 64341052408 [ 435.157441][ C0] get_page_from_freelist+0xa72/0x2f50 [ 435.162927][ C0] __alloc_pages+0x1b2/0x500 [ 435.167539][ C0] cache_grow_begin+0x75/0x390 [ 435.172320][ C0] cache_alloc_refill+0x27f/0x380 [ 435.177380][ C0] kmem_cache_alloc+0x450/0x560 [ 435.182251][ C0] copy_net_ns+0x125/0x760 [ 435.186687][ C0] create_new_namespaces+0x3f6/0xb20 [ 435.191990][ C0] unshare_nsproxy_namespaces+0xc1/0x1f0 [ 435.197639][ C0] ksys_unshare+0x445/0x920 [ 435.202161][ C0] __x64_sys_unshare+0x2d/0x40 [ 435.206947][ C0] do_syscall_64+0x35/0xb0 [ 435.211384][ C0] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 435.217299][ C0] page last free stack trace: [ 435.221973][ C0] free_pcp_prepare+0x374/0x870 [ 435.226853][ C0] free_unref_page+0x19/0x690 [ 435.231541][ C0] slabs_destroy+0x89/0xc0 [ 435.235975][ C0] ___cache_free+0x303/0x600 [ 435.240584][ C0] qlist_free_all+0x50/0x1a0 [ 435.245198][ C0] kasan_quarantine_reduce+0x180/0x200 [ 435.250685][ C0] __kasan_slab_alloc+0x97/0xb0 [ 435.255551][ C0] kmem_cache_alloc+0x265/0x560 [ 435.260416][ C0] getname_flags.part.0+0x50/0x4f0 [ 435.265554][ C0] __x64_sys_unlink+0xb1/0x110 [ 435.270344][ C0] do_syscall_64+0x35/0xb0 [ 435.274800][ C0] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 435.280736][ C0] [ 435.283068][ C0] Memory state around the buggy address: [ 435.288704][ C0] ffff88807d990200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 435.296779][ C0] ffff88807d990280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 435.304863][ C0] >ffff88807d990300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 435.312929][ C0] ^ [ 435.318834][ C0] ffff88807d990380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 435.326932][ C0] ffff88807d990400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 435.334995][ C0] ================================================================== [ 435.343056][ C0] Disabling lock debugging due to kernel taint [ 435.349242][ C0] Kernel panic - not syncing: panic_on_warn set ... [ 435.355834][ C0] CPU: 0 PID: 0 Comm: swapper/0 Tainted: G B 5.17.0-rc6-syzkaller-00226-g07ebd38a0da2-dirty #0 [ 435.367474][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 [ 435.377536][ C0] Call Trace: [ 435.380815][ C0] [ 435.383659][ C0] dump_stack_lvl+0xcd/0x134 [ 435.388269][ C0] panic+0x2b0/0x6dd [ 435.392171][ C0] ? __warn_printk+0xf3/0xf3 [ 435.396773][ C0] ? tcp_retransmit_timer+0x2ea2/0x3320 [ 435.402337][ C0] ? trace_hardirqs_on+0x38/0x1c0 [ 435.407374][ C0] ? trace_hardirqs_on+0x51/0x1c0 [ 435.412410][ C0] ? tcp_retransmit_timer+0x2ea2/0x3320 [ 435.417964][ C0] ? tcp_retransmit_timer+0x2ea2/0x3320 [ 435.423521][ C0] end_report.cold+0x63/0x6f [ 435.428132][ C0] kasan_report.cold+0x71/0xdf [ 435.432921][ C0] ? tcp_retransmit_timer+0x2ea2/0x3320 [ 435.438480][ C0] tcp_retransmit_timer+0x2ea2/0x3320 [ 435.443863][ C0] ? tcp_mstamp_refresh+0x12/0xa0 [ 435.448905][ C0] ? tcp_delack_timer+0x320/0x320 [ 435.453938][ C0] ? ktime_get+0x38a/0x470 [ 435.458369][ C0] ? lockdep_hardirqs_on+0x79/0x100 [ 435.463583][ C0] ? __sanitizer_cov_trace_cmp4+0x1c/0x70 [ 435.469319][ C0] ? ktime_get+0x30b/0x470 [ 435.473752][ C0] tcp_write_timer_handler+0x5e6/0xbc0 [ 435.479234][ C0] tcp_write_timer+0xa2/0x2b0 [ 435.483919][ C0] ? tcp_write_timer_handler+0xbc0/0xbc0 [ 435.489560][ C0] call_timer_fn+0x1a5/0x6b0 [ 435.494160][ C0] ? timer_fixup_activate+0x350/0x350 [ 435.499546][ C0] ? lock_downgrade+0x6e0/0x6e0 [ 435.504415][ C0] ? _raw_spin_unlock_irq+0x1f/0x40 [ 435.509631][ C0] ? tcp_write_timer_handler+0xbc0/0xbc0 [ 435.515275][ C0] __run_timers.part.0+0x67c/0xa30 [ 435.520403][ C0] ? call_timer_fn+0x6b0/0x6b0 [ 435.525183][ C0] ? kvm_sched_clock_read+0x14/0x40 [ 435.530390][ C0] ? sched_clock_cpu+0x15/0x1f0 [ 435.535254][ C0] run_timer_softirq+0xb3/0x1d0 [ 435.540223][ C0] __do_softirq+0x29b/0x9c2 [ 435.544748][ C0] __irq_exit_rcu+0x123/0x180 [ 435.549451][ C0] irq_exit_rcu+0x5/0x20 [ 435.553712][ C0] sysvec_apic_timer_interrupt+0x93/0xc0 [ 435.559365][ C0] [ 435.562297][ C0] [ 435.565230][ C0] asm_sysvec_apic_timer_interrupt+0x12/0x20 [ 435.571227][ C0] RIP: 0010:acpi_idle_do_entry+0x1c6/0x250 [ 435.577053][ C0] Code: 89 de e8 5d 1d 29 f8 84 db 75 ac e8 f4 19 29 f8 e8 2f 58 2f f8 eb 0c e8 e8 19 29 f8 0f 00 2d 41 33 c2 00 e8 dc 19 29 f8 fb f4 <9c> 5b 81 e3 00 02 00 00 fa 31 ff 48 89 de e8 d7 1b 29 f8 48 85 db [ 435.596673][ C0] RSP: 0018:ffffffff8b807d60 EFLAGS: 00000293 [ 435.602751][ C0] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 435.610738][ C0] RDX: ffffffff8b8bc6c0 RSI: ffffffff894ec924 RDI: 0000000000000000 [ 435.618726][ C0] RBP: ffff888012bb4864 R08: 0000000000000001 R09: 0000000000000001 [ 435.626708][ C0] R10: ffffffff817e2178 R11: 0000000000000000 R12: 0000000000000001 [ 435.634685][ C0] R13: ffff888012bb4800 R14: ffff888012bb4864 R15: ffff888018f68804 [ 435.642669][ C0] ? trace_hardirqs_on+0x38/0x1c0 [ 435.647710][ C0] ? acpi_idle_do_entry+0x1c4/0x250 [ 435.652923][ C0] acpi_idle_enter+0x361/0x500 [ 435.657807][ C0] cpuidle_enter_state+0x1b1/0xc80 [ 435.662932][ C0] cpuidle_enter+0x4a/0xa0 [ 435.667361][ C0] do_idle+0x3e8/0x590 [ 435.671448][ C0] ? arch_cpu_idle_exit+0x30/0x30 [ 435.676489][ C0] ? trace_init_perf_perm_irq_work_exit+0xe/0xe [ 435.682748][ C0] cpu_startup_entry+0x14/0x20 [ 435.687530][ C0] start_kernel+0x47a/0x49b [ 435.692060][ C0] secondary_startup_64_no_verify+0xc3/0xcb [ 435.697985][ C0] [ 435.701183][ C0] Kernel Offset: disabled [ 435.705494][ C0] Rebooting in 86400 seconds..