Warning: Permanently added '10.128.10.43' (ED25519) to the list of known hosts. 2025/07/16 00:38:08 ignoring optional flag "sandboxArg"="0" 2025/07/16 00:38:09 parsed 1 programs [ 81.927855][ T1929] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k 2025/07/16 00:38:17 executed programs: 0 [ 90.876717][ T2614] ================================================================== [ 90.884806][ T2614] BUG: KASAN: slab-use-after-free in tcp_prune_ofo_queue+0x316/0x5f0 [ 90.892878][ T2614] Read of size 4 at addr ffff888126122430 by task syz.6.43/2614 [ 90.900495][ T2614] [ 90.902922][ T2614] CPU: 0 UID: 0 PID: 2614 Comm: syz.6.43 Not tainted 6.16.0-rc5-syzkaller #0 PREEMPT(none) [ 90.902932][ T2614] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 90.902942][ T2614] Call Trace: [ 90.902951][ T2614] [ 90.902954][ T2614] dump_stack_lvl+0xf4/0x170 [ 90.902969][ T2614] ? __pfx_dump_stack_lvl+0x10/0x10 [ 90.902977][ T2614] ? rcu_is_watching+0x1f/0xa0 [ 90.902983][ T2614] ? __virt_addr_valid+0x176/0x2b0 [ 90.902990][ T2614] ? lock_release+0x42/0x2f0 [ 90.902997][ T2614] ? lock_acquire+0x69/0x210 [ 90.903003][ T2614] ? _raw_spin_lock_irqsave+0xa5/0xe0 [ 90.903012][ T2614] ? __virt_addr_valid+0x176/0x2b0 [ 90.903018][ T2614] ? __virt_addr_valid+0x262/0x2b0 [ 90.903024][ T2614] print_report+0xd2/0x2b0 [ 90.903033][ T2614] ? tcp_prune_ofo_queue+0x316/0x5f0 [ 90.903041][ T2614] kasan_report+0x118/0x150 [ 90.903050][ T2614] ? tcp_prune_ofo_queue+0x316/0x5f0 [ 90.903059][ T2614] tcp_prune_ofo_queue+0x316/0x5f0 [ 90.903069][ T2614] tcp_try_rmem_schedule+0xaf1/0x1640 [ 90.903079][ T2614] tcp_data_queue+0x38e/0x6420 [ 90.903091][ T2614] ? __pfx_tcp_ack+0x10/0x10 [ 90.903098][ T2614] ? tcp_urg+0xfa/0x430 [ 90.903104][ T2614] ? __pfx_tcp_data_queue+0x10/0x10 [ 90.903111][ T2614] ? __pfx_tcp_urg+0x10/0x10 [ 90.903119][ T2614] tcp_rcv_established+0xf15/0x2060 [ 90.903128][ T2614] ? __pfx_tcp_rcv_established+0x10/0x10 [ 90.903135][ T2614] ? ipv4_dst_check+0x51/0x170 [ 90.903142][ T2614] ? ipv4_dst_check+0x51/0x170 [ 90.903147][ T2614] ? ipv4_dst_check+0x10d/0x170 [ 90.903154][ T2614] tcp_v4_do_rcv+0x239/0xab0 [ 90.903163][ T2614] __release_sock+0x96/0x180 [ 90.903180][ T2614] release_sock+0x54/0x160 [ 90.903187][ T2614] tcp_sendmsg+0x31/0x40 [ 90.903195][ T2614] __sock_sendmsg+0x163/0x220 [ 90.903203][ T2614] __sys_sendto+0x31a/0x430 [ 90.903211][ T2614] ? __pfx___sys_sendto+0x10/0x10 [ 90.903217][ T2614] ? __schedule+0x1590/0x23f0 [ 90.903232][ T2614] __x64_sys_sendto+0xd9/0xf0 [ 90.903239][ T2614] do_syscall_64+0x8f/0x250 [ 90.903247][ T2614] ? fpregs_assert_state_consistent+0x48/0x60 [ 90.903254][ T2614] ? clear_bhb_loop+0x40/0x90 [ 90.903262][ T2614] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 90.903268][ T2614] RIP: 0033:0x7fe3ec14e929 [ 90.903276][ T2614] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 90.903286][ T2614] RSP: 002b:00007fe3ebbbf038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c [ 90.903299][ T2614] RAX: ffffffffffffffda RBX: 00007fe3ec375fa0 RCX: 00007fe3ec14e929 [ 90.903304][ T2614] RDX: 000000000000059a RSI: 0000200000000580 RDI: 0000000000000003 [ 90.903309][ T2614] RBP: 00007fe3ec1d0b39 R08: 0000000000000000 R09: 0000000000000000 [ 90.903314][ T2614] R10: 0000000010008095 R11: 0000000000000246 R12: 0000000000000000 [ 90.903318][ T2614] R13: 0000000000000000 R14: 00007fe3ec375fa0 R15: 00007ffd4c938d38 [ 90.903326][ T2614] [ 90.903329][ T2614] [ 91.192954][ T2614] Allocated by task 2614: [ 91.197362][ T2614] kasan_save_track+0x3e/0x80 [ 91.202029][ T2614] __kasan_slab_alloc+0x6c/0x80 [ 91.206870][ T2614] kmem_cache_alloc_node_noprof+0x1a9/0x400 [ 91.212773][ T2614] __alloc_skb+0xc4/0x250 [ 91.217269][ T2614] tcp_stream_alloc_skb+0x34/0x2f0 [ 91.222374][ T2614] tcp_write_xmit+0x1683/0x6840 [ 91.227220][ T2614] __tcp_push_pending_frames+0x79/0x2f0 [ 91.232805][ T2614] tcp_sendmsg_locked+0x3a37/0x4230 [ 91.237999][ T2614] tcp_sendmsg+0x27/0x40 [ 91.242233][ T2614] __sock_sendmsg+0x163/0x220 [ 91.246902][ T2614] __sys_sendto+0x31a/0x430 [ 91.251399][ T2614] __x64_sys_sendto+0xd9/0xf0 [ 91.256073][ T2614] do_syscall_64+0x8f/0x250 [ 91.260564][ T2614] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 91.266550][ T2614] [ 91.268880][ T2614] Freed by task 2614: [ 91.272937][ T2614] kasan_save_track+0x3e/0x80 [ 91.277599][ T2614] kasan_save_free_info+0x46/0x50 [ 91.282614][ T2614] __kasan_slab_free+0x62/0x70 [ 91.287367][ T2614] kmem_cache_free+0x175/0x460 [ 91.292205][ T2614] tcp_prune_ofo_queue+0x182/0x5f0 [ 91.297323][ T2614] tcp_try_rmem_schedule+0xaf1/0x1640 [ 91.302688][ T2614] tcp_data_queue+0x38e/0x6420 [ 91.307790][ T2614] tcp_rcv_established+0xf15/0x2060 [ 91.312978][ T2614] tcp_v4_do_rcv+0x239/0xab0 [ 91.317565][ T2614] __release_sock+0x96/0x180 [ 91.322158][ T2614] release_sock+0x54/0x160 [ 91.326565][ T2614] tcp_sendmsg+0x31/0x40 [ 91.330806][ T2614] __sock_sendmsg+0x163/0x220 [ 91.335474][ T2614] __sys_sendto+0x31a/0x430 [ 91.339968][ T2614] __x64_sys_sendto+0xd9/0xf0 [ 91.344636][ T2614] do_syscall_64+0x8f/0x250 [ 91.349131][ T2614] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 91.355017][ T2614] [ 91.357338][ T2614] The buggy address belongs to the object at ffff888126122280 [ 91.357338][ T2614] which belongs to the cache skbuff_fclone_cache of size 456 [ 91.372071][ T2614] The buggy address is located 432 bytes inside of [ 91.372071][ T2614] freed 456-byte region [ffff888126122280, ffff888126122448) [ 91.385854][ T2614] [ 91.388173][ T2614] The buggy address belongs to the physical page: [ 91.394585][ T2614] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x126122 [ 91.403427][ T2614] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 91.412088][ T2614] flags: 0x200000000000040(head|node=0|zone=2) [ 91.418267][ T2614] page_type: f5(slab) [ 91.422253][ T2614] raw: 0200000000000040 ffff8881026c9b40 dead000000000122 0000000000000000 [ 91.430836][ T2614] raw: 0000000000000000 00000000800c000c 00000000f5000000 0000000000000000 [ 91.439417][ T2614] head: 0200000000000040 ffff8881026c9b40 dead000000000122 0000000000000000 [ 91.448080][ T2614] head: 0000000000000000 00000000800c000c 00000000f5000000 0000000000000000 [ 91.456749][ T2614] head: 0200000000000001 ffffea0004984881 00000000ffffffff 00000000ffffffff [ 91.465419][ T2614] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000002 [ 91.474079][ T2614] page dumped because: kasan: bad access detected [ 91.480490][ T2614] page_owner tracks the page as allocated [ 91.486197][ T2614] page last allocated via order 1, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 2614, tgid 2611 (syz.6.43), ts 90875663640, free_ts 90851698454 [ 91.505110][ T2614] post_alloc_hook+0x168/0x1a0 [ 91.509881][ T2614] get_page_from_freelist+0x2cc3/0x2e80 [ 91.515461][ T2614] __alloc_frozen_pages_noprof+0x26b/0x460 [ 91.521299][ T2614] alloc_pages_mpol+0xcb/0x270 [ 91.526053][ T2614] allocate_slab+0x8a/0x350 [ 91.530549][ T2614] ___slab_alloc+0x9dc/0x10e0 [ 91.535214][ T2614] kmem_cache_alloc_node_noprof+0x26b/0x400 [ 91.541098][ T2614] __alloc_skb+0xc4/0x250 [ 91.545437][ T2614] tcp_stream_alloc_skb+0x34/0x2f0 [ 91.550544][ T2614] tcp_write_xmit+0x1683/0x6840 [ 91.555391][ T2614] __tcp_push_pending_frames+0x79/0x2f0 [ 91.560933][ T2614] tcp_sendmsg_locked+0x3a37/0x4230 [ 91.566128][ T2614] tcp_sendmsg+0x27/0x40 [ 91.570371][ T2614] __sock_sendmsg+0x163/0x220 [ 91.575134][ T2614] __sys_sendto+0x31a/0x430 [ 91.579630][ T2614] __x64_sys_sendto+0xd9/0xf0 [ 91.584305][ T2614] page last free pid 2462 tgid 2462 stack trace: [ 91.590649][ T2614] __free_frozen_pages+0xa2e/0xc00 [ 91.595763][ T2614] __slab_free+0x2d6/0x3a0 [ 91.600174][ T2614] qlist_free_all+0x97/0x140 [ 91.604787][ T2614] kasan_quarantine_reduce+0x148/0x160 [ 91.610241][ T2614] __kasan_slab_alloc+0x22/0x80 [ 91.615093][ T2614] __kmalloc_noprof+0x20d/0x500 [ 91.619950][ T2614] tomoyo_realpath_from_path+0xf5/0x550 [ 91.625491][ T2614] tomoyo_path_perm+0x1d3/0x460 [ 91.630332][ T2614] security_file_truncate+0x40/0xb0 [ 91.635521][ T2614] path_openat+0x2582/0x2bb0 [ 91.640104][ T2614] do_filp_open+0x1e4/0x3c0 [ 91.645041][ T2614] do_sys_openat2+0xfa/0x180 [ 91.649636][ T2614] __x64_sys_openat+0xf3/0x120 [ 91.654398][ T2614] do_syscall_64+0x8f/0x250 [ 91.658896][ T2614] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 91.664782][ T2614] [ 91.667108][ T2614] Memory state around the buggy address: [ 91.672736][ T2614] ffff888126122300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 91.680802][ T2614] ffff888126122380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 91.688945][ T2614] >ffff888126122400: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc [ 91.697012][ T2614] ^ [ 91.702639][ T2614] ffff888126122480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 91.710702][ T2614] ffff888126122500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 91.718841][ T2614] ================================================================== [ 91.727088][ T2614] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 91.734518][ T2614] Kernel Offset: disabled [ 91.738841][ T2614] Rebooting in 86400 seconds..