================================================================== BUG: KASAN: use-after-free in nr_add_node+0x1d78/0x1fc4 net/netrom/nr_route.c:248 Read of size 2 at addr ffff0000ce1a9732 by task syz.2.6583/19121 CPU: 1 PID: 19121 Comm: syz.2.6583 Not tainted 5.15.178-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 Call trace: dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216 __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106 print_address_description+0x7c/0x3f0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:434 [inline] kasan_report+0x174/0x1e4 mm/kasan/report.c:451 __asan_report_load2_noabort+0x44/0x50 mm/kasan/report_generic.c:307 nr_add_node+0x1d78/0x1fc4 net/netrom/nr_route.c:248 nr_rt_ioctl+0xe58/0x18c8 net/netrom/nr_route.c:651 nr_ioctl+0x14c/0x4b0 net/netrom/af_netrom.c:1253 sock_do_ioctl+0x134/0x2dc net/socket.c:1140 sock_ioctl+0x4f0/0x8ac net/socket.c:1257 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl fs/ioctl.c:860 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 Allocated by task 19113: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:434 [inline] ____kasan_kmalloc+0xbc/0xfc mm/kasan/common.c:513 __kasan_kmalloc+0x10/0x1c mm/kasan/common.c:522 kasan_kmalloc include/linux/kasan.h:264 [inline] kmem_cache_alloc_trace+0x27c/0x47c mm/slub.c:3247 kmalloc include/linux/slab.h:591 [inline] nr_add_node+0x78c/0x1fc4 net/netrom/nr_route.c:146 nr_rt_ioctl+0xe58/0x18c8 net/netrom/nr_route.c:651 nr_ioctl+0x14c/0x4b0 net/netrom/af_netrom.c:1253 sock_do_ioctl+0x134/0x2dc net/socket.c:1140 sock_ioctl+0x4f0/0x8ac net/socket.c:1257 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl fs/ioctl.c:860 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 Freed by task 19121: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4c/0x84 mm/kasan/common.c:46 kasan_set_free_info+0x28/0x4c mm/kasan/generic.c:360 ____kasan_slab_free+0x118/0x164 mm/kasan/common.c:366 __kasan_slab_free+0x18/0x28 mm/kasan/common.c:374 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:1705 [inline] slab_free_freelist_hook+0x128/0x1ec mm/slub.c:1731 slab_free mm/slub.c:3499 [inline] kfree+0x178/0x410 mm/slub.c:4559 nr_neigh_put+0x154/0x1f4 include/net/netrom.h:142 nr_add_node+0x1290/0x1fc4 net/netrom/nr_route.c:246 nr_rt_ioctl+0xe58/0x18c8 net/netrom/nr_route.c:651 nr_ioctl+0x14c/0x4b0 net/netrom/af_netrom.c:1253 sock_do_ioctl+0x134/0x2dc net/socket.c:1140 sock_ioctl+0x4f0/0x8ac net/socket.c:1257 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl fs/ioctl.c:860 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 Last potentially related work creation: kasan_save_stack+0x38/0x68 mm/kasan/common.c:38 kasan_record_aux_stack+0xd4/0x11c mm/kasan/generic.c:348 kvfree_call_rcu+0xb8/0x684 kernel/rcu/tree.c:3596 __hw_addr_del_entry net/core/dev_addr_lists.c:145 [inline] __hw_addr_del_ex+0x418/0x510 net/core/dev_addr_lists.c:194 __dev_mc_del net/core/dev_addr_lists.c:873 [inline] dev_mc_del+0x8c/0x108 net/core/dev_addr_lists.c:891 igmp6_group_dropped+0x180/0xd64 net/ipv6/mcast.c:715 ipv6_mc_down+0xc8/0x588 net/ipv6/mcast.c:2719 addrconf_ifdown+0x1594/0x1814 net/ipv6/addrconf.c:3923 addrconf_notify+0x350/0xc58 notifier_call_chain kernel/notifier.c:83 [inline] raw_notifier_call_chain+0xd4/0x164 kernel/notifier.c:391 call_netdevice_notifiers_info net/core/dev.c:2018 [inline] call_netdevice_notifiers_extack net/core/dev.c:2030 [inline] call_netdevice_notifiers net/core/dev.c:2044 [inline] dev_close_many+0x2fc/0x468 net/core/dev.c:1619 unregister_netdevice_many+0x408/0x189c net/core/dev.c:11078 default_device_exit_batch+0x4c0/0x520 net/core/dev.c:11635 ops_exit_list net/core/net_namespace.c:177 [inline] cleanup_net+0x6bc/0xa9c net/core/net_namespace.c:618 process_one_work+0x790/0x11b8 kernel/workqueue.c:2310 worker_thread+0x910/0x1034 kernel/workqueue.c:2457 kthread+0x37c/0x45c kernel/kthread.c:334 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:870 Second to last potentially related work creation: kasan_save_stack+0x38/0x68 mm/kasan/common.c:38 kasan_record_aux_stack+0xd4/0x11c mm/kasan/generic.c:348 kvfree_call_rcu+0xb8/0x684 kernel/rcu/tree.c:3596 sctp_inetaddr_event+0x450/0x4d8 net/sctp/protocol.c:815 notifier_call_chain kernel/notifier.c:83 [inline] blocking_notifier_call_chain+0xf0/0x198 kernel/notifier.c:318 __inet_del_ifa+0x764/0xe50 net/ipv4/devinet.c:443 inet_del_ifa net/ipv4/devinet.c:480 [inline] inetdev_destroy net/ipv4/devinet.c:320 [inline] inetdev_event+0x444/0x1234 net/ipv4/devinet.c:1611 notifier_call_chain kernel/notifier.c:83 [inline] raw_notifier_call_chain+0xd4/0x164 kernel/notifier.c:391 call_netdevice_notifiers_info net/core/dev.c:2018 [inline] call_netdevice_notifiers_extack net/core/dev.c:2030 [inline] call_netdevice_notifiers net/core/dev.c:2044 [inline] unregister_netdevice_many+0xec4/0x189c net/core/dev.c:11102 unregister_netdevice_queue+0x2d0/0x31c net/core/dev.c:11035 unregister_netdevice include/linux/netdevice.h:3012 [inline] nsim_destroy+0x58/0x164 drivers/net/netdevsim/netdev.c:382 __nsim_dev_port_del+0x148/0x1a8 drivers/net/netdevsim/dev.c:1349 nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1362 [inline] nsim_dev_reload_destroy+0x13c/0x214 drivers/net/netdevsim/dev.c:1561 nsim_dev_remove+0x5c/0x108 drivers/net/netdevsim/dev.c:1577 nsim_bus_remove+0x20/0x30 drivers/net/netdevsim/bus.c:381 __device_release_driver drivers/base/dd.c:1227 [inline] device_release_driver_internal+0x428/0x6ac drivers/base/dd.c:1262 device_release_driver+0x28/0x38 drivers/base/dd.c:1285 bus_remove_device+0x298/0x38c drivers/base/bus.c:531 device_del+0x57c/0x9b4 drivers/base/core.c:3600 device_unregister+0x2c/0xcc drivers/base/core.c:3633 nsim_bus_dev_del drivers/net/netdevsim/bus.c:454 [inline] del_device_store+0x2a4/0x3bc drivers/net/netdevsim/bus.c:354 bus_attr_store+0x80/0xa4 drivers/base/bus.c:124 sysfs_kf_write+0x200/0x280 fs/sysfs/file.c:139 kernfs_fop_write_iter+0x334/0x48c fs/kernfs/file.c:296 call_write_iter include/linux/fs.h:2174 [inline] new_sync_write fs/read_write.c:507 [inline] vfs_write+0x884/0xb44 fs/read_write.c:594 ksys_write+0x15c/0x26c fs/read_write.c:647 __do_sys_write fs/read_write.c:659 [inline] __se_sys_write fs/read_write.c:656 [inline] __arm64_sys_write+0x7c/0x90 fs/read_write.c:656 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 The buggy address belongs to the object at ffff0000ce1a9700 which belongs to the cache kmalloc-128 of size 128 The buggy address is located 50 bytes inside of 128-byte region [ffff0000ce1a9700, ffff0000ce1a9780) The buggy address belongs to the page: page:00000000e5206c01 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10e1a9 flags: 0x5ffc00000000200(slab|node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000000200 fffffc00034bad00 0000000500000003 ffff0000c0002300 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000ce1a9600: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff0000ce1a9680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff0000ce1a9700: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff0000ce1a9780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff0000ce1a9800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== Unable to handle kernel paging request at virtual address 004b807c40000956 Mem abort info: ESR = 0x0000000096000004 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x04: level 0 translation fault Data abort info: ISV = 0, ISS = 0x00000004 CM = 0, WnR = 0 [004b807c40000956] address between user and kernel address ranges Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 19121 Comm: syz.2.6583 Tainted: G B 5.15.178-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 pstate: 00400005 (nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __hlist_del include/linux/list.h:856 [inline] pc : hlist_del_init include/linux/list.h:884 [inline] pc : __nr_remove_neigh net/netrom/nr_route.c:298 [inline] pc : nr_remove_neigh+0x6c/0xec net/netrom/nr_route.c:308 lr : __hlist_del include/linux/list.h:853 [inline] lr : hlist_del_init include/linux/list.h:884 [inline] lr : __nr_remove_neigh net/netrom/nr_route.c:298 [inline] lr : nr_remove_neigh+0x64/0xec net/netrom/nr_route.c:308 sp : ffff8000204676d0 x29: ffff8000204676d0 x28: ffff0000c0c75800 x27: 000000000000ffff x26: 0000000000000000 x25: 1fffe0001986cb83 x24: ffff0000cc365c1f x23: dfff800000000000 x22: dfff800000000000 x21: 0000000000000000 x20: ea6003e200004ab1 x19: ffff0000ce1a9700 x18: 0000000000000203 x17: 0000000000000000 x16: ffff8000088d55d4 x15: 00000000ffffffff x14: ffff0000cee80000 x13: 0000000000000001 x12: ffff70000408cebc x11: 1ffff0000408cebc x10: 0000000000000004 x9 : ffff80001b8473d0 x8 : 1d4c007c40000956 x7 : 0000000000000000 x6 : ffff800010da2108 x5 : 0000000000000000 x4 : 0000000000000001 x3 : ffff800010da213c x2 : 0000000000000000 x1 : 0000000000000008 x0 : 0000000000000000 Call trace: __hlist_del include/linux/list.h:853 [inline] hlist_del_init include/linux/list.h:884 [inline] __nr_remove_neigh net/netrom/nr_route.c:298 [inline] nr_remove_neigh+0x6c/0xec net/netrom/nr_route.c:308 nr_add_node+0x17e4/0x1fc4 net/netrom/nr_route.c:249 nr_rt_ioctl+0xe58/0x18c8 net/netrom/nr_route.c:651 nr_ioctl+0x14c/0x4b0 net/netrom/af_netrom.c:1253 sock_do_ioctl+0x134/0x2dc net/socket.c:1140 sock_ioctl+0x4f0/0x8ac net/socket.c:1257 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl fs/ioctl.c:860 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 Code: aa1303e0 97c5cda2 d343fe88 f9400275 (38766908) ---[ end trace dedbd5c3688669cd ]--- ---------------- Code disassembly (best guess): 0: aa1303e0 mov x0, x19 4: 97c5cda2 bl 0xffffffffff17368c 8: d343fe88 lsr x8, x20, #3 c: f9400275 ldr x21, [x19] * 10: 38766908 ldrb w8, [x8, x22] <-- trapping instruction