==================================================================
BUG: KASAN: slab-use-after-free in sk_fullsock include/net/sock.h:2823 [inline]
BUG: KASAN: slab-use-after-free in ip_skb_dst_mtu+0x820/0x9a0 include/net/ip.h:499
Read of size 1 at addr ffff8880760be012 by task syz-executor.0/5357
CPU: 0 PID: 5357 Comm: syz-executor.0 Not tainted 6.8.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/25/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x1e7/0x2d0 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:377 [inline]
print_report+0x163/0x540 mm/kasan/report.c:488
kasan_report+0x142/0x170 mm/kasan/report.c:601
sk_fullsock include/net/sock.h:2823 [inline]
ip_skb_dst_mtu+0x820/0x9a0 include/net/ip.h:499
__ip_finish_output+0x133/0x4b0 net/ipv4/ip_output.c:306
ipvlan_process_v4_outbound+0x3ef/0x700 drivers/net/ipvlan/ipvlan_core.c:442
ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:540 [inline]
ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline]
ipvlan_queue_xmit+0xa64/0x1170 drivers/net/ipvlan/ipvlan_core.c:668
ipvlan_start_xmit+0x4a/0x150 drivers/net/ipvlan/ipvlan_main.c:222
__netdev_start_xmit include/linux/netdevice.h:4989 [inline]
netdev_start_xmit include/linux/netdevice.h:5003 [inline]
xmit_one net/core/dev.c:3547 [inline]
dev_hard_start_xmit+0x23e/0x750 net/core/dev.c:3563
sch_direct_xmit+0x2b6/0x5f0 net/sched/sch_generic.c:342
qdisc_restart net/sched/sch_generic.c:407 [inline]
__qdisc_run+0xae1/0x1eb0 net/sched/sch_generic.c:415
qdisc_run+0xda/0x260 include/net/pkt_sched.h:125
net_tx_action+0x86f/0xa20 net/core/dev.c:5197
__do_softirq+0x2bf/0x93a kernel/softirq.c:553
invoke_softirq kernel/softirq.c:427 [inline]
__irq_exit_rcu+0xf1/0x1b0 kernel/softirq.c:632
irq_exit_rcu+0x9/0x20 kernel/softirq.c:644
sysvec_apic_timer_interrupt+0x95/0xb0 arch/x86/kernel/apic/apic.c:1076
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xd8/0x140 kernel/locking/spinlock.c:194
Code: 9c 8f 44 24 20 42 80 3c 23 00 74 08 4c 89 f7 e8 be 1c fc f6 f6 44 24 21 02 75 4e 41 f7 c7 00 02 00 00 74 01 fb bf 01 00 00 00 d3 49 71 f6 65 8b 05 04 f4 14 75 85 c0 74 3f 48 c7 04 24 0e 36
RSP: 0018:ffffc90004d27be0 EFLAGS: 00000206
RAX: fea5525bf8b65a00 RBX: 1ffff920009a4f80 RCX: ffffffff92127203
RDX: dffffc0000000000 RSI: ffffffff8b2a8140 RDI: 0000000000000001
RBP: ffffc90004d27c78 R08: ffffffff8ebc14ef R09: 1ffffffff1d7829d
R10: dffffc0000000000 R11: fffffbfff1d7829e R12: dffffc0000000000
R13: 1ffff920009a4f7c R14: ffffc90004d27c00 R15: 0000000000000246
debug_timer_init kernel/time/timer.c:774 [inline]
debug_init kernel/time/timer.c:822 [inline]
init_timer_key+0x38/0x2e0 kernel/time/timer.c:866
inet_csk_init_xmit_timers+0x85/0xf0 net/ipv4/inet_connection_sock.c:757
tcp_init_xmit_timers+0x36/0xb0 net/ipv4/tcp_timer.c:857
tcp_init_sock+0x70/0x850 net/ipv4/tcp.c:419
tcp_v4_init_sock+0x21/0x70 net/ipv4/tcp_ipv4.c:2472
inet_create+0xb90/0xe70 net/ipv4/af_inet.c:385
__sock_create+0x48c/0x910 net/socket.c:1571
sock_create net/socket.c:1622 [inline]
__sys_socket_create net/socket.c:1659 [inline]
__sys_socket+0x14f/0x3b0 net/socket.c:1706
__do_sys_socket net/socket.c:1720 [inline]
__se_sys_socket net/socket.c:1718 [inline]
__x64_sys_socket+0x7a/0x90 net/socket.c:1718
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x85/0x160 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
RIP: 0033:0x7f615fe7fb27
Code: f0 ff ff 77 06 c3 0f 1f 44 00 00 48 c7 c2 b0 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 b8 29 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc469b90d8 EFLAGS: 00000202 ORIG_RAX: 0000000000000029
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f615fe7fb27
RDX: 0000000000000006 RSI: 0000000000000001 RDI: 0000000000000002
RBP: 00007ffc469b97ec R08: 00007ffc469b90cc R09: 00007ffc469b94d7
R10: 00007ffc469b9150 R11: 0000000000000202 R12: 0000000000000032
R13: 000000000001525d R14: 000000000001522c R15: 000000000000000b
Allocated by task 5540:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x70 mm/kasan/common.c:68
poison_kmalloc_redzone mm/kasan/common.c:372 [inline]
__kasan_kmalloc+0x7d/0x90 mm/kasan/common.c:389
kasan_kmalloc include/linux/kasan.h:211 [inline]
__do_kmalloc_node mm/slub.c:3981 [inline]
__kmalloc+0x224/0x500 mm/slub.c:3994
kmalloc include/linux/slab.h:594 [inline]
sk_prot_alloc+0xe0/0x210 net/core/sock.c:2078
sk_alloc+0x39/0x310 net/core/sock.c:2131
packet_create+0x104/0x790 net/packet/af_packet.c:3352
__sock_create+0x48c/0x910 net/socket.c:1571
sock_create net/socket.c:1622 [inline]
__sys_socket_create net/socket.c:1659 [inline]
__sys_socket+0x14f/0x3b0 net/socket.c:1706
__do_sys_socket net/socket.c:1720 [inline]
__se_sys_socket net/socket.c:1718 [inline]
__x64_sys_socket+0x7a/0x90 net/socket.c:1718
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x85/0x160 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
Freed by task 5357:
kasan_save_stack mm/kasan/common.c:47 [inline]
kasan_save_track+0x3f/0x70 mm/kasan/common.c:68
kasan_save_free_info+0x4e/0x60 mm/kasan/generic.c:643
poison_slab_object+0xa6/0xe0 mm/kasan/common.c:241
__kasan_slab_free+0x13/0x40 mm/kasan/common.c:257
kasan_slab_free include/linux/kasan.h:184 [inline]
slab_free_hook mm/slub.c:2121 [inline]
slab_free mm/slub.c:4299 [inline]
kfree+0x12b/0x340 mm/slub.c:4409
sk_prot_free net/core/sock.c:2114 [inline]
__sk_destruct+0x45c/0x5c0 net/core/sock.c:2206
skb_orphan include/linux/skbuff.h:3127 [inline]
ip_defrag+0x205/0x25c0 net/ipv4/ip_fragment.c:490
nf_ct_ipv4_gather_frags net/ipv4/netfilter/nf_defrag_ipv4.c:32 [inline]
ipv4_conntrack_defrag+0x3de/0x590 net/ipv4/netfilter/nf_defrag_ipv4.c:87
nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]
nf_hook_slow+0xbf/0x210 net/netfilter/core.c:626
nf_hook+0x2c4/0x450 include/linux/netfilter.h:269
__ip_local_out+0x3ca/0x4d0 net/ipv4/ip_output.c:118
ip_local_out+0x2a/0x130 net/ipv4/ip_output.c:127
ipvlan_process_v4_outbound+0x3ef/0x700 drivers/net/ipvlan/ipvlan_core.c:442
ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:540 [inline]
ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:602 [inline]
ipvlan_queue_xmit+0xa64/0x1170 drivers/net/ipvlan/ipvlan_core.c:668
ipvlan_start_xmit+0x4a/0x150 drivers/net/ipvlan/ipvlan_main.c:222
__netdev_start_xmit include/linux/netdevice.h:4989 [inline]
netdev_start_xmit include/linux/netdevice.h:5003 [inline]
xmit_one net/core/dev.c:3547 [inline]
dev_hard_start_xmit+0x23e/0x750 net/core/dev.c:3563
sch_direct_xmit+0x2b6/0x5f0 net/sched/sch_generic.c:342
qdisc_restart net/sched/sch_generic.c:407 [inline]
__qdisc_run+0xae1/0x1eb0 net/sched/sch_generic.c:415
qdisc_run+0xda/0x260 include/net/pkt_sched.h:125
net_tx_action+0x86f/0xa20 net/core/dev.c:5197
__do_softirq+0x2bf/0x93a kernel/softirq.c:553
The buggy address belongs to the object at ffff8880760be000
which belongs to the cache kmalloc-4k of size 4096
The buggy address is located 18 bytes inside of
freed 4096-byte region [ffff8880760be000, ffff8880760bf000)
The buggy address belongs to the physical page:
page:ffffea0001d82e00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x760b8
head:ffffea0001d82e00 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000840 ffff888012842140 dead000000000100 dead000000000122
raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd2040(__GFP_IO|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4459, tgid 4459 (udevadm), ts 21156280721, free_ts 18960881125
prep_new_page mm/page_alloc.c:1540 [inline]
get_page_from_freelist+0x339a/0x3530 mm/page_alloc.c:3311
__alloc_pages+0x255/0x670 mm/page_alloc.c:4567
__alloc_pages_node include/linux/gfp.h:238 [inline]
alloc_pages_node include/linux/gfp.h:261 [inline]
alloc_slab_page+0x5f/0x150 mm/slub.c:2190
allocate_slab mm/slub.c:2354 [inline]
new_slab+0x84/0x2f0 mm/slub.c:2407
___slab_alloc+0xcf5/0x13b0 mm/slub.c:3540
__slab_alloc mm/slub.c:3625 [inline]
__slab_alloc_node mm/slub.c:3678 [inline]
slab_alloc_node mm/slub.c:3850 [inline]
__do_kmalloc_node mm/slub.c:3980 [inline]
__kmalloc+0x2ef/0x500 mm/slub.c:3994
kmalloc include/linux/slab.h:594 [inline]
tomoyo_realpath_from_path+0xcf/0x5e0 security/tomoyo/realpath.c:251
tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
tomoyo_path_perm+0x2b7/0x730 security/tomoyo/file.c:822
security_inode_getattr+0xd3/0x120 security/security.c:2238
vfs_getattr+0x46/0x430 fs/stat.c:173
vfs_statx+0x1a5/0x4e0 fs/stat.c:248
vfs_fstatat+0x135/0x190 fs/stat.c:304
__do_sys_newfstatat fs/stat.c:468 [inline]
__se_sys_newfstatat fs/stat.c:462 [inline]
__x64_sys_newfstatat+0x117/0x190 fs/stat.c:462
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0x85/0x160 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x63/0x6b
page last free pid 1 tgid 1 stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1140 [inline]
free_unref_page_prepare+0x94d/0xa60 mm/page_alloc.c:2346
free_unref_page+0x37/0x3f0 mm/page_alloc.c:2486
free_contig_range+0x9e/0x150 mm/page_alloc.c:6535
destroy_args+0x8a/0x880 mm/debug_vm_pgtable.c:1028
debug_vm_pgtable+0x4ba/0x540 mm/debug_vm_pgtable.c:1408
do_one_initcall+0x234/0x800 init/main.c:1236
do_initcall_level+0x157/0x210 init/main.c:1298
do_initcalls+0x3f/0x80 init/main.c:1314
kernel_init_freeable+0x429/0x5c0 init/main.c:1551
kernel_init+0x1d/0x2a0 init/main.c:1441
ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:147
ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:242
Memory state around the buggy address:
ffff8880760bdf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff8880760bdf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8880760be000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8880760be080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8880760be100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess):
0: 9c pushf
1: 8f 44 24 20 pop 0x20(%rsp)
5: 42 80 3c 23 00 cmpb $0x0,(%rbx,%r12,1)
a: 74 08 je 0x14
c: 4c 89 f7 mov %r14,%rdi
f: e8 be 1c fc f6 call 0xf6fc1cd2
14: f6 44 24 21 02 testb $0x2,0x21(%rsp)
19: 75 4e jne 0x69
1b: 41 f7 c7 00 02 00 00 test $0x200,%r15d
22: 74 01 je 0x25
24: fb sti
25: bf 01 00 00 00 mov $0x1,%edi
* 2a: e8 d3 49 71 f6 call 0xf6714a02 <-- trapping instruction
2f: 65 8b 05 04 f4 14 75 mov %gs:0x7514f404(%rip),%eax # 0x7514f43a
36: 85 c0 test %eax,%eax
38: 74 3f je 0x79
3a: 48 rex.W
3b: c7 .byte 0xc7
3c: 04 24 add $0x24,%al
3e: 0e (bad)
3f: 36 ss