KASAN: use-after-free Read in route4_get (2)
6 views
Skip to first unread message
syzbot
Sep 12, 2021, 1:58:24 PM9/12/21
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: b172b44fcb17 Linux 4.19.206
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=13be4b1b300000
kernel config: https://syzkaller.appspot.com/x/.config?x=b9ba3521ce0be3cd
dashboard link: https://syzkaller.appspot.com/bug?extid=83fbd7715d9c3cbc9ef6
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1346583b300000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+83fbd7...@syzkaller.appspotmail.com
IPv6: ADDRCONF(NETDEV_UP): wlan1: link is not ready
wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
==================================================================
BUG: KASAN: use-after-free in route4_get+0x3e1/0x420 net/sched/cls_route.c:239
Read of size 4 at addr ffff88809969b140 by task syz-executor.1/9921
CPU: 1 PID: 9921 Comm: syz-executor.1 Not tainted 4.19.206-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
print_address_description.cold+0x54/0x219 mm/kasan/report.c:256
kasan_report_error.cold+0x8a/0x1b9 mm/kasan/report.c:354
kasan_report mm/kasan/report.c:412 [inline]
__asan_report_load4_noabort+0x88/0x90 mm/kasan/report.c:432
route4_get+0x3e1/0x420 net/sched/cls_route.c:239
tc_new_tfilter+0x535/0x16c0 net/sched/cls_api.c:1300
rtnetlink_rcv_msg+0x453/0xb80 net/core/rtnetlink.c:4782
netlink_rcv_skb+0x160/0x440 net/netlink/af_netlink.c:2457
netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
netlink_unicast+0x4d5/0x690 net/netlink/af_netlink.c:1346
netlink_sendmsg+0x6bb/0xc40 net/netlink/af_netlink.c:1911
sock_sendmsg_nosec net/socket.c:651 [inline]
sock_sendmsg+0xc3/0x120 net/socket.c:661
___sys_sendmsg+0x7bb/0x8e0 net/socket.c:2227
__sys_sendmsg net/socket.c:2265 [inline]
__do_sys_sendmsg net/socket.c:2274 [inline]
__se_sys_sendmsg net/socket.c:2272 [inline]
__x64_sys_sendmsg+0x132/0x220 net/socket.c:2272
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x4665f9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f17b8844188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665f9
RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000003
RBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf80
R13: 00007ffde46cfd0f R14: 00007f17b8844300 R15: 0000000000022000
Allocated by task 9921:
kmem_cache_alloc_trace+0x12f/0x380 mm/slab.c:3625
kmalloc include/linux/slab.h:515 [inline]
kzalloc include/linux/slab.h:709 [inline]
route4_change+0x2a5/0x22a0 net/sched/cls_route.c:495
tc_new_tfilter+0xb52/0x16c0 net/sched/cls_api.c:1320
rtnetlink_rcv_msg+0x453/0xb80 net/core/rtnetlink.c:4782
netlink_rcv_skb+0x160/0x440 net/netlink/af_netlink.c:2457
netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
netlink_unicast+0x4d5/0x690 net/netlink/af_netlink.c:1346
netlink_sendmsg+0x6bb/0xc40 net/netlink/af_netlink.c:1911
sock_sendmsg_nosec net/socket.c:651 [inline]
sock_sendmsg+0xc3/0x120 net/socket.c:661
___sys_sendmsg+0x7bb/0x8e0 net/socket.c:2227
__sys_sendmsg net/socket.c:2265 [inline]
__do_sys_sendmsg net/socket.c:2274 [inline]
__se_sys_sendmsg net/socket.c:2272 [inline]
__x64_sys_sendmsg+0x132/0x220 net/socket.c:2272
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 8753:
__cache_free mm/slab.c:3503 [inline]
kfree+0xcc/0x210 mm/slab.c:3822
route4_delete_filter_work+0x17/0x20 net/sched/cls_route.c:270
process_one_work+0x864/0x1570 kernel/workqueue.c:2153
worker_thread+0x64c/0x1130 kernel/workqueue.c:2296
kthread+0x33f/0x460 kernel/kthread.c:259
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
The buggy address belongs to the object at ffff88809969b100
which belongs to the cache kmalloc-192 of size 192
The buggy address is located 64 bytes inside of
192-byte region [ffff88809969b100, ffff88809969b1c0)
The buggy address belongs to the page:
page:ffffea000265a6c0 count:1 mapcount:0 mapping:ffff88813bff0040 index:0x0
flags: 0xfff00000000100(slab)
raw: 00fff00000000100 ffffea0002d38b48 ffffea00025b6f88 ffff88813bff0040
raw: 0000000000000000 ffff88809969b000 0000000100000010 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88809969b000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88809969b080: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
>ffff88809969b100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88809969b180: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff88809969b200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
syzbot found the following issue on:
HEAD commit: b172b44fcb17 Linux 4.19.206
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=13be4b1b300000
kernel config: https://syzkaller.appspot.com/x/.config?x=b9ba3521ce0be3cd
dashboard link: https://syzkaller.appspot.com/bug?extid=83fbd7715d9c3cbc9ef6
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=1346583b300000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+83fbd7...@syzkaller.appspotmail.com
IPv6: ADDRCONF(NETDEV_UP): wlan1: link is not ready
wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
==================================================================
BUG: KASAN: use-after-free in route4_get+0x3e1/0x420 net/sched/cls_route.c:239
Read of size 4 at addr ffff88809969b140 by task syz-executor.1/9921
CPU: 1 PID: 9921 Comm: syz-executor.1 Not tainted 4.19.206-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
print_address_description.cold+0x54/0x219 mm/kasan/report.c:256
kasan_report_error.cold+0x8a/0x1b9 mm/kasan/report.c:354
kasan_report mm/kasan/report.c:412 [inline]
__asan_report_load4_noabort+0x88/0x90 mm/kasan/report.c:432
route4_get+0x3e1/0x420 net/sched/cls_route.c:239
tc_new_tfilter+0x535/0x16c0 net/sched/cls_api.c:1300
rtnetlink_rcv_msg+0x453/0xb80 net/core/rtnetlink.c:4782
netlink_rcv_skb+0x160/0x440 net/netlink/af_netlink.c:2457
netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
netlink_unicast+0x4d5/0x690 net/netlink/af_netlink.c:1346
netlink_sendmsg+0x6bb/0xc40 net/netlink/af_netlink.c:1911
sock_sendmsg_nosec net/socket.c:651 [inline]
sock_sendmsg+0xc3/0x120 net/socket.c:661
___sys_sendmsg+0x7bb/0x8e0 net/socket.c:2227
__sys_sendmsg net/socket.c:2265 [inline]
__do_sys_sendmsg net/socket.c:2274 [inline]
__se_sys_sendmsg net/socket.c:2272 [inline]
__x64_sys_sendmsg+0x132/0x220 net/socket.c:2272
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x4665f9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f17b8844188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665f9
RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000003
RBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf80
R13: 00007ffde46cfd0f R14: 00007f17b8844300 R15: 0000000000022000
Allocated by task 9921:
kmem_cache_alloc_trace+0x12f/0x380 mm/slab.c:3625
kmalloc include/linux/slab.h:515 [inline]
kzalloc include/linux/slab.h:709 [inline]
route4_change+0x2a5/0x22a0 net/sched/cls_route.c:495
tc_new_tfilter+0xb52/0x16c0 net/sched/cls_api.c:1320
rtnetlink_rcv_msg+0x453/0xb80 net/core/rtnetlink.c:4782
netlink_rcv_skb+0x160/0x440 net/netlink/af_netlink.c:2457
netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
netlink_unicast+0x4d5/0x690 net/netlink/af_netlink.c:1346
netlink_sendmsg+0x6bb/0xc40 net/netlink/af_netlink.c:1911
sock_sendmsg_nosec net/socket.c:651 [inline]
sock_sendmsg+0xc3/0x120 net/socket.c:661
___sys_sendmsg+0x7bb/0x8e0 net/socket.c:2227
__sys_sendmsg net/socket.c:2265 [inline]
__do_sys_sendmsg net/socket.c:2274 [inline]
__se_sys_sendmsg net/socket.c:2272 [inline]
__x64_sys_sendmsg+0x132/0x220 net/socket.c:2272
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 8753:
__cache_free mm/slab.c:3503 [inline]
kfree+0xcc/0x210 mm/slab.c:3822
route4_delete_filter_work+0x17/0x20 net/sched/cls_route.c:270
process_one_work+0x864/0x1570 kernel/workqueue.c:2153
worker_thread+0x64c/0x1130 kernel/workqueue.c:2296
kthread+0x33f/0x460 kernel/kthread.c:259
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
The buggy address belongs to the object at ffff88809969b100
which belongs to the cache kmalloc-192 of size 192
The buggy address is located 64 bytes inside of
192-byte region [ffff88809969b100, ffff88809969b1c0)
The buggy address belongs to the page:
page:ffffea000265a6c0 count:1 mapcount:0 mapping:ffff88813bff0040 index:0x0
flags: 0xfff00000000100(slab)
raw: 00fff00000000100 ffffea0002d38b48 ffffea00025b6f88 ffff88813bff0040
raw: 0000000000000000 ffff88809969b000 0000000100000010 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88809969b000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff88809969b080: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
>ffff88809969b100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88809969b180: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff88809969b200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this issue, for details see:
https://goo.gl/tpsmEJ#testing-patches
syzbot
Sep 13, 2021, 2:10:23 AM9/13/21
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: b172b44fcb17 Linux 4.19.206
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=144735c7300000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1193742d300000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+83fbd7...@syzkaller.appspotmail.com
IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
CPU: 1 PID: 9517 Comm: syz-executor497 Not tainted 4.19.206-syzkaller #0
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 a1 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f924dcaa318 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00000000004cf508 RCX: 0000000000449799
RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000004
RBP: 00000000004cf500 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000003 R11: 0000000000000246 R12: 000000000049e49c
R13: 00007ffcb51bdfdf R14: 00007f924dcaa400 R15: 0000000000022000
Allocated by task 9517:
flags: 0xfff00000000100(slab)
raw: 00fff00000000100 ffffea00023dd9c8 ffffea00027bfe88 ffff88813bff0040
raw: 0000000000000000 ffff88809f730000 0000000100000010 0000000000000000
ffff88809f730d80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff88809f730e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88809f730e80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff88809f730f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
HEAD commit: b172b44fcb17 Linux 4.19.206
git tree: linux-4.19.y
kernel config: https://syzkaller.appspot.com/x/.config?x=b9ba3521ce0be3cd
dashboard link: https://syzkaller.appspot.com/bug?extid=83fbd7715d9c3cbc9ef6
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=10661c65300000
dashboard link: https://syzkaller.appspot.com/bug?extid=83fbd7715d9c3cbc9ef6
compiler: gcc version 10.2.1 20210110 (Debian 10.2.1-6)
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1193742d300000
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+83fbd7...@syzkaller.appspotmail.com
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready
==================================================================
BUG: KASAN: use-after-free in route4_get+0x3e1/0x420 net/sched/cls_route.c:239
Read of size 4 at addr ffff88809f730e40 by task syz-executor497/9517
BUG: KASAN: use-after-free in route4_get+0x3e1/0x420 net/sched/cls_route.c:239
CPU: 1 PID: 9517 Comm: syz-executor497 Not tainted 4.19.206-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
print_address_description.cold+0x54/0x219 mm/kasan/report.c:256
kasan_report_error.cold+0x8a/0x1b9 mm/kasan/report.c:354
kasan_report mm/kasan/report.c:412 [inline]
__asan_report_load4_noabort+0x88/0x90 mm/kasan/report.c:432
route4_get+0x3e1/0x420 net/sched/cls_route.c:239
tc_new_tfilter+0x535/0x16c0 net/sched/cls_api.c:1300
rtnetlink_rcv_msg+0x453/0xb80 net/core/rtnetlink.c:4782
netlink_rcv_skb+0x160/0x440 net/netlink/af_netlink.c:2457
netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
netlink_unicast+0x4d5/0x690 net/netlink/af_netlink.c:1346
netlink_sendmsg+0x6bb/0xc40 net/netlink/af_netlink.c:1911
sock_sendmsg_nosec net/socket.c:651 [inline]
sock_sendmsg+0xc3/0x120 net/socket.c:661
___sys_sendmsg+0x7bb/0x8e0 net/socket.c:2227
__sys_sendmsg net/socket.c:2265 [inline]
__do_sys_sendmsg net/socket.c:2274 [inline]
__se_sys_sendmsg net/socket.c:2272 [inline]
__x64_sys_sendmsg+0x132/0x220 net/socket.c:2272
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x449799
Call Trace:
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
print_address_description.cold+0x54/0x219 mm/kasan/report.c:256
kasan_report_error.cold+0x8a/0x1b9 mm/kasan/report.c:354
kasan_report mm/kasan/report.c:412 [inline]
__asan_report_load4_noabort+0x88/0x90 mm/kasan/report.c:432
route4_get+0x3e1/0x420 net/sched/cls_route.c:239
tc_new_tfilter+0x535/0x16c0 net/sched/cls_api.c:1300
rtnetlink_rcv_msg+0x453/0xb80 net/core/rtnetlink.c:4782
netlink_rcv_skb+0x160/0x440 net/netlink/af_netlink.c:2457
netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
netlink_unicast+0x4d5/0x690 net/netlink/af_netlink.c:1346
netlink_sendmsg+0x6bb/0xc40 net/netlink/af_netlink.c:1911
sock_sendmsg_nosec net/socket.c:651 [inline]
sock_sendmsg+0xc3/0x120 net/socket.c:661
___sys_sendmsg+0x7bb/0x8e0 net/socket.c:2227
__sys_sendmsg net/socket.c:2265 [inline]
__do_sys_sendmsg net/socket.c:2274 [inline]
__se_sys_sendmsg net/socket.c:2272 [inline]
__x64_sys_sendmsg+0x132/0x220 net/socket.c:2272
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 a1 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f924dcaa318 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00000000004cf508 RCX: 0000000000449799
RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000004
RBP: 00000000004cf500 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000003 R11: 0000000000000246 R12: 000000000049e49c
R13: 00007ffcb51bdfdf R14: 00007f924dcaa400 R15: 0000000000022000
Allocated by task 9517:
kmem_cache_alloc_trace+0x12f/0x380 mm/slab.c:3625
kmalloc include/linux/slab.h:515 [inline]
kzalloc include/linux/slab.h:709 [inline]
route4_change+0x2a5/0x22a0 net/sched/cls_route.c:495
tc_new_tfilter+0xb52/0x16c0 net/sched/cls_api.c:1320
rtnetlink_rcv_msg+0x453/0xb80 net/core/rtnetlink.c:4782
netlink_rcv_skb+0x160/0x440 net/netlink/af_netlink.c:2457
netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
netlink_unicast+0x4d5/0x690 net/netlink/af_netlink.c:1346
netlink_sendmsg+0x6bb/0xc40 net/netlink/af_netlink.c:1911
sock_sendmsg_nosec net/socket.c:651 [inline]
sock_sendmsg+0xc3/0x120 net/socket.c:661
___sys_sendmsg+0x7bb/0x8e0 net/socket.c:2227
__sys_sendmsg net/socket.c:2265 [inline]
__do_sys_sendmsg net/socket.c:2274 [inline]
__se_sys_sendmsg net/socket.c:2272 [inline]
__x64_sys_sendmsg+0x132/0x220 net/socket.c:2272
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 2888:
kmalloc include/linux/slab.h:515 [inline]
kzalloc include/linux/slab.h:709 [inline]
route4_change+0x2a5/0x22a0 net/sched/cls_route.c:495
tc_new_tfilter+0xb52/0x16c0 net/sched/cls_api.c:1320
rtnetlink_rcv_msg+0x453/0xb80 net/core/rtnetlink.c:4782
netlink_rcv_skb+0x160/0x440 net/netlink/af_netlink.c:2457
netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
netlink_unicast+0x4d5/0x690 net/netlink/af_netlink.c:1346
netlink_sendmsg+0x6bb/0xc40 net/netlink/af_netlink.c:1911
sock_sendmsg_nosec net/socket.c:651 [inline]
sock_sendmsg+0xc3/0x120 net/socket.c:661
___sys_sendmsg+0x7bb/0x8e0 net/socket.c:2227
__sys_sendmsg net/socket.c:2265 [inline]
__do_sys_sendmsg net/socket.c:2274 [inline]
__se_sys_sendmsg net/socket.c:2272 [inline]
__x64_sys_sendmsg+0x132/0x220 net/socket.c:2272
do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
entry_SYSCALL_64_after_hwframe+0x49/0xbe
__cache_free mm/slab.c:3503 [inline]
kfree+0xcc/0x210 mm/slab.c:3822
route4_delete_filter_work+0x17/0x20 net/sched/cls_route.c:270
process_one_work+0x864/0x1570 kernel/workqueue.c:2153
worker_thread+0x64c/0x1130 kernel/workqueue.c:2296
kthread+0x33f/0x460 kernel/kthread.c:259
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
The buggy address belongs to the object at ffff88809f730e00
kfree+0xcc/0x210 mm/slab.c:3822
route4_delete_filter_work+0x17/0x20 net/sched/cls_route.c:270
process_one_work+0x864/0x1570 kernel/workqueue.c:2153
worker_thread+0x64c/0x1130 kernel/workqueue.c:2296
kthread+0x33f/0x460 kernel/kthread.c:259
ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415
which belongs to the cache kmalloc-192 of size 192
The buggy address is located 64 bytes inside of
192-byte region [ffff88809f730e00, ffff88809f730ec0)
The buggy address is located 64 bytes inside of
The buggy address belongs to the page:
page:ffffea00027dcc00 count:1 mapcount:0 mapping:ffff88813bff0040 index:0x0
flags: 0xfff00000000100(slab)
raw: 00fff00000000100 ffffea00023dd9c8 ffffea00027bfe88 ffff88813bff0040
raw: 0000000000000000 ffff88809f730000 0000000100000010 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff88809f730d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
Memory state around the buggy address:
ffff88809f730d80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff88809f730e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff88809f730e80: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff88809f730f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
Reply all
Reply to author
Forward
0 new messages