====================================== | [ 58.918427][ T638] ================================================================== | [ 58.918757][ T638] BUG: KASAN: slab-use-after-free in kobject_put (lib/kobject.c:733) | [ 58.919043][ T638] Read of size 1 at addr ffff8880089f46ac by task ip/638 | [ 58.919263][ T638] [ 58.919362][ T638] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 58.919368][ T638] Call Trace: [ 58.919370][ T638] [ 58.919372][ T638] dump_stack_lvl (lib/dump_stack.c:123) [ 58.919378][ T638] print_address_description.constprop.0 (mm/kasan/report.c:379) [ 58.919389][ T638] ? kobject_put (lib/kobject.c:733) [ 58.919393][ T638] print_report (mm/kasan/report.c:483) [ 58.919396][ T638] ? kobject_put (lib/kobject.c:733) [ 58.919399][ T638] ? kasan_addr_to_slab (./include/linux/mm.h:1245 mm/kasan/../slab.h:191 mm/kasan/common.c:47) [ 58.919403][ T638] ? kobject_put (lib/kobject.c:733) [ 58.919406][ T638] kasan_report (mm/kasan/report.c:597) [ 58.919410][ T638] ? kobject_put (lib/kobject.c:733) [ 58.919415][ T638] kobject_put (lib/kobject.c:733) [ 58.919419][ T638] netdev_run_todo (./include/linux/list.h:381 net/core/dev.c:11670) [ 58.919425][ T638] ? dev_ingress_queue_create (net/core/dev.c:12299) [ 58.919428][ T638] ? generic_xdp_install (net/core/dev.c:11630) [ 58.919431][ T638] ? unregister_netdevice_many (net/core/dev.c:12241) [ 58.919435][ T638] ? net_generic (./include/net/netns/generic.h:51) ip6_gre [ 58.919443][ T638] rtnl_dellink (net/core/rtnetlink.c:3580) [ 58.919449][ T638] ? valid_bridge_getlink_req.constprop.0 (net/core/rtnetlink.c:3536) [ 58.919468][ T638] ? find_held_lock (kernel/locking/lockdep.c:5350) [ 58.919476][ T638] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 58.919482][ T638] ? find_held_lock (kernel/locking/lockdep.c:5350) [ 58.919486][ T638] ? rtnetlink_rcv_msg (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 net/core/rtnetlink.c:6956) [ 58.919488][ T638] ? __lock_release (kernel/locking/lockdep.c:5536) [ 58.919493][ T638] ? valid_bridge_getlink_req.constprop.0 (net/core/rtnetlink.c:3536) [ 58.919497][ T638] rtnetlink_rcv_msg (net/core/rtnetlink.c:6958) [ 58.919501][ T638] ? rtnl_port_fill (net/core/rtnetlink.c:6861) [ 58.919504][ T638] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 58.919511][ T638] netlink_rcv_skb (net/netlink/af_netlink.c:2550) [ 58.919516][ T638] ? rtnl_port_fill (net/core/rtnetlink.c:6861) [ 58.919519][ T638] ? netlink_ack (net/netlink/af_netlink.c:2527) [ 58.919526][ T638] ? netlink_deliver_tap (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 net/netlink/af_netlink.c:340) [ 58.919529][ T638] ? netlink_deliver_tap (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 ./include/net/netns/generic.h:48 net/netlink/af_netlink.c:333) [ 58.919533][ T638] netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344) [ 58.919537][ T638] ? netlink_attachskb (net/netlink/af_netlink.c:1329) [ 58.919540][ T638] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 58.919546][ T638] netlink_sendmsg (net/netlink/af_netlink.c:1894) [ 58.919552][ T638] ? netlink_unicast (net/netlink/af_netlink.c:1813) [ 58.919556][ T638] ? __import_iovec (lib/iov_iter.c:1346 lib/iov_iter.c:1361) [ 58.919563][ T638] ? netlink_unicast (net/netlink/af_netlink.c:1813) [ 58.919567][ T638] ____sys_sendmsg (net/socket.c:727 net/socket.c:742 net/socket.c:2630) [ 58.919573][ T638] ? get_timestamp.constprop.0 (net/socket.c:2576) [ 58.919576][ T638] ? __copy_msghdr (net/socket.c:2556) [ 58.919583][ T638] ___sys_sendmsg (net/socket.c:2686) [ 58.919586][ T638] ? kasan_record_aux_stack (mm/kasan/generic.c:559) [ 58.919589][ T638] ? __call_rcu_common.constprop.0 (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:109 ./arch/x86/include/asm/irqflags.h:127 kernel/rcu/tree.c:3125) [ 58.919596][ T638] ? copy_msghdr_from_user (net/socket.c:2673) [ 58.919601][ T638] ? find_held_lock (kernel/locking/lockdep.c:5350) [ 58.919605][ T638] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 58.919612][ T638] ? find_held_lock (kernel/locking/lockdep.c:5350) [ 58.919617][ T638] ? __virt_addr_valid (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:979 ./include/linux/mmzone.h:2197 arch/x86/mm/physaddr.c:65) [ 58.919627][ T638] ? __lock_release (kernel/locking/lockdep.c:5536) [ 58.919633][ T638] __sys_sendmsg (net/socket.c:2716) [ 58.919637][ T638] ? __call_rcu_common.constprop.0 (kernel/rcu/tree.c:3148) [ 58.919640][ T638] ? __sys_sendmsg_sock (net/socket.c:2701) [ 58.919648][ T638] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751) [ 58.919652][ T638] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) [ 58.919660][ T638] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 58.919664][ T638] RIP: 0033:0x7fad4c4241d7 [ 58.919669][ T638] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 All code ======== 0: 0e (bad) 1: 00 f7 add %dh,%bh 3: d8 64 89 02 fsubs 0x2(%rcx,%rcx,4) 7: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax e: eb b9 jmp 0xffffffffffffffc9 10: 0f 1f 00 nopl (%rax) 13: f3 0f 1e fa endbr64 17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax 1e: 00 1f: 85 c0 test %eax,%eax 21: 75 10 jne 0x33 23: b8 2e 00 00 00 mov $0x2e,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 51 ja 0x83 32: c3 ret 33: 48 83 ec 28 sub $0x28,%rsp 37: 89 54 24 1c mov %edx,0x1c(%rsp) 3b: 48 89 74 24 10 mov %rsi,0x10(%rsp) Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 51 ja 0x59 8: c3 ret 9: 48 83 ec 28 sub $0x28,%rsp d: 89 54 24 1c mov %edx,0x1c(%rsp) 11: 48 89 74 24 10 mov %rsi,0x10(%rsp) [ 58.919672][ T638] RSP: 002b:00007ffc98cddc28 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 58.919677][ T638] RAX: ffffffffffffffda RBX: 00007ffc98cde350 RCX: 00007fad4c4241d7 [ 58.919679][ T638] RDX: 0000000000000000 RSI: 00007ffc98cddc90 RDI: 0000000000000005 [ 58.919681][ T638] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078 [ 58.919683][ T638] R10: 00007fad4c320f60 R11: 0000000000000246 R12: 0000000000000002 [ 58.919685][ T638] R13: 00000000690df836 R14: 0000000000499600 R15: 0000000000000000 | [ 58.947680][ T638] refcount_t: underflow; use-after-free. | [ 58.947892][ T638] WARNING: CPU: 3 PID: 638 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28 (discriminator 3)) | [ 58.948253][ T638] Modules linked in: act_gact cls_flower sch_ingress ip6_gre ip6_tunnel tunnel6 gre 8021q vrf veth | [ 58.949095][ T638] Tainted: [B]=BAD_PAGE [ 58.949237][ T638] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 58.949496][ T638] RIP: 0010:refcount_warn_saturate (lib/refcount.c:28 (discriminator 3)) [ 58.949756][ T638] Code: 7d 93 02 80 fb 01 0f 87 bb 99 d9 fe 83 e3 01 0f 85 51 ff ff ff c6 05 a8 7d 93 02 01 90 48 c7 c7 60 8d a5 90 e8 32 bf 18 ff 90 <0f> 0b 90 90 e9 33 ff ff ff 48 89 df e8 b0 63 a1 ff e9 ba fe ff ff All code ======== 0: 7d 93 jge 0xffffffffffffff95 2: 02 80 fb 01 0f 87 add -0x78f0fe05(%rax),%al 8: bb 99 d9 fe 83 mov $0x83fed999,%ebx d: e3 01 jrcxz 0x10 f: 0f 85 51 ff ff ff jne 0xffffffffffffff66 15: c6 05 a8 7d 93 02 01 movb $0x1,0x2937da8(%rip) # 0x2937dc4 1c: 90 nop 1d: 48 c7 c7 60 8d a5 90 mov $0xffffffff90a58d60,%rdi 24: e8 32 bf 18 ff call 0xffffffffff18bf5b 29: 90 nop 2a:* 0f 0b ud2 <-- trapping instruction 2c: 90 nop 2d: 90 nop 2e: e9 33 ff ff ff jmp 0xffffffffffffff66 33: 48 89 df mov %rbx,%rdi 36: e8 b0 63 a1 ff call 0xffffffffffa163eb 3b: e9 ba fe ff ff jmp 0xfffffffffffffefa Code starting with the faulting instruction =========================================== 0: 0f 0b ud2 2: 90 nop 3: 90 nop 4: e9 33 ff ff ff jmp 0xffffffffffffff3c 9: 48 89 df mov %rbx,%rdi c: e8 b0 63 a1 ff call 0xffffffffffa163c1 11: e9 ba fe ff ff jmp 0xfffffffffffffed0 [ 58.950446][ T638] RSP: 0018:ffffc9000102f1f0 EFLAGS: 00010286 [ 58.950698][ T638] RAX: 0000000000000000 RBX: 0000000000000000 RCX: 0000000000000000 [ 58.950999][ T638] RDX: 0000000000000002 RSI: 0000000000000004 RDI: 0000000000000001 [ 58.951394][ T638] RBP: 0000000000000003 R08: 0000000000000000 R09: fffffbfff227e134 [ 58.951697][ T638] R10: 0000000000000003 R11: ffffc9000102ed80 R12: 0000000000000001 [ 58.952098][ T638] R13: dffffc0000000000 R14: dead000000000122 R15: dead000000000100 [ 58.952492][ T638] FS: 00007fad4c256800(0000) GS:ffff8880a3b72000(0000) knlGS:0000000000000000 [ 58.952848][ T638] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 58.953122][ T638] CR2: 00007f8198c4e000 CR3: 000000000f0a1001 CR4: 0000000000772ef0 [ 58.953424][ T638] PKRU: 55555554 [ 58.953583][ T638] Call Trace: [ 58.953727][ T638] [ 58.953945][ T638] netdev_run_todo (./include/linux/list.h:381 net/core/dev.c:11670) [ 58.954142][ T638] ? dev_ingress_queue_create (net/core/dev.c:12299) [ 58.954336][ T638] ? generic_xdp_install (net/core/dev.c:11630) [ 58.954630][ T638] ? unregister_netdevice_many (net/core/dev.c:12241) [ 58.954832][ T638] ? net_generic (./include/net/netns/generic.h:51) ip6_gre [ 58.955043][ T638] rtnl_dellink (net/core/rtnetlink.c:3580) [ 58.955237][ T638] ? valid_bridge_getlink_req.constprop.0 (net/core/rtnetlink.c:3536) [ 58.955771][ T638] ? find_held_lock (kernel/locking/lockdep.c:5350) [ 58.956010][ T638] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 58.956206][ T638] ? find_held_lock (kernel/locking/lockdep.c:5350) [ 58.956393][ T638] ? rtnetlink_rcv_msg (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 net/core/rtnetlink.c:6956) [ 58.956596][ T638] ? __lock_release (kernel/locking/lockdep.c:5536) [ 58.956916][ T638] ? valid_bridge_getlink_req.constprop.0 (net/core/rtnetlink.c:3536) [ 58.957165][ T638] rtnetlink_rcv_msg (net/core/rtnetlink.c:6958) [ 58.957371][ T638] ? rtnl_port_fill (net/core/rtnetlink.c:6861) [ 58.957785][ T638] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 58.958100][ T638] netlink_rcv_skb (net/netlink/af_netlink.c:2550) [ 58.958294][ T638] ? rtnl_port_fill (net/core/rtnetlink.c:6861) [ 58.958592][ T638] ? netlink_ack (net/netlink/af_netlink.c:2527) [ 58.958896][ T638] ? netlink_deliver_tap (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 net/netlink/af_netlink.c:340) [ 58.959093][ T638] ? netlink_deliver_tap (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:897 ./include/net/netns/generic.h:48 net/netlink/af_netlink.c:333) [ 58.959284][ T638] netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344) [ 58.959477][ T638] ? netlink_attachskb (net/netlink/af_netlink.c:1329) [ 58.959869][ T638] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 58.960078][ T638] netlink_sendmsg (net/netlink/af_netlink.c:1894) [ 58.960268][ T638] ? netlink_unicast (net/netlink/af_netlink.c:1813) [ 58.960464][ T638] ? __import_iovec (lib/iov_iter.c:1346 lib/iov_iter.c:1361) [ 58.960668][ T638] ? netlink_unicast (net/netlink/af_netlink.c:1813) [ 58.960858][ T638] ____sys_sendmsg (net/socket.c:727 net/socket.c:742 net/socket.c:2630) [ 58.961073][ T638] ? get_timestamp.constprop.0 (net/socket.c:2576) [ 58.961516][ T638] ? __copy_msghdr (net/socket.c:2556) [ 58.961712][ T638] ___sys_sendmsg (net/socket.c:2686) [ 58.962013][ T638] ? kasan_record_aux_stack (mm/kasan/generic.c:559) [ 58.962208][ T638] ? __call_rcu_common.constprop.0 (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:109 ./arch/x86/include/asm/irqflags.h:127 kernel/rcu/tree.c:3125) [ 58.962459][ T638] ? copy_msghdr_from_user (net/socket.c:2673) [ 58.962679][ T638] ? find_held_lock (kernel/locking/lockdep.c:5350) [ 58.962869][ T638] ? __lock_acquire (kernel/locking/lockdep.c:5237) [ 58.963082][ T638] ? find_held_lock (kernel/locking/lockdep.c:5350) [ 58.963270][ T638] ? __virt_addr_valid (./include/linux/rcupdate.h:341 ./include/linux/rcupdate.h:979 ./include/linux/mmzone.h:2197 arch/x86/mm/physaddr.c:65) [ 58.963462][ T638] ? __lock_release (kernel/locking/lockdep.c:5536) [ 58.963765][ T638] __sys_sendmsg (net/socket.c:2716) [ 58.964080][ T638] ? __call_rcu_common.constprop.0 (kernel/rcu/tree.c:3148) [ 58.964321][ T638] ? __sys_sendmsg_sock (net/socket.c:2701) [ 58.964516][ T638] ? rcu_is_watching (./include/linux/context_tracking.h:128 kernel/rcu/tree.c:751) [ 58.964709][ T638] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94) [ 58.964912][ T638] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 58.965159][ T638] RIP: 0033:0x7fad4c4241d7 [ 58.965360][ T638] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 All code ======== 0: 0e (bad) 1: 00 f7 add %dh,%bh 3: d8 64 89 02 fsubs 0x2(%rcx,%rcx,4) 7: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax e: eb b9 jmp 0xffffffffffffffc9 10: 0f 1f 00 nopl (%rax) 13: f3 0f 1e fa endbr64 17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax 1e: 00 1f: 85 c0 test %eax,%eax 21: 75 10 jne 0x33 23: b8 2e 00 00 00 mov $0x2e,%eax 28: 0f 05 syscall 2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction 30: 77 51 ja 0x83 32: c3 ret 33: 48 83 ec 28 sub $0x28,%rsp 37: 89 54 24 1c mov %edx,0x1c(%rsp) 3b: 48 89 74 24 10 mov %rsi,0x10(%rsp) Code starting with the faulting instruction =========================================== 0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax 6: 77 51 ja 0x59 8: c3 ret 9: 48 83 ec 28 sub $0x28,%rsp d: 89 54 24 1c mov %edx,0x1c(%rsp) 11: 48 89 74 24 10 mov %rsi,0x10(%rsp) [ 58.966180][ T638] RSP: 002b:00007ffc98cddc28 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 58.966590][ T638] RAX: ffffffffffffffda RBX: 00007ffc98cde350 RCX: 00007fad4c4241d7 [ 58.966995][ T638] RDX: 0000000000000000 RSI: 00007ffc98cddc90 RDI: 0000000000000005 [ 58.967290][ T638] RBP: 0000000000000002 R08: 0000000000000003 R09: 0000000000000078 [ 58.967602][ T638] R10: 00007fad4c320f60 R11: 0000000000000246 R12: 0000000000000002 Finger prints: print_report:kasan_report:kobject_put:netdev_run_todo:rtnl_dellink refcount_warn_saturate:netdev_run_todo:rtnl_dellink:rtnetlink_rcv_msg:netlink_rcv_skb