Hi, I got the following kasan report when running test_progs on bpf-tree (commit 100888fb6d8a): [ 212.183985] ================================================================== [ 212.184699] BUG: KASAN: slab-use-after-free in sock_def_readable+0x101/0x450 [ 212.185375] Read of size 8 at addr ffff88812d9f1860 by task kworker/4:1/67 [ 212.186195] CPU: 4 PID: 67 Comm: kworker/4:1 Tainted: G O 6.6.0+ #9 [ 212.186942] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014 [ 212.188044] Workqueue: events sk_psock_backlog [ 212.188496] Call Trace: [ 212.188746] <TASK> [ 212.188967] dump_stack_lvl+0x4a/0x90 [ 212.189342] print_report+0xd2/0x620 [ 212.189706] ? kasan_complete_mode_report_info+0x7c/0x210 [ 212.190241] kasan_report+0xd1/0x110 [ 212.190599] ? sock_def_readable+0x101/0x450 [ 212.191022] ? sock_def_readable+0x101/0x450 [ 212.191452] kasan_check_range+0x101/0x1c0 [ 212.191852] __kasan_check_read+0x11/0x20 [ 212.192253] sock_def_readable+0x101/0x450 [ 212.192656] unix_stream_sendmsg+0x3cc/0xaa0 [ 212.193093] ? __pfx_unix_stream_sendmsg+0x10/0x10 [ 212.193565] ? __pfx___lock_acquire+0x10/0x10 [ 212.194034] sock_sendmsg+0x219/0x230 [ 212.194400] ? __pfx_sock_sendmsg+0x10/0x10 [ 212.194813] ? lock_acquire+0x180/0x420 [ 212.195193] ? sk_psock_backlog+0x3c/0x600 [ 212.195598] ? __pfx_lock_acquire+0x10/0x10 [ 212.196014] ? lock_is_held_type+0x97/0x100 [ 212.196436] ? __asan_storeN+0x12/0x20 [ 212.196808] __skb_send_sock+0x53b/0x660 [ 212.197204] ? __pfx_sendmsg_unlocked+0x10/0x10 [ 212.197653] ? sk_psock_backlog+0x3c/0x600 [ 212.198057] ? __pfx___skb_send_sock+0x10/0x10 [ 212.198499] ? __mutex_unlock_slowpath+0x122/0x410 [ 212.198990] skb_send_sock+0x15/0x20 [ 212.199355] sk_psock_backlog+0x149/0x600 [ 212.199762] process_one_work+0x462/0x990 [ 212.200174] ? __pfx_process_one_work+0x10/0x10 [ 212.200617] ? do_raw_spin_lock+0x115/0x1b0 [ 212.201041] ? assign_work+0xe6/0x120 [ 212.201407] worker_thread+0x370/0x670 [ 212.201779] ? __pfx_worker_thread+0x10/0x10 [ 212.202202] kthread+0x1b0/0x200 [ 212.202525] ? kthread+0x103/0x200 [ 212.202862] ? __pfx_kthread+0x10/0x10 [ 212.203238] ret_from_fork+0x3a/0x70 [ 212.203600] ? __pfx_kthread+0x10/0x10 [ 212.203978] ret_from_fork_asm+0x1b/0x30 [ 212.204378] </TASK> [ 212.204762] Allocated by task 415: [ 212.205109] kasan_save_stack+0x26/0x50 [ 212.205495] kasan_set_track+0x25/0x40 [ 212.205873] kasan_save_alloc_info+0x1e/0x30 [ 212.206291] __kasan_slab_alloc+0x72/0x80 [ 212.206689] kmem_cache_alloc+0x16c/0x3a0 [ 212.207086] sk_prot_alloc+0x48/0x170 [ 212.207446] sk_alloc+0x31/0x5b0 [ 212.207773] unix_create1+0x8b/0x450 [ 212.208131] unix_create+0x82/0xf0 [ 212.208470] __sock_create+0x1d5/0x460 [ 212.208838] __sys_socketpair+0x1b1/0x3a0 [ 212.209235] __x64_sys_socketpair+0x54/0x70 [ 212.209642] do_syscall_64+0x36/0xb0 [ 212.210005] entry_SYSCALL_64_after_hwframe+0x6e/0x76 [ 212.210663] Freed by task 415: [ 212.210972] kasan_save_stack+0x26/0x50 [ 212.211348] kasan_set_track+0x25/0x40 [ 212.211717] kasan_save_free_info+0x2b/0x50 [ 212.212130] __kasan_slab_free+0x113/0x190 [ 212.212530] slab_free_freelist_hook+0xd7/0x1e0 [ 212.212983] kmem_cache_free+0x109/0x280 [ 212.213370] __sk_destruct+0x247/0x370 [ 212.213740] sk_destruct+0x80/0x90 [ 212.214080] __sk_free+0x68/0x180 [ 212.214410] sk_free+0x4a/0x70 [ 212.214723] unix_release_sock+0x648/0x6e0 [ 212.215128] unix_release+0x55/0x80 [ 212.215474] __sock_release+0x64/0x130 [ 212.215852] sock_close+0x18/0x20 [ 212.216187] __fput+0x13d/0x510 [ 212.216511] __fput_sync+0x34/0x40 [ 212.216854] __x64_sys_close+0x56/0xa0 [ 212.217232] do_syscall_64+0x36/0xb0 [ 212.217588] entry_SYSCALL_64_after_hwframe+0x6e/0x76 [ 212.218243] The buggy address belongs to the object at ffff88812d9f1800 which belongs to the cache UNIX-STREAM of size 1920 [ 212.219431] The buggy address is located 96 bytes inside of freed 1920-byte region [ffff88812d9f1800, ffff88812d9f1f80) [ 212.220753] The buggy address belongs to the physical page: [ 212.221292] page:00000000739895e2 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x12d9f0 [ 212.222189] head:00000000739895e2 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 212.222966] memcg:ffff88812d026501 [ 212.223302] flags: 0x17ffffc0000840(slab|head|node=0|zone=2|lastcpupid=0x1fffff) [ 212.224016] page_type: 0xffffffff() [ 212.224363] raw: 0017ffffc0000840 ffff888102fbb180 ffffea0004b67400 0000000000000002 [ 212.225112] raw: 0000000000000000 0000000080100010 00000001ffffffff ffff88812d026501 [ 212.225848] page dumped because: kasan: bad access detected [ 212.226553] Memory state around the buggy address: [ 212.227022] ffff88812d9f1700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 212.227714] ffff88812d9f1780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 212.228413] >ffff88812d9f1800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 212.229107] ^ [ 212.229717] ffff88812d9f1880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 212.230418] ffff88812d9f1900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 212.231113] ==================================================================
