[ 9.780822][ T199] ================================================================== [ 9.781089][ T199] BUG: KASAN: slab-out-of-bounds in tcp_v6_send_response+0x1241/0x2000 [ 9.781308][ T199] Read of size 8 at addr ff1100000d1ea570 by task packetdrill/199 [ 9.781519][ T199] [ 9.781594][ T199] CPU: 2 UID: 0 PID: 199 Comm: packetdrill Not tainted 7.2.0-virtme #1 PREEMPT(full) [ 9.781598][ T199] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 9.781600][ T199] Call Trace: [ 9.781601][ T199] [ 9.781603][ T199] dump_stack_lvl+0x6f/0xa0 [ 9.781608][ T199] print_address_description.constprop.0+0x56/0x2d0 [ 9.781612][ T199] print_report+0xfc/0x1fa [ 9.781613][ T199] ? __virt_addr_valid+0x102/0x440 [ 9.781617][ T199] ? __virt_addr_valid+0x1da/0x440 [ 9.781618][ T199] kasan_report+0x108/0x130 [ 9.781621][ T199] ? tcp_v6_send_response+0x1241/0x2000 [ 9.781623][ T199] ? tcp_v6_send_response+0x1241/0x2000 [ 9.781625][ T199] kasan_check_range+0x130/0x200 [ 9.781628][ T199] tcp_v6_send_response+0x1241/0x2000 [ 9.781629][ T199] ? __mod_timer+0x91/0xc60 [ 9.781634][ T199] ? __xfrm_policy_check2.constprop.0+0x720/0x720 [ 9.781635][ T199] ? __lock_acquire+0x518/0xc20 [ 9.781639][ T199] ? __lock_release.isra.0+0x69/0x1a0 [ 9.781641][ T199] ? rcu_is_watching+0x16/0xd0 [ 9.781644][ T199] tcp_v6_rcv+0x220e/0x2e70 [ 9.781648][ T199] ? tcp_v6_syn_recv_sock+0x1b00/0x1b00 [ 9.781650][ T199] ? mark_usage+0x61/0x170 [ 9.781653][ T199] ip6_protocol_deliver_rcu+0x15a/0x1290 [ 9.781657][ T199] ? rcu_is_watching+0x16/0xd0 [ 9.781659][ T199] ip6_input+0x223/0x5f0 [ 9.781661][ T199] __netif_receive_skb_one_core+0xfc/0x180 [ 9.781665][ T199] ? lock_acquire.part.0+0xd4/0x280 [ 9.781667][ T199] ? netif_receive_skb_internal+0x81/0x330 [ 9.781669][ T199] ? __netif_receive_skb_list_core+0x9e0/0x9e0 [ 9.781671][ T199] ? rcu_is_watching+0x16/0xd0 [ 9.781672][ T199] ? ktime_get_with_offset+0x1ef/0x3a0 [ 9.781675][ T199] netif_receive_skb_internal+0xb0/0x330 [ 9.781677][ T199] ? __netif_receive_skb+0x150/0x150 [ 9.781679][ T199] ? __might_fault+0x97/0x140 [ 9.781682][ T199] ? _copy_from_iter+0x3c6/0x1810 [ 9.781686][ T199] netif_receive_skb+0x56/0x340 [ 9.781688][ T199] ? __local_bh_disable_ip+0x80/0x100 [ 9.781691][ T199] tun_rx_batched.isra.0+0x3d5/0x790 [ 9.781694][ T199] ? mark_usage+0x61/0x170 [ 9.781696][ T199] ? __lock_acquire+0x518/0xc20 [ 9.781698][ T199] ? tun_setup+0x2d0/0x2d0 [ 9.781700][ T199] ? rcu_is_watching+0x16/0xd0 [ 9.781702][ T199] ? lock_acquire+0x13c/0x160 [ 9.781704][ T199] tun_get_user+0x1687/0x2620 [ 9.781707][ T199] ? do_syscall_64+0xff/0x530 [ 9.781709][ T199] ? entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 9.781712][ T199] ? tun_build_skb+0x14f0/0x14f0 [ 9.781714][ T199] ? mark_usage+0x61/0x170 [ 9.781715][ T199] ? ref_tracker_free+0x501/0x870 [ 9.781718][ T199] ? ref_tracker_dir_print+0x100/0x100 [ 9.781721][ T199] ? find_held_lock+0x2b/0x80 [ 9.781723][ T199] ? __lock_release.isra.0+0x69/0x1a0 [ 9.781725][ T199] ? tun_get+0x106/0x240 [ 9.781727][ T199] tun_chr_write_iter+0xb5/0x1a0 [ 9.781729][ T199] do_iter_readv_writev+0x485/0xb70 [ 9.781731][ T199] ? kasan_quarantine_put+0x13e/0x2b0 [ 9.781733][ T199] ? fsnotify+0x3610/0x3610 [ 9.781735][ T199] ? ref_tracker_free+0x501/0x870 [ 9.781737][ T199] ? new_sync_write+0x760/0x760 [ 9.781741][ T199] ? import_iovec+0x4e/0xa0 [ 9.781743][ T199] vfs_writev+0x2a4/0xd80 [ 9.781744][ T199] ? tun_get+0x106/0x240 [ 9.781746][ T199] ? vfs_iocb_iter_write+0x940/0x940 [ 9.781747][ T199] ? tun_recvmsg+0x290/0x290 [ 9.781749][ T199] ? __lock_acquire+0x518/0xc20 [ 9.781751][ T199] ? new_sync_read+0x192/0x750 [ 9.781753][ T199] ? lock_acquire.part.0+0xd4/0x280 [ 9.781755][ T199] ? find_held_lock+0x2b/0x80 [ 9.781758][ T199] ? __fget_files+0x1e3/0x460 [ 9.781761][ T199] ? do_writev+0x12f/0x320 [ 9.781762][ T199] do_writev+0x12f/0x320 [ 9.781764][ T199] ? vfs_writev+0xd80/0xd80 [ 9.781765][ T199] ? fput+0x1f/0xa0 [ 9.781767][ T199] ? rcu_is_watching+0x16/0xd0 [ 9.781769][ T199] do_syscall_64+0xff/0x530 [ 9.781771][ T199] ? irq_exit_rcu+0x1a/0x30 [ 9.781773][ T199] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 9.781775][ T199] RIP: 0033:0x4c42a2 [ 9.781778][ T199] Code: 08 0f 85 31 ea ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 55 48 89 e5 [ 9.781780][ T199] RSP: 002b:00007ffeddb32a08 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 9.781784][ T199] RAX: ffffffffffffffda RBX: 0000000000000010 RCX: 00000000004c42a2 [ 9.781786][ T199] RDX: 0000000000000002 RSI: 00007ffeddb32a90 RDI: 0000000000000005 [ 9.781787][ T199] RBP: 00007ffeddb32a30 R08: 0000000000000000 R09: 0000000000000000 [ 9.781788][ T199] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffeddb33068 [ 9.781789][ T199] R13: 00007ffeddb330f0 R14: 0000000000000002 R15: 0000000000543540 [ 9.781791][ T199] [ 9.781792][ T199] [ 9.794385][ T199] The buggy address belongs to the object at ff1100000d1ea4e8 [ 9.794385][ T199] which belongs to the cache tw_sock_TCPv6 of size 288 [ 9.794838][ T199] The buggy address is located 136 bytes inside of [ 9.794838][ T199] allocated 288-byte region [ff1100000d1ea4e8, ff1100000d1ea608) [ 9.795242][ T199] [ 9.795311][ T199] The buggy address belongs to the physical page: [ 9.795525][ T199] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xff1100000d1ea1a8 pfn:0xd1ea [ 9.795852][ T199] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 9.796104][ T199] flags: 0x80000000000240(workingset|head|node=0|zone=1) [ 9.796279][ T199] page_type: f5(slab) [ 9.796435][ T199] raw: 0080000000000240 ff11000005d8d9c0 ff11000005d9ad08 ff11000005d9ad08 [ 9.796675][ T199] raw: ff1100000d1ea1a8 0000000000130001 00000000f5000000 0000000000000000 [ 9.796961][ T199] head: 0080000000000240 ff11000005d8d9c0 ff11000005d9ad08 ff11000005d9ad08 [ 9.797252][ T199] head: ff1100000d1ea1a8 0000000000130001 00000000f5000000 0000000000000000 [ 9.797544][ T199] head: 0080000000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff [ 9.797831][ T199] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 9.798116][ T199] page dumped because: kasan: bad access detected [ 9.798288][ T199] [ 9.798404][ T199] Memory state around the buggy address: [ 9.798539][ T199] ff1100000d1ea400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 9.798785][ T199] ff1100000d1ea480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 9.799024][ T199] >ff1100000d1ea500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 9.799220][ T199] ^ [ 9.799465][ T199] ff1100000d1ea580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 9.799703][ T199] ff1100000d1ea600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 9.799939][ T199] ================================================================== [ 9.800227][ T199] Disabling lock debugging due to kernel taint [ 9.830604][ T199] packetdrill (199) used greatest stack depth: 23984 bytes left