[ 71.365883][ T1183] ================================================================== [ 71.366135][ T1183] BUG: KASAN: slab-out-of-bounds in tcp_v6_send_response+0x1241/0x2000 [ 71.366350][ T1183] Read of size 8 at addr ff110000110ce570 by task packetdrill/1183 [ 71.366548][ T1183] [ 71.366620][ T1183] CPU: 2 UID: 0 PID: 1183 Comm: packetdrill Not tainted 7.2.0-virtme #1 PREEMPT(full) [ 71.366623][ T1183] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 71.366625][ T1183] Call Trace: [ 71.366627][ T1183] [ 71.366628][ T1183] dump_stack_lvl+0x6f/0xa0 [ 71.366633][ T1183] print_address_description.constprop.0+0x56/0x2d0 [ 71.366638][ T1183] print_report+0xfc/0x1fa [ 71.366639][ T1183] ? __virt_addr_valid+0x102/0x440 [ 71.366642][ T1183] ? __virt_addr_valid+0x1da/0x440 [ 71.366644][ T1183] kasan_report+0x108/0x130 [ 71.366647][ T1183] ? tcp_v6_send_response+0x1241/0x2000 [ 71.366649][ T1183] ? tcp_v6_send_response+0x1241/0x2000 [ 71.366651][ T1183] kasan_check_range+0x130/0x200 [ 71.366653][ T1183] tcp_v6_send_response+0x1241/0x2000 [ 71.366654][ T1183] ? __mod_timer+0x3ad/0xc60 [ 71.366659][ T1183] ? __xfrm_policy_check2.constprop.0+0x720/0x720 [ 71.366660][ T1183] ? __lock_acquire+0x518/0xc20 [ 71.366664][ T1183] ? __lock_release.isra.0+0x69/0x1a0 [ 71.366666][ T1183] ? rcu_is_watching+0x16/0xd0 [ 71.366669][ T1183] tcp_v6_rcv+0x220e/0x2e70 [ 71.366673][ T1183] ? tcp_v6_syn_recv_sock+0x1b00/0x1b00 [ 71.366675][ T1183] ? mark_usage+0x61/0x170 [ 71.366678][ T1183] ip6_protocol_deliver_rcu+0x15a/0x1290 [ 71.366685][ T1183] ? rcu_is_watching+0x16/0xd0 [ 71.366688][ T1183] ip6_input+0x223/0x5f0 [ 71.366689][ T1183] __netif_receive_skb_one_core+0xfc/0x180 [ 71.366693][ T1183] ? lock_acquire.part.0+0xd4/0x280 [ 71.366695][ T1183] ? netif_receive_skb_internal+0x81/0x330 [ 71.366697][ T1183] ? __netif_receive_skb_list_core+0x9e0/0x9e0 [ 71.366699][ T1183] ? rcu_is_watching+0x16/0xd0 [ 71.366700][ T1183] ? ktime_get_with_offset+0x1ef/0x3a0 [ 71.366703][ T1183] netif_receive_skb_internal+0xb0/0x330 [ 71.366705][ T1183] ? __netif_receive_skb+0x150/0x150 [ 71.366707][ T1183] ? __might_fault+0x97/0x140 [ 71.366710][ T1183] ? _copy_from_iter+0x3c6/0x1810 [ 71.366715][ T1183] netif_receive_skb+0x56/0x340 [ 71.366716][ T1183] ? __local_bh_disable_ip+0x80/0x100 [ 71.366720][ T1183] tun_rx_batched.isra.0+0x3d5/0x790 [ 71.366723][ T1183] ? mark_usage+0x61/0x170 [ 71.366724][ T1183] ? __lock_acquire+0x518/0xc20 [ 71.366726][ T1183] ? tun_setup+0x2d0/0x2d0 [ 71.366728][ T1183] ? rcu_is_watching+0x16/0xd0 [ 71.366730][ T1183] ? lock_acquire+0x13c/0x160 [ 71.366732][ T1183] tun_get_user+0x1687/0x2620 [ 71.366735][ T1183] ? do_syscall_64+0xff/0x530 [ 71.366738][ T1183] ? entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 71.366740][ T1183] ? tun_build_skb+0x14f0/0x14f0 [ 71.366742][ T1183] ? mark_usage+0x61/0x170 [ 71.366743][ T1183] ? ref_tracker_free+0x501/0x870 [ 71.366746][ T1183] ? ref_tracker_dir_print+0x100/0x100 [ 71.366749][ T1183] ? find_held_lock+0x2b/0x80 [ 71.366751][ T1183] ? __lock_release.isra.0+0x69/0x1a0 [ 71.366753][ T1183] ? tun_get+0x106/0x240 [ 71.366755][ T1183] tun_chr_write_iter+0xb5/0x1a0 [ 71.366757][ T1183] do_iter_readv_writev+0x485/0xb70 [ 71.366759][ T1183] ? kasan_quarantine_put+0x13e/0x2b0 [ 71.366761][ T1183] ? fsnotify+0x3610/0x3610 [ 71.366763][ T1183] ? ref_tracker_free+0x501/0x870 [ 71.366765][ T1183] ? new_sync_write+0x760/0x760 [ 71.366768][ T1183] ? import_iovec+0x4e/0xa0 [ 71.366770][ T1183] vfs_writev+0x2a4/0xd80 [ 71.366771][ T1183] ? tun_get+0x106/0x240 [ 71.366773][ T1183] ? vfs_iocb_iter_write+0x940/0x940 [ 71.366775][ T1183] ? tun_recvmsg+0x290/0x290 [ 71.366776][ T1183] ? __lock_acquire+0x518/0xc20 [ 71.366778][ T1183] ? new_sync_read+0x192/0x750 [ 71.366780][ T1183] ? lock_acquire.part.0+0xd4/0x280 [ 71.366782][ T1183] ? find_held_lock+0x2b/0x80 [ 71.366785][ T1183] ? __fget_files+0x1e3/0x460 [ 71.366788][ T1183] ? do_writev+0x12f/0x320 [ 71.366789][ T1183] do_writev+0x12f/0x320 [ 71.366791][ T1183] ? vfs_writev+0xd80/0xd80 [ 71.366792][ T1183] ? fput+0x1f/0xa0 [ 71.366794][ T1183] ? rcu_is_watching+0x16/0xd0 [ 71.366796][ T1183] do_syscall_64+0xff/0x530 [ 71.366797][ T1183] ? irq_exit_rcu+0x1a/0x30 [ 71.366799][ T1183] entry_SYSCALL_64_after_hwframe+0x4b/0x53 [ 71.366801][ T1183] RIP: 0033:0x4c42a2 [ 71.366804][ T1183] Code: 08 0f 85 31 ea ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 55 48 89 e5 [ 71.366806][ T1183] RSP: 002b:00007ffdf0bd9af8 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 71.366810][ T1183] RAX: ffffffffffffffda RBX: 0000000000000010 RCX: 00000000004c42a2 [ 71.366811][ T1183] RDX: 0000000000000002 RSI: 00007ffdf0bd9b80 RDI: 0000000000000005 [ 71.366812][ T1183] RBP: 00007ffdf0bd9b20 R08: 0000000000000000 R09: 0000000000000000 [ 71.366813][ T1183] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffdf0bda158 [ 71.366814][ T1183] R13: 00007ffdf0bda1e0 R14: 0000000000000002 R15: 0000000000543540 [ 71.366816][ T1183] [ 71.366817][ T1183] [ 71.378534][ T1183] The buggy address belongs to the object at ff110000110ce4e8 [ 71.378534][ T1183] which belongs to the cache tw_sock_TCPv6 of size 288 [ 71.378892][ T1183] The buggy address is located 136 bytes inside of [ 71.378892][ T1183] allocated 288-byte region [ff110000110ce4e8, ff110000110ce608) [ 71.379251][ T1183] [ 71.379322][ T1183] The buggy address belongs to the physical page: [ 71.379488][ T1183] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xff110000110ce1a8 pfn:0x110ce [ 71.379763][ T1183] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 71.379959][ T1183] flags: 0x80000000000240(workingset|head|node=0|zone=1) [ 71.380130][ T1183] page_type: f5(slab) [ 71.380236][ T1183] raw: 0080000000000240 ff11000005d119c0 ff11000005d1ed08 ff11000005d1ed08 [ 71.380471][ T1183] raw: ff110000110ce1a8 0000000000130001 00000000f5000000 0000000000000000 [ 71.380709][ T1183] head: 0080000000000240 ff11000005d119c0 ff11000005d1ed08 ff11000005d1ed08 [ 71.380991][ T1183] head: ff110000110ce1a8 0000000000130001 00000000f5000000 0000000000000000 [ 71.381270][ T1183] head: 0080000000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff [ 71.381544][ T1183] head: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000 [ 71.381825][ T1183] page dumped because: kasan: bad access detected [ 71.381985][ T1183] [ 71.382050][ T1183] Memory state around the buggy address: [ 71.382219][ T1183] ff110000110ce400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 71.382451][ T1183] ff110000110ce480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 71.382643][ T1183] >ff110000110ce500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 71.382878][ T1183] ^ [ 71.383104][ T1183] ff110000110ce580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 71.383337][ T1183] ff110000110ce600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc [ 71.383523][ T1183] ================================================================== [ 71.383803][ T1183] Disabling lock debugging due to kernel taint