syzbot

RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000014
RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000015
R13: 0000000000000608 R14: 00000000006fc160 R15: 0000000000000001
==================================================================
BUG: KASAN: use-after-free in rcu_cblist_dequeue+0xaa/0xe0 kernel/rcu/rcu_segcblist.c:54
Read of size 8 at addr ffff8801c0876040 by task ksoftirqd/0/8

CPU: 0 PID: 8 Comm: ksoftirqd/0 Not tainted 4.16.0+ #17
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1b9/0x294 lib/dump_stack.c:113
 print_address_description+0x6c/0x20b mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report.cold.7+0xac/0x2f5 mm/kasan/report.c:412
 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
 rcu_cblist_dequeue+0xaa/0xe0 kernel/rcu/rcu_segcblist.c:54
 rcu_do_batch kernel/rcu/tree.c:2673 [inline]
 invoke_rcu_callbacks kernel/rcu/tree.c:2930 [inline]
 __rcu_process_callbacks kernel/rcu/tree.c:2897 [inline]
 rcu_process_callbacks+0x9e5/0x15f0 kernel/rcu/tree.c:2914
 __do_softirq+0x2e0/0xaf5 kernel/softirq.c:285
 run_ksoftirqd+0x86/0x100 kernel/softirq.c:646
 smpboot_thread_fn+0x417/0x870 kernel/smpboot.c:164
 kthread+0x345/0x410 kernel/kthread.c:238
 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:411

Allocated by task 13810:
 save_stack+0x43/0xd0 mm/kasan/kasan.c:448
 set_track mm/kasan/kasan.c:460 [inline]
 kasan_kmalloc+0xc4/0xe0 mm/kasan/kasan.c:553
 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:490
 kmem_cache_alloc_node+0x144/0x780 mm/slab.c:3644
 __alloc_skb+0x111/0x780 net/core/skbuff.c:193
 alloc_skb_fclone include/linux/skbuff.h:1029 [inline]
 tcp_send_fin+0x28e/0xda0 net/ipv4/tcp_output.c:3074
 tcp_shutdown+0x107/0x130 net/ipv4/tcp.c:2137
 inet_shutdown+0x1b9/0x3d0 net/ipv4/af_inet.c:870
 __sys_shutdown+0x154/0x2b0 net/socket.c:1967
 SYSC_shutdown net/socket.c:1975 [inline]
 SyS_shutdown+0x1c/0x30 net/socket.c:1973
 do_syscall_64+0x29e/0x9d0 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x42/0xb7

Freed by task 13810:
 save_stack+0x43/0xd0 mm/kasan/kasan.c:448
 set_track mm/kasan/kasan.c:460 [inline]
 __kasan_slab_free+0x11a/0x170 mm/kasan/kasan.c:521
 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
 __cache_free mm/slab.c:3498 [inline]
 kmem_cache_free+0x86/0x2d0 mm/slab.c:3756
 __alloc_skb+0x682/0x780 net/core/skbuff.c:250
 alloc_skb_fclone include/linux/skbuff.h:1029 [inline]
 tcp_send_fin+0x28e/0xda0 net/ipv4/tcp_output.c:3074
 tcp_shutdown+0x107/0x130 net/ipv4/tcp.c:2137
 inet_shutdown+0x1b9/0x3d0 net/ipv4/af_inet.c:870
 __sys_shutdown+0x154/0x2b0 net/socket.c:1967
 SYSC_shutdown net/socket.c:1975 [inline]
 SyS_shutdown+0x1c/0x30 net/socket.c:1973
 do_syscall_64+0x29e/0x9d0 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x42/0xb7

The buggy address belongs to the object at ffff8801c0876040
 which belongs to the cache skbuff_fclone_cache of size 472
The buggy address is located 0 bytes inside of
 472-byte region [ffff8801c0876040, ffff8801c0876218)
The buggy address belongs to the page:
page:ffffea0007021d80 count:1 mapcount:0 mapping:ffff8801c0876040 index:0xffff8801c08762c0
flags: 0x2fffc0000000100(slab)
raw: 02fffc0000000100 ffff8801c0876040 ffff8801c08762c0 0000000100000005
raw: ffffea0006f10020 ffffea0006de1760 ffff8801d9fd6540 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801c0875f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8801c0875f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8801c0876000: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
                                           ^
 ffff8801c0876080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8801c0876100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================