====================================== | [ 664.237696][ T9627] ================================================================== | [ 664.237887][ T9627] BUG: KASAN: slab-out-of-bounds in devlink_nl_dumpit (net/devlink/netlink.c:355) | [ 664.238075][ T9627] Read of size 8 at addr ff110000048f75c0 by task devlink/9627 | [ 664.238245][ T9627] [ 664.238303][ T9627] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011 [ 664.238305][ T9627] Call Trace: [ 664.238306][ T9627] [ 664.238308][ T9627] dump_stack_lvl (lib/dump_stack.c:122) [ 664.238313][ T9627] print_address_description.constprop.0 (mm/kasan/report.c:379) [ 664.238318][ T9627] print_report (mm/kasan/report.c:483) [ 664.238320][ T9627] ? devlink_nl_dumpit (net/devlink/netlink.c:355) [ 664.238322][ T9627] ? __virt_addr_valid (./include/linux/rcupdate.h:975 (discriminator 3) ./include/linux/mmzone.h:2207 (discriminator 3) arch/x86/mm/physaddr.c:54 (discriminator 3)) [ 664.238327][ T9627] ? devlink_nl_dumpit (net/devlink/netlink.c:355) [ 664.238328][ T9627] kasan_report (mm/kasan/report.c:597) [ 664.238332][ T9627] ? devlink_nl_dumpit (net/devlink/netlink.c:355) [ 664.238335][ T9627] devlink_nl_dumpit (net/devlink/netlink.c:355) [ 664.238336][ T9627] ? devlink_nl_fill (net/devlink/dev.c:246) [ 664.238339][ T9627] genl_dumpit (net/netlink/genetlink.c:1028) [ 664.238343][ T9627] netlink_dump (net/netlink/af_netlink.c:2325 (discriminator 1)) [ 664.238346][ T9627] ? netlink_lookup (net/netlink/af_netlink.c:2254) [ 664.238350][ T9627] ? __asan_memset (mm/kasan/shadow.c:84 (discriminator 2)) [ 664.238353][ T9627] ? genl_start (net/netlink/genetlink.c:1002) [ 664.238355][ T9627] __netlink_dump_start (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/net/sock.h:2010 net/netlink/af_netlink.c:2442) [ 664.238358][ T9627] genl_family_rcv_msg_dumpit (net/netlink/genetlink.c:59 net/netlink/genetlink.c:1077) [ 664.238361][ T9627] ? genl_dumpit (net/netlink/genetlink.c:1057) [ 664.238363][ T9627] ? lock_acquire.part.0 (kernel/locking/lockdep.c:470 kernel/locking/lockdep.c:5870) [ 664.238365][ T9627] ? find_held_lock (kernel/locking/lockdep.c:5350 (discriminator 1)) [ 664.238369][ T9627] ? genl_cmd_full_to_split (net/netlink/genetlink.c:305) [ 664.238371][ T9627] ? genl_family_rcv_msg_doit (net/netlink/genetlink.c:968) [ 664.238373][ T9627] ? genl_release (net/netlink/genetlink.c:1018) [ 664.238375][ T9627] ? genl_rcv_msg (net/netlink/genetlink.c:1033) [ 664.238377][ T9627] ? is_bpf_text_address (kernel/bpf/core.c:753) [ 664.238380][ T9627] ? kernel_text_address (kernel/extable.c:125 (discriminator 1) kernel/extable.c:94 (discriminator 1)) [ 664.238383][ T9627] genl_family_rcv_msg (net/netlink/genetlink.c:1192) [ 664.238385][ T9627] ? genl_family_rcv_msg_dumpit (net/netlink/genetlink.c:1160) [ 664.238387][ T9627] ? rcu_lockdep_current_cpu_online (kernel/rcu/tree.c:4040 (discriminator 2) kernel/rcu/tree.c:4032 (discriminator 2)) [ 664.238391][ T9627] ? devlink_nl_get_doit (net/devlink/dev.c:253) [ 664.238393][ T9627] ? __lock_acquire (kernel/locking/lockdep.c:5237 (discriminator 1)) [ 664.238395][ T9627] genl_rcv_msg (net/netlink/genetlink.c:65 net/netlink/genetlink.c:1211) [ 664.238397][ T9627] netlink_rcv_skb (net/netlink/af_netlink.c:2550) [ 664.238399][ T9627] ? genl_family_rcv_msg (net/netlink/genetlink.c:1201) [ 664.238402][ T9627] ? netlink_ack (net/netlink/af_netlink.c:2527) [ 664.238405][ T9627] ? netlink_deliver_tap (./include/linux/rcupdate.h:322 (discriminator 1) ./include/linux/rcupdate.h:881 (discriminator 1) ./include/net/netns/generic.h:48 (discriminator 1) net/netlink/af_netlink.c:333 (discriminator 1)) [ 664.238407][ T9627] ? netlink_deliver_tap (./include/linux/rcupdate.h:322 (discriminator 1) ./include/linux/rcupdate.h:881 (discriminator 1) net/netlink/af_netlink.c:340 (discriminator 1)) [ 664.238409][ T9627] genl_rcv (net/netlink/genetlink.c:1220) [ 664.238411][ T9627] netlink_unicast (net/netlink/af_netlink.c:1319 net/netlink/af_netlink.c:1344) [ 664.238413][ T9627] ? netlink_attachskb (net/netlink/af_netlink.c:1329) [ 664.238415][ T9627] ? __alloc_skb (./include/linux/bottom_half.h:20 (discriminator 1) net/core/skbuff.c:695 (discriminator 1)) [ 664.238418][ T9627] ? napi_skb_cache_get (net/core/skbuff.c:674) [ 664.238419][ T9627] ? __lock_acquire (kernel/locking/lockdep.c:5237 (discriminator 1)) [ 664.238421][ T9627] netlink_sendmsg (net/netlink/af_netlink.c:1894) [ 664.238424][ T9627] ? netlink_unicast (net/netlink/af_netlink.c:1813) [ 664.238426][ T9627] ? __might_fault (mm/memory.c:7217 (discriminator 4)) [ 664.238429][ T9627] ? __might_fault (mm/memory.c:7217 (discriminator 4)) [ 664.238431][ T9627] __sys_sendto (net/socket.c:730 (discriminator 1) net/socket.c:742 (discriminator 1) net/socket.c:2205 (discriminator 1)) [ 664.238435][ T9627] ? __ia32_sys_getpeername (net/socket.c:2172) [ 664.238440][ T9627] ? exc_page_fault (./arch/x86/include/asm/irqflags.h:26 ./arch/x86/include/asm/irqflags.h:109 ./arch/x86/include/asm/irqflags.h:151 arch/x86/mm/fault.c:1480 arch/x86/mm/fault.c:1527) [ 664.238445][ T9627] __x64_sys_sendto (net/socket.c:2212 (discriminator 1) net/socket.c:2208 (discriminator 1) net/socket.c:2208 (discriminator 1)) [ 664.238448][ T9627] ? trace_irq_enable.constprop.0 (./include/trace/events/preemptirq.h:40 (discriminator 33)) [ 664.238451][ T9627] ? lockdep_hardirqs_on (kernel/locking/lockdep.c:4473) [ 664.238452][ T9627] ? do_syscall_64 (./arch/x86/include/asm/irqflags.h:42 ./arch/x86/include/asm/irqflags.h:119 ./include/linux/entry-common.h:186 arch/x86/entry/syscall_64.c:90) [ 664.238454][ T9627] do_syscall_64 (arch/x86/entry/syscall_64.c:63 (discriminator 1) arch/x86/entry/syscall_64.c:94 (discriminator 1)) [ 664.238455][ T9627] ? exc_page_fault (arch/x86/mm/fault.c:1480 (discriminator 3) arch/x86/mm/fault.c:1527 (discriminator 3)) [ 664.238457][ T9627] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130) [ 664.238460][ T9627] RIP: 0033:0x7f2a483e7c5e [ 664.238463][ T9627] Code: 4d 89 d8 e8 34 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 c3 83 e2 39 83 fa 08 75 e7 e8 13 ff ff ff 0f 1f 00 f3 0f 1e fa All code ======== 0: 4d 89 d8 mov %r11,%r8 3: e8 34 bd 00 00 call 0xbd3c 8: 4c 8b 5d f8 mov -0x8(%rbp),%r11 c: 41 8b 93 08 03 00 00 mov 0x308(%r11),%edx 13: 59 pop %rcx 14: 5e pop %rsi 15: 48 83 f8 fc cmp $0xfffffffffffffffc,%rax 19: 74 11 je 0x2c 1b: c9 leave 1c: c3 ret 1d: 0f 1f 80 00 00 00 00 nopl 0x0(%rax) 24: 48 8b 45 10 mov 0x10(%rbp),%rax 28: 0f 05 syscall 2a:* c9 leave <-- trapping instruction 2b: c3 ret 2c: 83 e2 39 and $0x39,%edx 2f: 83 fa 08 cmp $0x8,%edx 32: 75 e7 jne 0x1b 34: e8 13 ff ff ff call 0xffffffffffffff4c 39: 0f 1f 00 nopl (%rax) 3c: f3 0f 1e fa endbr64 Code starting with the faulting instruction =========================================== 0: c9 leave 1: c3 ret 2: 83 e2 39 and $0x39,%edx 5: 83 fa 08 cmp $0x8,%edx 8: 75 e7 jne 0xfffffffffffffff1 a: e8 13 ff ff ff call 0xffffffffffffff22 f: 0f 1f 00 nopl (%rax) 12: f3 0f 1e fa endbr64 [ 664.238465][ T9627] RSP: 002b:00007fffb28b68c0 EFLAGS: 00000202 ORIG_RAX: 000000000000002c [ 664.238469][ T9627] RAX: ffffffffffffffda RBX: 000000002a695310 RCX: 00007f2a483e7c5e [ 664.238471][ T9627] RDX: 0000000000000014 RSI: 000000002a695530 RDI: 0000000000000005 [ 664.238472][ T9627] RBP: 00007fffb28b68d0 R08: 00007f2a48672980 R09: 000000000000000c [ 664.238473][ T9627] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000407ef0 Finger prints: print_report:kasan_report:devlink_nl_dumpit:genl_dumpit:netlink_dump