KASAN: use-after-free Read in sctp_outq_select_transport

[syzbot <syzbot+56a40ceee5fb35932f4d@syzkaller.appspotmail.com>]

Hello,

syzbot found the following crash on:

HEAD commit:    23469de647c4 Merge git://git.kernel.org/pub/scm/linux/kern..
git tree:       net
console output: https://syzkaller.appspot.com/x/log.txt?x\x13580ce5400000
kernel config:  https://syzkaller.appspot.com/x/.config?x³f55cb3dfcc6c33
dashboard link: https://syzkaller.appspot.com/bug?extidVa40ceee5fb35932f4d
compiler:       gcc (GCC) 8.0.1 20180413 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+56a40ceee5fb35932f4d@syzkaller.appspotmail.com

=================================
BUG: KASAN: use-after-free in sctp_outq_select_transport+0x77e/0x9a0  
net/sctp/outqueue.c:840
Read of size 4 at addr ffff8801c5ff2614 by task syz-executor5/8275

CPU: 0 PID: 8275 Comm: syz-executor5 Not tainted 4.19.0-rc8+ #152
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS  
Google 01/01/2011
Call Trace:
  <IRQ>
  __dump_stack lib/dump_stack.c:77 [inline]
  dump_stack+0x1c4/0x2b6 lib/dump_stack.c:113
  print_address_description.cold.8+0x9/0x1ff mm/kasan/report.c:256
  kasan_report_error mm/kasan/report.c:354 [inline]
  kasan_report.cold.9+0x242/0x309 mm/kasan/report.c:412
  __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:432
  sctp_outq_select_transport+0x77e/0x9a0 net/sctp/outqueue.c:840
  sctp_outq_flush_data net/sctp/outqueue.c:1100 [inline]
  sctp_outq_flush+0x14f7/0x34f0 net/sctp/outqueue.c:1209
  sctp_outq_uncork+0x6a/0x80 net/sctp/outqueue.c:776
  sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1820 [inline]
  sctp_side_effects net/sctp/sm_sideeffect.c:1220 [inline]
  sctp_do_sm+0x608/0x7190 net/sctp/sm_sideeffect.c:1191
  sctp_assoc_bh_rcv+0x346/0x670 net/sctp/associola.c:1067
  sctp_inq_push+0x280/0x370 net/sctp/inqueue.c:95
  sctp_rcv+0x2d93/0x3c00 net/sctp/input.c:268
  sctp6_rcv+0x15/0x30 net/sctp/ipv6.c:1061
  ip6_input_finish+0x3fc/0x1aa0 net/ipv6/ip6_input.c:383
  NF_HOOK include/linux/netfilter.h:289 [inline]
  ip6_input+0xe9/0x600 net/ipv6/ip6_input.c:426
  dst_input include/net/dst.h:450 [inline]
  ip6_rcv_finish+0x17a/0x330 net/ipv6/ip6_input.c:76
  NF_HOOK include/linux/netfilter.h:289 [inline]
  ipv6_rcv+0x120/0x640 net/ipv6/ip6_input.c:271
  __netif_receive_skb_one_core+0x14d/0x200 net/core/dev.c:4913
  __netif_receive_skb+0x2c/0x1e0 net/core/dev.c:5023
  process_backlog+0x218/0x6f0 net/core/dev.c:5829
  napi_poll net/core/dev.c:6249 [inline]
  net_rx_action+0x7c5/0x1950 net/core/dev.c:6315
IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready
  __do_softirq+0x30c/0xb03 kernel/softirq.c:292
  do_softirq_own_stack+0x2a/0x40 arch/x86/entry/entry_64.S:1047
  </IRQ>
  do_softirq.part.13+0x126/0x160 kernel/softirq.c:336
  do_softirq kernel/softirq.c:328 [inline]
  __local_bh_enable_ip+0x21d/0x260 kernel/softirq.c:189
  local_bh_enable include/linux/bottom_half.h:32 [inline]
  rcu_read_unlock_bh include/linux/rcupdate.h:723 [inline]
  ip6_finish_output2+0xce4/0x27a0 net/ipv6/ip6_output.c:121
  ip6_finish_output+0x58c/0xc60 net/ipv6/ip6_output.c:154
  NF_HOOK_COND include/linux/netfilter.h:278 [inline]
  ip6_output+0x232/0x9d0 net/ipv6/ip6_output.c:171
  dst_output include/net/dst.h:444 [inline]
  NF_HOOK include/linux/netfilter.h:289 [inline]
  ip6_xmit+0xf69/0x2420 net/ipv6/ip6_output.c:275
  sctp_v6_xmit+0x3b2/0x790 net/sctp/ipv6.c:230
  sctp_packet_transmit+0x298e/0x3db0 net/sctp/output.c:656
  sctp_packet_singleton net/sctp/outqueue.c:791 [inline]
  sctp_outq_flush_ctrl.constprop.11+0x7a9/0xe50 net/sctp/outqueue.c:922
  sctp_outq_flush+0x310/0x34f0 net/sctp/outqueue.c:1204
  sctp_outq_uncork+0x6a/0x80 net/sctp/outqueue.c:776
kobject: 'rfkill9' (0000000067be229d): fill_kobj_path: path  
= '/devices/virtual/mac80211_hwsim/hwsim7/ieee80211/phy7/rfkill9'
  sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1349 [inline]
  sctp_side_effects net/sctp/sm_sideeffect.c:1220 [inline]
  sctp_do_sm+0x4f25/0x7190 net/sctp/sm_sideeffect.c:1191
ieee80211 phy7: Selected rate control algorithm 'minstrel_ht'
kobject: 'net' (00000000cdd117dc): kobject_add_internal: parent: 'hwsim7',  
set: '(null)'
  sctp_endpoint_bh_rcv+0x465/0x960 net/sctp/endpointola.c:456
kobject: 'wlan0' (00000000c9d333fc): kobject_add_internal: parent: 'net',  
set: 'devices'
  sctp_inq_push+0x280/0x370 net/sctp/inqueue.c:95
  sctp_backlog_rcv+0x1a8/0xd50 net/sctp/input.c:351
kobject: 'wlan0' (00000000c9d333fc): kobject_uevent_env
kobject: 'wlan0' (00000000c9d333fc): fill_kobj_path: path  
= '/devices/virtual/mac80211_hwsim/hwsim7/net/wlan0'
  sk_backlog_rcv include/net/sock.h:931 [inline]
  __release_sock+0x12f/0x3a0 net/core/sock.c:2336
kobject: 'queues' (00000000c5d009e9): kobject_add_internal:  
parent: 'wlan0', set: '<NULL>'
  release_sock+0xad/0x2c0 net/core/sock.c:2849
  sock_setsockopt+0x60d/0x2280 net/core/sock.c:1054
kobject: 'queues' (00000000c5d009e9): kobject_uevent_env
kobject: 'queues' (00000000c5d009e9): kobject_uevent_env: filter function  
caused the event to drop!
  __sys_setsockopt+0x304/0x3c0 net/socket.c:1898
kobject: 'rx-0' (000000007736ba36): kobject_add_internal: parent: 'queues',  
set: 'queues'
  __do_sys_setsockopt net/socket.c:1913 [inline]
  __se_sys_setsockopt net/socket.c:1910 [inline]
  __x64_sys_setsockopt+0xbe/0x150 net/socket.c:1910
  do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
kobject: 'rx-0' (000000007736ba36): kobject_uevent_env
  entry_SYSCALL_64_after_hwframe+0x49/0xbe
kobject: 'rx-0' (000000007736ba36): fill_kobj_path: path  
= '/devices/virtual/mac80211_hwsim/hwsim7/net/wlan0/queues/rx-0'
RIP: 0033:0x457569
Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7  
48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff  
ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f0613beec78 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000000457569
RDX: 000000000000001a RSI: 0000000000000001 RDI: 0000000000000003
RBP: 000000000072c040 R08: 0000000000000010 R09: 0000000000000000
R10: 00000000200000c0 R11: 0000000000000246 R12: 00007f0613bef6d4
R13: 00000000004c3b61 R14: 00000000004d5c88 R15: 00000000ffffffff

Allocated by task 8261:
  save_stack+0x43/0xd0 mm/kasan/kasan.c:448
kobject: 'tx-0' (000000008f0eae4c): kobject_add_internal: parent: 'queues',  
set: 'queues'
  set_track mm/kasan/kasan.c:460 [inline]
  kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:553
  kmem_cache_alloc_trace+0x152/0x750 mm/slab.c:3620
  kmalloc include/linux/slab.h:513 [inline]
  kzalloc include/linux/slab.h:707 [inline]
  sctp_transport_new+0x10a/0x880 net/sctp/transport.c:111
  sctp_assoc_add_peer+0x2de/0x10d0 net/sctp/associola.c:630
  sctp_process_param net/sctp/sm_make_chunk.c:2540 [inline]
  sctp_process_init+0xfc0/0x29e0 net/sctp/sm_make_chunk.c:2356
  sctp_cmd_process_init net/sctp/sm_sideeffect.c:682 [inline]
  sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1410 [inline]
  sctp_side_effects net/sctp/sm_sideeffect.c:1220 [inline]
  sctp_do_sm+0x13b9/0x7190 net/sctp/sm_sideeffect.c:1191
  sctp_assoc_bh_rcv+0x346/0x670 net/sctp/associola.c:1067
  sctp_inq_push+0x280/0x370 net/sctp/inqueue.c:95
  sctp_backlog_rcv+0x1a8/0xd50 net/sctp/input.c:351
  sk_backlog_rcv include/net/sock.h:931 [inline]
  __release_sock+0x12f/0x3a0 net/core/sock.c:2336
kobject: 'tx-0' (000000008f0eae4c): kobject_uevent_env
  release_sock+0xad/0x2c0 net/core/sock.c:2849
  sctp_wait_for_connect+0x391/0x640 net/sctp/socket.c:8667
  sctp_sendmsg_to_asoc+0x1d0f/0x2230 net/sctp/socket.c:1985
  sctp_sendmsg+0x13c2/0x1da0 net/sctp/socket.c:2131
  inet_sendmsg+0x1a1/0x690 net/ipv4/af_inet.c:798
  sock_sendmsg_nosec net/socket.c:621 [inline]
  sock_sendmsg+0xd5/0x120 net/socket.c:631
  __sys_sendto+0x3d7/0x670 net/socket.c:1788
  __do_sys_sendto net/socket.c:1800 [inline]
  __se_sys_sendto net/socket.c:1796 [inline]
  __x64_sys_sendto+0xe1/0x1a0 net/socket.c:1796
  do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
  entry_SYSCALL_64_after_hwframe+0x49/0xbe
kobject: 'tx-0' (000000008f0eae4c): fill_kobj_path: path  
= '/devices/virtual/mac80211_hwsim/hwsim7/net/wlan0/queues/tx-0'

Freed by task 9:
  save_stack+0x43/0xd0 mm/kasan/kasan.c:448
  set_track mm/kasan/kasan.c:460 [inline]
  __kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
  kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
  __cache_free mm/slab.c:3498 [inline]
  kfree+0xcf/0x230 mm/slab.c:3813
  sctp_transport_destroy_rcu+0x4a/0x60 net/sctp/transport.c:163
  __rcu_reclaim kernel/rcu/rcu.h:236 [inline]
  rcu_do_batch kernel/rcu/tree.c:2576 [inline]
  invoke_rcu_callbacks kernel/rcu/tree.c:2880 [inline]
  __rcu_process_callbacks kernel/rcu/tree.c:2847 [inline]
  rcu_process_callbacks+0xf23/0x2670 kernel/rcu/tree.c:2864
  __do_softirq+0x30c/0xb03 kernel/softirq.c:292
kobject: 'tx-1' (000000009aaee194): kobject_add_internal: parent: 'queues',  
set: 'queues'

The buggy address belongs to the object at ffff8801c5ff24c0
  which belongs to the cache kmalloc-1024 of size 1024
The buggy address is located 340 bytes inside of
  1024-byte region [ffff8801c5ff24c0, ffff8801c5ff28c0)
The buggy address belongs to the page:
page:ffffea000717fc80 count:1 mapcount:0 mapping:ffff8801da800ac0 index:0x0  
compound_mapcount: 0
flags: 0x2fffc0000008100(slab|head)
raw: 02fffc0000008100 ffffea00070ed808 ffffea00071b2488 ffff8801da800ac0
raw: 0000000000000000 ffff8801c5ff2040 0000000100000007 0000000000000000
kobject: 'tx-1' (000000009aaee194): kobject_uevent_env
page dumped because: kasan: bad access detected

Memory state around the buggy address:
  ffff8801c5ff2500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  ffff8801c5ff2580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> ffff8801c5ff2600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                          ^
  ffff8801c5ff2680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
  ffff8801c5ff2700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
=================================


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#bug-status-tracking for how to communicate with  
syzbot.