Re: [syzbot] [kernel?] general protection fault in put_ipc_ns

[syzbot <syzbot+b4c65e7d749285a82467@syzkaller.appspotmail.com>]

Hello,

syzbot tried to test the proposed patch but the build/boot failed:

wner.h:32 [inline]
 post_alloc_hook+0x240/0x2a0 mm/page_alloc.c:1851
 prep_new_page mm/page_alloc.c:1859 [inline]
 get_page_from_freelist+0x2365/0x2440 mm/page_alloc.c:3920
 __alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5215
 alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2486
 alloc_slab_page mm/slub.c:3075 [inline]
 allocate_slab+0x86/0x3b0 mm/slub.c:3248
 new_slab mm/slub.c:3302 [inline]
 ___slab_alloc+0xf56/0x1990 mm/slub.c:4651
 __slab_alloc+0x65/0x100 mm/slub.c:4774
 __slab_alloc_node mm/slub.c:4850 [inline]
 slab_alloc_node mm/slub.c:5246 [inline]
 kmem_cache_alloc_node_noprof+0x4ce/0x710 mm/slub.c:5310
 __alloc_skb+0x112/0x2d0 net/core/skbuff.c:664
 alloc_skb include/linux/skbuff.h:1383 [inline]
 alloc_skb_with_frags+0xca/0x890 net/core/skbuff.c:6694
 sock_alloc_send_pskb+0x84d/0x980 net/core/sock.c:2995
 unix_dgram_sendmsg+0x461/0x1850 net/unix/af_unix.c:2133
 sock_sendmsg_nosec net/socket.c:727 [inline]
 __sock_sendmsg+0x21c/0x270 net/socket.c:746
 sock_write_iter+0x279/0x360 net/socket.c:1199
 new_sync_write fs/read_write.c:593 [inline]
 vfs_write+0x5c9/0xb30 fs/read_write.c:686
 ksys_write+0x145/0x250 fs/read_write.c:738
page last free pid 5214 tgid 5214 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1395 [inline]
 __free_frozen_pages+0xbc8/0xd30 mm/page_alloc.c:2948
 discard_slab mm/slub.c:3346 [inline]
 __put_partials+0x146/0x170 mm/slub.c:3886
 put_cpu_partial+0x1f2/0x2e0 mm/slub.c:3961
 __slab_free+0x288/0x2a0 mm/slub.c:5947
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x97/0x100 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:349
 kasan_slab_alloc include/linux/kasan.h:252 [inline]
 slab_post_alloc_hook mm/slub.c:4948 [inline]
 slab_alloc_node mm/slub.c:5258 [inline]
 kmem_cache_alloc_noprof+0x37d/0x700 mm/slub.c:5265
 getname_flags+0xb8/0x540 fs/namei.c:146
 getname include/linux/fs.h:2499 [inline]
 __do_sys_unlink fs/namei.c:5443 [inline]
 __se_sys_unlink fs/namei.c:5441 [inline]
 __x64_sys_unlink+0x3a/0x50 fs/namei.c:5441
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0xfa/0xfa0 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
 ffff888026cc1f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff888026cc1f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888026cc2000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                        ^
 ffff888026cc2080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
 ffff888026cc2100: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
==================================================================


Warning: Permanently added '10.128.1.28' (ED25519) to the list of known hosts.
2025/11/18 16:42:46 parsed 1 programs
[   77.911157][ T5835] cgroup: Unknown subsys name 'net'
[   78.100415][ T5835] cgroup: Unknown subsys name 'cpuset'
[   78.109439][ T5835] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   79.572711][ T5835] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   82.581196][ T5849] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   83.370499][   T52] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   83.379285][   T52] ==================================================================
[   83.387460][   T52] BUG: KASAN: slab-use-after-free in hci_cmd_work+0x5d0/0x7b0
[   83.395076][   T52] Read of size 2 at addr ffff888026cc2038 by task kworker/u9:0/52
[   83.402866][   T52] 
[   83.405398][   T52] CPU: 0 UID: 0 PID: 52 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT(full) 
[   83.405421][   T52] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[   83.405433][   T52] Workqueue: hci0 hci_cmd_work
[   83.405462][   T52] Call Trace:
[   83.405472][   T52]  <TASK>
[   83.405480][   T52]  dump_stack_lvl+0x189/0x250
[   83.405503][   T52]  ? __virt_addr_valid+0x1c8/0x5c0
[   83.405525][   T52]  ? rcu_is_watching+0x15/0xb0
[   83.405546][   T52]  ? __pfx_dump_stack_lvl+0x10/0x10
[   83.405565][   T52]  ? rcu_is_watching+0x15/0xb0
[   83.405589][   T52]  ? lock_release+0x4b/0x3d0
[   83.405606][   T52]  ? _raw_spin_lock_irqsave+0xb3/0xf0
[   83.405628][   T52]  ? __virt_addr_valid+0x1c8/0x5c0
[   83.405650][   T52]  ? __virt_addr_valid+0x4a5/0x5c0
[   83.405672][   T52]  print_report+0xca/0x240
[   83.405693][   T52]  ? hci_cmd_work+0x5d0/0x7b0
[   83.405708][   T52]  kasan_report+0x118/0x150
[   83.405727][   T52]  ? hci_cmd_work+0x5d0/0x7b0
[   83.405746][   T52]  hci_cmd_work+0x5d0/0x7b0
[   83.405763][   T52]  ? process_one_work+0x868/0x15e0
[   83.405780][   T52]  process_one_work+0x93a/0x15e0
[   83.405796][   T52]  ? __lock_acquire+0xab9/0xd20
[   83.405821][   T52]  ? __pfx_process_one_work+0x10/0x10
[   83.405847][   T52]  ? assign_work+0x3a1/0x410
[   83.405866][   T52]  worker_thread+0x9b0/0xee0
[   83.405894][   T52]  kthread+0x711/0x8a0
[   83.405916][   T52]  ? __pfx_worker_thread+0x10/0x10
[   83.405933][   T52]  ? __pfx_kthread+0x10/0x10
[   83.405954][   T52]  ? _raw_spin_unlock_irq+0x23/0x50
[   83.405974][   T52]  ? lockdep_hardirqs_on+0x9c/0x150
[   83.405994][   T52]  ? __pfx_kthread+0x10/0x10
[   83.406014][   T52]  ret_from_fork+0x599/0xb30
[   83.406031][   T52]  ? __pfx_ret_from_fork+0x10/0x10
[   83.406052][   T52]  ? __switch_to_asm+0x39/0x70
[   83.406071][   T52]  ? __switch_to_asm+0x33/0x70
[   83.406089][   T52]  ? __pfx_kthread+0x10/0x10
[   83.406108][   T52]  ret_from_fork_asm+0x1a/0x30
[   83.406134][   T52]  </TASK>
[   83.406140][   T52] 
[   83.596214][   T52] Allocated by task 5153:
[   83.600520][   T52]  kasan_save_track+0x3e/0x80
[   83.605447][   T52]  __kasan_slab_alloc+0x6c/0x80
[   83.610281][   T52]  kmem_cache_alloc_node_noprof+0x43c/0x710
[   83.616165][   T52]  __alloc_skb+0x112/0x2d0
[   83.620656][   T52]  hci_cmd_sync_alloc+0x3d/0x3b0
[   83.625587][   T52]  __hci_cmd_sync_sk+0x1a7/0xc70
[   83.630510][   T52]  hci_dev_open_sync+0x14b2/0x2dc0
[   83.635611][   T52]  hci_power_on+0x1b4/0x720
[   83.640096][   T52]  process_one_work+0x93a/0x15e0
[   83.645018][   T52]  worker_thread+0x9b0/0xee0
[   83.649608][   T52]  kthread+0x711/0x8a0
[   83.653664][   T52]  ret_from_fork+0x599/0xb30
[   83.658235][   T52]  ret_from_fork_asm+0x1a/0x30
[   83.662995][   T52] 
[   83.665303][   T52] Freed by task 5872:
[   83.669262][   T52]  kasan_save_track+0x3e/0x80
[   83.673926][   T52]  kasan_save_free_info+0x46/0x50
[   83.678939][   T52]  __kasan_slab_free+0x5c/0x80
[   83.683696][   T52]  kmem_cache_free+0x197/0x640
[   83.688457][   T52]  vhci_read+0x49a/0x5b0
[   83.692698][   T52]  vfs_read+0x200/0xa30
[   83.696838][   T52]  ksys_read+0x145/0x250
[   83.701073][   T52]  do_syscall_64+0xfa/0xfa0
[   83.705583][   T52]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   83.711460][   T52] 
[   83.713772][   T52] The buggy address belongs to the object at ffff888026cc2000
[   83.713772][   T52]  which belongs to the cache skbuff_head_cache of size 240
[   83.728331][   T52] The buggy address is located 56 bytes inside of
[   83.728331][   T52]  freed 240-byte region [ffff888026cc2000, ffff888026cc20f0)
[   83.742126][   T52] 
[   83.744521][   T52] The buggy address belongs to the physical page:
[   83.750927][   T52] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x26cc2
[   83.759756][   T52] anon flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
[   83.767296][   T52] page_type: f5(slab)
[   83.771275][   T52] raw: 00fff00000000000 ffff88801eaa0000 ffffea0000c96dc0 dead000000000005
[   83.779887][   T52] raw: 0000000000000000 00000000000c000c 00000000f5000000 0000000000000000
[   83.788446][   T52] page dumped because: kasan: bad access detected
[   83.794846][   T52] page_owner tracks the page as allocated
[   83.800544][   T52] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5214, tgid 5214 (udevd), ts 26976681464, free_ts 26965856314
[   83.819365][   T52]  post_alloc_hook+0x240/0x2a0
[   83.824127][   T52]  get_page_from_freelist+0x2365/0x2440
[   83.829660][   T52]  __alloc_frozen_pages_noprof+0x181/0x370
[   83.835551][   T52]  alloc_pages_mpol+0x232/0x4a0
[   83.840387][   T52]  allocate_slab+0x86/0x3b0
[   83.845242][   T52]  ___slab_alloc+0xf56/0x1990
[   83.850075][   T52]  __slab_alloc+0x65/0x100
[   83.854564][   T52]  kmem_cache_alloc_node_noprof+0x4ce/0x710
[   83.860637][   T52]  __alloc_skb+0x112/0x2d0
[   83.865136][   T52]  alloc_skb_with_frags+0xca/0x890
[   83.870326][   T52]  sock_alloc_send_pskb+0x84d/0x980
[   83.875506][   T52]  unix_dgram_sendmsg+0x461/0x1850
[   83.880599][   T52]  __sock_sendmsg+0x21c/0x270
[   83.885356][   T52]  sock_write_iter+0x279/0x360
[   83.890116][   T52]  vfs_write+0x5c9/0xb30
[   83.894341][   T52]  ksys_write+0x145/0x250
[   83.898656][   T52] page last free pid 5214 tgid 5214 stack trace:
[   83.904967][   T52]  __free_frozen_pages+0xbc8/0xd30
[   83.910059][   T52]  __put_partials+0x146/0x170
[   83.914719][   T52]  put_cpu_partial+0x1f2/0x2e0
[   83.919482][   T52]  __slab_free+0x288/0x2a0
[   83.923881][   T52]  qlist_free_all+0x97/0x100
[   83.928451][   T52]  kasan_quarantine_reduce+0x148/0x160
[   83.933889][   T52]  __kasan_slab_alloc+0x22/0x80
[   83.938724][   T52]  kmem_cache_alloc_noprof+0x37d/0x700
[   83.944169][   T52]  getname_flags+0xb8/0x540
[   83.949091][   T52]  __x64_sys_unlink+0x3a/0x50
[   83.953753][   T52]  do_syscall_64+0xfa/0xfa0
[   83.958248][   T52]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[   83.964121][   T52] 
[   83.966513][   T52] Memory state around the buggy address:
[   83.972122][   T52]  ffff888026cc1f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   83.980166][   T52]  ffff888026cc1f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   83.988209][   T52] >ffff888026cc2000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[   83.996247][   T52]                                         ^
[   84.002117][   T52]  ffff888026cc2080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
[   84.010260][   T52]  ffff888026cc2100: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
[   84.018310][   T52] ==================================================================
[   84.028479][   T52] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[   84.035707][   T52] CPU: 0 UID: 0 PID: 52 Comm: kworker/u9:0 Not tainted syzkaller #0 PREEMPT(full) 
[   84.045006][   T52] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025
[   84.055073][   T52] Workqueue: hci0 hci_cmd_work
[   84.059922][   T52] Call Trace:
[   84.063190][   T52]  <TASK>
[   84.066239][   T52]  dump_stack_lvl+0x99/0x250
[   84.070829][   T52]  ? __asan_memcpy+0x40/0x70
[   84.075506][   T52]  ? __pfx_dump_stack_lvl+0x10/0x10
[   84.080870][   T52]  ? __pfx__printk+0x10/0x10
[   84.085484][   T52]  vpanic+0x237/0x6d0
[   84.089714][   T52]  ? __pfx_vpanic+0x10/0x10
[   84.094201][   T52]  ? preempt_schedule+0xae/0xc0
[   84.099051][   T52]  ? __pfx_preempt_schedule+0x10/0x10
[   84.104414][   T52]  panic+0xb9/0xc0
[   84.108124][   T52]  ? __pfx_panic+0x10/0x10
[   84.112524][   T52]  ? _raw_spin_unlock_irqrestore+0xfd/0x110
[   84.118490][   T52]  ? is_module_address+0x17/0xf0
[   84.123408][   T52]  ? hci_cmd_work+0x5d0/0x7b0
[   84.128066][   T52]  check_panic_on_warn+0x89/0xb0
[   84.132990][   T52]  ? hci_cmd_work+0x5d0/0x7b0
[   84.137758][   T52]  end_report+0x6f/0x160
[   84.142068][   T52]  kasan_report+0x129/0x150
[   84.146646][   T52]  ? hci_cmd_work+0x5d0/0x7b0
[   84.151307][   T52]  hci_cmd_work+0x5d0/0x7b0
[   84.155922][   T52]  ? process_one_work+0x868/0x15e0
[   84.161061][   T52]  process_one_work+0x93a/0x15e0
[   84.165992][   T52]  ? __lock_acquire+0xab9/0xd20
[   84.170840][   T52]  ? __pfx_process_one_work+0x10/0x10
[   84.176283][   T52]  ? assign_work+0x3a1/0x410
[   84.180884][   T52]  worker_thread+0x9b0/0xee0
[   84.185468][   T52]  kthread+0x711/0x8a0
[   84.189525][   T52]  ? __pfx_worker_thread+0x10/0x10
[   84.194622][   T52]  ? __pfx_kthread+0x10/0x10
[   84.199211][   T52]  ? _raw_spin_unlock_irq+0x23/0x50
[   84.204412][   T52]  ? lockdep_hardirqs_on+0x9c/0x150
[   84.209605][   T52]  ? __pfx_kthread+0x10/0x10
[   84.214279][   T52]  ret_from_fork+0x599/0xb30
[   84.218867][   T52]  ? __pfx_ret_from_fork+0x10/0x10
[   84.223975][   T52]  ? __switch_to_asm+0x39/0x70
[   84.228816][   T52]  ? __switch_to_asm+0x33/0x70
[   84.233568][   T52]  ? __pfx_kthread+0x10/0x10
[   84.238153][   T52]  ret_from_fork_asm+0x1a/0x30
[   84.242913][   T52]  </TASK>
[   84.246435][   T52] Kernel Offset: disabled
[   84.250827][   T52] Rebooting in 86400 seconds..


syzkaller build log:
go env (err=<nil>)
AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE='auto'
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/syzkaller/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/syzkaller/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build3917061150=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/syzkaller/jobs-2/linux/gopath/src/github.com/google/syzkaller/go.mod'
GOMODCACHE='/syzkaller/jobs-2/linux/gopath/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/syzkaller/jobs-2/linux/gopath'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/usr/local/go'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/syzkaller/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/usr/local/go/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.24.4'
GOWORK=''
PKG_CONFIG='pkg-config'

git status (err=<nil>)
HEAD detached at 07e030dea
nothing to commit, working tree clean


tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
go list -f '{{.Stale}}' -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=07e030dea6e6d9ca88b75bb3be2810f47083b328 -X github.com/google/syzkaller/prog.gitRevisionDate=20251112-115923"  ./sys/syz-sysgen | grep -q false || go install -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=07e030dea6e6d9ca88b75bb3be2810f47083b328 -X github.com/google/syzkaller/prog.gitRevisionDate=20251112-115923"  ./sys/syz-sysgen
make .descriptions
tput: No value for $TERM and no -T specified
tput: No value for $TERM and no -T specified
Makefile:31: run command via tools/syz-env for best compatibility, see:
Makefile:32: https://github.com/google/syzkaller/blob/master/docs/contributing.md#using-syz-env
bin/syz-sysgen
touch .descriptions
GOOS=linux GOARCH=amd64 go build -ldflags="-s -w -X github.com/google/syzkaller/prog.GitRevision=07e030dea6e6d9ca88b75bb3be2810f47083b328 -X github.com/google/syzkaller/prog.gitRevisionDate=20251112-115923"  -o ./bin/linux_amd64/syz-execprog github.com/google/syzkaller/tools/syz-execprog
mkdir -p ./bin/linux_amd64
g++ -o ./bin/linux_amd64/syz-executor executor/executor.cc \
	-m64 -O2 -pthread -Wall -Werror -Wparentheses -Wunused-const-variable -Wframe-larger-than=16384 -Wno-stringop-overflow -Wno-array-bounds -Wno-format-overflow -Wno-unused-but-set-variable -Wno-unused-command-line-argument -static-pie -std=c++17 -I. -Iexecutor/_include   -DGOOS_linux=1 -DGOARCH_amd64=1 \
	-DHOSTGOOS_linux=1 -DGIT_REVISION=\"07e030dea6e6d9ca88b75bb3be2810f47083b328\"
/usr/bin/ld: /tmp/ccEzlJr7.o: in function `Connection::Connect(char const*, char const*)':
executor.cc:(.text._ZN10Connection7ConnectEPKcS1_[_ZN10Connection7ConnectEPKcS1_]+0x104): warning: Using 'gethostbyname' in statically linked applications requires at runtime the shared libraries from the glibc version used for linking
./tools/check-syzos.sh 2>/dev/null


Error text is too large and was truncated, full error text is at:
https://syzkaller.appspot.com/x/error.txt?x=12a13212580000


Tested on:

commit:         187dac29 Add linux-next specific files for 20251118
git tree:       linux-next
kernel config:  https://syzkaller.appspot.com/x/.config?x=f3aa05e175a53177
dashboard link: https://syzkaller.appspot.com/bug?extid=b4c65e7d749285a82467
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
patch:          https://syzkaller.appspot.com/x/patch.diff?x=1345fb42580000