Hi, I've got the following error report while fuzzing the kernel with syzkaller. On commit a71c9a1c779f2499fb2afc0553e543f18aff6edf (4.11-rc5). A reproducer and .config are attached. ------------[ cut here ]------------ WARNING: CPU: 0 PID: 4033 at lib/list_debug.c:31 __list_add_valid+0xca/0x120 list_add double add: new=ffff8800681b1198, prev=ffff8800681b1198, next=ffff880067316098. Modules linked in: CPU: 0 PID: 4033 Comm: a.out Not tainted 4.11.0-rc5+ #199 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:16 dump_stack+0x292/0x398 lib/dump_stack.c:52 __warn+0x19f/0x1e0 kernel/panic.c:549 warn_slowpath_fmt+0xe0/0x120 kernel/panic.c:564 __list_add_valid+0xca/0x120 lib/list_debug.c:29 __list_add ./include/linux/list.h:59 list_add_tail ./include/linux/list.h:92 sctp_endpoint_add_asoc+0x161/0x3e0 net/sctp/endpointola.c:220 sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1293 sctp_side_effects net/sctp/sm_sideeffect.c:1175 sctp_do_sm+0x21b5/0x6a50 net/sctp/sm_sideeffect.c:1147 sctp_primitive_ASSOCIATE+0x9d/0xd0 net/sctp/primitive.c:88 sctp_sendmsg+0x26ec/0x3b20 net/sctp/socket.c:1954 inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:762 sock_sendmsg_nosec net/socket.c:633 sock_sendmsg+0xca/0x110 net/socket.c:643 ___sys_sendmsg+0xa73/0xb90 net/socket.c:1997 __sys_sendmsg+0x138/0x320 net/socket.c:2031 SYSC_sendmsg net/socket.c:2042 SyS_sendmsg+0x2d/0x50 net/socket.c:2038 entry_SYSCALL_64_fastpath+0x1f/0xc2 arch/x86/entry/entry_64.S:204 RIP: 0033:0x7f19dd797b79 RSP: 002b:00007f19da6b5d98 EFLAGS: 00000206 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f19da6b69c0 RCX: 00007f19dd797b79 RDX: 0000000000004000 RSI: 000000002047a000 RDI: 0000000000000003 RBP: 00007f19ddc63220 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 00007f19da6b69c0 R14: 00007f19de08e040 R15: 0000000000000003 ---[ end trace 19c5e4b11b8569c4 ]--- ================================================================== BUG: KASAN: use-after-free in sctp_do_sm+0x6704/0x6a50 at addr ffff8800681b13c0 Read of size 8 by task a.out/4033 CPU: 1 PID: 4033 Comm: a.out Tainted: G W 4.11.0-rc5+ #199 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:16 dump_stack+0x292/0x398 lib/dump_stack.c:52 kasan_object_err+0x1c/0x70 mm/kasan/report.c:164 print_address_description mm/kasan/report.c:202 kasan_report_error mm/kasan/report.c:291 kasan_report+0x252/0x510 mm/kasan/report.c:347 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:368 sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1514 sctp_side_effects net/sctp/sm_sideeffect.c:1175 sctp_do_sm+0x6704/0x6a50 net/sctp/sm_sideeffect.c:1147 sctp_primitive_ASSOCIATE+0x9d/0xd0 net/sctp/primitive.c:88 sctp_sendmsg+0x26ec/0x3b20 net/sctp/socket.c:1954 inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:762 sock_sendmsg_nosec net/socket.c:633 sock_sendmsg+0xca/0x110 net/socket.c:643 ___sys_sendmsg+0xa73/0xb90 net/socket.c:1997 __sys_sendmsg+0x138/0x320 net/socket.c:2031 SYSC_sendmsg net/socket.c:2042 SyS_sendmsg+0x2d/0x50 net/socket.c:2038 entry_SYSCALL_64_fastpath+0x1f/0xc2 arch/x86/entry/entry_64.S:204 RIP: 0033:0x7f19dd797b79 RSP: 002b:00007f19da6b5d98 EFLAGS: 00000206 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007f19da6b69c0 RCX: 00007f19dd797b79 RDX: 0000000000004000 RSI: 000000002047a000 RDI: 0000000000000003 RBP: 00007f19ddc63220 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 00007f19da6b69c0 R14: 00007f19de08e040 R15: 0000000000000003 Object at ffff8800681b1100, in cache kmalloc-4096 size: 4096 Allocated: PID = 4031 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59 save_stack+0x43/0xd0 mm/kasan/kasan.c:513 set_track mm/kasan/kasan.c:525 kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:616 kmem_cache_alloc_trace+0x82/0x270 mm/slub.c:2745 kmalloc ./include/linux/slab.h:490 kzalloc ./include/linux/slab.h:663 sctp_association_new+0x114/0x2130 net/sctp/associola.c:304 sctp_sendmsg+0x160d/0x3b20 net/sctp/socket.c:1836 inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:762 sock_sendmsg_nosec net/socket.c:633 sock_sendmsg+0xca/0x110 net/socket.c:643 SYSC_sendto+0x660/0x810 net/socket.c:1696 SyS_sendto+0x40/0x50 net/socket.c:1664 entry_SYSCALL_64_fastpath+0x1f/0xc2 arch/x86/entry/entry_64.S:204 Freed: PID = 4040 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59 save_stack+0x43/0xd0 mm/kasan/kasan.c:513 set_track mm/kasan/kasan.c:525 kasan_slab_free+0x73/0xc0 mm/kasan/kasan.c:589 slab_free_hook mm/slub.c:1357 slab_free_freelist_hook mm/slub.c:1379 slab_free mm/slub.c:2961 kfree+0xe8/0x2b0 mm/slub.c:3882 sctp_association_destroy net/sctp/associola.c:430 sctp_association_put+0x217/0x310 net/sctp/associola.c:879 sctp_transport_destroy net/sctp/transport.c:183 sctp_transport_put+0x15f/0x1d0 net/sctp/transport.c:328 sctp_backlog_rcv+0x239/0xd50 net/sctp/input.c:356 sk_backlog_rcv ./include/net/sock.h:898 __release_sock+0x127/0x3a0 net/core/sock.c:2069 release_sock+0xa5/0x2b0 net/core/sock.c:2564 sctp_close+0x735/0x9f0 net/sctp/socket.c:1539 inet_release+0xed/0x1c0 net/ipv4/af_inet.c:425 sock_release+0x8d/0x1e0 net/socket.c:597 sock_close+0x16/0x20 net/socket.c:1072 __fput+0x332/0x7f0 fs/file_table.c:209 ____fput+0x15/0x20 fs/file_table.c:245 task_work_run+0x19b/0x270 kernel/task_work.c:116 tracehook_notify_resume ./include/linux/tracehook.h:191 exit_to_usermode_loop+0x1c2/0x200 arch/x86/entry/common.c:161 prepare_exit_to_usermode arch/x86/entry/common.c:191 syscall_return_slowpath+0x3d3/0x420 arch/x86/entry/common.c:260 entry_SYSCALL_64_fastpath+0xc0/0xc2 arch/x86/entry/entry_64.S:239 Memory state around the buggy address: ffff8800681b1280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8800681b1300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8800681b1380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8800681b1400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8800681b1480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================