KASAN: slab-use-after-free Read in nr_add

Date	Name	Commit	Repro	Result
2025/09/19	upstream (ToT)	097a6c336d00	syz	[report] possible deadlock in nr_rt_device_down

Date

Name

Commit

Repro

Result

2025/09/19

upstream (ToT)

097a6c336d00

syz

[report] possible deadlock in nr_rt_device_down

Kernel	Title	Rank 🛈	Repro	Fix bisect	Count	Last	Reported	Patched	Status
linux-6.1	KASAN: use-after-free Read in nr_add_node	19			1	191d	191d	0/3	auto-obsoleted due to no activity on 2025/06/19 16:48
linux-6.1	KASAN: use-after-free Read in nr_add_node (2)	19	C		1	1d04h	1d04h	0/3	upstream: reported C repro on 2025/09/18 05:54
linux-5.15	KASAN: use-after-free Read in nr_add_node origin:upstream	19	C	error	1	52d	240d	0/3	upstream: reported C repro on 2025/01/22 09:11

================================================================== BUG: KASAN: slab-use-after-free in nr_add_node+0x2455/0x24b0 net/netrom/nr_route.c:248 Read of size 2 at addr ffff88805bffd332 by task syz.3.1722/9436 CPU: 1 PID: 9436 Comm: syz.3.1722 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 Call Trace: <TASK> dump_stack_lvl+0x16c/0x230 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:364 [inline] print_report+0xac/0x220 mm/kasan/report.c:468 kasan_report+0x117/0x150 mm/kasan/report.c:581 nr_add_node+0x2455/0x24b0 net/netrom/nr_route.c:248 nr_rt_ioctl+0xc0f/0xd40 net/netrom/nr_route.c:651 sock_do_ioctl+0xd7/0x2f0 net/socket.c:1222 sock_ioctl+0x623/0x7a0 net/socket.c:1341 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:871 [inline] __se_sys_ioctl+0xfd/0x170 fs/ioctl.c:857 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f547dd8eba9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f547eb3b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f547dfd5fa0 RCX: 00007f547dd8eba9 RDX: 0000200000000000 RSI: 000000000000890b RDI: 0000000000000004 RBP: 00007f547de11e19 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f547dfd6038 R14: 00007f547dfd5fa0 R15: 00007fff2d313028 </TASK> Allocated by task 9440: kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x4e/0x70 mm/kasan/common.c:52 ____kasan_kmalloc mm/kasan/common.c:374 [inline] __kasan_kmalloc+0x8f/0xa0 mm/kasan/common.c:383 kmalloc include/linux/slab.h:600 [inline] nr_add_node+0x7f9/0x24b0 net/netrom/nr_route.c:146 nr_rt_ioctl+0xc0f/0xd40 net/netrom/nr_route.c:651 sock_do_ioctl+0xd7/0x2f0 net/socket.c:1222 sock_ioctl+0x623/0x7a0 net/socket.c:1341 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:871 [inline] __se_sys_ioctl+0xfd/0x170 fs/ioctl.c:857 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 Freed by task 9436: kasan_save_stack mm/kasan/common.c:45 [inline] kasan_set_track+0x4e/0x70 mm/kasan/common.c:52 kasan_save_free_info+0x2e/0x50 mm/kasan/generic.c:522 ____kasan_slab_free+0x126/0x1e0 mm/kasan/common.c:236 kasan_slab_free include/linux/kasan.h:164 [inline] slab_free_hook mm/slub.c:1811 [inline] slab_free_freelist_hook+0x130/0x1b0 mm/slub.c:1837 slab_free mm/slub.c:3830 [inline] __kmem_cache_free+0xba/0x1f0 mm/slub.c:3843 nr_add_node+0x1c40/0x24b0 net/netrom/nr_route.c:246 nr_rt_ioctl+0xc0f/0xd40 net/netrom/nr_route.c:651 sock_do_ioctl+0xd7/0x2f0 net/socket.c:1222 sock_ioctl+0x623/0x7a0 net/socket.c:1341 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:871 [inline] __se_sys_ioctl+0xfd/0x170 fs/ioctl.c:857 do_syscall_x64 arch/x86/entry/common.c:51 [inline] do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81 entry_SYSCALL_64_after_hwframe+0x68/0xd2 The buggy address belongs to the object at ffff88805bffd300 which belongs to the cache kmalloc-64 of size 64 The buggy address is located 50 bytes inside of freed 64-byte region [ffff88805bffd300, ffff88805bffd340) The buggy address belongs to the physical page: page:ffffea00016fff40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5bffd ksm flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 00fff00000000800 ffff888017841640 ffffea0001663400 dead000000000007 raw: 0000000000000000 0000000000200020 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 5809, tgid 5809 (syz-executor), ts 93104503711, free_ts 27330338935 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x1cd/0x210 mm/page_alloc.c:1554 prep_new_page mm/page_alloc.c:1561 [inline] get_page_from_freelist+0x195c/0x19f0 mm/page_alloc.c:3191 __alloc_pages+0x1e3/0x460 mm/page_alloc.c:4457 alloc_slab_page+0x5d/0x170 mm/slub.c:1881 allocate_slab mm/slub.c:2028 [inline] new_slab+0x87/0x2e0 mm/slub.c:2081 ___slab_alloc+0xc6d/0x1300 mm/slub.c:3253 __slab_alloc mm/slub.c:3339 [inline] __slab_alloc_node mm/slub.c:3392 [inline] slab_alloc_node mm/slub.c:3485 [inline] __kmem_cache_alloc_node+0x1a2/0x260 mm/slub.c:3534 __do_kmalloc_node mm/slab_common.c:1006 [inline] __kmalloc+0xa4/0x240 mm/slab_common.c:1020 kmalloc include/linux/slab.h:604 [inline] kzalloc include/linux/slab.h:721 [inline] kobject_get_path+0xc3/0x2c0 lib/kobject.c:161 kobject_uevent_env+0x28a/0x8c0 lib/kobject_uevent.c:544 rx_queue_add_kobject net/core/net-sysfs.c:1101 [inline] net_rx_queue_update_kobjects+0x313/0x580 net/core/net-sysfs.c:1141 register_queue_kobjects net/core/net-sysfs.c:1801 [inline] netdev_register_kobject+0x227/0x310 net/core/net-sysfs.c:2046 register_netdevice+0x128f/0x1ae0 net/core/dev.c:10280 register_netdev+0x3b/0x50 net/core/dev.c:10412 vti6_init_net+0x214/0x330 net/ipv6/ip6_vti.c:1163 ops_init+0x397/0x640 net/core/net_namespace.c:139 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1154 [inline] free_unref_page_prepare+0x7ce/0x8e0 mm/page_alloc.c:2336 free_unref_page+0x32/0x2e0 mm/page_alloc.c:2429 free_contig_range+0xa1/0x160 mm/page_alloc.c:6369 destroy_args+0x80/0x850 mm/debug_vm_pgtable.c:1015 debug_vm_pgtable+0x3cc/0x410 mm/debug_vm_pgtable.c:1400 do_one_initcall+0x1fd/0x750 init/main.c:1238 do_initcall_level+0x137/0x1f0 init/main.c:1300 do_initcalls+0x69/0xd0 init/main.c:1316 kernel_init_freeable+0x3d2/0x570 init/main.c:1553 kernel_init+0x1d/0x1c0 init/main.c:1443 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293 Memory state around the buggy address: ffff88805bffd200: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff88805bffd280: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc >ffff88805bffd300: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ^ ffff88805bffd380: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff88805bffd400: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ==================================================================

Crashes (1):
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Assets (help?)	Manager	Title
2025/09/18 05:22	linux-6.6.y	60a9e718726f	e2beed91	.config	console log	report	syz / log			[disk image] [vmlinux] [kernel image]	ci2-linux-6-6-kasan	KASAN: slab-use-after-free Read in nr_add_node

Crashes (1):

Assets (help?)