UBSAN: array-index-out-of-bounds in llc_conn_state_process (2)

Status: upstream: reported C repro on 2024/06/03 15:59
Subsystems: net
Labels: prio:high
[Documentation on labels]
Reported-by: syzbot+628f93722c08dc5aabe0@syzkaller.appspotmail.com
First crash: 865d, last: 10h42m
✨ AI Jobs (10)
ID Workflow Result Correct Bug Created Started Finished Revision
5c30c3bd assessment-security DenialOfService: ✅ Exploitable: ✅ FilesystemTrigger: ❌ NetworkTrigger: ✅ PeripheralTrigger: ❌ RemoteTrigger: ✅ Unprivileged: ❌ UserNamespace: ❌ VMGuestTrigger: ❌ VMHostTrigger: ❌ UBSAN: array-index-out-of-bounds in llc_conn_state_process (2) 2026/09/04 04:45 2026/09/04 04:45 2026/09/04 04:54 d2e5fb95
bc8173aa repro-c 💥 UBSAN: array-index-out-of-bounds in llc_conn_state_process (2) 2026/08/05 17:31 2026/08/06 02:00 2026/08/06 02:14 e33390b8
5296ade2 assessment-security 💥 UBSAN: array-index-out-of-bounds in llc_conn_state_process (2) 2026/08/05 00:03 2026/08/05 00:03 2026/08/05 00:03 d4abbeac
8f348e35 assessment-security 💥 UBSAN: array-index-out-of-bounds in llc_conn_state_process (2) 2026/07/05 05:14 2026/07/05 05:14 2026/07/05 05:37 93f57954
f8f83347 assessment-security 💥 UBSAN: array-index-out-of-bounds in llc_conn_state_process (2) 2026/06/18 04:44 2026/06/18 04:44 2026/06/18 05:13 b62b3ded
17e856de assessment-security 💥 UBSAN: array-index-out-of-bounds in llc_conn_state_process (2) 2026/06/10 00:42 2026/06/10 00:42 2026/06/10 01:14 c36c07f6
3652982d assessment-security 💥 UBSAN: array-index-out-of-bounds in llc_conn_state_process (2) 2026/06/04 02:48 2026/06/04 02:48 2026/06/04 03:05 62fe1528
2cc8c9fb assessment-security 💥 UBSAN: array-index-out-of-bounds in llc_conn_state_process (2) 2026/06/01 17:46 2026/06/01 17:46 2026/06/01 18:09 386cc6da
9102434f assessment-security 💥 UBSAN: array-index-out-of-bounds in llc_conn_state_process (2) 2026/05/17 05:57 2026/05/17 05:57 2026/05/17 06:24 de5aae85
f06d45ac repro UBSAN: array-index-out-of-bounds in llc_conn_state_process (2) 2026/03/08 01:31 2026/03/08 01:31 2026/03/08 01:41 31e9c887
Discussions (4)
Title Replies (including bot) Last reply
[PATCH net-next 0/3] llc: do not run the state machine on out of service connections 6 (6) 2026/09/05 19:28
[syzbot] [net?] UBSAN: array-index-out-of-bounds in llc_conn_state_process (2) 1 (3) 2026/08/31 13:58
[PATCH] net/llc: fix UBSAN array-index-out-of-bounds in llc_conn_state_process 4 (4) 2026/05/19 00:58
Re: [PATCH] net/llc: fix UBSAN array-index-out-of-bounds in llc_conn_state_process 1 (1) 2026/05/16 22:11
Similar bugs (6)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream UBSAN: array-index-out-of-bounds in llc_conn_state_process net 17 2 1654d 1768d 0/29 auto-closed as invalid on 2022/07/10 02:25
linux-6.1 general protection fault in llc_conn_state_process (4) 2 1 196d 196d 0/3 auto-obsoleted due to no activity on 2026/06/17 18:46
linux-5.15 KASAN: global-out-of-bounds Read in llc_conn_state_process 17 1 964d 964d 0/3 auto-obsoleted due to no activity on 2024/05/10 14:15
linux-6.1 general protection fault in llc_conn_state_process (2) 2 1 600d 600d 0/3 auto-obsoleted due to no activity on 2025/05/09 06:03
linux-6.1 general protection fault in llc_conn_state_process 2 1 753d 753d 0/3 auto-obsoleted due to no activity on 2024/12/06 20:07
linux-6.1 general protection fault in llc_conn_state_process (3) 2 2 438d 489d 0/3 auto-obsoleted due to no activity on 2025/10/18 08:50
Last patch testing requests (1)
Created Duration User Patch Repo Result
2026/09/19 14:20 19m retest repro git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci report job log log

Sample crash report:
------------[ cut here ]------------
UBSAN: array-index-out-of-bounds in net/llc/llc_conn.c:681:24
index -1 is out of range for type 'int [12][5]'
CPU: 1 UID: 0 PID: 5904 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 ubsan_epilogue+0xa/0x30 lib/ubsan.c:233
 __ubsan_handle_out_of_bounds+0xcc/0xf0 lib/ubsan.c:455
 llc_find_offset net/llc/llc_conn.c:681 [inline]
 llc_qualify_conn_ev net/llc/llc_conn.c:395 [inline]
 llc_conn_service net/llc/llc_conn.c:360 [inline]
 llc_conn_state_process+0x1392/0x1480 net/llc/llc_conn.c:66
 llc_conn_rcv net/llc/llc_conn.c:750 [inline]
 llc_conn_handler+0x599/0x1490 net/llc/llc_conn.c:817
 llc_rcv+0x55a/0xcb0 net/llc/llc_input.c:206
 __netif_receive_skb_list_ptype net/core/dev.c:6312 [inline]
 __netif_receive_skb_list_ptype net/core/dev.c:6296 [inline]
 __netif_receive_skb_list_core+0x6da/0x940 net/core/dev.c:6354
 __netif_receive_skb_list net/core/dev.c:6406 [inline]
 netif_receive_skb_list_internal+0x722/0xd40 net/core/dev.c:6497
 netif_receive_skb_list net/core/dev.c:6549 [inline]
 netif_receive_skb_list+0x72/0x500 net/core/dev.c:6539
 xdp_recv_frames net/bpf/test_run.c:268 [inline]
 xdp_test_run_batch.constprop.0+0x16bb/0x1ca0 net/bpf/test_run.c:349
 bpf_test_run_xdp_live+0x367/0x760 net/bpf/test_run.c:378
 bpf_prog_test_run_xdp+0xd86/0x1670 net/bpf/test_run.c:1463
 bpf_prog_test_run kernel/bpf/syscall.c:4804 [inline]
 __sys_bpf+0x2265/0x4a30 kernel/bpf/syscall.c:6385
 __do_sys_bpf kernel/bpf/syscall.c:6486 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:6483 [inline]
 __x64_sys_bpf+0xce/0x140 kernel/bpf/syscall.c:6483
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x123/0x790 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f33ed39e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f33ee22c028 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 00007f33ed625fa0 RCX: 00007f33ed39e159
RDX: 0000000000000048 RSI: 0000200000000600 RDI: 000000000000000a
RBP: 00007f33ed43506b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f33ed626038 R14: 00007f33ed625fa0 R15: 00007ffd762869a8
 </TASK>
---[ end trace ]---

Crashes (42):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2026/09/21 08:46 upstream 93f51579e7df 853b104b .config console log report syz / log C [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream UBSAN: array-index-out-of-bounds in llc_conn_state_process
2026/08/31 13:58 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci f1b8fa82cab7 2f52988a .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: global-out-of-bounds Read in llc_conn_state_process
2024/05/09 03:46 upstream 6d7ddd805123 20bf80e1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root UBSAN: array-index-out-of-bounds in llc_conn_state_process
2026/08/16 23:39 upstream dcb68831eac7 746171ee .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root general protection fault in llc_conn_state_process
2026/08/01 09:06 upstream 0131b508c0e2 e611ffe1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root general protection fault in llc_conn_state_process
2026/05/13 19:15 upstream 1d5dcaa3bd65 fec2a7ee .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root general protection fault in llc_conn_state_process
2026/03/25 23:24 upstream bbeb83d3182a 4367a094 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root general protection fault in llc_conn_state_process
2025/07/26 16:18 upstream 5f33ebd2018c fb8f743d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root general protection fault in llc_conn_state_process
2025/04/26 11:23 upstream f1a3944c860b c6b4fb39 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root general protection fault in llc_conn_state_process
2025/03/18 05:43 upstream fc444ada1310 ce3352cd .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root general protection fault in llc_conn_state_process
2025/03/08 15:24 upstream 21e4543a2e2f 7e3bd60d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root general protection fault in llc_conn_state_process
2025/02/17 07:44 upstream 0ad2507d5d93 40a34ec9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root general protection fault in llc_conn_state_process
2024/12/23 16:32 upstream 4bbf9020becb 444551c4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-root general protection fault in llc_conn_state_process
2024/12/20 08:27 upstream 8faabc041a00 1d58202c .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-badwrites-root general protection fault in llc_conn_state_process
2024/11/05 01:05 upstream 557329bcecc2 509da429 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root general protection fault in llc_conn_state_process
2024/10/25 08:45 upstream ae90f6a6170d c79b8ca5 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root general protection fault in llc_conn_state_process
2024/09/29 09:02 upstream 3efc57369a0c ba29ff75 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-smack-root general protection fault in llc_conn_state_process
2024/09/03 05:33 upstream 67784a74e258 abeaa9b9 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-kasan-gce-selinux-root general protection fault in llc_conn_state_process
2026/03/26 18:42 upstream 0138af2472df 4b3d9a38 .config console log report [disk image (non-bootable)] [vmlinux] [kernel image] ci-snapshot-upstream-root general protection fault in llc_conn_state_process
2024/10/14 14:33 upstream 6485cf5ea253 084d8178 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream general protection fault in llc_conn_state_process
2026/09/02 20:26 upstream 89a312991dc6 74e93e68 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in llc_conn_state_process
2024/10/26 17:23 upstream 850925a8133c 65e8686b .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm32 BUG: unable to handle kernel paging request in llc_conn_state_process
2024/10/04 23:51 upstream 0c559323bbaa d7906eff .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu-upstream-386 general protection fault in llc_conn_state_process
2024/05/28 05:25 upstream 2bfcfd584ff5 f550015e .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-arm32 BUG: unable to handle kernel NULL pointer dereference in llc_conn_state_process
2026/03/18 15:31 net 64dcbde7f8f8 0199f9a1 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce general protection fault in llc_conn_state_process
2025/12/23 13:00 net dabac51b8102 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce general protection fault in llc_conn_state_process
2025/09/28 14:02 net 012ea489aeda 001c9061 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce general protection fault in llc_conn_state_process
2025/06/11 16:55 net d9816ec74e6d 5d7e17ca .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce general protection fault in llc_conn_state_process
2025/05/19 11:19 net c46286fdd6aa f41472b0 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce general protection fault in llc_conn_state_process
2025/02/03 08:28 net 3f1baa91a1fd 568559e4 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-this-kasan-gce general protection fault in llc_conn_state_process
2026/04/02 10:52 net-next f1359c240191 0cb124d5 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce general protection fault in llc_conn_state_process
2026/01/08 09:37 net-next 8e7148b56023 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-net-kasan-gce general protection fault in llc_conn_state_process
2026/08/16 21:59 linux-next 4477a78374a5 746171ee .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root general protection fault in llc_conn_state_process
2025/07/17 00:13 linux-next e8352908bdcd 44f8051e .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root general protection fault in llc_conn_state_process
2025/07/06 03:04 linux-next 26ffb3d6f02c 4f67c4ae .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-rust-kasan-gce general protection fault in llc_conn_state_process
2024/10/31 05:10 linux-next 86e3904dcdc7 fb888278 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-linux-next-kasan-gce-root general protection fault in llc_conn_state_process
2026/08/31 13:06 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci f1b8fa82cab7 2f52988a .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 KASAN: global-out-of-bounds Read in llc_conn_state_process
2026/05/24 11:44 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 4b4362973b6f c69befb3 .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in llc_conn_state_process
2025/03/08 10:15 git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci 77c95b8c7a16 7e3bd60d .config console log report info [disk image] [vmlinux] [kernel image] ci-upstream-gce-arm64 BUG: unable to handle kernel paging request in llc_conn_state_process
2026/08/21 19:29 git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git for-next 77ae27fd98f3 1e72964b .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-riscv64 BUG: unable to handle kernel paging request in llc_conn_state_process
2026/08/21 19:27 git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git for-next 77ae27fd98f3 1e72964b .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-riscv64 BUG: unable to handle kernel paging request in llc_conn_state_process
2026/06/20 20:36 git://git.kernel.org/pub/scm/linux/kernel/git/riscv/linux.git for-next 319fafd9a374 43bfcdb0 .config console log report info [disk image (non-bootable)] [vmlinux] [kernel image] ci-qemu2-riscv64 BUG: unable to handle kernel paging request in llc_conn_state_process
* Struck through repros no longer work on HEAD.