================================================================== BUG: KASAN: slab-use-after-free in __xfrm_state_lookup_all net/xfrm/xfrm_state.c:-1 [inline] BUG: KASAN: slab-use-after-free in xfrm_state_find+0x2cf2/0x5400 net/xfrm/xfrm_state.c:1494 Read of size 1 at addr ffff8880303ed870 by task syz.7.1669/12673 CPU: 1 UID: 0 PID: 12673 Comm: syz.7.1669 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 Call Trace: dump_stack_lvl+0x189/0x250 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595 __xfrm_state_lookup_all net/xfrm/xfrm_state.c:-1 [inline] xfrm_state_find+0x2cf2/0x5400 net/xfrm/xfrm_state.c:1494 xfrm_tmpl_resolve_one net/xfrm/xfrm_policy.c:2522 [inline] xfrm_tmpl_resolve net/xfrm/xfrm_policy.c:2573 [inline] xfrm_resolve_and_create_bundle+0x768/0x2f80 net/xfrm/xfrm_policy.c:2871 xfrm_lookup_with_ifid+0x2a7/0x1a70 net/xfrm/xfrm_policy.c:3205 xfrm_lookup net/xfrm/xfrm_policy.c:3336 [inline] xfrm_lookup_route+0x3c/0x1c0 net/xfrm/xfrm_policy.c:3347 ip6_datagram_dst_update+0x75c/0xcb0 net/ipv6/datagram.c:96 __ip6_datagram_connect+0xbd1/0x1150 net/ipv6/datagram.c:255 ip6_datagram_connect net/ipv6/datagram.c:279 [inline] ip6_datagram_connect_v6_only+0x63/0xa0 net/ipv6/datagram.c:291 __sys_connect_file net/socket.c:2086 [inline] __sys_connect+0x313/0x440 net/socket.c:2105 __do_sys_connect net/socket.c:2111 [inline] __se_sys_connect net/socket.c:2108 [inline] __ia32_sys_connect+0x7a/0x90 net/socket.c:2108 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] __do_fast_syscall_32+0xb6/0x2b0 arch/x86/entry/syscall_32.c:306 do_fast_syscall_32+0x34/0x80 arch/x86/entry/syscall_32.c:331 entry_SYSENTER_compat_after_hwframe+0x84/0x8e RIP: 0023:0xf707e539 Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 RSP: 002b:00000000f546e55c EFLAGS: 00000206 ORIG_RAX: 000000000000016a RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800000c0 RDX: 000000000000001c RSI: 0000000000000000 RDI: 0000000000000000 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Allocated by task 9678: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:330 [inline] __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:356 kasan_slab_alloc include/linux/kasan.h:250 [inline] slab_post_alloc_hook mm/slub.c:4180 [inline] slab_alloc_node mm/slub.c:4229 [inline] kmem_cache_alloc_noprof+0x1c1/0x3c0 mm/slub.c:4236 xfrm_state_alloc+0x24/0x2f0 net/xfrm/xfrm_state.c:733 __find_acq_core+0x8a7/0x1c00 net/xfrm/xfrm_state.c:1833 xfrm_find_acq+0x78/0xa0 net/xfrm/xfrm_state.c:2353 xfrm_alloc_userspi+0x6b3/0xc90 net/xfrm/xfrm_user.c:1863 xfrm_user_rcv_msg+0x7a0/0xab0 net/xfrm/xfrm_user.c:3501 netlink_rcv_skb+0x205/0x470 net/netlink/af_netlink.c:2552 xfrm_netlink_rcv+0x79/0x90 net/xfrm/xfrm_user.c:3523 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0x82c/0x9e0 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896 sock_sendmsg_nosec net/socket.c:714 [inline] __sock_sendmsg+0x219/0x270 net/socket.c:729 ____sys_sendmsg+0x505/0x830 net/socket.c:2614 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668 __sys_sendmsg+0x164/0x220 net/socket.c:2700 do_syscall_32_irqs_on arch/x86/entry/syscall_32.c:83 [inline] __do_fast_syscall_32+0xb6/0x2b0 arch/x86/entry/syscall_32.c:306 do_fast_syscall_32+0x34/0x80 arch/x86/entry/syscall_32.c:331 entry_SYSENTER_compat_after_hwframe+0x84/0x8e Freed by task 24: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:576 poison_slab_object mm/kasan/common.c:243 [inline] __kasan_slab_free+0x5b/0x80 mm/kasan/common.c:275 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2417 [inline] slab_free mm/slub.c:4680 [inline] kmem_cache_free+0x18f/0x400 mm/slub.c:4782 xfrm_state_free net/xfrm/xfrm_state.c:591 [inline] xfrm_state_gc_destroy net/xfrm/xfrm_state.c:618 [inline] xfrm_state_gc_task+0x52d/0x6b0 net/xfrm/xfrm_state.c:634 process_one_work kernel/workqueue.c:3236 [inline] process_scheduled_works+0xae1/0x17b0 kernel/workqueue.c:3319 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3400 kthread+0x70e/0x8a0 kernel/kthread.c:463 ret_from_fork+0x3fc/0x770 arch/x86/kernel/process.c:148 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 The buggy address belongs to the object at ffff8880303ed540 which belongs to the cache xfrm_state of size 928 The buggy address is located 816 bytes inside of freed 928-byte region [ffff8880303ed540, ffff8880303ed8e0) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff8880303ed980 pfn:0x303ec head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff888022acb500 dead000000000122 0000000000000000 raw: ffff8880303ed980 00000000800f0009 00000000f5000000 0000000000000000 head: 00fff00000000040 ffff888022acb500 dead000000000122 0000000000000000 head: ffff8880303ed980 00000000800f0009 00000000f5000000 0000000000000000 head: 00fff00000000002 ffffea0000c0fb01 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 7066, tgid 7065 (syz.2.190), ts 176787430901, free_ts 175326586149 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x240/0x2a0 mm/page_alloc.c:1851 prep_new_page mm/page_alloc.c:1859 [inline] get_page_from_freelist+0x21e4/0x22c0 mm/page_alloc.c:3858 __alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5148 alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2416 alloc_slab_page mm/slub.c:2487 [inline] allocate_slab+0x8a/0x370 mm/slub.c:2655 new_slab mm/slub.c:2709 [inline] ___slab_alloc+0xbeb/0x1410 mm/slub.c:3891 __slab_alloc mm/slub.c:3981 [inline] __slab_alloc_node mm/slub.c:4056 [inline] slab_alloc_node mm/slub.c:4217 [inline] kmem_cache_alloc_noprof+0x283/0x3c0 mm/slub.c:4236 xfrm_state_alloc+0x24/0x2f0 net/xfrm/xfrm_state.c:733 xfrm_state_find+0x37d4/0x5400 net/xfrm/xfrm_state.c:1513 xfrm_tmpl_resolve_one net/xfrm/xfrm_policy.c:2522 [inline] xfrm_tmpl_resolve net/xfrm/xfrm_policy.c:2573 [inline] xfrm_resolve_and_create_bundle+0x768/0x2f80 net/xfrm/xfrm_policy.c:2871 xfrm_lookup_with_ifid+0x2a7/0x1a70 net/xfrm/xfrm_policy.c:3205 xfrm_lookup net/xfrm/xfrm_policy.c:3336 [inline] xfrm_lookup_route+0x3c/0x1c0 net/xfrm/xfrm_policy.c:3347 ip6_datagram_dst_update+0x75c/0xcb0 net/ipv6/datagram.c:96 __ip6_datagram_connect+0xbd1/0x1150 net/ipv6/datagram.c:255 ip6_datagram_connect net/ipv6/datagram.c:279 [inline] ip6_datagram_connect_v6_only+0x63/0xa0 net/ipv6/datagram.c:291 __sys_connect_file net/socket.c:2086 [inline] __sys_connect+0x313/0x440 net/socket.c:2105 page last free pid 7051 tgid 7051 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1395 [inline] __free_frozen_pages+0xbc4/0xd30 mm/page_alloc.c:2895 __slab_free+0x303/0x3c0 mm/slub.c:4591 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x97/0x140 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:340 kasan_slab_alloc include/linux/kasan.h:250 [inline] slab_post_alloc_hook mm/slub.c:4180 [inline] slab_alloc_node mm/slub.c:4229 [inline] kmem_cache_alloc_noprof+0x1c1/0x3c0 mm/slub.c:4236 anon_vma_chain_alloc mm/rmap.c:142 [inline] __anon_vma_prepare+0xcb/0x4a0 mm/rmap.c:195 __vmf_anon_prepare mm/memory.c:3506 [inline] vmf_anon_prepare mm/internal.h:432 [inline] do_anonymous_page mm/memory.c:5050 [inline] do_pte_missing mm/memory.c:4232 [inline] handle_pte_fault mm/memory.c:6052 [inline] __handle_mm_fault+0x4b2d/0x5440 mm/memory.c:6195 handle_mm_fault+0x40a/0x8e0 mm/memory.c:6364 do_user_addr_fault+0xa81/0x1390 arch/x86/mm/fault.c:1336 handle_page_fault arch/x86/mm/fault.c:1476 [inline] exc_page_fault+0x76/0xf0 arch/x86/mm/fault.c:1532 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 Memory state around the buggy address: ffff8880303ed700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880303ed780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8880303ed800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880303ed880: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ffff8880303ed900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== ---------------- Code disassembly (best guess): 0: 03 74 b4 01 add 0x1(%rsp,%rsi,4),%esi 4: 10 07 adc %al,(%rdi) 6: 03 74 b0 01 add 0x1(%rax,%rsi,4),%esi a: 10 08 adc %cl,(%rax) c: 03 74 d8 01 add 0x1(%rax,%rbx,8),%esi 20: 00 51 52 add %dl,0x52(%rcx) 23: 55 push %rbp 24: 89 e5 mov %esp,%ebp 26: 0f 34 sysenter 28: cd 80 int $0x80 * 2a: 5d pop %rbp <-- trapping instruction 2b: 5a pop %rdx 2c: 59 pop %rcx 2d: c3 ret 2e: 90 nop 2f: 90 nop 30: 90 nop 31: 90 nop 32: 90 nop 33: 90 nop 34: 90 nop 35: 90 nop 36: 90 nop 37: 90 nop 38: 90 nop 39: 90 nop 3a: 90 nop 3b: 90 nop 3c: 90 nop 3d: 90 nop 3e: 90 nop 3f: 90 nop