==================================================================
BUG: KASAN: slab-use-after-free in __xfrm_state_insert+0x24fc/0x2510 net/xfrm/xfrm_state.c:1743
Read of size 1 at addr ffff888036dd20f0 by task syz.1.7139/27134
CPU: 0 UID: 0 PID: 27134 Comm: syz.1.7139 Not tainted 6.16.0-syzkaller-11322-g352af6a011d5 #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xcd/0x630 mm/kasan/report.c:482
kasan_report+0xe0/0x110 mm/kasan/report.c:595
__xfrm_state_insert+0x24fc/0x2510 net/xfrm/xfrm_state.c:1743
xfrm_state_insert+0x4c/0x60 net/xfrm/xfrm_state.c:1795
ipcomp6_tunnel_attach net/ipv6/ipcomp6.c:131 [inline]
ipcomp6_init_state net/ipv6/ipcomp6.c:163 [inline]
ipcomp6_init_state+0x608/0x8d0 net/ipv6/ipcomp6.c:141
__xfrm_init_state+0x6fe/0x1c10 net/xfrm/xfrm_state.c:3188
xfrm_init_state+0x18/0xa0 net/xfrm/xfrm_state.c:3231
pfkey_msg2xfrm_state net/key/af_key.c:1286 [inline]
pfkey_add+0x24f4/0x2ec0 net/key/af_key.c:1504
pfkey_process+0x6dc/0x840 net/key/af_key.c:2848
pfkey_sendmsg+0x435/0x850 net/key/af_key.c:3699
sock_sendmsg_nosec net/socket.c:714 [inline]
__sock_sendmsg net/socket.c:729 [inline]
____sys_sendmsg+0xa98/0xc70 net/socket.c:2614
___sys_sendmsg+0x134/0x1d0 net/socket.c:2668
__sys_sendmsg+0x16d/0x220 net/socket.c:2700
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f370478eb69
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f37055a2038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f37049b5fa0 RCX: 00007f370478eb69
RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000004
RBP: 00007f3704811df1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f37049b5fa0 R15: 00007ffe7055cb58
Allocated by task 25939:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
unpoison_slab_object mm/kasan/common.c:319 [inline]
__kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:345
kasan_slab_alloc include/linux/kasan.h:250 [inline]
slab_post_alloc_hook mm/slub.c:4180 [inline]
slab_alloc_node mm/slub.c:4229 [inline]
kmem_cache_alloc_noprof+0x1cb/0x3b0 mm/slub.c:4236
xfrm_state_alloc+0x23/0x5c0 net/xfrm/xfrm_state.c:733
xfrm_state_find+0x31e6/0x84c0 net/xfrm/xfrm_state.c:1513
xfrm_tmpl_resolve_one net/xfrm/xfrm_policy.c:2522 [inline]
xfrm_tmpl_resolve net/xfrm/xfrm_policy.c:2573 [inline]
xfrm_resolve_and_create_bundle+0x4cd/0x3740 net/xfrm/xfrm_policy.c:2871
xfrm_lookup_with_ifid+0x2a0/0x1e40 net/xfrm/xfrm_policy.c:3205
xfrm_lookup net/xfrm/xfrm_policy.c:3336 [inline]
xfrm_lookup_route+0x3b/0x200 net/xfrm/xfrm_policy.c:3347
ip_route_output_flow+0x11e/0x150 net/ipv4/route.c:2930
udp_sendmsg+0x1af9/0x2870 net/ipv4/udp.c:1450
inet_sendmsg+0x105/0x140 net/ipv4/af_inet.c:851
sock_sendmsg_nosec net/socket.c:714 [inline]
__sock_sendmsg net/socket.c:729 [inline]
____sys_sendmsg+0x973/0xc70 net/socket.c:2614
___sys_sendmsg+0x134/0x1d0 net/socket.c:2668
__sys_sendmmsg+0x200/0x420 net/socket.c:2757
__do_sys_sendmmsg net/socket.c:2784 [inline]
__se_sys_sendmmsg net/socket.c:2781 [inline]
__x64_sys_sendmmsg+0x9c/0x100 net/socket.c:2781
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 22561:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x51/0x70 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2417 [inline]
slab_free mm/slub.c:4680 [inline]
kmem_cache_free+0x2d1/0x4d0 mm/slub.c:4782
xfrm_state_free net/xfrm/xfrm_state.c:591 [inline]
xfrm_state_gc_destroy net/xfrm/xfrm_state.c:618 [inline]
xfrm_state_gc_task+0x50a/0x770 net/xfrm/xfrm_state.c:634
process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3236
process_scheduled_works kernel/workqueue.c:3319 [inline]
worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400
kthread+0x3c5/0x780 kernel/kthread.c:464
ret_from_fork+0x5d7/0x6f0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
The buggy address belongs to the object at ffff888036dd1dc0
which belongs to the cache xfrm_state of size 928
The buggy address is located 816 bytes inside of
freed 928-byte region [ffff888036dd1dc0, ffff888036dd2160)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888036dd0440 pfn:0x36dd0
head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
ksm flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff888021aaf500 ffffea00017d1800 0000000000000003
raw: ffff888036dd0440 00000000000f0000 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff888021aaf500 ffffea00017d1800 0000000000000003
head: ffff888036dd0440 00000000000f0000 00000000f5000000 0000000000000000
head: 00fff00000000002 ffffea0000db7401 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 23229, tgid 23226 (syz.7.5861), ts 1013117086888, free_ts 960742528664
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1c0/0x230 mm/page_alloc.c:1851
prep_new_page mm/page_alloc.c:1859 [inline]
get_page_from_freelist+0x132b/0x38e0 mm/page_alloc.c:3858
__alloc_frozen_pages_noprof+0x261/0x23f0 mm/page_alloc.c:5148
alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2416
alloc_slab_page mm/slub.c:2487 [inline]
allocate_slab mm/slub.c:2655 [inline]
new_slab+0x247/0x330 mm/slub.c:2709
___slab_alloc+0xcf2/0x1740 mm/slub.c:3891
__slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3981
__slab_alloc_node mm/slub.c:4056 [inline]
slab_alloc_node mm/slub.c:4217 [inline]
kmem_cache_alloc_noprof+0xef/0x3b0 mm/slub.c:4236
xfrm_state_alloc+0x23/0x5c0 net/xfrm/xfrm_state.c:733
xfrm_state_find+0x31e6/0x84c0 net/xfrm/xfrm_state.c:1513
xfrm_tmpl_resolve_one net/xfrm/xfrm_policy.c:2522 [inline]
xfrm_tmpl_resolve net/xfrm/xfrm_policy.c:2573 [inline]
xfrm_resolve_and_create_bundle+0x4cd/0x3740 net/xfrm/xfrm_policy.c:2871
xfrm_lookup_with_ifid+0x2a0/0x1e40 net/xfrm/xfrm_policy.c:3205
xfrm_lookup net/xfrm/xfrm_policy.c:3336 [inline]
xfrm_lookup_route+0x3b/0x200 net/xfrm/xfrm_policy.c:3347
ip_route_output_flow+0x11e/0x150 net/ipv4/route.c:2930
udp_sendmsg+0x1af9/0x2870 net/ipv4/udp.c:1450
inet_sendmsg+0x105/0x140 net/ipv4/af_inet.c:851
page last free pid 49 tgid 49 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1395 [inline]
free_unref_folios+0xa61/0x16b0 mm/page_alloc.c:2952
folios_put_refs+0x56f/0x740 mm/swap.c:997
release_pages+0x2a2/0x4b0 mm/swap.c:1037
io_free_region+0x102/0x2e0 io_uring/memmap.c:102
io_rings_free io_uring/io_uring.c:2719 [inline]
io_ring_ctx_free io_uring/io_uring.c:2809 [inline]
io_ring_exit_work+0x9ba/0x10a0 io_uring/io_uring.c:3031
process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3236
process_scheduled_works kernel/workqueue.c:3319 [inline]
worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400
kthread+0x3c5/0x780 kernel/kthread.c:464
ret_from_fork+0x5d7/0x6f0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Memory state around the buggy address:
ffff888036dd1f80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888036dd2000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888036dd2080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888036dd2100: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
ffff888036dd2180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
==================================================================
BUG: KASAN: slab-use-after-free in hlist_add_before_rcu include/linux/rculist.h:703 [inline]
BUG: KASAN: slab-use-after-free in __xfrm_state_insert+0x24e3/0x2510 net/xfrm/xfrm_state.c:1743
Read of size 8 at addr ffff888036dd1df0 by task syz.1.7139/27134
CPU: 0 UID: 0 PID: 27134 Comm: syz.1.7139 Tainted: G B 6.16.0-syzkaller-11322-g352af6a011d5 #0 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xcd/0x630 mm/kasan/report.c:482
kasan_report+0xe0/0x110 mm/kasan/report.c:595
hlist_add_before_rcu include/linux/rculist.h:703 [inline]
__xfrm_state_insert+0x24e3/0x2510 net/xfrm/xfrm_state.c:1743
xfrm_state_insert+0x4c/0x60 net/xfrm/xfrm_state.c:1795
ipcomp6_tunnel_attach net/ipv6/ipcomp6.c:131 [inline]
ipcomp6_init_state net/ipv6/ipcomp6.c:163 [inline]
ipcomp6_init_state+0x608/0x8d0 net/ipv6/ipcomp6.c:141
__xfrm_init_state+0x6fe/0x1c10 net/xfrm/xfrm_state.c:3188
xfrm_init_state+0x18/0xa0 net/xfrm/xfrm_state.c:3231
pfkey_msg2xfrm_state net/key/af_key.c:1286 [inline]
pfkey_add+0x24f4/0x2ec0 net/key/af_key.c:1504
pfkey_process+0x6dc/0x840 net/key/af_key.c:2848
pfkey_sendmsg+0x435/0x850 net/key/af_key.c:3699
sock_sendmsg_nosec net/socket.c:714 [inline]
__sock_sendmsg net/socket.c:729 [inline]
____sys_sendmsg+0xa98/0xc70 net/socket.c:2614
___sys_sendmsg+0x134/0x1d0 net/socket.c:2668
__sys_sendmsg+0x16d/0x220 net/socket.c:2700
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f370478eb69
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f37055a2038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f37049b5fa0 RCX: 00007f370478eb69
RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000004
RBP: 00007f3704811df1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f37049b5fa0 R15: 00007ffe7055cb58
Allocated by task 25939:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
unpoison_slab_object mm/kasan/common.c:319 [inline]
__kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:345
kasan_slab_alloc include/linux/kasan.h:250 [inline]
slab_post_alloc_hook mm/slub.c:4180 [inline]
slab_alloc_node mm/slub.c:4229 [inline]
kmem_cache_alloc_noprof+0x1cb/0x3b0 mm/slub.c:4236
xfrm_state_alloc+0x23/0x5c0 net/xfrm/xfrm_state.c:733
xfrm_state_find+0x31e6/0x84c0 net/xfrm/xfrm_state.c:1513
xfrm_tmpl_resolve_one net/xfrm/xfrm_policy.c:2522 [inline]
xfrm_tmpl_resolve net/xfrm/xfrm_policy.c:2573 [inline]
xfrm_resolve_and_create_bundle+0x4cd/0x3740 net/xfrm/xfrm_policy.c:2871
xfrm_lookup_with_ifid+0x2a0/0x1e40 net/xfrm/xfrm_policy.c:3205
xfrm_lookup net/xfrm/xfrm_policy.c:3336 [inline]
xfrm_lookup_route+0x3b/0x200 net/xfrm/xfrm_policy.c:3347
ip_route_output_flow+0x11e/0x150 net/ipv4/route.c:2930
udp_sendmsg+0x1af9/0x2870 net/ipv4/udp.c:1450
inet_sendmsg+0x105/0x140 net/ipv4/af_inet.c:851
sock_sendmsg_nosec net/socket.c:714 [inline]
__sock_sendmsg net/socket.c:729 [inline]
____sys_sendmsg+0x973/0xc70 net/socket.c:2614
___sys_sendmsg+0x134/0x1d0 net/socket.c:2668
__sys_sendmmsg+0x200/0x420 net/socket.c:2757
__do_sys_sendmmsg net/socket.c:2784 [inline]
__se_sys_sendmmsg net/socket.c:2781 [inline]
__x64_sys_sendmmsg+0x9c/0x100 net/socket.c:2781
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 22561:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:47
kasan_save_track+0x14/0x30 mm/kasan/common.c:68
kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:576
poison_slab_object mm/kasan/common.c:247 [inline]
__kasan_slab_free+0x51/0x70 mm/kasan/common.c:264
kasan_slab_free include/linux/kasan.h:233 [inline]
slab_free_hook mm/slub.c:2417 [inline]
slab_free mm/slub.c:4680 [inline]
kmem_cache_free+0x2d1/0x4d0 mm/slub.c:4782
xfrm_state_free net/xfrm/xfrm_state.c:591 [inline]
xfrm_state_gc_destroy net/xfrm/xfrm_state.c:618 [inline]
xfrm_state_gc_task+0x50a/0x770 net/xfrm/xfrm_state.c:634
process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3236
process_scheduled_works kernel/workqueue.c:3319 [inline]
worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400
kthread+0x3c5/0x780 kernel/kthread.c:464
ret_from_fork+0x5d7/0x6f0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
The buggy address belongs to the object at ffff888036dd1dc0
which belongs to the cache xfrm_state of size 928
The buggy address is located 48 bytes inside of
freed 928-byte region [ffff888036dd1dc0, ffff888036dd2160)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888036dd0440 pfn:0x36dd0
head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
ksm flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff888021aaf500 ffffea00017d1800 0000000000000003
raw: ffff888036dd0440 00000000000f0000 00000000f5000000 0000000000000000
head: 00fff00000000040 ffff888021aaf500 ffffea00017d1800 0000000000000003
head: ffff888036dd0440 00000000000f0000 00000000f5000000 0000000000000000
head: 00fff00000000002 ffffea0000db7401 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x52820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 23229, tgid 23226 (syz.7.5861), ts 1013117086888, free_ts 960742528664
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1c0/0x230 mm/page_alloc.c:1851
prep_new_page mm/page_alloc.c:1859 [inline]
get_page_from_freelist+0x132b/0x38e0 mm/page_alloc.c:3858
__alloc_frozen_pages_noprof+0x261/0x23f0 mm/page_alloc.c:5148
alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2416
alloc_slab_page mm/slub.c:2487 [inline]
allocate_slab mm/slub.c:2655 [inline]
new_slab+0x247/0x330 mm/slub.c:2709
___slab_alloc+0xcf2/0x1740 mm/slub.c:3891
__slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3981
__slab_alloc_node mm/slub.c:4056 [inline]
slab_alloc_node mm/slub.c:4217 [inline]
kmem_cache_alloc_noprof+0xef/0x3b0 mm/slub.c:4236
xfrm_state_alloc+0x23/0x5c0 net/xfrm/xfrm_state.c:733
xfrm_state_find+0x31e6/0x84c0 net/xfrm/xfrm_state.c:1513
xfrm_tmpl_resolve_one net/xfrm/xfrm_policy.c:2522 [inline]
xfrm_tmpl_resolve net/xfrm/xfrm_policy.c:2573 [inline]
xfrm_resolve_and_create_bundle+0x4cd/0x3740 net/xfrm/xfrm_policy.c:2871
xfrm_lookup_with_ifid+0x2a0/0x1e40 net/xfrm/xfrm_policy.c:3205
xfrm_lookup net/xfrm/xfrm_policy.c:3336 [inline]
xfrm_lookup_route+0x3b/0x200 net/xfrm/xfrm_policy.c:3347
ip_route_output_flow+0x11e/0x150 net/ipv4/route.c:2930
udp_sendmsg+0x1af9/0x2870 net/ipv4/udp.c:1450
inet_sendmsg+0x105/0x140 net/ipv4/af_inet.c:851
page last free pid 49 tgid 49 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1395 [inline]
free_unref_folios+0xa61/0x16b0 mm/page_alloc.c:2952
folios_put_refs+0x56f/0x740 mm/swap.c:997
release_pages+0x2a2/0x4b0 mm/swap.c:1037
io_free_region+0x102/0x2e0 io_uring/memmap.c:102
io_rings_free io_uring/io_uring.c:2719 [inline]
io_ring_ctx_free io_uring/io_uring.c:2809 [inline]
io_ring_exit_work+0x9ba/0x10a0 io_uring/io_uring.c:3031
process_one_work+0x9cf/0x1b70 kernel/workqueue.c:3236
process_scheduled_works kernel/workqueue.c:3319 [inline]
worker_thread+0x6c8/0xf10 kernel/workqueue.c:3400
kthread+0x3c5/0x780 kernel/kthread.c:464
ret_from_fork+0x5d7/0x6f0 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Memory state around the buggy address:
ffff888036dd1c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888036dd1d00: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888036dd1d80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
^
ffff888036dd1e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888036dd1e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Oops: general protection fault, probably for non-canonical address 0xfbd59c0000000024: 0000 [#1] SMP KASAN NOPTI
KASAN: maybe wild-memory-access in range [0xdead000000000120-0xdead000000000127]
CPU: 0 UID: 0 PID: 27134 Comm: syz.1.7139 Tainted: G B 6.16.0-syzkaller-11322-g352af6a011d5 #0 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025
RIP: 0010:hlist_add_before_rcu include/linux/rculist.h:705 [inline]
RIP: 0010:__xfrm_state_insert+0x1710/0x2510 net/xfrm/xfrm_state.c:1743
Code: 00 fc ff df 4c 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 96 0d 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 7b 30 4c 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 6a 0d 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89
RSP: 0018:ffffc9001a4b7668 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: ffff888052005dc0 RCX: 1ffff1100a400bbd
RDX: 1bd5a00000000024 RSI: 1ffff1100a400bbe RDI: 0000000000000007
RBP: ffff88802c640000 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 3d3d3d3d3d3d3d3d R12: ffff888036dd1dc0
R13: ffff888052005de8 R14: ffff888036dd1df0 R15: dead000000000122
FS: 00007f37055a26c0(0000) GS:ffff8881246cf000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fadba7b7bac CR3: 00000000391d5000 CR4: 0000000000350ef0
Call Trace:
xfrm_state_insert+0x4c/0x60 net/xfrm/xfrm_state.c:1795
ipcomp6_tunnel_attach net/ipv6/ipcomp6.c:131 [inline]
ipcomp6_init_state net/ipv6/ipcomp6.c:163 [inline]
ipcomp6_init_state+0x608/0x8d0 net/ipv6/ipcomp6.c:141
__xfrm_init_state+0x6fe/0x1c10 net/xfrm/xfrm_state.c:3188
xfrm_init_state+0x18/0xa0 net/xfrm/xfrm_state.c:3231
pfkey_msg2xfrm_state net/key/af_key.c:1286 [inline]
pfkey_add+0x24f4/0x2ec0 net/key/af_key.c:1504
pfkey_process+0x6dc/0x840 net/key/af_key.c:2848
pfkey_sendmsg+0x435/0x850 net/key/af_key.c:3699
sock_sendmsg_nosec net/socket.c:714 [inline]
__sock_sendmsg net/socket.c:729 [inline]
____sys_sendmsg+0xa98/0xc70 net/socket.c:2614
___sys_sendmsg+0x134/0x1d0 net/socket.c:2668
__sys_sendmsg+0x16d/0x220 net/socket.c:2700
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0x4c0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f370478eb69
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f37055a2038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f37049b5fa0 RCX: 00007f370478eb69
RDX: 0000000000000000 RSI: 00002000000001c0 RDI: 0000000000000004
RBP: 00007f3704811df1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f37049b5fa0 R15: 00007ffe7055cb58
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:hlist_add_before_rcu include/linux/rculist.h:705 [inline]
RIP: 0010:__xfrm_state_insert+0x1710/0x2510 net/xfrm/xfrm_state.c:1743
Code: 00 fc ff df 4c 89 fa 48 c1 ea 03 80 3c 02 00 0f 85 96 0d 00 00 48 b8 00 00 00 00 00 fc ff df 4c 8b 7b 30 4c 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 6a 0d 00 00 48 b8 00 00 00 00 00 fc ff df 4c 89
RSP: 0018:ffffc9001a4b7668 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: ffff888052005dc0 RCX: 1ffff1100a400bbd
RDX: 1bd5a00000000024 RSI: 1ffff1100a400bbe RDI: 0000000000000007
RBP: ffff88802c640000 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 3d3d3d3d3d3d3d3d R12: ffff888036dd1dc0
R13: ffff888052005de8 R14: ffff888036dd1df0 R15: dead000000000122
FS: 00007f37055a26c0(0000) GS:ffff8881246cf000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fadba7b7bac CR3: 00000000391d5000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess), 3 bytes skipped:
0: df 4c 89 fa fisttps -0x6(%rcx,%rcx,4)
4: 48 c1 ea 03 shr $0x3,%rdx
8: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1)
c: 0f 85 96 0d 00 00 jne 0xda8
12: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
19: fc ff df
1c: 4c 8b 7b 30 mov 0x30(%rbx),%r15
20: 4c 89 fa mov %r15,%rdx
23: 48 c1 ea 03 shr $0x3,%rdx
* 27: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) <-- trapping instruction
2b: 0f 85 6a 0d 00 00 jne 0xd9b
31: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax
38: fc ff df
3b: 4c rex.WR
3c: 89 .byte 0x89