================================================================== BUG: KASAN: slab-use-after-free in xsk_bind+0xe38/0xeac net/xdp/xsk.c:1758 Read of size 4 at addr ffff0000f3ca718c by task syz.0.463/6574 CPU: 1 UID: 0 PID: 6574 Comm: syz.0.463 Tainted: G L syzkaller #0 PREEMPT Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/02/2026 Call trace: show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:499 (C) __dump_stack+0x30/0x40 lib/dump_stack.c:94 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120 print_address_description+0xb0/0x238 mm/kasan/report.c:378 print_report+0x68/0x84 mm/kasan/report.c:482 kasan_report+0x8c/0xc4 mm/kasan/report.c:595 __asan_report_load4_noabort+0x20/0x2c mm/kasan/report_generic.c:380 xsk_bind+0xe38/0xeac net/xdp/xsk.c:1758 __sys_bind_socket net/socket.c:1920 [inline] __sys_bind+0x1c4/0x268 net/socket.c:1951 __do_sys_bind net/socket.c:1956 [inline] __se_sys_bind net/socket.c:1954 [inline] __arm64_sys_bind+0x84/0x9c net/socket.c:1954 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:738 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:757 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590 Allocated by task 4711: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:78 kasan_save_alloc_info+0x44/0x54 mm/kasan/generic.c:570 poison_kmalloc_redzone mm/kasan/common.c:398 [inline] __kasan_kmalloc+0x9c/0xb4 mm/kasan/common.c:415 kasan_kmalloc include/linux/kasan.h:263 [inline] __do_kmalloc_node mm/slub.c:5334 [inline] __kvmalloc_node_noprof+0x460/0x7d8 mm/slub.c:6905 xt_alloc_table_info+0x58/0xc4 net/netfilter/x_tables.c:1286 do_replace net/ipv4/netfilter/ip_tables.c:1124 [inline] do_ipt_set_ctl+0x850/0xc38 net/ipv4/netfilter/ip_tables.c:1634 nf_setsockopt+0xa0/0xe4 net/netfilter/nf_sockopt.c:101 ip_setsockopt+0x118/0x128 net/ipv4/ip_sockglue.c:1424 tcp_setsockopt+0xcc/0xe8 net/ipv4/tcp.c:4179 sock_common_setsockopt+0xb0/0xcc net/core/sock.c:4034 do_sock_setsockopt+0x1f0/0x330 net/socket.c:2368 __sys_setsockopt+0x104/0x170 net/socket.c:2393 __do_sys_setsockopt net/socket.c:2399 [inline] __se_sys_setsockopt net/socket.c:2396 [inline] __arm64_sys_setsockopt+0xc8/0xe4 net/socket.c:2396 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:738 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:757 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590 Freed by task 4711: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x40/0x78 mm/kasan/common.c:78 kasan_save_free_info+0x58/0x70 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x74/0xa4 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2677 [inline] slab_free mm/slub.c:6377 [inline] kfree+0x188/0x690 mm/slub.c:6692 kvfree+0x30/0x40 mm/slub.c:6954 xt_free_table_info+0x114/0x13c net/netfilter/x_tables.c:1306 __do_replace+0x664/0x8f4 net/ipv4/netfilter/ip_tables.c:1082 do_replace net/ipv4/netfilter/ip_tables.c:1139 [inline] do_ipt_set_ctl+0x980/0xc38 net/ipv4/netfilter/ip_tables.c:1634 nf_setsockopt+0xa0/0xe4 net/netfilter/nf_sockopt.c:101 ip_setsockopt+0x118/0x128 net/ipv4/ip_sockglue.c:1424 tcp_setsockopt+0xcc/0xe8 net/ipv4/tcp.c:4179 sock_common_setsockopt+0xb0/0xcc net/core/sock.c:4034 do_sock_setsockopt+0x1f0/0x330 net/socket.c:2368 __sys_setsockopt+0x104/0x170 net/socket.c:2393 __do_sys_setsockopt net/socket.c:2399 [inline] __se_sys_setsockopt net/socket.c:2396 [inline] __arm64_sys_setsockopt+0xc8/0xe4 net/socket.c:2396 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline] invoke_syscall+0x98/0x244 arch/arm64/kernel/syscall.c:49 el0_svc_common+0xec/0x23c arch/arm64/kernel/syscall.c:121 do_el0_svc+0x4c/0x5c arch/arm64/kernel/syscall.c:140 el0_svc+0x64/0x260 arch/arm64/kernel/entry-common.c:738 el0t_64_sync_handler+0x48/0x148 arch/arm64/kernel/entry-common.c:757 el0t_64_sync+0x198/0x19c arch/arm64/kernel/entry.S:590 The buggy address belongs to the object at ffff0000f3ca7000 which belongs to the cache kmalloc-cg-1k of size 1024 The buggy address is located 396 bytes inside of freed 1024-byte region [ffff0000f3ca7000, ffff0000f3ca7400) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff0000f3ca7000 pfn:0x133ca0 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 memcg:ffff0000d68a4801 flags: 0x5ffc00000000240(workingset|head|node=0|zone=2|lastcpupid=0x7ff) page_type: f5(slab) raw: 05ffc00000000240 ffff0000c000b280 fffffdffc3ce5810 fffffdffc3cadc10 raw: ffff0000f3ca7000 000000080010000f 00000000f5000000 ffff0000d68a4801 head: 05ffc00000000240 ffff0000c000b280 fffffdffc3ce5810 fffffdffc3cadc10 head: ffff0000f3ca7000 000000080010000f 00000000f5000000 ffff0000d68a4801 head: 05ffc00000000003 fffffdffc3cf2801 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000f3ca7080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff0000f3ca7100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff0000f3ca7180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff0000f3ca7200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff0000f3ca7280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================