Warning: Permanently added '10.128.10.0' (ED25519) to the list of known hosts. 2025/09/10 14:23:23 parsed 1 programs [ 57.095242][ T2676] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 60.488763][ T2762] veth0_vlan: entered promiscuous mode [ 61.132374][ T299] veth0_vlan: left promiscuous mode 2025/09/10 14:23:28 executed programs: 0 [ 63.065242][ T2995] veth0_vlan: entered promiscuous mode [ 63.638550][ T3222] syz.2.17 uses obsolete (PF_INET,SOCK_PACKET) [ 63.645574][ T3222] ================================================================== [ 63.653640][ T3222] BUG: KASAN: slab-use-after-free in napi_gro_frags+0x68/0xc30 [ 63.661162][ T3222] Read of size 8 at addr ffff8881148605c8 by task syz.2.17/3222 [ 63.668758][ T3222] [ 63.671149][ T3222] CPU: 0 PID: 3222 Comm: syz.2.17 Not tainted syzkaller #0 [ 63.678316][ T3222] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 63.688351][ T3222] Call Trace: [ 63.691639][ T3222] [ 63.694579][ T3222] dump_stack_lvl+0xcf/0x140 [ 63.699153][ T3222] ? __pfx_dump_stack_lvl+0x10/0x10 [ 63.704321][ T3222] ? __virt_addr_valid+0x177/0x290 [ 63.709403][ T3222] ? __virt_addr_valid+0x24b/0x290 [ 63.714482][ T3222] print_report+0xca/0x250 [ 63.718880][ T3222] ? napi_gro_frags+0x68/0xc30 [ 63.723614][ T3222] kasan_report+0x117/0x150 [ 63.728087][ T3222] ? napi_gro_frags+0x68/0xc30 [ 63.732852][ T3222] napi_gro_frags+0x68/0xc30 [ 63.737443][ T3222] ? __pfx_napi_schedule_prep+0x10/0x10 [ 63.742956][ T3222] tun_get_user+0x1d1c/0x2bc0 [ 63.747622][ T3222] ? tun_get_user+0x1b80/0x2bc0 [ 63.752441][ T3222] ? schedule+0x10f/0x220 [ 63.756752][ T3222] ? aa_file_perm+0xf4/0x930 [ 63.761320][ T3222] ? __pfx_tun_get_user+0x10/0x10 [ 63.766314][ T3222] ? tun_get+0x20/0x110 [ 63.770443][ T3222] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 63.775874][ T3222] ? tun_get+0x20/0x110 [ 63.780000][ T3222] ? __pfx_lock_release+0x10/0x10 [ 63.784989][ T3222] ? __lock_acquire+0x5dc/0xbd0 [ 63.789812][ T3222] ? tun_get+0x20/0x110 [ 63.793950][ T3222] ? tun_get+0x20/0x110 [ 63.798069][ T3222] tun_chr_write_iter+0xc3/0x190 [ 63.802976][ T3222] vfs_write+0x593/0xc10 [ 63.807215][ T3222] ? __pfx_vfs_write+0x10/0x10 [ 63.811956][ T3222] ? __fget_files+0x2d/0x2d0 [ 63.816548][ T3222] ? __fget_files+0x2d/0x2d0 [ 63.821110][ T3222] ksys_write+0xf2/0x1a0 [ 63.825337][ T3222] ? __pfx_ksys_write+0x10/0x10 [ 63.830162][ T3222] ? switch_fpu_return+0xcf/0x140 [ 63.835167][ T3222] do_syscall_64+0x92/0x180 [ 63.839690][ T3222] ? fpregs_assert_state_consistent+0x47/0x60 [ 63.845733][ T3222] entry_SYSCALL_64_after_hwframe+0x6f/0x77 [ 63.851620][ T3222] RIP: 0033:0x7f8f5df11be9 [ 63.856015][ T3222] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 63.875619][ T3222] RSP: 002b:00007f8f5dd82038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 63.884001][ T3222] RAX: ffffffffffffffda RBX: 00007f8f5e148fa0 RCX: 00007f8f5df11be9 [ 63.892038][ T3222] RDX: 000000000000004b RSI: 0000200000000340 RDI: 0000000000000003 [ 63.899983][ T3222] RBP: 00007f8f5df94e19 R08: 0000000000000000 R09: 0000000000000000 [ 63.907922][ T3222] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 63.915874][ T3222] R13: 00007f8f5e149038 R14: 00007f8f5e148fa0 R15: 00007ffe5eababe8 [ 63.923814][ T3222] [ 63.926815][ T3222] [ 63.929111][ T3222] Allocated by task 3222: [ 63.933409][ T3222] kasan_save_track+0x3e/0x80 [ 63.938054][ T3222] __kasan_mempool_unpoison_object+0xad/0x1c0 [ 63.944086][ T3222] __napi_build_skb+0xc8/0x190 [ 63.948815][ T3222] __napi_alloc_skb+0x311/0x490 [ 63.953628][ T3222] napi_get_frags+0x61/0x130 [ 63.958183][ T3222] tun_get_user+0x77a/0x2bc0 [ 63.962739][ T3222] tun_chr_write_iter+0xc3/0x190 [ 63.967643][ T3222] vfs_write+0x593/0xc10 [ 63.971863][ T3222] ksys_write+0xf2/0x1a0 [ 63.976084][ T3222] do_syscall_64+0x92/0x180 [ 63.980560][ T3222] entry_SYSCALL_64_after_hwframe+0x6f/0x77 [ 63.986436][ T3222] [ 63.988732][ T3222] Freed by task 3222: [ 63.992679][ T3222] kasan_save_track+0x3e/0x80 [ 63.997326][ T3222] kasan_save_free_info+0x54/0x70 [ 64.002316][ T3222] poison_slab_object+0xfb/0x1c0 [ 64.007220][ T3222] __kasan_slab_free+0x3d/0x70 [ 64.011948][ T3222] kmem_cache_free+0x12b/0x310 [ 64.016681][ T3222] skb_cow_data_for_xdp+0xc60/0x11f0 [ 64.021931][ T3222] do_xdp_generic+0x274/0x960 [ 64.026572][ T3222] tun_get_user+0x1ad5/0x2bc0 [ 64.031237][ T3222] tun_chr_write_iter+0xc3/0x190 [ 64.036161][ T3222] vfs_write+0x593/0xc10 [ 64.040395][ T3222] ksys_write+0xf2/0x1a0 [ 64.044615][ T3222] do_syscall_64+0x92/0x180 [ 64.049088][ T3222] entry_SYSCALL_64_after_hwframe+0x6f/0x77 [ 64.054948][ T3222] [ 64.057249][ T3222] The buggy address belongs to the object at ffff888114860500 [ 64.057249][ T3222] which belongs to the cache skbuff_head_cache of size 224 [ 64.071797][ T3222] The buggy address is located 200 bytes inside of [ 64.071797][ T3222] freed 224-byte region [ffff888114860500, ffff8881148605e0) [ 64.085571][ T3222] [ 64.087873][ T3222] The buggy address belongs to the physical page: [ 64.094265][ T3222] page:ffffea0004521800 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x114860 [ 64.104482][ T3222] flags: 0x200000000000800(slab|node=0|zone=2) [ 64.110637][ T3222] page_type: 0xffffffff() [ 64.114940][ T3222] raw: 0200000000000800 ffff8881026c03c0 ffffea000449e540 dead000000000002 [ 64.123491][ T3222] raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000 [ 64.132082][ T3222] page dumped because: kasan: bad access detected [ 64.138478][ T3222] page_owner tracks the page as allocated [ 64.144161][ T3222] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY), pid 1971, tgid 1971 (udevadm), ts 5914911784, free_ts 0 [ 64.161077][ T3222] post_alloc_hook+0x16e/0x1b0 [ 64.165824][ T3222] get_page_from_freelist+0x2eaa/0x3000 [ 64.171348][ T3222] __alloc_pages+0x1d2/0x400 [ 64.175910][ T3222] alloc_slab_page+0x46/0x140 [ 64.180565][ T3222] new_slab+0x70/0x270 [ 64.184610][ T3222] ___slab_alloc+0xa70/0x1020 [ 64.189262][ T3222] kmem_cache_alloc+0x21c/0x360 [ 64.194170][ T3222] skb_clone+0x19f/0x330 [ 64.198476][ T3222] netlink_broadcast_filtered+0x560/0xdf0 [ 64.204168][ T3222] netlink_broadcast+0xe/0x20 [ 64.208816][ T3222] kobject_uevent_net_broadcast+0x30c/0x3f0 [ 64.214681][ T3222] kobject_uevent_env+0x567/0x700 [ 64.219677][ T3222] kobject_synth_uevent+0x741/0x8d0 [ 64.224854][ T3222] uevent_store+0x46/0x60 [ 64.229188][ T3222] kernfs_fop_write_iter+0x29c/0x3d0 [ 64.234535][ T3222] vfs_write+0x593/0xc10 [ 64.238746][ T3222] page_owner free stack trace missing [ 64.244105][ T3222] [ 64.246414][ T3222] Memory state around the buggy address: [ 64.252016][ T3222] ffff888114860480: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc [ 64.260064][ T3222] ffff888114860500: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 64.268114][ T3222] >ffff888114860580: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 64.276174][ T3222] ^ [ 64.282565][ T3222] ffff888114860600: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00 [ 64.290614][ T3222] ffff888114860680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 64.298647][ T3222] ================================================================== [ 64.306832][ T3222] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 64.314287][ T3222] Kernel Offset: disabled [ 64.318597][ T3222] Rebooting in 86400 seconds..