[syzbot] [netfilter?] KASAN: slab-use-after-free Read in nft_array_get_cmp

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 62777c8015f3 Merge branch 'net-stmmac-rk-simplify-per-soc-..
git tree: net-next
console output: https://syzkaller.appspot.com/x/log.txt?x=103e49b2580000
kernel config: https://syzkaller.appspot.com/x/.config?x=aeae47237b696a30
dashboard link: https://syzkaller.appspot.com/bug?extid=d417922a3e7935517ef6
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15e50160580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=155ce322580000

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/1eb82c60e767/disk-62777c80.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e421b2bad029/vmlinux-62777c80.xz
kernel image: https://storage.googleapis.com/syzbot-assets/3bc19b11eaeb/bzImage-62777c80.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+d41792...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: slab-use-after-free in nft_set_ext include/net/netfilter/nf_tables.h:795 [inline]
BUG: KASAN: slab-use-after-free in nft_set_ext_key include/net/netfilter/nf_tables.h:800 [inline]
BUG: KASAN: slab-use-after-free in nft_array_get_cmp+0x1f6/0x2a0 net/netfilter/nft_set_rbtree.c:133
Read of size 1 at addr ffff888058618b19 by task syz.3.79/6217

CPU: 1 UID: 0 PID: 6217 Comm: syz.3.79 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xba/0x230 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
nft_set_ext include/net/netfilter/nf_tables.h:795 [inline]
nft_set_ext_key include/net/netfilter/nf_tables.h:800 [inline]
nft_array_get_cmp+0x1f6/0x2a0 net/netfilter/nft_set_rbtree.c:133
__inline_bsearch include/linux/bsearch.h:15 [inline]
bsearch+0x50/0xc0 lib/bsearch.c:33
nft_rbtree_get+0x16b/0x400 net/netfilter/nft_set_rbtree.c:169
nft_setelem_get net/netfilter/nf_tables_api.c:6495 [inline]
nft_get_set_elem+0x420/0xaa0 net/netfilter/nf_tables_api.c:6543
nf_tables_getsetelem+0x448/0x5e0 net/netfilter/nf_tables_api.c:6632
nfnetlink_rcv_msg+0x8ae/0x12c0 net/netfilter/nfnetlink.c:290
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
nfnetlink_rcv+0x2c0/0x27b0 net/netfilter/nfnetlink.c:669
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg net/socket.c:742 [inline]
____sys_sendmsg+0xa68/0xad0 net/socket.c:2592
___sys_sendmsg+0x2a5/0x360 net/socket.c:2646
__sys_sendmsg net/socket.c:2678 [inline]
__do_sys_sendmsg net/socket.c:2683 [inline]
__se_sys_sendmsg net/socket.c:2681 [inline]
__x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2681
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f58cd79aeb9
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f58ce594028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f58cda15fa0 RCX: 00007f58cd79aeb9
RDX: 0000000000008000 RSI: 0000200000000100 RDI: 0000000000000004
RBP: 00007f58cd808c1f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f58cda16038 R14: 00007f58cda15fa0 R15: 00007ffd3f69bcd8
</TASK>

Allocated by task 6217:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__do_kmalloc_node mm/slub.c:5657 [inline]
__kmalloc_noprof+0x40c/0x7e0 mm/slub.c:5669
kmalloc_noprof include/linux/slab.h:961 [inline]
kzalloc_noprof include/linux/slab.h:1094 [inline]
nft_set_elem_init+0xa8/0x7e0 net/netfilter/nf_tables_api.c:6811
nft_add_set_elem net/netfilter/nf_tables_api.c:7547 [inline]
nf_tables_newsetelem+0x22a4/0x4360 net/netfilter/nf_tables_api.c:7717
nfnetlink_rcv_batch net/netfilter/nfnetlink.c:526 [inline]
nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:649 [inline]
nfnetlink_rcv+0x1240/0x27b0 net/netfilter/nfnetlink.c:667
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg net/socket.c:742 [inline]
____sys_sendmsg+0xa68/0xad0 net/socket.c:2592
___sys_sendmsg+0x2a5/0x360 net/socket.c:2646
__sys_sendmsg net/socket.c:2678 [inline]
__do_sys_sendmsg net/socket.c:2683 [inline]
__se_sys_sendmsg net/socket.c:2681 [inline]
__x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2681
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 5959:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2540 [inline]
slab_free mm/slub.c:6674 [inline]
kfree+0x1be/0x650 mm/slub.c:6882
nf_tables_set_elem_destroy net/netfilter/nf_tables_api.c:6930 [inline]
nft_trans_gc_trans_free+0x519/0x6c0 net/netfilter/nf_tables_api.c:10542
rcu_do_batch kernel/rcu/tree.c:2605 [inline]
rcu_core+0xc9e/0x1750 kernel/rcu/tree.c:2857
handle_softirqs+0x22a/0x7c0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x5f/0x150 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697

The buggy address belongs to the object at ffff888058618b00
which belongs to the cache kmalloc-cg-64 of size 64
The buggy address is located 25 bytes inside of
freed 64-byte region [ffff888058618b00, ffff888058618b40)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888058618300 pfn:0x58618
memcg:ffff888078dd1a01
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000000 ffff88813fe2ec80 ffffea0001b2c9c0 dead000000000006
raw: ffff888058618300 000000000020001e 00000000f5000000 ffff888078dd1a01
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5876, tgid 5876 (syz-executor), ts 78950935067, free_ts 78950359848
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x228/0x280 mm/page_alloc.c:1884
prep_new_page mm/page_alloc.c:1892 [inline]
get_page_from_freelist+0x24dc/0x2580 mm/page_alloc.c:3945
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5240
alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2486
alloc_slab_page mm/slub.c:3075 [inline]
allocate_slab+0x86/0x3a0 mm/slub.c:3248
new_slab mm/slub.c:3302 [inline]
___slab_alloc+0xd82/0x1760 mm/slub.c:4656
__slab_alloc+0x65/0x100 mm/slub.c:4779
__slab_alloc_node mm/slub.c:4855 [inline]
slab_alloc_node mm/slub.c:5251 [inline]
__do_kmalloc_node mm/slub.c:5656 [inline]
__kvmalloc_node_noprof+0x673/0x8d0 mm/slub.c:7140
allocate_hook_entries_size net/netfilter/core.c:58 [inline]
nf_hook_entries_grow+0x288/0x720 net/netfilter/core.c:137
__nf_register_net_hook+0x2c9/0x930 net/netfilter/core.c:432
nf_register_net_hook+0xb2/0x190 net/netfilter/core.c:575
nf_register_net_hooks+0x44/0x1b0 net/netfilter/core.c:591
ipt_register_table+0x55b/0x7f0 net/ipv4/netfilter/ip_tables.c:1781
iptable_filter_table_init+0x75/0xb0 net/ipv4/netfilter/iptable_filter.c:49
xt_find_table_lock+0x30c/0x3e0 net/netfilter/x_tables.c:1260
xt_request_find_table_lock+0x26/0x100 net/netfilter/x_tables.c:1285
page last free pid 5876 tgid 5876 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1433 [inline]
__free_frozen_pages+0xbf8/0xd70 mm/page_alloc.c:2973
vfree+0x25a/0x400 mm/vmalloc.c:3466
copy_entries_to_user net/ipv4/netfilter/arp_tables.c:713 [inline]
get_entries net/ipv4/netfilter/arp_tables.c:867 [inline]
do_arpt_get_ctl+0xdef/0x1100 net/ipv4/netfilter/arp_tables.c:1461
nf_getsockopt+0x26e/0x290 net/netfilter/nf_sockopt.c:116
ip_getsockopt+0x19e/0x230 net/ipv4/ip_sockglue.c:1777
do_sock_getsockopt+0x2d3/0x3f0 net/socket.c:2383
__sys_getsockopt net/socket.c:2412 [inline]
__do_sys_getsockopt net/socket.c:2419 [inline]
__se_sys_getsockopt net/socket.c:2416 [inline]
__x64_sys_getsockopt+0x1a4/0x240 net/socket.c:2416
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Memory state around the buggy address:
ffff888058618a00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff888058618a80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff888058618b00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
^
ffff888058618b80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff888058618c00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.

***

Subject: [PATCH] netfilter: nf_tables: fix use-after-free in nft_set_elem lookup
Author: karti...@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git main

Add RCU read-side critical section in nft_get_set_elem() to protect
against concurrent element deletion by garbage collection.

The lookup path in nft_rbtree_get() dereferences set elements through
interval->from and interval->to pointers via nft_array_get_cmp().
These elements can be freed by nft_trans_gc_trans_free() running in
an RCU callback context while the lookup is in progress, leading to
a use-after-free.

The crash occurs in nft_array_get_cmp() when it calls nft_set_ext_key()
on a freed element:

BUG: KASAN: slab-use-after-free in nft_array_get_cmp+0x1f6/0x2a0

Protect the element lookup with rcu_read_lock()/rcu_read_unlock() to
ensure the RCU grace period extends until after we're done accessing
the element data. This prevents the GC callback from freeing elements
while they're being accessed.

Reported-by: syzbot+d41792...@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d417922a3e7935517ef6
Signed-off-by: Deepanshu Kartikey <karti...@gmail.com>
---
net/netfilter/nf_tables_api.c | 3 +++
1 file changed, 3 insertions(+)

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index be4924aeaf0e..57affe22e0bd 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -6540,7 +6540,10 @@ static int nft_get_set_elem(struct nft_ctx *ctx, const struct nft_set *set,
return err;
}

+ rcu_read_lock();
err = nft_setelem_get(ctx, set, &elem, flags);
+ rcu_read_unlock();
+
if (err < 0)
return err;

--
2.43.0

[Florian Westphal]

Use after free, its possible for rbtree insert to evict elements
due to expiry, but still return -EEXIST.

We can thus end up with removed elements but without a call to
->commit(), hence we have a stale binary blob referencing free'd
elements.

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in nft_array_get_cmp

==================================================================
BUG: KASAN: slab-use-after-free in nft_set_ext include/net/netfilter/nf_tables.h:795 [inline]
BUG: KASAN: slab-use-after-free in nft_set_ext_key include/net/netfilter/nf_tables.h:800 [inline]
BUG: KASAN: slab-use-after-free in nft_array_get_cmp+0x1f6/0x2a0 net/netfilter/nft_set_rbtree.c:133

Read of size 1 at addr ffff88801e3d3099 by task syz.1.92/6700

CPU: 0 UID: 0 PID: 6700 Comm: syz.1.92 Not tainted syzkaller #0 PREEMPT(full)

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xba/0x230 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
nft_set_ext include/net/netfilter/nf_tables.h:795 [inline]
nft_set_ext_key include/net/netfilter/nf_tables.h:800 [inline]
nft_array_get_cmp+0x1f6/0x2a0 net/netfilter/nft_set_rbtree.c:133
__inline_bsearch include/linux/bsearch.h:15 [inline]
bsearch+0x50/0xc0 lib/bsearch.c:33
nft_rbtree_get+0x16b/0x400 net/netfilter/nft_set_rbtree.c:169

nft_setelem_get net/netfilter/nf_tables_api.c:6495 [inline]
nft_get_set_elem+0x5d8/0xcd0 net/netfilter/nf_tables_api.c:6544
nf_tables_getsetelem+0x448/0x5e0 net/netfilter/nf_tables_api.c:6635

nfnetlink_rcv_msg+0x8ae/0x12c0 net/netfilter/nfnetlink.c:290
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
nfnetlink_rcv+0x2c0/0x27b0 net/netfilter/nfnetlink.c:669
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg net/socket.c:742 [inline]
____sys_sendmsg+0xa68/0xad0 net/socket.c:2592
___sys_sendmsg+0x2a5/0x360 net/socket.c:2646
__sys_sendmsg net/socket.c:2678 [inline]
__do_sys_sendmsg net/socket.c:2683 [inline]
__se_sys_sendmsg net/socket.c:2681 [inline]
__x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2681
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

RIP: 0033:0x7fda1419aeb9

Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007fda150fa028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fda14415fa0 RCX: 00007fda1419aeb9

RDX: 0000000000008000 RSI: 0000200000000100 RDI: 0000000000000004

RBP: 00007fda14208c1f R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007fda14416038 R14: 00007fda14415fa0 R15: 00007ffe60f61eb8
</TASK>

Allocated by task 6700:

kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__do_kmalloc_node mm/slub.c:5657 [inline]
__kmalloc_noprof+0x40c/0x7e0 mm/slub.c:5669
kmalloc_noprof include/linux/slab.h:961 [inline]
kzalloc_noprof include/linux/slab.h:1094 [inline]

nft_set_elem_init+0xa8/0x7e0 net/netfilter/nf_tables_api.c:6814
nft_add_set_elem net/netfilter/nf_tables_api.c:7550 [inline]
nf_tables_newsetelem+0x22a4/0x4360 net/netfilter/nf_tables_api.c:7720

nfnetlink_rcv_batch net/netfilter/nfnetlink.c:526 [inline]
nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:649 [inline]
nfnetlink_rcv+0x1240/0x27b0 net/netfilter/nfnetlink.c:667
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg net/socket.c:742 [inline]
____sys_sendmsg+0xa68/0xad0 net/socket.c:2592
___sys_sendmsg+0x2a5/0x360 net/socket.c:2646
__sys_sendmsg net/socket.c:2678 [inline]
__do_sys_sendmsg net/socket.c:2683 [inline]
__se_sys_sendmsg net/socket.c:2681 [inline]
__x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2681
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 3484:

kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2540 [inline]
slab_free mm/slub.c:6674 [inline]
kfree+0x1be/0x650 mm/slub.c:6882

nf_tables_set_elem_destroy net/netfilter/nf_tables_api.c:6933 [inline]
nft_trans_gc_trans_free+0x519/0x6c0 net/netfilter/nf_tables_api.c:10545

rcu_do_batch kernel/rcu/tree.c:2605 [inline]
rcu_core+0xc9e/0x1750 kernel/rcu/tree.c:2857
handle_softirqs+0x22a/0x7c0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x5f/0x150 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697

The buggy address belongs to the object at ffff88801e3d3080

which belongs to the cache kmalloc-cg-64 of size 64
The buggy address is located 25 bytes inside of

freed 64-byte region [ffff88801e3d3080, ffff88801e3d30c0)

The buggy address belongs to the physical page:

page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1e3d3
memcg:ffff8880768ac801

flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)

raw: 00fff00000000000 ffff88813fe2ec80 dead000000000100 dead000000000122
raw: 0000000000000000 0000000080200020 00000000f5000000 ffff8880768ac801

page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 2135, tgid 2135 (kworker/u8:9), ts 83657173301, free_ts 83540632799

set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x228/0x280 mm/page_alloc.c:1884
prep_new_page mm/page_alloc.c:1892 [inline]
get_page_from_freelist+0x24dc/0x2580 mm/page_alloc.c:3945
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5240
alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2486
alloc_slab_page mm/slub.c:3075 [inline]
allocate_slab+0x86/0x3a0 mm/slub.c:3248
new_slab mm/slub.c:3302 [inline]
___slab_alloc+0xd82/0x1760 mm/slub.c:4656
__slab_alloc+0x65/0x100 mm/slub.c:4779
__slab_alloc_node mm/slub.c:4855 [inline]
slab_alloc_node mm/slub.c:5251 [inline]
__do_kmalloc_node mm/slub.c:5656 [inline]
__kvmalloc_node_noprof+0x673/0x8d0 mm/slub.c:7140
allocate_hook_entries_size net/netfilter/core.c:58 [inline]

__nf_hook_entries_try_shrink+0x328/0x700 net/netfilter/core.c:257
__nf_unregister_net_hook+0x4cc/0x6f0 net/netfilter/core.c:517
nf_unregister_net_hook net/netfilter/core.c:-1 [inline]
nf_unregister_net_hooks+0xcb/0x140 net/netfilter/core.c:610
ops_pre_exit_list net/core/net_namespace.c:161 [inline]
ops_undo_list+0x187/0x940 net/core/net_namespace.c:234
cleanup_net+0x4df/0x7b0 net/core/net_namespace.c:696
process_one_work kernel/workqueue.c:3257 [inline]
process_scheduled_works+0xaec/0x17a0 kernel/workqueue.c:3340
worker_thread+0xda6/0x1360 kernel/workqueue.c:3421
kthread+0x726/0x8b0 kernel/kthread.c:463
page last free pid 24 tgid 24 stack trace:

reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1433 [inline]
__free_frozen_pages+0xbf8/0xd70 mm/page_alloc.c:2973
vfree+0x25a/0x400 mm/vmalloc.c:3466

delayed_vfree_work+0x55/0x80 mm/vmalloc.c:3385
process_one_work kernel/workqueue.c:3257 [inline]
process_scheduled_works+0xaec/0x17a0 kernel/workqueue.c:3340
worker_thread+0xda6/0x1360 kernel/workqueue.c:3421
kthread+0x726/0x8b0 kernel/kthread.c:463
ret_from_fork+0x51b/0xa40 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

Memory state around the buggy address:

ffff88801e3d2f80: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
ffff88801e3d3000: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc
>ffff88801e3d3080: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
^
ffff88801e3d3100: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff88801e3d3180: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
==================================================================


Tested on:

commit: 239f09e2 selftests: ptp: treat unsupported PHC operati..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git main
console output: https://syzkaller.appspot.com/x/log.txt?x=17cf3fb3980000

kernel config: https://syzkaller.appspot.com/x/.config?x=aeae47237b696a30
dashboard link: https://syzkaller.appspot.com/bug?extid=d417922a3e7935517ef6
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8

patch: https://syzkaller.appspot.com/x/patch.diff?x=14c4fa44580000

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-...@vger.kernel.org, syzkall...@googlegroups.com.

***

Subject: [PATCH] netfilter: nf_tables: add missing RCU read lock in nf_tables_getsetelem

Author: karti...@gmail.com

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git main

Add RCU read-side critical section in nf_tables_getsetelem() to protect

against concurrent element deletion by garbage collection.

The function nf_tables_getsetelem() calls nft_get_set_elem() which
eventually dereferences set elements through the rbtree lookup path.

These elements can be freed by nft_trans_gc_trans_free() running in an
RCU callback context while the lookup is in progress, leading to a
use-after-free.

The function nf_tables_getsetelem_reset() already has proper RCU
protection around the same code path. This patch adds the missing RCU
read lock to nf_tables_getsetelem() to match.

Reported-by: syzbot+d41792...@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=d417922a3e7935517ef6
Signed-off-by: Deepanshu Kartikey <karti...@gmail.com>
---

net/netfilter/nf_tables_api.c | 2 ++
1 file changed, 2 insertions(+)

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index be4924aeaf0e..00af242b1e62 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -6628,6 +6628,7 @@ static int nf_tables_getsetelem(struct sk_buff *skb,
if (err)
return err;

+ rcu_read_lock();
nla_for_each_nested(attr, nla[NFTA_SET_ELEM_LIST_ELEMENTS], rem) {
err = nft_get_set_elem(&dump_ctx.ctx, dump_ctx.set, attr, false);
if (err < 0) {
@@ -6635,6 +6636,7 @@ static int nf_tables_getsetelem(struct sk_buff *skb,
break;
}
}
+ rcu_read_unlock();

return err;
}
--
2.43.0

[syzbot]

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
KASAN: slab-use-after-free Read in nft_array_get_cmp

==================================================================
BUG: KASAN: slab-use-after-free in nft_set_ext include/net/netfilter/nf_tables.h:795 [inline]
BUG: KASAN: slab-use-after-free in nft_set_ext_key include/net/netfilter/nf_tables.h:800 [inline]
BUG: KASAN: slab-use-after-free in nft_array_get_cmp+0x1f6/0x2a0 net/netfilter/nft_set_rbtree.c:133

Read of size 1 at addr ffff888028356599 by task syz.4.61/6804

CPU: 0 UID: 0 PID: 6804 Comm: syz.4.61 Not tainted syzkaller #0 PREEMPT(full)

Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026
Call Trace:
<TASK>
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xba/0x230 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
nft_set_ext include/net/netfilter/nf_tables.h:795 [inline]
nft_set_ext_key include/net/netfilter/nf_tables.h:800 [inline]
nft_array_get_cmp+0x1f6/0x2a0 net/netfilter/nft_set_rbtree.c:133
__inline_bsearch include/linux/bsearch.h:15 [inline]
bsearch+0x50/0xc0 lib/bsearch.c:33
nft_rbtree_get+0x16b/0x400 net/netfilter/nft_set_rbtree.c:169
nft_setelem_get net/netfilter/nf_tables_api.c:6495 [inline]

nft_get_set_elem+0x420/0xaa0 net/netfilter/nf_tables_api.c:6543
nf_tables_getsetelem+0x5c3/0x7c0 net/netfilter/nf_tables_api.c:6633

nfnetlink_rcv_msg+0x8ae/0x12c0 net/netfilter/nfnetlink.c:290
netlink_rcv_skb+0x232/0x4b0 net/netlink/af_netlink.c:2550
nfnetlink_rcv+0x2c0/0x27b0 net/netfilter/nfnetlink.c:669
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg net/socket.c:742 [inline]
____sys_sendmsg+0xa68/0xad0 net/socket.c:2592
___sys_sendmsg+0x2a5/0x360 net/socket.c:2646
__sys_sendmsg net/socket.c:2678 [inline]
__do_sys_sendmsg net/socket.c:2683 [inline]
__se_sys_sendmsg net/socket.c:2681 [inline]
__x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2681
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

RIP: 0033:0x7f908c99aeb9

Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48

RSP: 002b:00007f908d8ae028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f908cc16090 RCX: 00007f908c99aeb9

RDX: 0000000000008000 RSI: 0000200000000100 RDI: 0000000000000004

RBP: 00007f908ca08c1f R08: 0000000000000000 R09: 0000000000000000

R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000

R13: 00007f908cc16128 R14: 00007f908cc16090 R15: 00007ffcbdac0cb8
</TASK>

Allocated by task 6799:

kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__do_kmalloc_node mm/slub.c:5657 [inline]
__kmalloc_noprof+0x40c/0x7e0 mm/slub.c:5669
kmalloc_noprof include/linux/slab.h:961 [inline]
kzalloc_noprof include/linux/slab.h:1094 [inline]

nft_set_elem_init+0xa8/0x7e0 net/netfilter/nf_tables_api.c:6813
nft_add_set_elem net/netfilter/nf_tables_api.c:7549 [inline]
nf_tables_newsetelem+0x22a4/0x4360 net/netfilter/nf_tables_api.c:7719

nfnetlink_rcv_batch net/netfilter/nfnetlink.c:526 [inline]
nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:649 [inline]
nfnetlink_rcv+0x1240/0x27b0 net/netfilter/nfnetlink.c:667
netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
netlink_unicast+0x80f/0x9b0 net/netlink/af_netlink.c:1344
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1894
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg net/socket.c:742 [inline]
____sys_sendmsg+0xa68/0xad0 net/socket.c:2592
___sys_sendmsg+0x2a5/0x360 net/socket.c:2646
__sys_sendmsg net/socket.c:2678 [inline]
__do_sys_sendmsg net/socket.c:2683 [inline]
__se_sys_sendmsg net/socket.c:2681 [inline]
__x64_sys_sendmsg+0x1bd/0x2a0 net/socket.c:2681
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 6801:

kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2540 [inline]
slab_free mm/slub.c:6674 [inline]
kfree+0x1be/0x650 mm/slub.c:6882

nf_tables_set_elem_destroy net/netfilter/nf_tables_api.c:6932 [inline]
nft_trans_gc_trans_free+0x519/0x6c0 net/netfilter/nf_tables_api.c:10544

rcu_do_batch kernel/rcu/tree.c:2605 [inline]
rcu_core+0xc9e/0x1750 kernel/rcu/tree.c:2857
handle_softirqs+0x22a/0x7c0 kernel/softirq.c:622
__do_softirq kernel/softirq.c:656 [inline]
invoke_softirq kernel/softirq.c:496 [inline]
__irq_exit_rcu+0x5f/0x150 kernel/softirq.c:723
irq_exit_rcu+0x9/0x30 kernel/softirq.c:739
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline]
sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697

The buggy address belongs to the object at ffff888028356580

which belongs to the cache kmalloc-cg-64 of size 64
The buggy address is located 25 bytes inside of

freed 64-byte region [ffff888028356580, ffff8880283565c0)

The buggy address belongs to the physical page:

page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888028356a80 pfn:0x28356
memcg:ffff88807aeee201

flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)

raw: 00fff00000000000 ffff88813fe2ec80 ffffea00017ab380 dead000000000004
raw: ffff888028356a80 000000008020001f 00000000f5000000 ffff88807aeee201

page dumped because: kasan: bad access detected
page_owner tracks the page as allocated

page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 5895, tgid 5895 (syz-executor), ts 83082785285, free_ts 83057629143

set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x228/0x280 mm/page_alloc.c:1884
prep_new_page mm/page_alloc.c:1892 [inline]
get_page_from_freelist+0x24dc/0x2580 mm/page_alloc.c:3945
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5240
alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2486
alloc_slab_page mm/slub.c:3075 [inline]
allocate_slab+0x86/0x3a0 mm/slub.c:3248
new_slab mm/slub.c:3302 [inline]
___slab_alloc+0xd82/0x1760 mm/slub.c:4656
__slab_alloc+0x65/0x100 mm/slub.c:4779
__slab_alloc_node mm/slub.c:4855 [inline]
slab_alloc_node mm/slub.c:5251 [inline]
__do_kmalloc_node mm/slub.c:5656 [inline]
__kvmalloc_node_noprof+0x673/0x8d0 mm/slub.c:7140
allocate_hook_entries_size net/netfilter/core.c:58 [inline]

nf_hook_entries_grow+0x288/0x720 net/netfilter/core.c:137
__nf_register_net_hook+0x2c9/0x930 net/netfilter/core.c:432
nf_register_net_hook+0xb2/0x190 net/netfilter/core.c:575
nf_register_net_hooks+0x44/0x1b0 net/netfilter/core.c:591

ip6t_register_table+0x561/0x800 net/ipv6/netfilter/ip6_tables.c:1787
ip6table_filter_table_init+0x75/0xb0 net/ipv6/netfilter/ip6table_filter.c:48

xt_find_table_lock+0x30c/0x3e0 net/netfilter/x_tables.c:1260
xt_request_find_table_lock+0x26/0x100 net/netfilter/x_tables.c:1285

page last free pid 23 tgid 23 stack trace:

reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1433 [inline]
__free_frozen_pages+0xbf8/0xd70 mm/page_alloc.c:2973

rcu_do_batch kernel/rcu/tree.c:2605 [inline]
rcu_core+0xc9e/0x1750 kernel/rcu/tree.c:2857
handle_softirqs+0x22a/0x7c0 kernel/softirq.c:622

run_ksoftirqd+0x36/0x60 kernel/softirq.c:1063
smpboot_thread_fn+0x541/0xa50 kernel/smpboot.c:160

kthread+0x726/0x8b0 kernel/kthread.c:463
ret_from_fork+0x51b/0xa40 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246

Memory state around the buggy address:

ffff888028356480: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
ffff888028356500: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff888028356580: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
^
ffff888028356600: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
ffff888028356680: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc

==================================================================


Tested on:

commit: 239f09e2 selftests: ptp: treat unsupported PHC operati..
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next.git main

console output: https://syzkaller.appspot.com/x/log.txt?x=17b4f05a580000

kernel config: https://syzkaller.appspot.com/x/.config?x=aeae47237b696a30
dashboard link: https://syzkaller.appspot.com/bug?extid=d417922a3e7935517ef6
compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8

patch: https://syzkaller.appspot.com/x/patch.diff?x=1432ebfa580000

[Florian Westphal]

Florian Westphal <f...@strlen.de> wrote:
> > dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
> > print_address_description mm/kasan/report.c:378 [inline]
> > print_report+0xba/0x230 mm/kasan/report.c:482
> > kasan_report+0x117/0x150 mm/kasan/report.c:595
> > nft_set_ext include/net/netfilter/nf_tables.h:795 [inline]
> > nft_set_ext_key include/net/netfilter/nf_tables.h:800 [inline]
> > nft_array_get_cmp+0x1f6/0x2a0 net/netfilter/nft_set_rbtree.c:133
> > __inline_bsearch include/linux/bsearch.h:15 [inline]
> > bsearch+0x50/0xc0 lib/bsearch.c:33
> > nft_rbtree_get+0x16b/0x400 net/netfilter/nft_set_rbtree.c:169
>
> Use after free, its possible for rbtree insert to evict elements
> due to expiry, but still return -EEXIST.
>
> We can thus end up with removed elements but without a call to
> ->commit(), hence we have a stale binary blob referencing free'd
> elements.

So far I found 3 related issues, bsearch blob gets out of sync with the
rbtree. Prerequisite: set has a timed-out entry. In all cases
the bsearch blob isn't refreshed and holds pointers to free'd elements.

1. add new element, transaction is later aborted.
Fix: refresh the bsearch blob from abort callback.

2. re-add an existing element, transaction passes.
In this case, the commit hook isn't called because we don't have
any changes to the set from transaction point of view.

3. create (F_EXCL) an existing element. This also
aborts the transaction, but the abort callback isn't run
as no change to the set was made.

I'm not yet sure how to fix 2 and 3.

I'll see about moving set_update_list to the nft pernet
structure, so it can be populated from
nft_trans_gc_queue_sync_done().

Pipapo set backend should be fine with it, it won't act
when called with the 'private clone' being NULL.