[v6.1] KASAN: use-after-free Read in __xfrm_decode_session (2)
2 views
Skip to first unread message
syzbot
Apr 30, 2025, 9:03:27 AM4/30/25
to syzkaller...@googlegroups.com
Hello,
syzbot found the following issue on:
HEAD commit: 535ec20c5027 Linux 6.1.135
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1430af74580000
kernel config: https://syzkaller.appspot.com/x/.config?x=c2afad13ffca3ea1
dashboard link: https://syzkaller.appspot.com/bug?extid=cadd4c7c96a74757f198
compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2
userspace arch: arm64
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/12decbd62de7/disk-535ec20c.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/0239dce3cb58/vmlinux-535ec20c.xz
kernel image: https://storage.googleapis.com/syzbot-assets/e7ceca192181/Image-535ec20c.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+cadd4c...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in decode_session6 net/xfrm/xfrm_policy.c:3412 [inline]
BUG: KASAN: use-after-free in __xfrm_decode_session+0x14c4/0x1b8c net/xfrm/xfrm_policy.c:3518
Read of size 1 at addr ffff0000d47d2a07 by task syz.0.228/5212
CPU: 0 PID: 5212 Comm: syz.0.228 Not tainted 6.1.135-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call trace:
dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack+0x30/0x40 lib/dump_stack.c:88
dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106
print_address_description+0x88/0x220 mm/kasan/report.c:316
print_report+0x50/0x68 mm/kasan/report.c:427
kasan_report+0xa8/0x100 mm/kasan/report.c:531
__asan_report_load1_noabort+0x2c/0x38 mm/kasan/report_generic.c:348
decode_session6 net/xfrm/xfrm_policy.c:3412 [inline]
__xfrm_decode_session+0x14c4/0x1b8c net/xfrm/xfrm_policy.c:3518
xfrm_decode_session_reverse include/net/xfrm.h:1184 [inline]
icmpv6_route_lookup+0x310/0x470 net/ipv6/icmp.c:394
icmp6_send+0xb98/0x13e4 net/ipv6/icmp.c:603
__icmpv6_send include/linux/icmpv6.h:28 [inline]
icmpv6_send include/linux/icmpv6.h:49 [inline]
ip6_link_failure+0x44/0x4a8 net/ipv6/route.c:2827
dst_link_failure include/net/dst.h:423 [inline]
ip6_tnl_xmit+0xed8/0x2448 net/ipv6/ip6_tunnel.c:1284
ipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1400 [inline]
ip6_tnl_start_xmit+0xb88/0x1088 net/ipv6/ip6_tunnel.c:1449
__netdev_start_xmit include/linux/netdevice.h:4896 [inline]
netdev_start_xmit include/linux/netdevice.h:4910 [inline]
xmit_one net/core/dev.c:3658 [inline]
dev_hard_start_xmit+0x244/0x8e0 net/core/dev.c:3674
sch_direct_xmit+0x204/0x480 net/sched/sch_generic.c:342
qdisc_restart net/sched/sch_generic.c:407 [inline]
__qdisc_run+0x8c0/0x1368 net/sched/sch_generic.c:415
__dev_xmit_skb net/core/dev.c:3958 [inline]
__dev_queue_xmit+0xc18/0x309c net/core/dev.c:4300
dev_queue_xmit include/linux/netdevice.h:3051 [inline]
neigh_connected_output+0x358/0x3e8 net/core/neighbour.c:1592
neigh_output include/net/neighbour.h:544 [inline]
ip6_finish_output2+0xd60/0x1844 net/ipv6/ip6_output.c:138
__ip6_finish_output net/ipv6/ip6_output.c:205 [inline]
ip6_finish_output+0x594/0x930 net/ipv6/ip6_output.c:216
NF_HOOK_COND include/linux/netfilter.h:291 [inline]
ip6_output+0x274/0x500 net/ipv6/ip6_output.c:237
dst_output include/net/dst.h:453 [inline]
NF_HOOK include/linux/netfilter.h:302 [inline]
ip6_xmit+0x111c/0x19c4 net/ipv6/ip6_output.c:357
inet6_csk_xmit+0x3a0/0x60c net/ipv6/inet6_connection_sock.c:135
__tcp_transmit_skb+0x17c4/0x2b6c net/ipv4/tcp_output.c:1405
tcp_transmit_skb net/ipv4/tcp_output.c:1423 [inline]
tcp_connect+0x1a4c/0x3dd8 net/ipv4/tcp_output.c:3930
tcp_v6_connect+0xd58/0x1324 net/ipv6/tcp_ipv6.c:342
__inet_stream_connect+0x1fc/0xc3c net/ipv4/af_inet.c:668
inet_stream_connect+0x74/0xb0 net/ipv4/af_inet.c:739
__sys_connect_file net/socket.c:2011 [inline]
__sys_connect+0x264/0x28c net/socket.c:2028
__do_sys_connect net/socket.c:2038 [inline]
__se_sys_connect net/socket.c:2035 [inline]
__arm64_sys_connect+0x7c/0x94 net/socket.c:2035
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Allocated by task 9:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4c/0x80 mm/kasan/common.c:52
kasan_save_alloc_info+0x28/0x34 mm/kasan/generic.c:505
____kasan_kmalloc mm/kasan/common.c:374 [inline]
__kasan_kmalloc+0xa0/0xb8 mm/kasan/common.c:383
kasan_kmalloc include/linux/kasan.h:211 [inline]
__do_kmalloc_node mm/slab_common.c:936 [inline]
__kmalloc+0xec/0x178 mm/slab_common.c:949
kmalloc include/linux/slab.h:568 [inline]
kzalloc include/linux/slab.h:699 [inline]
ieee802_11_parse_elems_full+0xa4/0xe14 net/mac80211/util.c:1503
ieee802_11_parse_elems_crc net/mac80211/ieee80211_i.h:2248 [inline]
ieee802_11_parse_elems net/mac80211/ieee80211_i.h:2255 [inline]
ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1605 [inline]
ieee80211_ibss_rx_queued_mgmt+0x3d0/0x2490 net/mac80211/ibss.c:1638
ieee80211_iface_process_skb net/mac80211/iface.c:1671 [inline]
ieee80211_iface_work+0x598/0xa34 net/mac80211/iface.c:1725
process_one_work+0x7f4/0x13a8 kernel/workqueue.c:2292
worker_thread+0x8c8/0xfbc kernel/workqueue.c:2439
kthread+0x250/0x2d8 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864
Freed by task 9:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4c/0x80 mm/kasan/common.c:52
kasan_save_free_info+0x3c/0x60 mm/kasan/generic.c:516
____kasan_slab_free+0x148/0x1b0 mm/kasan/common.c:236
__kasan_slab_free+0x18/0x28 mm/kasan/common.c:244
kasan_slab_free include/linux/kasan.h:177 [inline]
slab_free_hook mm/slub.c:1724 [inline]
slab_free_freelist_hook+0x16c/0x1ec mm/slub.c:1750
slab_free mm/slub.c:3661 [inline]
__kmem_cache_free+0xc0/0x224 mm/slub.c:3674
kfree+0xd0/0x1ac mm/slab_common.c:988
ieee80211_ibss_rx_queued_mgmt+0xecc/0x2490 net/mac80211/ibss.c:-1
ieee80211_iface_process_skb net/mac80211/iface.c:1671 [inline]
ieee80211_iface_work+0x598/0xa34 net/mac80211/iface.c:1725
process_one_work+0x7f4/0x13a8 kernel/workqueue.c:2292
worker_thread+0x8c8/0xfbc kernel/workqueue.c:2439
kthread+0x250/0x2d8 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864
The buggy address belongs to the object at ffff0000d47d2800
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 519 bytes inside of
1024-byte region [ffff0000d47d2800, ffff0000d47d2c00)
The buggy address belongs to the physical page:
page:00000000055c3a31 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1147d0
head:00000000055c3a31 order:3 compound_mapcount:0 compound_pincount:0
flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000010200 0000000000000000 dead000000000001 ffff0000c0002780
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff0000d47d2900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff0000d47d2980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff0000d47d2a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff0000d47d2a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff0000d47d2b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot found the following issue on:
HEAD commit: 535ec20c5027 Linux 6.1.135
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1430af74580000
kernel config: https://syzkaller.appspot.com/x/.config?x=c2afad13ffca3ea1
dashboard link: https://syzkaller.appspot.com/bug?extid=cadd4c7c96a74757f198
compiler: Debian clang version 20.1.2 (++20250402124445+58df0ef89dd6-1~exp1~20250402004600.97), Debian LLD 20.1.2
userspace arch: arm64
Unfortunately, I don't have any reproducer for this issue yet.
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/12decbd62de7/disk-535ec20c.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/0239dce3cb58/vmlinux-535ec20c.xz
kernel image: https://storage.googleapis.com/syzbot-assets/e7ceca192181/Image-535ec20c.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+cadd4c...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in decode_session6 net/xfrm/xfrm_policy.c:3412 [inline]
BUG: KASAN: use-after-free in __xfrm_decode_session+0x14c4/0x1b8c net/xfrm/xfrm_policy.c:3518
Read of size 1 at addr ffff0000d47d2a07 by task syz.0.228/5212
CPU: 0 PID: 5212 Comm: syz.0.228 Not tainted 6.1.135-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call trace:
dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack+0x30/0x40 lib/dump_stack.c:88
dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106
print_address_description+0x88/0x220 mm/kasan/report.c:316
print_report+0x50/0x68 mm/kasan/report.c:427
kasan_report+0xa8/0x100 mm/kasan/report.c:531
__asan_report_load1_noabort+0x2c/0x38 mm/kasan/report_generic.c:348
decode_session6 net/xfrm/xfrm_policy.c:3412 [inline]
__xfrm_decode_session+0x14c4/0x1b8c net/xfrm/xfrm_policy.c:3518
xfrm_decode_session_reverse include/net/xfrm.h:1184 [inline]
icmpv6_route_lookup+0x310/0x470 net/ipv6/icmp.c:394
icmp6_send+0xb98/0x13e4 net/ipv6/icmp.c:603
__icmpv6_send include/linux/icmpv6.h:28 [inline]
icmpv6_send include/linux/icmpv6.h:49 [inline]
ip6_link_failure+0x44/0x4a8 net/ipv6/route.c:2827
dst_link_failure include/net/dst.h:423 [inline]
ip6_tnl_xmit+0xed8/0x2448 net/ipv6/ip6_tunnel.c:1284
ipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1400 [inline]
ip6_tnl_start_xmit+0xb88/0x1088 net/ipv6/ip6_tunnel.c:1449
__netdev_start_xmit include/linux/netdevice.h:4896 [inline]
netdev_start_xmit include/linux/netdevice.h:4910 [inline]
xmit_one net/core/dev.c:3658 [inline]
dev_hard_start_xmit+0x244/0x8e0 net/core/dev.c:3674
sch_direct_xmit+0x204/0x480 net/sched/sch_generic.c:342
qdisc_restart net/sched/sch_generic.c:407 [inline]
__qdisc_run+0x8c0/0x1368 net/sched/sch_generic.c:415
__dev_xmit_skb net/core/dev.c:3958 [inline]
__dev_queue_xmit+0xc18/0x309c net/core/dev.c:4300
dev_queue_xmit include/linux/netdevice.h:3051 [inline]
neigh_connected_output+0x358/0x3e8 net/core/neighbour.c:1592
neigh_output include/net/neighbour.h:544 [inline]
ip6_finish_output2+0xd60/0x1844 net/ipv6/ip6_output.c:138
__ip6_finish_output net/ipv6/ip6_output.c:205 [inline]
ip6_finish_output+0x594/0x930 net/ipv6/ip6_output.c:216
NF_HOOK_COND include/linux/netfilter.h:291 [inline]
ip6_output+0x274/0x500 net/ipv6/ip6_output.c:237
dst_output include/net/dst.h:453 [inline]
NF_HOOK include/linux/netfilter.h:302 [inline]
ip6_xmit+0x111c/0x19c4 net/ipv6/ip6_output.c:357
inet6_csk_xmit+0x3a0/0x60c net/ipv6/inet6_connection_sock.c:135
__tcp_transmit_skb+0x17c4/0x2b6c net/ipv4/tcp_output.c:1405
tcp_transmit_skb net/ipv4/tcp_output.c:1423 [inline]
tcp_connect+0x1a4c/0x3dd8 net/ipv4/tcp_output.c:3930
tcp_v6_connect+0xd58/0x1324 net/ipv6/tcp_ipv6.c:342
__inet_stream_connect+0x1fc/0xc3c net/ipv4/af_inet.c:668
inet_stream_connect+0x74/0xb0 net/ipv4/af_inet.c:739
__sys_connect_file net/socket.c:2011 [inline]
__sys_connect+0x264/0x28c net/socket.c:2028
__do_sys_connect net/socket.c:2038 [inline]
__se_sys_connect net/socket.c:2035 [inline]
__arm64_sys_connect+0x7c/0x94 net/socket.c:2035
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Allocated by task 9:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4c/0x80 mm/kasan/common.c:52
kasan_save_alloc_info+0x28/0x34 mm/kasan/generic.c:505
____kasan_kmalloc mm/kasan/common.c:374 [inline]
__kasan_kmalloc+0xa0/0xb8 mm/kasan/common.c:383
kasan_kmalloc include/linux/kasan.h:211 [inline]
__do_kmalloc_node mm/slab_common.c:936 [inline]
__kmalloc+0xec/0x178 mm/slab_common.c:949
kmalloc include/linux/slab.h:568 [inline]
kzalloc include/linux/slab.h:699 [inline]
ieee802_11_parse_elems_full+0xa4/0xe14 net/mac80211/util.c:1503
ieee802_11_parse_elems_crc net/mac80211/ieee80211_i.h:2248 [inline]
ieee802_11_parse_elems net/mac80211/ieee80211_i.h:2255 [inline]
ieee80211_rx_mgmt_probe_beacon net/mac80211/ibss.c:1605 [inline]
ieee80211_ibss_rx_queued_mgmt+0x3d0/0x2490 net/mac80211/ibss.c:1638
ieee80211_iface_process_skb net/mac80211/iface.c:1671 [inline]
ieee80211_iface_work+0x598/0xa34 net/mac80211/iface.c:1725
process_one_work+0x7f4/0x13a8 kernel/workqueue.c:2292
worker_thread+0x8c8/0xfbc kernel/workqueue.c:2439
kthread+0x250/0x2d8 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864
Freed by task 9:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4c/0x80 mm/kasan/common.c:52
kasan_save_free_info+0x3c/0x60 mm/kasan/generic.c:516
____kasan_slab_free+0x148/0x1b0 mm/kasan/common.c:236
__kasan_slab_free+0x18/0x28 mm/kasan/common.c:244
kasan_slab_free include/linux/kasan.h:177 [inline]
slab_free_hook mm/slub.c:1724 [inline]
slab_free_freelist_hook+0x16c/0x1ec mm/slub.c:1750
slab_free mm/slub.c:3661 [inline]
__kmem_cache_free+0xc0/0x224 mm/slub.c:3674
kfree+0xd0/0x1ac mm/slab_common.c:988
ieee80211_ibss_rx_queued_mgmt+0xecc/0x2490 net/mac80211/ibss.c:-1
ieee80211_iface_process_skb net/mac80211/iface.c:1671 [inline]
ieee80211_iface_work+0x598/0xa34 net/mac80211/iface.c:1725
process_one_work+0x7f4/0x13a8 kernel/workqueue.c:2292
worker_thread+0x8c8/0xfbc kernel/workqueue.c:2439
kthread+0x250/0x2d8 kernel/kthread.c:376
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:864
The buggy address belongs to the object at ffff0000d47d2800
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 519 bytes inside of
1024-byte region [ffff0000d47d2800, ffff0000d47d2c00)
The buggy address belongs to the physical page:
page:00000000055c3a31 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1147d0
head:00000000055c3a31 order:3 compound_mapcount:0 compound_pincount:0
flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000010200 0000000000000000 dead000000000001 ffff0000c0002780
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff0000d47d2900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff0000d47d2980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff0000d47d2a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff0000d47d2a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff0000d47d2b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
syzbot
Jul 1, 2025, 4:03:33 AM7/1/25
to syzkaller...@googlegroups.com
syzbot has found a reproducer for the following issue on:
HEAD commit: 7e69c33e4858 Linux 6.1.142
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1510d88c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a8ab0a96d60bbe8f
dashboard link: https://syzkaller.appspot.com/bug?extid=cadd4c7c96a74757f198
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=160b13d4580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17659982580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/45e07ce672f1/disk-7e69c33e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e00cc723dfa5/vmlinux-7e69c33e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/4cbcf3fe062f/Image-7e69c33e.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+cadd4c...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in decode_session6 net/xfrm/xfrm_policy.c:3415 [inline]
BUG: KASAN: use-after-free in __xfrm_decode_session+0x14c4/0x1b8c net/xfrm/xfrm_policy.c:3521
Read of size 1 at addr ffff0000de62a623 by task syz.0.16/4454
CPU: 0 PID: 4454 Comm: syz.0.16 Not tainted 6.1.142-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
__xfrm_decode_session+0x14c4/0x1b8c net/xfrm/xfrm_policy.c:3521
xfrm_decode_session_reverse include/net/xfrm.h:1183 [inline]
__ip6_finish_output net/ipv6/ip6_output.c:203 [inline]
ip6_finish_output+0x444/0x930 net/ipv6/ip6_output.c:216
sctp_packet_transmit+0x1df4/0x22e4 net/sctp/output.c:653
sctp_packet_singleton+0x1d0/0x2bc net/sctp/outqueue.c:783
sctp_outq_flush_ctrl net/sctp/outqueue.c:914 [inline]
sctp_outq_flush+0x404/0x27bc net/sctp/outqueue.c:1212
sctp_outq_uncork+0x84/0xc0 net/sctp/outqueue.c:764
sctp_cmd_interpreter net/sctp/sm_sideeffect.c:-1 [inline]
sctp_side_effects net/sctp/sm_sideeffect.c:1199 [inline]
sctp_do_sm+0x427c/0x4894 net/sctp/sm_sideeffect.c:1170
sctp_primitive_ASSOCIATE+0x98/0xc8 net/sctp/primitive.c:73
sctp_sendmsg_to_asoc+0xfc8/0x1344 net/sctp/socket.c:1840
sctp_sendmsg+0x14dc/0x20cc net/sctp/socket.c:2030
inet_sendmsg+0x154/0x284 net/ipv4/af_inet.c:841
sock_sendmsg_nosec net/socket.c:718 [inline]
__sock_sendmsg net/socket.c:730 [inline]
__sys_sendto+0x304/0x3fc net/socket.c:2153
__do_sys_sendto net/socket.c:2165 [inline]
__se_sys_sendto net/socket.c:2161 [inline]
__arm64_sys_sendto+0xd8/0xf8 net/socket.c:2161
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook+0x74/0x43c mm/slab.h:737
slab_alloc_node mm/slub.c:3398 [inline]
slab_alloc mm/slub.c:3406 [inline]
__kmem_cache_alloc_lru mm/slub.c:3413 [inline]
kmem_cache_alloc+0x234/0x318 mm/slub.c:3422
__sigqueue_alloc+0x3e0/0x4e0 kernel/signal.c:436
__send_signal_locked+0x1d8/0xc78 kernel/signal.c:1129
send_signal_locked+0xac/0x854 kernel/signal.c:1258
do_send_sig_info kernel/signal.c:1301 [inline]
do_send_specific+0x19c/0x2cc kernel/signal.c:3926
do_tkill kernel/signal.c:3952 [inline]
__do_sys_tgkill kernel/signal.c:3971 [inline]
__se_sys_tgkill kernel/signal.c:3965 [inline]
__arm64_sys_tgkill+0x1c4/0x244 kernel/signal.c:3965
__sigqueue_free kernel/signal.c:459 [inline]
collect_signal kernel/signal.c:602 [inline]
__dequeue_signal+0x3fc/0x4fc kernel/signal.c:624
dequeue_signal+0x70/0x3cc kernel/signal.c:644
get_signal+0x41c/0x1310 kernel/signal.c:2751
do_signal arch/arm64/kernel/signal.c:1081 [inline]
do_notify_resume+0x290/0x2b0c arch/arm64/kernel/signal.c:1134
prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
el0_svc+0x98/0x138 arch/arm64/kernel/entry-common.c:638
which belongs to the cache sigqueue of size 80
The buggy address is located 3 bytes inside of
80-byte region [ffff0000de62a620, ffff0000de62a670)
The buggy address belongs to the physical page:
page:0000000030afacf5 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11e62a
flags: 0x5ffc00000000200(slab|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000200 0000000000000000 dead000000000122 ffff0000c03dd080
raw: 0000000000000000 0000000000240024 00000001ffffffff 0000000000000000
ffff0000de62a580: fb fb fc fc fc fc fa fb fb fb fb fb fb fb fb fb
>ffff0000de62a600: fc fc fc fc fa fb fb fb fb fb fb fb fb fb fc fc
^
ffff0000de62a680: fc fc fa fb fb fb fb fb fb fb fb fb fc fc fc fc
ffff0000de62a700: fa fb fb fb fb fb fb fb fb fb fc fc fc fc fa fb
==================================================================
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
HEAD commit: 7e69c33e4858 Linux 6.1.142
git tree: linux-6.1.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1510d88c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=a8ab0a96d60bbe8f
dashboard link: https://syzkaller.appspot.com/bug?extid=cadd4c7c96a74757f198
compiler: Debian clang version 20.1.6 (++20250514063057+1e4d39e07757-1~exp1~20250514183223.118), Debian LLD 20.1.6
userspace arch: arm64
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=160b13d4580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=17659982580000
Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/45e07ce672f1/disk-7e69c33e.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e00cc723dfa5/vmlinux-7e69c33e.xz
kernel image: https://storage.googleapis.com/syzbot-assets/4cbcf3fe062f/Image-7e69c33e.gz.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+cadd4c...@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: use-after-free in __xfrm_decode_session+0x14c4/0x1b8c net/xfrm/xfrm_policy.c:3521
Read of size 1 at addr ffff0000de62a623 by task syz.0.16/4454
CPU: 0 PID: 4454 Comm: syz.0.16 Not tainted 6.1.142-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Call trace:
dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack+0x30/0x40 lib/dump_stack.c:88
dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106
print_address_description+0x88/0x220 mm/kasan/report.c:316
print_report+0x50/0x68 mm/kasan/report.c:427
kasan_report+0xa8/0x100 mm/kasan/report.c:531
__asan_report_load1_noabort+0x2c/0x38 mm/kasan/report_generic.c:348
decode_session6 net/xfrm/xfrm_policy.c:3415 [inline]
dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
__dump_stack+0x30/0x40 lib/dump_stack.c:88
dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106
print_address_description+0x88/0x220 mm/kasan/report.c:316
print_report+0x50/0x68 mm/kasan/report.c:427
kasan_report+0xa8/0x100 mm/kasan/report.c:531
__asan_report_load1_noabort+0x2c/0x38 mm/kasan/report_generic.c:348
__xfrm_decode_session+0x14c4/0x1b8c net/xfrm/xfrm_policy.c:3521
xfrm_decode_session_reverse include/net/xfrm.h:1183 [inline]
icmpv6_route_lookup+0x310/0x470 net/ipv6/icmp.c:394
icmp6_send+0xb98/0x13e4 net/ipv6/icmp.c:603
__icmpv6_send include/linux/icmpv6.h:28 [inline]
icmpv6_send include/linux/icmpv6.h:49 [inline]
ip6_link_failure+0x44/0x4a8 net/ipv6/route.c:2827
dst_link_failure include/net/dst.h:423 [inline]
ip6_tnl_xmit+0xed8/0x2448 net/ipv6/ip6_tunnel.c:1284
ipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1400 [inline]
ip6_tnl_start_xmit+0xb88/0x1088 net/ipv6/ip6_tunnel.c:1449
__netdev_start_xmit include/linux/netdevice.h:4896 [inline]
netdev_start_xmit include/linux/netdevice.h:4910 [inline]
xmit_one net/core/dev.c:3658 [inline]
dev_hard_start_xmit+0x244/0x8e0 net/core/dev.c:3674
sch_direct_xmit+0x204/0x480 net/sched/sch_generic.c:342
qdisc_restart net/sched/sch_generic.c:407 [inline]
__qdisc_run+0x8c0/0x1368 net/sched/sch_generic.c:415
__dev_xmit_skb net/core/dev.c:3958 [inline]
__dev_queue_xmit+0xc18/0x309c net/core/dev.c:4300
dev_queue_xmit include/linux/netdevice.h:3051 [inline]
neigh_connected_output+0x358/0x3e8 net/core/neighbour.c:1592
neigh_output include/net/neighbour.h:544 [inline]
ip6_finish_output2+0xd60/0x1844 net/ipv6/ip6_output.c:138
ip6_fragment+0x1558/0x247c net/ipv6/ip6_output.c:1021
icmp6_send+0xb98/0x13e4 net/ipv6/icmp.c:603
__icmpv6_send include/linux/icmpv6.h:28 [inline]
icmpv6_send include/linux/icmpv6.h:49 [inline]
ip6_link_failure+0x44/0x4a8 net/ipv6/route.c:2827
dst_link_failure include/net/dst.h:423 [inline]
ip6_tnl_xmit+0xed8/0x2448 net/ipv6/ip6_tunnel.c:1284
ipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1400 [inline]
ip6_tnl_start_xmit+0xb88/0x1088 net/ipv6/ip6_tunnel.c:1449
__netdev_start_xmit include/linux/netdevice.h:4896 [inline]
netdev_start_xmit include/linux/netdevice.h:4910 [inline]
xmit_one net/core/dev.c:3658 [inline]
dev_hard_start_xmit+0x244/0x8e0 net/core/dev.c:3674
sch_direct_xmit+0x204/0x480 net/sched/sch_generic.c:342
qdisc_restart net/sched/sch_generic.c:407 [inline]
__qdisc_run+0x8c0/0x1368 net/sched/sch_generic.c:415
__dev_xmit_skb net/core/dev.c:3958 [inline]
__dev_queue_xmit+0xc18/0x309c net/core/dev.c:4300
dev_queue_xmit include/linux/netdevice.h:3051 [inline]
neigh_connected_output+0x358/0x3e8 net/core/neighbour.c:1592
neigh_output include/net/neighbour.h:544 [inline]
ip6_finish_output2+0xd60/0x1844 net/ipv6/ip6_output.c:138
__ip6_finish_output net/ipv6/ip6_output.c:203 [inline]
ip6_finish_output+0x444/0x930 net/ipv6/ip6_output.c:216
NF_HOOK_COND include/linux/netfilter.h:291 [inline]
ip6_output+0x274/0x500 net/ipv6/ip6_output.c:237
dst_output include/net/dst.h:453 [inline]
NF_HOOK include/linux/netfilter.h:302 [inline]
ip6_xmit+0x111c/0x19c4 net/ipv6/ip6_output.c:357
sctp_v6_xmit+0x83c/0xf70 net/sctp/ipv6.c:250
ip6_output+0x274/0x500 net/ipv6/ip6_output.c:237
dst_output include/net/dst.h:453 [inline]
NF_HOOK include/linux/netfilter.h:302 [inline]
ip6_xmit+0x111c/0x19c4 net/ipv6/ip6_output.c:357
sctp_packet_transmit+0x1df4/0x22e4 net/sctp/output.c:653
sctp_packet_singleton+0x1d0/0x2bc net/sctp/outqueue.c:783
sctp_outq_flush_ctrl net/sctp/outqueue.c:914 [inline]
sctp_outq_flush+0x404/0x27bc net/sctp/outqueue.c:1212
sctp_outq_uncork+0x84/0xc0 net/sctp/outqueue.c:764
sctp_cmd_interpreter net/sctp/sm_sideeffect.c:-1 [inline]
sctp_side_effects net/sctp/sm_sideeffect.c:1199 [inline]
sctp_do_sm+0x427c/0x4894 net/sctp/sm_sideeffect.c:1170
sctp_primitive_ASSOCIATE+0x98/0xc8 net/sctp/primitive.c:73
sctp_sendmsg_to_asoc+0xfc8/0x1344 net/sctp/socket.c:1840
sctp_sendmsg+0x14dc/0x20cc net/sctp/socket.c:2030
inet_sendmsg+0x154/0x284 net/ipv4/af_inet.c:841
sock_sendmsg_nosec net/socket.c:718 [inline]
__sock_sendmsg net/socket.c:730 [inline]
__sys_sendto+0x304/0x3fc net/socket.c:2153
__do_sys_sendto net/socket.c:2165 [inline]
__se_sys_sendto net/socket.c:2161 [inline]
__arm64_sys_sendto+0xd8/0xf8 net/socket.c:2161
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Allocated by task 4298:
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4c/0x80 mm/kasan/common.c:52
kasan_save_alloc_info+0x28/0x34 mm/kasan/generic.c:505
__kasan_slab_alloc+0x70/0x88 mm/kasan/common.c:328
kasan_set_track+0x4c/0x80 mm/kasan/common.c:52
kasan_save_alloc_info+0x28/0x34 mm/kasan/generic.c:505
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook+0x74/0x43c mm/slab.h:737
slab_alloc_node mm/slub.c:3398 [inline]
slab_alloc mm/slub.c:3406 [inline]
__kmem_cache_alloc_lru mm/slub.c:3413 [inline]
kmem_cache_alloc+0x234/0x318 mm/slub.c:3422
__sigqueue_alloc+0x3e0/0x4e0 kernel/signal.c:436
__send_signal_locked+0x1d8/0xc78 kernel/signal.c:1129
send_signal_locked+0xac/0x854 kernel/signal.c:1258
do_send_sig_info kernel/signal.c:1301 [inline]
do_send_specific+0x19c/0x2cc kernel/signal.c:3926
do_tkill kernel/signal.c:3952 [inline]
__do_sys_tgkill kernel/signal.c:3971 [inline]
__se_sys_tgkill kernel/signal.c:3965 [inline]
__arm64_sys_tgkill+0x1c4/0x244 kernel/signal.c:3965
__invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Freed by task 4297:
invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4c/0x80 mm/kasan/common.c:52
kasan_save_free_info+0x3c/0x60 mm/kasan/generic.c:516
____kasan_slab_free+0x148/0x1b0 mm/kasan/common.c:236
__kasan_slab_free+0x18/0x28 mm/kasan/common.c:244
kasan_slab_free include/linux/kasan.h:177 [inline]
slab_free_hook mm/slub.c:1724 [inline]
slab_free_freelist_hook+0x16c/0x1ec mm/slub.c:1750
slab_free mm/slub.c:3661 [inline]
kmem_cache_free+0x11c/0x324 mm/slub.c:3683
kasan_set_track+0x4c/0x80 mm/kasan/common.c:52
kasan_save_free_info+0x3c/0x60 mm/kasan/generic.c:516
____kasan_slab_free+0x148/0x1b0 mm/kasan/common.c:236
__kasan_slab_free+0x18/0x28 mm/kasan/common.c:244
kasan_slab_free include/linux/kasan.h:177 [inline]
slab_free_hook mm/slub.c:1724 [inline]
slab_free_freelist_hook+0x16c/0x1ec mm/slub.c:1750
slab_free mm/slub.c:3661 [inline]
__sigqueue_free kernel/signal.c:459 [inline]
collect_signal kernel/signal.c:602 [inline]
__dequeue_signal+0x3fc/0x4fc kernel/signal.c:624
dequeue_signal+0x70/0x3cc kernel/signal.c:644
get_signal+0x41c/0x1310 kernel/signal.c:2751
do_signal arch/arm64/kernel/signal.c:1081 [inline]
do_notify_resume+0x290/0x2b0c arch/arm64/kernel/signal.c:1134
prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
el0_svc+0x98/0x138 arch/arm64/kernel/entry-common.c:638
el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
The buggy address belongs to the object at ffff0000de62a620
el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
which belongs to the cache sigqueue of size 80
The buggy address is located 3 bytes inside of
80-byte region [ffff0000de62a620, ffff0000de62a670)
The buggy address belongs to the physical page:
flags: 0x5ffc00000000200(slab|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000200 0000000000000000 dead000000000122 ffff0000c03dd080
raw: 0000000000000000 0000000000240024 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff0000de62a500: fb fb fb fb fc fc fc fc fa fb fb fb fb fb fb fb
Memory state around the buggy address:
ffff0000de62a580: fb fb fc fc fc fc fa fb fb fb fb fb fb fb fb fb
>ffff0000de62a600: fc fc fc fc fa fb fb fb fb fb fb fb fb fb fc fc
^
ffff0000de62a680: fc fc fa fb fb fb fb fb fb fb fb fb fc fc fc fc
ffff0000de62a700: fa fb fb fb fb fb fb fb fb fb fc fc fc fc fa fb
==================================================================
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
Reply all
Reply to author
Forward
0 new messages