From: syzbot <syzbot+2860e75836a08b172755@syzkaller.appspotmail.com>
To: davem@davemloft.net, edumazet@google.com, horms@kernel.org,
kuba@kernel.org, linux-hams@vger.kernel.org,
linux-kernel@vger.kernel.org, netdev@vger.kernel.org,
pabeni@redhat.com, syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [hams?] KASAN: slab-use-after-free Read in nr_add_node
Date: Sat, 18 Oct 2025 13:37:30 -0700 [thread overview]
Message-ID: <68f3fa8a.050a0220.91a22.0433.GAE@google.com> (raw)
In-Reply-To: <68d56f4d.050a0220.25d7ab.0047.GAE@google.com>
syzbot has found a reproducer for the following issue on:
HEAD commit: f406055cb18c Merge tag 'arm64-fixes' of git://git.kernel.o..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=11cf767c580000
kernel config: https://syzkaller.appspot.com/x/.config?x=f3e7b5a3627a90dd
dashboard link: https://syzkaller.appspot.com/bug?extid=2860e75836a08b172755
compiler: gcc (Debian 12.2.0-14+deb12u1) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=155f1de2580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=12b6b52f980000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-f406055c.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/a4db2a99bfb1/vmlinux-f406055c.xz
kernel image: https://storage.googleapis.com/syzbot-assets/91d1ca420bac/bzImage-f406055c.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+2860e75836a08b172755@syzkaller.appspotmail.com
==================================================================
BUG: KASAN: slab-use-after-free in nr_add_node+0x25db/0x2c00 net/netrom/nr_route.c:248
Read of size 4 at addr ffff888054b8cc30 by task syz.3.7839/22393
CPU: 3 UID: 0 PID: 22393 Comm: syz.3.7839 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:378 [inline]
print_report+0xcd/0x630 mm/kasan/report.c:482
kasan_report+0xe0/0x110 mm/kasan/report.c:595
nr_add_node+0x25db/0x2c00 net/netrom/nr_route.c:248
nr_rt_ioctl+0x11b7/0x29b0 net/netrom/nr_route.c:651
nr_ioctl+0x19a/0x2d0 net/netrom/af_netrom.c:1254
sock_do_ioctl+0x118/0x280 net/socket.c:1254
sock_ioctl+0x227/0x6b0 net/socket.c:1375
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7f4fb8efc9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7f509c5038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007f7f4fde5fa0 RCX: 00007f7f4fb8efc9
RDX: 0000200000000280 RSI: 000000000000890b RDI: 0000000000000004
RBP: 00007f7f4fc11f91 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f7f4fde6038 R14: 00007f7f4fde5fa0 R15: 00007ffd1bd56f18
</TASK>
Allocated by task 22380:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:56
kasan_save_track+0x14/0x30 mm/kasan/common.c:77
poison_kmalloc_redzone mm/kasan/common.c:400 [inline]
__kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:417
kmalloc_noprof include/linux/slab.h:957 [inline]
nr_add_node+0xe4e/0x2c00 net/netrom/nr_route.c:146
nr_rt_ioctl+0x11b7/0x29b0 net/netrom/nr_route.c:651
nr_ioctl+0x19a/0x2d0 net/netrom/af_netrom.c:1254
sock_do_ioctl+0x118/0x280 net/socket.c:1254
sock_ioctl+0x227/0x6b0 net/socket.c:1375
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Freed by task 22393:
kasan_save_stack+0x33/0x60 mm/kasan/common.c:56
kasan_save_track+0x14/0x30 mm/kasan/common.c:77
__kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:587
kasan_save_free_info mm/kasan/kasan.h:406 [inline]
poison_slab_object mm/kasan/common.c:252 [inline]
__kasan_slab_free+0x5f/0x80 mm/kasan/common.c:284
kasan_slab_free include/linux/kasan.h:234 [inline]
slab_free_hook mm/slub.c:2523 [inline]
slab_free mm/slub.c:6611 [inline]
kfree+0x2b8/0x6d0 mm/slub.c:6818
nr_neigh_put include/net/netrom.h:143 [inline]
nr_neigh_put include/net/netrom.h:137 [inline]
nr_add_node+0x23b9/0x2c00 net/netrom/nr_route.c:246
nr_rt_ioctl+0x11b7/0x29b0 net/netrom/nr_route.c:651
nr_ioctl+0x19a/0x2d0 net/netrom/af_netrom.c:1254
sock_do_ioctl+0x118/0x280 net/socket.c:1254
sock_ioctl+0x227/0x6b0 net/socket.c:1375
vfs_ioctl fs/ioctl.c:51 [inline]
__do_sys_ioctl fs/ioctl.c:597 [inline]
__se_sys_ioctl fs/ioctl.c:583 [inline]
__x64_sys_ioctl+0x18e/0x210 fs/ioctl.c:583
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xcd/0xfa0 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
The buggy address belongs to the object at ffff888054b8cc00
which belongs to the cache kmalloc-64 of size 64
The buggy address is located 48 bytes inside of
freed 64-byte region [ffff888054b8cc00, ffff888054b8cc40)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x54b8c
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000000 ffff88801b4428c0 dead000000000100 dead000000000122
raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 6074, tgid 6074 (syz-executor), ts 126099390276, free_ts 126098882568
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1c0/0x230 mm/page_alloc.c:1850
prep_new_page mm/page_alloc.c:1858 [inline]
get_page_from_freelist+0x10a3/0x3a30 mm/page_alloc.c:3884
__alloc_frozen_pages_noprof+0x25f/0x2470 mm/page_alloc.c:5183
alloc_pages_mpol+0x1fb/0x550 mm/mempolicy.c:2416
alloc_slab_page mm/slub.c:3039 [inline]
allocate_slab mm/slub.c:3212 [inline]
new_slab+0x24a/0x360 mm/slub.c:3266
___slab_alloc+0xdc4/0x1ae0 mm/slub.c:4636
__slab_alloc.constprop.0+0x63/0x110 mm/slub.c:4755
__slab_alloc_node mm/slub.c:4831 [inline]
slab_alloc_node mm/slub.c:5253 [inline]
__kmalloc_cache_noprof+0x477/0x780 mm/slub.c:5743
kmalloc_noprof include/linux/slab.h:957 [inline]
__team_option_inst_add+0xbf/0x330 drivers/net/team/team_core.c:160
__team_option_inst_add_option drivers/net/team/team_core.c:182 [inline]
__team_options_register+0x355/0x720 drivers/net/team/team_core.c:276
team_options_register drivers/net/team/team_core.c:341 [inline]
team_init+0x5c8/0xce0 drivers/net/team/team_core.c:1658
register_netdevice+0x653/0x2270 net/core/dev.c:11221
team_newlink+0xb4/0x190 drivers/net/team/team_core.c:2213
rtnl_newlink_create net/core/rtnetlink.c:3833 [inline]
__rtnl_newlink net/core/rtnetlink.c:3950 [inline]
rtnl_newlink+0xc45/0x2000 net/core/rtnetlink.c:4065
rtnetlink_rcv_msg+0x95e/0xe90 net/core/rtnetlink.c:6954
netlink_rcv_skb+0x158/0x420 net/netlink/af_netlink.c:2552
page last free pid 6074 tgid 6074 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
free_pages_prepare mm/page_alloc.c:1394 [inline]
__free_frozen_pages+0x7df/0x1160 mm/page_alloc.c:2906
selinux_genfs_get_sid security/selinux/hooks.c:1357 [inline]
inode_doinit_with_dentry+0xacb/0x12e0 security/selinux/hooks.c:1555
selinux_d_instantiate+0x26/0x30 security/selinux/hooks.c:6523
security_d_instantiate+0x142/0x1a0 security/security.c:4148
d_instantiate+0x5c/0x90 fs/dcache.c:1961
__debugfs_create_file+0x286/0x6b0 fs/debugfs/inode.c:459
debugfs_create_file_full+0x41/0x60 fs/debugfs/inode.c:469
ref_tracker_dir_debugfs+0x19d/0x290 lib/ref_tracker.c:441
ref_tracker_dir_init include/linux/ref_tracker.h:70 [inline]
alloc_netdev_mqs+0x314/0x1550 net/core/dev.c:11907
rtnl_create_link+0xc08/0xf90 net/core/rtnetlink.c:3641
rtnl_newlink_create net/core/rtnetlink.c:3823 [inline]
__rtnl_newlink net/core/rtnetlink.c:3950 [inline]
rtnl_newlink+0xb69/0x2000 net/core/rtnetlink.c:4065
rtnetlink_rcv_msg+0x95e/0xe90 net/core/rtnetlink.c:6954
netlink_rcv_skb+0x158/0x420 net/netlink/af_netlink.c:2552
netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
netlink_unicast+0x5aa/0x870 net/netlink/af_netlink.c:1346
netlink_sendmsg+0x8c8/0xdd0 net/netlink/af_netlink.c:1896
sock_sendmsg_nosec net/socket.c:727 [inline]
__sock_sendmsg net/socket.c:742 [inline]
__sys_sendto+0x4a3/0x520 net/socket.c:2244
Memory state around the buggy address:
ffff888054b8cb00: 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc
ffff888054b8cb80: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
>ffff888054b8cc00: fa fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
^
ffff888054b8cc80: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
ffff888054b8cd00: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc
==================================================================
---
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
next prev parent reply other threads:[~2025-10-18 20:37 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-09-25 16:35 [syzbot] [hams?] KASAN: slab-use-after-free Read in nr_add_node syzbot
2025-10-18 20:37 ` syzbot [this message]
2025-10-19 5:02 ` Brahmajit Das
2025-10-19 5:21 ` syzbot
2025-10-19 5:10 ` Brahmajit Das
2025-10-19 5:10 ` syzbot
2025-10-20 8:13 ` [PATCH] netrom: Prevent race conditions between multiple add route Lizhi Xu
2025-10-20 10:10 ` Dan Carpenter
2025-10-20 11:02 ` [PATCH V2] " Lizhi Xu
2025-10-20 12:25 ` Dan Carpenter
2025-10-20 12:33 ` Dan Carpenter
2025-10-20 12:57 ` Dan Carpenter
2025-10-20 13:34 ` Lizhi Xu
2025-10-20 13:49 ` Lizhi Xu
2025-10-20 17:59 ` Dan Carpenter
2025-10-21 2:05 ` Lizhi Xu
2025-10-21 6:36 ` Dan Carpenter
2025-10-21 8:34 ` Lizhi Xu
2025-10-21 8:35 ` [PATCH V3] netrom: Prevent race conditions between neighbor operations Lizhi Xu
2025-10-23 11:44 ` Paolo Abeni
2025-10-23 11:54 ` Eric Dumazet
2025-10-23 12:41 ` Lizhi Xu
2025-10-23 13:50 ` [PATCH V4] netrom: Preventing the use of abnormal neighbor Lizhi Xu
2025-10-28 14:13 ` Paolo Abeni
2025-10-29 2:59 ` Lizhi Xu
2025-11-13 6:33 ` Lizhi Xu
2025-10-24 10:45 ` [PATCH V3] netrom: Prevent race conditions between neighbor operations Dan Carpenter
2025-10-19 5:16 ` Forwarded: Re: [syzbot] [hams?] KASAN: slab-use-after-free Read in nr_add_node syzbot
2025-10-19 13:55 ` syzbot
[not found] <luix3x4zjs7wt2nxbum2iihi4zdsqefj3njqglgkreehenags2@47i3wmfhboyo>
2025-10-19 5:36 ` syzbot
[not found] <c5cfbnfdsztbsqq4g2po4aruqzgxssx7rlnqtxojw2aafjyfpx@qwvgxpbdixmj>
2025-10-19 14:12 ` syzbot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=68f3fa8a.050a0220.91a22.0433.GAE@google.com \
--to=syzbot+2860e75836a08b172755@syzkaller.appspotmail.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=horms@kernel.org \
--cc=kuba@kernel.org \
--cc=linux-hams@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.