[BUG REPORT] selinux: general protection fault in avtab_search_node() during an AVC lookup

[BUG REPORT] selinux: general protection fault in avtab_search_node() during an AVC lookup

[1sh1ro]

Hi Paul, Stephen,

fuzzing with syzkaller on a 7.3.0-rc5 KASAN kernel (SELinux enabled,
permissive) produced a general protection fault in avtab_search_node() from
the AVC lookup path.  The policy's avtab appears to contain garbage: the
first fault reads a non-canonical address, and it is followed by thousands
of further Oopses (8850 in this run) as later lookups keep hitting the
broken structure.

The crash
---------

Oops: general protection fault, probably for non-canonical address 0xe06f3dc280000000: 0000 [#1] SMP KASAN NOPTI
KASAN: maybe wild-memory-access in range [0x037a0e1400000000-0x037a0e1400000007]
CPU: 1 UID: 0 PID: 14271 Comm: systemd-udevd Not tainted 7.3.0-rc5 #2 PREEMPT(lazy)
Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:avtab_search_node+0x24d/0x4d0
Call Trace:
 <TASK>
 cond_compute_av+0x59/0x340
 context_struct_compute_av+0x7f2/0x11f0
 security_compute_av+0x558/0xd60
 avc_compute_av+0x86/0x820
 avc_perm_nonode+0x9b/0x170
 avc_has_perm+0x27b/0x2f0
 selinux_inode_follow_link+0x226/0x380
 security_inode_follow_link+0x96/0xe0
 pick_link+0x447/0x1570
 step_into_slowpath+0x928/0xdd0
 link_path_walk+0xdae/0x1b20
 path_lookupat+0x70/0xb80
 filename_lookup+0x213/0x5e0
 filename_setxattr+0x89/0x1b0
 path_setxattrat+0x1cc/0x2a0
 __x64_sys_setxattr+0xc6/0x140
 do_syscall_64+0xec/0x4e0
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
 </TASK>

Context
-------

- The task is systemd-udevd (uid 0) in setxattr() (ORIG_RAX 0xbc), which
  follows a symlink while walking the path; the first AVC decision for the
  symlink hits the corrupt avtab.
- The same crash appeared on three runs of this fuzzing instance:
  2026-10-08 23:39 UTC, 2026-10-12 04:50 UTC and 2026-10-12 10:48 UTC.
- The kernel log of the crashing run shows only avc denials
  (permissive=1) and no policy (re)load, so the avtab was already corrupt
  when this lookup happened.  From this run alone I cannot tell whether the
  corruption originates in SELinux or comes from an unrelated memory
  corruption bug in the same fuzzing session (that instance also produced
  unrelated memory-safety crashes around the same time).
- No reproducer: the instance ran with syzkaller's reproduce disabled.  I
  can rerun it with reproduce enabled if you would like one.

7.3-rc5 already contains the recent policy-load validation fixes (class and
permission counts, level category sets, boolean values), so this looks like
a separate instance of the avtab-corruption family rather than one of those.

Thanks,
1sh1ro

Re: [BUG REPORT] selinux: general protection fault in avtab_search_node() during an AVC lookup

[Stephen Smalley]

On Mon, Oct 12, 2026 at 10:38 AM 1sh1ro <yangguikun19@qq.com> wrote:
>
> Hi Paul, Stephen,
>
> fuzzing with syzkaller on a 7.3.0-rc5 KASAN kernel (SELinux enabled,
> permissive) produced a general protection fault in avtab_search_node() from
> the AVC lookup path.  The policy's avtab appears to contain garbage: the
> first fault reads a non-canonical address, and it is followed by thousands
> of further Oopses (8850 in this run) as later lookups keep hitting the
> broken structure.
>
> The crash
> ---------
>
> Oops: general protection fault, probably for non-canonical address 0xe06f3dc280000000: 0000 [#1] SMP KASAN NOPTI
> KASAN: maybe wild-memory-access in range [0x037a0e1400000000-0x037a0e1400000007]
> CPU: 1 UID: 0 PID: 14271 Comm: systemd-udevd Not tainted 7.3.0-rc5 #2 PREEMPT(lazy)
> Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
> RIP: 0010:avtab_search_node+0x24d/0x4d0
> Call Trace:
>  <TASK>
>  cond_compute_av+0x59/0x340
>  context_struct_compute_av+0x7f2/0x11f0
>  security_compute_av+0x558/0xd60
>  avc_compute_av+0x86/0x820
>  avc_perm_nonode+0x9b/0x170
>  avc_has_perm+0x27b/0x2f0
>  selinux_inode_follow_link+0x226/0x380
>  security_inode_follow_link+0x96/0xe0
>  pick_link+0x447/0x1570
>  step_into_slowpath+0x928/0xdd0
>  link_path_walk+0xdae/0x1b20
>  path_lookupat+0x70/0xb80
>  filename_lookup+0x213/0x5e0
>  filename_setxattr+0x89/0x1b0
>  path_setxattrat+0x1cc/0x2a0
>  __x64_sys_setxattr+0xc6/0x140
>  do_syscall_64+0xec/0x4e0
>  entry_SYSCALL_64_after_hwframe+0x77/0x7f
>  </TASK>
>
> Context
> -------
>
> - The task is systemd-udevd (uid 0) in setxattr() (ORIG_RAX 0xbc), which
>   follows a symlink while walking the path; the first AVC decision for the
>   symlink hits the corrupt avtab.
> - The same crash appeared on three runs of this fuzzing instance:
>   2026-10-08 23:39 UTC, 2026-10-12 04:50 UTC and 2026-10-12 10:48 UTC.
> - The kernel log of the crashing run shows only avc denials
>   (permissive=1) and no policy (re)load, so the avtab was already corrupt
>   when this lookup happened.  From this run alone I cannot tell whether the
>   corruption originates in SELinux or comes from an unrelated memory
>   corruption bug in the same fuzzing session (that instance also produced
>   unrelated memory-safety crashes around the same time).
> - No reproducer: the instance ran with syzkaller's reproduce disabled.  I
>   can rerun it with reproduce enabled if you would like one.

Yes, please rerun it with reproduce enabled. Thanks.

> 7.3-rc5 already contains the recent policy-load validation fixes (class and
> permission counts, level category sets, boolean values), so this looks like
> a separate instance of the avtab-corruption family rather than one of those.
>
> Thanks,
> 1sh1ro
>