* [BUG] net: ipv6: KASAN: slab-use-after-free in ip6gre_tunnel_xmit
@ 2026-08-19 6:22 Shuangpeng Bai
2026-08-19 7:32 ` Eric Dumazet
0 siblings, 1 reply; 2+ messages in thread
From: Shuangpeng Bai @ 2026-08-19 6:22 UTC (permalink / raw)
To: David Ahern, Ido Schimmel, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni
Cc: Shuangpeng Bai, Simon Horman, netdev, linux-kernel
Hi Kernel Maintainers,
I hit the following report while testing current upstream kernel:
KASAN: slab-use-after-free in ip6gre_tunnel_xmit
on commit: bd5f485f3f026225b86573e559af0b7254ef4184 (2026-08-18)
The reproducer and .config files are here.
https://gist.github.com/shuangpengbai/63aa087b3e843c7a4e98a42c0f130aeb
I'm happy to test debug patches or provide additional information.
Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
[ 127.142568][ T8310] BUG: KASAN: slab-use-after-free in ip6gre_tunnel_xmit (./include/linux/skbuff.h:1162 .net/dst_metadata.h:46 .net/dst_metadata.h:57 net/ipv6/ip6_gre.c:711 net/ipv6/ip6_gre.c:910)
[ 127.143319][ T8310] Read of size 8 at addr ffff888118f856d8 by task ip6gre_uaf_repr/8310
[ 127.144052][ T8310]
[ 127.144281][ T8310] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 127.144284][ T8310] Call Trace:
[ 127.144286][ T8310] <TASK>
[ 127.144287][ T8310] dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
[ 127.144311][ T8310] print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
[ 127.144342][ T8310] kasan_report (mm/kasan/report.c:595)
[ 127.144349][ T8310] ip6gre_tunnel_xmit (./include/linux/skbuff.h:1162 .net/dst_metadata.h:46 .net/dst_metadata.h:57 net/ipv6/ip6_gre.c:711 net/ipv6/ip6_gre.c:910)
[ 127.144405][ T8310] dev_hard_start_xmit (./include/linux/netdevice.h:5397 ./include/linux/netdevice.h:5406 net/core/dev.c:3889 net/core/dev.c:3905)
[ 127.144408][ T8310] sch_direct_xmit (net/sched/sch_generic.c:372)
[ 127.144419][ T8310] __dev_queue_xmit (net/core/dev.c:4214 net/core/dev.c:4836)
[ 127.144476][ T8310] sch_frag_xmit_hook (net/sched/sch_frag.c:156)
[ 127.144582][ T8310] tcf_mirred_to_dev (net/sched/act_mirred.c:242 net/sched/act_mirred.c:?)
[ 127.144585][ T8310] tcf_mirred_act (net/sched/act_mirred.c:489)
[ 127.144594][ T8310] tcf_action_exec (.net/tc_wrapper.h:59 net/sched/act_api.c:1150)
[ 127.144599][ T8310] tcf_classify (.net/tc_wrapper.h:178 net/sched/cls_api.c:1779 net/sched/cls_api.c:1875)
[ 127.144603][ T8310] tc_run (net/core/dev.c:4415)
[ 127.144610][ T8310] __dev_queue_xmit (net/core/dev.c:4549 net/core/dev.c:4812)
[ 127.144643][ T8310] packet_sendmsg (net/packet/af_packet.c:3107 net/packet/af_packet.c:3139)
[ 127.144686][ T8310] __sock_sendmsg (net/socket.c:775 net/socket.c:790)
[ 127.144689][ T8310] __sys_sendto (net/socket.c:2252)
[ 127.144722][ T8310] __x64_sys_sendto (net/socket.c:2259 net/socket.c:2255 net/socket.c:2255)
[ 127.144726][ T8310] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
[ 127.144730][ T8310] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
[ 127.144733][ T8310] RIP: 0033:0x7fd922eb8fa6
[ 127.144737][ T8310] Code: 0e 0d 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b8 0f 1f 00 41 89 ca 64 8b 04 25 18 00 00 00 85 c0 75 11 b8 2c 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 72 c3 90 55 48 83 ec 30 44 89 4c 24 2c 4c 89
All code
========
0: 0e (bad)
1: 0d 00 f7 d8 64 or $0x64d8f700,%eax
6: 89 02 mov %eax,(%rdx)
8: 48 c7 c0 ff ff ff ff mov $0xffffffffffffffff,%rax
f: eb b8 jmp 0xffffffffffffffc9
11: 0f 1f 00 nopl (%rax)
14: 41 89 ca mov %ecx,%r10d
17: 64 8b 04 25 18 00 00 mov %fs:0x18,%eax
1e: 00
1f: 85 c0 test %eax,%eax
21: 75 11 jne 0x34
23: b8 2c 00 00 00 mov $0x2c,%eax
28: 0f 05 syscall
2a:* 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax <-- trapping instruction
30: 77 72 ja 0xa4
32: c3 ret
33: 90 nop
34: 55 push %rbp
35: 48 83 ec 30 sub $0x30,%rsp
39: 44 89 4c 24 2c mov %r9d,0x2c(%rsp)
3e: 4c rex.WR
3f: 89 .byte 0x89
Code starting with the faulting instruction
===========================================
0: 48 3d 00 f0 ff ff cmp $0xfffffffffffff000,%rax
6: 77 72 ja 0x7a
8: c3 ret
9: 90 nop
a: 55 push %rbp
b: 48 83 ec 30 sub $0x30,%rsp
f: 44 89 4c 24 2c mov %r9d,0x2c(%rsp)
14: 4c rex.WR
15: 89 .byte 0x89
[ 127.144740][ T8310] RSP: 002b:00007fff703c61d8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
[ 127.144745][ T8310] RAX: ffffffffffffffda RBX: 00007fff703c6200 RCX: 00007fd922eb8fa6
[ 127.144748][ T8310] RDX: 0000000000000080 RSI: 00007fff703c6200 RDI: 0000000000000003
[ 127.144749][ T8310] RBP: 0000000000000001 R08: 00007fff703c61e0 R09: 0000000000000014
[ 127.144751][ T8310] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003
[ 127.144753][ T8310] R13: 00007fff703c61e0 R14: 000056446288e032 R15: 0000000000000000
[ 127.144779][ T8310] </TASK>
[ 127.144780][ T8310]
[ 127.201576][ T8310] Allocated by task 8310 on cpu 1 at 127.141516s:
[ 127.202164][ T8310] kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78)
[ 127.202606][ T8310] __kasan_slab_alloc (mm/kasan/common.c:340 mm/kasan/common.c:366)
[ 127.203055][ T8310] kmem_cache_alloc_noprof (./include/linux/kasan.h:253 mm/slub.c:4584 mm/slub.c:4917 mm/slub.c:4931)
[ 127.203567][ T8310] skb_clone (net/core/skbuff.c:2116)
[ 127.203962][ T8310] tcf_mirred_to_dev (net/sched/act_mirred.c:295)
[ 127.204420][ T8310] tcf_mirred_act (net/sched/act_mirred.c:489)
[ 127.204861][ T8310] tcf_action_exec (.net/tc_wrapper.h:59 net/sched/act_api.c:1150)
[ 127.205304][ T8310] tcf_classify (.net/tc_wrapper.h:178 net/sched/cls_api.c:1779 net/sched/cls_api.c:1875)
[ 127.205738][ T8310] tc_run (net/core/dev.c:4415)
[ 127.206102][ T8310] __dev_queue_xmit (net/core/dev.c:4549 net/core/dev.c:4812)
[ 127.206560][ T8310] packet_sendmsg (net/packet/af_packet.c:3107 net/packet/af_packet.c:3139)
[ 127.207001][ T8310] __sock_sendmsg (net/socket.c:775 net/socket.c:790)
[ 127.207426][ T8310] __sys_sendto (net/socket.c:2252)
[ 127.207843][ T8310] __x64_sys_sendto (net/socket.c:2259 net/socket.c:2255 net/socket.c:2255)
[ 127.208269][ T8310] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
[ 127.208688][ T8310] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
[ 127.209223][ T8310]
[ 127.209441][ T8310] Freed by task 8310 on cpu 1 at 127.141774s:
[ 127.209993][ T8310] kasan_save_track (mm/kasan/common.c:57 mm/kasan/common.c:78)
[ 127.210418][ T8310] kasan_save_free_info (mm/kasan/generic.c:584)
[ 127.210883][ T8310] __kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)
[ 127.211316][ T8310] kmem_cache_free (./include/linux/kasan.h:235 mm/slub.c:2677 mm/slub.c:6377 mm/slub.c:6504)
[ 127.211753][ T8310] ip6_tnl_xmit (net/ipv6/ip6_tunnel.c:1249)
[ 127.212175][ T8310] __gre6_xmit (net/ipv6/ip6_gre.c:787)
[ 127.212587][ T8310] ip6gre_tunnel_xmit (net/ipv6/ip6_gre.c:873 net/ipv6/ip6_gre.c:900)
[ 127.213046][ T8310] dev_hard_start_xmit (./include/linux/netdevice.h:5397 ./include/linux/netdevice.h:5406 net/core/dev.c:3889 net/core/dev.c:3905)
[ 127.213513][ T8310] sch_direct_xmit (net/sched/sch_generic.c:372)
[ 127.213950][ T8310] __dev_queue_xmit (net/core/dev.c:4214 net/core/dev.c:4836)
[ 127.214404][ T8310] sch_frag_xmit_hook (net/sched/sch_frag.c:156)
[ 127.214871][ T8310] tcf_mirred_to_dev (net/sched/act_mirred.c:242 net/sched/act_mirred.c:?)
[ 127.215328][ T8310] tcf_mirred_act (net/sched/act_mirred.c:489)
[ 127.215764][ T8310] tcf_action_exec (.net/tc_wrapper.h:59 net/sched/act_api.c:1150)
[ 127.216199][ T8310] tcf_classify (.net/tc_wrapper.h:178 net/sched/cls_api.c:1779 net/sched/cls_api.c:1875)
[ 127.216622][ T8310] tc_run (net/core/dev.c:4415)
[ 127.216988][ T8310] __dev_queue_xmit (net/core/dev.c:4549 net/core/dev.c:4812)
[ 127.217448][ T8310] packet_sendmsg (net/packet/af_packet.c:3107 net/packet/af_packet.c:3139)
[ 127.217906][ T8310] __sock_sendmsg (net/socket.c:775 net/socket.c:790)
[ 127.218332][ T8310] __sys_sendto (net/socket.c:2252)
[ 127.218765][ T8310] __x64_sys_sendto (net/socket.c:2259 net/socket.c:2255 net/socket.c:2255)
[ 127.219197][ T8310] do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
[ 127.219614][ T8310] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
[ 127.220147][ T8310]
[ 127.220364][ T8310] The buggy address belongs to the object at ffff888118f85680
[ 127.220364][ T8310] which belongs to the cache skbuff_head_cache of size 232
[ 127.221685][ T8310] The buggy address is located 88 bytes inside of
[ 127.221685][ T8310] freed 232-byte region [ffff888118f85680, ffff888118f85768)
[ 127.222919][ T8310]
Best,
Shuangpeng
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [BUG] net: ipv6: KASAN: slab-use-after-free in ip6gre_tunnel_xmit
2026-08-19 6:22 [BUG] net: ipv6: KASAN: slab-use-after-free in ip6gre_tunnel_xmit Shuangpeng Bai
@ 2026-08-19 7:32 ` Eric Dumazet
0 siblings, 0 replies; 2+ messages in thread
From: Eric Dumazet @ 2026-08-19 7:32 UTC (permalink / raw)
To: Shuangpeng Bai
Cc: David Ahern, Ido Schimmel, David S. Miller, Jakub Kicinski,
Paolo Abeni, Simon Horman, netdev, linux-kernel
On Wed, Aug 19, 2026 at 8:23 AM Shuangpeng Bai
<shuangpeng.kernel@gmail.com> wrote:
>
> Hi Kernel Maintainers,
>
> I hit the following report while testing current upstream kernel:
>
> KASAN: slab-use-after-free in ip6gre_tunnel_xmit
>
> on commit: bd5f485f3f026225b86573e559af0b7254ef4184 (2026-08-18)
>
> The reproducer and .config files are here.
> https://gist.github.com/shuangpengbai/63aa087b3e843c7a4e98a42c0f130aeb
>
> I'm happy to test debug patches or provide additional information.
>
Hi Shuandpeng
Thanks for the report, could you test the following for me?
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 200d0ba1a40e71a4245f1b153dc30691e773f8c7..678678fcb5da395f8b1c8243562efe8addbda2ee
100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -878,6 +878,7 @@ static int ip6gre_xmit_other(struct sk_buff *skb,
struct net_device *dev)
static netdev_tx_t ip6gre_tunnel_xmit(struct sk_buff *skb,
struct net_device *dev)
{
+ struct ip_tunnel_info *tun_info = NULL;
struct ip6_tnl *t = netdev_priv(dev);
__be16 payload_protocol;
int ret;
@@ -888,6 +889,9 @@ static netdev_tx_t ip6gre_tunnel_xmit(struct sk_buff *skb,
if (!ip6_tnl_xmit_ctl(t, &t->parms.laddr, &t->parms.raddr))
goto tx_err;
+ if (t->parms.collect_md)
+ tun_info = skb_tunnel_info_txcheck(skb);
+
payload_protocol = skb_protocol(skb, true);
switch (payload_protocol) {
case htons(ETH_P_IP):
@@ -907,7 +911,7 @@ static netdev_tx_t ip6gre_tunnel_xmit(struct sk_buff *skb,
return NETDEV_TX_OK;
tx_err:
- if (!t->parms.collect_md || !IS_ERR(skb_tunnel_info_txcheck(skb)))
+ if (!IS_ERR(tun_info))
DEV_STATS_INC(dev, tx_errors);
DEV_STATS_INC(dev, tx_dropped);
kfree_skb(skb);
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-08-19 7:32 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-19 6:22 [BUG] net: ipv6: KASAN: slab-use-after-free in ip6gre_tunnel_xmit Shuangpeng Bai
2026-08-19 7:32 ` Eric Dumazet
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).