From: Florian Westphal <fw@strlen.de>
To: syzbot <syzbot+d417922a3e7935517ef6@syzkaller.appspotmail.com>
Cc: coreteam@netfilter.org, davem@davemloft.net, edumazet@google.com,
horms@kernel.org, kuba@kernel.org, linux-kernel@vger.kernel.org,
netdev@vger.kernel.org, netfilter-devel@vger.kernel.org,
pabeni@redhat.com, pablo@netfilter.org, phil@nwl.cc,
syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] [netfilter?] KASAN: slab-use-after-free Read in nft_array_get_cmp
Date: Wed, 28 Jan 2026 14:40:12 +0100 [thread overview]
Message-ID: <aXoRvAottF2YRD3a@strlen.de> (raw)
In-Reply-To: <6979fc44.050a0220.c9109.003b.GAE@google.com>
syzbot <syzbot+d417922a3e7935517ef6@syzkaller.appspotmail.com> wrote:
> Hello,
>
> syzbot found the following issue on:
>
> HEAD commit: 62777c8015f3 Merge branch 'net-stmmac-rk-simplify-per-soc-..
> git tree: net-next
> console output: https://syzkaller.appspot.com/x/log.txt?x=103e49b2580000
> kernel config: https://syzkaller.appspot.com/x/.config?x=aeae47237b696a30
> dashboard link: https://syzkaller.appspot.com/bug?extid=d417922a3e7935517ef6
> compiler: Debian clang version 21.1.8 (++20251221033036+2078da43e25a-1~exp1~20251221153213.50), Debian LLD 21.1.8
> syz repro: https://syzkaller.appspot.com/x/repro.syz?x=15e50160580000
> C reproducer: https://syzkaller.appspot.com/x/repro.c?x=155ce322580000
>
> Downloadable assets:
> disk image: https://storage.googleapis.com/syzbot-assets/1eb82c60e767/disk-62777c80.raw.xz
> vmlinux: https://storage.googleapis.com/syzbot-assets/e421b2bad029/vmlinux-62777c80.xz
> kernel image: https://storage.googleapis.com/syzbot-assets/3bc19b11eaeb/bzImage-62777c80.xz
>
> IMPORTANT: if you fix the issue, please add the following tag to the commit:
> Reported-by: syzbot+d417922a3e7935517ef6@syzkaller.appspotmail.com
>
> ==================================================================
> BUG: KASAN: slab-use-after-free in nft_set_ext include/net/netfilter/nf_tables.h:795 [inline]
> BUG: KASAN: slab-use-after-free in nft_set_ext_key include/net/netfilter/nf_tables.h:800 [inline]
> BUG: KASAN: slab-use-after-free in nft_array_get_cmp+0x1f6/0x2a0 net/netfilter/nft_set_rbtree.c:133
> Read of size 1 at addr ffff888058618b19 by task syz.3.79/6217
>
> CPU: 1 UID: 0 PID: 6217 Comm: syz.3.79 Not tainted syzkaller #0 PREEMPT(full)
> Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/13/2026
> Call Trace:
> <TASK>
> dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
> print_address_description mm/kasan/report.c:378 [inline]
> print_report+0xba/0x230 mm/kasan/report.c:482
> kasan_report+0x117/0x150 mm/kasan/report.c:595
> nft_set_ext include/net/netfilter/nf_tables.h:795 [inline]
> nft_set_ext_key include/net/netfilter/nf_tables.h:800 [inline]
> nft_array_get_cmp+0x1f6/0x2a0 net/netfilter/nft_set_rbtree.c:133
> __inline_bsearch include/linux/bsearch.h:15 [inline]
> bsearch+0x50/0xc0 lib/bsearch.c:33
> nft_rbtree_get+0x16b/0x400 net/netfilter/nft_set_rbtree.c:169
Use after free, its possible for rbtree insert to evict elements
due to expiry, but still return -EEXIST.
We can thus end up with removed elements but without a call to
->commit(), hence we have a stale binary blob referencing free'd
elements.
next prev parent reply other threads:[~2026-01-28 13:40 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-01-28 12:08 [syzbot] [netfilter?] KASAN: slab-use-after-free Read in nft_array_get_cmp syzbot
2026-01-28 13:40 ` Florian Westphal [this message]
2026-01-28 16:35 ` Florian Westphal
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=aXoRvAottF2YRD3a@strlen.de \
--to=fw@strlen.de \
--cc=coreteam@netfilter.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=horms@kernel.org \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=netfilter-devel@vger.kernel.org \
--cc=pabeni@redhat.com \
--cc=pablo@netfilter.org \
--cc=phil@nwl.cc \
--cc=syzbot+d417922a3e7935517ef6@syzkaller.appspotmail.com \
--cc=syzkaller-bugs@googlegroups.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox