syzbot

 sign-in | mailing list | source | docs
🐞 Open [857]
🐞 Fixed [141]
🐞 Invalid [977]
⬇ Missing Backports [75]
≡ Crashes
Kernel Health Bugs/Month Bug Lifetimes Fuzzing
💬 Send us feedback

KASAN: use-after-free Read in qfq_reset_qdisc

Status: upstream: reported C repro on 2025/12/27 09:38
Bug presence: origin:upstream
[Documentation on labels]
Reported-by: syzbot+415e52ffab7b2b45778b@syzkaller.appspotmail.com
First crash: 9d22h, last: 9d18h
▶ ▼ Bug presence (1)
Date Name Commit Repro Result
2025/12/28 upstream (ToT) d26143bb38e2 C [report] KASAN: slab-use-after-free Read in qfq_reset_qdisc
▶ ▼ Similar bugs (11)
Kernel Title Rank 🛈 Repro Cause bisect Fix bisect Count Last Reported Patched Status
upstream general protection fault in qfq_reset_qdisc net 19 5 1242d 1314d 0/29 auto-obsoleted due to no activity on 2022/11/11 06:00
linux-4.19 KASAN: use-after-free Read in qfq_reset_qdisc 19 2 2159d 2169d 0/1 auto-closed as invalid on 2020/06/06 11:35
upstream KASAN: use-after-free Read in qfq_reset_qdisc net 19 1 1449d 1449d 0/29 closed as invalid on 2022/02/17 02:00
linux-4.14 KASAN: use-after-free Read in qfq_reset_qdisc 19 6 1953d 2266d 0/1 auto-closed as invalid on 2020/12/30 04:03
linux-4.19 KASAN: use-after-free Read in qfq_reset_qdisc (2) 19 1 1987d 1987d 0/1 auto-closed as invalid on 2020/11/25 14:56
linux-4.19 KASAN: use-after-free Read in qfq_reset_qdisc (3) 19 1 1856d 1856d 0/1 auto-closed as invalid on 2021/04/05 19:15
linux-4.14 general protection fault in qfq_reset_qdisc (2) 2 2 1744d 1821d 0/1 auto-closed as invalid on 2021/07/26 19:48
upstream KASAN: slab-use-after-free Read in qfq_reset_qdisc net 19 3 890d 933d 0/29 closed as invalid on 2023/09/21 09:36
upstream KASAN: slab-use-after-free Read in qfq_reset_qdisc (2) net 19 C 36 2d02h 61d 0/29 upstream: reported C repro on 2025/11/06 07:06
upstream general protection fault in qfq_reset_qdisc (3) net 2 2 686d 737d 0/29 closed as invalid on 2024/03/12 16:19
upstream general protection fault in qfq_reset_qdisc (2) net 2 1 814d 814d 0/29 closed as invalid on 2023/12/05 18:14

Sample crash report:
 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
==================================================================
BUG: KASAN: use-after-free in qfq_reset_qdisc+0xcc/0x208 net/sched/sch_qfq.c:1486
Read of size 8 at addr ffff0000d41fb050 by task syz.0.17/4518

CPU: 1 PID: 4518 Comm: syz.0.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025
Call trace:
 dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106
 print_address_description+0x88/0x218 mm/kasan/report.c:316
 print_report+0x50/0x68 mm/kasan/report.c:420
 kasan_report+0xa8/0x100 mm/kasan/report.c:524
 __asan_report_load8_noabort+0x2c/0x38 mm/kasan/report_generic.c:351
 qfq_reset_qdisc+0xcc/0x208 net/sched/sch_qfq.c:1486
 qdisc_reset+0x134/0x604 net/sched/sch_generic.c:1038
 __qdisc_destroy+0x100/0x500 net/sched/sch_generic.c:1076
 qdisc_put net/sched/sch_generic.c:1107 [inline]
 dev_shutdown+0x35c/0x47c net/sched/sch_generic.c:1495
 unregister_netdevice_many+0x944/0x1740 net/core/dev.c:10981
 unregister_netdevice_queue+0x2ac/0x2f8 net/core/dev.c:10921
 unregister_netdevice include/linux/netdevice.h:3075 [inline]
 __tun_detach+0xb04/0x122c drivers/net/tun.c:685
 tun_detach drivers/net/tun.c:701 [inline]
 tun_chr_close+0x118/0x1f8 drivers/net/tun.c:3492
 __fput+0x1bc/0x7c0 fs/file_table.c:320
 ____fput+0x20/0x30 fs/file_table.c:348
 task_work_run+0x1ec/0x270 kernel/task_work.c:203
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 do_notify_resume+0x2038/0x2b28 arch/arm64/kernel/signal.c:1137
 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
 exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
 el0_svc+0x98/0x138 arch/arm64/kernel/entry-common.c:638
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

Allocated by task 4518:
 kasan_save_stack mm/kasan/common.c:45 [inline]
 kasan_set_track+0x4c/0x80 mm/kasan/common.c:52
 kasan_save_alloc_info+0x28/0x34 mm/kasan/generic.c:505
 ____kasan_kmalloc mm/kasan/common.c:374 [inline]
 __kasan_kmalloc+0xa0/0xb8 mm/kasan/common.c:383
 kasan_kmalloc include/linux/kasan.h:211 [inline]
 kmalloc_trace+0x7c/0x94 mm/slab_common.c:1031
 kmalloc include/linux/slab.h:563 [inline]
 kzalloc include/linux/slab.h:699 [inline]
 qfq_change_class+0x358/0xa68 net/sched/sch_qfq.c:483
 tc_ctl_tclass+0x840/0xb34 net/sched/sch_api.c:2202
 rtnetlink_rcv_msg+0x734/0xce4 net/core/rtnetlink.c:6150
 netlink_rcv_skb+0x208/0x3c4 net/netlink/af_netlink.c:2511
 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6168
 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
 netlink_unicast+0x60c/0x824 net/netlink/af_netlink.c:1344
 netlink_sendmsg+0x6e8/0x9b0 net/netlink/af_netlink.c:1872
 sock_sendmsg_nosec net/socket.c:718 [inline]
 __sock_sendmsg net/socket.c:730 [inline]
 ____sys_sendmsg+0x5b8/0x918 net/socket.c:2519
 ___sys_sendmsg net/socket.c:2573 [inline]
 __sys_sendmsg+0x25c/0x320 net/socket.c:2602
 __do_sys_sendmsg net/socket.c:2611 [inline]
 __se_sys_sendmsg net/socket.c:2609 [inline]
 __arm64_sys_sendmsg+0x80/0x94 net/socket.c:2609
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

Freed by task 4518:
 kasan_save_stack mm/kasan/common.c:45 [inline]
 kasan_set_track+0x4c/0x80 mm/kasan/common.c:52
 kasan_save_free_info+0x3c/0x60 mm/kasan/generic.c:516
 ____kasan_slab_free+0x148/0x1b0 mm/kasan/common.c:236
 __kasan_slab_free+0x18/0x28 mm/kasan/common.c:244
 kasan_slab_free include/linux/kasan.h:177 [inline]
 slab_free_hook mm/slub.c:1729 [inline]
 slab_free_freelist_hook+0x16c/0x1ec mm/slub.c:1755
 slab_free mm/slub.c:3687 [inline]
 __kmem_cache_free+0xc0/0x224 mm/slub.c:3700
 kfree+0xd0/0x1ac mm/slab_common.c:988
 qfq_change_class+0x818/0xa68 net/sched/sch_qfq.c:537
 tc_ctl_tclass+0x840/0xb34 net/sched/sch_api.c:2202
 rtnetlink_rcv_msg+0x734/0xce4 net/core/rtnetlink.c:6150
 netlink_rcv_skb+0x208/0x3c4 net/netlink/af_netlink.c:2511
 rtnetlink_rcv+0x28/0x38 net/core/rtnetlink.c:6168
 netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]
 netlink_unicast+0x60c/0x824 net/netlink/af_netlink.c:1344
 netlink_sendmsg+0x6e8/0x9b0 net/netlink/af_netlink.c:1872
 sock_sendmsg_nosec net/socket.c:718 [inline]
 __sock_sendmsg net/socket.c:730 [inline]
 ____sys_sendmsg+0x5b8/0x918 net/socket.c:2519
 ___sys_sendmsg net/socket.c:2573 [inline]
 __sys_sendmsg+0x25c/0x320 net/socket.c:2602
 __do_sys_sendmsg net/socket.c:2611 [inline]
 __se_sys_sendmsg net/socket.c:2609 [inline]
 __arm64_sys_sendmsg+0x80/0x94 net/socket.c:2609
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x138 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

The buggy address belongs to the object at ffff0000d41fb000
 which belongs to the cache kmalloc-128 of size 128
The buggy address is located 80 bytes inside of
 128-byte region [ffff0000d41fb000, ffff0000d41fb080)

The buggy address belongs to the physical page:
page:0000000025cfb622 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1141fb
flags: 0x5ffc00000000200(slab|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000200 0000000000000000 dead000000000122 ffff0000c0002300
raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000d41faf00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff0000d41faf80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff0000d41fb000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                 ^
 ffff0000d41fb080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff0000d41fb100: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
Unable to handle kernel paging request at virtual address e0a720760000023d
KASAN: maybe wild-memory-access in range [0x053d03b0000011e8-0x053d03b0000011ef]
Mem abort info:
  ESR = 0x0000000096000004
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x04: level 0 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000004
  CM = 0, WnR = 0
[e0a720760000023d] address between user and kernel address ranges
Internal error: Oops: 0000000096000004 [#1] PREEMPT SMP
Modules linked in:
CPU: 1 PID: 4518 Comm: syz.0.17 Tainted: G    B              syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/03/2025
pstate: 82400005 (Nzcv daif +PAN -UAO +TCO -DIT -SSBS BTYPE=--)
pc : qfq_reset_qdisc+0xbc/0x208 net/sched/sch_qfq.c:1486
lr : qfq_reset_qdisc+0x158/0x208 net/sched/sch_qfq.c:1485
sp : ffff8000208975a0
x29: ffff8000208975b0 x28: 0000000000000000 x27: 1fffe0001860585a
x26: 00a7a0760000023d x25: dfff800000000000 x24: 0000000000000000
x23: 053d03b0000011ee x22: 053d03b00000119e x21: ffff0000c302c2d0
x20: ffff0000c302c2d8 x19: ffff0000c302c000 x18: ffff800011a5bd40
x17: 0000000000000000 x16: ffff800008042d90 x15: 0000000000000000
x14: 00000000ffffffff x13: 0000000000000001 x12: 0000000000ff0100
x11: ff0080000ff41dac x10: 0000000000000000 x9 : ffff80000ff41dac
x8 : ffff0000d39eb780 x7 : 0000000000000001 x6 : 0000000000000001
x5 : ffff800020896f78 x4 : ffff800015134e00 x3 : ffff80000ff41d98
x2 : 0000000000000000 x1 : 0000000000000008 x0 : 0000000000000000
Call trace:
 qfq_reset_qdisc+0xbc/0x208 net/sched/sch_qfq.c:1486
 qdisc_reset+0x134/0x604 net/sched/sch_generic.c:1038
 __qdisc_destroy+0x100/0x500 net/sched/sch_generic.c:1076
 qdisc_put net/sched/sch_generic.c:1107 [inline]
 dev_shutdown+0x35c/0x47c net/sched/sch_generic.c:1495
 unregister_netdevice_many+0x944/0x1740 net/core/dev.c:10981
 unregister_netdevice_queue+0x2ac/0x2f8 net/core/dev.c:10921
 unregister_netdevice include/linux/netdevice.h:3075 [inline]
 __tun_detach+0xb04/0x122c drivers/net/tun.c:685
 tun_detach drivers/net/tun.c:701 [inline]
 tun_chr_close+0x118/0x1f8 drivers/net/tun.c:3492
 __fput+0x1bc/0x7c0 fs/file_table.c:320
 ____fput+0x20/0x30 fs/file_table.c:348
 task_work_run+0x1ec/0x270 kernel/task_work.c:203
 resume_user_mode_work include/linux/resume_user_mode.h:49 [inline]
 do_notify_resume+0x2038/0x2b28 arch/arm64/kernel/signal.c:1137
 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:137 [inline]
 exit_to_user_mode arch/arm64/kernel/entry-common.c:142 [inline]
 el0_svc+0x98/0x138 arch/arm64/kernel/entry-common.c:638
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
Code: d1002116 b4000656 910142d7 d343fefa (38796b48) 
---[ end trace 0000000000000000 ]---
----------------
Code disassembly (best guess):
   0:	d1002116 	sub	x22, x8, #0x8
   4:	b4000656 	cbz	x22, 0xcc
   8:	910142d7 	add	x23, x22, #0x50
   c:	d343fefa 	lsr	x26, x23, #3
* 10:	38796b48 	ldrb	w8, [x26, x25] <-- trapping instruction

Crashes (5):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2025/12/27 13:26 linux-6.1.y 50cbba13faa2 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in qfq_reset_qdisc
2025/12/27 12:26 linux-6.1.y 50cbba13faa2 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in qfq_reset_qdisc
2025/12/27 11:30 linux-6.1.y 50cbba13faa2 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in qfq_reset_qdisc
2025/12/27 10:34 linux-6.1.y 50cbba13faa2 d6526ea3 .config console log report syz / log C [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in qfq_reset_qdisc
2025/12/27 09:37 linux-6.1.y 50cbba13faa2 d6526ea3 .config console log report info [disk image] [vmlinux] [kernel image] ci2-linux-6-1-kasan-arm64 KASAN: use-after-free Read in qfq_reset_qdisc
* Struck through repros no longer work on HEAD.