==================================================================
BUG: KASAN: use-after-free in __hlist_del include/linux/list.h:906 [inline]
BUG: KASAN: use-after-free in hlist_del_init_rcu include/linux/rculist.h:184 [inline]
BUG: KASAN: use-after-free in __xfrm_state_delete+0x3db/0x940 net/xfrm/xfrm_state.c:700
Write of size 8 at addr ffff888056cc8590 by task syz-executor/4263
CPU: 1 PID: 4263 Comm: syz-executor Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026
Call Trace:
dump_stack_lvl+0x188/0x24e lib/dump_stack.c:106
print_address_description mm/kasan/report.c:316 [inline]
print_report+0xa8/0x210 mm/kasan/report.c:420
kasan_report+0x10b/0x140 mm/kasan/report.c:524
__hlist_del include/linux/list.h:906 [inline]
hlist_del_init_rcu include/linux/rculist.h:184 [inline]
__xfrm_state_delete+0x3db/0x940 net/xfrm/xfrm_state.c:700
xfrm_timer_handler+0x10b/0x970 net/xfrm/xfrm_state.c:631
__run_hrtimer kernel/time/hrtimer.c:1751 [inline]
__hrtimer_run_queues+0x522/0xc90 kernel/time/hrtimer.c:1815
hrtimer_run_softirq+0x173/0x290 kernel/time/hrtimer.c:1832
handle_softirqs+0x291/0x910 kernel/softirq.c:596
__do_softirq kernel/softirq.c:630 [inline]
invoke_softirq kernel/softirq.c:470 [inline]
__irq_exit_rcu+0x13b/0x230 kernel/softirq.c:679
irq_exit_rcu+0x5/0x20 kernel/softirq.c:691
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1118 [inline]
sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1118
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:691
RIP: 0010:put_cpu_partial+0x1b0/0x250 mm/slub.c:2673
Code: 3b 44 24 18 0f 85 b4 00 00 00 48 83 c4 20 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 4c 06 64 08 f7 c5 00 02 00 00 74 c0 fb 4d 85 e4 <75> bf eb c8 e8 37 81 3a 02 85 c0 0f 84 e9 fe ff ff 83 3d 50 24 4f
RSP: 0000:ffffc90003d77718 EFLAGS: 00000246
RAX: 88051bbd7fec7800 RBX: ffff888018442140 RCX: 88051bbd7fec7800
RDX: dffffc0000000000 RSI: ffffffff8aac1cc0 RDI: ffffffff8afe72a0
RBP: 0000000000000286 R08: ffffffff91b62317 R09: 1ffffffff236c462
R10: dffffc0000000000 R11: fffffbfff236c463 R12: 0000000000000000
R13: 0000000000000001 R14: ffff88802cf00000 R15: ffff8880b8d3ea80
qlink_free mm/kasan/quarantine.c:166 [inline]
qlist_free_all+0x76/0xe0 mm/kasan/quarantine.c:185
kasan_quarantine_reduce+0x144/0x160 mm/kasan/quarantine.c:292
__kasan_slab_alloc+0x1e/0x80 mm/kasan/common.c:306
kasan_slab_alloc include/linux/kasan.h:201 [inline]
slab_post_alloc_hook+0x4b/0x490 mm/slab.h:742
slab_alloc_node mm/slub.c:3366 [inline]
slab_alloc mm/slub.c:3374 [inline]
__kmem_cache_alloc_lru mm/slub.c:3381 [inline]
kmem_cache_alloc+0x18b/0x2f0 mm/slub.c:3390
kmem_cache_zalloc include/linux/slab.h:689 [inline]
jbd2_alloc_handle include/linux/jbd2.h:1602 [inline]
new_handle fs/jbd2/transaction.c:476 [inline]
jbd2__journal_start+0x13c/0x5a0 fs/jbd2/transaction.c:503
__ext4_journal_start_sb+0x187/0x3d0 fs/ext4/ext4_jbd2.c:105
__ext4_journal_start fs/ext4/ext4_jbd2.h:326 [inline]
ext4_dirty_inode+0x8b/0x100 fs/ext4/inode.c:6196
__mark_inode_dirty+0x2e7/0xe80 fs/fs-writeback.c:2515
generic_update_time fs/inode.c:1944 [inline]
inode_update_time fs/inode.c:1957 [inline]
__file_update_time+0x21d/0x240 fs/inode.c:2145
file_update_time+0x2f3/0x370 fs/inode.c:2176
ext4_page_mkwrite+0x1a9/0x10d0 fs/ext4/inode.c:6317
do_page_mkwrite+0x16b/0x5c0 mm/memory.c:3009
wp_page_shared+0x167/0x370 mm/memory.c:3358
handle_pte_fault mm/memory.c:5047 [inline]
__handle_mm_fault mm/memory.c:5171 [inline]
handle_mm_fault+0x1b1b/0x3d40 mm/memory.c:5292
do_user_addr_fault+0x5a9/0xbb0 arch/x86/mm/fault.c:1338
handle_page_fault arch/x86/mm/fault.c:1429 [inline]
exc_page_fault+0x60/0x100 arch/x86/mm/fault.c:1482
asm_exc_page_fault+0x22/0x30 arch/x86/include/asm/idtentry.h:608
RIP: 0033:0x7f8d69e7df91
Code: 89 14 72 48 89 ce 48 83 e8 01 48 c1 e9 03 49 83 c1 08 48 c1 e0 0e 48 c1 ee 06 83 e1 07 48 01 c2 81 e6 ff 3f 00 00 89 d8 d3 e0 <08> 84 16 00 a0 00 00 4d 39 cb 0f 85 16 ff ff ff 48 8b 44 24 10 4c
RSP: 002b:00007ffe2520ad60 EFLAGS: 00010202
RAX: 0000000000000008 RBX: 0000000000000001 RCX: 0000000000000003
RDX: 00007f8d67c08000 RSI: 0000000000001772 RDI: ffffffff83cfffff
RBP: 00007ffe2520b260 R08: 0000000000001000 R09: 000055558b8c6848
R10: 000000000000008f R11: 000055558b8c6848 R12: 00007ffe2520b0a0
R13: 00007ffe2520ae90 R14: 585858582e7a7973 R15: 00007ffe2520ade0
Allocated by task 4347:
kasan_save_stack mm/kasan/common.c:46 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
____kasan_kmalloc mm/kasan/common.c:375 [inline]
__kasan_kmalloc+0x8e/0xa0 mm/kasan/common.c:384
kasan_kmalloc include/linux/kasan.h:211 [inline]
__do_kmalloc_node mm/slab_common.c:936 [inline]
__kmalloc+0xb3/0x240 mm/slab_common.c:949
xfrm_hash_resize+0x84/0xff0 net/xfrm/xfrm_state.c:156
process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
process_scheduled_works kernel/workqueue.c:2355 [inline]
worker_thread+0xd6e/0x12a0 kernel/workqueue.c:2441
kthread+0x29d/0x330 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
Freed by task 4351:
kasan_save_stack mm/kasan/common.c:46 [inline]
kasan_set_track+0x4b/0x70 mm/kasan/common.c:53
kasan_save_free_info+0x27/0x40 mm/kasan/generic.c:516
____kasan_slab_free+0x126/0x1f0 mm/kasan/common.c:237
kasan_slab_free include/linux/kasan.h:177 [inline]
slab_free_hook mm/slub.c:1735 [inline]
slab_free_freelist_hook+0x133/0x1b0 mm/slub.c:1761
slab_free mm/slub.c:3694 [inline]
__kmem_cache_free+0xb6/0x200 mm/slub.c:3707
xfrm_hash_resize+0xdce/0xff0 net/xfrm/xfrm_state.c:198
process_one_work+0x8ab/0x1160 kernel/workqueue.c:2292
worker_thread+0xaf5/0x12a0 kernel/workqueue.c:2439
kthread+0x29d/0x330 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
The buggy address belongs to the object at ffff888056cc8400
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 400 bytes inside of
512-byte region [ffff888056cc8400, ffff888056cc8600)
The buggy address belongs to the physical page:
page:ffffea00015b3200 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888056cca800 pfn:0x56cc8
head:ffffea00015b3200 order:2 compound_mapcount:0 compound_pincount:0
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 ffffea0001f40e08 ffffea0001e4f908 ffff888018441c80
raw: ffff888056cca800 0000000000100004 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 4278, tgid 4278 (syz-executor), ts 66132702339, free_ts 18248607485
set_page_owner include/linux/page_owner.h:31 [inline]
post_alloc_hook+0x173/0x1a0 mm/page_alloc.c:2560
prep_new_page mm/page_alloc.c:2567 [inline]
get_page_from_freelist+0x206b/0x2180 mm/page_alloc.c:4358
__alloc_pages+0x1ec/0x4f0 mm/page_alloc.c:5658
alloc_slab_page+0x5d/0x180 mm/slub.c:1805
allocate_slab mm/slub.c:1950 [inline]
new_slab+0x87/0x2d0 mm/slub.c:2003
___slab_alloc+0xbc5/0x1240 mm/slub.c:3161
__slab_alloc mm/slub.c:3247 [inline]
slab_alloc_node mm/slub.c:3332 [inline]
__kmem_cache_alloc_node+0x126/0x270 mm/slub.c:3405
__do_kmalloc_node mm/slab_common.c:935 [inline]
__kmalloc+0xa3/0x240 mm/slab_common.c:949
kmalloc include/linux/slab.h:568 [inline]
kzalloc include/linux/slab.h:699 [inline]
fib6_info_alloc+0x2e/0xe0 net/ipv6/ip6_fib.c:156
ip6_route_info_create+0x455/0x1220 net/ipv6/route.c:3800
addrconf_f6i_alloc+0x1ec/0x430 net/ipv6/route.c:4627
ipv6_add_addr+0x461/0xfc0 net/ipv6/addrconf.c:1121
add_addr+0x8c/0x2c0 net/ipv6/addrconf.c:3162
add_v4_addrs+0x76e/0xcc0 net/ipv6/addrconf.c:3224
addrconf_sit_config net/ipv6/addrconf.c:3475 [inline]
addrconf_init_auto_addrs+0x35d/0xaa0 net/ipv6/addrconf.c:3513
addrconf_notify+0xacd/0xf60 net/ipv6/addrconf.c:3700
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1487 [inline]
free_pcp_prepare mm/page_alloc.c:1537 [inline]
free_unref_page_prepare+0x8e5/0x9e0 mm/page_alloc.c:3414
free_unref_page+0x2e/0x3f0 mm/page_alloc.c:3509
free_contig_range+0x9d/0x150 mm/page_alloc.c:9506
destroy_args+0xef/0xa0e mm/debug_vm_pgtable.c:1031
debug_vm_pgtable+0x33c/0x38e mm/debug_vm_pgtable.c:1359
do_one_initcall+0x257/0x800 init/main.c:1271
do_initcall_level+0x13d/0x1ed init/main.c:1344
do_initcalls+0x4b/0x8a init/main.c:1360
kernel_init_freeable+0x401/0x5ab init/main.c:1599
kernel_init+0x19/0x1b0 init/main.c:1487
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
Memory state around the buggy address:
ffff888056cc8480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888056cc8500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888056cc8580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888056cc8600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888056cc8680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
----------------
Code disassembly (best guess):
0: 3b 44 24 18 cmp 0x18(%rsp),%eax
4: 0f 85 b4 00 00 00 jne 0xbe
a: 48 83 c4 20 add $0x20,%rsp
e: 5b pop %rbx
f: 41 5c pop %r12
11: 41 5d pop %r13
13: 41 5e pop %r14
15: 41 5f pop %r15
17: 5d pop %rbp
18: c3 ret
19: e8 4c 06 64 08 call 0x864066a
1e: f7 c5 00 02 00 00 test $0x200,%ebp
24: 74 c0 je 0xffffffe6
26: fb sti
27: 4d 85 e4 test %r12,%r12
* 2a: 75 bf jne 0xffffffeb <-- trapping instruction
2c: eb c8 jmp 0xfffffff6
2e: e8 37 81 3a 02 call 0x23a816a
33: 85 c0 test %eax,%eax
35: 0f 84 e9 fe ff ff je 0xffffff24
3b: 83 .byte 0x83
3c: 3d .byte 0x3d
3d: 50 push %rax
3e: 24 4f and $0x4f,%al