================================================================== BUG: KFENCE: use-after-free read in __xfrm_state_insert+0x855/0x1450 net/xfrm/xfrm_state.c:1743 Use-after-free read at 0xffff88823be4af70 (in kfence-#36): __xfrm_state_insert+0x855/0x1450 net/xfrm/xfrm_state.c:1743 xfrm_state_insert+0x54/0x60 net/xfrm/xfrm_state.c:1795 ipcomp6_tunnel_attach net/ipv6/ipcomp6.c:131 [inline] ipcomp6_init_state+0x655/0x900 net/ipv6/ipcomp6.c:163 __xfrm_init_state+0xa73/0x13f0 net/xfrm/xfrm_state.c:3188 xfrm_state_construct net/xfrm/xfrm_user.c:954 [inline] xfrm_add_sa+0x2f5b/0x4070 net/xfrm/xfrm_user.c:1019 xfrm_user_rcv_msg+0x7a0/0xab0 net/xfrm/xfrm_user.c:3501 netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552 xfrm_netlink_rcv+0x79/0x90 net/xfrm/xfrm_user.c:3523 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0x82c/0x9e0 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896 sock_sendmsg_nosec net/socket.c:714 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:729 ____sys_sendmsg+0x505/0x830 net/socket.c:2614 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668 __sys_sendmsg net/socket.c:2700 [inline] __do_sys_sendmsg net/socket.c:2705 [inline] __se_sys_sendmsg net/socket.c:2703 [inline] __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2703 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f kfence-#36: 0xffff88823be4a000-0xffff88823be4aa1f, size=2592, cache=kmalloc-4k allocated by task 18154 on cpu 0 at 621.041802s (1.596597s ago): kmalloc_noprof include/linux/slab.h:905 [inline] kzalloc_noprof include/linux/slab.h:1039 [inline] kobject_uevent_env+0x27c/0x8c0 lib/kobject_uevent.c:540 __kobject_del+0xd2/0x300 lib/kobject.c:601 kobject_cleanup lib/kobject.c:680 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x243/0x480 lib/kobject.c:737 netdev_queue_update_kobjects+0x5db/0x6c0 net/core/net-sysfs.c:2071 remove_queue_kobjects net/core/net-sysfs.c:2168 [inline] netdev_unregister_kobject+0x11f/0x450 net/core/net-sysfs.c:2323 unregister_netdevice_many_notify+0x1a6b/0x1ff0 net/core/dev.c:12183 ops_exit_rtnl_list net/core/net_namespace.c:186 [inline] ops_undo_list+0x3dc/0x990 net/core/net_namespace.c:247 setup_net+0x2d3/0x320 net/core/net_namespace.c:453 copy_net_ns+0x31b/0x4d0 net/core/net_namespace.c:570 create_new_namespaces+0x3f3/0x720 kernel/nsproxy.c:110 copy_namespaces+0x438/0x4b0 kernel/nsproxy.c:175 copy_process+0x1733/0x3c00 kernel/fork.c:2178 kernel_clone+0x21e/0x840 kernel/fork.c:2605 __do_sys_clone kernel/fork.c:2748 [inline] __se_sys_clone kernel/fork.c:2732 [inline] __x64_sys_clone+0x18b/0x1e0 kernel/fork.c:2732 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f freed by task 18154 on cpu 0 at 621.042255s (1.686669s ago): kobject_uevent_env+0x36b/0x8c0 lib/kobject_uevent.c:640 __kobject_del+0xd2/0x300 lib/kobject.c:601 kobject_cleanup lib/kobject.c:680 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x243/0x480 lib/kobject.c:737 netdev_queue_update_kobjects+0x5db/0x6c0 net/core/net-sysfs.c:2071 remove_queue_kobjects net/core/net-sysfs.c:2168 [inline] netdev_unregister_kobject+0x11f/0x450 net/core/net-sysfs.c:2323 unregister_netdevice_many_notify+0x1a6b/0x1ff0 net/core/dev.c:12183 ops_exit_rtnl_list net/core/net_namespace.c:186 [inline] ops_undo_list+0x3dc/0x990 net/core/net_namespace.c:247 setup_net+0x2d3/0x320 net/core/net_namespace.c:453 copy_net_ns+0x31b/0x4d0 net/core/net_namespace.c:570 create_new_namespaces+0x3f3/0x720 kernel/nsproxy.c:110 copy_namespaces+0x438/0x4b0 kernel/nsproxy.c:175 copy_process+0x1733/0x3c00 kernel/fork.c:2178 kernel_clone+0x21e/0x840 kernel/fork.c:2605 __do_sys_clone kernel/fork.c:2748 [inline] __se_sys_clone kernel/fork.c:2732 [inline] __x64_sys_clone+0x18b/0x1e0 kernel/fork.c:2732 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f CPU: 0 UID: 0 PID: 18276 Comm: syz.9.3331 Not tainted 6.17.0-rc1-syzkaller-g3ec85602f86c #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:__xfrm_state_insert+0x855/0x1450 net/xfrm/xfrm_state.c:1743 Code: d8 0f 94 c1 08 c1 74 0a e8 c8 e7 9e f7 e9 aa 00 00 00 4d 8d ac 24 30 03 00 00 4d 89 ee 49 c1 ee 03 41 0f b6 04 1e 84 c0 75 48 <41> 0f b6 6d 00 83 e5 0c bf 08 00 00 00 89 ee e8 97 ea 9e f7 83 fd RSP: 0018:ffffc9001736f0f8 EFLAGS: 00010246 RAX: 0000000000000000 RBX: dffffc0000000000 RCX: 0000000000000000 RDX: ffff88802e52bc00 RSI: 0000000000000000 RDI: 0000000000000008 RBP: 0000000000000003 R08: dffffc0000000000 R09: 0000000000000002 R10: 000000000000000a R11: 0000000000000002 R12: ffff88823be4ac40 R13: ffff88823be4af70 R14: 1ffff110477c95ee R15: 0000000000000003 FS: 00007fb170c026c0(0000) GS:ffff888125c1c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff88823be4af70 CR3: 0000000065d5e000 CR4: 00000000003526f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Call Trace: xfrm_state_insert+0x54/0x60 net/xfrm/xfrm_state.c:1795 ipcomp6_tunnel_attach net/ipv6/ipcomp6.c:131 [inline] ipcomp6_init_state+0x655/0x900 net/ipv6/ipcomp6.c:163 __xfrm_init_state+0xa73/0x13f0 net/xfrm/xfrm_state.c:3188 xfrm_state_construct net/xfrm/xfrm_user.c:954 [inline] xfrm_add_sa+0x2f5b/0x4070 net/xfrm/xfrm_user.c:1019 xfrm_user_rcv_msg+0x7a0/0xab0 net/xfrm/xfrm_user.c:3501 netlink_rcv_skb+0x208/0x470 net/netlink/af_netlink.c:2552 xfrm_netlink_rcv+0x79/0x90 net/xfrm/xfrm_user.c:3523 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline] netlink_unicast+0x82c/0x9e0 net/netlink/af_netlink.c:1346 netlink_sendmsg+0x805/0xb30 net/netlink/af_netlink.c:1896 sock_sendmsg_nosec net/socket.c:714 [inline] __sock_sendmsg+0x21c/0x270 net/socket.c:729 ____sys_sendmsg+0x505/0x830 net/socket.c:2614 ___sys_sendmsg+0x21f/0x2a0 net/socket.c:2668 __sys_sendmsg net/socket.c:2700 [inline] __do_sys_sendmsg net/socket.c:2705 [inline] __se_sys_sendmsg net/socket.c:2703 [inline] __x64_sys_sendmsg+0x19b/0x260 net/socket.c:2703 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xfa/0x3b0 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fb16fd8ebe9 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fb170c02038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007fb16ffb6090 RCX: 00007fb16fd8ebe9 RDX: 0000000000000000 RSI: 00002000000035c0 RDI: 0000000000000009 RBP: 00007fb16fe11e19 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007fb16ffb6128 R14: 00007fb16ffb6090 R15: 00007ffee65dfd08 ================================================================== ---------------- Code disassembly (best guess): 0: d8 0f fmuls (%rdi) 2: 94 xchg %eax,%esp 3: c1 08 c1 rorl $0xc1,(%rax) 6: 74 0a je 0x12 8: e8 c8 e7 9e f7 call 0xf79ee7d5 d: e9 aa 00 00 00 jmp 0xbc 12: 4d 8d ac 24 30 03 00 lea 0x330(%r12),%r13 19: 00 1a: 4d 89 ee mov %r13,%r14 1d: 49 c1 ee 03 shr $0x3,%r14 21: 41 0f b6 04 1e movzbl (%r14,%rbx,1),%eax 26: 84 c0 test %al,%al 28: 75 48 jne 0x72 * 2a: 41 0f b6 6d 00 movzbl 0x0(%r13),%ebp <-- trapping instruction 2f: 83 e5 0c and $0xc,%ebp 32: bf 08 00 00 00 mov $0x8,%edi 37: 89 ee mov %ebp,%esi 39: e8 97 ea 9e f7 call 0xf79eead5 3e: 83 .byte 0x83 3f: fd std