================================================================== BUG: KASAN: slab-use-after-free in read_pnet include/net/net_namespace.h:414 [inline] BUG: KASAN: slab-use-after-free in dev_net include/linux/netdevice.h:2738 [inline] BUG: KASAN: slab-use-after-free in nf_hook_entry_head+0x1f1/0x2c0 net/netfilter/core.c:319 Read of size 8 at addr ffff88807a220108 by task kworker/u8:25/10783 CPU: 0 UID: 0 PID: 10783 Comm: kworker/u8:25 Tainted: G L syzkaller #0 PREEMPT(full) Tainted: [L]=SOFTLOCKUP Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 Workqueue: netns cleanup_net Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xca/0x240 mm/kasan/report.c:482 kasan_report+0x118/0x150 mm/kasan/report.c:595 read_pnet include/net/net_namespace.h:414 [inline] dev_net include/linux/netdevice.h:2738 [inline] nf_hook_entry_head+0x1f1/0x2c0 net/netfilter/core.c:319 __nf_unregister_net_hook+0x74/0x6f0 net/netfilter/core.c:491 nft_unregister_flowtable_ops net/netfilter/nf_tables_api.c:9039 [inline] __nft_unregister_flowtable_net_hooks net/netfilter/nf_tables_api.c:9054 [inline] __nft_release_hook+0x180/0x350 net/netfilter/nf_tables_api.c:12036 __nft_release_hooks net/netfilter/nf_tables_api.c:12050 [inline] nf_tables_pre_exit_net+0xa7/0x110 net/netfilter/nf_tables_api.c:12201 ops_pre_exit_list net/core/net_namespace.c:161 [inline] ops_undo_list+0x187/0x990 net/core/net_namespace.c:234 cleanup_net+0x4d8/0x7a0 net/core/net_namespace.c:696 process_one_work kernel/workqueue.c:3257 [inline] process_scheduled_works+0xad1/0x1770 kernel/workqueue.c:3340 worker_thread+0x8a0/0xda0 kernel/workqueue.c:3421 kthread+0x711/0x8a0 kernel/kthread.c:463 ret_from_fork+0x510/0xa50 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:246 Allocated by task 15533: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 unpoison_slab_object mm/kasan/common.c:340 [inline] __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:366 kasan_slab_alloc include/linux/kasan.h:253 [inline] slab_post_alloc_hook mm/slub.c:4953 [inline] slab_alloc_node mm/slub.c:5263 [inline] kmem_cache_alloc_node_noprof+0x43c/0x720 mm/slub.c:5315 kmalloc_reserve+0xbd/0x290 net/core/skbuff.c:586 __alloc_skb+0x204/0x3a0 net/core/skbuff.c:690 alloc_skb include/linux/skbuff.h:1383 [inline] nlmsg_new include/net/netlink.h:1055 [inline] inet6_rt_notify+0x170/0x470 net/ipv6/route.c:6356 fib6_del_route net/ipv6/ip6_fib.c:2056 [inline] fib6_del+0x1061/0x1560 net/ipv6/ip6_fib.c:2091 fib6_clean_node+0x29f/0x5c0 net/ipv6/ip6_fib.c:2253 fib6_walk_continue+0x67b/0x910 net/ipv6/ip6_fib.c:2175 fib6_walk+0x149/0x290 net/ipv6/ip6_fib.c:2223 fib6_clean_tree net/ipv6/ip6_fib.c:2303 [inline] __fib6_clean_all+0x234/0x380 net/ipv6/ip6_fib.c:2319 rt6_sync_down_dev net/ipv6/route.c:5014 [inline] rt6_disable_ip+0x120/0x720 net/ipv6/route.c:5019 addrconf_ifdown+0x14d/0x1870 net/ipv6/addrconf.c:3853 addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1 notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2268 [inline] call_netdevice_notifiers net/core/dev.c:2282 [inline] netif_close_many+0x29c/0x410 net/core/dev.c:1785 unregister_netdevice_many_notify+0xb50/0x2340 net/core/dev.c:12353 unregister_netdevice_many net/core/dev.c:12446 [inline] unregister_netdevice_queue+0x317/0x350 net/core/dev.c:12260 unregister_netdevice include/linux/netdevice.h:3405 [inline] __tun_detach+0x6d9/0x15d0 drivers/net/tun.c:621 tun_detach drivers/net/tun.c:637 [inline] tun_chr_close+0x10a/0x1c0 drivers/net/tun.c:3436 __fput+0x44c/0xa70 fs/file_table.c:468 task_work_run+0x1d4/0x260 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:44 [inline] exit_to_user_mode_loop+0xef/0x4e0 kernel/entry/common.c:75 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline] do_syscall_64+0x2c1/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 15533: kasan_save_stack mm/kasan/common.c:57 [inline] kasan_save_track+0x3e/0x80 mm/kasan/common.c:78 kasan_save_free_info+0x46/0x50 mm/kasan/generic.c:584 poison_slab_object mm/kasan/common.c:253 [inline] __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285 kasan_slab_free include/linux/kasan.h:235 [inline] slab_free_hook mm/slub.c:2540 [inline] slab_free mm/slub.c:6670 [inline] kmem_cache_free+0x197/0x620 mm/slub.c:6781 skb_release_data+0x62d/0x7c0 net/core/skbuff.c:1107 skb_release_all net/core/skbuff.c:1182 [inline] __kfree_skb net/core/skbuff.c:1196 [inline] consume_skb+0x9e/0xf0 net/core/skbuff.c:1428 netlink_broadcast_filtered+0xec7/0x1000 net/netlink/af_netlink.c:1535 nlmsg_multicast_filtered include/net/netlink.h:1165 [inline] nlmsg_multicast include/net/netlink.h:1184 [inline] nlmsg_notify+0xf0/0x1a0 net/netlink/af_netlink.c:2593 fib6_del_route net/ipv6/ip6_fib.c:2056 [inline] fib6_del+0x1061/0x1560 net/ipv6/ip6_fib.c:2091 fib6_clean_node+0x29f/0x5c0 net/ipv6/ip6_fib.c:2253 fib6_walk_continue+0x67b/0x910 net/ipv6/ip6_fib.c:2175 fib6_walk+0x149/0x290 net/ipv6/ip6_fib.c:2223 fib6_clean_tree net/ipv6/ip6_fib.c:2303 [inline] __fib6_clean_all+0x234/0x380 net/ipv6/ip6_fib.c:2319 rt6_sync_down_dev net/ipv6/route.c:5014 [inline] rt6_disable_ip+0x120/0x720 net/ipv6/route.c:5019 addrconf_ifdown+0x14d/0x1870 net/ipv6/addrconf.c:3853 addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1 notifier_call_chain+0x19d/0x3a0 kernel/notifier.c:85 call_netdevice_notifiers_extack net/core/dev.c:2268 [inline] call_netdevice_notifiers net/core/dev.c:2282 [inline] netif_close_many+0x29c/0x410 net/core/dev.c:1785 unregister_netdevice_many_notify+0xb50/0x2340 net/core/dev.c:12353 unregister_netdevice_many net/core/dev.c:12446 [inline] unregister_netdevice_queue+0x317/0x350 net/core/dev.c:12260 unregister_netdevice include/linux/netdevice.h:3405 [inline] __tun_detach+0x6d9/0x15d0 drivers/net/tun.c:621 tun_detach drivers/net/tun.c:637 [inline] tun_chr_close+0x10a/0x1c0 drivers/net/tun.c:3436 __fput+0x44c/0xa70 fs/file_table.c:468 task_work_run+0x1d4/0x260 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:44 [inline] exit_to_user_mode_loop+0xef/0x4e0 kernel/entry/common.c:75 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline] do_syscall_64+0x2c1/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff88807a220000 which belongs to the cache skbuff_small_head of size 704 The buggy address is located 264 bytes inside of freed 704-byte region [ffff88807a220000, ffff88807a2202c0) The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7a220 head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801d687140 ffffea0001f77d00 dead000000000002 raw: 0000000000000000 0000000000130013 00000000f5000000 0000000000000000 head: 00fff00000000040 ffff88801d687140 ffffea0001f77d00 dead000000000002 head: 0000000000000000 0000000000130013 00000000f5000000 0000000000000000 head: 00fff00000000002 ffffea0001e88801 00000000ffffffff 00000000ffffffff head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000004 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd2820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5198, tgid 5198 (udevd), ts 810252732467, free_ts 810066297722 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x234/0x290 mm/page_alloc.c:1857 prep_new_page mm/page_alloc.c:1865 [inline] get_page_from_freelist+0x24e0/0x2580 mm/page_alloc.c:3915 __alloc_frozen_pages_noprof+0x181/0x370 mm/page_alloc.c:5210 alloc_pages_mpol+0x232/0x4a0 mm/mempolicy.c:2486 alloc_slab_page mm/slub.c:3075 [inline] allocate_slab+0x86/0x3b0 mm/slub.c:3248 new_slab mm/slub.c:3302 [inline] ___slab_alloc+0xe53/0x1820 mm/slub.c:4656 __slab_alloc+0x65/0x100 mm/slub.c:4779 __slab_alloc_node mm/slub.c:4855 [inline] slab_alloc_node mm/slub.c:5251 [inline] kmem_cache_alloc_node_noprof+0x4ce/0x720 mm/slub.c:5315 kmalloc_reserve+0xbd/0x290 net/core/skbuff.c:586 __alloc_skb+0x204/0x3a0 net/core/skbuff.c:690 alloc_skb_fclone include/linux/skbuff.h:1433 [inline] tcp_stream_alloc_skb+0x3d/0x350 net/ipv4/tcp.c:910 tso_fragment net/ipv4/tcp_output.c:2327 [inline] tcp_write_xmit+0xd87/0x6980 net/ipv4/tcp_output.c:2988 __tcp_push_pending_frames+0x97/0x380 net/ipv4/tcp_output.c:3185 tcp_push_pending_frames include/net/tcp.h:2224 [inline] tcp_data_snd_check net/ipv4/tcp_input.c:5896 [inline] tcp_rcv_established+0xfe6/0x2580 net/ipv4/tcp_input.c:6476 tcp_v4_do_rcv+0xa90/0x1430 net/ipv4/tcp_ipv4.c:1881 tcp_v4_rcv+0x2675/0x2f20 net/ipv4/tcp_ipv4.c:2324 page last free pid 12836 tgid 12836 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1406 [inline] __free_frozen_pages+0xbc8/0xd30 mm/page_alloc.c:2943 device_release+0x9e/0x1d0 drivers/base/core.c:-1 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x228/0x570 lib/kobject.c:737 netdev_run_todo+0xd2c/0xea0 net/core/dev.c:11700 tun_detach drivers/net/tun.c:640 [inline] tun_chr_close+0x13c/0x1c0 drivers/net/tun.c:3436 __fput+0x44c/0xa70 fs/file_table.c:468 task_work_run+0x1d4/0x260 kernel/task_work.c:233 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] __exit_to_user_mode_loop kernel/entry/common.c:44 [inline] exit_to_user_mode_loop+0xef/0x4e0 kernel/entry/common.c:75 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode_work include/linux/entry-common.h:159 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:194 [inline] do_syscall_64+0x2c1/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff88807a220000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88807a220080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88807a220100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88807a220180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88807a220200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================