================================================================== BUG: KASAN: slab-use-after-free in skb_network_header include/linux/skbuff.h:2952 [inline] BUG: KASAN: slab-use-after-free in ipv6_hdr include/linux/ipv6.h:101 [inline] BUG: KASAN: slab-use-after-free in nf_nat_ipv6_in+0x141/0x2c0 net/netfilter/nf_nat_proto.c:949 Read of size 8 at addr ffff88802fdfcd50 by task syz.0.642/9083 CPU: 0 PID: 9083 Comm: syz.0.642 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026 Call Trace: dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:364 [inline] print_report+0xa8/0x210 mm/kasan/report.c:468 kasan_report+0x117/0x150 mm/kasan/report.c:581 skb_network_header include/linux/skbuff.h:2952 [inline] ipv6_hdr include/linux/ipv6.h:101 [inline] nf_nat_ipv6_in+0x141/0x2c0 net/netfilter/nf_nat_proto.c:949 nf_hook_entry_hookfn include/linux/netfilter.h:156 [inline] nf_hook_slow+0xb9/0x210 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:271 [inline] NF_HOOK include/linux/netfilter.h:314 [inline] br_nf_pre_routing_ipv6+0x55b/0x6a0 net/bridge/br_netfilter_ipv6.c:184 nf_hook_entry_hookfn include/linux/netfilter.h:156 [inline] nf_hook_bridge_pre net/bridge/br_input.c:277 [inline] br_handle_frame+0x12fa/0x15b0 net/bridge/br_input.c:433 __netif_receive_skb_core+0xf94/0x3ac0 net/core/dev.c:5604 __netif_receive_skb_one_core net/core/dev.c:5708 [inline] __netif_receive_skb+0x74/0x290 net/core/dev.c:5824 netif_receive_skb_internal net/core/dev.c:5910 [inline] netif_receive_skb+0x1bc/0x720 net/core/dev.c:5969 tun_rx_batched+0x1df/0x790 drivers/net/tun.c:1561 tun_get_user+0x286c/0x3d30 drivers/net/tun.c:2020 tun_chr_write_iter+0x119/0x200 drivers/net/tun.c:2066 call_write_iter include/linux/fs.h:2019 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x474/0x9a0 fs/read_write.c:584 ksys_write+0x151/0x260 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f768bd5fd8e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007f768cc12fb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f768cc136c0 RCX: 00007f768bd5fd8e RDX: 000000000000005a RSI: 0000200000000200 RDI: 00000000000000c8 RBP: 00007f768be36b20 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f768c026218 R14: 00007f768c026180 R15: 00007ffc53c3d478 Allocated by task 9083: kasan_save_stack mm/kasan/common.c:46 [inline] kasan_set_track+0x4e/0x70 mm/kasan/common.c:53 __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:188 [inline] slab_post_alloc_hook+0x6a/0x4d0 mm/slab.h:770 slab_alloc_node mm/slub.c:3518 [inline] slab_alloc mm/slub.c:3526 [inline] __kmem_cache_alloc_lru mm/slub.c:3533 [inline] kmem_cache_alloc+0x17e/0x2d0 mm/slub.c:3542 __build_skb net/core/skbuff.c:451 [inline] build_skb+0x29/0x250 net/core/skbuff.c:466 __tun_build_skb+0x36/0x320 drivers/net/tun.c:1616 tun_build_skb drivers/net/tun.c:1707 [inline] tun_get_user+0x1cb8/0x3d30 drivers/net/tun.c:1831 tun_chr_write_iter+0x119/0x200 drivers/net/tun.c:2066 call_write_iter include/linux/fs.h:2019 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x474/0x9a0 fs/read_write.c:584 ksys_write+0x151/0x260 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 Freed by task 9083: kasan_save_stack mm/kasan/common.c:46 [inline] kasan_set_track+0x4e/0x70 mm/kasan/common.c:53 kasan_save_free_info+0x28/0x40 mm/kasan/generic.c:522 ____kasan_slab_free+0x126/0x1f0 mm/kasan/common.c:237 kasan_slab_free include/linux/kasan.h:164 [inline] slab_free_hook mm/slub.c:1833 [inline] slab_free_freelist_hook+0x154/0x240 mm/slub.c:1859 slab_free mm/slub.c:3853 [inline] kmem_cache_free+0xf8/0x290 mm/slub.c:3875 NF_DROP_REASON include/linux/netfilter.h:30 [inline] nft_do_chain+0x14d9/0x16d0 net/netfilter/nf_tables_core.c:-1 nft_nat_do_chain+0x29b/0x380 net/netfilter/nft_chain_nat.c:32 nf_nat_inet_fn+0x5dd/0xb20 net/netfilter/nf_nat_core.c:958 nf_nat_ipv6_fn+0x227/0x2e0 net/netfilter/nf_nat_proto.c:937 nf_nat_ipv6_in+0xf1/0x2c0 net/netfilter/nf_nat_proto.c:947 nf_hook_entry_hookfn include/linux/netfilter.h:156 [inline] nf_hook_slow+0xb9/0x210 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:271 [inline] NF_HOOK include/linux/netfilter.h:314 [inline] br_nf_pre_routing_ipv6+0x55b/0x6a0 net/bridge/br_netfilter_ipv6.c:184 nf_hook_entry_hookfn include/linux/netfilter.h:156 [inline] nf_hook_bridge_pre net/bridge/br_input.c:277 [inline] br_handle_frame+0x12fa/0x15b0 net/bridge/br_input.c:433 __netif_receive_skb_core+0xf94/0x3ac0 net/core/dev.c:5604 __netif_receive_skb_one_core net/core/dev.c:5708 [inline] __netif_receive_skb+0x74/0x290 net/core/dev.c:5824 netif_receive_skb_internal net/core/dev.c:5910 [inline] netif_receive_skb+0x1bc/0x720 net/core/dev.c:5969 tun_rx_batched+0x1df/0x790 drivers/net/tun.c:1561 tun_get_user+0x286c/0x3d30 drivers/net/tun.c:2020 tun_chr_write_iter+0x119/0x200 drivers/net/tun.c:2066 call_write_iter include/linux/fs.h:2019 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x474/0x9a0 fs/read_write.c:584 ksys_write+0x151/0x260 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 The buggy address belongs to the object at ffff88802fdfcc80 which belongs to the cache skbuff_head_cache of size 240 The buggy address is located 208 bytes inside of freed 240-byte region [ffff88802fdfcc80, ffff88802fdfcd70) The buggy address belongs to the physical page: page:ffffea0000bf7f00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2fdfc memcg:ffff888030936b01 anon flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 00fff00000000800 ffff88801e26b000 0000000000000000 dead000000000001 raw: 0000000000000000 00000000800c000c 00000001ffffffff ffff888030936b01 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_HARDWALL), pid 42, tgid 42 (kworker/u4:2), ts 106969067624, free_ts 106962190120 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x1c1/0x200 mm/page_alloc.c:1582 prep_new_page mm/page_alloc.c:1589 [inline] get_page_from_freelist+0x2181/0x22a0 mm/page_alloc.c:3221 __alloc_pages+0x1f0/0x460 mm/page_alloc.c:4501 alloc_slab_page+0x5d/0x180 mm/slub.c:1903 allocate_slab mm/slub.c:2050 [inline] new_slab+0x87/0x2d0 mm/slub.c:2103 ___slab_alloc+0xc5c/0x12f0 mm/slub.c:3275 __slab_alloc mm/slub.c:3361 [inline] __slab_alloc_node mm/slub.c:3414 [inline] slab_alloc_node mm/slub.c:3508 [inline] slab_alloc mm/slub.c:3526 [inline] __kmem_cache_alloc_lru mm/slub.c:3533 [inline] kmem_cache_alloc+0x109/0x2d0 mm/slub.c:3542 skb_clone+0x1eb/0x370 net/core/skbuff.c:1915 batadv_iv_ogm_send_to_if net/batman-adv/bat_iv_ogm.c:390 [inline] batadv_iv_ogm_emit net/batman-adv/bat_iv_ogm.c:423 [inline] batadv_iv_send_outstanding_bat_ogm_packet+0x5e4/0x800 net/batman-adv/bat_iv_ogm.c:1792 process_one_work kernel/workqueue.c:2657 [inline] process_scheduled_works+0xa60/0x1600 kernel/workqueue.c:2734 worker_thread+0xa5e/0xfe0 kernel/workqueue.c:2815 kthread+0x2fa/0x390 kernel/kthread.c:388 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1182 [inline] free_unref_page_prepare+0x7d7/0x8f0 mm/page_alloc.c:2366 free_unref_page+0x32/0x2e0 mm/page_alloc.c:2459 vfree+0x1a7/0x340 mm/vmalloc.c:2899 bpf_check+0x667a/0xfe50 kernel/bpf/verifier.c:20990 bpf_prog_load+0x10fa/0x1610 kernel/bpf/syscall.c:2753 __sys_bpf+0x5ba/0x890 kernel/bpf/syscall.c:5497 __do_sys_bpf kernel/bpf/syscall.c:5601 [inline] __se_sys_bpf kernel/bpf/syscall.c:5599 [inline] __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5599 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 Memory state around the buggy address: ffff88802fdfcc00: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc ffff88802fdfcc80: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88802fdfcd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc ^ ffff88802fdfcd80: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb ffff88802fdfce00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================