================================================================== BUG: KASAN: slab-use-after-free in skb_network_header include/linux/skbuff.h:2952 [inline] BUG: KASAN: slab-use-after-free in ipv6_hdr include/linux/ipv6.h:101 [inline] BUG: KASAN: slab-use-after-free in nf_nat_ipv6_in+0x141/0x2c0 net/netfilter/nf_nat_proto.c:949 Read of size 8 at addr ffff88804965c490 by task syz.0.3528/20863 CPU: 1 PID: 20863 Comm: syz.0.3528 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/06/2026 Call Trace: dump_stack_lvl+0x18c/0x250 lib/dump_stack.c:106 print_address_description mm/kasan/report.c:364 [inline] print_report+0xa8/0x210 mm/kasan/report.c:468 kasan_report+0x117/0x150 mm/kasan/report.c:581 skb_network_header include/linux/skbuff.h:2952 [inline] ipv6_hdr include/linux/ipv6.h:101 [inline] nf_nat_ipv6_in+0x141/0x2c0 net/netfilter/nf_nat_proto.c:949 nf_hook_entry_hookfn include/linux/netfilter.h:156 [inline] nf_hook_slow+0xb9/0x210 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:271 [inline] NF_HOOK include/linux/netfilter.h:314 [inline] br_nf_pre_routing_ipv6+0x55b/0x6a0 net/bridge/br_netfilter_ipv6.c:184 nf_hook_entry_hookfn include/linux/netfilter.h:156 [inline] nf_hook_bridge_pre net/bridge/br_input.c:277 [inline] br_handle_frame+0x12fa/0x15b0 net/bridge/br_input.c:433 __netif_receive_skb_core+0xf94/0x3ac0 net/core/dev.c:5604 __netif_receive_skb_one_core net/core/dev.c:5708 [inline] __netif_receive_skb+0x74/0x290 net/core/dev.c:5824 netif_receive_skb_internal net/core/dev.c:5910 [inline] netif_receive_skb+0x1bc/0x720 net/core/dev.c:5969 tun_rx_batched+0x1df/0x790 drivers/net/tun.c:1561 tun_get_user+0x286c/0x3d30 drivers/net/tun.c:2020 tun_chr_write_iter+0x119/0x200 drivers/net/tun.c:2066 call_write_iter include/linux/fs.h:2019 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x474/0x9a0 fs/read_write.c:584 ksys_write+0x151/0x260 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 RIP: 0033:0x7f7d29169d0e Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08 RSP: 002b:00007f7d29fddfb8 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007f7d29fde6c0 RCX: 00007f7d29169d0e RDX: 000000000000008e RSI: 00002000000004c0 RDI: 00000000000000c8 RBP: 00007f7d2923804e R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f7d29426218 R14: 00007f7d29426180 R15: 00007fff843a1278 Allocated by task 20863: kasan_save_stack mm/kasan/common.c:46 [inline] kasan_set_track+0x4e/0x70 mm/kasan/common.c:53 __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:188 [inline] slab_post_alloc_hook+0x6a/0x4d0 mm/slab.h:770 slab_alloc_node mm/slub.c:3518 [inline] slab_alloc mm/slub.c:3526 [inline] __kmem_cache_alloc_lru mm/slub.c:3533 [inline] kmem_cache_alloc+0x17e/0x2d0 mm/slub.c:3542 __build_skb net/core/skbuff.c:451 [inline] build_skb+0x29/0x250 net/core/skbuff.c:466 __tun_build_skb+0x36/0x320 drivers/net/tun.c:1616 tun_build_skb drivers/net/tun.c:1707 [inline] tun_get_user+0x1cb8/0x3d30 drivers/net/tun.c:1831 tun_chr_write_iter+0x119/0x200 drivers/net/tun.c:2066 call_write_iter include/linux/fs.h:2019 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x474/0x9a0 fs/read_write.c:584 ksys_write+0x151/0x260 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 Freed by task 20863: kasan_save_stack mm/kasan/common.c:46 [inline] kasan_set_track+0x4e/0x70 mm/kasan/common.c:53 kasan_save_free_info+0x28/0x40 mm/kasan/generic.c:522 ____kasan_slab_free+0x126/0x1f0 mm/kasan/common.c:237 kasan_slab_free include/linux/kasan.h:164 [inline] slab_free_hook mm/slub.c:1833 [inline] slab_free_freelist_hook+0x154/0x240 mm/slub.c:1859 slab_free mm/slub.c:3853 [inline] kmem_cache_free+0xf8/0x290 mm/slub.c:3875 NF_DROP_REASON include/linux/netfilter.h:30 [inline] nft_do_chain+0x14d9/0x16d0 net/netfilter/nf_tables_core.c:-1 nft_nat_do_chain+0x29b/0x380 net/netfilter/nft_chain_nat.c:32 nf_nat_inet_fn+0x5dd/0xb20 net/netfilter/nf_nat_core.c:958 nf_nat_ipv6_fn+0x227/0x2e0 net/netfilter/nf_nat_proto.c:937 nf_nat_ipv6_in+0xf1/0x2c0 net/netfilter/nf_nat_proto.c:947 nf_hook_entry_hookfn include/linux/netfilter.h:156 [inline] nf_hook_slow+0xb9/0x210 net/netfilter/core.c:626 nf_hook include/linux/netfilter.h:271 [inline] NF_HOOK include/linux/netfilter.h:314 [inline] br_nf_pre_routing_ipv6+0x55b/0x6a0 net/bridge/br_netfilter_ipv6.c:184 nf_hook_entry_hookfn include/linux/netfilter.h:156 [inline] nf_hook_bridge_pre net/bridge/br_input.c:277 [inline] br_handle_frame+0x12fa/0x15b0 net/bridge/br_input.c:433 __netif_receive_skb_core+0xf94/0x3ac0 net/core/dev.c:5604 __netif_receive_skb_one_core net/core/dev.c:5708 [inline] __netif_receive_skb+0x74/0x290 net/core/dev.c:5824 netif_receive_skb_internal net/core/dev.c:5910 [inline] netif_receive_skb+0x1bc/0x720 net/core/dev.c:5969 tun_rx_batched+0x1df/0x790 drivers/net/tun.c:1561 tun_get_user+0x286c/0x3d30 drivers/net/tun.c:2020 tun_chr_write_iter+0x119/0x200 drivers/net/tun.c:2066 call_write_iter include/linux/fs.h:2019 [inline] new_sync_write fs/read_write.c:491 [inline] vfs_write+0x474/0x9a0 fs/read_write.c:584 ksys_write+0x151/0x260 fs/read_write.c:637 do_syscall_x64 arch/x86/entry/common.c:46 [inline] do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:76 entry_SYSCALL_64_after_hwframe+0x68/0xd2 The buggy address belongs to the object at ffff88804965c3c0 which belongs to the cache skbuff_head_cache of size 240 The buggy address is located 208 bytes inside of freed 240-byte region [ffff88804965c3c0, ffff88804965c4b0) The buggy address belongs to the physical page: page:ffffea0001259700 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4965c memcg:ffff8880245fad01 anon flags: 0xfff00000000800(slab|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 00fff00000000800 ffff888141a5a000 ffffea0001c80480 dead000000000005 raw: 0000000000000000 00000000800c000c 00000001ffffffff ffff8880245fad01 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x132820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_MEMALLOC|__GFP_HARDWALL), pid 18296, tgid 18289 (syz.3.2974), ts 1678899067652, free_ts 1678533506757 set_page_owner include/linux/page_owner.h:31 [inline] post_alloc_hook+0x1c1/0x200 mm/page_alloc.c:1582 prep_new_page mm/page_alloc.c:1589 [inline] get_page_from_freelist+0x2181/0x22a0 mm/page_alloc.c:3221 __alloc_pages+0x1f0/0x460 mm/page_alloc.c:4501 alloc_slab_page+0x5d/0x180 mm/slub.c:1903 allocate_slab mm/slub.c:2050 [inline] new_slab+0x87/0x2d0 mm/slub.c:2103 ___slab_alloc+0xc5c/0x12f0 mm/slub.c:3275 __slab_alloc mm/slub.c:3361 [inline] __slab_alloc_node mm/slub.c:3414 [inline] slab_alloc_node mm/slub.c:3508 [inline] kmem_cache_alloc_node+0x12e/0x320 mm/slub.c:3563 __alloc_skb+0x103/0x2c0 net/core/skbuff.c:643 __netdev_alloc_skb+0x10c/0x500 net/core/skbuff.c:717 netdev_alloc_skb include/linux/skbuff.h:3312 [inline] dev_alloc_skb include/linux/skbuff.h:3325 [inline] __ieee80211_beacon_get+0xd5d/0x1520 net/mac80211/tx.c:5551 ieee80211_beacon_get_tim+0xbf/0x580 net/mac80211/tx.c:5673 ieee80211_beacon_get include/net/mac80211.h:5447 [inline] mac80211_hwsim_beacon_tx+0x3bd/0x770 drivers/net/wireless/virtual/mac80211_hwsim.c:2271 __iterate_interfaces+0x225/0x4c0 net/mac80211/util.c:766 ieee80211_iterate_active_interfaces_atomic+0xdb/0x180 net/mac80211/util.c:802 mac80211_hwsim_beacon+0xbb/0x1b0 drivers/net/wireless/virtual/mac80211_hwsim.c:2301 __run_hrtimer kernel/time/hrtimer.c:1754 [inline] __hrtimer_run_queues+0x525/0xc10 kernel/time/hrtimer.c:1818 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1182 [inline] free_unref_page_prepare+0x7d7/0x8f0 mm/page_alloc.c:2366 free_unref_page+0x32/0x2e0 mm/page_alloc.c:2459 tlb_batch_list_free mm/mmu_gather.c:115 [inline] tlb_finish_mmu+0x13e/0x220 mm/mmu_gather.c:428 exit_mmap+0x428/0xb90 mm/mmap.c:3323 __mmput+0x118/0x3a0 kernel/fork.c:1365 exit_mm+0x23f/0x340 kernel/exit.c:576 do_exit+0x909/0x2530 kernel/exit.c:877 do_group_exit+0x22d/0x2f0 kernel/exit.c:1032 get_signal+0x12a6/0x1390 kernel/signal.c:2927 arch_do_signal_or_restart+0xc2/0x7b0 arch/x86/kernel/signal.c:310 exit_to_user_mode_loop+0x70/0x110 kernel/entry/common.c:177 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:213 __syscall_exit_to_user_mode_work kernel/entry/common.c:294 [inline] syscall_exit_to_user_mode+0x1a/0x50 kernel/entry/common.c:305 do_syscall_64+0x61/0xb0 arch/x86/entry/common.c:82 entry_SYSCALL_64_after_hwframe+0x68/0xd2 Memory state around the buggy address: ffff88804965c380: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb ffff88804965c400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff88804965c480: fb fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc ^ ffff88804965c500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88804965c580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc ==================================================================