linux-kernel - Re: [syzbot] [ocfs2?] KASAN: slab-use-after-free Read in ocfs2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Message-ID: <6901fbe7.050a0220.3344a1.041d.GAE@google.com>
Date: Wed, 29 Oct 2025 04:35:03 -0700
From: syzbot <syzbot+a49010a0e8fcdeea075f@...kaller.appspotmail.com>
To: dmantipov@...dex.ru, linux-kernel@...r.kernel.org, 
	syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] [ocfs2?] KASAN: slab-use-after-free Read in ocfs2_fault

Hello,

syzbot has tested the proposed patch but the reproducer is still triggering an issue:
UBSAN: signed-integer-overflow in ip_idents_reserve

================================================================================
UBSAN: signed-integer-overflow in ./arch/x86/include/asm/atomic.h:165:11
1495198172 + 1093622763 cannot be represented in type 'int'
CPU: 0 PID: 7104 Comm: syz-executor Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025
Call Trace:
 <IRQ>
 dump_stack+0xfd/0x16e lib/dump_stack.c:118
 ubsan_epilogue+0xa/0x30 lib/ubsan.c:148
 handle_overflow+0x192/0x1b0 lib/ubsan.c:180
 arch_atomic_add_return arch/x86/include/asm/atomic.h:165 [inline]
 atomic_add_return include/asm-generic/atomic-instrumented.h:73 [inline]
 ip_idents_reserve+0x14a/0x170 net/ipv4/route.c:521
 __ip_select_ident+0xe4/0x1c0 net/ipv4/route.c:538
 iptunnel_xmit+0x466/0x7b0 net/ipv4/ip_tunnel_core.c:80
 udp_tunnel_xmit_skb+0x1ba/0x290 net/ipv4/udp_tunnel_core.c:190
 geneve_xmit_skb drivers/net/geneve.c:1004 [inline]
 geneve_xmit+0x1d05/0x2140 drivers/net/geneve.c:1117
 __netdev_start_xmit include/linux/netdevice.h:4824 [inline]
 netdev_start_xmit include/linux/netdevice.h:4838 [inline]
 xmit_one net/core/dev.c:3601 [inline]
 dev_hard_start_xmit+0x294/0x780 net/core/dev.c:3617
 __dev_queue_xmit+0x1678/0x28b0 net/core/dev.c:4203
 neigh_output include/net/neighbour.h:509 [inline]
 ip6_finish_output2+0x1020/0x1490 net/ipv6/ip6_output.c:130
 NF_HOOK+0x45/0x2c0 include/linux/netfilter.h:297
 mld_sendpack+0x5f9/0xa70 net/ipv6/mcast.c:1676
 mld_send_cr net/ipv6/mcast.c:1972 [inline]
 mld_ifc_timer_expire+0x7e1/0x990 net/ipv6/mcast.c:2471
 call_timer_fn+0x105/0x440 kernel/time/timer.c:1444
 expire_timers kernel/time/timer.c:1489 [inline]
 __run_timers+0x5d8/0x7a0 kernel/time/timer.c:1783
 run_timer_softirq+0x19/0x30 kernel/time/timer.c:1796
 __do_softirq+0x23c/0x8ae kernel/softirq.c:298
 asm_call_irq_on_stack+0xf/0x20
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0x6d/0xb0 arch/x86/kernel/irq_64.c:77
 do_softirq+0xa9/0xf0 kernel/softirq.c:343
 __local_bh_enable_ip+0x10e/0x170 kernel/softirq.c:195
 spin_unlock_bh include/linux/spinlock.h:399 [inline]
 netif_addr_unlock_bh include/linux/netdevice.h:4425 [inline]
 dev_uc_add+0xbe/0x110 net/core/dev_addr_lists.c:593
 vlan_dev_set_mac_address+0x1b3/0x530 net/8021q/vlan_dev.c:322
 dev_set_mac_address+0x1d4/0x330 net/core/dev.c:8784
 dev_set_mac_address_user+0x2d/0x50 net/core/dev.c:8802
 do_setlink+0x6c2/0x39b0 net/core/rtnetlink.c:2687
 __rtnl_newlink net/core/rtnetlink.c:3410 [inline]
 rtnl_newlink+0x1195/0x1530 net/core/rtnetlink.c:3530
 rtnetlink_rcv_msg+0x9b8/0xe40 net/core/rtnetlink.c:5610
 netlink_rcv_skb+0x187/0x390 net/netlink/af_netlink.c:2503
 netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
 netlink_unicast+0x7b7/0x9b0 net/netlink/af_netlink.c:1340
 netlink_sendmsg+0x968/0xb50 net/netlink/af_netlink.c:1914
 sock_sendmsg_nosec net/socket.c:651 [inline]
 __sock_sendmsg+0x15c/0x170 net/socket.c:663
 __sys_sendto+0x323/0x430 net/socket.c:2005
 __do_sys_sendto net/socket.c:2017 [inline]
 __se_sys_sendto net/socket.c:2013 [inline]
 __x64_sys_sendto+0xda/0xf0 net/socket.c:2013
 do_syscall_64+0x34/0x50 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x67/0xd1
RIP: 0033:0x7fab23a02a3c
Code: 2a 5f 02 00 44 8b 4c 24 2c 4c 8b 44 24 20 89 c5 44 8b 54 24 28 48 8b 54 24 18 b8 2c 00 00 00 48 8b 74 24 10 8b 7c 24 08 0f 05 <48> 3d 00 f0 ff ff 77 34 89 ef 48 89 44 24 08 e8 70 5f 02 00 48 8b
RSP: 002b:00007ffdf0a7a370 EFLAGS: 00000293 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007fab24776620 RCX: 00007fab23a02a3c
RDX: 000000000000002c RSI: 00007fab24776670 RDI: 0000000000000003
RBP: 0000000000000000 R08: 00007ffdf0a7a3c4 R09: 000000000000000c
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000003
R13: 0000000000000000 R14: 00007fab24776670 R15: 0000000000000000
================================================================================


Tested on:

commit:         d3d0b4e2 Linux 5.10.245
git tree:       https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git linux-5.10.y
console output: https://syzkaller.appspot.com/x/log.txt?x=138c4fe2580000
kernel config:  https://syzkaller.appspot.com/x/.config?x=39182a54870857eb
dashboard link: https://syzkaller.appspot.com/bug?extid=a49010a0e8fcdeea075f
compiler:       Debian clang version 20.1.8 (++20250708063551+0c9f909b7976-1~exp1~20250708183702.136), Debian LLD 20.1.8
patch:          https://syzkaller.appspot.com/x/patch.diff?x=14d89c92580000