Re: [BUG] net: ipv6: KASAN: slab-use-after-free in ip6gre_tunnel_xmit
From: Eric Dumazet <edumazet@google.com>
Date: 2026-08-19 07:32:36
Also in:
lkml
Subsystem:
networking [general], networking [ipv4/ipv6], the rest · Maintainers:
"David S. Miller", Eric Dumazet, Jakub Kicinski, Paolo Abeni, David Ahern, Ido Schimmel, Linus Torvalds
On Wed, Aug 19, 2026 at 8:23 AM Shuangpeng Bai [off-list ref] wrote:
Hi Kernel Maintainers, I hit the following report while testing current upstream kernel: KASAN: slab-use-after-free in ip6gre_tunnel_xmit on commit: bd5f485f3f026225b86573e559af0b7254ef4184 (2026-08-18) The reproducer and .config files are here. https://gist.github.com/shuangpengbai/63aa087b3e843c7a4e98a42c0f130aeb I'm happy to test debug patches or provide additional information.
Hi Shuandpeng Thanks for the report, could you test the following for me?
diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 200d0ba1a40e71a4245f1b153dc30691e773f8c7..678678fcb5da395f8b1c8243562efe8addbda2ee100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c@@ -878,6 +878,7 @@ static int ip6gre_xmit_other(struct sk_buff *skb,struct net_device *dev)
static netdev_tx_t ip6gre_tunnel_xmit(struct sk_buff *skb,
struct net_device *dev)
{
+ struct ip_tunnel_info *tun_info = NULL;
struct ip6_tnl *t = netdev_priv(dev);
__be16 payload_protocol;
int ret;@@ -888,6 +889,9 @@ static netdev_tx_t ip6gre_tunnel_xmit(struct sk_buff *skb, if (!ip6_tnl_xmit_ctl(t, &t->parms.laddr, &t->parms.raddr)) goto tx_err; + if (t->parms.collect_md) + tun_info = skb_tunnel_info_txcheck(skb); + payload_protocol = skb_protocol(skb, true); switch (payload_protocol) { case htons(ETH_P_IP):
@@ -907,7 +911,7 @@ static netdev_tx_t ip6gre_tunnel_xmit(struct sk_buff *skb, return NETDEV_TX_OK; tx_err: - if (!t->parms.collect_md || !IS_ERR(skb_tunnel_info_txcheck(skb))) + if (!IS_ERR(tun_info)) DEV_STATS_INC(dev, tx_errors); DEV_STATS_INC(dev, tx_dropped); kfree_skb(skb);