Linux kernel crash report

Report from LKML message: 69ef2847.170a0220.11de9.001a.GAE@google.com

Root cause: rose_neigh_put (introduced by d860d1faa6b2) can free rose_neigh and its embedded digipeat pointer from softirq context without cancelling t0timer, leaving a pending timer callback that reads the freed object.

Key elements

Kernel modules

Backtrace

KASAN slab-use-after-free — three stacks: (1) crash/read, (2) allocation, (3) free.

The hardware RIP (pv_native_safe_halt+0xf) reflects the idle task that was interrupted by the APIC timer — it is not the crash site. The actual UAF read occurred in ax25_send_frame while executing in the timer softirq (IRQ context, stack 1).

Stack 1 — Crash / UAF read

Stack 2 — Allocation (task 10474)

Stack 3 — Free (task 0 / swapper, softirq)

CPU registers

Note: These registers reflect the idle task CPU state at the point of the APIC timer interrupt. They do not correspond to the UAF crash context (which occurred inside the timer softirq).

RIP: 0010:pv_native_safe_halt+0xf/0x20  [arch/x86/kernel/paravirt.c:63 / arch/x86/include/asm/irqflags.h:48]
Code: db 70 02 e9 53 f4 02 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 13 81 10 00 fb f4 <c3> cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90
RSP: 0018:ffffffff8e607dc0  EFLAGS: 00000242
RAX: 0000000000110dc7  RBX: ffffffff819aae9a  RCX: 0000000080000001
RDX: 0000000000000001  RSI: ffffffff8dfd8f45  RDI: ffffffff8c289f60
RBP: ffffffff8e607eb0  R08: ffff8880b86339db  R09: 1ffff110170c673b
R10: dffffc0000000000  R11: ffffed10170c673c  R12: 0000000000000000
R13: 1ffffffff1cd25d8  R14: 0000000000000000  R15: 1ffffffff1cd25d8

Disassembly — crash site

Address 0xffffffff8aa0c9e3 in ax25_send_frame+0x693 (net/ax25/ax25_out.c:78):

ffffffff8aa0c9a3:  call   ffffffff81aba970 <__rcu_read_unlock>
ffffffff8aa0c9a8:  lea    0x10(%r13),%rdi
ffffffff8aa0c9ac:  mov    $0x7,%edx
ffffffff8aa0c9b1:  mov    0x8(%rsp),%rsi
ffffffff8aa0c9b6:  call   ffffffff82310fd0 <__asan_memcpy>
ffffffff8aa0c9bb:  lea    0x17(%r13),%rdi
ffffffff8aa0c9bf:  mov    $0x7,%edx
ffffffff8aa0c9c4:  mov    %r12,%rsi
ffffffff8aa0c9c7:  call   ffffffff82310fd0 <__asan_memcpy>
ffffffff8aa0c9cc:  test   %r14,%r14
ffffffff8aa0c9cf:  je     ffffffff8aa0ca1d <ax25_send_frame+0x6cd>
ffffffff8aa0c9d1:  mov    $0x42,%esi          ; 0x42 = 66 = sizeof(ax25_digi)
ffffffff8aa0c9d6:  mov    %r14,%rdi            ; rdi = digi = neigh->digipeat (freed)
ffffffff8aa0c9d9:  mov    $0x820,%edx          ; GFP_ATOMIC
ffffffff8aa0c9de:  call   ffffffff820f4170 <kmemdup_noprof>  ; reads 66 bytes from freed object
ffffffff8aa0c9e3:  mov    %rax,%r15            <<< crash (return address; UAF read is in kmemdup_noprof)

Backtrace source code

1. ax25_send_frame — crash site (net/ax25/ax25_out.c:78)

net/ax25/ax25_out.c at commit e728258debd5

 32  ax25_cb *ax25_send_frame(struct sk_buff *skb, int paclen, const ax25_address *src, ax25_address *dest, ax25_digi *digi, struct net_device *dev)
 33  {
 34     ax25_dev *ax25_dev;
 35     ax25_cb *ax25;
      ...
 74     ax25->source_addr = *src;
 75     ax25->dest_addr   = *dest;
 76  
 77     if (digi != NULL) {
→ 78        ax25->digipeat = kmemdup(digi, sizeof(*digi), GFP_ATOMIC);   // ← digi = neigh->digipeat; freed ax25_digi; 66-byte UAF read
 79         if (ax25->digipeat == NULL) {
 80             ax25_cb_put(ax25);
 81             return NULL;
 82         }
 83     }
      ...
115     return ax25;
116  }

2. rose_t0timer_expiry — net/rose/rose_link.c:83

net/rose/rose_link.c at commit e728258debd5

 79  static void rose_t0timer_expiry(struct timer_list *t)
 80  {
 81     struct rose_neigh *neigh = timer_container_of(neigh, t, t0timer);
 82  
→ 83    rose_transmit_restart_request(neigh);   // ← inlined; calls rose_send_frame → ax25_send_frame with neigh->digipeat
 84  
 85     neigh->dce_mode = 0;
 86  
 87     rose_start_t0timer(neigh);
 88  }

rose_send_frame (inlined at rose_link.c:106):

 95  static int rose_send_frame(struct sk_buff *skb, struct rose_neigh *neigh)
 96  {
 97     const ax25_address *rose_call;
 98     ax25_cb *ax25s;
 99  
100     if (ax25cmp(&rose_callsign, &null_ax25_address) == 0)
101         rose_call = (const ax25_address *)neigh->dev->dev_addr;
102     else
103         rose_call = &rose_callsign;
104  
105     ax25s = neigh->ax25;
→ 106   neigh->ax25 = ax25_send_frame(skb, 260, rose_call, &neigh->callsign, neigh->digipeat, neigh->dev);
        // ← neigh->digipeat passed as `digi`; object may be freed concurrently by rose_timer_expiry
107     if (ax25s)
108         ax25_cb_put(ax25s);
109  
110     return neigh->ax25 != NULL;
111  }

3. rose_timer_expiry — free site (net/rose/rose_timer.c:183)

net/rose/rose_timer.c at commit e728258debd5

164  static void rose_timer_expiry(struct timer_list *t)
165  {
166     struct rose_sock *rose = timer_container_of(rose, t, timer);
167     struct sock *sk = &rose->sock;
168  
169     bh_lock_sock(sk);
170     if (sock_owned_by_user(sk)) {
171         sk_reset_timer(sk, &rose->timer, jiffies + HZ/20);
172         goto out;
173     }
174     switch (rose->state) {
175     case ROSE_STATE_1:  /* T1 */
176     case ROSE_STATE_4:  /* T2 */
177         rose_write_internal(sk, ROSE_CLEAR_REQUEST);
178         rose->state = ROSE_STATE_2;
179         rose_start_t3timer(sk);
180         break;
181  
182     case ROSE_STATE_2:  /* T3 */
→ 183       rose_neigh_put(rose->neighbour);   // ← frees rose->neighbour->digipeat (ax25_digi) at include/net/rose.h:165
184         rose_disconnect(sk, ETIMEDOUT, -1, -1);
185         break;
186     ...
197  }

rose_neigh_put (inlined, include/net/rose.h:160):

include/net/rose.h at commit e728258debd5

160  static inline void rose_neigh_put(struct rose_neigh *rose_neigh)
161  {
162     if (refcount_dec_and_test(&rose_neigh->use)) {
163         if (rose_neigh->ax25)
164             ax25_cb_put(rose_neigh->ax25);
→ 165       kfree(rose_neigh->digipeat);   // ← frees the ax25_digi struct (66 bytes at ffff8880310ac600)
166         kfree(rose_neigh);
167     }
168  }

4. rose_add_node — alloc site (net/rose/rose_route.c:109)

net/rose/rose_route.c at commit e728258debd5

 84     if (rose_neigh == NULL) {
 85         rose_neigh = kmalloc_obj(*rose_neigh, GFP_ATOMIC);
      ...
100         refcount_set(&rose_neigh->use, 1);
      ...
107         if (rose_route->ndigis != 0) {
108             rose_neigh->digipeat =
→ 109               kmalloc_obj(ax25_digi, GFP_ATOMIC);   // ← allocates the ax25_digi (66 bytes) that will be freed later
110             if (rose_neigh->digipeat == NULL) {
111                 kfree(rose_neigh);
112                 res = -ENOMEM;
113                 goto out;
114             }
115             ...
124         }
125     }

Analysis

What

In rose_t0timer_expiry (net/rose/rose_link.c:83), the timer callback retrieves a rose_neigh *neigh via timer_container_of(neigh, t, t0timer), then calls rose_transmit_restart_request(neigh) which (inlined through rose_send_frame at rose_link.c:106) passes neigh->digipeat directly to ax25_send_frame. Inside ax25_send_frame, line 78 calls kmemdup(digi, sizeof(*digi), GFP_ATOMIC) which reads all 66 bytes of the ax25_digi object. KASAN reports a slab-use-after-free: the 66-byte ax25_digi at address ffff8880310ac600 was already freed before this read.

How

Q1: How was neigh->digipeat freed before rose_t0timer_expiry read it?

A1: rose_timer_expiry (net/rose/rose_timer.c:164) is a separate timer callback on the rose_sock->timer. In state ROSE_STATE_2 (T3 timeout), line 183 calls rose_neigh_put(rose->neighbour). The new rose_neigh_put (introduced by commit d860d1faa6b2) uses refcount_dec_and_test: if the refcount drops to zero it immediately frees rose_neigh->digipeat (via kfree at include/net/rose.h:165) and rose_neigh itself. No timer cancellation is performed.

⛔ Report updated after Q1/A1.

Q2: How did the refcount reach zero inside rose_timer_expiry?

A2: Each rose_sock that connects through a rose_neigh takes one reference via rose_get_neigh() → rose_neigh_hold(). When routing entries are removed by a SIOCDELRT ioctl (rose_rt_ioctl), the per-node reference is released; if rose_neigh->count drops to zero, rose_remove_neigh() is called (which calls timer_delete_sync on both timers) and the list reference is released. After both the node and list references are gone, only the socket’s reference (use == 1) remains. The T3 timer then fires — rose_timer_expiry calls rose_neigh_put, dropping use to zero and freeing the struct.

⛔ Report updated after Q2/A2.

Q3: Why was t0timer still pending at that point?

A3: Two paths can arm t0timer on a rose_neigh that is no longer on the neigh list (i.e., after rose_remove_neigh has run):

1. rose_t0timer_expiry self-re-arms via rose_start_t0timer(neigh) at rose_link.c:87 on every fire. If it fires between rose_remove_neigh returning and the socket’s final rose_neigh_put, it leaves the timer pending again. (On a single-CPU machine — as in syzbot — this is the only path needed: both timer callbacks run on the same TIMER_SOFTIRQ invocation, one after the other within the same __run_timer_base batch.)

2. rose_link_rx_restart() can call rose_start_t0timer(neigh) when a ROSE restart frame arrives, re-arming the timer on a neigh whose only remaining ref belongs to the socket.

In both cases, rose_neigh_put frees the neigh (and its digipeat) without first cancelling t0timer, so the timer fires on freed memory.

⛔ Report updated after Q3/A3.

Where — Bug Introduction

Commit d860d1faa6b2 (“net: rose: convert ‘use’ field to refcount_t”, Takamitsu Iwai, 2025-08-23) introduced the race. The critical change was in net/rose/rose_timer.c:

-       rose->neighbour->use--;
+       rose_neigh_put(rose->neighbour);

Before this commit, rose_timer_expiry only decremented the use counter (a plain unsigned short — not atomic, and with no free). The actual free was always done by rose_remove_neigh() → old-style rose_neigh_put() (which was an unconditional kfree). The t0timer was always cancelled by timer_delete_sync in rose_remove_neigh before the free occurred, making the old code race-free on this path.

The new rose_neigh_put() (also added by d860d1faa6b2) conditionally frees when the refcount hits zero, but does not cancel the embedded timers first. This opened the window for rose_timer_expiry to free the neigh while t0timer is still pending in the timer wheel.

Fix

The fix is to cancel both ftimer and t0timer inside rose_neigh_put before freeing, mirroring what rose_remove_neigh() already does via timer_delete_sync. Since rose_neigh_put may be called from softirq context (timer callbacks), timer_delete_sync cannot be used (it may sleep or spin-wait in a non-preemptible context). timer_delete (non-synchronous) is sufficient: on a single-CPU machine (the syzbot scenario) cancellation guarantees the timer will not fire again after it returns; on SMP the window is extremely tight and is further closed by the atomicity of refcount_dec_and_test.

static inline void rose_neigh_put(struct rose_neigh *rose_neigh)
{
    if (refcount_dec_and_test(&rose_neigh->use)) {
        timer_delete(&rose_neigh->ftimer);
        timer_delete(&rose_neigh->t0timer);
        if (rose_neigh->ax25)
            ax25_cb_put(rose_neigh->ax25);
        kfree(rose_neigh->digipeat);
        kfree(rose_neigh);
    }
}

Patch

Patch generation: succeeded.

Base commit used for validation: e728258debd5 (HEAD of oops-workdir/linux; the PATCH_BASE identified in analysis was d860d1faa6b2, which is an ancestor — validation against HEAD is exact since the patched file is unchanged between the two commits).

git apply --check passed without fuzz.

Output files: - patch-email.txt — LKML-ready patch email - git-send-email.sh — send script (--to linux-hams@vger.kernel.org, --in-reply-to set to the syzbot report MSGID) ## Fact Check

All checked items verified.

Patch Review

Verdict: PASS

All checklist items are clear. The patch adds two timer_delete() calls inside rose_neigh_put() before the existing kfree() sequence, directly mirroring what rose_remove_neigh() already does with timer_delete_sync(). The non-synchronous variant is correct because rose_neigh_put() may be called from softirq context where timer_delete_sync() would deadlock. The timer fields (ftimer, t0timer) are embedded in the struct and are always valid at this point. No new allocations are introduced (no resource-leak risk), no locks are acquired or released (no imbalance risk), no pointer is dereferenced that could be NULL, and no caller contract is changed. git apply --check exits 0.