==================================================================
BUG: KASAN: slab-use-after-free in xfrm_state_find+0x35b8/0x4510 net/xfrm/xfrm_state.c:1357
Read of size 1 at addr ffff8880613ff2f8 by task syz.6.4950/26652

CPU: 0 PID: 26652 Comm: syz.6.4950 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025
Call Trace:
 <TASK>
 dump_stack_lvl+0x16c/0x230 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:364 [inline]
 print_report+0xac/0x220 mm/kasan/report.c:468
 kasan_report+0x117/0x150 mm/kasan/report.c:581
 xfrm_state_find+0x35b8/0x4510 net/xfrm/xfrm_state.c:1357
 xfrm_tmpl_resolve_one net/xfrm/xfrm_policy.c:2502 [inline]
 xfrm_tmpl_resolve net/xfrm/xfrm_policy.c:2547 [inline]
 xfrm_resolve_and_create_bundle+0x727/0x2c20 net/xfrm/xfrm_policy.c:2841
 xfrm_bundle_lookup net/xfrm/xfrm_policy.c:3076 [inline]
 xfrm_lookup_with_ifid+0x556/0x19c0 net/xfrm/xfrm_policy.c:3207
 xfrm_lookup net/xfrm/xfrm_policy.c:3304 [inline]
 xfrm_lookup_route+0x3c/0x1b0 net/xfrm/xfrm_policy.c:3315
 sctp_v6_get_dst+0x6b0/0x1b90 net/sctp/ipv6.c:327
 sctp_transport_route+0x10b/0x2c0 net/sctp/transport.c:457
 sctp_assoc_add_peer+0x650/0x13a0 net/sctp/associola.c:663
 sctp_connect_new_asoc+0x304/0x690 net/sctp/socket.c:1099
 sctp_sendmsg_new_asoc net/sctp/socket.c:1693 [inline]
 sctp_sendmsg+0x155c/0x27e0 net/sctp/socket.c:2004
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg net/socket.c:745 [inline]
 ____sys_sendmsg+0x5bf/0x950 net/socket.c:2595
 ___sys_sendmsg+0x220/0x290 net/socket.c:2649
 __sys_sendmmsg+0x275/0x4a0 net/socket.c:2735
 __do_sys_sendmmsg net/socket.c:2764 [inline]
 __se_sys_sendmmsg net/socket.c:2761 [inline]
 __x64_sys_sendmmsg+0xa0/0xb0 net/socket.c:2761
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2
RIP: 0033:0x7ffb8c78eec9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffb8d607038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 00007ffb8c9e6180 RCX: 00007ffb8c78eec9
RDX: 0000000000000001 RSI: 0000200000000a80 RDI: 0000000000000004
RBP: 00007ffb8c811f91 R08: 0000000000000000 R09: 0000000000000000
R10: 000000000004c040 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffb8c9e6218 R14: 00007ffb8c9e6180 R15: 00007ffd4898af18
 </TASK>

Allocated by task 25448:
 kasan_save_stack mm/kasan/common.c:45 [inline]
 kasan_set_track+0x4e/0x70 mm/kasan/common.c:52
 __kasan_slab_alloc+0x6c/0x80 mm/kasan/common.c:328
 kasan_slab_alloc include/linux/kasan.h:188 [inline]
 slab_post_alloc_hook+0x6e/0x4d0 mm/slab.h:767
 slab_alloc_node mm/slub.c:3495 [inline]
 slab_alloc mm/slub.c:3503 [inline]
 __kmem_cache_alloc_lru mm/slub.c:3510 [inline]
 kmem_cache_alloc+0x11e/0x2e0 mm/slub.c:3519
 kmem_cache_zalloc include/linux/slab.h:711 [inline]
 xfrm_state_alloc+0x22/0x2a0 net/xfrm/xfrm_state.c:661
 xfrm_state_find+0x2944/0x4510 net/xfrm/xfrm_state.c:1303
 xfrm_tmpl_resolve_one net/xfrm/xfrm_policy.c:2502 [inline]
 xfrm_tmpl_resolve net/xfrm/xfrm_policy.c:2547 [inline]
 xfrm_resolve_and_create_bundle+0x727/0x2c20 net/xfrm/xfrm_policy.c:2841
 xfrm_bundle_lookup net/xfrm/xfrm_policy.c:3076 [inline]
 xfrm_lookup_with_ifid+0x556/0x19c0 net/xfrm/xfrm_policy.c:3207
 xfrm_lookup net/xfrm/xfrm_policy.c:3304 [inline]
 xfrm_lookup_route+0x3c/0x1b0 net/xfrm/xfrm_policy.c:3315
 sctp_v6_get_dst+0xeb9/0x1b90 net/sctp/ipv6.c:385
 sctp_transport_route+0x10b/0x2c0 net/sctp/transport.c:457
 sctp_assoc_add_peer+0x650/0x13a0 net/sctp/associola.c:663
 sctp_connect_new_asoc+0x304/0x690 net/sctp/socket.c:1099
 sctp_sendmsg_new_asoc net/sctp/socket.c:1693 [inline]
 sctp_sendmsg+0x155c/0x27e0 net/sctp/socket.c:2004
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg net/socket.c:745 [inline]
 ____sys_sendmsg+0x5bf/0x950 net/socket.c:2595
 ___sys_sendmsg+0x220/0x290 net/socket.c:2649
 __sys_sendmmsg+0x275/0x4a0 net/socket.c:2735
 __do_sys_sendmmsg net/socket.c:2764 [inline]
 __se_sys_sendmmsg net/socket.c:2761 [inline]
 __x64_sys_sendmmsg+0xa0/0xb0 net/socket.c:2761
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_64+0x55/0xb0 arch/x86/entry/common.c:81
 entry_SYSCALL_64_after_hwframe+0x68/0xd2

The buggy address belongs to the object at ffff8880613ff000
 which belongs to the cache xfrm_state of size 848
The buggy address is located 760 bytes inside of
 freed 848-byte region [ffff8880613ff000, ffff8880613ff350)

The buggy address belongs to the physical page:
page:ffffea000184ff00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff8880613ffc00 pfn:0x613fc
head:ffffea000184ff00 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000840(slab|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000840 ffff888141298000 ffffea0001747d10 ffffea0001744610
raw: ffff8880613ffc00 0000000000100001 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x152820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 6915, tgid 6907 (syz.3.259), ts 202076300841, free_ts 156603579960
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x1cd/0x210 mm/page_alloc.c:1554
 prep_new_page mm/page_alloc.c:1561 [inline]
 get_page_from_freelist+0x195c/0x19f0 mm/page_alloc.c:3191
 __alloc_pages+0x1e3/0x460 mm/page_alloc.c:4457
 alloc_slab_page+0x5d/0x170 mm/slub.c:1881
 allocate_slab mm/slub.c:2028 [inline]
 new_slab+0x87/0x2e0 mm/slub.c:2081
 ___slab_alloc+0xc6d/0x1300 mm/slub.c:3253
 __slab_alloc mm/slub.c:3339 [inline]
 __slab_alloc_node mm/slub.c:3392 [inline]
 slab_alloc_node mm/slub.c:3485 [inline]
 slab_alloc mm/slub.c:3503 [inline]
 __kmem_cache_alloc_lru mm/slub.c:3510 [inline]
 kmem_cache_alloc+0x1b7/0x2e0 mm/slub.c:3519
 kmem_cache_zalloc include/linux/slab.h:711 [inline]
 xfrm_state_alloc+0x22/0x2a0 net/xfrm/xfrm_state.c:661
 xfrm_state_find+0x2944/0x4510 net/xfrm/xfrm_state.c:1303
 xfrm_tmpl_resolve_one net/xfrm/xfrm_policy.c:2502 [inline]
 xfrm_tmpl_resolve net/xfrm/xfrm_policy.c:2547 [inline]
 xfrm_resolve_and_create_bundle+0x727/0x2c20 net/xfrm/xfrm_policy.c:2841
 xfrm_lookup_with_ifid+0x261/0x19c0 net/xfrm/xfrm_policy.c:3175
 xfrm_lookup net/xfrm/xfrm_policy.c:3304 [inline]
 xfrm_lookup_route+0x3c/0x1b0 net/xfrm/xfrm_policy.c:3315
 udp_sendmsg+0x15cf/0x2380 net/ipv4/udp.c:1236
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg net/socket.c:745 [inline]
 ____sys_sendmsg+0x5bf/0x950 net/socket.c:2595
 ___sys_sendmsg+0x220/0x290 net/socket.c:2649
 __sys_sendmmsg+0x275/0x4a0 net/socket.c:2735
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1154 [inline]
 free_unref_page_prepare+0x7ce/0x8e0 mm/page_alloc.c:2336
 free_unref_page+0x32/0x2e0 mm/page_alloc.c:2429
 rcu_do_batch kernel/rcu/tree.c:2194 [inline]
 rcu_core+0xcc4/0x1720 kernel/rcu/tree.c:2467
 handle_softirqs+0x280/0x820 kernel/softirq.c:578
 run_ksoftirqd+0x9c/0xf0 kernel/softirq.c:950
 smpboot_thread_fn+0x635/0xa00 kernel/smpboot.c:164
 kthread+0x2fa/0x390 kernel/kthread.c:388
 ret_from_fork+0x48/0x80 arch/x86/kernel/process.c:152
 ret_from_fork_asm+0x11/0x20 arch/x86/entry/entry_64.S:293

Memory state around the buggy address:
 ffff8880613ff180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8880613ff200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8880613ff280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                                ^
 ffff8880613ff300: fb fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc
 ffff8880613ff380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================