KASAN: slab-use-after-free Read in decode_session6

**【缺陷描述】：请补充详细的缺陷问题现象描述**
==================================================================
BUG: KASAN: slab-use-after-free in decode_session6+0xf74/0x1198 net/xfrm/xfrm_policy.c:3491
Read of size 1 at addr ffff0000cd1dcae0 by task syz.7.5831/139108

CPU: 0 PID: 139108 Comm: syz.7.5831 Not tainted 6.6.0+ #14
Hardware name: linux,dummy-virt (DT)
Call trace:
 dump_backtrace+0x12c/0x220 arch/arm64/kernel/stacktrace.c:233
 show_stack+0x34/0x50 arch/arm64/kernel/stacktrace.c:240
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x80/0x118 lib/dump_stack.c:106
 print_address_description.constprop.0+0x84/0x3c8 mm/kasan/report.c:364
 print_report+0xb0/0x280 mm/kasan/report.c:475
 kasan_report+0x84/0xd0 mm/kasan/report.c:588
 __asan_report_load1_noabort+0x20/0x30 mm/kasan/report_generic.c:378
 decode_session6+0xf74/0x1198 net/xfrm/xfrm_policy.c:3491
 __xfrm_decode_session+0x78/0xf8 net/xfrm/xfrm_policy.c:3597
 xfrm_decode_session_reverse include/net/xfrm.h:1257 [inline]
 icmpv6_route_lookup+0x30c/0x498 net/ipv6/icmp.c:392
 icmp6_send+0x94c/0x1af8 net/ipv6/icmp.c:601
 __icmpv6_send include/linux/icmpv6.h:28 [inline]
 icmpv6_send include/linux/icmpv6.h:49 [inline]
 ip6_link_failure+0x3c/0x1b0 net/ipv6/route.c:2791
 dst_link_failure include/net/dst.h:447 [inline]
 ip6_tnl_xmit+0x3cc/0x2778 net/ipv6/ip6_tunnel.c:1283
 ipxip6_tnl_xmit net/ipv6/ip6_tunnel.c:1399 [inline]
 ip6_tnl_start_xmit+0x774/0x1138 net/ipv6/ip6_tunnel.c:1447
 __netdev_start_xmit include/linux/netdevice.h:4965 [inline]
 netdev_start_xmit include/linux/netdevice.h:4979 [inline]
 xmit_one.constprop.0+0x114/0x3c0 net/core/dev.c:3580
 dev_hard_start_xmit+0xb0/0x180 net/core/dev.c:3596
 sch_direct_xmit+0x17c/0x1088 net/sched/sch_generic.c:342
 qdisc_restart net/sched/sch_generic.c:407 [inline]
 __qdisc_run+0x1a4/0x358 net/sched/sch_generic.c:415
 __dev_xmit_skb net/core/dev.c:3886 [inline]
 __dev_queue_xmit+0x156c/0x3380 net/core/dev.c:4358
 dev_queue_xmit include/linux/netdevice.h:3146 [inline]
 neigh_connected_output+0x2e8/0x3e0 net/core/neighbour.c:1592
 neigh_output include/net/neighbour.h:553 [inline]
 ip6_finish_output2+0xb58/0x17b0 net/ipv6/ip6_output.c:141
 ip6_fragment+0x1778/0x1d70 net/ipv6/ip6_output.c:962
 __ip6_finish_output+0x61c/0x9f0 net/ipv6/ip6_output.c:206
 ip6_finish_output+0x48/0x2d8 net/ipv6/ip6_output.c:219
 NF_HOOK_COND include/linux/netfilter.h:297 [inline]
 ip6_output+0x1cc/0x3a0 net/ipv6/ip6_output.c:240
 dst_output include/net/dst.h:468 [inline]
 ip6_local_out+0xa4/0xe0 net/ipv6/output_core.c:155
 ip6_send_skb+0x88/0x1f0 net/ipv6/ip6_output.c:2038
 udp_v6_send_skb+0xa7c/0x10b8 net/ipv6/udp.c:1295
 udpv6_sendmsg+0x1b04/0x2320 net/ipv6/udp.c:1591
 inet6_sendmsg+0xb0/0x110 net/ipv6/af_inet6.c:657
 sock_sendmsg_nosec net/socket.c:734 [inline]
 __sock_sendmsg net/socket.c:749 [inline]
 __sock_sendmsg+0xc8/0x190 net/socket.c:744
 sock_sendmsg+0x120/0x210 net/socket.c:772
 splice_to_socket+0x8d8/0xc88 fs/splice.c:881
 do_splice_from fs/splice.c:933 [inline]
 direct_splice_actor+0x100/0x1a0 fs/splice.c:1142
 splice_direct_to_actor+0x300/0x898 fs/splice.c:1088
 do_splice_direct+0x190/0x268 fs/splice.c:1194
 do_sendfile+0xa50/0xf50 fs/read_write.c:1256
 __do_sys_sendfile64 fs/read_write.c:1324 [inline]
 __se_sys_sendfile64+0x2e4/0x3a0 fs/read_write.c:1310
 __arm64_sys_sendfile64+0x94/0xe0 fs/read_write.c:1310
 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]
 invoke_syscall+0x8c/0x2e0 arch/arm64/kernel/syscall.c:51
 el0_svc_common.constprop.0+0x200/0x2a8 arch/arm64/kernel/syscall.c:134
 do_el0_svc+0x4c/0x70 arch/arm64/kernel/syscall.c:176
 el0_svc+0x44/0x1d8 arch/arm64/kernel/entry-common.c:806
 el0t_64_sync_handler+0x100/0x130 arch/arm64/kernel/entry-common.c:844
 el0t_64_sync+0x188/0x190 arch/arm64/kernel/entry.S:757

**一、缺陷信息**

**【缺陷所属的os版本】（如openEuler-22.03-LTS，参考命令"cat /etc/os-release"结果）**

**【内核版本】（如kernel-5.10.0-60.138.0.165，参考命令"uname -r"结果）**

**【缺陷所属软件及版本号】（如kernel-5.10.0-60.138.0.165，参考命令"rpm -q 包名"结果）**

**【环境信息】**
硬件信息

- 提供跟硬件相关的信息，如架构、cpu和内存规格等
- 虚拟机场景，额外补充宿主机os版本类型

软件信息

- 跟缺陷所属软件相关的其它软件版本信息（如软件包构建失败由gcc引起，请填写gcc的版本号）

网络信息

- 如果有特殊组网，请提供网络拓扑信息以及网络数据走向

**【问题复现步骤】：请描述具体的操作步骤**

**【实际结果】**，请描述出问题的结果和影响
**【期望结果】**，请描述出期望的结果和影响
**【其他相关附件信息】**
比如系统message日志/组件日志、dump信息、图片等

**【缺陷详情及分析指导参考链接】**

**二、缺陷分析结构反馈**
影响性分析说明：

缺陷严重等级:(Critical/High/Moderate/Low)

缺陷根因说明:

受影响版本排查(受影响/不受影响):
openEuler-20.03-LTS-SP4
openEuler-22.03-LTS-SP3
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS
openEuler-24.03-LTS-SP1

修复是否涉及abi变化(是/否):
openEuler-20.03-LTS-SP4
openEuler-22.03-LTS-SP3
openEuler-22.03-LTS-SP4
openEuler-24.03-LTS
openEuler-24.03-LTS-SP1

src-openEuler/kernel

内容风险标识

评论 (3)

src-openEuler/kernel .gitee-modal { width: 500px !important; }

内容风险标识