Re: [BUG] general protection fault in espintcp_sendmsg

[Sabrina Dubroca]

2026-08-20, 16:22:19 +0800, Xuanqiang Luo wrote:
> Hi Jaeyoung,
> 
> 在 2026/8/19 23:53, Jaeyoung Chung 写道:
> > Hello,
> > 
> > We found a "general protection fault in espintcp_sendmsg" on Linux v7.2.
> > The issue was found by our own race fuzzer. We have not analyzed the root
> > cause, so we do not have a proposed fix to offer.
> > 
> > To reproduce the race reliably, we applied the delay patch below to the
> > kernel and ran the C reproducer as root inside an x86_64 QEMU guest. The
> > crash log we observed, the delay patch and the reproducer are all included
> > below.
> > 
> > The following kernel config options are required to reproduce the issue:
> > 	CONFIG_XFRM=y
> > 	CONFIG_XFRM_USER=y
> > 	CONFIG_INET_ESP=y
> > 	CONFIG_INET_ESPINTCP=y
> > 	CONFIG_KASAN=y
> > 
> > We hope this report is useful. Please let us know if any further
> > information would help.
> > 
> > Reported-by: Eulgyu Kim <eulgyukim@xxxxxxxxx>
> > Reported-by: Jaeyoung Chung <jjy600901@xxxxxxxxx>
> 
> Thanks for the report.
> 
> I suspect the issue you reproduced is the same race that Yilin Zhu
> attempted to address a few months ago:
> 
> https://lore.kernel.org/all/c30b645074a1b379e0f7fe297f917c66137d9964.1778464688.git.zylzyl2333@xxxxxxxxx/
> 
> I have added Yilin and Sabrina back to Cc. Sabrina reviewed that patch,
> but as far as I can tell, no revised version was posted afterwards. I
> do not know the current status of that work.

Thanks. I made some comments on the patch and never got an answer or a
v2. I'll take over and add some tags for the reporters/authors of v1
and of this thread.

I should be able to send it either tonight or tomorrow.

-- 
Sabrina