[BUG REPORT] selinux: general protection fault in avtab_search_node() during an AVC lookup

[1sh1ro]

Hi Paul, Stephen,

fuzzing with syzkaller on a 7.3.0-rc5 KASAN kernel (SELinux enabled,
permissive) produced a general protection fault in avtab_search_node() from
the AVC lookup path.  The policy's avtab appears to contain garbage: the
first fault reads a non-canonical address, and it is followed by thousands
of further Oopses (8850 in this run) as later lookups keep hitting the
broken structure.

The crash
---------

Oops: general protection fault, probably for non-canonical address 0xe06f3dc280000000: 0000 [#1] SMP KASAN NOPTI
KASAN: maybe wild-memory-access in range [0x037a0e1400000000-0x037a0e1400000007]
CPU: 1 UID: 0 PID: 14271 Comm: systemd-udevd Not tainted 7.3.0-rc5 #2 PREEMPT(lazy)
Hardware name: QEMU Ubuntu 24.04 PC (i440FX + PIIX, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:avtab_search_node+0x24d/0x4d0
Call Trace:
 <TASK>
 cond_compute_av+0x59/0x340
 context_struct_compute_av+0x7f2/0x11f0
 security_compute_av+0x558/0xd60
 avc_compute_av+0x86/0x820
 avc_perm_nonode+0x9b/0x170
 avc_has_perm+0x27b/0x2f0
 selinux_inode_follow_link+0x226/0x380
 security_inode_follow_link+0x96/0xe0
 pick_link+0x447/0x1570
 step_into_slowpath+0x928/0xdd0
 link_path_walk+0xdae/0x1b20
 path_lookupat+0x70/0xb80
 filename_lookup+0x213/0x5e0
 filename_setxattr+0x89/0x1b0
 path_setxattrat+0x1cc/0x2a0
 __x64_sys_setxattr+0xc6/0x140
 do_syscall_64+0xec/0x4e0
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
 </TASK>

Context
-------

- The task is systemd-udevd (uid 0) in setxattr() (ORIG_RAX 0xbc), which
  follows a symlink while walking the path; the first AVC decision for the
  symlink hits the corrupt avtab.
- The same crash appeared on three runs of this fuzzing instance:
  2026-10-08 23:39 UTC, 2026-10-12 04:50 UTC and 2026-10-12 10:48 UTC.
- The kernel log of the crashing run shows only avc denials
  (permissive=1) and no policy (re)load, so the avtab was already corrupt
  when this lookup happened.  From this run alone I cannot tell whether the
  corruption originates in SELinux or comes from an unrelated memory
  corruption bug in the same fuzzing session (that instance also produced
  unrelated memory-safety crashes around the same time).
- No reproducer: the instance ran with syzkaller's reproduce disabled.  I
  can rerun it with reproduce enabled if you would like one.

7.3-rc5 already contains the recent policy-load validation fixes (class and
permission counts, level category sets, boolean values), so this looks like
a separate instance of the avtab-corruption family rather than one of those.

Thanks,
1sh1ro