Re: [BUG] net: ipv6: KASAN: slab-use-after-free in ip6gre_tunnel_xmit

[Eric Dumazet]

On Wed, Aug 19, 2026 at 8:23 AM Shuangpeng Bai
<shuangpeng.kernel@xxxxxxxxx> wrote:
>
> Hi Kernel Maintainers,
>
> I hit the following report while testing current upstream kernel:
>
> KASAN: slab-use-after-free in ip6gre_tunnel_xmit
>
> on commit: bd5f485f3f026225b86573e559af0b7254ef4184 (2026-08-18)
>
> The reproducer and .config files are here.
> https://gist.github.com/shuangpengbai/63aa087b3e843c7a4e98a42c0f130aeb
>
> I'm happy to test debug patches or provide additional information.
>

Hi Shuandpeng

Thanks for the report, could you test the following for me?

diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
index 200d0ba1a40e71a4245f1b153dc30691e773f8c7..678678fcb5da395f8b1c8243562efe8addbda2ee
100644
--- a/net/ipv6/ip6_gre.c
+++ b/net/ipv6/ip6_gre.c
@@ -878,6 +878,7 @@ static int ip6gre_xmit_other(struct sk_buff *skb,
struct net_device *dev)
 static netdev_tx_t ip6gre_tunnel_xmit(struct sk_buff *skb,
        struct net_device *dev)
 {
+       struct ip_tunnel_info *tun_info = NULL;
        struct ip6_tnl *t = netdev_priv(dev);
        __be16 payload_protocol;
        int ret;
@@ -888,6 +889,9 @@ static netdev_tx_t ip6gre_tunnel_xmit(struct sk_buff *skb,
        if (!ip6_tnl_xmit_ctl(t, &t->parms.laddr, &t->parms.raddr))
                goto tx_err;

+       if (t->parms.collect_md)
+               tun_info = skb_tunnel_info_txcheck(skb);
+
        payload_protocol = skb_protocol(skb, true);
        switch (payload_protocol) {
        case htons(ETH_P_IP):
@@ -907,7 +911,7 @@ static netdev_tx_t ip6gre_tunnel_xmit(struct sk_buff *skb,
        return NETDEV_TX_OK;

 tx_err:
-       if (!t->parms.collect_md || !IS_ERR(skb_tunnel_info_txcheck(skb)))
+       if (!IS_ERR(tun_info))
                DEV_STATS_INC(dev, tx_errors);
        DEV_STATS_INC(dev, tx_dropped);
        kfree_skb(skb);