Re: [BUG] general protection fault in espintcp_sendmsg

[Xuanqiang Luo]

Hi Jaeyoung,

在 2026/8/19 23:53, Jaeyoung Chung 写道:
> Hello,
>
> We found a "general protection fault in espintcp_sendmsg" on Linux v7.2.
> The issue was found by our own race fuzzer. We have not analyzed the root
> cause, so we do not have a proposed fix to offer.
>
> To reproduce the race reliably, we applied the delay patch below to the
> kernel and ran the C reproducer as root inside an x86_64 QEMU guest. The
> crash log we observed, the delay patch and the reproducer are all included
> below.
>
> The following kernel config options are required to reproduce the issue:
> 	CONFIG_XFRM=y
> 	CONFIG_XFRM_USER=y
> 	CONFIG_INET_ESP=y
> 	CONFIG_INET_ESPINTCP=y
> 	CONFIG_KASAN=y
>
> We hope this report is useful. Please let us know if any further
> information would help.
>
> Reported-by: Eulgyu Kim <eulgyukim@xxxxxxxxx>
> Reported-by: Jaeyoung Chung <jjy600901@xxxxxxxxx>

Thanks for the report.

I suspect the issue you reproduced is the same race that Yilin Zhu
attempted to address a few months ago:

https://lore.kernel.org/all/c30b645074a1b379e0f7fe297f917c66137d9964.1778464688.git.zylzyl2333@xxxxxxxxx/

I have added Yilin and Sabrina back to Cc. Sabrina reviewed that patch,
but as far as I can tell, no revised version was posted afterwards. I
do not know the current status of that work.

Thanks,
Xuanqiang