IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready
IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready
8021q: adding VLAN 0 to HW filter on device batadv0
==================================================================
kasan: CONFIG_KASAN_INLINE enabled
BUG: KASAN: use-after-free in tick_sched_handle+0x16f/0x190 kernel/time/tick-sched.c:161
kasan: GPF could be caused by NULL-ptr deref or user memory access
Read of size 8 at addr ffff8880a4b3af90 by task syz-executor547/7965
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 7965 Comm: syz-executor547 Not tainted 5.0.0-rc1+ #24
CPU: 0 PID: 3472 Comm: kworker/0:2 Not tainted 5.0.0-rc1+ #24
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
Workqueue: ipv6_addrconf addrconf_dad_work
RIP: 0010:fib6_ignore_linkdown net/ipv6/route.c:651 [inline]
RIP: 0010:find_match+0x225/0x10d0 net/ipv6/route.c:667
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1db/0x2d0 lib/dump_stack.c:113
Code: a0 fe ff ff 40 84 f6 0f 84 4d 07 00 00 e8 33 33 b3 fa 49 8d be 3c 02 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 0e
RSP: 0018:ffff8880ae606f80 EFLAGS: 00010207
RAX: dffffc0000000000 RBX: 0000000000000003 RCX: ffffffff86cec418
RDX: 0000000000000047 RSI: ffffffff86cec42d RDI: 000000000000023c
RBP: ffff8880ae6070f0 R08: ffff88809ac1c580 R09: ffff8880ae6071d0
R10: ffffed1015cc5b8f R11: ffff8880ae62dc7b R12: 000000000000000f
print_address_description.cold+0x7c/0x20d mm/kasan/report.c:187
R13: ffff8880a4f79b40 R14: 0000000000000000 R15: ffff8880a4f79a80
FS: 0000000000000000(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
kasan_report.cold+0x1b/0x40 mm/kasan/report.c:317
CR2: 0000560057176110 CR3: 0000000091b39000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
__asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:135
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
tick_sched_handle+0x16f/0x190 kernel/time/tick-sched.c:161
Call Trace:
tick_sched_timer+0x47/0x130 kernel/time/tick-sched.c:1271
__run_hrtimer kernel/time/hrtimer.c:1389 [inline]
__hrtimer_run_queues+0x3a7/0x1050 kernel/time/hrtimer.c:1451
find_rr_leaf net/ipv6/route.c:730 [inline]
rt6_select net/ipv6/route.c:763 [inline]
fib6_table_lookup+0xc76/0x1000 net/ipv6/route.c:1809
hrtimer_interrupt+0x314/0x770 kernel/time/hrtimer.c:1509
local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1035 [inline]
smp_apic_timer_interrupt+0x18d/0x760 arch/x86/kernel/apic/apic.c:1060
ip6_pol_route+0x1b9/0x1490 net/ipv6/route.c:1842
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807
Allocated by task 2673313232:
ip6_pol_route_input+0x65/0x80 net/ipv6/route.c:1911
fib6_rule_lookup+0x12f/0x870 net/ipv6/fib6_rules.c:118
ip6_route_input_lookup+0xb7/0xd0 net/ipv6/route.c:1923
ip6_route_input+0x79b/0xe00 net/ipv6/route.c:2058
ip6_rcv_finish_core.isra.0+0x204/0x720 net/ipv6/ip6_input.c:63
ip6_rcv_finish+0x109/0x330 net/ipv6/ip6_input.c:74
NF_HOOK include/linux/netfilter.h:289 [inline]
NF_HOOK include/linux/netfilter.h:283 [inline]
ipv6_rcv+0x113/0x650 net/ipv6/ip6_input.c:272
__netif_receive_skb_one_core+0x160/0x210 net/core/dev.c:4973
__netif_receive_skb+0x2c/0x1c0 net/core/dev.c:5083
process_backlog+0x206/0x750 net/core/dev.c:5923
napi_poll net/core/dev.c:6346 [inline]
net_rx_action+0x76d/0x1930 net/core/dev.c:6412
__do_softirq+0x30b/0xb11 kernel/softirq.c:292
do_softirq_own_stack+0x2a/0x40 arch/x86/entry/entry_64.S:1027
do_softirq.part.0+0x11a/0x170 kernel/softirq.c:337
do_softirq kernel/softirq.c:329 [inline]
__local_bh_enable_ip+0x211/0x270 kernel/softirq.c:189
local_bh_enable include/linux/bottom_half.h:32 [inline]
rcu_read_unlock_bh include/linux/rcupdate.h:696 [inline]
ip6_finish_output2+0xca9/0x28e0 net/ipv6/ip6_output.c:121
ip6_finish_output+0x577/0xc30 net/ipv6/ip6_output.c:154
NF_HOOK_COND include/linux/netfilter.h:278 [inline]
ip6_output+0x23c/0xa00 net/ipv6/ip6_output.c:171
dst_output include/net/dst.h:444 [inline]
NF_HOOK include/linux/netfilter.h:289 [inline]
ndisc_send_skb+0xfce/0x1550 net/ipv6/ndisc.c:491
ndisc_send_ns+0x3b6/0x8a0 net/ipv6/ndisc.c:633
addrconf_dad_work+0xbe8/0x1320 net/ipv6/addrconf.c:4081
process_one_work+0xd0c/0x1ce0 kernel/workqueue.c:2153
worker_thread+0x143/0x14a0 kernel/workqueue.c:2296
kthread+0x357/0x430 kernel/kthread.c:246
ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352
Modules linked in:
BUG: unable to handle kernel paging request at ffffffff8cf149c0
---[ end trace e5fccfbed6721520 ]---
#PF error: [normal kernel read fault]
PGD 9874067 P4D 9874067 PUD 9875063 PMD 0
RIP: 0010:fib6_ignore_linkdown net/ipv6/route.c:651 [inline]
RIP: 0010:find_match+0x225/0x10d0 net/ipv6/route.c:667
Thread overran stack, or stack corrupted
Oops: 0000 [#2] PREEMPT SMP KASAN
CPU: 1 PID: 7965 Comm: syz-executor547 Tainted: G D 5.0.0-rc1+ #24
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Code: a0 fe ff ff 40 84 f6 0f 84 4d 07 00 00 e8 33 33 b3 fa 49 8d be 3c 02 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 14 02 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85 0e
RIP: 0010:depot_fetch_stack+0x10/0x30 lib/stackdepot.c:202
Code: c6 8f 22 fe e9 20 fe ff ff 48 89 df e8 b9 8f 22 fe e9 f1 fd ff ff 90 90 90 90 89 f8 c1 ef 11 25 ff ff 1f 00 81 e7 f0 3f 00 00 <48> 03 3c c5 c0 05 f5 8b 8b 47 0c 48 83 c7 18 c7 46 10 00 00 00 00
RSP: 0018:ffff8880ae606f80 EFLAGS: 00010207
RSP: 0018:ffff8880ae707b38 EFLAGS: 00010006
RAX: 00000000001f8880 RBX: ffff8880a4b3b784 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffff8880ae707b40 RDI: 0000000000003ff0
RBP: ffff8880ae707b68 R08: 000000000000001d R09: 0000000000000000
RAX: dffffc0000000000 RBX: 0000000000000003 RCX: ffffffff86cec418
R10: 0000000000000000 R11: ffffffff899993a3 R12: ffffea000292ce80
R13: ffff8880a4b3af90 R14: ffff8880aa16adc0 R15: ffff8880a4b3b780
FS: 0000000000000000(0000) GS:ffff8880ae700000(0063) knlGS:00000000084c4840
CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033
RDX: 0000000000000047 RSI: ffffffff86cec42d RDI: 000000000000023c
CR2: ffffffff8cf149c0 CR3: 000000009005f000 CR4: 00000000001406e0
RBP: ffff8880ae6070f0 R08: ffff88809ac1c580 R09: ffff8880ae6071d0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
R10: ffffed1015cc5b8f R11: ffff8880ae62dc7b R12: 000000000000000f
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
R13: ffff8880a4f79b40 R14: 0000000000000000 R15: ffff8880a4f79a80
describe_object mm/kasan/report.c:158 [inline]
print_address_description.cold+0x16a/0x20d mm/kasan/report.c:194
FS: 0000000000000000(0000) GS:ffff8880ae600000(0000) knlGS:0000000000000000
kasan_report.cold+0x1b/0x40 mm/kasan/report.c:317
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
__asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:135
tick_sched_handle+0x16f/0x190 kernel/time/tick-sched.c:161
CR2: 0000560057176110 CR3: 0000000091b39000 CR4: 00000000001406f0
tick_sched_timer+0x47/0x130 kernel/time/tick-sched.c:1271
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
__run_hrtimer kernel/time/hrtimer.c:1389 [inline]
__hrtimer_run_queues+0x3a7/0x1050 kernel/time/hrtimer.c:1451
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400