KASAN: global-out-of-bounds Read in __find_rr

Title	Replies (including bot)	Last reply
[syzbot] [net?] KASAN: global-out-of-bounds Read in __find_rr_leaf (2)	0 (1)	2025/05/01 14:39
Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	KASAN: global-out-of-bounds Read in __find_rr_leaf net				1	50d	50d	0/28	closed as invalid on 2025/04/08 14:27
==================================================================
BUG: KASAN: global-out-of-bounds in fib6_check_expired include/net/ip6_fib.h:270 [inline]
BUG: KASAN: global-out-of-bounds in __find_rr_leaf+0xbcb/0xe00 net/ipv6/route.c:843
Read of size 4 at addr ffffffff9af86bc4 by task syz.3.1436/11985

CPU: 0 UID: 0 PID: 11985 Comm: syz.3.1436 Not tainted 6.15.0-rc4-syzkaller-00147-gebd297a2affa #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:408 [inline]
 print_report+0xc3/0x670 mm/kasan/report.c:521
 kasan_report+0xe0/0x110 mm/kasan/report.c:634
 fib6_check_expired include/net/ip6_fib.h:270 [inline]
 __find_rr_leaf+0xbcb/0xe00 net/ipv6/route.c:843
 find_rr_leaf net/ipv6/route.c:899 [inline]
 rt6_select net/ipv6/route.c:934 [inline]
 fib6_table_lookup+0x7b3/0xa30 net/ipv6/route.c:2230
 ip6_pol_route+0x1cc/0x1230 net/ipv6/route.c:2266
 pol_lookup_func include/net/ip6_fib.h:616 [inline]
 fib6_rule_lookup+0x536/0x720 net/ipv6/fib6_rules.c:120
 ip6_route_input_lookup net/ipv6/route.c:2335 [inline]
 ip6_route_input+0x662/0xc00 net/ipv6/route.c:2631
 ip6_rcv_finish_core.constprop.0+0x1a0/0x5d0 net/ipv6/ip6_input.c:66
 ip6_rcv_finish net/ipv6/ip6_input.c:77 [inline]
 NF_HOOK include/linux/netfilter.h:314 [inline]
 NF_HOOK include/linux/netfilter.h:308 [inline]
 ipv6_rcv+0x1e8/0x680 net/ipv6/ip6_input.c:309
 __netif_receive_skb_one_core+0x12d/0x1e0 net/core/dev.c:5887
 __netif_receive_skb+0x1d/0x160 net/core/dev.c:6000
 process_backlog+0x442/0x15e0 net/core/dev.c:6352
 __napi_poll.constprop.0+0xba/0x550 net/core/dev.c:7324
 napi_poll net/core/dev.c:7388 [inline]
 net_rx_action+0xa97/0x1010 net/core/dev.c:7510
 handle_softirqs+0x219/0x8e0 kernel/softirq.c:579
 __do_softirq kernel/softirq.c:613 [inline]
 invoke_softirq kernel/softirq.c:453 [inline]
 __irq_exit_rcu+0x109/0x170 kernel/softirq.c:680
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:202
Code: 90 f3 0f 1e fa 53 48 8b 74 24 08 48 89 fb 48 83 c7 18 e8 4a 0f 2b f6 48 89 df e8 f2 62 2b f6 e8 fd fa 55 f6 fb bf 01 00 00 00 <e8> 52 cf 1b f6 65 8b 05 8b a4 36 08 85 c0 74 06 5b e9 5c 45 a3 f5
RSP: 0018:ffffc900048cf3c8 EFLAGS: 00000206
RAX: 000000000002a303 RBX: ffff8880281cb7e8 RCX: 0000000000000006
RDX: 0000000000000000 RSI: ffffffff8dbdc851 RDI: 0000000000000001
RBP: ffff8880281cb7e0 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff90851c17 R11: 0000000000000000 R12: ffff8880281cb7e8
R13: ffff8880281cb7e0 R14: ffffc900048cf678 R15: 000000000000000d
 spin_unlock_irq include/linux/spinlock.h:401 [inline]
 filemap_remove_folio+0x106/0x250 mm/filemap.c:254
 truncate_inode_folio+0x49/0x70 mm/truncate.c:176
 shmem_undo_range+0x376/0x1150 mm/shmem.c:1121
 shmem_truncate_range mm/shmem.c:1237 [inline]
 shmem_evict_inode+0x3a1/0xbe0 mm/shmem.c:1365
 evict+0x3e6/0x920 fs/inode.c:810
 iput_final fs/inode.c:1898 [inline]
 iput fs/inode.c:1924 [inline]
 iput+0x521/0x880 fs/inode.c:1910
 dentry_unlink_inode+0x29c/0x480 fs/dcache.c:457
 __dentry_kill+0x1d0/0x600 fs/dcache.c:660
 dput.part.0+0x4b1/0x9b0 fs/dcache.c:902
 dput+0x1f/0x30 fs/dcache.c:892
 __fput+0x51c/0xb70 fs/file_table.c:473
 task_work_run+0x150/0x240 kernel/task_work.c:227
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0xafb/0x2c30 kernel/exit.c:953
 do_group_exit+0xd3/0x2a0 kernel/exit.c:1102
 get_signal+0x2673/0x26d0 kernel/signal.c:3034
 arch_do_signal_or_restart+0x8f/0x7d0 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218
 do_syscall_64+0xda/0x260 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f36e0f8e969
Code: Unable to access opcode bytes at 0x7f36e0f8e93f.
RSP: 002b:00007f36dedf6038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: 0000000000010106 RBX: 00007f36e11b6080 RCX: 00007f36e0f8e969
RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000005
RBP: 00007f36e1010ab1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f36e11b6080 R15: 00007ffdf3fea2b8
 </TASK>

The buggy address belongs to the variable:
 binder_deferred_list+0x24/0x40

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1af86
flags: 0xfff00000002000(reserved|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000002000 ffffea00006be188 ffffea00006be188 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner info is not present (never set?)

Memory state around the buggy address:
 ffffffff9af86a80: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9
 ffffffff9af86b00: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9
>ffffffff9af86b80: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 00 f9 f9
                                           ^
 ffffffff9af86c00: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
 ffffffff9af86c80: 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9 f9
==================================================================
==================================================================
BUG: KASAN: global-out-of-bounds in __find_rr_leaf+0xbf1/0xe00 net/ipv6/route.c:846
Read of size 8 at addr ffffffff9af86c10 by task syz.3.1436/11985

CPU: 0 UID: 0 PID: 11985 Comm: syz.3.1436 Tainted: G    B               6.15.0-rc4-syzkaller-00147-gebd297a2affa #0 PREEMPT(full) 
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:408 [inline]
 print_report+0xc3/0x670 mm/kasan/report.c:521
 kasan_report+0xe0/0x110 mm/kasan/report.c:634
 __find_rr_leaf+0xbf1/0xe00 net/ipv6/route.c:846
 find_rr_leaf net/ipv6/route.c:899 [inline]
 rt6_select net/ipv6/route.c:934 [inline]
 fib6_table_lookup+0x7b3/0xa30 net/ipv6/route.c:2230
 ip6_pol_route+0x1cc/0x1230 net/ipv6/route.c:2266
 pol_lookup_func include/net/ip6_fib.h:616 [inline]
 fib6_rule_lookup+0x536/0x720 net/ipv6/fib6_rules.c:120
 ip6_route_input_lookup net/ipv6/route.c:2335 [inline]
 ip6_route_input+0x662/0xc00 net/ipv6/route.c:2631
 ip6_rcv_finish_core.constprop.0+0x1a0/0x5d0 net/ipv6/ip6_input.c:66
 ip6_rcv_finish net/ipv6/ip6_input.c:77 [inline]
 NF_HOOK include/linux/netfilter.h:314 [inline]
 NF_HOOK include/linux/netfilter.h:308 [inline]
 ipv6_rcv+0x1e8/0x680 net/ipv6/ip6_input.c:309
 __netif_receive_skb_one_core+0x12d/0x1e0 net/core/dev.c:5887
 __netif_receive_skb+0x1d/0x160 net/core/dev.c:6000
 process_backlog+0x442/0x15e0 net/core/dev.c:6352
 __napi_poll.constprop.0+0xba/0x550 net/core/dev.c:7324
 napi_poll net/core/dev.c:7388 [inline]
 net_rx_action+0xa97/0x1010 net/core/dev.c:7510
 handle_softirqs+0x219/0x8e0 kernel/softirq.c:579
 __do_softirq kernel/softirq.c:613 [inline]
 invoke_softirq kernel/softirq.c:453 [inline]
 __irq_exit_rcu+0x109/0x170 kernel/softirq.c:680
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:202
Code: 90 f3 0f 1e fa 53 48 8b 74 24 08 48 89 fb 48 83 c7 18 e8 4a 0f 2b f6 48 89 df e8 f2 62 2b f6 e8 fd fa 55 f6 fb bf 01 00 00 00 <e8> 52 cf 1b f6 65 8b 05 8b a4 36 08 85 c0 74 06 5b e9 5c 45 a3 f5
RSP: 0018:ffffc900048cf3c8 EFLAGS: 00000206
RAX: 000000000002a303 RBX: ffff8880281cb7e8 RCX: 0000000000000006
RDX: 0000000000000000 RSI: ffffffff8dbdc851 RDI: 0000000000000001
RBP: ffff8880281cb7e0 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff90851c17 R11: 0000000000000000 R12: ffff8880281cb7e8
R13: ffff8880281cb7e0 R14: ffffc900048cf678 R15: 000000000000000d
 spin_unlock_irq include/linux/spinlock.h:401 [inline]
 filemap_remove_folio+0x106/0x250 mm/filemap.c:254
 truncate_inode_folio+0x49/0x70 mm/truncate.c:176
 shmem_undo_range+0x376/0x1150 mm/shmem.c:1121
 shmem_truncate_range mm/shmem.c:1237 [inline]
 shmem_evict_inode+0x3a1/0xbe0 mm/shmem.c:1365
 evict+0x3e6/0x920 fs/inode.c:810
 iput_final fs/inode.c:1898 [inline]
 iput fs/inode.c:1924 [inline]
 iput+0x521/0x880 fs/inode.c:1910
 dentry_unlink_inode+0x29c/0x480 fs/dcache.c:457
 __dentry_kill+0x1d0/0x600 fs/dcache.c:660
 dput.part.0+0x4b1/0x9b0 fs/dcache.c:902
 dput+0x1f/0x30 fs/dcache.c:892
 __fput+0x51c/0xb70 fs/file_table.c:473
 task_work_run+0x150/0x240 kernel/task_work.c:227
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0xafb/0x2c30 kernel/exit.c:953
 do_group_exit+0xd3/0x2a0 kernel/exit.c:1102
 get_signal+0x2673/0x26d0 kernel/signal.c:3034
 arch_do_signal_or_restart+0x8f/0x7d0 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218
 do_syscall_64+0xda/0x260 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f36e0f8e969
Code: Unable to access opcode bytes at 0x7f36e0f8e93f.
RSP: 002b:00007f36dedf6038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: 0000000000010106 RBX: 00007f36e11b6080 RCX: 00007f36e0f8e969
RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000005
RBP: 00007f36e1010ab1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f36e11b6080 R15: 00007ffdf3fea2b8
 </TASK>

The buggy address belongs to the variable:
 __key.0+0x30/0x40

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1af86
flags: 0xfff00000002000(reserved|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000002000 ffffea00006be188 ffffea00006be188 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner info is not present (never set?)

Memory state around the buggy address:
 ffffffff9af86b00: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9
 ffffffff9af86b80: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 00 f9 f9
>ffffffff9af86c00: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
                         ^
 ffffffff9af86c80: 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9 f9
 ffffffff9af86d00: 00 00 f9 f9 f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9
==================================================================
==================================================================
BUG: KASAN: global-out-of-bounds in find_match+0xdbe/0x15d0 net/ipv6/route.c:778
Read of size 1 at addr ffffffff9af86c2f by task syz.3.1436/11985

CPU: 0 UID: 0 PID: 11985 Comm: syz.3.1436 Tainted: G    B               6.15.0-rc4-syzkaller-00147-gebd297a2affa #0 PREEMPT(full) 
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:408 [inline]
 print_report+0xc3/0x670 mm/kasan/report.c:521
 kasan_report+0xe0/0x110 mm/kasan/report.c:634
 find_match+0xdbe/0x15d0 net/ipv6/route.c:778
 __find_rr_leaf+0x140/0xe00 net/ipv6/route.c:869
 find_rr_leaf net/ipv6/route.c:899 [inline]
 rt6_select net/ipv6/route.c:934 [inline]
 fib6_table_lookup+0x7b3/0xa30 net/ipv6/route.c:2230
 ip6_pol_route+0x1cc/0x1230 net/ipv6/route.c:2266
 pol_lookup_func include/net/ip6_fib.h:616 [inline]
 fib6_rule_lookup+0x536/0x720 net/ipv6/fib6_rules.c:120
 ip6_route_input_lookup net/ipv6/route.c:2335 [inline]
 ip6_route_input+0x662/0xc00 net/ipv6/route.c:2631
 ip6_rcv_finish_core.constprop.0+0x1a0/0x5d0 net/ipv6/ip6_input.c:66
 ip6_rcv_finish net/ipv6/ip6_input.c:77 [inline]
 NF_HOOK include/linux/netfilter.h:314 [inline]
 NF_HOOK include/linux/netfilter.h:308 [inline]
 ipv6_rcv+0x1e8/0x680 net/ipv6/ip6_input.c:309
 __netif_receive_skb_one_core+0x12d/0x1e0 net/core/dev.c:5887
 __netif_receive_skb+0x1d/0x160 net/core/dev.c:6000
 process_backlog+0x442/0x15e0 net/core/dev.c:6352
 __napi_poll.constprop.0+0xba/0x550 net/core/dev.c:7324
 napi_poll net/core/dev.c:7388 [inline]
 net_rx_action+0xa97/0x1010 net/core/dev.c:7510
 handle_softirqs+0x219/0x8e0 kernel/softirq.c:579
 __do_softirq kernel/softirq.c:613 [inline]
 invoke_softirq kernel/softirq.c:453 [inline]
 __irq_exit_rcu+0x109/0x170 kernel/softirq.c:680
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:202
Code: 90 f3 0f 1e fa 53 48 8b 74 24 08 48 89 fb 48 83 c7 18 e8 4a 0f 2b f6 48 89 df e8 f2 62 2b f6 e8 fd fa 55 f6 fb bf 01 00 00 00 <e8> 52 cf 1b f6 65 8b 05 8b a4 36 08 85 c0 74 06 5b e9 5c 45 a3 f5
RSP: 0018:ffffc900048cf3c8 EFLAGS: 00000206
RAX: 000000000002a303 RBX: ffff8880281cb7e8 RCX: 0000000000000006
RDX: 0000000000000000 RSI: ffffffff8dbdc851 RDI: 0000000000000001
RBP: ffff8880281cb7e0 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff90851c17 R11: 0000000000000000 R12: ffff8880281cb7e8
R13: ffff8880281cb7e0 R14: ffffc900048cf678 R15: 000000000000000d
 spin_unlock_irq include/linux/spinlock.h:401 [inline]
 filemap_remove_folio+0x106/0x250 mm/filemap.c:254
 truncate_inode_folio+0x49/0x70 mm/truncate.c:176
 shmem_undo_range+0x376/0x1150 mm/shmem.c:1121
 shmem_truncate_range mm/shmem.c:1237 [inline]
 shmem_evict_inode+0x3a1/0xbe0 mm/shmem.c:1365
 evict+0x3e6/0x920 fs/inode.c:810
 iput_final fs/inode.c:1898 [inline]
 iput fs/inode.c:1924 [inline]
 iput+0x521/0x880 fs/inode.c:1910
 dentry_unlink_inode+0x29c/0x480 fs/dcache.c:457
 __dentry_kill+0x1d0/0x600 fs/dcache.c:660
 dput.part.0+0x4b1/0x9b0 fs/dcache.c:902
 dput+0x1f/0x30 fs/dcache.c:892
 __fput+0x51c/0xb70 fs/file_table.c:473
 task_work_run+0x150/0x240 kernel/task_work.c:227
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0xafb/0x2c30 kernel/exit.c:953
 do_group_exit+0xd3/0x2a0 kernel/exit.c:1102
 get_signal+0x2673/0x26d0 kernel/signal.c:3034
 arch_do_signal_or_restart+0x8f/0x7d0 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218
 do_syscall_64+0xda/0x260 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f36e0f8e969
Code: Unable to access opcode bytes at 0x7f36e0f8e93f.
RSP: 002b:00007f36dedf6038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: 0000000000010106 RBX: 00007f36e11b6080 RCX: 00007f36e0f8e969
RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000005
RBP: 00007f36e1010ab1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f36e11b6080 R15: 00007ffdf3fea2b8
 </TASK>

The buggy address belongs to the variable:
 binder_shrinker+0xf/0x40

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1af86
flags: 0xfff00000002000(reserved|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000002000 ffffea00006be188 ffffea00006be188 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner info is not present (never set?)

Memory state around the buggy address:
 ffffffff9af86b00: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9
 ffffffff9af86b80: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 00 f9 f9
>ffffffff9af86c00: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
                                  ^
 ffffffff9af86c80: 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9 f9
 ffffffff9af86d00: 00 00 f9 f9 f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9
==================================================================
==================================================================
BUG: KASAN: global-out-of-bounds in find_match+0x12ce/0x15d0 net/ipv6/route.c:781
Read of size 8 at addr ffffffff9af86c18 by task syz.3.1436/11985

CPU: 0 UID: 0 PID: 11985 Comm: syz.3.1436 Tainted: G    B               6.15.0-rc4-syzkaller-00147-gebd297a2affa #0 PREEMPT(full) 
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:408 [inline]
 print_report+0xc3/0x670 mm/kasan/report.c:521
 kasan_report+0xe0/0x110 mm/kasan/report.c:634
 find_match+0x12ce/0x15d0 net/ipv6/route.c:781
 __find_rr_leaf+0x140/0xe00 net/ipv6/route.c:869
 find_rr_leaf net/ipv6/route.c:899 [inline]
 rt6_select net/ipv6/route.c:934 [inline]
 fib6_table_lookup+0x7b3/0xa30 net/ipv6/route.c:2230
 ip6_pol_route+0x1cc/0x1230 net/ipv6/route.c:2266
 pol_lookup_func include/net/ip6_fib.h:616 [inline]
 fib6_rule_lookup+0x536/0x720 net/ipv6/fib6_rules.c:120
 ip6_route_input_lookup net/ipv6/route.c:2335 [inline]
 ip6_route_input+0x662/0xc00 net/ipv6/route.c:2631
 ip6_rcv_finish_core.constprop.0+0x1a0/0x5d0 net/ipv6/ip6_input.c:66
 ip6_rcv_finish net/ipv6/ip6_input.c:77 [inline]
 NF_HOOK include/linux/netfilter.h:314 [inline]
 NF_HOOK include/linux/netfilter.h:308 [inline]
 ipv6_rcv+0x1e8/0x680 net/ipv6/ip6_input.c:309
 __netif_receive_skb_one_core+0x12d/0x1e0 net/core/dev.c:5887
 __netif_receive_skb+0x1d/0x160 net/core/dev.c:6000
 process_backlog+0x442/0x15e0 net/core/dev.c:6352
 __napi_poll.constprop.0+0xba/0x550 net/core/dev.c:7324
 napi_poll net/core/dev.c:7388 [inline]
 net_rx_action+0xa97/0x1010 net/core/dev.c:7510
 handle_softirqs+0x219/0x8e0 kernel/softirq.c:579
 __do_softirq kernel/softirq.c:613 [inline]
 invoke_softirq kernel/softirq.c:453 [inline]
 __irq_exit_rcu+0x109/0x170 kernel/softirq.c:680
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:202
Code: 90 f3 0f 1e fa 53 48 8b 74 24 08 48 89 fb 48 83 c7 18 e8 4a 0f 2b f6 48 89 df e8 f2 62 2b f6 e8 fd fa 55 f6 fb bf 01 00 00 00 <e8> 52 cf 1b f6 65 8b 05 8b a4 36 08 85 c0 74 06 5b e9 5c 45 a3 f5
RSP: 0018:ffffc900048cf3c8 EFLAGS: 00000206
RAX: 000000000002a303 RBX: ffff8880281cb7e8 RCX: 0000000000000006
RDX: 0000000000000000 RSI: ffffffff8dbdc851 RDI: 0000000000000001
RBP: ffff8880281cb7e0 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff90851c17 R11: 0000000000000000 R12: ffff8880281cb7e8
R13: ffff8880281cb7e0 R14: ffffc900048cf678 R15: 000000000000000d
 spin_unlock_irq include/linux/spinlock.h:401 [inline]
 filemap_remove_folio+0x106/0x250 mm/filemap.c:254
 truncate_inode_folio+0x49/0x70 mm/truncate.c:176
 shmem_undo_range+0x376/0x1150 mm/shmem.c:1121
 shmem_truncate_range mm/shmem.c:1237 [inline]
 shmem_evict_inode+0x3a1/0xbe0 mm/shmem.c:1365
 evict+0x3e6/0x920 fs/inode.c:810
 iput_final fs/inode.c:1898 [inline]
 iput fs/inode.c:1924 [inline]
 iput+0x521/0x880 fs/inode.c:1910
 dentry_unlink_inode+0x29c/0x480 fs/dcache.c:457
 __dentry_kill+0x1d0/0x600 fs/dcache.c:660
 dput.part.0+0x4b1/0x9b0 fs/dcache.c:902
 dput+0x1f/0x30 fs/dcache.c:892
 __fput+0x51c/0xb70 fs/file_table.c:473
 task_work_run+0x150/0x240 kernel/task_work.c:227
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0xafb/0x2c30 kernel/exit.c:953
 do_group_exit+0xd3/0x2a0 kernel/exit.c:1102
 get_signal+0x2673/0x26d0 kernel/signal.c:3034
 arch_do_signal_or_restart+0x8f/0x7d0 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218
 do_syscall_64+0xda/0x260 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f36e0f8e969
Code: Unable to access opcode bytes at 0x7f36e0f8e93f.
RSP: 002b:00007f36dedf6038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: 0000000000010106 RBX: 00007f36e11b6080 RCX: 00007f36e0f8e969
RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000005
RBP: 00007f36e1010ab1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f36e11b6080 R15: 00007ffdf3fea2b8
 </TASK>

The buggy address belongs to the variable:
 __key.0+0x38/0x40

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1af86
flags: 0xfff00000002000(reserved|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000002000 ffffea00006be188 ffffea00006be188 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner info is not present (never set?)

Memory state around the buggy address:
 ffffffff9af86b00: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9
 ffffffff9af86b80: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 00 f9 f9
>ffffffff9af86c00: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
                            ^
 ffffffff9af86c80: 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9 f9
 ffffffff9af86d00: 00 00 f9 f9 f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9
==================================================================
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000018: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x00000000000000c0-0x00000000000000c7]
CPU: 0 UID: 0 PID: 11985 Comm: syz.3.1436 Tainted: G    B               6.15.0-rc4-syzkaller-00147-gebd297a2affa #0 PREEMPT(full) 
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
RIP: 0010:__in6_dev_get include/net/addrconf.h:347 [inline]
RIP: 0010:ip6_ignore_linkdown include/net/addrconf.h:443 [inline]
RIP: 0010:find_match+0x136/0x15d0 net/ipv6/route.c:781
Code: 48 c1 ea 03 80 3c 02 00 0f 85 ac 11 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 7d 00 49 8d bf c0 00 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 93 11 00 00 4d 8b bf c0 00 00 00 e8 b4 18 50 01
RSP: 0018:ffffc900000073a8 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: 0000000000000003 RCX: ffffffff817ad3af
RDX: 0000000000000018 RSI: ffffffff821f9507 RDI: 00000000000000c0
RBP: ffffc900000074b0 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 3d3d3d3d3d3d3d3d R12: ffffffff9af86c2f
R13: ffffffff9af86c18 R14: 1ffff92000000e84 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8881249e6000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f36dedd4f98 CR3: 000000006480d000 CR4: 0000000000350ef0
Call Trace:
 <IRQ>
 __find_rr_leaf+0x140/0xe00 net/ipv6/route.c:869
 find_rr_leaf net/ipv6/route.c:899 [inline]
 rt6_select net/ipv6/route.c:934 [inline]
 fib6_table_lookup+0x7b3/0xa30 net/ipv6/route.c:2230
 ip6_pol_route+0x1cc/0x1230 net/ipv6/route.c:2266
 pol_lookup_func include/net/ip6_fib.h:616 [inline]
 fib6_rule_lookup+0x536/0x720 net/ipv6/fib6_rules.c:120
 ip6_route_input_lookup net/ipv6/route.c:2335 [inline]
 ip6_route_input+0x662/0xc00 net/ipv6/route.c:2631
 ip6_rcv_finish_core.constprop.0+0x1a0/0x5d0 net/ipv6/ip6_input.c:66
 ip6_rcv_finish net/ipv6/ip6_input.c:77 [inline]
 NF_HOOK include/linux/netfilter.h:314 [inline]
 NF_HOOK include/linux/netfilter.h:308 [inline]
 ipv6_rcv+0x1e8/0x680 net/ipv6/ip6_input.c:309
 __netif_receive_skb_one_core+0x12d/0x1e0 net/core/dev.c:5887
 __netif_receive_skb+0x1d/0x160 net/core/dev.c:6000
 process_backlog+0x442/0x15e0 net/core/dev.c:6352
 __napi_poll.constprop.0+0xba/0x550 net/core/dev.c:7324
 napi_poll net/core/dev.c:7388 [inline]
 net_rx_action+0xa97/0x1010 net/core/dev.c:7510
 handle_softirqs+0x219/0x8e0 kernel/softirq.c:579
 __do_softirq kernel/softirq.c:613 [inline]
 invoke_softirq kernel/softirq.c:453 [inline]
 __irq_exit_rcu+0x109/0x170 kernel/softirq.c:680
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:202
Code: 90 f3 0f 1e fa 53 48 8b 74 24 08 48 89 fb 48 83 c7 18 e8 4a 0f 2b f6 48 89 df e8 f2 62 2b f6 e8 fd fa 55 f6 fb bf 01 00 00 00 <e8> 52 cf 1b f6 65 8b 05 8b a4 36 08 85 c0 74 06 5b e9 5c 45 a3 f5
RSP: 0018:ffffc900048cf3c8 EFLAGS: 00000206
RAX: 000000000002a303 RBX: ffff8880281cb7e8 RCX: 0000000000000006
RDX: 0000000000000000 RSI: ffffffff8dbdc851 RDI: 0000000000000001
RBP: ffff8880281cb7e0 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff90851c17 R11: 0000000000000000 R12: ffff8880281cb7e8
R13: ffff8880281cb7e0 R14: ffffc900048cf678 R15: 000000000000000d
 spin_unlock_irq include/linux/spinlock.h:401 [inline]
 filemap_remove_folio+0x106/0x250 mm/filemap.c:254
 truncate_inode_folio+0x49/0x70 mm/truncate.c:176
 shmem_undo_range+0x376/0x1150 mm/shmem.c:1121
 shmem_truncate_range mm/shmem.c:1237 [inline]
 shmem_evict_inode+0x3a1/0xbe0 mm/shmem.c:1365
 evict+0x3e6/0x920 fs/inode.c:810
 iput_final fs/inode.c:1898 [inline]
 iput fs/inode.c:1924 [inline]
 iput+0x521/0x880 fs/inode.c:1910
 dentry_unlink_inode+0x29c/0x480 fs/dcache.c:457
 __dentry_kill+0x1d0/0x600 fs/dcache.c:660
 dput.part.0+0x4b1/0x9b0 fs/dcache.c:902
 dput+0x1f/0x30 fs/dcache.c:892
 __fput+0x51c/0xb70 fs/file_table.c:473
 task_work_run+0x150/0x240 kernel/task_work.c:227
 exit_task_work include/linux/task_work.h:40 [inline]
 do_exit+0xafb/0x2c30 kernel/exit.c:953
 do_group_exit+0xd3/0x2a0 kernel/exit.c:1102
 get_signal+0x2673/0x26d0 kernel/signal.c:3034
 arch_do_signal_or_restart+0x8f/0x7d0 arch/x86/kernel/signal.c:337
 exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
 exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
 __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
 syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218
 do_syscall_64+0xda/0x260 arch/x86/entry/syscall_64.c:100
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f36e0f8e969
Code: Unable to access opcode bytes at 0x7f36e0f8e93f.
RSP: 002b:00007f36dedf6038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: 0000000000010106 RBX: 00007f36e11b6080 RCX: 00007f36e0f8e969
RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000005
RBP: 00007f36e1010ab1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f36e11b6080 R15: 00007ffdf3fea2b8
 </TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__in6_dev_get include/net/addrconf.h:347 [inline]
RIP: 0010:ip6_ignore_linkdown include/net/addrconf.h:443 [inline]
RIP: 0010:find_match+0x136/0x15d0 net/ipv6/route.c:781
Code: 48 c1 ea 03 80 3c 02 00 0f 85 ac 11 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 7d 00 49 8d bf c0 00 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 93 11 00 00 4d 8b bf c0 00 00 00 e8 b4 18 50 01
RSP: 0018:ffffc900000073a8 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: 0000000000000003 RCX: ffffffff817ad3af
RDX: 0000000000000018 RSI: ffffffff821f9507 RDI: 00000000000000c0
RBP: ffffc900000074b0 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 3d3d3d3d3d3d3d3d R12: ffffffff9af86c2f
R13: ffffffff9af86c18 R14: 1ffff92000000e84 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8881249e6000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f36dedd4f98 CR3: 000000006480d000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess):
   0:	90                   	nop
   1:	f3 0f 1e fa          	endbr64
   5:	53                   	push   %rbx
   6:	48 8b 74 24 08       	mov    0x8(%rsp),%rsi
   b:	48 89 fb             	mov    %rdi,%rbx
   e:	48 83 c7 18          	add    $0x18,%rdi
  12:	e8 4a 0f 2b f6       	call   0xf62b0f61
  17:	48 89 df             	mov    %rbx,%rdi
  1a:	e8 f2 62 2b f6       	call   0xf62b6311
  1f:	e8 fd fa 55 f6       	call   0xf655fb21
  24:	fb                   	sti
  25:	bf 01 00 00 00       	mov    $0x1,%edi
* 2a:	e8 52 cf 1b f6       	call   0xf61bcf81 <-- trapping instruction
  2f:	65 8b 05 8b a4 36 08 	mov    %gs:0x836a48b(%rip),%eax        # 0x836a4c1
  36:	85 c0                	test   %eax,%eax
  38:	74 06                	je     0x40
  3a:	5b                   	pop    %rbx
  3b:	e9 5c 45 a3 f5       	jmp    0xf5a3459c
Time	Kernel	Commit	Syzkaller	Config	Log	Report	Syz repro	C repro	VM info	Assets (help?)	Manager	Title
2025/05/02 10:52	upstream	ebd297a2affa	51b137cd	.config	console log	report			info	[disk image] [vmlinux] [kernel image]	ci-upstream-kasan-badwrites-root	KASAN: global-out-of-bounds Read in __find_rr_leaf
2025/05/01 04:19	upstream	7a13c14ee59d	ce7952f4	.config	console log	report			info	[disk image (non-bootable)] [vmlinux] [kernel image]	ci-qemu-upstream-386	KASAN: global-out-of-bounds Read in __find_rr_leaf