KASAN: slab-out-of-bounds Read in fib6_nh_get_excptn

Kernel	Title	Repro	Cause bisect	Fix bisect	Count	Last	Reported	Patched	Status
upstream	KASAN: slab-out-of-bounds Read in fib6_nh_get_excptn_bucket (3) net				2	1073d	1122d	0/26	auto-closed as invalid on 2021/09/13 13:28
upstream	KASAN: slab-out-of-bounds Read in fib6_nh_get_excptn_bucket net				16	1548d	1680d	0/26	auto-closed as invalid on 2020/05/26 18:38
==================================================================
BUG: KASAN: slab-out-of-bounds in fib6_nh_get_excptn_bucket+0x18b/0x1a0 net/ipv6/route.c:1620
Read of size 8 at addr ffff888022fa6af8 by task systemd-journal/4893

CPU: 0 PID: 4893 Comm: systemd-journal Not tainted 5.10.0-rc5-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:118
 print_address_description.constprop.0.cold+0xae/0x4c8 mm/kasan/report.c:385
 __kasan_report mm/kasan/report.c:545 [inline]
 kasan_report.cold+0x1f/0x37 mm/kasan/report.c:562
 fib6_nh_get_excptn_bucket+0x18b/0x1a0 net/ipv6/route.c:1620
 fib6_nh_flush_exceptions+0x34/0x2d0 net/ipv6/route.c:1748
 fib6_nh_release+0x81/0x3c0 net/ipv6/route.c:3549
 fib6_info_destroy_rcu+0x187/0x210 net/ipv6/ip6_fib.c:174
 rcu_do_batch kernel/rcu/tree.c:2476 [inline]
 rcu_core+0x5df/0xe80 kernel/rcu/tree.c:2711
 __do_softirq+0x2a0/0x9f6 kernel/softirq.c:298
 asm_call_irq_on_stack+0xf/0x20
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0xaa/0xd0 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:393 [inline]
 __irq_exit_rcu kernel/softirq.c:423 [inline]
 irq_exit_rcu+0x132/0x200 kernel/softirq.c:435
 sysvec_apic_timer_interrupt+0x4d/0x100 arch/x86/kernel/apic/apic.c:1091
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:631
RIP: 0010:get_current arch/x86/include/asm/current.h:15 [inline]
RIP: 0010:__sanitizer_cov_trace_pc+0x0/0x60 kernel/kcov.c:196
Code: fc ff ff 48 c7 c7 00 d5 38 8b 48 89 54 24 08 48 89 34 24 e8 72 3c 5f 02 48 8b 54 24 08 48 8b 34 24 e9 a1 fd ff ff 0f 1f 40 00 <65> 48 8b 14 25 00 f0 01 00 65 8b 05 10 eb 91 7e a9 00 01 ff 00 48
RSP: 0018:ffffc9000161fad0 EFLAGS: 00000206
RAX: 000000000023afbb RBX: 0000000000000ff8 RCX: ffffffff8155a947
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000001cf0 R08: 0000000000000001 R09: ffffffff8ebb36ff
R10: fffffbfff1d766df R11: 0000000000000000 R12: 0000000000000041
R13: 0000000000000000 R14: ffff888010fb1af0 R15: ffffffff81586220
 devkmsg_poll+0x122/0x1d0 kernel/printk/printk.c:879
 vfs_poll include/linux/poll.h:90 [inline]
 ep_item_poll+0x14a/0x3e0 fs/eventpoll.c:885
 ep_send_events_proc+0x273/0xc50 fs/eventpoll.c:1742
 ep_scan_ready_list+0x256/0x7d0 fs/eventpoll.c:712
 ep_send_events fs/eventpoll.c:1786 [inline]
 ep_poll fs/eventpoll.c:1942 [inline]
 do_epoll_wait+0xb2f/0x10a0 fs/eventpoll.c:2323
 __do_sys_epoll_wait fs/eventpoll.c:2333 [inline]
 __se_sys_epoll_wait fs/eventpoll.c:2330 [inline]
 __x64_sys_epoll_wait+0x93/0xf0 fs/eventpoll.c:2330
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f1bbde202e3
Code: 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 83 3d 29 54 2b 00 00 75 13 49 89 ca b8 e8 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 34 c3 48 83 ec 08 e8 0b c2 00 00 48 89 04 24
RSP: 002b:00007ffd96311b28 EFLAGS: 00000246 ORIG_RAX: 00000000000000e8
RAX: ffffffffffffffda RBX: 0000560b5f1e31e0 RCX: 00007f1bbde202e3
RDX: 0000000000000013 RSI: 00007ffd96311b30 RDI: 0000000000000008
RBP: 00007ffd96311d20 R08: 431bde82d7b634db R09: 00007ffd963f9080
R10: 00000000ffffffff R11: 0000000000000246 R12: 00007ffd96311b30
R13: 0000000000000001 R14: ffffffffffffffff R15: 0005b596617060cc

Allocated by task 27368:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48
 kasan_set_track mm/kasan/common.c:56 [inline]
 __kasan_kmalloc.constprop.0+0xc2/0xd0 mm/kasan/common.c:461
 kmalloc include/linux/slab.h:552 [inline]
 kzalloc include/linux/slab.h:664 [inline]
 fib6_info_alloc+0xbe/0x1d0 net/ipv6/ip6_fib.c:154
 ip6_route_info_create+0x350/0x19d0 net/ipv6/route.c:3651
 ip6_route_add+0x24/0x150 net/ipv6/route.c:3741
 inet6_rtm_newroute+0x152/0x160 net/ipv6/route.c:5362
 rtnetlink_rcv_msg+0x44e/0xad0 net/core/rtnetlink.c:5562
 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2494
 netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
 netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1330
 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1919
 sock_sendmsg_nosec net/socket.c:651 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:671
 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2331
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2385
 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2418
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Last call_rcu():
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48
 kasan_record_aux_stack+0xc0/0xf0 mm/kasan/generic.c:346
 __call_rcu kernel/rcu/tree.c:2953 [inline]
 call_rcu+0xbb/0x700 kernel/rcu/tree.c:3027
 fib6_info_release include/net/ip6_fib.h:336 [inline]
 fib6_info_release include/net/ip6_fib.h:333 [inline]
 ip6_route_info_create+0xf79/0x19d0 net/ipv6/route.c:3731
 ip6_route_add+0x24/0x150 net/ipv6/route.c:3741
 inet6_rtm_newroute+0x152/0x160 net/ipv6/route.c:5362
 rtnetlink_rcv_msg+0x44e/0xad0 net/core/rtnetlink.c:5562
 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2494
 netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
 netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1330
 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1919
 sock_sendmsg_nosec net/socket.c:651 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:671
 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2331
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2385
 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2418
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Second to last call_rcu():
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48
 kasan_record_aux_stack+0xc0/0xf0 mm/kasan/generic.c:346
 __call_rcu kernel/rcu/tree.c:2953 [inline]
 call_rcu+0xbb/0x700 kernel/rcu/tree.c:3027
 rhashtable_rehash_table lib/rhashtable.c:345 [inline]
 rht_deferred_worker+0x10f4/0x1d40 lib/rhashtable.c:429
 process_one_work+0x933/0x15a0 kernel/workqueue.c:2272
 worker_thread+0x64c/0x1120 kernel/workqueue.c:2418
 kthread+0x3b1/0x4a0 kernel/kthread.c:292
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296

The buggy address belongs to the object at ffff888022fa6a00
 which belongs to the cache kmalloc-192 of size 192
The buggy address is located 56 bytes to the right of
 192-byte region [ffff888022fa6a00, ffff888022fa6ac0)
The buggy address belongs to the page:
page:00000000833eb755 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x22fa6
flags: 0xfff00000000200(slab)
raw: 00fff00000000200 ffffea000072b340 0000000400000004 ffff888010041500
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff888022fa6980: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888022fa6a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888022fa6a80: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc
                                                                ^
 ffff888022fa6b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff888022fa6b80: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================