KASAN: null-ptr-deref Write in fib6_purge

Kernel	Title	Rank 🛈	Count	Last	Reported	Patched	Status
upstream	KASAN: null-ptr-deref Write in fib6_purge_rt net	12	18	2237d	2260d	12/29	fixed on 2019/06/18 17:49
upstream	KASAN: null-ptr-deref Write in fib6_purge_rt (2) net	12	1	2218d	2214d	0/29	auto-closed as invalid on 2019/10/25 08:48
upstream	KASAN: slab-use-after-free Write in fib6_purge_rt net	24	1	605d	605d	25/29	fixed on 2024/02/01 11:10

device veth0_macvtap left promiscuous mode device veth1_vlan left promiscuous mode device veth0_vlan left promiscuous mode Bluetooth: hci1: command 0x0406 tx timeout ================================================================== BUG: KASAN: null-ptr-deref in fib6_drop_pcpu_from net/ipv6/ip6_fib.c:898 [inline] BUG: KASAN: null-ptr-deref in fib6_purge_rt+0x1ba/0x610 net/ipv6/ip6_fib.c:912 Write of size 8 at addr 00000000000001e2 by task kworker/u4:10/29375 CPU: 0 PID: 29375 Comm: kworker/u4:10 Not tainted 4.19.182-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: netns cleanup_net Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fc/0x2ef lib/dump_stack.c:118 kasan_report_error.cold+0x15b/0x1b9 mm/kasan/report.c:352 kasan_report+0x8f/0xa0 mm/kasan/report.c:412 fib6_drop_pcpu_from net/ipv6/ip6_fib.c:898 [inline] fib6_purge_rt+0x1ba/0x610 net/ipv6/ip6_fib.c:912 fib6_del_route net/ipv6/ip6_fib.c:1802 [inline] fib6_del+0x9d2/0xeb0 net/ipv6/ip6_fib.c:1838 fib6_clean_node+0x35a/0x560 net/ipv6/ip6_fib.c:1999 fib6_walk_continue+0x4ff/0x8d0 net/ipv6/ip6_fib.c:1922 fib6_walk+0x182/0x370 net/ipv6/ip6_fib.c:1970 fib6_clean_tree+0xc2/0x100 net/ipv6/ip6_fib.c:2047 __fib6_clean_all+0x11f/0x2a0 net/ipv6/ip6_fib.c:2063 rt6_sync_down_dev net/ipv6/route.c:4133 [inline] rt6_disable_ip+0xb5/0x700 net/ipv6/route.c:4138 addrconf_ifdown.isra.0+0xf6/0x1320 net/ipv6/addrconf.c:3664 addrconf_notify+0x568/0x21f0 net/ipv6/addrconf.c:3589 notifier_call_chain+0xc0/0x230 kernel/notifier.c:93 call_netdevice_notifiers net/core/dev.c:1762 [inline] dev_close_many+0x323/0x670 net/core/dev.c:1514 rollback_registered_many+0x2f7/0xe70 net/core/dev.c:8165 unregister_netdevice_many.part.0+0x1a/0x300 net/core/dev.c:9316 unregister_netdevice_many net/core/dev.c:9315 [inline] default_device_exit_batch+0x2fa/0x3c0 net/core/dev.c:9787 ops_exit_list+0xf9/0x150 net/core/net_namespace.c:156 cleanup_net+0x3b4/0x8b0 net/core/net_namespace.c:553 process_one_work+0x864/0x1570 kernel/workqueue.c:2152 worker_thread+0x64c/0x1130 kernel/workqueue.c:2295 kthread+0x33f/0x460 kernel/kthread.c:259 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415 ==================================================================