slab kmalloc-32 start ffff88804440f3c0 pointer offset 0 size 32
list_add corruption. next->prev should be prev (ffff888052b50658), but was 0000000000000000. (next=ffff88804440f3c0).
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:31!
Oops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
CPU: 0 UID: 0 PID: 1037 Comm: kworker/u4:7 Not tainted 6.14.0-rc3-syzkaller-00060-g6537cfb395f3 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
Workqueue: ipv6_addrconf addrconf_dad_work
RIP: 0010:__list_add_valid_or_report+0xf3/0x130 lib/list_debug.c:29
Code: e9 0a fd 42 80 7c 2d 00 00 74 08 48 89 df e8 84 dd 2c fd 49 8b 56 08 48 c7 c7 40 ef 80 8c 4c 89 e6 4c 89 f1 e8 ee e8 2a fc 90 <0f> 0b 4c 89 e7 e8 73 e9 0a fd 42 80 3c 2b 00 74 08 4c 89 e7 e8 54
RSP: 0018:ffffc9000271f4a8 EFLAGS: 00010046
RAX: 0000000000000075 RBX: ffff88804440f3c8 RCX: ac0df509a8bb5100
RDX: 0000000000000000 RSI: 0000000080000001 RDI: 0000000000000000
RBP: 1ffff11008881e79 R08: ffffffff81a1108c R09: fffffbfff1d3a614
R10: dffffc0000000000 R11: fffffbfff1d3a614 R12: ffff888052b50658
R13: dffffc0000000000 R14: ffff88804440f3c0 R15: ffff888051af4540
FS: 0000000000000000(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055ffc1a67038 CR3: 0000000043780000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
__list_add_valid include/linux/list.h:88 [inline]
__list_add include/linux/list.h:150 [inline]
list_add include/linux/list.h:169 [inline]
ref_tracker_alloc+0x1f4/0x490 lib/ref_tracker.c:213
__netdev_tracker_alloc include/linux/netdevice.h:4281 [inline]
netdev_hold include/linux/netdevice.h:4310 [inline]
dst_init+0xee/0x490 net/core/dst.c:52
dst_alloc+0x14f/0x190 net/core/dst.c:93
ip6_dst_alloc net/ipv6/route.c:342 [inline]
icmp6_dst_alloc+0x77/0x420 net/ipv6/route.c:3280
mld_sendpack+0x6a3/0xdb0 net/ipv6/mcast.c:1857
ipv6_mc_dad_complete+0x88/0x490 net/ipv6/mcast.c:2293
addrconf_dad_completed+0x712/0xcd0 net/ipv6/addrconf.c:4336
addrconf_dad_work+0xdbc/0x16a0
process_one_work kernel/workqueue.c:3236 [inline]
process_scheduled_works+0xabe/0x18e0 kernel/workqueue.c:3317
worker_thread+0x870/0xd30 kernel/workqueue.c:3398
kthread+0x7a9/0x920 kernel/kthread.c:464
ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:148
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244
</TASK>
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__list_add_valid_or_report+0xf3/0x130 lib/list_debug.c:29
Code: e9 0a fd 42 80 7c 2d 00 00 74 08 48 89 df e8 84 dd 2c fd 49 8b 56 08 48 c7 c7 40 ef 80 8c 4c 89 e6 4c 89 f1 e8 ee e8 2a fc 90 <0f> 0b 4c 89 e7 e8 73 e9 0a fd 42 80 3c 2b 00 74 08 4c 89 e7 e8 54
RSP: 0018:ffffc9000271f4a8 EFLAGS: 00010046
RAX: 0000000000000075 RBX: ffff88804440f3c8 RCX: ac0df509a8bb5100
RDX: 0000000000000000 RSI: 0000000080000001 RDI: 0000000000000000
RBP: 1ffff11008881e79 R08: ffffffff81a1108c R09: fffffbfff1d3a614
R10: dffffc0000000000 R11: fffffbfff1d3a614 R12: ffff888052b50658
R13: dffffc0000000000 R14: ffff88804440f3c0 R15: ffff888051af4540
FS: 0000000000000000(0000) GS:ffff88801fc00000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000055ffc1a67038 CR3: 0000000043780000 CR4: 0000000000352ef0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400