==================================================================
BUG: KASAN: slab-out-of-bounds in atomic_read include/asm-generic/atomic-instrumented.h:26 [inline]
BUG: KASAN: slab-out-of-bounds in atomic_fetch_add_unless include/linux/atomic-fallback.h:1086 [inline]
BUG: KASAN: slab-out-of-bounds in atomic_add_unless include/linux/atomic-fallback.h:1111 [inline]
BUG: KASAN: slab-out-of-bounds in atomic_inc_not_zero include/linux/atomic-fallback.h:1127 [inline]
BUG: KASAN: slab-out-of-bounds in dst_hold_safe include/net/dst.h:297 [inline]
BUG: KASAN: slab-out-of-bounds in ip6_hold_safe+0xad/0x380 net/ipv6/route.c:1075
Read of size 4 at addr ffff8880a49de9a8 by task ksoftirqd/0/9

CPU: 0 PID: 9 Comm: ksoftirqd/0 Not tainted 5.2.0-rc2+ #18
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x172/0x1f0 lib/dump_stack.c:113
 print_address_description.cold+0x7c/0x20d mm/kasan/report.c:188
 __kasan_report.cold+0x1b/0x40 mm/kasan/report.c:317
 kasan_report+0x12/0x20 mm/kasan/common.c:614
 check_memory_region_inline mm/kasan/generic.c:185 [inline]
 check_memory_region+0x123/0x190 mm/kasan/generic.c:191
 kasan_check_read+0x11/0x20 mm/kasan/common.c:94
 atomic_read include/asm-generic/atomic-instrumented.h:26 [inline]
 atomic_fetch_add_unless include/linux/atomic-fallback.h:1086 [inline]
 atomic_add_unless include/linux/atomic-fallback.h:1111 [inline]
 atomic_inc_not_zero include/linux/atomic-fallback.h:1127 [inline]
 dst_hold_safe include/net/dst.h:297 [inline]
 ip6_hold_safe+0xad/0x380 net/ipv6/route.c:1075
 rt6_get_pcpu_route net/ipv6/route.c:1304 [inline]
 ip6_pol_route+0x2e9/0xf40 net/ipv6/route.c:2055
 ip6_pol_route_input+0x65/0x80 net/ipv6/route.c:2074
 fib6_rule_lookup+0x133/0x5a0 net/ipv6/fib6_rules.c:116
 ip6_route_input_lookup+0xb7/0xd0 net/ipv6/route.c:2086
 ip6_route_input+0x5e2/0x9e0 net/ipv6/route.c:2221
 ip6_rcv_finish_core.isra.0+0x174/0x590 net/ipv6/ip6_input.c:67
 ip6_rcv_finish+0x17a/0x310 net/ipv6/ip6_input.c:78
 NF_HOOK include/linux/netfilter.h:305 [inline]
 NF_HOOK include/linux/netfilter.h:299 [inline]
 ipv6_rcv+0x10e/0x420 net/ipv6/ip6_input.c:276
 __netif_receive_skb_one_core+0x113/0x1a0 net/core/dev.c:4985
 __netif_receive_skb+0x2c/0x1d0 net/core/dev.c:5099
 process_backlog+0x206/0x750 net/core/dev.c:5910
 napi_poll net/core/dev.c:6333 [inline]
 net_rx_action+0x4f5/0x1070 net/core/dev.c:6399
 __do_softirq+0x25c/0x94c kernel/softirq.c:293
 run_ksoftirqd kernel/softirq.c:604 [inline]
 run_ksoftirqd+0x8e/0x110 kernel/softirq.c:596
 smpboot_thread_fn+0x6a3/0xa30 kernel/smpboot.c:165
 kthread+0x354/0x420 kernel/kthread.c:255
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

Allocated by task 1:
 save_stack+0x23/0x90 mm/kasan/common.c:71
 set_track mm/kasan/common.c:79 [inline]
 __kasan_kmalloc mm/kasan/common.c:489 [inline]
 __kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:462
 kasan_kmalloc+0x9/0x10 mm/kasan/common.c:503
 kmem_cache_alloc_trace+0x151/0x750 mm/slab.c:3555
 kmalloc include/linux/slab.h:547 [inline]
 kzalloc include/linux/slab.h:742 [inline]
 tty_register_device_attr+0x1d0/0x740 drivers/tty/tty_io.c:3128
 tty_register_device drivers/tty/tty_io.c:3076 [inline]
 tty_register_driver+0x478/0x8a0 drivers/tty/tty_io.c:3347
 legacy_pty_init drivers/tty/pty.c:602 [inline]
 pty_init+0x6e6/0xf1c drivers/tty/pty.c:964
 do_one_initcall+0x107/0x7ba init/main.c:915
 do_initcall_level init/main.c:983 [inline]
 do_initcalls init/main.c:991 [inline]
 do_basic_setup init/main.c:1009 [inline]
 kernel_init_freeable+0x4d4/0x5c3 init/main.c:1169
 kernel_init+0x12/0x1c5 init/main.c:1087
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

Freed by task 0:
(stack is not available)

The buggy address belongs to the object at ffff8880a49de580
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 1064 bytes inside of
 2048-byte region [ffff8880a49de580, ffff8880a49ded80)
The buggy address belongs to the page:
page:ffffea0002927780 refcount:1 mapcount:0 mapping:ffff8880aa400c40 index:0x0 compound_mapcount: 0
flags: 0x1fffc0000010200(slab|head)
raw: 01fffc0000010200 ffffea0002926b08 ffffea0002928b88 ffff8880aa400c40
raw: 0000000000000000 ffff8880a49de580 0000000100000003 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8880a49de880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8880a49de900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8880a49de980: 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc
                                  ^
 ffff8880a49dea00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8880a49dea80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================