==================================================================
BUG: KASAN: use-after-free in memcpy include/linux/string.h:359 [inline]
BUG: KASAN: use-after-free in batadv_iv_ogm_aggregate_new net/batman-adv/bat_iv_ogm.c:544 [inline]
BUG: KASAN: use-after-free in batadv_iv_ogm_queue_add+0x327/0xec0 net/batman-adv/bat_iv_ogm.c:640
Read of size 60 at addr ffff8880a86e7720 by task kworker/u4:6/10428

CPU: 0 PID: 10428 Comm: kworker/u4:6 Not tainted 5.3.0-rc8-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x86/0xca lib/dump_stack.c:113
 print_address_description.cold.4+0x9/0x35a mm/kasan/report.c:351
 __kasan_report.cold.5+0x1b/0x3e mm/kasan/report.c:482
 kasan_report+0x12/0x17 mm/kasan/common.c:618
 check_memory_region_inline mm/kasan/generic.c:185 [inline]
 check_memory_region+0x151/0x1d0 mm/kasan/generic.c:192
 memcpy+0x23/0x50 mm/kasan/common.c:122
 memcpy include/linux/string.h:359 [inline]
 batadv_iv_ogm_aggregate_new net/batman-adv/bat_iv_ogm.c:544 [inline]
 batadv_iv_ogm_queue_add+0x327/0xec0 net/batman-adv/bat_iv_ogm.c:640
 batadv_iv_ogm_schedule+0xb47/0xe80 net/batman-adv/bat_iv_ogm.c:813
 batadv_iv_send_outstanding_bat_ogm_packet+0x570/0x7d0 net/batman-adv/bat_iv_ogm.c:1675
 process_one_work+0x7d2/0x1560 kernel/workqueue.c:2269
 worker_thread+0x85/0xb60 kernel/workqueue.c:2415
 kthread+0x331/0x3f0 kernel/kthread.c:255
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

Allocated by task 10428:
 save_stack mm/kasan/common.c:69 [inline]
 set_track mm/kasan/common.c:77 [inline]
 __kasan_kmalloc.part.0+0x44/0xc0 mm/kasan/common.c:493
 __kasan_kmalloc.constprop.1+0xb1/0xc0 mm/kasan/common.c:474
 kasan_kmalloc+0x9/0x10 mm/kasan/common.c:507
 __kmalloc+0x153/0x390 mm/slub.c:3811
 kmalloc include/linux/slab.h:557 [inline]
 batadv_tvlv_realloc_packet_buff net/batman-adv/tvlv.c:277 [inline]
 batadv_tvlv_container_ogm_append+0x16f/0x4c0 net/batman-adv/tvlv.c:318
 batadv_iv_ogm_schedule+0xc39/0xe80 net/batman-adv/bat_iv_ogm.c:776
 batadv_iv_send_outstanding_bat_ogm_packet+0x570/0x7d0 net/batman-adv/bat_iv_ogm.c:1675
 process_one_work+0x7d2/0x1560 kernel/workqueue.c:2269
 worker_thread+0x85/0xb60 kernel/workqueue.c:2415
 kthread+0x331/0x3f0 kernel/kthread.c:255
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

Freed by task 589:
 save_stack mm/kasan/common.c:69 [inline]
 set_track mm/kasan/common.c:77 [inline]
 __kasan_slab_free+0x145/0x210 mm/kasan/common.c:455
 kasan_slab_free+0xe/0x10 mm/kasan/common.c:463
 slab_free_hook mm/slub.c:1423 [inline]
 slab_free_freelist_hook mm/slub.c:1474 [inline]
 slab_free mm/slub.c:3016 [inline]
 kfree+0xf7/0x380 mm/slub.c:3957
 batadv_iv_ogm_iface_disable+0x34/0x70 net/batman-adv/bat_iv_ogm.c:220
 batadv_hardif_disable_interface.cold.8+0x5fb/0xeff net/batman-adv/hard-interface.c:875
 batadv_softif_destroy_netlink+0x94/0x100 net/batman-adv/soft-interface.c:1146
 default_device_exit_batch+0x239/0x3d0 net/core/dev.c:9775
 ops_exit_list.isra.1+0xd3/0x120 net/core/net_namespace.c:175
 cleanup_net+0x430/0x940 net/core/net_namespace.c:594
 process_one_work+0x7d2/0x1560 kernel/workqueue.c:2269
 worker_thread+0x85/0xb60 kernel/workqueue.c:2415
 kthread+0x331/0x3f0 kernel/kthread.c:255
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

The buggy address belongs to the object at ffff8880a86e7720
 which belongs to the cache kmalloc-64 of size 64
The buggy address is located 0 bytes inside of
 64-byte region [ffff8880a86e7720, ffff8880a86e7760)
The buggy address belongs to the page:
page:ffffea0002a1b9c0 refcount:1 mapcount:0 mapping:ffff8880b5c03180 index:0x0
flags: 0xfff00000000200(slab)
raw: 00fff00000000200 ffffea0002303040 0000000700000007 ffff8880b5c03180
raw: 0000000000000000 00000000802a002a 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8880a86e7600: fb fb fb fb fb fb fb fb fc fc fc fc fb fb fb fb
 ffff8880a86e7680: fb fb fb fb fc fc fc fc fb fb fb fb fb fb fb fb
>ffff8880a86e7700: fc fc fc fc fb fb fb fb fb fb fb fb fc fc fc fc
                               ^
 ffff8880a86e7780: fb fb fb fb fb fb fb fb fc fc fc fc 00 00 00 00
 ffff8880a86e7800: 00 00 00 00 fc fc fc fc 00 00 00 00 00 00 00 00
==================================================================