IPv6: ADDRCONF(NETDEV_UP): hsr0: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready 8021q: adding VLAN 0 to HW filter on device batadv0 ================================================================== BUG: KASAN: use-after-free in tick_sched_handle+0x16f/0x190 kernel/time/tick-sched.c:161 kasan: CONFIG_KASAN_INLINE enabled Read of size 8 at addr ffff88808886b030 by task syz-executor774/8016 kasan: GPF could be caused by NULL-ptr deref or user memory access general protection fault: 0000 [#1] PREEMPT SMP KASAN CPU: 1 PID: 0 Comm: swapper/1 Not tainted 5.0.0-rc1+ #24 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 RIP: 0010:lock_accessed kernel/locking/lockdep.c:968 [inline] RIP: 0010:__bfs kernel/locking/lockdep.c:1035 [inline] RIP: 0010:__bfs+0x2ce/0x7a0 kernel/locking/lockdep.c:989 Code: 49 01 00 00 49 8d 7f 10 4c 89 f8 4c 8b 1d 0a d8 ee 09 48 89 f9 48 2d 20 47 32 8b 44 8b 15 5a d6 61 09 48 c1 e9 03 48 c1 f8 06 <42> 80 3c 21 00 0f 85 2c 03 00 00 49 8b 77 10 4c 8d 46 2c 4c 89 c1 RSP: 0018:ffff8880ae7069b0 EFLAGS: 00010003 RAX: 0000000001d336e3 RBX: ffffed1015ce0d4f RCX: 0000000000000002 RDX: 1ffff11015ce0d4b RSI: 0000000000000001 RDI: 0000000000000010 RBP: ffff8880ae706ae0 R08: 0000000000000001 R09: 1ffff11015ce0d4f R10: 000000000000a31d R11: 0000000000001bba R12: dffffc0000000000 R13: ffffffff8b302450 R14: ffff8880ae706ab8 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055821f2250d0 CR3: 000000009ab3c000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: __bfs_forwards kernel/locking/lockdep.c:1063 [inline] find_usage_forwards kernel/locking/lockdep.c:1363 [inline] check_usage_forwards+0x164/0x3e0 kernel/locking/lockdep.c:2575 mark_lock_irq kernel/locking/lockdep.c:2690 [inline] mark_lock+0x519/0x1cd0 kernel/locking/lockdep.c:3062 mark_irqflags kernel/locking/lockdep.c:2940 [inline] __lock_acquire+0x139c/0x4a30 kernel/locking/lockdep.c:3295 lock_acquire+0x1db/0x570 kernel/locking/lockdep.c:3841 __raw_spin_lock include/linux/spinlock_api_smp.h:142 [inline] _raw_spin_lock+0x2f/0x40 kernel/locking/spinlock.c:144 spin_lock include/linux/spinlock.h:329 [inline] __dev_xmit_skb net/core/dev.c:3491 [inline] __dev_queue_xmit+0x17e0/0x3a60 net/core/dev.c:3832 dev_queue_xmit+0x18/0x20 net/core/dev.c:3897 neigh_resolve_output net/core/neighbour.c:1471 [inline] neigh_resolve_output+0x6a0/0xb30 net/core/neighbour.c:1451 neigh_output include/net/neighbour.h:508 [inline] ip6_finish_output2+0xc56/0x28e0 net/ipv6/ip6_output.c:120 ip6_finish_output+0x577/0xc30 net/ipv6/ip6_output.c:154 NF_HOOK_COND include/linux/netfilter.h:278 [inline] ip6_output+0x23c/0xa00 net/ipv6/ip6_output.c:171 dst_output include/net/dst.h:444 [inline] NF_HOOK include/linux/netfilter.h:289 [inline] NF_HOOK include/linux/netfilter.h:283 [inline] mld_sendpack+0xa44/0xfd0 net/ipv6/mcast.c:1683 mld_send_cr net/ipv6/mcast.c:1979 [inline] mld_ifc_timer_expire+0x449/0x8a0 net/ipv6/mcast.c:2478 call_timer_fn+0x254/0x900 kernel/time/timer.c:1325 expire_timers kernel/time/timer.c:1362 [inline] __run_timers+0x6fc/0xd50 kernel/time/timer.c:1681 run_timer_softirq+0x52/0xb0 kernel/time/timer.c:1694 __do_softirq+0x30b/0xb11 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0x180/0x1d0 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x1b7/0x760 arch/x86/kernel/apic/apic.c:1062 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:807 RIP: 0010:native_safe_halt+0x2/0x10 arch/x86/include/asm/irqflags.h:58 Code: ff ff ff 48 89 c7 48 89 45 d8 e8 69 dd d1 f9 48 8b 45 d8 e9 ce fe ff ff 48 89 df e8 58 dd d1 f9 eb 82 90 90 90 90 90 90 fb f4 0f 1f 00 66 2e 0f 1f 84 00 00 00 00 00 f4 c3 90 90 90 90 90 90 RSP: 0018:ffff8880a94a7cd0 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff13 RAX: 1ffffffff1325019 RBX: 1ffff11015294f9d RCX: 0000000000000000 RDX: dffffc0000000000 RSI: 0000000000000001 RDI: ffff8880a9496bbc RBP: ffff8880a94a7d90 R08: ffff8880a9496340 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001 R13: ffff8880a94a7d68 R14: 0000000000000000 R15: ffffffff899280b8 arch_cpu_idle+0x10/0x20 arch/x86/kernel/process.c:555 default_idle_call+0x36/0x90 kernel/sched/idle.c:93 cpuidle_idle_call kernel/sched/idle.c:153 [inline] do_idle+0x386/0x5d0 kernel/sched/idle.c:262 cpu_startup_entry+0x1b/0x20 kernel/sched/idle.c:353 start_secondary+0x435/0x620 arch/x86/kernel/smpboot.c:271 secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:243 Modules linked in: ---[ end trace 1f6a270ad6cc3a4f ]--- RIP: 0010:lock_accessed kernel/locking/lockdep.c:968 [inline] RIP: 0010:__bfs kernel/locking/lockdep.c:1035 [inline] RIP: 0010:__bfs+0x2ce/0x7a0 kernel/locking/lockdep.c:989 Code: 49 01 00 00 49 8d 7f 10 4c 89 f8 4c 8b 1d 0a d8 ee 09 48 89 f9 48 2d 20 47 32 8b 44 8b 15 5a d6 61 09 48 c1 e9 03 48 c1 f8 06 <42> 80 3c 21 00 0f 85 2c 03 00 00 49 8b 77 10 4c 8d 46 2c 4c 89 c1 RSP: 0018:ffff8880ae7069b0 EFLAGS: 00010003 RAX: 0000000001d336e3 RBX: ffffed1015ce0d4f RCX: 0000000000000002 RDX: 1ffff11015ce0d4b RSI: 0000000000000001 RDI: 0000000000000010 RBP: ffff8880ae706ae0 R08: 0000000000000001 R09: 1ffff11015ce0d4f R10: 000000000000a31d R11: 0000000000001bba R12: dffffc0000000000 R13: ffffffff8b302450 R14: ffff8880ae706ab8 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8880ae700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055821f2250d0 CR3: 000000009ab3c000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400