==================================================================
BUG: KASAN: global-out-of-bounds in fib6_check_expired include/net/ip6_fib.h:270 [inline]
BUG: KASAN: global-out-of-bounds in __find_rr_leaf+0xbcb/0xe00 net/ipv6/route.c:843
Read of size 4 at addr ffffffff9af86bc4 by task syz.3.1436/11985
CPU: 0 UID: 0 PID: 11985 Comm: syz.3.1436 Not tainted 6.15.0-rc4-syzkaller-00147-gebd297a2affa #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:408 [inline]
print_report+0xc3/0x670 mm/kasan/report.c:521
kasan_report+0xe0/0x110 mm/kasan/report.c:634
fib6_check_expired include/net/ip6_fib.h:270 [inline]
__find_rr_leaf+0xbcb/0xe00 net/ipv6/route.c:843
find_rr_leaf net/ipv6/route.c:899 [inline]
rt6_select net/ipv6/route.c:934 [inline]
fib6_table_lookup+0x7b3/0xa30 net/ipv6/route.c:2230
ip6_pol_route+0x1cc/0x1230 net/ipv6/route.c:2266
pol_lookup_func include/net/ip6_fib.h:616 [inline]
fib6_rule_lookup+0x536/0x720 net/ipv6/fib6_rules.c:120
ip6_route_input_lookup net/ipv6/route.c:2335 [inline]
ip6_route_input+0x662/0xc00 net/ipv6/route.c:2631
ip6_rcv_finish_core.constprop.0+0x1a0/0x5d0 net/ipv6/ip6_input.c:66
ip6_rcv_finish net/ipv6/ip6_input.c:77 [inline]
NF_HOOK include/linux/netfilter.h:314 [inline]
NF_HOOK include/linux/netfilter.h:308 [inline]
ipv6_rcv+0x1e8/0x680 net/ipv6/ip6_input.c:309
__netif_receive_skb_one_core+0x12d/0x1e0 net/core/dev.c:5887
__netif_receive_skb+0x1d/0x160 net/core/dev.c:6000
process_backlog+0x442/0x15e0 net/core/dev.c:6352
__napi_poll.constprop.0+0xba/0x550 net/core/dev.c:7324
napi_poll net/core/dev.c:7388 [inline]
net_rx_action+0xa97/0x1010 net/core/dev.c:7510
handle_softirqs+0x219/0x8e0 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:202
Code: 90 f3 0f 1e fa 53 48 8b 74 24 08 48 89 fb 48 83 c7 18 e8 4a 0f 2b f6 48 89 df e8 f2 62 2b f6 e8 fd fa 55 f6 fb bf 01 00 00 00 52 cf 1b f6 65 8b 05 8b a4 36 08 85 c0 74 06 5b e9 5c 45 a3 f5
RSP: 0018:ffffc900048cf3c8 EFLAGS: 00000206
RAX: 000000000002a303 RBX: ffff8880281cb7e8 RCX: 0000000000000006
RDX: 0000000000000000 RSI: ffffffff8dbdc851 RDI: 0000000000000001
RBP: ffff8880281cb7e0 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff90851c17 R11: 0000000000000000 R12: ffff8880281cb7e8
R13: ffff8880281cb7e0 R14: ffffc900048cf678 R15: 000000000000000d
spin_unlock_irq include/linux/spinlock.h:401 [inline]
filemap_remove_folio+0x106/0x250 mm/filemap.c:254
truncate_inode_folio+0x49/0x70 mm/truncate.c:176
shmem_undo_range+0x376/0x1150 mm/shmem.c:1121
shmem_truncate_range mm/shmem.c:1237 [inline]
shmem_evict_inode+0x3a1/0xbe0 mm/shmem.c:1365
evict+0x3e6/0x920 fs/inode.c:810
iput_final fs/inode.c:1898 [inline]
iput fs/inode.c:1924 [inline]
iput+0x521/0x880 fs/inode.c:1910
dentry_unlink_inode+0x29c/0x480 fs/dcache.c:457
__dentry_kill+0x1d0/0x600 fs/dcache.c:660
dput.part.0+0x4b1/0x9b0 fs/dcache.c:902
dput+0x1f/0x30 fs/dcache.c:892
__fput+0x51c/0xb70 fs/file_table.c:473
task_work_run+0x150/0x240 kernel/task_work.c:227
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0xafb/0x2c30 kernel/exit.c:953
do_group_exit+0xd3/0x2a0 kernel/exit.c:1102
get_signal+0x2673/0x26d0 kernel/signal.c:3034
arch_do_signal_or_restart+0x8f/0x7d0 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218
do_syscall_64+0xda/0x260 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f36e0f8e969
Code: Unable to access opcode bytes at 0x7f36e0f8e93f.
RSP: 002b:00007f36dedf6038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: 0000000000010106 RBX: 00007f36e11b6080 RCX: 00007f36e0f8e969
RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000005
RBP: 00007f36e1010ab1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f36e11b6080 R15: 00007ffdf3fea2b8
The buggy address belongs to the variable:
binder_deferred_list+0x24/0x40
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1af86
flags: 0xfff00000002000(reserved|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000002000 ffffea00006be188 ffffea00006be188 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner info is not present (never set?)
Memory state around the buggy address:
ffffffff9af86a80: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9
ffffffff9af86b00: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9
>ffffffff9af86b80: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 00 f9 f9
^
ffffffff9af86c00: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
ffffffff9af86c80: 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9 f9
==================================================================
==================================================================
BUG: KASAN: global-out-of-bounds in __find_rr_leaf+0xbf1/0xe00 net/ipv6/route.c:846
Read of size 8 at addr ffffffff9af86c10 by task syz.3.1436/11985
CPU: 0 UID: 0 PID: 11985 Comm: syz.3.1436 Tainted: G B 6.15.0-rc4-syzkaller-00147-gebd297a2affa #0 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:408 [inline]
print_report+0xc3/0x670 mm/kasan/report.c:521
kasan_report+0xe0/0x110 mm/kasan/report.c:634
__find_rr_leaf+0xbf1/0xe00 net/ipv6/route.c:846
find_rr_leaf net/ipv6/route.c:899 [inline]
rt6_select net/ipv6/route.c:934 [inline]
fib6_table_lookup+0x7b3/0xa30 net/ipv6/route.c:2230
ip6_pol_route+0x1cc/0x1230 net/ipv6/route.c:2266
pol_lookup_func include/net/ip6_fib.h:616 [inline]
fib6_rule_lookup+0x536/0x720 net/ipv6/fib6_rules.c:120
ip6_route_input_lookup net/ipv6/route.c:2335 [inline]
ip6_route_input+0x662/0xc00 net/ipv6/route.c:2631
ip6_rcv_finish_core.constprop.0+0x1a0/0x5d0 net/ipv6/ip6_input.c:66
ip6_rcv_finish net/ipv6/ip6_input.c:77 [inline]
NF_HOOK include/linux/netfilter.h:314 [inline]
NF_HOOK include/linux/netfilter.h:308 [inline]
ipv6_rcv+0x1e8/0x680 net/ipv6/ip6_input.c:309
__netif_receive_skb_one_core+0x12d/0x1e0 net/core/dev.c:5887
__netif_receive_skb+0x1d/0x160 net/core/dev.c:6000
process_backlog+0x442/0x15e0 net/core/dev.c:6352
__napi_poll.constprop.0+0xba/0x550 net/core/dev.c:7324
napi_poll net/core/dev.c:7388 [inline]
net_rx_action+0xa97/0x1010 net/core/dev.c:7510
handle_softirqs+0x219/0x8e0 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:202
Code: 90 f3 0f 1e fa 53 48 8b 74 24 08 48 89 fb 48 83 c7 18 e8 4a 0f 2b f6 48 89 df e8 f2 62 2b f6 e8 fd fa 55 f6 fb bf 01 00 00 00 52 cf 1b f6 65 8b 05 8b a4 36 08 85 c0 74 06 5b e9 5c 45 a3 f5
RSP: 0018:ffffc900048cf3c8 EFLAGS: 00000206
RAX: 000000000002a303 RBX: ffff8880281cb7e8 RCX: 0000000000000006
RDX: 0000000000000000 RSI: ffffffff8dbdc851 RDI: 0000000000000001
RBP: ffff8880281cb7e0 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff90851c17 R11: 0000000000000000 R12: ffff8880281cb7e8
R13: ffff8880281cb7e0 R14: ffffc900048cf678 R15: 000000000000000d
spin_unlock_irq include/linux/spinlock.h:401 [inline]
filemap_remove_folio+0x106/0x250 mm/filemap.c:254
truncate_inode_folio+0x49/0x70 mm/truncate.c:176
shmem_undo_range+0x376/0x1150 mm/shmem.c:1121
shmem_truncate_range mm/shmem.c:1237 [inline]
shmem_evict_inode+0x3a1/0xbe0 mm/shmem.c:1365
evict+0x3e6/0x920 fs/inode.c:810
iput_final fs/inode.c:1898 [inline]
iput fs/inode.c:1924 [inline]
iput+0x521/0x880 fs/inode.c:1910
dentry_unlink_inode+0x29c/0x480 fs/dcache.c:457
__dentry_kill+0x1d0/0x600 fs/dcache.c:660
dput.part.0+0x4b1/0x9b0 fs/dcache.c:902
dput+0x1f/0x30 fs/dcache.c:892
__fput+0x51c/0xb70 fs/file_table.c:473
task_work_run+0x150/0x240 kernel/task_work.c:227
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0xafb/0x2c30 kernel/exit.c:953
do_group_exit+0xd3/0x2a0 kernel/exit.c:1102
get_signal+0x2673/0x26d0 kernel/signal.c:3034
arch_do_signal_or_restart+0x8f/0x7d0 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218
do_syscall_64+0xda/0x260 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f36e0f8e969
Code: Unable to access opcode bytes at 0x7f36e0f8e93f.
RSP: 002b:00007f36dedf6038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: 0000000000010106 RBX: 00007f36e11b6080 RCX: 00007f36e0f8e969
RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000005
RBP: 00007f36e1010ab1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f36e11b6080 R15: 00007ffdf3fea2b8
The buggy address belongs to the variable:
__key.0+0x30/0x40
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1af86
flags: 0xfff00000002000(reserved|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000002000 ffffea00006be188 ffffea00006be188 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner info is not present (never set?)
Memory state around the buggy address:
ffffffff9af86b00: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9
ffffffff9af86b80: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 00 f9 f9
>ffffffff9af86c00: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
^
ffffffff9af86c80: 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9 f9
ffffffff9af86d00: 00 00 f9 f9 f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9
==================================================================
==================================================================
BUG: KASAN: global-out-of-bounds in find_match+0xdbe/0x15d0 net/ipv6/route.c:778
Read of size 1 at addr ffffffff9af86c2f by task syz.3.1436/11985
CPU: 0 UID: 0 PID: 11985 Comm: syz.3.1436 Tainted: G B 6.15.0-rc4-syzkaller-00147-gebd297a2affa #0 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:408 [inline]
print_report+0xc3/0x670 mm/kasan/report.c:521
kasan_report+0xe0/0x110 mm/kasan/report.c:634
find_match+0xdbe/0x15d0 net/ipv6/route.c:778
__find_rr_leaf+0x140/0xe00 net/ipv6/route.c:869
find_rr_leaf net/ipv6/route.c:899 [inline]
rt6_select net/ipv6/route.c:934 [inline]
fib6_table_lookup+0x7b3/0xa30 net/ipv6/route.c:2230
ip6_pol_route+0x1cc/0x1230 net/ipv6/route.c:2266
pol_lookup_func include/net/ip6_fib.h:616 [inline]
fib6_rule_lookup+0x536/0x720 net/ipv6/fib6_rules.c:120
ip6_route_input_lookup net/ipv6/route.c:2335 [inline]
ip6_route_input+0x662/0xc00 net/ipv6/route.c:2631
ip6_rcv_finish_core.constprop.0+0x1a0/0x5d0 net/ipv6/ip6_input.c:66
ip6_rcv_finish net/ipv6/ip6_input.c:77 [inline]
NF_HOOK include/linux/netfilter.h:314 [inline]
NF_HOOK include/linux/netfilter.h:308 [inline]
ipv6_rcv+0x1e8/0x680 net/ipv6/ip6_input.c:309
__netif_receive_skb_one_core+0x12d/0x1e0 net/core/dev.c:5887
__netif_receive_skb+0x1d/0x160 net/core/dev.c:6000
process_backlog+0x442/0x15e0 net/core/dev.c:6352
__napi_poll.constprop.0+0xba/0x550 net/core/dev.c:7324
napi_poll net/core/dev.c:7388 [inline]
net_rx_action+0xa97/0x1010 net/core/dev.c:7510
handle_softirqs+0x219/0x8e0 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:202
Code: 90 f3 0f 1e fa 53 48 8b 74 24 08 48 89 fb 48 83 c7 18 e8 4a 0f 2b f6 48 89 df e8 f2 62 2b f6 e8 fd fa 55 f6 fb bf 01 00 00 00 52 cf 1b f6 65 8b 05 8b a4 36 08 85 c0 74 06 5b e9 5c 45 a3 f5
RSP: 0018:ffffc900048cf3c8 EFLAGS: 00000206
RAX: 000000000002a303 RBX: ffff8880281cb7e8 RCX: 0000000000000006
RDX: 0000000000000000 RSI: ffffffff8dbdc851 RDI: 0000000000000001
RBP: ffff8880281cb7e0 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff90851c17 R11: 0000000000000000 R12: ffff8880281cb7e8
R13: ffff8880281cb7e0 R14: ffffc900048cf678 R15: 000000000000000d
spin_unlock_irq include/linux/spinlock.h:401 [inline]
filemap_remove_folio+0x106/0x250 mm/filemap.c:254
truncate_inode_folio+0x49/0x70 mm/truncate.c:176
shmem_undo_range+0x376/0x1150 mm/shmem.c:1121
shmem_truncate_range mm/shmem.c:1237 [inline]
shmem_evict_inode+0x3a1/0xbe0 mm/shmem.c:1365
evict+0x3e6/0x920 fs/inode.c:810
iput_final fs/inode.c:1898 [inline]
iput fs/inode.c:1924 [inline]
iput+0x521/0x880 fs/inode.c:1910
dentry_unlink_inode+0x29c/0x480 fs/dcache.c:457
__dentry_kill+0x1d0/0x600 fs/dcache.c:660
dput.part.0+0x4b1/0x9b0 fs/dcache.c:902
dput+0x1f/0x30 fs/dcache.c:892
__fput+0x51c/0xb70 fs/file_table.c:473
task_work_run+0x150/0x240 kernel/task_work.c:227
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0xafb/0x2c30 kernel/exit.c:953
do_group_exit+0xd3/0x2a0 kernel/exit.c:1102
get_signal+0x2673/0x26d0 kernel/signal.c:3034
arch_do_signal_or_restart+0x8f/0x7d0 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218
do_syscall_64+0xda/0x260 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f36e0f8e969
Code: Unable to access opcode bytes at 0x7f36e0f8e93f.
RSP: 002b:00007f36dedf6038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: 0000000000010106 RBX: 00007f36e11b6080 RCX: 00007f36e0f8e969
RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000005
RBP: 00007f36e1010ab1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f36e11b6080 R15: 00007ffdf3fea2b8
The buggy address belongs to the variable:
binder_shrinker+0xf/0x40
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1af86
flags: 0xfff00000002000(reserved|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000002000 ffffea00006be188 ffffea00006be188 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner info is not present (never set?)
Memory state around the buggy address:
ffffffff9af86b00: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9
ffffffff9af86b80: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 00 f9 f9
>ffffffff9af86c00: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
^
ffffffff9af86c80: 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9 f9
ffffffff9af86d00: 00 00 f9 f9 f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9
==================================================================
==================================================================
BUG: KASAN: global-out-of-bounds in find_match+0x12ce/0x15d0 net/ipv6/route.c:781
Read of size 8 at addr ffffffff9af86c18 by task syz.3.1436/11985
CPU: 0 UID: 0 PID: 11985 Comm: syz.3.1436 Tainted: G B 6.15.0-rc4-syzkaller-00147-gebd297a2affa #0 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
Call Trace:
__dump_stack lib/dump_stack.c:94 [inline]
dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120
print_address_description mm/kasan/report.c:408 [inline]
print_report+0xc3/0x670 mm/kasan/report.c:521
kasan_report+0xe0/0x110 mm/kasan/report.c:634
find_match+0x12ce/0x15d0 net/ipv6/route.c:781
__find_rr_leaf+0x140/0xe00 net/ipv6/route.c:869
find_rr_leaf net/ipv6/route.c:899 [inline]
rt6_select net/ipv6/route.c:934 [inline]
fib6_table_lookup+0x7b3/0xa30 net/ipv6/route.c:2230
ip6_pol_route+0x1cc/0x1230 net/ipv6/route.c:2266
pol_lookup_func include/net/ip6_fib.h:616 [inline]
fib6_rule_lookup+0x536/0x720 net/ipv6/fib6_rules.c:120
ip6_route_input_lookup net/ipv6/route.c:2335 [inline]
ip6_route_input+0x662/0xc00 net/ipv6/route.c:2631
ip6_rcv_finish_core.constprop.0+0x1a0/0x5d0 net/ipv6/ip6_input.c:66
ip6_rcv_finish net/ipv6/ip6_input.c:77 [inline]
NF_HOOK include/linux/netfilter.h:314 [inline]
NF_HOOK include/linux/netfilter.h:308 [inline]
ipv6_rcv+0x1e8/0x680 net/ipv6/ip6_input.c:309
__netif_receive_skb_one_core+0x12d/0x1e0 net/core/dev.c:5887
__netif_receive_skb+0x1d/0x160 net/core/dev.c:6000
process_backlog+0x442/0x15e0 net/core/dev.c:6352
__napi_poll.constprop.0+0xba/0x550 net/core/dev.c:7324
napi_poll net/core/dev.c:7388 [inline]
net_rx_action+0xa97/0x1010 net/core/dev.c:7510
handle_softirqs+0x219/0x8e0 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:202
Code: 90 f3 0f 1e fa 53 48 8b 74 24 08 48 89 fb 48 83 c7 18 e8 4a 0f 2b f6 48 89 df e8 f2 62 2b f6 e8 fd fa 55 f6 fb bf 01 00 00 00 52 cf 1b f6 65 8b 05 8b a4 36 08 85 c0 74 06 5b e9 5c 45 a3 f5
RSP: 0018:ffffc900048cf3c8 EFLAGS: 00000206
RAX: 000000000002a303 RBX: ffff8880281cb7e8 RCX: 0000000000000006
RDX: 0000000000000000 RSI: ffffffff8dbdc851 RDI: 0000000000000001
RBP: ffff8880281cb7e0 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff90851c17 R11: 0000000000000000 R12: ffff8880281cb7e8
R13: ffff8880281cb7e0 R14: ffffc900048cf678 R15: 000000000000000d
spin_unlock_irq include/linux/spinlock.h:401 [inline]
filemap_remove_folio+0x106/0x250 mm/filemap.c:254
truncate_inode_folio+0x49/0x70 mm/truncate.c:176
shmem_undo_range+0x376/0x1150 mm/shmem.c:1121
shmem_truncate_range mm/shmem.c:1237 [inline]
shmem_evict_inode+0x3a1/0xbe0 mm/shmem.c:1365
evict+0x3e6/0x920 fs/inode.c:810
iput_final fs/inode.c:1898 [inline]
iput fs/inode.c:1924 [inline]
iput+0x521/0x880 fs/inode.c:1910
dentry_unlink_inode+0x29c/0x480 fs/dcache.c:457
__dentry_kill+0x1d0/0x600 fs/dcache.c:660
dput.part.0+0x4b1/0x9b0 fs/dcache.c:902
dput+0x1f/0x30 fs/dcache.c:892
__fput+0x51c/0xb70 fs/file_table.c:473
task_work_run+0x150/0x240 kernel/task_work.c:227
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0xafb/0x2c30 kernel/exit.c:953
do_group_exit+0xd3/0x2a0 kernel/exit.c:1102
get_signal+0x2673/0x26d0 kernel/signal.c:3034
arch_do_signal_or_restart+0x8f/0x7d0 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218
do_syscall_64+0xda/0x260 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f36e0f8e969
Code: Unable to access opcode bytes at 0x7f36e0f8e93f.
RSP: 002b:00007f36dedf6038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: 0000000000010106 RBX: 00007f36e11b6080 RCX: 00007f36e0f8e969
RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000005
RBP: 00007f36e1010ab1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f36e11b6080 R15: 00007ffdf3fea2b8
The buggy address belongs to the variable:
__key.0+0x38/0x40
The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1af86
flags: 0xfff00000002000(reserved|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000002000 ffffea00006be188 ffffea00006be188 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner info is not present (never set?)
Memory state around the buggy address:
ffffffff9af86b00: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9
ffffffff9af86b80: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 00 f9 f9
>ffffffff9af86c00: f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
^
ffffffff9af86c80: 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9 f9
ffffffff9af86d00: 00 00 f9 f9 f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9
==================================================================
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000018: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x00000000000000c0-0x00000000000000c7]
CPU: 0 UID: 0 PID: 11985 Comm: syz.3.1436 Tainted: G B 6.15.0-rc4-syzkaller-00147-gebd297a2affa #0 PREEMPT(full)
Tainted: [B]=BAD_PAGE
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
RIP: 0010:__in6_dev_get include/net/addrconf.h:347 [inline]
RIP: 0010:ip6_ignore_linkdown include/net/addrconf.h:443 [inline]
RIP: 0010:find_match+0x136/0x15d0 net/ipv6/route.c:781
Code: 48 c1 ea 03 80 3c 02 00 0f 85 ac 11 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 7d 00 49 8d bf c0 00 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 93 11 00 00 4d 8b bf c0 00 00 00 e8 b4 18 50 01
RSP: 0018:ffffc900000073a8 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: 0000000000000003 RCX: ffffffff817ad3af
RDX: 0000000000000018 RSI: ffffffff821f9507 RDI: 00000000000000c0
RBP: ffffc900000074b0 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 3d3d3d3d3d3d3d3d R12: ffffffff9af86c2f
R13: ffffffff9af86c18 R14: 1ffff92000000e84 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8881249e6000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f36dedd4f98 CR3: 000000006480d000 CR4: 0000000000350ef0
Call Trace:
__find_rr_leaf+0x140/0xe00 net/ipv6/route.c:869
find_rr_leaf net/ipv6/route.c:899 [inline]
rt6_select net/ipv6/route.c:934 [inline]
fib6_table_lookup+0x7b3/0xa30 net/ipv6/route.c:2230
ip6_pol_route+0x1cc/0x1230 net/ipv6/route.c:2266
pol_lookup_func include/net/ip6_fib.h:616 [inline]
fib6_rule_lookup+0x536/0x720 net/ipv6/fib6_rules.c:120
ip6_route_input_lookup net/ipv6/route.c:2335 [inline]
ip6_route_input+0x662/0xc00 net/ipv6/route.c:2631
ip6_rcv_finish_core.constprop.0+0x1a0/0x5d0 net/ipv6/ip6_input.c:66
ip6_rcv_finish net/ipv6/ip6_input.c:77 [inline]
NF_HOOK include/linux/netfilter.h:314 [inline]
NF_HOOK include/linux/netfilter.h:308 [inline]
ipv6_rcv+0x1e8/0x680 net/ipv6/ip6_input.c:309
__netif_receive_skb_one_core+0x12d/0x1e0 net/core/dev.c:5887
__netif_receive_skb+0x1d/0x160 net/core/dev.c:6000
process_backlog+0x442/0x15e0 net/core/dev.c:6352
__napi_poll.constprop.0+0xba/0x550 net/core/dev.c:7324
napi_poll net/core/dev.c:7388 [inline]
net_rx_action+0xa97/0x1010 net/core/dev.c:7510
handle_softirqs+0x219/0x8e0 kernel/softirq.c:579
__do_softirq kernel/softirq.c:613 [inline]
invoke_softirq kernel/softirq.c:453 [inline]
__irq_exit_rcu+0x109/0x170 kernel/softirq.c:680
irq_exit_rcu+0x9/0x30 kernel/softirq.c:696
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
sysvec_apic_timer_interrupt+0xa4/0xc0 arch/x86/kernel/apic/apic.c:1049
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x29/0x50 kernel/locking/spinlock.c:202
Code: 90 f3 0f 1e fa 53 48 8b 74 24 08 48 89 fb 48 83 c7 18 e8 4a 0f 2b f6 48 89 df e8 f2 62 2b f6 e8 fd fa 55 f6 fb bf 01 00 00 00 52 cf 1b f6 65 8b 05 8b a4 36 08 85 c0 74 06 5b e9 5c 45 a3 f5
RSP: 0018:ffffc900048cf3c8 EFLAGS: 00000206
RAX: 000000000002a303 RBX: ffff8880281cb7e8 RCX: 0000000000000006
RDX: 0000000000000000 RSI: ffffffff8dbdc851 RDI: 0000000000000001
RBP: ffff8880281cb7e0 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff90851c17 R11: 0000000000000000 R12: ffff8880281cb7e8
R13: ffff8880281cb7e0 R14: ffffc900048cf678 R15: 000000000000000d
spin_unlock_irq include/linux/spinlock.h:401 [inline]
filemap_remove_folio+0x106/0x250 mm/filemap.c:254
truncate_inode_folio+0x49/0x70 mm/truncate.c:176
shmem_undo_range+0x376/0x1150 mm/shmem.c:1121
shmem_truncate_range mm/shmem.c:1237 [inline]
shmem_evict_inode+0x3a1/0xbe0 mm/shmem.c:1365
evict+0x3e6/0x920 fs/inode.c:810
iput_final fs/inode.c:1898 [inline]
iput fs/inode.c:1924 [inline]
iput+0x521/0x880 fs/inode.c:1910
dentry_unlink_inode+0x29c/0x480 fs/dcache.c:457
__dentry_kill+0x1d0/0x600 fs/dcache.c:660
dput.part.0+0x4b1/0x9b0 fs/dcache.c:902
dput+0x1f/0x30 fs/dcache.c:892
__fput+0x51c/0xb70 fs/file_table.c:473
task_work_run+0x150/0x240 kernel/task_work.c:227
exit_task_work include/linux/task_work.h:40 [inline]
do_exit+0xafb/0x2c30 kernel/exit.c:953
do_group_exit+0xd3/0x2a0 kernel/exit.c:1102
get_signal+0x2673/0x26d0 kernel/signal.c:3034
arch_do_signal_or_restart+0x8f/0x7d0 arch/x86/kernel/signal.c:337
exit_to_user_mode_loop kernel/entry/common.c:111 [inline]
exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline]
__syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline]
syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218
do_syscall_64+0xda/0x260 arch/x86/entry/syscall_64.c:100
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f36e0f8e969
Code: Unable to access opcode bytes at 0x7f36e0f8e93f.
RSP: 002b:00007f36dedf6038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: 0000000000010106 RBX: 00007f36e11b6080 RCX: 00007f36e0f8e969
RDX: 0000000000010106 RSI: 00002000000000c0 RDI: 0000000000000005
RBP: 00007f36e1010ab1 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f36e11b6080 R15: 00007ffdf3fea2b8
Modules linked in:
---[ end trace 0000000000000000 ]---
RIP: 0010:__in6_dev_get include/net/addrconf.h:347 [inline]
RIP: 0010:ip6_ignore_linkdown include/net/addrconf.h:443 [inline]
RIP: 0010:find_match+0x136/0x15d0 net/ipv6/route.c:781
Code: 48 c1 ea 03 80 3c 02 00 0f 85 ac 11 00 00 48 b8 00 00 00 00 00 fc ff df 4d 8b 7d 00 49 8d bf c0 00 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 93 11 00 00 4d 8b bf c0 00 00 00 e8 b4 18 50 01
RSP: 0018:ffffc900000073a8 EFLAGS: 00010216
RAX: dffffc0000000000 RBX: 0000000000000003 RCX: ffffffff817ad3af
RDX: 0000000000000018 RSI: ffffffff821f9507 RDI: 00000000000000c0
RBP: ffffc900000074b0 R08: 0000000000000007 R09: 0000000000000000
R10: 0000000000000000 R11: 3d3d3d3d3d3d3d3d R12: ffffffff9af86c2f
R13: ffffffff9af86c18 R14: 1ffff92000000e84 R15: 0000000000000000
FS: 0000000000000000(0000) GS:ffff8881249e6000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f36dedd4f98 CR3: 000000006480d000 CR4: 0000000000350ef0
----------------
Code disassembly (best guess):
0: 90 nop
1: f3 0f 1e fa endbr64
5: 53 push %rbx
6: 48 8b 74 24 08 mov 0x8(%rsp),%rsi
b: 48 89 fb mov %rdi,%rbx
e: 48 83 c7 18 add $0x18,%rdi
12: e8 4a 0f 2b f6 call 0xf62b0f61
17: 48 89 df mov %rbx,%rdi
1a: e8 f2 62 2b f6 call 0xf62b6311
1f: e8 fd fa 55 f6 call 0xf655fb21
24: fb sti
25: bf 01 00 00 00 mov $0x1,%edi
* 2a: e8 52 cf 1b f6 call 0xf61bcf81 <-- trapping instruction
2f: 65 8b 05 8b a4 36 08 mov %gs:0x836a48b(%rip),%eax # 0x836a4c1
36: 85 c0 test %eax,%eax
38: 74 06 je 0x40
3a: 5b pop %rbx
3b: e9 5c 45 a3 f5 jmp 0xf5a3459c