netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 team0: left allmulticast mode team_slave_0: left allmulticast mode team_slave_1: left allmulticast mode team0: left promiscuous mode team_slave_0: left promiscuous mode team_slave_1: left promiscuous mode bridge0: port 3(team0) entered disabled state bridge_slave_1: left allmulticast mode bridge_slave_1: left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state bridge_slave_0: left allmulticast mode bridge_slave_0: left promiscuous mode bridge0: port 1(bridge_slave_0) entered disabled state bond0 (unregistering): (slave bond_slave_0): Releasing backup interface bond0 (unregistering): (slave bond_slave_1): Releasing backup interface bond0 (unregistering): Released all slaves hsr_slave_0: left promiscuous mode hsr_slave_1: left promiscuous mode batman_adv: batadv0: Interface deactivated: batadv_slave_0 batman_adv: batadv0: Removing interface: batadv_slave_0 batman_adv: batadv0: Interface deactivated: batadv_slave_1 batman_adv: batadv0: Removing interface: batadv_slave_1 veth1_macvtap: left promiscuous mode veth0_macvtap: left promiscuous mode veth1_vlan: left promiscuous mode veth0_vlan: left promiscuous mode ================================================================== BUG: KASAN: slab-out-of-bounds in __fib6_drop_pcpu_from.part.0+0x4bb/0x4f0 net/ipv6/ip6_fib.c:987 Read of size 8 at addr ffff88806f64df69 by task kworker/u32:5/1084 CPU: 1 PID: 1084 Comm: kworker/u32:5 Not tainted 6.10.0-rc3-syzkaller-00044-g2ccbdf43d5e7 #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.2-debian-1.16.2-1 04/01/2014 Workqueue: netns cleanup_net Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0xc3/0x620 mm/kasan/report.c:488 kasan_report+0xd9/0x110 mm/kasan/report.c:601 __fib6_drop_pcpu_from.part.0+0x4bb/0x4f0 net/ipv6/ip6_fib.c:987 __fib6_drop_pcpu_from net/ipv6/ip6_fib.c:1030 [inline] fib6_drop_pcpu_from net/ipv6/ip6_fib.c:1031 [inline] fib6_purge_rt+0x7ef/0x9f0 net/ipv6/ip6_fib.c:1042 fib6_del_route net/ipv6/ip6_fib.c:2002 [inline] fib6_del+0xa70/0x17b0 net/ipv6/ip6_fib.c:2047 fib6_clean_node+0x426/0x5b0 net/ipv6/ip6_fib.c:2209 fib6_walk_continue+0x44f/0x8d0 net/ipv6/ip6_fib.c:2131 fib6_walk+0x182/0x370 net/ipv6/ip6_fib.c:2179 fib6_clean_tree+0xd7/0x120 net/ipv6/ip6_fib.c:2259 __fib6_clean_all+0x100/0x2d0 net/ipv6/ip6_fib.c:2275 rt6_sync_down_dev net/ipv6/route.c:4908 [inline] rt6_disable_ip+0x7ed/0xa00 net/ipv6/route.c:4913 addrconf_ifdown.isra.0+0x117/0x1a70 net/ipv6/addrconf.c:3855 addrconf_notify+0x223/0x19e0 net/ipv6/addrconf.c:3778 notifier_call_chain+0xb9/0x410 kernel/notifier.c:93 call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:1992 call_netdevice_notifiers_extack net/core/dev.c:2030 [inline] call_netdevice_notifiers net/core/dev.c:2044 [inline] dev_close_many+0x333/0x6a0 net/core/dev.c:1585 unregister_netdevice_many_notify+0x46d/0x19f0 net/core/dev.c:11194 unregister_netdevice_many net/core/dev.c:11277 [inline] default_device_exit_batch+0x731/0x9b0 net/core/dev.c:11760 ops_exit_list+0x128/0x180 net/core/net_namespace.c:178 cleanup_net+0x5b7/0xbf0 net/core/net_namespace.c:640 process_one_work+0x958/0x1ad0 kernel/workqueue.c:3231 process_scheduled_works kernel/workqueue.c:3312 [inline] worker_thread+0x6c8/0xf70 kernel/workqueue.c:3393 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Allocated by task 5287: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:312 [inline] __kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:338 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook mm/slub.c:3941 [inline] slab_alloc_node mm/slub.c:4001 [inline] kmem_cache_alloc_noprof+0x121/0x2f0 mm/slub.c:4008 dst_alloc+0x99/0x1a0 net/core/dst.c:89 ip6_dst_alloc+0x2c/0xa0 net/ipv6/route.c:344 ip6_rt_pcpu_alloc net/ipv6/route.c:1381 [inline] rt6_make_pcpu_route net/ipv6/route.c:1430 [inline] ip6_pol_route+0x956/0x1150 net/ipv6/route.c:2267 pol_lookup_func include/net/ip6_fib.h:616 [inline] fib6_rule_lookup+0x536/0x720 net/ipv6/fib6_rules.c:116 ip6_route_input_lookup net/ipv6/route.c:2300 [inline] ip6_route_input+0x60b/0xc10 net/ipv6/route.c:2596 ip6_rcv_finish_core.constprop.0+0x1a0/0x5d0 net/ipv6/ip6_input.c:66 ip6_rcv_finish net/ipv6/ip6_input.c:77 [inline] NF_HOOK include/linux/netfilter.h:314 [inline] NF_HOOK include/linux/netfilter.h:308 [inline] ipv6_rcv+0x1e4/0x680 net/ipv6/ip6_input.c:310 __netif_receive_skb_one_core+0x12e/0x1e0 net/core/dev.c:5625 __netif_receive_skb+0x1d/0x160 net/core/dev.c:5739 process_backlog+0x133/0x760 net/core/dev.c:6068 __napi_poll.constprop.0+0xb7/0x550 net/core/dev.c:6722 napi_poll net/core/dev.c:6791 [inline] net_rx_action+0x9b6/0xf10 net/core/dev.c:6907 handle_softirqs+0x216/0x8f0 kernel/softirq.c:554 do_softirq kernel/softirq.c:455 [inline] do_softirq+0xb2/0xf0 kernel/softirq.c:442 __local_bh_enable_ip+0x100/0x120 kernel/softirq.c:382 local_bh_enable include/linux/bottom_half.h:33 [inline] rcu_read_unlock_bh include/linux/rcupdate.h:851 [inline] __dev_queue_xmit+0x872/0x4130 net/core/dev.c:4420 dev_queue_xmit include/linux/netdevice.h:3095 [inline] neigh_resolve_output net/core/neighbour.c:1565 [inline] neigh_resolve_output+0x5bc/0x950 net/core/neighbour.c:1545 neigh_output include/net/neighbour.h:542 [inline] ip6_finish_output2+0x673/0x1880 net/ipv6/ip6_output.c:137 __ip6_finish_output net/ipv6/ip6_output.c:211 [inline] ip6_finish_output+0x3f9/0x1300 net/ipv6/ip6_output.c:222 NF_HOOK_COND include/linux/netfilter.h:303 [inline] ip6_output+0x1f8/0x540 net/ipv6/ip6_output.c:243 dst_output include/net/dst.h:450 [inline] NF_HOOK include/linux/netfilter.h:314 [inline] NF_HOOK include/linux/netfilter.h:308 [inline] mld_sendpack+0x9ee/0x11d0 net/ipv6/mcast.c:1818 mld_send_cr net/ipv6/mcast.c:2119 [inline] mld_ifc_work+0x756/0xce0 net/ipv6/mcast.c:2650 process_one_work+0x958/0x1ad0 kernel/workqueue.c:3231 process_scheduled_works kernel/workqueue.c:3312 [inline] worker_thread+0x6c8/0xf70 kernel/workqueue.c:3393 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 The buggy address belongs to the object at ffff88806f64de00 which belongs to the cache ip6_dst_cache of size 232 The buggy address is located 129 bytes to the right of allocated 232-byte region [ffff88806f64de00, ffff88806f64dee8) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88806f64c000 pfn:0x6f64c head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 memcg:ffff888064216c01 flags: 0x4fff00000000240(workingset|head|node=1|zone=1|lastcpupid=0x7ff) page_type: 0xffffefff(slab) raw: 04fff00000000240 ffff8880192a1e00 ffffea0001666890 ffffea0001751790 raw: ffff88806f64c000 0000000000190007 00000001ffffefff ffff888064216c01 head: 04fff00000000240 ffff8880192a1e00 ffffea0001666890 ffffea0001751790 head: ffff88806f64c000 0000000000190007 00000001ffffefff ffff888064216c01 head: 04fff00000000001 ffffea0001bd9301 ffffffffffffffff 0000000000000000 head: ffff888000000002 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 1, migratetype Unmovable, gfp_mask 0x152820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 5230, tgid 5230 (kworker/2:2), ts 169703398745, free_ts 169462793027 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1468 prep_new_page mm/page_alloc.c:1476 [inline] get_page_from_freelist+0x136a/0x2e50 mm/page_alloc.c:3420 __alloc_pages_noprof+0x22b/0x2460 mm/page_alloc.c:4678 __alloc_pages_node_noprof include/linux/gfp.h:269 [inline] alloc_pages_node_noprof include/linux/gfp.h:296 [inline] alloc_slab_page+0x56/0x110 mm/slub.c:2265 allocate_slab mm/slub.c:2428 [inline] new_slab+0x84/0x260 mm/slub.c:2481 ___slab_alloc+0xdac/0x1870 mm/slub.c:3667 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3757 __slab_alloc_node mm/slub.c:3810 [inline] slab_alloc_node mm/slub.c:3989 [inline] kmem_cache_alloc_noprof+0x2ae/0x2f0 mm/slub.c:4008 dst_alloc+0x99/0x1a0 net/core/dst.c:89 ip6_dst_alloc+0x2c/0xa0 net/ipv6/route.c:344 icmp6_dst_alloc+0x70/0x4a0 net/ipv6/route.c:3275 mld_sendpack+0x5a9/0x11d0 net/ipv6/mcast.c:1807 mld_send_cr net/ipv6/mcast.c:2119 [inline] mld_ifc_work+0x756/0xce0 net/ipv6/mcast.c:2650 process_one_work+0x958/0x1ad0 kernel/workqueue.c:3231 process_scheduled_works kernel/workqueue.c:3312 [inline] worker_thread+0x6c8/0xf70 kernel/workqueue.c:3393 kthread+0x2c1/0x3a0 kernel/kthread.c:389 page last free pid 6532 tgid 6532 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1088 [inline] free_unref_page+0x64a/0xe40 mm/page_alloc.c:2583 __put_partials+0x14c/0x170 mm/slub.c:2995 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x4e/0x140 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:322 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook mm/slub.c:3941 [inline] slab_alloc_node mm/slub.c:4001 [inline] __do_kmalloc_node mm/slub.c:4121 [inline] __kmalloc_node_noprof+0x1c7/0x450 mm/slub.c:4129 kmalloc_node_noprof include/linux/slab.h:681 [inline] qdisc_alloc+0xb3/0xbd0 net/sched/sch_generic.c:944 qdisc_create_dflt+0x73/0x440 net/sched/sch_generic.c:1006 attach_one_default_qdisc net/sched/sch_generic.c:1172 [inline] netdev_for_each_tx_queue include/linux/netdevice.h:2504 [inline] attach_default_qdiscs net/sched/sch_generic.c:1190 [inline] dev_activate+0x667/0x1310 net/sched/sch_generic.c:1249 __dev_open+0x396/0x4e0 net/core/dev.c:1481 __dev_change_flags+0x561/0x720 net/core/dev.c:8781 dev_change_flags+0x8f/0x160 net/core/dev.c:8853 do_setlink+0x19a6/0x3ea0 net/core/rtnetlink.c:2900 __rtnl_newlink+0xc3a/0x1960 net/core/rtnetlink.c:3696 rtnl_newlink+0x67/0xa0 net/core/rtnetlink.c:3743 rtnetlink_rcv_msg+0x3c7/0xea0 net/core/rtnetlink.c:6635 Memory state around the buggy address: ffff88806f64de00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff88806f64de80: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc >ffff88806f64df00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff88806f64df80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88806f64e000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ==================================================================