UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2020/09/19 18:44 (1000)
team0: Port device vlan2 added
gfs2: gfs2 mount does not exist
==================================================================
BUG: KASAN: use-after-free in br_dev_xmit+0x12b3/0x13e0 net/bridge/br_device.c:68
Read of size 2 at addr ffff88809577494e by task syz-fuzzer/8068

CPU: 0 PID: 8068 Comm: syz-fuzzer Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
 print_address_description.cold+0x54/0x219 mm/kasan/report.c:256
 kasan_report_error.cold+0x8a/0x1b9 mm/kasan/report.c:354
 kasan_report mm/kasan/report.c:412 [inline]
 __asan_report_load_n_noabort+0x8b/0xa0 mm/kasan/report.c:443
 br_dev_xmit+0x12b3/0x13e0 net/bridge/br_device.c:68
 __netdev_start_xmit include/linux/netdevice.h:4349 [inline]
 netdev_start_xmit include/linux/netdevice.h:4363 [inline]
 xmit_one net/core/dev.c:3256 [inline]
 dev_hard_start_xmit+0x1a8/0x920 net/core/dev.c:3272
 __dev_queue_xmit+0x269d/0x2e00 net/core/dev.c:3838
 vlan_dev_hard_start_xmit+0x38f/0x800 net/8021q/vlan_dev.c:131
 __netdev_start_xmit include/linux/netdevice.h:4349 [inline]
 netdev_start_xmit include/linux/netdevice.h:4363 [inline]
 xmit_one net/core/dev.c:3256 [inline]
 dev_hard_start_xmit+0x1a8/0x920 net/core/dev.c:3272
 __dev_queue_xmit+0x269d/0x2e00 net/core/dev.c:3838
 neigh_connected_output+0x3e8/0x5e0 net/core/neighbour.c:1403
 neigh_output include/net/neighbour.h:501 [inline]
 ip6_finish_output2+0x113d/0x2290 net/ipv6/ip6_output.c:120
 ip6_finish_output+0x89b/0x10f0 net/ipv6/ip6_output.c:192
 NF_HOOK_COND include/linux/netfilter.h:278 [inline]
 ip6_output+0x205/0x770 net/ipv6/ip6_output.c:209
 dst_output include/net/dst.h:455 [inline]
 NF_HOOK include/linux/netfilter.h:289 [inline]
 mld_sendpack+0x674/0x1060 net/ipv6/mcast.c:1681
 mld_send_cr net/ipv6/mcast.c:1977 [inline]
 mld_ifc_timer_expire+0x616/0xdf0 net/ipv6/mcast.c:2476
 call_timer_fn+0x177/0x700 kernel/time/timer.c:1338
 expire_timers+0x243/0x4e0 kernel/time/timer.c:1375
 __run_timers kernel/time/timer.c:1696 [inline]
 run_timer_softirq+0x21c/0x670 kernel/time/timer.c:1709
 __do_softirq+0x265/0x980 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:372 [inline]
 irq_exit+0x215/0x260 kernel/softirq.c:412
 exiting_irq arch/x86/include/asm/apic.h:536 [inline]
 smp_apic_timer_interrupt+0x136/0x550 arch/x86/kernel/apic/apic.c:1098
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
 </IRQ>
RIP: 0033:0x4d1caa
Code: 85 db 0f 8e a0 00 00 00 8d 4b ff 85 cb 74 40 48 89 44 24 28 89 5c 24 30 48 8b 08 48 89 c2 b8 00 00 00 80 48 89 d6 31 d2 f7 f3 <89> 54 24 14 90 48 8b 46 08 48 8b 49 18 ff d1 8b 4c 24 14 81 c1 01
RSP: 002b:000000c001a86b20 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: 00000000000429e5 RBX: 0000000000001ebe RCX: 00000000008a84c8
RDX: 000000000000120a RSI: 000000c0080135c0 RDI: 0000000000001ebc
RBP: 000000c001a86b38 R08: 00007f3d07009108 R09: 0000000000000000
R10: 00007f3cddf09b40 R11: 0000000000000001 R12: 000000c029e4e000
R13: 0000000000000000 R14: 000000c000001a00 R15: 0000000000ac4120

Allocated by task 8068:
 __do_kmalloc_node mm/slab.c:3689 [inline]
 __kmalloc_node_track_caller+0x4c/0x70 mm/slab.c:3703
 __kmalloc_reserve net/core/skbuff.c:137 [inline]
 __alloc_skb+0xae/0x560 net/core/skbuff.c:205
 alloc_skb include/linux/skbuff.h:995 [inline]
 alloc_skb_with_frags+0x92/0x570 net/core/skbuff.c:5333
 sock_alloc_send_pskb+0x6e1/0x830 net/core/sock.c:2108
 mld_newpack+0x1d2/0x760 net/ipv6/mcast.c:1609
 add_grhead+0x265/0x330 net/ipv6/mcast.c:1712
 add_grec+0xe3c/0x10b0 net/ipv6/mcast.c:1843
 mld_send_cr net/ipv6/mcast.c:1969 [inline]
 mld_ifc_timer_expire+0x5a2/0xdf0 net/ipv6/mcast.c:2476
 call_timer_fn+0x177/0x700 kernel/time/timer.c:1338
 expire_timers+0x243/0x4e0 kernel/time/timer.c:1375
 __run_timers kernel/time/timer.c:1696 [inline]
 run_timer_softirq+0x21c/0x670 kernel/time/timer.c:1709
 __do_softirq+0x265/0x980 kernel/softirq.c:292

Freed by task 8068:
 __cache_free mm/slab.c:3503 [inline]
 kfree+0xcc/0x210 mm/slab.c:3822
 skb_free_head net/core/skbuff.c:563 [inline]
 pskb_expand_head+0x327/0xf20 net/core/skbuff.c:1506
 __skb_cow include/linux/skbuff.h:2977 [inline]
 skb_cow_head include/linux/skbuff.h:3011 [inline]
 __vlan_insert_inner_tag include/linux/if_vlan.h:346 [inline]
 vlan_insert_inner_tag include/linux/if_vlan.h:416 [inline]
 vlan_insert_tag include/linux/if_vlan.h:441 [inline]
 vlan_insert_tag_set_proto include/linux/if_vlan.h:460 [inline]
 __allowed_ingress net/bridge/br_vlan.c:437 [inline]
 br_allowed_ingress+0x376/0xed0 net/bridge/br_vlan.c:514
 br_dev_xmit+0x3e5/0x13e0 net/bridge/br_device.c:64
 __netdev_start_xmit include/linux/netdevice.h:4349 [inline]
 netdev_start_xmit include/linux/netdevice.h:4363 [inline]
 xmit_one net/core/dev.c:3256 [inline]
 dev_hard_start_xmit+0x1a8/0x920 net/core/dev.c:3272
 __dev_queue_xmit+0x269d/0x2e00 net/core/dev.c:3838
 vlan_dev_hard_start_xmit+0x38f/0x800 net/8021q/vlan_dev.c:131
 __netdev_start_xmit include/linux/netdevice.h:4349 [inline]
 netdev_start_xmit include/linux/netdevice.h:4363 [inline]
 xmit_one net/core/dev.c:3256 [inline]
 dev_hard_start_xmit+0x1a8/0x920 net/core/dev.c:3272
 __dev_queue_xmit+0x269d/0x2e00 net/core/dev.c:3838
 neigh_connected_output+0x3e8/0x5e0 net/core/neighbour.c:1403
 neigh_output include/net/neighbour.h:501 [inline]
 ip6_finish_output2+0x113d/0x2290 net/ipv6/ip6_output.c:120
 ip6_finish_output+0x89b/0x10f0 net/ipv6/ip6_output.c:192
 NF_HOOK_COND include/linux/netfilter.h:278 [inline]
 ip6_output+0x205/0x770 net/ipv6/ip6_output.c:209
 dst_output include/net/dst.h:455 [inline]
 NF_HOOK include/linux/netfilter.h:289 [inline]
 mld_sendpack+0x674/0x1060 net/ipv6/mcast.c:1681
 mld_send_cr net/ipv6/mcast.c:1977 [inline]
 mld_ifc_timer_expire+0x616/0xdf0 net/ipv6/mcast.c:2476
 call_timer_fn+0x177/0x700 kernel/time/timer.c:1338
 expire_timers+0x243/0x4e0 kernel/time/timer.c:1375
 __run_timers kernel/time/timer.c:1696 [inline]
 run_timer_softirq+0x21c/0x670 kernel/time/timer.c:1709
 __do_softirq+0x265/0x980 kernel/softirq.c:292

The buggy address belongs to the object at ffff888095774940
 which belongs to the cache kmalloc-2048 of size 2048
The buggy address is located 14 bytes inside of
 2048-byte region [ffff888095774940, ffff888095775140)
The buggy address belongs to the page:
page:ffffea000255dd00 count:1 mapcount:0 mapping:ffff88813bff0c40 index:0x0 compound_mapcount: 0
flags: 0xfff00000008100(slab|head)
raw: 00fff00000008100 ffffea0002bc3a88 ffff88813bff1948 ffff88813bff0c40
raw: 0000000000000000 ffff8880957740c0 0000000100000003 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff888095774800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888095774880: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888095774900: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
                                              ^
 ffff888095774980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888095774a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================