================================================================== BUG: KASAN: use-after-free in __list_del_entry_valid+0xf1/0x100 lib/list_debug.c:51 Read of size 8 at addr ffff8881bafefd70 by task kworker/1:2/3433 binder: 11919:11920 ioctl c018620b 20000000 returned -14 CPU: 1 PID: 3433 Comm: kworker/1:2 Not tainted 4.20.0-rc6-next-20181210+ #164 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: events_power_efficient neigh_periodic_work Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x244/0x39d lib/dump_stack.c:113 print_address_description.cold.4+0x9/0x1ff mm/kasan/report.c:187 kasan_report.cold.5+0x1b/0x39 mm/kasan/report.c:317 __asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:135 __list_del_entry_valid+0xf1/0x100 lib/list_debug.c:51 __list_del_entry include/linux/list.h:117 [inline] list_del_init include/linux/list.h:159 [inline] neigh_mark_dead+0x13b/0x410 net/core/neighbour.c:125 neigh_periodic_work+0x89a/0xc30 net/core/neighbour.c:905 process_one_work+0xc90/0x1c40 kernel/workqueue.c:2153 binder: 11933:11934 ioctl c018620b 20000000 returned -14 worker_thread+0x17f/0x1390 kernel/workqueue.c:2296 kthread+0x35a/0x440 kernel/kthread.c:246 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352 Allocated by task 21: save_stack+0x43/0xd0 mm/kasan/common.c:73 set_track mm/kasan/common.c:85 [inline] kasan_kmalloc+0xcb/0xd0 mm/kasan/common.c:482 __do_kmalloc_node mm/slab.c:3671 [inline] __kmalloc_node_track_caller+0x4d/0x70 mm/slab.c:3685 __kmalloc_reserve.isra.38+0x41/0xe0 net/core/skbuff.c:137 __alloc_skb+0x155/0x770 net/core/skbuff.c:205 alloc_skb include/linux/skbuff.h:1008 [inline] nlmsg_new include/net/netlink.h:654 [inline] inet6_rt_notify+0x101/0x2c0 net/ipv6/route.c:4974 fib6_del_route net/ipv6/ip6_fib.c:1813 [inline] fib6_del+0xf1c/0x12e0 net/ipv6/ip6_fib.c:1840 fib6_clean_node+0x44c/0x650 net/ipv6/ip6_fib.c:2002 fib6_walk_continue+0x4b1/0x8e0 net/ipv6/ip6_fib.c:1924 fib6_walk+0x95/0xf0 net/ipv6/ip6_fib.c:1972 fib6_clean_tree+0x21c/0x420 net/ipv6/ip6_fib.c:2051 __fib6_clean_all+0x235/0x440 net/ipv6/ip6_fib.c:2067 fib6_clean_all+0x2a/0x40 net/ipv6/ip6_fib.c:2078 rt6_sync_down_dev+0x17a/0x1b0 net/ipv6/route.c:4039 rt6_disable_ip+0x87/0x720 net/ipv6/route.c:4044 addrconf_ifdown+0x168/0x1650 net/ipv6/addrconf.c:3669 addrconf_notify+0x6de/0x2770 net/ipv6/addrconf.c:3594 notifier_call_chain+0x17e/0x380 kernel/notifier.c:93 __raw_notifier_call_chain kernel/notifier.c:394 [inline] raw_notifier_call_chain+0x2d/0x40 kernel/notifier.c:401 call_netdevice_notifiers_info+0x3f/0x90 net/core/dev.c:1737 call_netdevice_notifiers_extack net/core/dev.c:1749 [inline] call_netdevice_notifiers net/core/dev.c:1763 [inline] dev_close_many+0x443/0x8b0 net/core/dev.c:1507 rollback_registered_many+0x543/0x1260 net/core/dev.c:8041 unregister_netdevice_many+0xfa/0x4c0 net/core/dev.c:9169 default_device_exit_batch+0x43a/0x540 net/core/dev.c:9638 ops_exit_list.isra.5+0x105/0x160 net/core/net_namespace.c:156 cleanup_net+0x555/0xb10 net/core/net_namespace.c:551 process_one_work+0xc90/0x1c40 kernel/workqueue.c:2153 worker_thread+0x17f/0x1390 kernel/workqueue.c:2296 kthread+0x35a/0x440 kernel/kthread.c:246 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352 Freed by task 21: save_stack+0x43/0xd0 mm/kasan/common.c:73 set_track mm/kasan/common.c:85 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/common.c:444 kasan_slab_free+0xe/0x10 mm/kasan/common.c:452 __cache_free mm/slab.c:3485 [inline] kfree+0xcf/0x230 mm/slab.c:3804 skb_free_head+0x99/0xc0 net/core/skbuff.c:550 skb_release_data+0x70c/0x9a0 net/core/skbuff.c:570 skb_release_all+0x4a/0x60 net/core/skbuff.c:627 __kfree_skb net/core/skbuff.c:641 [inline] consume_skb+0x1ae/0x570 net/core/skbuff.c:701 netlink_broadcast_filtered+0x6e6/0x1680 net/netlink/af_netlink.c:1512 netlink_broadcast net/netlink/af_netlink.c:1534 [inline] nlmsg_multicast include/net/netlink.h:734 [inline] nlmsg_notify+0xa0/0x1a0 net/netlink/af_netlink.c:2520 rtnl_notify+0xce/0xf0 net/core/rtnetlink.c:742 inet6_rt_notify+0x204/0x2c0 net/ipv6/route.c:4986 fib6_del_route net/ipv6/ip6_fib.c:1813 [inline] fib6_del+0xf1c/0x12e0 net/ipv6/ip6_fib.c:1840 fib6_clean_node+0x44c/0x650 net/ipv6/ip6_fib.c:2002 fib6_walk_continue+0x4b1/0x8e0 net/ipv6/ip6_fib.c:1924 fib6_walk+0x95/0xf0 net/ipv6/ip6_fib.c:1972 fib6_clean_tree+0x21c/0x420 net/ipv6/ip6_fib.c:2051 __fib6_clean_all+0x235/0x440 net/ipv6/ip6_fib.c:2067 fib6_clean_all+0x2a/0x40 net/ipv6/ip6_fib.c:2078 rt6_sync_down_dev+0x17a/0x1b0 net/ipv6/route.c:4039 rt6_disable_ip+0x87/0x720 net/ipv6/route.c:4044 addrconf_ifdown+0x168/0x1650 net/ipv6/addrconf.c:3669 addrconf_notify+0x6de/0x2770 net/ipv6/addrconf.c:3594 notifier_call_chain+0x17e/0x380 kernel/notifier.c:93 __raw_notifier_call_chain kernel/notifier.c:394 [inline] raw_notifier_call_chain+0x2d/0x40 kernel/notifier.c:401 call_netdevice_notifiers_info+0x3f/0x90 net/core/dev.c:1737 call_netdevice_notifiers_extack net/core/dev.c:1749 [inline] call_netdevice_notifiers net/core/dev.c:1763 [inline] dev_close_many+0x443/0x8b0 net/core/dev.c:1507 rollback_registered_many+0x543/0x1260 net/core/dev.c:8041 unregister_netdevice_many+0xfa/0x4c0 net/core/dev.c:9169 default_device_exit_batch+0x43a/0x540 net/core/dev.c:9638 ops_exit_list.isra.5+0x105/0x160 net/core/net_namespace.c:156 cleanup_net+0x555/0xb10 net/core/net_namespace.c:551 process_one_work+0xc90/0x1c40 kernel/workqueue.c:2153 worker_thread+0x17f/0x1390 kernel/workqueue.c:2296 kthread+0x35a/0x440 kernel/kthread.c:246 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:352 The buggy address belongs to the object at ffff8881bafefb00 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 624 bytes inside of 1024-byte region [ffff8881bafefb00, ffff8881bafeff00) The buggy address belongs to the page: page:ffffea0006ebfb80 count:1 mapcount:0 mapping:ffff8881da800ac0 index:0xffff8881bafefb00 compound_mapcount: 0 flags: 0x2fffc0000010200(slab|head) raw: 02fffc0000010200 ffffea0006f1c108 ffffea0006f7a188 ffff8881da800ac0 raw: ffff8881bafefb00 ffff8881bafee000 0000000100000005 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8881bafefc00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8881bafefc80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8881bafefd00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8881bafefd80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8881bafefe00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================