==================================================================
BUG: KASAN: use-after-free in batadv_iv_ogm_schedule+0xd63/0xe90 net/batman-adv/bat_iv_ogm.c:776
Write of size 2 at addr ffff888098c2b816 by task kworker/u4:0/7

CPU: 1 PID: 7 Comm: kworker/u4:0 Not tainted 5.2.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x113/0x167 lib/dump_stack.c:113
 print_address_description.cold.5+0x9/0x1ff mm/kasan/report.c:188
 __kasan_report.cold.6+0x1b/0x39 mm/kasan/report.c:317
 kasan_report+0x12/0x20 mm/kasan/common.c:614
 __asan_report_store2_noabort+0x17/0x20 mm/kasan/generic_report.c:135
 batadv_iv_ogm_schedule+0xd63/0xe90 net/batman-adv/bat_iv_ogm.c:776
 batadv_iv_send_outstanding_bat_ogm_packet+0x4a2/0x790 net/batman-adv/bat_iv_ogm.c:1669
 process_one_work+0x830/0x16a0 kernel/workqueue.c:2269
 worker_thread+0x85/0xb60 kernel/workqueue.c:2415
 kthread+0x324/0x3e0 kernel/kthread.c:255
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

Allocated by task 7611:
 save_stack+0x21/0x90 mm/kasan/common.c:71
 set_track mm/kasan/common.c:79 [inline]
 __kasan_kmalloc.constprop.12+0xc7/0xd0 mm/kasan/common.c:489
 kasan_kmalloc+0x9/0x10 mm/kasan/common.c:503
 kmem_cache_alloc_trace+0x154/0x740 mm/slab.c:3555
 kmalloc include/linux/slab.h:547 [inline]
 batadv_iv_ogm_iface_enable+0x11c/0x370 net/batman-adv/bat_iv_ogm.c:201
 batadv_hardif_enable_interface+0x20d/0x8f0 net/batman-adv/hard-interface.c:760
 batadv_softif_slave_add+0x7f/0xd0 net/batman-adv/soft-interface.c:896
 do_set_master+0x171/0x200 net/core/rtnetlink.c:2360
 do_setlink+0x95a/0x2db0 net/core/rtnetlink.c:2495
 __rtnl_newlink+0xa57/0x13f0 net/core/rtnetlink.c:3120
 rtnl_newlink+0x61/0x90 net/core/rtnetlink.c:3245
 rtnetlink_rcv_msg+0x34f/0x8f0 net/core/rtnetlink.c:5214
 netlink_rcv_skb+0x13c/0x380 net/netlink/af_netlink.c:2482
 rtnetlink_rcv+0x10/0x20 net/core/rtnetlink.c:5232
 netlink_unicast_kernel net/netlink/af_netlink.c:1307 [inline]
 netlink_unicast+0x43b/0x640 net/netlink/af_netlink.c:1333
 netlink_sendmsg+0x765/0xc40 net/netlink/af_netlink.c:1922
 sock_sendmsg_nosec net/socket.c:646 [inline]
 sock_sendmsg+0xb5/0xf0 net/socket.c:665
 __sys_sendto+0x1f2/0x2e0 net/socket.c:1958
 __do_compat_sys_socketcall net/compat.c:770 [inline]
 __se_compat_sys_socketcall net/compat.c:718 [inline]
 __ia32_compat_sys_socketcall+0x473/0x610 net/compat.c:718
 do_syscall_32_irqs_on arch/x86/entry/common.c:337 [inline]
 do_fast_syscall_32+0x235/0xb05 arch/x86/entry/common.c:408
 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139

Freed by task 2625:
 save_stack+0x21/0x90 mm/kasan/common.c:71
 set_track mm/kasan/common.c:79 [inline]
 __kasan_slab_free+0x102/0x150 mm/kasan/common.c:451
 kasan_slab_free+0xe/0x10 mm/kasan/common.c:459
 __cache_free mm/slab.c:3432 [inline]
 kfree+0xcf/0x220 mm/slab.c:3755
 batadv_iv_ogm_iface_disable+0x34/0x70 net/batman-adv/bat_iv_ogm.c:220
 batadv_hardif_disable_interface.cold.23+0x5a8/0xc32 net/batman-adv/hard-interface.c:874
 batadv_softif_destroy_netlink+0x98/0x110 net/batman-adv/soft-interface.c:1150
 default_device_exit_batch+0x239/0x3d0 net/core/dev.c:9778
 ops_exit_list.isra.5+0xd3/0x120 net/core/net_namespace.c:157
 cleanup_net+0x363/0x850 net/core/net_namespace.c:553
 process_one_work+0x830/0x16a0 kernel/workqueue.c:2269
 worker_thread+0x85/0xb60 kernel/workqueue.c:2415
 kthread+0x324/0x3e0 kernel/kthread.c:255
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352

The buggy address belongs to the object at ffff888098c2b800
 which belongs to the cache kmalloc-32 of size 32
The buggy address is located 22 bytes inside of
 32-byte region [ffff888098c2b800, ffff888098c2b820)
The buggy address belongs to the page:
page:ffffea0002630ac0 refcount:1 mapcount:0 mapping:ffff8880aa4001c0 index:0xffff888098c2bfc1
flags: 0xfffe0000000200(slab)
raw: 00fffe0000000200 ffffea00027949c8 ffffea00026daf08 ffff8880aa4001c0
raw: ffff888098c2bfc1 ffff888098c2b000 000000010000003e 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff888098c2b700: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
 ffff888098c2b780: 00 04 fc fc fc fc fc fc 00 03 fc fc fc fc fc fc
>ffff888098c2b800: fb fb fb fb fc fc fc fc 00 06 fc fc fc fc fc fc
                         ^
 ffff888098c2b880: 00 00 05 fc fc fc fc fc fb fb fb fb fc fc fc fc
 ffff888098c2b900: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
==================================================================