==================================================================
8021q: adding VLAN 0 to HW filter on device batadv2
BUG: KASAN: user-memory-access in atomic_add include/asm-generic/atomic-instrumented.h:143 [inline]
BUG: KASAN: user-memory-access in do_profile_hits.constprop.0+0x2ae/0x610 kernel/profile.c:324
Write of size 4 at addr 00000007fffc4414 by task syz-executor.2/8370

CPU: 1 PID: 8370 Comm: syz-executor.2 Not tainted 4.19.211-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
netlink: 'syz-executor.1': attribute type 5 has an invalid length.
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1fc/0x2ef lib/dump_stack.c:118
 kasan_report_error.cold+0x15b/0x1b9 mm/kasan/report.c:352
device dummy0 entered promiscuous mode
 kasan_report+0x8f/0xa0 mm/kasan/report.c:412
 atomic_add include/asm-generic/atomic-instrumented.h:143 [inline]
 do_profile_hits.constprop.0+0x2ae/0x610 kernel/profile.c:324
 profile_hits kernel/profile.c:398 [inline]
 profile_hit include/linux/profile.h:64 [inline]
 profile_tick+0xd7/0xf0 kernel/profile.c:408
device macvlan2 entered promiscuous mode
 tick_sched_timer+0xfc/0x290 kernel/time/tick-sched.c:1278
 __run_hrtimer kernel/time/hrtimer.c:1465 [inline]
 __hrtimer_run_queues+0x3f6/0xe60 kernel/time/hrtimer.c:1527
 hrtimer_interrupt+0x326/0x9e0 kernel/time/hrtimer.c:1585
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1071 [inline]
 smp_apic_timer_interrupt+0x10c/0x550 arch/x86/kernel/apic/apic.c:1096
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:894
IPv6: ADDRCONF(NETDEV_UP): macvlan2: link is not ready
 </IRQ>
RIP: 0010:__raw_spin_unlock_irq include/linux/spinlock_api_smp.h:169 [inline]
RIP: 0010:_raw_spin_unlock_irq+0x50/0x80 kernel/locking/spinlock.c:192
Code: c0 98 82 f1 89 48 ba 00 00 00 00 00 fc ff df 48 c1 e8 03 80 3c 10 00 75 31 48 83 3d 01 31 d8 01 00 74 25 fb 66 0f 1f 44 00 00 <bf> 01 00 00 00 e8 26 1b 28 f9 65 8b 05 9f 8d e8 77 85 c0 74 02 5d
RSP: 0018:ffff88804d8b7890 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff13e3053 RBX: ffff888093150340 RCX: 0000000000000000
RDX: dffffc0000000000 RSI: 0000000000000001 RDI: ffff888093150bc4
RBP: ffff8880ba12b0c0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff8880ba12b0c0
R13: ffff8880b4cde440 R14: 0000000000000000 R15: 0000000000000000
 finish_lock_switch kernel/sched/core.c:2578 [inline]
 finish_task_switch+0x146/0x760 kernel/sched/core.c:2678
 context_switch kernel/sched/core.c:2831 [inline]
 __schedule+0x88f/0x2040 kernel/sched/core.c:3517
 schedule+0x8d/0x1b0 kernel/sched/core.c:3561
 freezable_schedule include/linux/freezer.h:172 [inline]
 futex_wait_queue_me+0x2fc/0x5e0 kernel/futex.c:2722
 futex_wait+0x1ef/0x610 kernel/futex.c:2837
 do_futex+0x268/0x1880 kernel/futex.c:3889
 __do_sys_futex kernel/futex.c:3950 [inline]
 __se_sys_futex+0x28f/0x3b0 kernel/futex.c:3918
 do_syscall_64+0xf9/0x620 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f47f62bd049
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc6f913538 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: ffffffffffffffda RBX: 00007f47f63cff6c RCX: 00007f47f62bd049
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f47f63cff6c
RBP: 00007f47f63cff60 R08: 00000088ae6be76f R09: 0000000000000000
R10: 00007ffc6f913620 R11: 0000000000000246 R12: 0000000000081722
R13: 00007ffc6f913620 R14: 00007ffc6f913640 R15: 0000000000000032
==================================================================
----------------
Code disassembly (best guess), 5 bytes skipped:
   0:	48 ba 00 00 00 00 00 	movabs $0xdffffc0000000000,%rdx
   7:	fc ff df
   a:	48 c1 e8 03          	shr    $0x3,%rax
   e:	80 3c 10 00          	cmpb   $0x0,(%rax,%rdx,1)
  12:	75 31                	jne    0x45
  14:	48 83 3d 01 31 d8 01 	cmpq   $0x0,0x1d83101(%rip)        # 0x1d8311d
  1b:	00
  1c:	74 25                	je     0x43
  1e:	fb                   	sti
  1f:	66 0f 1f 44 00 00    	nopw   0x0(%rax,%rax,1)
* 25:	bf 01 00 00 00       	mov    $0x1,%edi <-- trapping instruction
  2a:	e8 26 1b 28 f9       	callq  0xf9281b55
  2f:	65 8b 05 9f 8d e8 77 	mov    %gs:0x77e88d9f(%rip),%eax        # 0x77e88dd5
  36:	85 c0                	test   %eax,%eax
  38:	74 02                	je     0x3c
  3a:	5d                   	pop    %rbp