==================================================================
BUG: KASAN: slab-use-after-free in rht_key_hashfn include/linux/rhashtable.h:159 [inline]
BUG: KASAN: slab-use-after-free in __rhashtable_lookup include/linux/rhashtable.h:604 [inline]
BUG: KASAN: slab-use-after-free in rhashtable_lookup include/linux/rhashtable.h:646 [inline]
BUG: KASAN: slab-use-after-free in rhashtable_lookup_fast+0x77a/0x9b0 include/linux/rhashtable.h:672
Read of size 4 at addr ffff88806d328008 by task dhcpcd-run-hook/8321

CPU: 0 PID: 8321 Comm: dhcpcd-run-hook Not tainted 6.10.0-rc7-syzkaller-00132-g503757c80928 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0x169/0x550 mm/kasan/report.c:488
 kasan_report+0x143/0x180 mm/kasan/report.c:601
 rht_key_hashfn include/linux/rhashtable.h:159 [inline]
 __rhashtable_lookup include/linux/rhashtable.h:604 [inline]
 rhashtable_lookup include/linux/rhashtable.h:646 [inline]
 rhashtable_lookup_fast+0x77a/0x9b0 include/linux/rhashtable.h:672
 ila_lookup_wildcards net/ipv6/ila/ila_xlat.c:132 [inline]
 ila_xlat_addr net/ipv6/ila/ila_xlat.c:652 [inline]
 ila_nf_input+0x1fe/0x3c0 net/ipv6/ila/ila_xlat.c:190
 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]
 nf_hook_slow+0xc3/0x220 net/netfilter/core.c:626
 nf_hook include/linux/netfilter.h:269 [inline]
 NF_HOOK+0x29e/0x450 include/linux/netfilter.h:312
 __netif_receive_skb_one_core net/core/dev.c:5625 [inline]
 __netif_receive_skb+0x1ea/0x650 net/core/dev.c:5739
 process_backlog+0x391/0x7d0 net/core/dev.c:6068
 __napi_poll+0xcb/0x490 net/core/dev.c:6722
 napi_poll net/core/dev.c:6791 [inline]
 net_rx_action+0x7bb/0x10a0 net/core/dev.c:6907
 handle_softirqs+0x2c4/0x970 kernel/softirq.c:554
 __do_softirq kernel/softirq.c:588 [inline]
 invoke_softirq kernel/softirq.c:428 [inline]
 __irq_exit_rcu+0xf4/0x1c0 kernel/softirq.c:637
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:649
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1043 [inline]
 sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1043
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0010:__sanitizer_cov_trace_switch+0x16/0x120 kernel/kcov.c:324
Code: 0f 1f 40 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 41 57 41 56 41 54 53 4c 8b 16 48 8b 46 08 48 83 c0 f8 <48> c1 c0 3d 48 83 f8 02 7f 1f 48 85 c0 74 3a 48 83 f8 01 0f 85 da
RSP: 0018:ffffc900096e72b8 EFLAGS: 00000207
RAX: 0000000000000018 RBX: 0000000000000001 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8e1a1400 RDI: 0000000000000001
RBP: ffffffff90302b22 R08: ffffc900096e747f R09: 0000000000000000
R10: 0000000000000003 R11: fffff520012dce90 R12: ffffc900096e7418
R13: dffffc0000000000 R14: ffffc900096e7470 R15: 1ffff920012dce84
 unwind_next_frame+0x196f/0x2a00 arch/x86/kernel/unwind_orc.c:641
 __unwind_start+0x641/0x7c0 arch/x86/kernel/unwind_orc.c:760
 unwind_start arch/x86/include/asm/unwind.h:64 [inline]
 arch_stack_walk+0x103/0x1b0 arch/x86/kernel/stacktrace.c:24
 stack_trace_save+0x118/0x1d0 kernel/stacktrace.c:122
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
 unpoison_slab_object mm/kasan/common.c:312 [inline]
 __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:338
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook mm/slub.c:3940 [inline]
 slab_alloc_node mm/slub.c:4002 [inline]
 kmem_cache_alloc_noprof+0x135/0x2a0 mm/slub.c:4009
 anon_vma_alloc mm/rmap.c:94 [inline]
 anon_vma_fork+0xe8/0x580 mm/rmap.c:360
 dup_mmap kernel/fork.c:714 [inline]
 dup_mm kernel/fork.c:1688 [inline]
 copy_mm+0xdf3/0x2020 kernel/fork.c:1737
 copy_process+0x187a/0x3dc0 kernel/fork.c:2390
 kernel_clone+0x226/0x8f0 kernel/fork.c:2797
 __do_sys_clone kernel/fork.c:2940 [inline]
 __se_sys_clone kernel/fork.c:2924 [inline]
 __x64_sys_clone+0x258/0x2a0 kernel/fork.c:2924
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f3f869d8a12
Code: 41 5d 41 5e 41 5f c3 64 48 8b 04 25 10 00 00 00 45 31 c0 31 d2 31 f6 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 76 10 48 8b 15 e7 43 0f 00 f7 d8 64 89 02 48 83
RSP: 002b:00007ffd3ee02d28 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 00005555fe02b901 RCX: 00007f3f869d8a12
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 00005555fe02cb70 R08: 0000000000000000 R09: 3c00000000001001
R10: 00007f3f8689e650 R11: 0000000000000246 R12: 00005555fe02f338
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
 </TASK>

Allocated by task 8327:
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
 unpoison_slab_object mm/kasan/common.c:312 [inline]
 __kasan_slab_alloc+0x66/0x80 mm/kasan/common.c:338
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook mm/slub.c:3940 [inline]
 slab_alloc_node mm/slub.c:4002 [inline]
 kmem_cache_alloc_noprof+0x135/0x2a0 mm/slub.c:4009
 getname_flags+0xbd/0x4f0 fs/namei.c:139
 getname fs/namei.c:218 [inline]
 __do_sys_symlinkat fs/namei.c:4537 [inline]
 __se_sys_symlinkat fs/namei.c:4534 [inline]
 __x64_sys_symlinkat+0x7c/0xb0 fs/namei.c:4534
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 8327:
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x3f/0x80 mm/kasan/common.c:68
 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579
 poison_slab_object+0xe0/0x150 mm/kasan/common.c:240
 __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256
 kasan_slab_free include/linux/kasan.h:184 [inline]
 slab_free_hook mm/slub.c:2196 [inline]
 slab_free mm/slub.c:4438 [inline]
 kmem_cache_free+0x145/0x350 mm/slub.c:4513
 do_symlinkat+0x354/0x3a0 fs/namei.c:4530
 __do_sys_symlinkat fs/namei.c:4537 [inline]
 __se_sys_symlinkat fs/namei.c:4534 [inline]
 __x64_sys_symlinkat+0x99/0xb0 fs/namei.c:4534
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff88806d328000
 which belongs to the cache names_cache of size 4096
The buggy address is located 8 bytes inside of
 freed 4096-byte region [ffff88806d328000, ffff88806d329000)

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6d328
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffefff(slab)
raw: 00fff00000000040 ffff888015eee780 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000070007 00000001ffffefff 0000000000000000
head: 00fff00000000040 ffff888015eee780 dead000000000122 0000000000000000
head: 0000000000000000 0000000000070007 00000001ffffefff 0000000000000000
head: 00fff00000000003 ffffea0001b4ca01 ffffffffffffffff 0000000000000000
head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 8327, tgid 8327 (syz-executor), ts 137711095842, free_ts 137708965139
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1473
 prep_new_page mm/page_alloc.c:1481 [inline]
 get_page_from_freelist+0x2e4c/0x2f10 mm/page_alloc.c:3425
 __alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4683
 __alloc_pages_node_noprof include/linux/gfp.h:269 [inline]
 alloc_pages_node_noprof include/linux/gfp.h:296 [inline]
 alloc_slab_page+0x5f/0x120 mm/slub.c:2265
 allocate_slab+0x5a/0x2f0 mm/slub.c:2428
 new_slab mm/slub.c:2481 [inline]
 ___slab_alloc+0xcd1/0x14b0 mm/slub.c:3667
 __slab_alloc+0x58/0xa0 mm/slub.c:3757
 __slab_alloc_node mm/slub.c:3810 [inline]
 slab_alloc_node mm/slub.c:3990 [inline]
 kmem_cache_alloc_noprof+0x1c1/0x2a0 mm/slub.c:4009
 getname_flags+0xbd/0x4f0 fs/namei.c:139
 getname fs/namei.c:218 [inline]
 __do_sys_symlinkat fs/namei.c:4537 [inline]
 __se_sys_symlinkat fs/namei.c:4534 [inline]
 __x64_sys_symlinkat+0x7c/0xb0 fs/namei.c:4534
 do_syscall_x64 arch/x86/entry/common.c:52 [inline]
 do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
page last free pid 2909 tgid 2909 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 free_pages_prepare mm/page_alloc.c:1093 [inline]
 free_unref_page+0xd22/0xea0 mm/page_alloc.c:2588
 __folio_put+0x3b9/0x620 mm/swap.c:129
 folio_put include/linux/mm.h:1513 [inline]
 free_large_kmalloc+0x105/0x1c0 mm/slub.c:4530
 kfree+0x1c4/0x360 mm/slub.c:4553
 rhashtable_free_and_destroy+0x7c6/0x920 lib/rhashtable.c:1169
 ila_xlat_exit_net+0x55/0x110 net/ipv6/ila/ila_xlat.c:626
 ops_exit_list net/core/net_namespace.c:173 [inline]
 cleanup_net+0x802/0xcc0 net/core/net_namespace.c:640
 process_one_work kernel/workqueue.c:3248 [inline]
 process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3329
 worker_thread+0x86d/0xd50 kernel/workqueue.c:3409
 kthread+0x2f0/0x390 kernel/kthread.c:389
 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244

Memory state around the buggy address:
 ffff88806d327f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88806d327f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88806d328000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                      ^
 ffff88806d328080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88806d328100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess):
   0:	0f 1f 40 00          	nopl   0x0(%rax)
   4:	90                   	nop
   5:	90                   	nop
   6:	90                   	nop
   7:	90                   	nop
   8:	90                   	nop
   9:	90                   	nop
   a:	90                   	nop
   b:	90                   	nop
   c:	90                   	nop
   d:	90                   	nop
   e:	90                   	nop
   f:	90                   	nop
  10:	90                   	nop
  11:	90                   	nop
  12:	90                   	nop
  13:	90                   	nop
  14:	f3 0f 1e fa          	endbr64
  18:	41 57                	push   %r15
  1a:	41 56                	push   %r14
  1c:	41 54                	push   %r12
  1e:	53                   	push   %rbx
  1f:	4c 8b 16             	mov    (%rsi),%r10
  22:	48 8b 46 08          	mov    0x8(%rsi),%rax
  26:	48 83 c0 f8          	add    $0xfffffffffffffff8,%rax
* 2a:	48 c1 c0 3d          	rol    $0x3d,%rax <-- trapping instruction
  2e:	48 83 f8 02          	cmp    $0x2,%rax
  32:	7f 1f                	jg     0x53
  34:	48 85 c0             	test   %rax,%rax
  37:	74 3a                	je     0x73
  39:	48 83 f8 01          	cmp    $0x1,%rax
  3d:	0f                   	.byte 0xf
  3e:	85 da                	test   %ebx,%edx