batman_adv: batadv0: Removing interface: batadv_slave_1 ================================================================== device bridge_slave_1 left promiscuous mode bridge0: port 2(bridge_slave_1) entered disabled state BUG: KASAN: null-ptr-deref on address (null) Read of size 24 by task kworker/u4:6/7850 CPU: 1 PID: 7850 Comm: kworker/u4:6 Not tainted 4.8.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet 1ffffffff0dd62ce ffff880122c47998 ffffffff82d072c6 ffff880122c47a28 ffff8801113f7780 0000000000000000 ffff8801228d1150 ffff880122c47a18 ffffffff817583aa ffff8801113f7780 0000000000000286 ffff88012333e580 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xe6/0x120 lib/dump_stack.c:51 [] kasan_report_error+0x3da/0x490 mm/kasan/report.c:280 [] kasan_report+0x34/0x40 mm/kasan/report.c:303 [] ? batadv_tvlv_realloc_packet_buff net/batman-adv/tvlv.c:289 [inline] [] ? batadv_tvlv_container_ogm_append+0x158/0x470 net/batman-adv/tvlv.c:324 [] check_memory_region_inline mm/kasan/kasan.c:285 [inline] [] check_memory_region+0x13d/0x1a0 mm/kasan/kasan.c:299 [] memcpy+0x23/0x50 mm/kasan/kasan.c:334 [] batadv_tvlv_realloc_packet_buff net/batman-adv/tvlv.c:289 [inline] [] batadv_tvlv_container_ogm_append+0x158/0x470 net/batman-adv/tvlv.c:324 [] batadv_iv_ogm_schedule+0xa30/0xcc0 net/batman-adv/bat_iv_ogm.c:967 [] ? batadv_iv_ogm_schedule+0x89/0xcc0 net/batman-adv/bat_iv_ogm.c:957 [] ? __local_bh_enable_ip+0xa7/0x1a0 kernel/softirq.c:175 [] ? __trace_hardirqs_on_caller kernel/locking/lockdep.c:2686 [inline] [] ? trace_hardirqs_on_caller+0x44c/0x5e0 kernel/locking/lockdep.c:2733 [] ? spin_unlock_bh include/linux/spinlock.h:352 [inline] [] ? batadv_iv_send_outstanding_bat_ogm_packet+0x12a/0xbd0 net/batman-adv/bat_iv_ogm.c:1813 [] ? trace_hardirqs_on+0xd/0x10 kernel/locking/lockdep.c:2740 [] ? __local_bh_enable_ip+0xa7/0x1a0 kernel/softirq.c:175 [] batadv_iv_send_outstanding_bat_ogm_packet+0x2d0/0xbd0 net/batman-adv/bat_iv_ogm.c:1830 [] process_one_work+0x6a2/0x1580 kernel/workqueue.c:2096 [] ? process_one_work+0x5fc/0x1580 kernel/workqueue.c:2093 [] ? cancel_delayed_work_sync+0x10/0x10 kernel/workqueue.c:3024 [] worker_thread+0xd7/0xf10 kernel/workqueue.c:2230 [] ? context_switch kernel/sched/core.c:2867 [inline] [] ? __schedule+0x92e/0x1c80 kernel/sched/core.c:3376 [] ? ___preempt_schedule+0x16/0x18 [] ? process_one_work+0x1580/0x1580 include/linux/compiler.h:220 [] kthread+0x209/0x2d0 kernel/kthread.c:209 [] ? kthread_create_on_node+0x390/0x390 kernel/kthread.c:285 [] ret_from_fork+0x1f/0x40 arch/x86/entry/entry_64.S:393 [] ? kthread_create_on_node+0x390/0x390 kernel/kthread.c:285 ================================================================== BUG: unable to handle kernel NULL pointer dereference at (null) IP: [] memcpy_erms+0x6/0x10 arch/x86/lib/memcpy_64.S:51 PGD 114d43067 PUD 11544f067 PMD 0 Oops: 0000 [#1] PREEMPT SMP KASAN Modules linked in: CPU: 1 PID: 7850 Comm: kworker/u4:6 Tainted: G B 4.8.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet task: ffff88012333e580 task.stack: ffff880122c40000 RIP: 0010:[] [] memcpy_erms+0x6/0x10 arch/x86/lib/memcpy_64.S:51 RSP: 0018:ffff880122c47a78 EFLAGS: 00010246 RAX: ffff8801113f7780 RBX: 0000000000000018 RCX: 0000000000000018 RDX: 0000000000000018 RSI: 0000000000000000 RDI: ffff8801113f7780 RBP: ffff880122c47a98 R08: ffffed002227eef3 R09: ffffed002227eef3 R10: 0000000000000003 R11: ffffed002227eef2 R12: ffff8801113f7780 R13: 0000000000000000 R14: ffff8801228d1150 R15: 0000000000000024 FS: 0000000000000000(0000) GS:ffff88012c100000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000000112988000 CR4: 00000000001406e0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Stack: ffffffff817576e5 0000000000000018 ffff88010e2fe700 ffff8801228d1148 ffff880122c47af8 ffffffff85cc6338 ffff88010e2fef28 0000000000000000 ffff8801113f7780 ffff88010000003c ffff88010e2fef38 ffff88010e2fe700 Call Trace: [] ? memcpy+0x45/0x50 mm/kasan/kasan.c:337 [] batadv_tvlv_realloc_packet_buff net/batman-adv/tvlv.c:289 [inline] [] batadv_tvlv_container_ogm_append+0x158/0x470 net/batman-adv/tvlv.c:324 [] batadv_iv_ogm_schedule+0xa30/0xcc0 net/batman-adv/bat_iv_ogm.c:967 [] ? batadv_iv_ogm_schedule+0x89/0xcc0 net/batman-adv/bat_iv_ogm.c:957 [] ? __local_bh_enable_ip+0xa7/0x1a0 kernel/softirq.c:175 [] ? __trace_hardirqs_on_caller kernel/locking/lockdep.c:2686 [inline] [] ? trace_hardirqs_on_caller+0x44c/0x5e0 kernel/locking/lockdep.c:2733 [] ? spin_unlock_bh include/linux/spinlock.h:352 [inline] [] ? batadv_iv_send_outstanding_bat_ogm_packet+0x12a/0xbd0 net/batman-adv/bat_iv_ogm.c:1813 [] ? trace_hardirqs_on+0xd/0x10 kernel/locking/lockdep.c:2740 [] ? __local_bh_enable_ip+0xa7/0x1a0 kernel/softirq.c:175 [] batadv_iv_send_outstanding_bat_ogm_packet+0x2d0/0xbd0 net/batman-adv/bat_iv_ogm.c:1830 [] process_one_work+0x6a2/0x1580 kernel/workqueue.c:2096 [] ? process_one_work+0x5fc/0x1580 kernel/workqueue.c:2093 [] ? cancel_delayed_work_sync+0x10/0x10 kernel/workqueue.c:3024 [] worker_thread+0xd7/0xf10 kernel/workqueue.c:2230 [] ? context_switch kernel/sched/core.c:2867 [inline] [] ? __schedule+0x92e/0x1c80 kernel/sched/core.c:3376 [] ? ___preempt_schedule+0x16/0x18 [] ? process_one_work+0x1580/0x1580 include/linux/compiler.h:220 [] kthread+0x209/0x2d0 kernel/kthread.c:209 [] ? kthread_create_on_node+0x390/0x390 kernel/kthread.c:285 [] ret_from_fork+0x1f/0x40 arch/x86/entry/entry_64.S:393 [] ? kthread_create_on_node+0x390/0x390 kernel/kthread.c:285 Code: ff ff ff 90 90 eb 1e 0f 1f 00 48 89 f8 48 89 d1 48 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 c3 66 0f 1f 44 00 00 48 89 f8 48 89 d1 a4 c3 0f 1f 80 00 00 00 00 48 89 f8 48 83 fa 20 72 7e 40 38 RIP [] memcpy_erms+0x6/0x10 arch/x86/lib/memcpy_64.S:50 RSP CR2: 0000000000000000 ---[ end trace f38f76fa0dc17dbd ]---