================================================================== BUG: KASAN: slab-out-of-bounds in __ipv6_addr_type+0x26c/0x290 net/ipv6/addrconf_core.c:68 Read of size 4 at addr ffff8801aa74d938 by task syz-executor.0/23698 CPU: 1 PID: 23698 Comm: syz-executor.0 Not tainted 4.4.174+ #4 0000000000000000 83dcccefd133ee8e ffff8801a2396da0 ffffffff81aad1a1 0000000000000000 ffffea0006a9d300 ffff8801aa74d938 0000000000000004 ffff8801aa74d680 ffff8801a2396dd8 ffffffff81490120 0000000000000000 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x120 lib/dump_stack.c:51 [] print_address_description+0x6f/0x21b mm/kasan/report.c:252 [] kasan_report_error mm/kasan/report.c:351 [inline] [] kasan_report mm/kasan/report.c:408 [inline] [] kasan_report.cold+0x8c/0x2be mm/kasan/report.c:393 [] __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:428 [] __ipv6_addr_type+0x26c/0x290 net/ipv6/addrconf_core.c:68 [] ipv6_addr_type include/net/ipv6.h:330 [inline] [] ip6_tnl_xmit2+0x2ac/0x2320 net/ipv6/ip6_tunnel.c:988 [] ip4ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1134 [inline] [] ip6_tnl_xmit+0xa09/0xe00 net/ipv6/ip6_tunnel.c:1212 [] __netdev_start_xmit include/linux/netdevice.h:3750 [inline] [] netdev_start_xmit include/linux/netdevice.h:3759 [inline] [] xmit_one net/core/dev.c:2781 [inline] [] dev_hard_start_xmit+0x7c1/0x11e0 net/core/dev.c:2797 [] __dev_queue_xmit+0x164b/0x1bb0 net/core/dev.c:3229 [] dev_queue_xmit+0x18/0x20 net/core/dev.c:3263 [] neigh_direct_output+0x16/0x20 net/core/neighbour.c:1369 [] dst_neigh_output include/net/dst.h:461 [inline] [] ip_finish_output2+0x6a2/0x1280 net/ipv4/ip_output.c:213 [] ip_finish_output+0x8b2/0xc60 net/ipv4/ip_output.c:288 [] NF_HOOK_COND include/linux/netfilter.h:240 [inline] [] ip_output+0x227/0x4c0 net/ipv4/ip_output.c:362 [] dst_output include/net/dst.h:498 [inline] [] ip_local_out+0x9c/0x180 net/ipv4/ip_output.c:119 [] ip_send_skb+0x3e/0xc0 net/ipv4/ip_output.c:1453 [] udp_send_skb+0x4fd/0xc70 net/ipv4/udp.c:842 [] udp_sendmsg+0x16cf/0x1c60 net/ipv4/udp.c:1072 [] udpv6_sendmsg+0x12f2/0x24f0 net/ipv6/udp.c:1173 [] inet_sendmsg+0x202/0x4d0 net/ipv4/af_inet.c:755 [] sock_sendmsg_nosec net/socket.c:638 [inline] [] sock_sendmsg+0xbe/0x110 net/socket.c:648 [] ___sys_sendmsg+0x769/0x890 net/socket.c:1975 [] __sys_sendmsg+0xc5/0x160 net/socket.c:2009 [] SYSC_sendmsg net/socket.c:2020 [inline] [] SyS_sendmsg+0x2d/0x50 net/socket.c:2016 [] entry_SYSCALL_64_fastpath+0x1e/0x9a Allocated by task 23698: [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63 [] save_stack mm/kasan/kasan.c:512 [inline] [] set_track mm/kasan/kasan.c:524 [inline] [] kasan_kmalloc.part.0+0x62/0xf0 mm/kasan/kasan.c:616 [] kasan_kmalloc+0xb7/0xd0 mm/kasan/kasan.c:601 [] __kmalloc+0x141/0x330 mm/slub.c:3613 [] kmalloc include/linux/slab.h:481 [inline] [] kzalloc include/linux/slab.h:620 [inline] [] neigh_alloc net/core/neighbour.c:285 [inline] [] __neigh_create+0x1d6/0x1b30 net/core/neighbour.c:457 [] neigh_create include/net/neighbour.h:313 [inline] [] ipv4_neigh_lookup+0x52e/0x6e0 net/ipv4/route.c:464 [] dst_neigh_lookup include/net/dst.h:466 [inline] [] ip6_tnl_xmit2+0x27b/0x2320 net/ipv6/ip6_tunnel.c:982 [] ip4ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1134 [inline] [] ip6_tnl_xmit+0xa09/0xe00 net/ipv6/ip6_tunnel.c:1212 [] __netdev_start_xmit include/linux/netdevice.h:3750 [inline] [] netdev_start_xmit include/linux/netdevice.h:3759 [inline] [] xmit_one net/core/dev.c:2781 [inline] [] dev_hard_start_xmit+0x7c1/0x11e0 net/core/dev.c:2797 [] __dev_queue_xmit+0x164b/0x1bb0 net/core/dev.c:3229 [] dev_queue_xmit+0x18/0x20 net/core/dev.c:3263 [] neigh_direct_output+0x16/0x20 net/core/neighbour.c:1369 [] dst_neigh_output include/net/dst.h:461 [inline] [] ip_finish_output2+0x6a2/0x1280 net/ipv4/ip_output.c:213 [] ip_finish_output+0x8b2/0xc60 net/ipv4/ip_output.c:288 [] NF_HOOK_COND include/linux/netfilter.h:240 [inline] [] ip_output+0x227/0x4c0 net/ipv4/ip_output.c:362 [] dst_output include/net/dst.h:498 [inline] [] ip_local_out+0x9c/0x180 net/ipv4/ip_output.c:119 [] ip_send_skb+0x3e/0xc0 net/ipv4/ip_output.c:1453 [] udp_send_skb+0x4fd/0xc70 net/ipv4/udp.c:842 [] udp_sendmsg+0x16cf/0x1c60 net/ipv4/udp.c:1072 [] udpv6_sendmsg+0x12f2/0x24f0 net/ipv6/udp.c:1173 [] inet_sendmsg+0x202/0x4d0 net/ipv4/af_inet.c:755 [] sock_sendmsg_nosec net/socket.c:638 [inline] [] sock_sendmsg+0xbe/0x110 net/socket.c:648 [] ___sys_sendmsg+0x769/0x890 net/socket.c:1975 [] __sys_sendmsg+0xc5/0x160 net/socket.c:2009 [] SYSC_sendmsg net/socket.c:2020 [inline] [] SyS_sendmsg+0x2d/0x50 net/socket.c:2016 [] entry_SYSCALL_64_fastpath+0x1e/0x9a Freed by task 20735: [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63 [] save_stack mm/kasan/kasan.c:512 [inline] [] set_track mm/kasan/kasan.c:524 [inline] [] kasan_slab_free+0xb0/0x190 mm/kasan/kasan.c:589 [] slab_free_hook mm/slub.c:1383 [inline] [] slab_free_freelist_hook mm/slub.c:1405 [inline] [] slab_free mm/slub.c:2859 [inline] [] kfree+0xf4/0x310 mm/slub.c:3749 [] skb_free_head net/core/skbuff.c:571 [inline] [] skb_release_data+0x2e6/0x380 net/core/skbuff.c:602 [] skb_release_all+0x4d/0x60 net/core/skbuff.c:661 [] __kfree_skb net/core/skbuff.c:675 [inline] [] kfree_skb+0xf7/0x400 net/core/skbuff.c:696 [] ip6_finish_output2+0x1075/0x1dc0 net/ipv6/ip6_output.c:102 [] ip6_finish_output+0x2f3/0x750 net/ipv6/ip6_output.c:131 [] NF_HOOK_COND include/linux/netfilter.h:240 [inline] [] ip6_output+0x1b4/0x520 net/ipv6/ip6_output.c:145 [] dst_output include/net/dst.h:498 [inline] [] ip6_local_out+0x9c/0x180 net/ipv6/output_core.c:169 [] ip6_send_skb+0xa2/0x340 net/ipv6/ip6_output.c:1725 [] udp_v6_send_skb+0x438/0xe90 net/ipv6/udp.c:1066 [] udpv6_sendmsg+0x1e3d/0x24f0 net/ipv6/udp.c:1330 [] inet_sendmsg+0x202/0x4d0 net/ipv4/af_inet.c:755 [] sock_sendmsg_nosec net/socket.c:638 [inline] [] sock_sendmsg+0xbe/0x110 net/socket.c:648 [] ___sys_sendmsg+0x369/0x890 net/socket.c:1975 [] __sys_sendmmsg+0x130/0x2e0 net/socket.c:2060 [] SYSC_sendmmsg net/socket.c:2090 [inline] [] SyS_sendmmsg+0x35/0x60 net/socket.c:2085 [] entry_SYSCALL_64_fastpath+0x1e/0x9a The buggy address belongs to the object at ffff8801aa74d680 which belongs to the cache kmalloc-1024 of size 1024 The buggy address is located 696 bytes inside of 1024-byte region [ffff8801aa74d680, ffff8801aa74da80) The buggy address belongs to the page: INFO: trying to register non-static key. the code is fine but needs lockdep annotation. turning off the locking correctness validator. CPU: 0 PID: 22109 Comm: kworker/u4:27 Not tainted 4.4.174+ #4 Workqueue: 0x6765f0112a1c73b4 (ü¤Q,®¯dÑ­ë¢Exd€) 0000000000000000 6e2cafce7ea6c05d ffff8801db607960 ffffffff81aad1a1 ffffffff83a73e40 ffff8801bb83df00 0000000000000000 0000000000000001 0000000000000000 ffff8801db607af0 ffffffff8120393e ffff8801bb83df00 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x120 lib/dump_stack.c:51 [] register_lock_class kernel/locking/lockdep.c:762 [inline] [] __lock_acquire+0x438e/0x4f50 kernel/locking/lockdep.c:3101 [] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592 [] __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:112 [inline] [] _raw_spin_lock_irqsave+0x50/0x70 kernel/locking/spinlock.c:159 [] try_to_wake_up+0x2b/0x1110 kernel/sched/core.c:1974 [] wake_up_process+0x15/0x20 kernel/sched/core.c:2142 [] wake_up_worker kernel/workqueue.c:846 [inline] [] insert_work+0x21e/0x320 kernel/workqueue.c:1318 [] __queue_work+0x3e3/0xec0 kernel/workqueue.c:1433 [] delayed_work_timer_fn+0x6e/0x90 kernel/workqueue.c:1472 [] call_timer_fn+0x18d/0x850 kernel/time/timer.c:1185 [] __run_timers kernel/time/timer.c:1257 [inline] [] run_timer_softirq+0x2d4/0xb70 kernel/time/timer.c:1444 [] __do_softirq+0x226/0xa3f kernel/softirq.c:273 [] invoke_softirq kernel/softirq.c:350 [inline] [] irq_exit+0x10a/0x150 kernel/softirq.c:391 [] exiting_irq arch/x86/include/asm/apic.h:652 [inline] [] smp_apic_timer_interrupt+0x7e/0xb0 arch/x86/kernel/apic/apic.c:926 [] apic_timer_interrupt+0x9d/0xb0 arch/x86/entry/entry_64.S:768 [] ? dump_page+0x20/0x30 mm/debug.c:105 kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral protection fault: 0000 [#1] PREEMPT SMP KASAN Modules linked in: CPU: 0 PID: 22109 Comm: kworker/u4:27 Not tainted 4.4.174+ #4 Workqueue: 0x6765f0112a1c73b4 (ü¤Q,®¯dÑ­ë¢Exd€) task: ffff8801bb83df00 task.stack: ffff88019a2b8000 RIP: 0010:[] [] lookup_object lib/debugobjects.c:120 [inline] RIP: 0010:[] [] debug_object_deactivate+0x16f/0x360 lib/debugobjects.c:468 RSP: 0018:ffff8801db607a60 EFLAGS: 00010003 RAX: 0000000000000000 RBX: 0000000000000003 RCX: ffffffff81b0c7cd RDX: 09ebe8eaa84be9ad RSI: ffffffff82eafea0 RDI: 4f5f4755425f4d6e RBP: ffff8801db607b48 R08: 0000000000000001 R09: ffffffff840c9308 R10: 0000000000000092 R11: ffffffff831a5078 R12: 4f5f4755425f4d56 R13: dffffc0000000000 R14: 1ffff1003b6c0f50 R15: ffff8800b93f12d8 FS: 0000000000000000(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000130 CR3: 000000008815f000 CR4: 00000000001606b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Stack: 0000000000000040 ffffffff82eafea0 0000000000000092 ffffffff840c9308 0000000041b58ab3 ffffffff82c76921 ffffffff81b0c500 ffff880100000001 ffff880100000000 ffffffff00000000 0000000000000000 1ffff1003b6c0f5a Call Trace: [] debug_hrtimer_deactivate kernel/time/hrtimer.c:415 [inline] [] debug_deactivate kernel/time/hrtimer.c:462 [inline] [] __run_hrtimer kernel/time/hrtimer.c:1230 [inline] [] __hrtimer_run_queues+0x1bd/0xfc0 kernel/time/hrtimer.c:1325 [] hrtimer_interrupt+0x1b6/0x450 kernel/time/hrtimer.c:1359 [] local_apic_timer_interrupt+0x76/0xa0 arch/x86/kernel/apic/apic.c:901 [] smp_apic_timer_interrupt+0x79/0xb0 arch/x86/kernel/apic/apic.c:925 [] apic_timer_interrupt+0x9d/0xb0 arch/x86/entry/entry_64.S:768 [] spin_unlock_irq include/linux/spinlock.h:357 [inline] [] __run_timers kernel/time/timer.c:1260 [inline] [] run_timer_softirq+0x50d/0xb70 kernel/time/timer.c:1444 [] __do_softirq+0x226/0xa3f kernel/softirq.c:273 [] invoke_softirq kernel/softirq.c:350 [inline] [] irq_exit+0x10a/0x150 kernel/softirq.c:391 [] exiting_irq arch/x86/include/asm/apic.h:652 [inline] [] smp_apic_timer_interrupt+0x7e/0xb0 arch/x86/kernel/apic/apic.c:926 [] apic_timer_interrupt+0x9d/0xb0 arch/x86/entry/entry_64.S:768 Code: 48 c1 ea 03 42 80 3c 2a 00 0f 85 8e 01 00 00 4d 8b 24 24 4d 85 e4 0f 84 e9 00 00 00 49 8d 7c 24 18 83 c3 01 48 89 fa 48 c1 ea 03 <42> 80 3c 2a 00 0f 85 3f 01 00 00 4d 3b 7c 24 18 75 c0 49 8d 7c RIP [] lookup_object lib/debugobjects.c:120 [inline] RIP [] debug_object_deactivate+0x16f/0x360 lib/debugobjects.c:468 RSP ---[ end trace dc4ce04b12b7cbd5 ]--- double fault: 0000 [#2] PREEMPT SMP KASAN Modules linked in: CPU: 1 PID: 23698 Comm: syz-executor.0 Tainted: G D 4.4.174+ #4 task: ffff8800ba325f00 task.stack: ffff8801a2390000 RIP: 0010:[] [] dump_page_badflags+0x4/0x70 mm/debug.c:84 RSP: 0018:ffff880100000000 EFLAGS: 00010046 RAX: 0000000000040000 RBX: 0000000000000000 RCX: ffffc9000158f000 RDX: 0000000000000000 RSI: ffffffff82891be0 RDI: ffffea0006a9d300 RBP: ffff880100000000 R08: 0000000000000026 R09: 0000000000000000 R10: 0000000000000001 R11: ffffffff83fdf174 R12: ffffea0006a9d300 R13: ffffffff82891be0 R14: ffff8801aa74da80 R15: ffff8801aa74d680 FS: 00007fdd21f8c700(0000) GS:ffff8801db700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff8800fffffff8 CR3: 00000000b4864000 CR4: 00000000001606b0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600 Stack: Call Trace: Code: e8 3e 48 69 c0 80 06 00 00 f0 48 ff 80 a8 1b 19 83 5b 5d c3 48 89 df e8 0b a3 05 00 eb dd 66 0f 1f 84 00 00 00 00 00 55 48 89 e5 <41> 57 41 56 41 55 49 89 f5 41 54 49 89 fc 53 48 89 d3 48 83 ec RIP [] dump_page_badflags+0x4/0x70 mm/debug.c:84 RSP ---[ end trace dc4ce04b12b7cbd6 ]---