==================================================================
BUG: KASAN: slab-use-after-free in rht_key_hashfn include/linux/rhashtable.h:159 [inline]
BUG: KASAN: slab-use-after-free in __rhashtable_lookup include/linux/rhashtable.h:604 [inline]
BUG: KASAN: slab-use-after-free in rhashtable_lookup include/linux/rhashtable.h:646 [inline]
BUG: KASAN: slab-use-after-free in rhashtable_lookup_fast+0x668/0x814 include/linux/rhashtable.h:672
Read of size 4 at addr ffff0000dbd30008 by task syz.0.198/7906

CPU: 0 UID: 0 PID: 7906 Comm: syz.0.198 Not tainted 6.11.0-rc7-syzkaller-g5f5673607153 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/06/2024
Call trace:
 dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:319
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:326
 __dump_stack lib/dump_stack.c:93 [inline]
 dump_stack_lvl+0xe4/0x150 lib/dump_stack.c:119
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0x198/0x538 mm/kasan/report.c:488
 kasan_report+0xd8/0x138 mm/kasan/report.c:601
 __asan_report_load4_noabort+0x20/0x2c mm/kasan/report_generic.c:380
 rht_key_hashfn include/linux/rhashtable.h:159 [inline]
 __rhashtable_lookup include/linux/rhashtable.h:604 [inline]
 rhashtable_lookup include/linux/rhashtable.h:646 [inline]
 rhashtable_lookup_fast+0x668/0x814 include/linux/rhashtable.h:672
 ila_lookup_wildcards net/ipv6/ila/ila_xlat.c:132 [inline]
 ila_xlat_addr net/ipv6/ila/ila_xlat.c:657 [inline]
 ila_nf_input+0x210/0x404 net/ipv6/ila/ila_xlat.c:190
 nf_hook_entry_hookfn include/linux/netfilter.h:154 [inline]
 nf_hook_slow+0xc8/0x234 net/netfilter/core.c:626
 nf_hook include/linux/netfilter.h:269 [inline]
 NF_HOOK+0x22c/0x3d4 include/linux/netfilter.h:312
 ipv6_rcv+0x9c/0xbc net/ipv6/ip6_input.c:310
 __netif_receive_skb_one_core net/core/dev.c:5661 [inline]
 __netif_receive_skb+0x18c/0x3c8 net/core/dev.c:5775
 process_backlog+0x640/0x123c net/core/dev.c:6108
 __napi_poll+0xb4/0x3fc net/core/dev.c:6772
 napi_poll net/core/dev.c:6841 [inline]
 net_rx_action+0x6a8/0xf4c net/core/dev.c:6963
 handle_softirqs+0x2e4/0xbfc kernel/softirq.c:554
 __do_softirq+0x14/0x20 kernel/softirq.c:588
 ____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:81
 call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:889
 do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:86
 invoke_softirq kernel/softirq.c:435 [inline]
 __irq_exit_rcu+0x1d8/0x434 kernel/softirq.c:637
 irq_exit_rcu+0x14/0x84 kernel/softirq.c:649
 __el1_irq arch/arm64/kernel/entry-common.c:537 [inline]
 el1_interrupt+0x38/0x68 arch/arm64/kernel/entry-common.c:551
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:556
 el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:594
 __sanitizer_cov_trace_pc+0x60/0x84 kernel/kcov.c:221
 import_iovec+0x88/0xa4 lib/iov_iter.c:1346
 copy_msghdr_from_user+0x3f4/0x59c net/socket.c:2534
 recvmsg_copy_msghdr net/socket.c:2782 [inline]
 ___sys_recvmsg net/socket.c:2854 [inline]
 do_recvmmsg+0x390/0xb34 net/socket.c:2952
 __sys_recvmmsg net/socket.c:3031 [inline]
 __do_sys_recvmmsg net/socket.c:3054 [inline]
 __se_sys_recvmmsg net/socket.c:3047 [inline]
 __arm64_sys_recvmmsg+0x180/0x23c net/socket.c:3047
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712
 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730
 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598

Allocated by task 7834:
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x40/0x78 mm/kasan/common.c:68
 kasan_save_alloc_info+0x40/0x50 mm/kasan/generic.c:565
 poison_kmalloc_redzone mm/kasan/common.c:370 [inline]
 __kasan_kmalloc+0xac/0xc4 mm/kasan/common.c:387
 kasan_kmalloc include/linux/kasan.h:211 [inline]
 __kmalloc_cache_noprof+0x244/0x374 mm/slub.c:4193
 kmalloc_noprof include/linux/slab.h:681 [inline]
 kzalloc_noprof include/linux/slab.h:807 [inline]
 kobject_uevent_env+0x260/0x894 lib/kobject_uevent.c:540
 kobject_uevent+0x2c/0x3c lib/kobject_uevent.c:656
 device_add+0x54c/0xa6c drivers/base/core.c:3663
 netdev_register_kobject+0x15c/0x2e8 net/core/net-sysfs.c:2136
 register_netdevice+0xb88/0x11a8 net/core/dev.c:10444
 nsim_init_netdevsim drivers/net/netdevsim/netdev.c:690 [inline]
 nsim_create+0x5ac/0x79c drivers/net/netdevsim/netdev.c:750
 __nsim_dev_port_add+0x530/0x894 drivers/net/netdevsim/dev.c:1390
 nsim_dev_port_add_all+0x4c/0x110 drivers/net/netdevsim/dev.c:1446
 nsim_drv_probe+0x788/0x9a8 drivers/net/netdevsim/dev.c:1604
 nsim_bus_probe+0x20/0x30 drivers/net/netdevsim/bus.c:391
 really_probe+0x38c/0x8fc drivers/base/dd.c:657
 __driver_probe_device+0x194/0x374 drivers/base/dd.c:799
 driver_probe_device+0x78/0x330 drivers/base/dd.c:829
 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:957
 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:457
 __device_attach+0x2b4/0x434 drivers/base/dd.c:1029
 device_initial_probe+0x24/0x34 drivers/base/dd.c:1078
 bus_probe_device+0x178/0x240 drivers/base/bus.c:532
 device_add+0x728/0xa6c drivers/base/core.c:3682
 device_register+0x28/0x38 drivers/base/core.c:3764
 nsim_bus_dev_new drivers/net/netdevsim/bus.c:442 [inline]
 new_device_store+0x340/0x704 drivers/net/netdevsim/bus.c:173
 bus_attr_store+0x80/0xa4 drivers/base/bus.c:170
 sysfs_kf_write+0x200/0x280 fs/sysfs/file.c:136
 kernfs_fop_write_iter+0x334/0x48c fs/kernfs/file.c:334
 new_sync_write fs/read_write.c:497 [inline]
 vfs_write+0x940/0xc80 fs/read_write.c:590
 ksys_write+0x15c/0x26c fs/read_write.c:643
 __do_sys_write fs/read_write.c:655 [inline]
 __se_sys_write fs/read_write.c:652 [inline]
 __arm64_sys_write+0x7c/0x90 fs/read_write.c:652
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712
 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730
 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598

Freed by task 7834:
 kasan_save_stack mm/kasan/common.c:47 [inline]
 kasan_save_track+0x40/0x78 mm/kasan/common.c:68
 kasan_save_free_info+0x54/0x6c mm/kasan/generic.c:579
 poison_slab_object+0x128/0x180 mm/kasan/common.c:240
 __kasan_slab_free+0x3c/0x70 mm/kasan/common.c:256
 kasan_slab_free include/linux/kasan.h:184 [inline]
 slab_free_hook mm/slub.c:2256 [inline]
 slab_free mm/slub.c:4477 [inline]
 kfree+0x154/0x3e0 mm/slub.c:4598
 kobject_uevent_env+0x344/0x894 lib/kobject_uevent.c:640
 kobject_uevent+0x2c/0x3c lib/kobject_uevent.c:656
 device_add+0x54c/0xa6c drivers/base/core.c:3663
 netdev_register_kobject+0x15c/0x2e8 net/core/net-sysfs.c:2136
 register_netdevice+0xb88/0x11a8 net/core/dev.c:10444
 nsim_init_netdevsim drivers/net/netdevsim/netdev.c:690 [inline]
 nsim_create+0x5ac/0x79c drivers/net/netdevsim/netdev.c:750
 __nsim_dev_port_add+0x530/0x894 drivers/net/netdevsim/dev.c:1390
 nsim_dev_port_add_all+0x4c/0x110 drivers/net/netdevsim/dev.c:1446
 nsim_drv_probe+0x788/0x9a8 drivers/net/netdevsim/dev.c:1604
 nsim_bus_probe+0x20/0x30 drivers/net/netdevsim/bus.c:391
 really_probe+0x38c/0x8fc drivers/base/dd.c:657
 __driver_probe_device+0x194/0x374 drivers/base/dd.c:799
 driver_probe_device+0x78/0x330 drivers/base/dd.c:829
 __device_attach_driver+0x2a8/0x4f4 drivers/base/dd.c:957
 bus_for_each_drv+0x228/0x2bc drivers/base/bus.c:457
 __device_attach+0x2b4/0x434 drivers/base/dd.c:1029
 device_initial_probe+0x24/0x34 drivers/base/dd.c:1078
 bus_probe_device+0x178/0x240 drivers/base/bus.c:532
 device_add+0x728/0xa6c drivers/base/core.c:3682
 device_register+0x28/0x38 drivers/base/core.c:3764
 nsim_bus_dev_new drivers/net/netdevsim/bus.c:442 [inline]
 new_device_store+0x340/0x704 drivers/net/netdevsim/bus.c:173
 bus_attr_store+0x80/0xa4 drivers/base/bus.c:170
 sysfs_kf_write+0x200/0x280 fs/sysfs/file.c:136
 kernfs_fop_write_iter+0x334/0x48c fs/kernfs/file.c:334
 new_sync_write fs/read_write.c:497 [inline]
 vfs_write+0x940/0xc80 fs/read_write.c:590
 ksys_write+0x15c/0x26c fs/read_write.c:643
 __do_sys_write fs/read_write.c:655 [inline]
 __se_sys_write fs/read_write.c:652 [inline]
 __arm64_sys_write+0x7c/0x90 fs/read_write.c:652
 __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:49
 el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:132
 do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:151
 el0_svc+0x54/0x168 arch/arm64/kernel/entry-common.c:712
 el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:730
 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:598

The buggy address belongs to the object at ffff0000dbd30000
 which belongs to the cache kmalloc-4k of size 4096
The buggy address is located 8 bytes inside of
 freed 4096-byte region [ffff0000dbd30000, ffff0000dbd31000)

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x11bd30
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x5ffc00000000040(head|node=0|zone=2|lastcpupid=0x7ff)
page_type: 0xfdffffff(slab)
raw: 05ffc00000000040 ffff0000c0002140 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000040004 00000001fdffffff 0000000000000000
head: 05ffc00000000040 ffff0000c0002140 dead000000000122 0000000000000000
head: 0000000000000000 0000000000040004 00000001fdffffff 0000000000000000
head: 05ffc00000000003 fffffdffc36f4c01 ffffffffffffffff 0000000000000000
head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000dbd2ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff0000dbd2ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff0000dbd30000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                      ^
 ffff0000dbd30080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff0000dbd30100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
Unable to handle kernel paging request at virtual address dfff800000000000
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
Mem abort info:
  ESR = 0x0000000096000005
  EC = 0x25: DABT (current EL), IL = 32 bits
  SET = 0, FnV = 0
  EA = 0, S1PTW = 0
  FSC = 0x05: level 1 translation fault
Data abort info:
  ISV = 0, ISS = 0x00000005, ISS2 = 0x00000000
  CM = 0, WnR = 0, TnD = 0, TagAccess = 0
  GCS = 0, Overlay = 0, DirtyBit = 0, Xs = 0
[dfff800000000000] address between user and kernel address ranges