netlink: 9 bytes leftover after parsing attributes in process `syz-executor1'.
netlink: 9 bytes leftover after parsing attributes in process `syz-executor1'.
==================================================================
BUG: KASAN: null-ptr-deref in atomic_read include/asm-generic/atomic-instrumented.h:21 [inline]
BUG: KASAN: null-ptr-deref in refcount_sub_and_test_checked+0x9d/0x310 lib/refcount.c:179
Read of size 4 at addr 000000000000002e by task syz-executor3/8976

netlink: 17 bytes leftover after parsing attributes in process `syz-executor0'.
CPU: 1 PID: 8976 Comm: syz-executor3 Not tainted 4.19.0-rc6+ #245
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1c4/0x2b4 lib/dump_stack.c:113
netlink: 'syz-executor1': attribute type 8 has an invalid length.
 kasan_report_error mm/kasan/report.c:352 [inline]
 kasan_report.cold.9+0x6d/0x309 mm/kasan/report.c:412
netlink: 9 bytes leftover after parsing attributes in process `syz-executor1'.
 check_memory_region_inline mm/kasan/kasan.c:260 [inline]
 check_memory_region+0x13e/0x1b0 mm/kasan/kasan.c:267
 kasan_check_read+0x11/0x20 mm/kasan/kasan.c:272
 atomic_read include/asm-generic/atomic-instrumented.h:21 [inline]
 refcount_sub_and_test_checked+0x9d/0x310 lib/refcount.c:179
netlink: 9 bytes leftover after parsing attributes in process `syz-executor1'.
 refcount_dec_and_test_checked+0x1a/0x20 lib/refcount.c:212
 ip_fib_metrics_put include/net/ip.h:428 [inline]
 fib6_info_destroy_rcu+0x2ef/0x3e0 net/ipv6/ip6_fib.c:204
 __rcu_reclaim kernel/rcu/rcu.h:236 [inline]
 rcu_do_batch kernel/rcu/tree.c:2576 [inline]
 invoke_rcu_callbacks kernel/rcu/tree.c:2880 [inline]
 __rcu_process_callbacks kernel/rcu/tree.c:2847 [inline]
 rcu_process_callbacks+0xf23/0x2670 kernel/rcu/tree.c:2864
netlink: 'syz-executor1': attribute type 8 has an invalid length.
 __do_softirq+0x30b/0xad8 kernel/softirq.c:292
 invoke_softirq kernel/softirq.c:372 [inline]
 irq_exit+0x17f/0x1c0 kernel/softirq.c:412
 exiting_irq arch/x86/include/asm/apic.h:536 [inline]
 smp_apic_timer_interrupt+0x1cb/0x760 arch/x86/kernel/apic/apic.c:1056
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:864
 </IRQ>
RIP: 0010:keccakf_round crypto/sha3_generic.c:110 [inline]
RIP: 0010:keccakf crypto/sha3_generic.c:160 [inline]
RIP: 0010:crypto_sha3_update+0xbdc/0x1170 crypto/sha3_generic.c:203
Code: 89 ad 60 ff ff ff 48 f7 d2 48 23 55 c0 49 89 d5 48 8b 95 18 ff ff ff 49 31 c5 4c 89 ad 40 ff ff ff 48 89 d0 48 f7 d0 48 21 f8 <4c> 31 c0 48 89 45 a8 48 89 f8 48 f7 d0 4c 21 f0 48 31 d0 48 89 85
RSP: 0018:ffff880199e7f680 EFLAGS: 00000206 ORIG_RAX: ffffffffffffff13
RAX: 08c0200020144100 RBX: 38efbe247612c0b6 RCX: 92b5bbf7c7eab710
RDX: f7275f7fc7ab16c4 RSI: 780964a464c84e1c RDI: 29e0706320345304
RBP: ffff880199e7f888 R08: c9eb1927b55a14f2 R09: f9f31da1d1bb32a7
R10: e22a3348618d9156 R11: d13b200dc3288ef6 R12: 8d4372dd3813ad7c
R13: 3aaa9d9792ba15a2 R14: 9be8dab8ab1192fe R15: c454202824450251
 crypto_shash_update+0xf7/0x2a0 crypto/shash.c:117
 shash_ahash_update+0xc4/0x140 crypto/shash.c:239
 shash_async_update+0x19/0x20 crypto/shash.c:247
 crypto_ahash_update include/crypto/hash.h:525 [inline]
 hash_sendmsg+0x52e/0xae0 crypto/algif_hash.c:107
 sock_sendmsg_nosec net/socket.c:621 [inline]
 sock_sendmsg+0xd5/0x120 net/socket.c:631
 sock_write_iter+0x35e/0x5c0 net/socket.c:900
 call_write_iter include/linux/fs.h:1808 [inline]
 new_sync_write fs/read_write.c:474 [inline]
 __vfs_write+0x6b8/0x9f0 fs/read_write.c:487
 vfs_write+0x1fc/0x560 fs/read_write.c:549
 ksys_write+0x101/0x260 fs/read_write.c:598
 __do_sys_write fs/read_write.c:610 [inline]
 __se_sys_write fs/read_write.c:607 [inline]
 __x64_sys_write+0x73/0xb0 fs/read_write.c:607
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457579
Code: 1d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 eb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f01d90b8c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457579
RDX: 00000000fffffdef RSI: 0000000020000300 RDI: 0000000000000007
RBP: 000000000072bfa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f01d90b96d4
R13: 00000000004c2897 R14: 00000000004d8568 R15: 00000000ffffffff
==================================================================