bridge0: received packet on bridge_slave_1 with own address as source address (addr:aa:aa:aa:aa:aa:1b, vlan:0)
ip6_tunnel: ip6tnl1 xmit: Local address not yet configured!
==================================================================
BUG: KASAN: slab-use-after-free in ip6_rcv_core+0x1559/0x1870 net/ipv6/ip6_input.c:239
Read of size 1 at addr ffff888079880010 by task kworker/u8:31/10903
CPU: 1 UID: 0 PID: 10903 Comm: kworker/u8:31 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
Workqueue: bat_events batadv_dat_purge
Call Trace:
dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
print_address_description+0x55/0x1e0 mm/kasan/report.c:378
print_report+0x58/0x70 mm/kasan/report.c:482
kasan_report+0x117/0x150 mm/kasan/report.c:595
ip6_rcv_core+0x1559/0x1870 net/ipv6/ip6_input.c:239
ipv6_rcv+0x72/0xc0 net/ipv6/ip6_input.c:348
__netif_receive_skb_one_core net/core/dev.c:6206 [inline]
__netif_receive_skb net/core/dev.c:6319 [inline]
process_backlog+0x774/0x1860 net/core/dev.c:6670
__napi_poll+0xaa/0x330 net/core/dev.c:7729
napi_poll net/core/dev.c:7792 [inline]
net_rx_action+0x61d/0xf50 net/core/dev.c:7949
handle_softirqs+0x225/0x840 kernel/softirq.c:622
do_softirq+0x76/0xd0 kernel/softirq.c:523
__local_bh_enable_ip+0xf8/0x130 kernel/softirq.c:450
spin_unlock_bh include/linux/spinlock.h:396 [inline]
__batadv_dat_purge net/batman-adv/distributed-arp-table.c:186 [inline]
batadv_dat_purge+0x2d7/0x3c0 net/batman-adv/distributed-arp-table.c:205
process_one_work kernel/workqueue.c:3322 [inline]
process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Allocated by task 10920:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
__kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
kasan_kmalloc include/linux/kasan.h:263 [inline]
__do_kmalloc_node mm/slub.c:5362 [inline]
__kmalloc_node_track_caller_noprof+0x4c3/0x730 mm/slub.c:5497
kmalloc_reserve net/core/skbuff.c:637 [inline]
__alloc_skb+0x2bd/0x7a0 net/core/skbuff.c:715
alloc_skb include/linux/skbuff.h:1384 [inline]
mld_newpack+0x165/0xcb0 net/ipv6/mcast.c:1773
add_grhead net/ipv6/mcast.c:1884 [inline]
add_grec+0x119f/0x19d0 net/ipv6/mcast.c:2023
mld_send_initial_cr+0x288/0x550 net/ipv6/mcast.c:2268
ipv6_mc_dad_complete+0x87/0x540 net/ipv6/mcast.c:2279
addrconf_dad_completed+0x8af/0xe60 net/ipv6/addrconf.c:4375
addrconf_dad_work+0xcf8/0x15c0 net/ipv6/addrconf.c:-1
process_one_work kernel/workqueue.c:3322 [inline]
process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Freed by task 10903:
kasan_save_stack mm/kasan/common.c:57 [inline]
kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584
poison_slab_object mm/kasan/common.c:253 [inline]
__kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
kasan_slab_free include/linux/kasan.h:235 [inline]
slab_free_hook mm/slub.c:2705 [inline]
slab_free mm/slub.c:6405 [inline]
kfree+0x1c5/0x640 mm/slub.c:6720
skb_kfree_head net/core/skbuff.c:1077 [inline]
skb_free_head net/core/skbuff.c:1089 [inline]
pskb_expand_head+0x469/0x13a0 net/core/skbuff.c:2338
netif_skb_check_for_xdp net/core/dev.c:5571 [inline]
netif_receive_generic_xdp net/core/dev.c:5602 [inline]
do_xdp_generic+0x9a5/0x12d0 net/core/dev.c:5670
__netif_receive_skb_core+0x10e0/0x30b0 net/core/dev.c:6016
__netif_receive_skb_one_core net/core/dev.c:6204 [inline]
__netif_receive_skb net/core/dev.c:6319 [inline]
netif_receive_skb_internal net/core/dev.c:6405 [inline]
netif_receive_skb+0x1fe/0xbf0 net/core/dev.c:6464
NF_HOOK+0xa4/0x3a0 include/linux/netfilter.h:318
br_handle_frame_finish+0x1192/0x1990 net/bridge/br_input.c:-1
br_nf_hook_thresh+0x3dd/0x4c0 net/bridge/br_netfilter_hooks.c:-1
br_nf_pre_routing_finish_ipv6+0x90c/0xc40 net/bridge/br_netfilter_ipv6.c:-1
NF_HOOK include/linux/netfilter.h:318 [inline]
br_nf_pre_routing_ipv6+0x382/0x6f0 net/bridge/br_netfilter_ipv6.c:183
nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline]
nf_hook_bridge_pre net/bridge/br_input.c:291 [inline]
br_handle_frame+0x127f/0x1510 net/bridge/br_input.c:442
__netif_receive_skb_core+0x989/0x30b0 net/core/dev.c:6093
__netif_receive_skb_one_core net/core/dev.c:6204 [inline]
__netif_receive_skb net/core/dev.c:6319 [inline]
process_backlog+0x706/0x1860 net/core/dev.c:6670
__napi_poll+0xaa/0x330 net/core/dev.c:7729
napi_poll net/core/dev.c:7792 [inline]
net_rx_action+0x61d/0xf50 net/core/dev.c:7949
handle_softirqs+0x225/0x840 kernel/softirq.c:622
do_softirq+0x76/0xd0 kernel/softirq.c:523
__local_bh_enable_ip+0xf8/0x130 kernel/softirq.c:450
spin_unlock_bh include/linux/spinlock.h:396 [inline]
__batadv_dat_purge net/batman-adv/distributed-arp-table.c:186 [inline]
batadv_dat_purge+0x2d7/0x3c0 net/batman-adv/distributed-arp-table.c:205
process_one_work kernel/workqueue.c:3322 [inline]
process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405
worker_thread+0xa47/0xfb0 kernel/workqueue.c:3486
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
The buggy address belongs to the object at ffff888079880000
which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 16 bytes inside of
freed 2048-byte region [ffff888079880000, ffff888079880800)
The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888079885000 pfn:0x79880
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000240 ffff88813fe26000 ffffea0000c60010 ffffea0000b44c10
raw: ffff888079885000 0000000800080005 00000000f5000000 0000000000000000
head: 00fff00000000240 ffff88813fe26000 ffffea0000c60010 ffffea0000b44c10
head: ffff888079885000 0000000800080005 00000000f5000000 0000000000000000
head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd28c0(GFP_NOWAIT|__GFP_IO|__GFP_FS|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5622, tgid 5622 (syz-executor), ts 70564091110, free_ts 67530956299
set_page_owner include/linux/page_owner.h:32 [inline]
post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1859
prep_new_page mm/page_alloc.c:1867 [inline]
get_page_from_freelist+0x21fa/0x2270 mm/page_alloc.c:3946
__alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5304
alloc_slab_page mm/slub.c:3294 [inline]
allocate_slab+0x79/0x5e0 mm/slub.c:3408
new_slab mm/slub.c:3454 [inline]
refill_objects+0x2d5/0x350 mm/slub.c:7338
refill_sheaf mm/slub.c:2832 [inline]
__pcs_replace_empty_main+0x2bf/0x6b0 mm/slub.c:4703
alloc_from_pcs mm/slub.c:4801 [inline]
slab_alloc_node mm/slub.c:4933 [inline]
__do_kmalloc_node mm/slub.c:5361 [inline]
__kmalloc_node_track_caller_noprof+0x557/0x730 mm/slub.c:5497
kmalloc_reserve net/core/skbuff.c:637 [inline]
pskb_expand_head+0x22c/0x13a0 net/core/skbuff.c:2306
netlink_trim+0x1b3/0x2c0 net/netlink/af_netlink.c:1300
netlink_broadcast_filtered+0x6d/0xea0 net/netlink/af_netlink.c:1518
nlmsg_multicast_filtered include/net/netlink.h:1165 [inline]
nlmsg_multicast include/net/netlink.h:1184 [inline]
nlmsg_notify+0xe3/0x1a0 net/netlink/af_netlink.c:2599
rtnl_notify net/core/rtnetlink.c:963 [inline]
rtmsg_ifinfo_send net/core/rtnetlink.c:4553 [inline]
rtmsg_ifinfo_event net/core/rtnetlink.c:4569 [inline]
rtnetlink_event+0x224/0x270 net/core/rtnetlink.c:7136
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2288 [inline]
call_netdevice_notifiers net/core/dev.c:2302 [inline]
netif_set_mac_address+0x393/0x4d0 net/core/dev.c:9996
do_setlink+0x9ad/0x4670 net/core/rtnetlink.c:3167
rtnl_changelink net/core/rtnetlink.c:3849 [inline]
__rtnl_newlink net/core/rtnetlink.c:4022 [inline]
rtnl_newlink+0x15c2/0x1bd0 net/core/rtnetlink.c:4159
page last free pid 5610 tgid 5610 stack trace:
reset_page_owner include/linux/page_owner.h:25 [inline]
__free_pages_prepare mm/page_alloc.c:1406 [inline]
__free_frozen_pages+0xc1e/0xd10 mm/page_alloc.c:2950
__folio_put+0x4b3/0x590 mm/swap.c:112
folio_put include/linux/mm.h:2124 [inline]
put_page include/linux/mm.h:2193 [inline]
put_netmem include/net/netmem.h:394 [inline]
skb_page_unref include/linux/skbuff_ref.h:43 [inline]
__skb_frag_unref include/linux/skbuff_ref.h:56 [inline]
skb_release_data+0x573/0xab0 net/core/skbuff.c:1110
skb_release_all net/core/skbuff.c:1191 [inline]
__kfree_skb+0x5d/0x210 net/core/skbuff.c:1205
tcp_clean_rtx_queue net/ipv4/tcp_input.c:3698 [inline]
tcp_ack+0x28f7/0x8050 net/ipv4/tcp_input.c:4370
tcp_rcv_established+0x1527/0x2910 net/ipv4/tcp_input.c:6559
tcp_v4_do_rcv+0x727/0x13b0 net/ipv4/tcp_ipv4.c:1851
sk_backlog_rcv include/net/sock.h:1192 [inline]
__release_sock+0x25b/0x390 net/core/sock.c:3258
__sk_flush_backlog+0x36/0xc0 net/core/sock.c:3281
sk_flush_backlog include/net/sock.h:1253 [inline]
tcp_sendmsg_locked+0x43ac/0x55c0 net/ipv4/tcp.c:1252
tcp_sendmsg+0x2f/0x50 net/ipv4/tcp.c:1451
sock_sendmsg_nosec+0x10e/0x180 net/socket.c:776
__sock_sendmsg net/socket.c:790 [inline]
sock_write_iter+0x2de/0x3e0 net/socket.c:1241
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x612/0xba0 fs/read_write.c:687
ksys_write+0x150/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
Memory state around the buggy address:
ffff88807987ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88807987ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888079880000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff888079880080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff888079880100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================