==================================================================
BUG: KASAN: stack-out-of-bounds in csd_lock_record+0xd2/0xe0 kernel/smp.c:119
Read of size 8 at addr ffffc9001788f538 by task syz-executor.1/19504

CPU: 0 PID: 19504 Comm: syz-executor.1 Not tainted 5.8.0-rc3-next-20200703-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x18f/0x20d lib/dump_stack.c:118
 print_address_description.constprop.0.cold+0x5/0x436 mm/kasan/report.c:383
 __kasan_report mm/kasan/report.c:513 [inline]
 kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530
 csd_lock_record+0xd2/0xe0 kernel/smp.c:119
 flush_smp_call_function_queue+0x285/0x730 kernel/smp.c:391
 __sysvec_call_function_single+0x98/0x490 arch/x86/kernel/smp.c:248
 asm_call_on_stack+0xf/0x20 arch/x86/entry/entry_64.S:706
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:22 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:48 [inline]
 sysvec_call_function_single+0xe0/0x120 arch/x86/kernel/smp.c:243
 asm_sysvec_call_function_single+0x12/0x20 arch/x86/include/asm/idtentry.h:604
RIP: 0010:fib6_ifup+0xa6/0x260 net/ipv6/route.c:4639
Code: 49 39 ad 50 0a 00 00 74 31 e8 46 b9 8e fa 48 8d bd 98 00 00 00 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 <0f> 85 76 01 00 00 48 83 bd 98 00 00 00 00 74 0e e8 15 b9 8e fa 31
RSP: 0018:ffffc900173ce998 EFLAGS: 00000246
RAX: dffffc0000000000 RBX: ffffc900173cecc0 RCX: ffffc900046d9000
RDX: 1ffff110133aa693 RSI: ffffffff86e54dba RDI: ffff888099d53498
RBP: ffff888099d53400 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffff888056e18000
R13: ffff888087c1a080 R14: fffff52002e79d78 R15: fffff52002e79d76
 fib6_clean_node+0x2a1/0x570 net/ipv6/ip6_fib.c:2177
 fib6_walk_continue+0x4aa/0x8e0 net/ipv6/ip6_fib.c:2102
 fib6_walk+0x182/0x370 net/ipv6/ip6_fib.c:2150
 fib6_clean_tree+0xdb/0x120 net/ipv6/ip6_fib.c:2230
 __fib6_clean_all+0x120/0x290 net/ipv6/ip6_fib.c:2246
 rt6_sync_up+0xce/0x170 net/ipv6/route.c:4661
 addrconf_notify+0x17fd/0x2310 net/ipv6/addrconf.c:3536
 notifier_call_chain+0xb5/0x200 kernel/notifier.c:83
 call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:2033
 netdev_state_change net/core/dev.c:1463 [inline]
 netdev_state_change+0x100/0x130 net/core/dev.c:1456
 do_setlink+0x2bc4/0x35c0 net/core/rtnetlink.c:2834
 rtnl_group_changelink net/core/rtnetlink.c:3123 [inline]
 __rtnl_newlink+0xdea/0x1730 net/core/rtnetlink.c:3277
 rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3397
 rtnetlink_rcv_msg+0x44e/0xad0 net/core/rtnetlink.c:5460
 netlink_rcv_skb+0x15a/0x430 net/netlink/af_netlink.c:2469
 netlink_unicast_kernel net/netlink/af_netlink.c:1303 [inline]
 netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1329
 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1918
 sock_sendmsg_nosec net/socket.c:652 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:672
 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2352
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2406
 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2439
 do_syscall_64+0x60/0xe0 arch/x86/entry/common.c:367
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45cb29
Code: Bad RIP value.
RSP: 002b:00007fb87af42c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000502760 RCX: 000000000045cb29
RDX: 0000000000000000 RSI: 0000000020000140 RDI: 0000000000000005
RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 0000000000000a43 R14: 00000000004cd2a1 R15: 00007fb87af436d4


Memory state around the buggy address:
 ffffc9001788f400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffc9001788f480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffc9001788f500: f1 f1 f1 f1 00 00 00 00 f3 f3 f3 f3 00 00 00 00
                                           ^
 ffffc9001788f580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffc9001788f600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================