batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! IPv6: ADDRCONF(NETDEV_UP): batadv_slave_0: link is not ready ================================================================== batman_adv: batadv0: Interface activated: batadv_slave_0 BUG: KASAN: slab-out-of-bounds in memcpy include/linux/string.h:347 [inline] BUG: KASAN: slab-out-of-bounds in bacpy include/net/bluetooth/bluetooth.h:233 [inline] BUG: KASAN: slab-out-of-bounds in hci_extended_inquiry_result_evt net/bluetooth/hci_event.c:3840 [inline] BUG: KASAN: slab-out-of-bounds in hci_event_packet+0x8e05/0x9a1f net/bluetooth/hci_event.c:5375 Read of size 6 at addr ffff8880a570ac88 by task kworker/u5:0/1189 CPU: 1 PID: 1189 Comm: kworker/u5:0 Not tainted 4.14.177-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: hci0 hci_rx_work Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0xf7/0x13b lib/dump_stack.c:58 print_address_description.cold.7+0x9/0x1c9 mm/kasan/report.c:252 kasan_report_error mm/kasan/report.c:351 [inline] kasan_report.cold.8+0x11a/0x2d3 mm/kasan/report.c:409 __asan_report_load_n_noabort+0xf/0x20 mm/kasan/report.c:440 memcpy include/linux/string.h:347 [inline] bacpy include/net/bluetooth/bluetooth.h:233 [inline] hci_extended_inquiry_result_evt net/bluetooth/hci_event.c:3840 [inline] hci_event_packet+0x8e05/0x9a1f net/bluetooth/hci_event.c:5375 IPv6: ADDRCONF(NETDEV_UP): macvlan1: link is not ready device veth1_vlan entered promiscuous mode hci_rx_work+0x356/0x8e0 net/bluetooth/hci_core.c:4244 IPv6: ADDRCONF(NETDEV_UP): macvlan0: link is not ready IPv6: ADDRCONF(NETDEV_UP): macvlan1: link is not ready process_one_work+0x79e/0x16c0 kernel/workqueue.c:2116 IPv6: ADDRCONF(NETDEV_UP): veth0_macvtap: link is not ready IPv6: ADDRCONF(NETDEV_UP): veth1_macvtap: link is not ready worker_thread+0xcc/0xee0 kernel/workqueue.c:2250 device veth0_macvtap entered promiscuous mode kthread+0x338/0x400 kernel/kthread.c:232 IPv6: ADDRCONF(NETDEV_UP): macvtap0: link is not ready device veth1_macvtap entered promiscuous mode IPv6: ADDRCONF(NETDEV_UP): macsec0: link is not ready ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:404 Allocated by task 7753: save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59 save_stack+0x43/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:551 __do_kmalloc_node mm/slab.c:3682 [inline] __kmalloc_node_track_caller+0x50/0x70 mm/slab.c:3696 __kmalloc_reserve.isra.38+0x2c/0xc0 net/core/skbuff.c:137 IPv6: ADDRCONF(NETDEV_UP): veth0_to_batadv: link is not ready __alloc_skb+0xc1/0x500 net/core/skbuff.c:205 alloc_skb include/linux/skbuff.h:980 [inline] bt_skb_alloc include/net/bluetooth/bluetooth.h:336 [inline] vhci_get_user drivers/bluetooth/hci_vhci.c:180 [inline] vhci_write+0xa8/0x3e2 drivers/bluetooth/hci_vhci.c:299 call_write_iter include/linux/fs.h:1778 [inline] new_sync_write fs/read_write.c:469 [inline] __vfs_write+0x413/0x840 fs/read_write.c:482 vfs_write+0x150/0x4f0 fs/read_write.c:544 SYSC_write fs/read_write.c:590 [inline] SyS_write+0x100/0x250 fs/read_write.c:582 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 IPv6: ADDRCONF(NETDEV_UP): veth1_to_batadv: link is not ready Freed by task 0: (stack is not available) The buggy address belongs to the object at ffff8880a570aa80 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 8 bytes to the right of 512-byte region [ffff8880a570aa80, ffff8880a570ac80) The buggy address belongs to the page: page:ffffea000295c280 count:1 mapcount:0 mapping:ffff8880a570a080 index:0x0 flags: 0xfffe0000000100(slab) raw: 00fffe0000000100 ffff8880a570a080 0000000000000000 0000000100000006 raw: ffffea0002147860 ffffea000295c2e0 ffff8880aa800940 0000000000000000 page dumped because: kasan: bad access detected batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3d) already exists on: batadv_slave_0 Memory state around the buggy address: ffff8880a570ab80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880a570ac00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff8880a570ac80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff8880a570ad00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880a570ad80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================