================================================================== BUG: KASAN: slab-out-of-bounds in fib6_nh_get_excptn_bucket+0x198/0x1b0 net/ipv6/route.c:1591 Read of size 8 at addr ffff88805b7295f8 by task kworker/u4:0/7035 CPU: 0 PID: 7035 Comm: kworker/u4:0 Not tainted 5.3.0+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: bat_events batadv_nc_worker Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x172/0x1f0 lib/dump_stack.c:113 print_address_description.cold+0xd4/0x306 mm/kasan/report.c:351 __kasan_report.cold+0x1b/0x36 mm/kasan/report.c:482 kasan_report+0x12/0x17 mm/kasan/common.c:618 __asan_report_load8_noabort+0x14/0x20 mm/kasan/generic_report.c:132 fib6_nh_get_excptn_bucket+0x198/0x1b0 net/ipv6/route.c:1591 fib6_nh_flush_exceptions+0x37/0x2d0 net/ipv6/route.c:1719 fib6_nh_release+0x84/0x3a0 net/ipv6/route.c:3501 fib6_info_destroy_rcu+0x11e/0x150 net/ipv6/ip6_fib.c:174 __rcu_reclaim kernel/rcu/rcu.h:222 [inline] rcu_do_batch kernel/rcu/tree.c:2157 [inline] rcu_core+0x581/0x1560 kernel/rcu/tree.c:2377 rcu_core_si+0x9/0x10 kernel/rcu/tree.c:2386 __do_softirq+0x262/0x98c kernel/softirq.c:292 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0x19b/0x1e0 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:536 [inline] smp_apic_timer_interrupt+0x1a3/0x610 arch/x86/kernel/apic/apic.c:1137 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:830 RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:756 [inline] RIP: 0010:lock_acquire+0x20b/0x410 kernel/locking/lockdep.c:4490 Code: 94 08 00 00 00 00 00 00 48 c1 e8 03 80 3c 10 00 0f 85 d3 01 00 00 48 83 3d 81 5c 9a 07 00 0f 84 53 01 00 00 48 8b 7d c8 57 9d <0f> 1f 44 00 00 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d c3 65 8b RSP: 0018:ffff888036befc80 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13 RAX: 1ffffffff11e630c RBX: ffff888081b32500 RCX: ffffffff81585c71 RDX: dffffc0000000000 RSI: 0000000000000008 RDI: 0000000000000286 RBP: ffff888036befcc8 R08: 1ffffffff14ef12c R09: fffffbfff14ef12d R10: ffff888081b32de8 R11: ffff888081b32500 R12: ffffffff88fab280 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000002 rcu_lock_acquire include/linux/rcupdate.h:208 [inline] rcu_read_lock include/linux/rcupdate.h:599 [inline] batadv_nc_purge_orig_hash net/batman-adv/network-coding.c:407 [inline] batadv_nc_worker+0x117/0x760 net/batman-adv/network-coding.c:718 process_one_work+0x9af/0x1740 kernel/workqueue.c:2269 worker_thread+0x98/0xe40 kernel/workqueue.c:2415 kthread+0x361/0x430 kernel/kthread.c:255 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Allocated by task 11740: save_stack+0x23/0x90 mm/kasan/common.c:69 set_track mm/kasan/common.c:77 [inline] __kasan_kmalloc mm/kasan/common.c:493 [inline] __kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:466 kasan_kmalloc+0x9/0x10 mm/kasan/common.c:507 kmem_cache_alloc_trace+0x158/0x790 mm/slab.c:3550 kmalloc include/linux/slab.h:552 [inline] kzalloc include/linux/slab.h:748 [inline] fib6_info_alloc+0xb6/0x1b0 net/ipv6/ip6_fib.c:154 ip6_route_info_create+0x2fe/0x1530 net/ipv6/route.c:3603 ip6_route_add+0x27/0xc0 net/ipv6/route.c:3695 inet6_rtm_newroute+0x16c/0x180 net/ipv6/route.c:5263 rtnetlink_rcv_msg+0x463/0xb00 net/core/rtnetlink.c:5223 netlink_rcv_skb+0x177/0x450 net/netlink/af_netlink.c:2477 rtnetlink_rcv+0x1d/0x30 net/core/rtnetlink.c:5241 netlink_unicast_kernel net/netlink/af_netlink.c:1302 [inline] netlink_unicast+0x531/0x710 net/netlink/af_netlink.c:1328 netlink_sendmsg+0x8a5/0xd60 net/netlink/af_netlink.c:1917 sock_sendmsg_nosec net/socket.c:637 [inline] sock_sendmsg+0xd7/0x130 net/socket.c:657 ___sys_sendmsg+0x803/0x920 net/socket.c:2311 __sys_sendmsg+0x105/0x1d0 net/socket.c:2356 __do_sys_sendmsg net/socket.c:2365 [inline] __se_sys_sendmsg net/socket.c:2363 [inline] __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2363 do_syscall_64+0xfa/0x760 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 8207: save_stack+0x23/0x90 mm/kasan/common.c:69 set_track mm/kasan/common.c:77 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/common.c:455 kasan_slab_free+0xe/0x10 mm/kasan/common.c:463 __cache_free mm/slab.c:3425 [inline] kfree+0x10a/0x2c0 mm/slab.c:3756 urb_destroy drivers/usb/core/urb.c:26 [inline] kref_put include/linux/kref.h:65 [inline] usb_free_urb.part.0+0x85/0xd0 drivers/usb/core/urb.c:95 usb_free_urb+0x20/0x30 drivers/usb/core/urb.c:94 usb_start_wait_urb+0x21f/0x2f0 drivers/usb/core/message.c:79 usb_internal_control_msg drivers/usb/core/message.c:101 [inline] usb_control_msg+0x352/0x530 drivers/usb/core/message.c:152 set_port_feature+0x6f/0x90 drivers/usb/core/hub.c:428 hub_suspend+0x805/0x9c0 drivers/usb/core/hub.c:3710 usb_suspend_interface drivers/usb/core/driver.c:1203 [inline] usb_suspend_both+0x29e/0x880 drivers/usb/core/driver.c:1308 usb_runtime_suspend+0x4b/0x120 drivers/usb/core/driver.c:1846 __rpm_callback+0x29e/0x3d0 drivers/base/power/runtime.c:357 rpm_callback+0x19c/0x240 drivers/base/power/runtime.c:487 rpm_suspend+0x3b3/0x14d0 drivers/base/power/runtime.c:629 __pm_runtime_suspend+0xbf/0x150 drivers/base/power/runtime.c:1048 pm_runtime_put_sync_autosuspend include/linux/pm_runtime.h:252 [inline] usb_autosuspend_device+0x4c/0x70 drivers/usb/core/driver.c:1571 usbdev_release+0x3d4/0x4a0 drivers/usb/core/devio.c:1067 __fput+0x2ff/0x890 fs/file_table.c:280 ____fput+0x16/0x20 fs/file_table.c:313 task_work_run+0x145/0x1c0 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_usermode_loop+0x316/0x380 arch/x86/entry/common.c:163 prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline] syscall_return_slowpath arch/x86/entry/common.c:274 [inline] do_syscall_64+0x65f/0x760 arch/x86/entry/common.c:300 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff88805b729500 which belongs to the cache kmalloc-192 of size 192 The buggy address is located 56 bytes to the right of 192-byte region [ffff88805b729500, ffff88805b7295c0) The buggy address belongs to the page: page:ffffea00016dca40 refcount:1 mapcount:0 mapping:ffff8880aa400000 index:0x0 flags: 0x1fffc0000000200(slab) raw: 01fffc0000000200 ffffea000197c988 ffffea000280d648 ffff8880aa400000 raw: 0000000000000000 ffff88805b729000 0000000100000010 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88805b729480: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff88805b729500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff88805b729580: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff88805b729600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88805b729680: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ==================================================================