bisecting fixing commit since 13d2ce42de8cb98ff952f8de6307f896203854c2
building syzkaller on 8f160dd5d603e9cd86705baad260794afa3e5cb3
testing commit 13d2ce42de8cb98ff952f8de6307f896203854c2 with gcc (GCC) 8.4.1 20210217
kernel signature: 6378c27a0c7f4d24e4a0ca6bf32c9447f92af170d4cb5719c9767803796de579
run #0: crashed: KASAN: use-after-free Read in ipvlan_queue_xmit
run #1: crashed: KASAN: slab-out-of-bounds Read in ipvlan_queue_xmit
run #2: crashed: KASAN: use-after-free Read in ipvlan_queue_xmit
run #3: crashed: KASAN: use-after-free Read in ipvlan_queue_xmit
run #4: crashed: KASAN: slab-out-of-bounds Read in ipvlan_queue_xmit
run #5: crashed: KASAN: slab-out-of-bounds Read in ipvlan_queue_xmit
run #6: crashed: KASAN: slab-out-of-bounds Read in ipvlan_queue_xmit
run #7: crashed: KASAN: use-after-free Read in ipvlan_queue_xmit
run #8: crashed: KASAN: use-after-free Read in ipvlan_queue_xmit
run #9: crashed: KASAN: use-after-free Read in ipvlan_queue_xmit
run #10: crashed: KASAN: use-after-free Read in ipvlan_queue_xmit
run #11: crashed: KASAN: slab-out-of-bounds Read in ipvlan_queue_xmit
run #12: crashed: KASAN: use-after-free Read in ipvlan_queue_xmit
run #13: crashed: KASAN: slab-out-of-bounds Read in ipvlan_queue_xmit
run #14: crashed: KASAN: use-after-free Read in ipvlan_queue_xmit
run #15: crashed: KASAN: use-after-free Read in ipvlan_queue_xmit
run #16: crashed: KASAN: slab-out-of-bounds Read in ipvlan_queue_xmit
run #17: crashed: KASAN: use-after-free Read in ipvlan_queue_xmit
run #18: crashed: KASAN: slab-out-of-bounds Read in ipvlan_queue_xmit
run #19: crashed: KASAN: slab-out-of-bounds Read in ipvlan_queue_xmit
testing current HEAD eb575cd5d7f60241d016fdd13a9e86d962093c9b
testing commit eb575cd5d7f60241d016fdd13a9e86d962093c9b with gcc (GCC) 8.4.1 20210217
kernel signature: aa1f0b58a20f2d49ed1f073351e2c3424b403e269c3b1385a8f5e39ff15ca8a8
run #0: crashed: KASAN: use-after-free Read in ipvlan_queue_xmit
run #1: crashed: KASAN: slab-out-of-bounds Read in ipvlan_queue_xmit
run #2: crashed: KASAN: use-after-free Read in ipvlan_queue_xmit
run #3: crashed: KASAN: use-after-free Read in ipvlan_queue_xmit
run #4: crashed: KASAN: slab-out-of-bounds Read in ipvlan_queue_xmit
run #5: crashed: KASAN: slab-out-of-bounds Read in ipvlan_queue_xmit
run #6: crashed: KASAN: slab-out-of-bounds Read in ipvlan_queue_xmit
run #7: crashed: KASAN: use-after-free Read in ipvlan_queue_xmit
run #8: crashed: KASAN: use-after-free Read in ipvlan_queue_xmit
run #9: crashed: KASAN: slab-out-of-bounds Read in ipvlan_queue_xmit
revisions tested: 2, total time: 23m24.06795321s (build: 16m31.231513063s, test: 6m31.308423204s)
the crash still happens on HEAD
commit msg: Linux 4.19.195
crash: KASAN: slab-out-of-bounds Read in ipvlan_queue_xmit
wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready
IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
IPv6: ADDRCONF(NETDEV_UP): wlan1: link is not ready
==================================================================
BUG: KASAN: slab-out-of-bounds in ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:533 [inline]
BUG: KASAN: slab-out-of-bounds in ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:593 [inline]
BUG: KASAN: slab-out-of-bounds in ipvlan_queue_xmit+0x89d/0x1630 drivers/net/ipvlan/ipvlan_core.c:654
Read of size 4 at addr ffff888097f35fff by task syz-executor.0/9893

CPU: 0 PID: 9893 Comm: syz-executor.0 Not tainted 4.19.195-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x17c/0x226 lib/dump_stack.c:118
 print_address_description.cold.6+0x9/0x211 mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report mm/kasan/report.c:412 [inline]
 kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:396
 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:432
 ipvlan_process_outbound drivers/net/ipvlan/ipvlan_core.c:533 [inline]
 ipvlan_xmit_mode_l3 drivers/net/ipvlan/ipvlan_core.c:593 [inline]
 ipvlan_queue_xmit+0x89d/0x1630 drivers/net/ipvlan/ipvlan_core.c:654
 ipvlan_start_xmit+0x4a/0x150 drivers/net/ipvlan/ipvlan_main.c:290
 __netdev_start_xmit include/linux/netdevice.h:4345 [inline]
 netdev_start_xmit include/linux/netdevice.h:4359 [inline]
 dev_direct_xmit+0x2db/0x620 net/core/dev.c:3905
 packet_direct_xmit+0xd6/0x140 net/packet/af_packet.c:246
 packet_snd net/packet/af_packet.c:2988 [inline]
 packet_sendmsg+0x3467/0x6660 net/packet/af_packet.c:3013
wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
 sock_sendmsg_nosec net/socket.c:622 [inline]
 sock_sendmsg+0xac/0xf0 net/socket.c:632
 sock_write_iter+0x215/0x420 net/socket.c:901
 call_write_iter include/linux/fs.h:1821 [inline]
 aio_write+0x2e4/0x560 fs/aio.c:1574
ieee80211 phy12: Selected rate control algorithm 'minstrel_ht'
 __io_submit_one fs/aio.c:1858 [inline]
 io_submit_one+0x764/0x1db0 fs/aio.c:1909
wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
 __do_sys_io_submit fs/aio.c:1953 [inline]
 __se_sys_io_submit+0x112/0x390 fs/aio.c:1924
 __x64_sys_io_submit+0x6e/0xb0 fs/aio.c:1924
 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x465a49
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007efc145dd188 EFLAGS: 00000246 ORIG_RAX: 00000000000000d1
RAX: ffffffffffffffda RBX: 000000000055bf40 RCX: 0000000000465a49
RDX: 0000000020000080 RSI: 0000000000000001 RDI: 00007efc145bc000
RBP: 00000000004af682 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000055bf40
R13: 00007ffc38633c4f R14: 00007efc145dd300 R15: 0000000000022000

Allocated by task 8452:
 save_stack mm/kasan/kasan.c:448 [inline]
 set_track mm/kasan/kasan.c:460 [inline]
 kasan_kmalloc.part.1+0x62/0xf0 mm/kasan/kasan.c:553
 kasan_kmalloc+0xaf/0xc0 mm/kasan/kasan.c:538
 kmem_cache_alloc_trace+0x152/0x3a0 mm/slab.c:3625
 kmalloc include/linux/slab.h:515 [inline]
 kzalloc include/linux/slab.h:709 [inline]
 kobject_uevent_env+0x1c7/0x1130 lib/kobject_uevent.c:522
 kobject_uevent+0xb/0x10 lib/kobject_uevent.c:640
IPv6: ADDRCONF(NETDEV_UP): wlan1: link is not ready
 netdev_queue_add_kobject net/core/net-sysfs.c:1533 [inline]
 netdev_queue_update_kobjects+0x28d/0x330 net/core/net-sysfs.c:1550
wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
 register_queue_kobjects net/core/net-sysfs.c:1592 [inline]
 netdev_register_kobject+0x313/0x3d0 net/core/net-sysfs.c:1810
 register_netdevice+0x714/0xfa0 net/core/dev.c:8722
 ieee80211_if_add+0x87a/0x1600 net/mac80211/iface.c:1889
 ieee80211_register_hw+0x2954/0x3fc0 net/mac80211/main.c:1174
 mac80211_hwsim_new_radio+0x1a57/0x3750 drivers/net/wireless/mac80211_hwsim.c:2896
 hwsim_new_radio_nl+0x517/0x8d0 drivers/net/wireless/mac80211_hwsim.c:3374
 genl_family_rcv_msg+0x599/0x1000 net/netlink/genetlink.c:602
 genl_rcv_msg+0xa7/0x140 net/netlink/genetlink.c:627
 netlink_rcv_skb+0x13e/0x3d0 net/netlink/af_netlink.c:2457
 genl_rcv+0x23/0x40 net/netlink/genetlink.c:638
 netlink_unicast_kernel net/netlink/af_netlink.c:1320 [inline]
 netlink_unicast+0x443/0x660 net/netlink/af_netlink.c:1346
 netlink_sendmsg+0x667/0xc60 net/netlink/af_netlink.c:1911
 sock_sendmsg_nosec net/socket.c:622 [inline]
 sock_sendmsg+0xac/0xf0 net/socket.c:632
 __sys_sendto+0x1f2/0x2e0 net/socket.c:1787
 __do_sys_sendto net/socket.c:1799 [inline]
 __se_sys_sendto net/socket.c:1795 [inline]
 __x64_sys_sendto+0xdc/0x1a0 net/socket.c:1795
 do_syscall_64+0xd0/0x4e0 arch/x86/entry/common.c:293
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 9875:
 save_stack mm/kasan/kasan.c:448 [inline]
 set_track mm/kasan/kasan.c:460 [inline]
 __kasan_slab_free+0x13c/0x220 mm/kasan/kasan.c:521
 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready
 __cache_free mm/slab.c:3503 [inline]
 kfree+0xcf/0x220 mm/slab.c:3822
 cleanup_uevent_env+0x32/0x40 lib/kobject_uevent.c:273
 call_usermodehelper_freeinfo kernel/umh.c:45 [inline]
 umh_complete kernel/umh.c:60 [inline]
 umh_complete+0x58/0x70 kernel/umh.c:49
 call_usermodehelper_exec_async+0x51a/0x630 kernel/umh.c:126
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:415

The buggy address belongs to the object at ffff888097f34a80
 which belongs to the cache kmalloc-4096 of size 4096
IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready
The buggy address is located 1407 bytes to the right of
 4096-byte region [ffff888097f34a80, ffff888097f35a80)
The buggy address belongs to the page:
page:ffffea00025fcd00 count:1 mapcount:0 mapping:ffff88813bff6dc0 index:0x0 compound_mapcount: 0
flags: 0xfff00000008100(slab|head)
raw: 00fff00000008100 ffffea00025c0008 ffffea00025d7c88 ffff88813bff6dc0
raw: 0000000000000000 ffff888097f34a80 0000000100000001 0000000000000000
page dumped because: kasan: bad access detected

wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
Memory state around the buggy address:
 ffff888097f35e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888097f35f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888097f35f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                                                                ^
 ffff888097f36000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888097f36080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================