==================================================================
BUG: KASAN: use-after-free in find_rr_leaf net/ipv6/route.c:711 [inline]
BUG: KASAN: use-after-free in rt6_select net/ipv6/route.c:766 [inline]
BUG: KASAN: use-after-free in ip6_pol_route+0x16f3/0x1a70 net/ipv6/route.c:1833
Read of size 4 at addr ffff8800a819be70 by task syz-executor.1/16967

CPU: 0 PID: 16967 Comm: syz-executor.1 Not tainted 4.16.0+ #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x109/0x15a lib/dump_stack.c:113
 print_address_description.cold.8+0x9/0x1ff mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report.cold.9+0x242/0x2fe mm/kasan/report.c:412
 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:432
 find_rr_leaf net/ipv6/route.c:711 [inline]
 rt6_select net/ipv6/route.c:766 [inline]
 ip6_pol_route+0x16f3/0x1a70 net/ipv6/route.c:1833
 ip6_pol_route_output+0x3c/0x70 net/ipv6/route.c:2072
 fib6_rule_lookup+0xee/0x410 net/ipv6/fib6_rules.c:85
 ip6_route_output_flags+0x22a/0x2c0 net/ipv6/route.c:2100
 ip6_dst_lookup_tail+0x3cd/0x1680 net/ipv6/ip6_output.c:992
 ip6_dst_lookup_flow+0x9b/0x1e0 net/ipv6/ip6_output.c:1093
 ip6_sk_dst_lookup_flow+0x452/0x910 net/ipv6/ip6_output.c:1131
 udpv6_sendmsg+0x1365/0x26a0 net/ipv6/udp.c:1311
 inet_sendmsg+0x108/0x440 net/ipv4/af_inet.c:798
 sock_sendmsg_nosec net/socket.c:629 [inline]
 sock_sendmsg+0xb5/0xf0 net/socket.c:639
 ___sys_sendmsg+0x28e/0x950 net/socket.c:2117
 __sys_sendmmsg+0x160/0x370 net/socket.c:2212
 SYSC_sendmmsg net/socket.c:2241 [inline]
 SyS_sendmmsg+0xf/0x20 net/socket.c:2238
 do_syscall_64+0x1c7/0x690 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x459a59
RSP: 002b:00007f15c613ac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000459a59
RDX: 00000000000000c6 RSI: 0000000020006d00 RDI: 0000000000000004
RBP: 000000000075c070 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f15c613b6d4
R13: 00000000004c74b8 R14: 00000000004dd1a8 R15: 00000000ffffffff

Allocated by task 16954:
 save_stack+0x43/0xd0 mm/kasan/kasan.c:448
 set_track mm/kasan/kasan.c:460 [inline]
 kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:553
 kmem_cache_alloc_trace+0x152/0x790 mm/slab.c:3620
 kmalloc include/linux/slab.h:512 [inline]
 kzalloc include/linux/slab.h:701 [inline]
 fib6_info_alloc+0x4e/0x1a0 net/ipv6/ip6_fib.c:152
 ip6_route_info_create+0x564/0x34e0 net/ipv6/route.c:2914
 ip6_route_add+0x18/0x80 net/ipv6/route.c:3053
 addrconf_add_mroute+0x1bd/0x280 net/ipv6/addrconf.c:2402
 addrconf_add_dev+0xea/0x170 net/ipv6/addrconf.c:2420
 addrconf_dev_config+0x92/0x1b0 net/ipv6/addrconf.c:3278
 addrconf_notify+0x2ec/0x1da0 net/ipv6/addrconf.c:3517
 notifier_call_chain+0x8a/0x160 kernel/notifier.c:93
 __raw_notifier_call_chain kernel/notifier.c:394 [inline]
 raw_notifier_call_chain+0x11/0x20 kernel/notifier.c:401
 call_netdevice_notifiers_info+0x28/0x60 net/core/dev.c:1734
 call_netdevice_notifiers net/core/dev.c:1752 [inline]
 dev_set_mtu+0x266/0x4b0 net/core/dev.c:7085
 team_change_mtu+0xe2/0x2e0 drivers/net/team/team.c:1776
 __dev_set_mtu net/core/dev.c:7039 [inline]
 dev_set_mtu+0x243/0x4b0 net/core/dev.c:7082
 dev_ifsioc+0x48f/0x7c0 net/core/dev_ioctl.c:244
 dev_ioctl+0x149/0xad0 net/core/dev_ioctl.c:500
 sock_do_ioctl+0x16f/0x230 net/socket.c:980
 sock_ioctl+0x281/0x500 net/socket.c:1081
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:500 [inline]
 do_vfs_ioctl+0x196/0xff0 fs/ioctl.c:684
 ksys_ioctl+0x62/0x90 fs/ioctl.c:701
 SYSC_ioctl fs/ioctl.c:708 [inline]
 SyS_ioctl+0x9/0x10 fs/ioctl.c:706
 do_syscall_64+0x1c7/0x690 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x42/0xb7

Freed by task 16964:
 save_stack+0x43/0xd0 mm/kasan/kasan.c:448
 set_track mm/kasan/kasan.c:460 [inline]
 __kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
 __cache_free mm/slab.c:3498 [inline]
 kfree+0xcf/0x270 mm/slab.c:3813
 fib6_info_destroy+0x29b/0x370 net/ipv6/ip6_fib.c:209
 fib6_info_release include/net/ip6_fib.h:344 [inline]
 fib6_del_route net/ipv6/ip6_fib.c:1784 [inline]
 fib6_del+0xad5/0xf30 net/ipv6/ip6_fib.c:1810
 fib6_clean_node+0x2db/0x490 net/ipv6/ip6_fib.c:1971
 fib6_walk_continue+0x3e0/0x7c0 net/ipv6/ip6_fib.c:1894
 fib6_walk+0x90/0xe0 net/ipv6/ip6_fib.c:1942
 fib6_clean_tree+0x93/0xc0 net/ipv6/ip6_fib.c:2019
 __fib6_clean_all+0xdb/0x1d0 net/ipv6/ip6_fib.c:2035
 fib6_clean_all+0xe/0x10 net/ipv6/ip6_fib.c:2046
 rt6_sync_down_dev net/ipv6/route.c:3956 [inline]
 rt6_disable_ip+0xa8/0x5e0 net/ipv6/route.c:3961
 addrconf_ifdown+0x7a/0xfa0 net/ipv6/addrconf.c:3631
 addrconf_notify+0x4fa/0x1da0 net/ipv6/addrconf.c:3555
 notifier_call_chain+0x8a/0x160 kernel/notifier.c:93
 __raw_notifier_call_chain kernel/notifier.c:394 [inline]
 raw_notifier_call_chain+0x11/0x20 kernel/notifier.c:401
 call_netdevice_notifiers_info+0x28/0x60 net/core/dev.c:1734
 call_netdevice_notifiers net/core/dev.c:1752 [inline]
 dev_set_mtu+0x266/0x4b0 net/core/dev.c:7085
 team_change_mtu+0xe2/0x2e0 drivers/net/team/team.c:1776
 __dev_set_mtu net/core/dev.c:7039 [inline]
 dev_set_mtu+0x243/0x4b0 net/core/dev.c:7082
 dev_ifsioc+0x48f/0x7c0 net/core/dev_ioctl.c:244
 dev_ioctl+0x149/0xad0 net/core/dev_ioctl.c:500
 sock_do_ioctl+0x16f/0x230 net/socket.c:980
 sock_ioctl+0x281/0x500 net/socket.c:1081
 vfs_ioctl fs/ioctl.c:46 [inline]
 file_ioctl fs/ioctl.c:500 [inline]
 do_vfs_ioctl+0x196/0xff0 fs/ioctl.c:684
 ksys_ioctl+0x62/0x90 fs/ioctl.c:701
 SYSC_ioctl fs/ioctl.c:708 [inline]
 SyS_ioctl+0x9/0x10 fs/ioctl.c:706
 do_syscall_64+0x1c7/0x690 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x42/0xb7

The buggy address belongs to the object at ffff8800a819bd40
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 304 bytes inside of
 512-byte region [ffff8800a819bd40, ffff8800a819bf40)
The buggy address belongs to the page:
page:ffffea0002a066c0 count:1 mapcount:0 mapping:ffff8800a819b0c0 index:0x0
flags: 0x1fffc0000000100(slab)
raw: 01fffc0000000100 ffff8800a819b0c0 0000000000000000 0000000100000006
raw: ffffea0002588e60 ffffea0002819b60 ffff88012fe48940 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8800a819bd00: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
 ffff8800a819bd80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8800a819be00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                             ^
 ffff8800a819be80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8800a819bf00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
==================================================================