================================================================== BUG: KASAN: use-after-free in find_rr_leaf net/ipv6/route.c:711 [inline] BUG: KASAN: use-after-free in rt6_select net/ipv6/route.c:766 [inline] BUG: KASAN: use-after-free in ip6_pol_route+0x16f3/0x1a70 net/ipv6/route.c:1833 Read of size 4 at addr ffff8800a819be70 by task syz-executor.1/16967 CPU: 0 PID: 16967 Comm: syz-executor.1 Not tainted 4.16.0+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x109/0x15a lib/dump_stack.c:113 print_address_description.cold.8+0x9/0x1ff mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report.cold.9+0x242/0x2fe mm/kasan/report.c:412 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:432 find_rr_leaf net/ipv6/route.c:711 [inline] rt6_select net/ipv6/route.c:766 [inline] ip6_pol_route+0x16f3/0x1a70 net/ipv6/route.c:1833 ip6_pol_route_output+0x3c/0x70 net/ipv6/route.c:2072 fib6_rule_lookup+0xee/0x410 net/ipv6/fib6_rules.c:85 ip6_route_output_flags+0x22a/0x2c0 net/ipv6/route.c:2100 ip6_dst_lookup_tail+0x3cd/0x1680 net/ipv6/ip6_output.c:992 ip6_dst_lookup_flow+0x9b/0x1e0 net/ipv6/ip6_output.c:1093 ip6_sk_dst_lookup_flow+0x452/0x910 net/ipv6/ip6_output.c:1131 udpv6_sendmsg+0x1365/0x26a0 net/ipv6/udp.c:1311 inet_sendmsg+0x108/0x440 net/ipv4/af_inet.c:798 sock_sendmsg_nosec net/socket.c:629 [inline] sock_sendmsg+0xb5/0xf0 net/socket.c:639 ___sys_sendmsg+0x28e/0x950 net/socket.c:2117 __sys_sendmmsg+0x160/0x370 net/socket.c:2212 SYSC_sendmmsg net/socket.c:2241 [inline] SyS_sendmmsg+0xf/0x20 net/socket.c:2238 do_syscall_64+0x1c7/0x690 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x459a59 RSP: 002b:00007f15c613ac78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000000459a59 RDX: 00000000000000c6 RSI: 0000000020006d00 RDI: 0000000000000004 RBP: 000000000075c070 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f15c613b6d4 R13: 00000000004c74b8 R14: 00000000004dd1a8 R15: 00000000ffffffff Allocated by task 16954: save_stack+0x43/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:553 kmem_cache_alloc_trace+0x152/0x790 mm/slab.c:3620 kmalloc include/linux/slab.h:512 [inline] kzalloc include/linux/slab.h:701 [inline] fib6_info_alloc+0x4e/0x1a0 net/ipv6/ip6_fib.c:152 ip6_route_info_create+0x564/0x34e0 net/ipv6/route.c:2914 ip6_route_add+0x18/0x80 net/ipv6/route.c:3053 addrconf_add_mroute+0x1bd/0x280 net/ipv6/addrconf.c:2402 addrconf_add_dev+0xea/0x170 net/ipv6/addrconf.c:2420 addrconf_dev_config+0x92/0x1b0 net/ipv6/addrconf.c:3278 addrconf_notify+0x2ec/0x1da0 net/ipv6/addrconf.c:3517 notifier_call_chain+0x8a/0x160 kernel/notifier.c:93 __raw_notifier_call_chain kernel/notifier.c:394 [inline] raw_notifier_call_chain+0x11/0x20 kernel/notifier.c:401 call_netdevice_notifiers_info+0x28/0x60 net/core/dev.c:1734 call_netdevice_notifiers net/core/dev.c:1752 [inline] dev_set_mtu+0x266/0x4b0 net/core/dev.c:7085 team_change_mtu+0xe2/0x2e0 drivers/net/team/team.c:1776 __dev_set_mtu net/core/dev.c:7039 [inline] dev_set_mtu+0x243/0x4b0 net/core/dev.c:7082 dev_ifsioc+0x48f/0x7c0 net/core/dev_ioctl.c:244 dev_ioctl+0x149/0xad0 net/core/dev_ioctl.c:500 sock_do_ioctl+0x16f/0x230 net/socket.c:980 sock_ioctl+0x281/0x500 net/socket.c:1081 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:500 [inline] do_vfs_ioctl+0x196/0xff0 fs/ioctl.c:684 ksys_ioctl+0x62/0x90 fs/ioctl.c:701 SYSC_ioctl fs/ioctl.c:708 [inline] SyS_ioctl+0x9/0x10 fs/ioctl.c:706 do_syscall_64+0x1c7/0x690 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x42/0xb7 Freed by task 16964: save_stack+0x43/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528 __cache_free mm/slab.c:3498 [inline] kfree+0xcf/0x270 mm/slab.c:3813 fib6_info_destroy+0x29b/0x370 net/ipv6/ip6_fib.c:209 fib6_info_release include/net/ip6_fib.h:344 [inline] fib6_del_route net/ipv6/ip6_fib.c:1784 [inline] fib6_del+0xad5/0xf30 net/ipv6/ip6_fib.c:1810 fib6_clean_node+0x2db/0x490 net/ipv6/ip6_fib.c:1971 fib6_walk_continue+0x3e0/0x7c0 net/ipv6/ip6_fib.c:1894 fib6_walk+0x90/0xe0 net/ipv6/ip6_fib.c:1942 fib6_clean_tree+0x93/0xc0 net/ipv6/ip6_fib.c:2019 __fib6_clean_all+0xdb/0x1d0 net/ipv6/ip6_fib.c:2035 fib6_clean_all+0xe/0x10 net/ipv6/ip6_fib.c:2046 rt6_sync_down_dev net/ipv6/route.c:3956 [inline] rt6_disable_ip+0xa8/0x5e0 net/ipv6/route.c:3961 addrconf_ifdown+0x7a/0xfa0 net/ipv6/addrconf.c:3631 addrconf_notify+0x4fa/0x1da0 net/ipv6/addrconf.c:3555 notifier_call_chain+0x8a/0x160 kernel/notifier.c:93 __raw_notifier_call_chain kernel/notifier.c:394 [inline] raw_notifier_call_chain+0x11/0x20 kernel/notifier.c:401 call_netdevice_notifiers_info+0x28/0x60 net/core/dev.c:1734 call_netdevice_notifiers net/core/dev.c:1752 [inline] dev_set_mtu+0x266/0x4b0 net/core/dev.c:7085 team_change_mtu+0xe2/0x2e0 drivers/net/team/team.c:1776 __dev_set_mtu net/core/dev.c:7039 [inline] dev_set_mtu+0x243/0x4b0 net/core/dev.c:7082 dev_ifsioc+0x48f/0x7c0 net/core/dev_ioctl.c:244 dev_ioctl+0x149/0xad0 net/core/dev_ioctl.c:500 sock_do_ioctl+0x16f/0x230 net/socket.c:980 sock_ioctl+0x281/0x500 net/socket.c:1081 vfs_ioctl fs/ioctl.c:46 [inline] file_ioctl fs/ioctl.c:500 [inline] do_vfs_ioctl+0x196/0xff0 fs/ioctl.c:684 ksys_ioctl+0x62/0x90 fs/ioctl.c:701 SYSC_ioctl fs/ioctl.c:708 [inline] SyS_ioctl+0x9/0x10 fs/ioctl.c:706 do_syscall_64+0x1c7/0x690 arch/x86/entry/common.c:287 entry_SYSCALL_64_after_hwframe+0x42/0xb7 The buggy address belongs to the object at ffff8800a819bd40 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 304 bytes inside of 512-byte region [ffff8800a819bd40, ffff8800a819bf40) The buggy address belongs to the page: page:ffffea0002a066c0 count:1 mapcount:0 mapping:ffff8800a819b0c0 index:0x0 flags: 0x1fffc0000000100(slab) raw: 01fffc0000000100 ffff8800a819b0c0 0000000000000000 0000000100000006 raw: ffffea0002588e60 ffffea0002819b60 ffff88012fe48940 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8800a819bd00: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb ffff8800a819bd80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8800a819be00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8800a819be80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8800a819bf00: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ==================================================================