batman_adv: batadv0: Removing interface: batadv_slave_1
==================================================================
device bridge_slave_1 left promiscuous mode
bridge0: port 2(bridge_slave_1) entered disabled state
BUG: KASAN: use-after-free in batadv_iv_ogm_aggregate_new net/batman-adv/bat_iv_ogm.c:710 [inline] at addr ffff88010b75f100
BUG: KASAN: use-after-free in batadv_iv_ogm_queue_add+0x71f/0xf50 net/batman-adv/bat_iv_ogm.c:815 at addr ffff88010b75f100
Read of size 60 by task kworker/u4:0/6
CPU: 0 PID: 6 Comm: kworker/u4:0 Not tainted 4.8.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet
 0000000000000000 ffff88012b0bf940 ffffffff82d07402 ffff88012bc00200
 ffff88010b75f100 ffff88010b75f140 ffff880122b60a40 ffff88010e0cc500
 ffff88012b0bf968 ffffffff8175db4c ffff88012b0bf9f8 ffff88010b75f100
Call Trace:
 [<ffffffff82d07402>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff82d07402>] dump_stack+0x136/0x1d4 lib/dump_stack.c:51
 [<ffffffff8175db4c>] kasan_object_err+0x1c/0x70 mm/kasan/report.c:156
 [<ffffffff8175dda0>] print_address_description mm/kasan/report.c:194 [inline]
 [<ffffffff8175dda0>] kasan_report_error+0x1b0/0x490 mm/kasan/report.c:283
 [<ffffffff8175e414>] kasan_report+0x34/0x40 mm/kasan/report.c:303
 [<ffffffff8175cd7d>] check_memory_region_inline mm/kasan/kasan.c:285 [inline]
 [<ffffffff8175cd7d>] check_memory_region+0x13d/0x1a0 mm/kasan/kasan.c:299
 [<ffffffff8175d213>] memcpy+0x23/0x50 mm/kasan/kasan.c:334
 [<ffffffff85c83baf>] batadv_iv_ogm_aggregate_new net/batman-adv/bat_iv_ogm.c:710 [inline]
 [<ffffffff85c83baf>] batadv_iv_ogm_queue_add+0x71f/0xf50 net/batman-adv/bat_iv_ogm.c:815
 [<ffffffff85c86dae>] batadv_iv_ogm_schedule+0x95e/0xcc0 net/batman-adv/bat_iv_ogm.c:984
 [<ffffffff85c8761a>] batadv_iv_send_outstanding_bat_ogm_packet+0x4fa/0x8b0 net/batman-adv/bat_iv_ogm.c:1810
 [<ffffffff81393d9d>] process_one_work+0x67d/0x14f0 kernel/workqueue.c:2096
 [<ffffffff81394cea>] worker_thread+0xda/0xf10 kernel/workqueue.c:2230
 [<ffffffff813a5699>] kthread+0x209/0x2d0 kernel/kthread.c:209
 [<ffffffff85de2e8f>] ret_from_fork+0x1f/0x40 arch/x86/entry/entry_64.S:393
Object at ffff88010b75f100, in cache kmalloc-64 size: 64
Allocated:
PID = 6
 [<ffffffff81211826>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67
 [<ffffffff8175d08e>] save_stack mm/kasan/kasan.c:479 [inline]
 [<ffffffff8175d08e>] set_track mm/kasan/kasan.c:491 [inline]
 [<ffffffff8175d08e>] kasan_kmalloc+0xee/0x180 mm/kasan/kasan.c:582
 [<ffffffff81758fc2>] __do_kmalloc mm/slab.c:3737 [inline]
 [<ffffffff81758fc2>] __kmalloc+0x162/0x440 mm/slab.c:3746
 [<ffffffff85cfbe87>] kmalloc include/linux/slab.h:495 [inline]
 [<ffffffff85cfbe87>] batadv_tvlv_realloc_packet_buff net/batman-adv/tvlv.c:288 [inline]
 [<ffffffff85cfbe87>] batadv_tvlv_container_ogm_append+0x117/0x470 net/batman-adv/tvlv.c:329
 [<ffffffff85c86e84>] batadv_iv_ogm_schedule+0xa34/0xcc0 net/batman-adv/bat_iv_ogm.c:947
 [<ffffffff85c8761a>] batadv_iv_send_outstanding_bat_ogm_packet+0x4fa/0x8b0 net/batman-adv/bat_iv_ogm.c:1810
 [<ffffffff81393d9d>] process_one_work+0x67d/0x14f0 kernel/workqueue.c:2096
 [<ffffffff81394cea>] worker_thread+0xda/0xf10 kernel/workqueue.c:2230
 [<ffffffff813a5699>] kthread+0x209/0x2d0 kernel/kthread.c:209
 [<ffffffff85de2e8f>] ret_from_fork+0x1f/0x40 arch/x86/entry/entry_64.S:393
Freed:
PID = 6154
 [<ffffffff81211826>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67
 [<ffffffff8175d6dd>] save_stack mm/kasan/kasan.c:479 [inline]
 [<ffffffff8175d6dd>] set_track mm/kasan/kasan.c:491 [inline]
 [<ffffffff8175d6dd>] kasan_slab_free+0xad/0x180 mm/kasan/kasan.c:555
 [<ffffffff8175b454>] __cache_free mm/slab.c:3515 [inline]
 [<ffffffff8175b454>] kfree+0xd4/0x2d0 mm/slab.c:3832
 [<ffffffff85c82aa4>] batadv_iv_ogm_iface_disable+0x34/0x70 net/batman-adv/bat_iv_ogm.c:393
 [<ffffffff85cb0fbc>] batadv_hardif_disable_interface+0x31c/0xbb0 net/batman-adv/hard-interface.c:636
 [<ffffffff85cda8c9>] batadv_softif_destroy_netlink+0xd9/0x100 net/batman-adv/soft-interface.c:1038
 [<ffffffff84af7661>] default_device_exit_batch+0x241/0x3d0 net/core/dev.c:8247
 [<ffffffff84acf5a6>] ops_exit_list.isra.0+0xd6/0x120 net/core/net_namespace.c:139
 [<ffffffff84ad1860>] cleanup_net+0x2d0/0x540 net/core/net_namespace.c:430
 [<ffffffff81393d9d>] process_one_work+0x67d/0x14f0 kernel/workqueue.c:2096
 [<ffffffff81394cea>] worker_thread+0xda/0xf10 kernel/workqueue.c:2230
 [<ffffffff813a5699>] kthread+0x209/0x2d0 kernel/kthread.c:209
 [<ffffffff85de2e8f>] ret_from_fork+0x1f/0x40 arch/x86/entry/entry_64.S:393
Memory state around the buggy address:
 ffff88010b75f000: 00 00 00 00 00 00 00 06 fc fc fc fc fc fc fc fc
 ffff88010b75f080: 00 00 00 00 00 00 00 04 fc fc fc fc fc fc fc fc
>ffff88010b75f100: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
                   ^
 ffff88010b75f180: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
 ffff88010b75f200: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
==================================================================
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 6 Comm: kworker/u4:0 Tainted: G    B           4.8.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: bat_events batadv_iv_send_outstanding_bat_ogm_packet
task: ffff88012b0ae180 task.stack: ffff88012b0b8000
RIP: 0010:[<ffffffff85c834bf>]  [<ffffffff85c834bf>] batadv_iv_ogm_queue_add+0x2f/0xf50 net/batman-adv/bat_iv_ogm.c:780
RSP: 0018:ffff88012b0bfa78  EFLAGS: 00010296
RAX: dffffc0000000000 RBX: ffff8801295b42c0 RCX: ffff8801128b2500
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003
RBP: ffff88012b0bfb18 R08: ffff8801295b42c0 R09: 0000000000000001
R10: 0000000000000009 R11: 0000000000000000 R12: 000000000000003c
R13: 0000000000000000 R14: ffff8801128b2500 R15: ffff88011f322940
FS:  0000000000000000(0000) GS:ffff88012c000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007ffca2de4660 CR3: 000000010e02a000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 0000000000000000 0000000000000000 0000000000000002 0000000000000000
 ffff88012b0bfb18 0000000000000282 0000000000000000 ffffffff85c86c1d
 ffff880100000000 ffff8801128b2500 ffff88011f322a10 ffff8801128b2500
Call Trace:
 [<ffffffff85c86dae>] batadv_iv_ogm_schedule+0x95e/0xcc0 net/batman-adv/bat_iv_ogm.c:984
 [<ffffffff85c8761a>] batadv_iv_send_outstanding_bat_ogm_packet+0x4fa/0x8b0 net/batman-adv/bat_iv_ogm.c:1810
 [<ffffffff81393d9d>] process_one_work+0x67d/0x14f0 kernel/workqueue.c:2096
 [<ffffffff81394cea>] worker_thread+0xda/0xf10 kernel/workqueue.c:2230
 [<ffffffff813a5699>] kthread+0x209/0x2d0 kernel/kthread.c:209
 [<ffffffff85de2e8f>] ret_from_fork+0x1f/0x40 arch/x86/entry/entry_64.S:393
Code: 00 00 00 fc ff df 55 48 89 e5 41 57 49 89 ff 48 8d 7e 03 41 56 41 55 49 89 f5 41 54 41 89 d4 48 89 fa 48 c1 ea 03 53 48 83 ec 78 <0f> b6 04 02 48 89 fa 48 89 4d a8 83 e2 07 4c 89 45 b8 44 89 4d 
RIP  [<ffffffff85c834bf>] batadv_iv_ogm_queue_add+0x2f/0xf50 net/batman-adv/bat_iv_ogm.c:769
 RSP <ffff88012b0bfa78>
---[ end trace eb011d2cd23186cd ]---