==================================================================
BUG: KASAN: use-after-free in rose_get_neigh+0x1a4/0x5ac net/rose/rose_route.c:692
Read of size 1 at addr ffff0000f4807c30 by task syz.4.1510/9276

CPU: 1 PID: 9276 Comm: syz.4.1510 Not tainted 6.1.134-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2025
Call trace:
 dump_backtrace+0x1c8/0x1f4 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:316 [inline]
 print_report+0x174/0x4c0 mm/kasan/report.c:427
 kasan_report+0xd4/0x130 mm/kasan/report.c:531
 __asan_report_load1_noabort+0x2c/0x38 mm/kasan/report_generic.c:348
 rose_get_neigh+0x1a4/0x5ac net/rose/rose_route.c:692
 rose_connect+0x3b8/0xe44 net/rose/af_rose.c:816
 __sys_connect_file net/socket.c:2011 [inline]
 __sys_connect+0x268/0x290 net/socket.c:2028
 __do_sys_connect net/socket.c:2038 [inline]
 __se_sys_connect net/socket.c:2035 [inline]
 __arm64_sys_connect+0x7c/0x94 net/socket.c:2035
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

Allocated by task 4296:
 kasan_save_stack mm/kasan/common.c:45 [inline]
 kasan_set_track+0x4c/0x80 mm/kasan/common.c:52
 kasan_save_alloc_info+0x24/0x30 mm/kasan/generic.c:505
 ____kasan_kmalloc mm/kasan/common.c:374 [inline]
 __kasan_kmalloc+0xac/0xc4 mm/kasan/common.c:383
 kasan_kmalloc include/linux/kasan.h:211 [inline]
 __do_kmalloc_node mm/slab_common.c:936 [inline]
 __kmalloc_node+0xe0/0x1d0 mm/slab_common.c:943
 kmalloc_array_node include/linux/slab.h:676 [inline]
 kcalloc_node include/linux/slab.h:681 [inline]
 memcg_alloc_slab_cgroups+0x90/0x164 mm/memcontrol.c:2891
 account_slab mm/slab.h:635 [inline]
 allocate_slab mm/slub.c:1957 [inline]
 new_slab+0xd4/0x2f4 mm/slub.c:1992
 ___slab_alloc+0x8bc/0xee0 mm/slub.c:3180
 __slab_alloc mm/slub.c:3279 [inline]
 slab_alloc_node mm/slub.c:3364 [inline]
 slab_alloc mm/slub.c:3406 [inline]
 __kmem_cache_alloc_lru mm/slub.c:3413 [inline]
 kmem_cache_alloc+0x2cc/0x37c mm/slub.c:3422
 anon_vma_chain_alloc mm/rmap.c:141 [inline]
 anon_vma_clone+0x9c/0x468 mm/rmap.c:287
 anon_vma_fork+0x80/0x478 mm/rmap.c:350
 dup_mmap kernel/fork.c:663 [inline]
 dup_mm kernel/fork.c:1541 [inline]
 copy_mm+0xc58/0x1438 kernel/fork.c:1590
 copy_process+0x17a8/0x38f8 kernel/fork.c:2266
 kernel_clone+0x1d8/0x98c kernel/fork.c:2681
 __do_sys_clone kernel/fork.c:2822 [inline]
 __se_sys_clone kernel/fork.c:2790 [inline]
 __arm64_sys_clone+0x1e0/0x258 kernel/fork.c:2790
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

Freed by task 9244:
 kasan_save_stack mm/kasan/common.c:45 [inline]
 kasan_set_track+0x4c/0x80 mm/kasan/common.c:52
 kasan_save_free_info+0x38/0x5c mm/kasan/generic.c:516
 ____kasan_slab_free+0x144/0x1c0 mm/kasan/common.c:236
 __kasan_slab_free+0x18/0x28 mm/kasan/common.c:244
 kasan_slab_free include/linux/kasan.h:177 [inline]
 slab_free_hook mm/slub.c:1724 [inline]
 slab_free_freelist_hook mm/slub.c:1750 [inline]
 slab_free mm/slub.c:3661 [inline]
 __kmem_cache_free+0x2c0/0x4b4 mm/slub.c:3674
 kfree+0xcc/0x1b8 mm/slab_common.c:988
 memcg_free_slab_cgroups mm/slab.h:456 [inline]
 unaccount_slab mm/slab.h:645 [inline]
 __free_slab+0xb0/0x29c mm/slub.c:2015
 free_slab mm/slub.c:2031 [inline]
 discard_slab+0x5c/0xdc mm/slub.c:2037
 __slab_free+0x1e0/0x26c mm/slub.c:3574
 do_slab_free mm/slub.c:3615 [inline]
 ___cache_free+0x164/0x198 mm/slub.c:3668
 qlink_free+0x5c/0xac mm/kasan/quarantine.c:168
 qlist_free_all+0x40/0xcc mm/kasan/quarantine.c:187
 kasan_quarantine_reduce+0x124/0x130 mm/kasan/quarantine.c:294
 __kasan_slab_alloc+0x2c/0x8c mm/kasan/common.c:305
 kasan_slab_alloc include/linux/kasan.h:201 [inline]
 slab_post_alloc_hook+0x74/0x458 mm/slab.h:737
 slab_alloc_node mm/slub.c:3398 [inline]
 slab_alloc mm/slub.c:3406 [inline]
 __kmem_cache_alloc_lru mm/slub.c:3413 [inline]
 kmem_cache_alloc+0x230/0x37c mm/slub.c:3422
 vm_area_alloc+0x2c/0xe0 kernel/fork.c:459
 __mmap_region mm/mmap.c:2741 [inline]
 mmap_region+0x1118/0x2208 mm/mmap.c:2904
 do_mmap+0x9ac/0x1118 mm/mmap.c:1424
 vm_mmap_pgoff+0x1a4/0x2b4 mm/util.c:520
 ksys_mmap_pgoff+0x3c8/0x5b0 mm/mmap.c:1470
 __do_sys_mmap arch/arm64/kernel/sys.c:28 [inline]
 __se_sys_mmap arch/arm64/kernel/sys.c:21 [inline]
 __arm64_sys_mmap+0xf8/0x110 arch/arm64/kernel/sys.c:21
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

Last potentially related work creation:
 kasan_save_stack+0x40/0x70 mm/kasan/common.c:45
 __kasan_record_aux_stack+0xcc/0xe8 mm/kasan/generic.c:486
 kasan_record_aux_stack_noalloc+0x14/0x20 mm/kasan/generic.c:496
 kvfree_call_rcu+0xb4/0x714 kernel/rcu/tree.c:3401
 drop_sysctl_table+0x274/0x3a0 fs/proc/proc_sysctl.c:1727
 drop_sysctl_table+0x284/0x3a0 fs/proc/proc_sysctl.c:1730
 unregister_sysctl_table+0x90/0x12c fs/proc/proc_sysctl.c:1765
 unregister_net_sysctl_table+0x20/0x30 net/sysctl_net.c:174
 __devinet_sysctl_unregister net/ipv4/devinet.c:2636 [inline]
 devinet_sysctl_unregister net/ipv4/devinet.c:2664 [inline]
 inetdev_destroy net/ipv4/devinet.c:329 [inline]
 inetdev_event+0x560/0x1308 net/ipv4/devinet.c:1616
 notifier_call_chain kernel/notifier.c:87 [inline]
 raw_notifier_call_chain+0xd4/0x164 kernel/notifier.c:455
 call_netdevice_notifiers_info net/core/dev.c:2001 [inline]
 call_netdevice_notifiers_extack net/core/dev.c:2039 [inline]
 call_netdevice_notifiers net/core/dev.c:2053 [inline]
 unregister_netdevice_many+0xe68/0x1798 net/core/dev.c:10978
 vti6_exit_batch_net+0x3ac/0x410 net/ipv6/ip6_vti.c:1190
 ops_exit_list net/core/net_namespace.c:177 [inline]
 setup_net+0x894/0xb88 net/core/net_namespace.c:368
 copy_net_ns+0x2ec/0x58c net/core/net_namespace.c:508
 create_new_namespaces+0x344/0x614 kernel/nsproxy.c:110
 unshare_nsproxy_namespaces+0x108/0x158 kernel/nsproxy.c:226
 ksys_unshare+0x424/0x7e4 kernel/fork.c:3201
 __do_sys_unshare kernel/fork.c:3272 [inline]
 __se_sys_unshare kernel/fork.c:3270 [inline]
 __arm64_sys_unshare+0x3c/0x50 kernel/fork.c:3270
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2bc arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x58/0x13c arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x168 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

The buggy address belongs to the object at ffff0000f4807c00
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 48 bytes inside of
 512-byte region [ffff0000f4807c00, ffff0000f4807e00)

The buggy address belongs to the physical page:
page:00000000bdab1791 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff0000f4804000 pfn:0x134804
head:00000000bdab1791 order:2 compound_mapcount:0 compound_pincount:0
flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000010200 fffffc00032ee808 fffffc0003111108 ffff0000c0002600
raw: ffff0000f4804000 0000000000100004 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000f4807b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff0000f4807b80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff0000f4807c00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                     ^
 ffff0000f4807c80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff0000f4807d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================