device lo entered promiscuous mode ================================================================== BUG: KASAN: use-after-free in fib6_ifup+0x212/0x220 net/ipv6/route.c:3573 Read of size 8 at addr ffff8801dadd97c0 by task syz-executor4/1298 CPU: 1 PID: 1298 Comm: syz-executor4 Not tainted 4.15.0-rc7+ #185 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 print_address_description+0x73/0x250 mm/kasan/report.c:252 kasan_report_error mm/kasan/report.c:351 [inline] kasan_report+0x25b/0x340 mm/kasan/report.c:409 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:430 fib6_ifup+0x212/0x220 net/ipv6/route.c:3573 fib6_clean_node+0x389/0x580 net/ipv6/ip6_fib.c:1912 fib6_walk_continue+0x46c/0x8a0 net/ipv6/ip6_fib.c:1838 fib6_walk+0x91/0xf0 net/ipv6/ip6_fib.c:1886 fib6_clean_tree+0x1e6/0x340 net/ipv6/ip6_fib.c:1963 __fib6_clean_all+0x1f4/0x3a0 net/ipv6/ip6_fib.c:1979 fib6_clean_all+0x27/0x30 net/ipv6/ip6_fib.c:1990 rt6_sync_up+0x15e/0x1c0 net/ipv6/route.c:3592 addrconf_notify+0x3f6/0x2310 net/ipv6/addrconf.c:3490 notifier_call_chain+0x136/0x2c0 kernel/notifier.c:93 __raw_notifier_call_chain kernel/notifier.c:394 [inline] raw_notifier_call_chain+0x2d/0x40 kernel/notifier.c:401 call_netdevice_notifiers_info+0x32/0x70 net/core/dev.c:1708 call_netdevice_notifiers net/core/dev.c:1726 [inline] __dev_notify_flags+0x15d/0x430 net/core/dev.c:6933 dev_change_flags+0xf5/0x140 net/core/dev.c:6969 devinet_ioctl+0x125b/0x19e0 net/ipv4/devinet.c:1083 inet_ioctl+0x117/0x1c0 net/ipv4/af_inet.c:904 sock_do_ioctl+0x65/0xb0 net/socket.c:958 sock_ioctl+0x2c2/0x440 net/socket.c:1055 vfs_ioctl fs/ioctl.c:46 [inline] do_vfs_ioctl+0x1b1/0x1520 fs/ioctl.c:686 SYSC_ioctl fs/ioctl.c:701 [inline] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692 entry_SYSCALL_64_fastpath+0x23/0x9a RIP: 0033:0x452ac9 RSP: 002b:00007fd556348c58 EFLAGS: 00000212 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 000000000071bea0 RCX: 0000000000452ac9 RDX: 000000002000d000 RSI: 0000000000008914 RDI: 0000000000000014 RBP: 00000000000000d5 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006ef498 R13: 00000000ffffffff R14: 00007fd5563496d4 R15: 0000000000000000 Allocated by task 32661: save_stack+0x43/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:489 kmem_cache_alloc+0x12e/0x760 mm/slab.c:3544 dst_alloc+0x11f/0x1a0 net/core/dst.c:104 __ip6_dst_alloc+0x35/0x90 net/ipv6/route.c:361 ip6_dst_alloc+0x29/0xb0 net/ipv6/route.c:376 ip6_route_info_create+0x4ff/0x2e20 net/ipv6/route.c:2538 ip6_route_add+0xa2/0x190 net/ipv6/route.c:2779 addrconf_add_mroute+0x2bf/0x380 net/ipv6/addrconf.c:2376 addrconf_add_dev+0xf8/0x180 net/ipv6/addrconf.c:2394 inet6_addr_add+0xa8/0x390 net/ipv6/addrconf.c:2838 addrconf_add_ifaddr+0x145/0x1d0 net/ipv6/addrconf.c:2954 inet6_ioctl+0x111/0x1e0 net/ipv6/af_inet6.c:523 sock_do_ioctl+0x65/0xb0 net/socket.c:958 sock_ioctl+0x2c2/0x440 net/socket.c:1055 vfs_ioctl fs/ioctl.c:46 [inline] do_vfs_ioctl+0x1b1/0x1520 fs/ioctl.c:686 SYSC_ioctl fs/ioctl.c:701 [inline] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692 entry_SYSCALL_64_fastpath+0x23/0x9a Freed by task 32661: save_stack+0x43/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524 __cache_free mm/slab.c:3488 [inline] kmem_cache_free+0x83/0x2a0 mm/slab.c:3746 dst_destroy+0x257/0x370 net/core/dst.c:140 dst_release_immediate+0x4c/0x90 net/core/dst.c:205 fib6_add+0x82b/0x1540 net/ipv6/ip6_fib.c:1290 __ip6_ins_rt+0x6c/0x90 net/ipv6/route.c:1003 ip6_route_add+0x141/0x190 net/ipv6/route.c:2790 addrconf_add_mroute+0x2bf/0x380 net/ipv6/addrconf.c:2376 addrconf_add_dev+0xf8/0x180 net/ipv6/addrconf.c:2394 inet6_addr_add+0xa8/0x390 net/ipv6/addrconf.c:2838 addrconf_add_ifaddr+0x145/0x1d0 net/ipv6/addrconf.c:2954 inet6_ioctl+0x111/0x1e0 net/ipv6/af_inet6.c:523 sock_do_ioctl+0x65/0xb0 net/socket.c:958 sock_ioctl+0x2c2/0x440 net/socket.c:1055 vfs_ioctl fs/ioctl.c:46 [inline] do_vfs_ioctl+0x1b1/0x1520 fs/ioctl.c:686 SYSC_ioctl fs/ioctl.c:701 [inline] SyS_ioctl+0x8f/0xc0 fs/ioctl.c:692 entry_SYSCALL_64_fastpath+0x23/0x9a The buggy address belongs to the object at ffff8801dadd97c0 which belongs to the cache ip6_dst_cache of size 320 The buggy address is located 0 bytes inside of 320-byte region [ffff8801dadd97c0, ffff8801dadd9900) The buggy address belongs to the page: page:ffffea00076b7640 count:1 mapcount:0 mapping:ffff8801dadd9040 index:0x0 flags: 0x2fffc0000000100(slab) raw: 02fffc0000000100 ffff8801dadd9040 0000000000000000 000000010000000a raw: ffffea0007449060 ffffea0006f43260 ffff8801d30d93c0 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8801dadd9680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8801dadd9700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8801dadd9780: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb ^ ffff8801dadd9800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8801dadd9880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================