IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready ================================================================== BUG: KASAN: slab-out-of-bounds in ip6_tnl_xmit2+0x2043/0x20d0 net/ipv6/ip6_tunnel.c:987 Read of size 16 at addr ffff8800b0f6afb0 by task syz-executor021/3755 CPU: 1 PID: 3755 Comm: syz-executor021 Not tainted 4.4.147-ga5fc665 #80 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 0000000000000000 40e1c381715200bc ffff8801cbaf7020 ffffffff81e12a4d ffffea0002c3da00 ffff8800b0f6afb0 0000000000000000 ffff8800b0f6afb8 ffff8800b094e600 ffff8801cbaf7058 ffffffff81517fd6 ffff8800b0f6afb0 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x124 lib/dump_stack.c:51 [] print_address_description+0x6c/0x216 mm/kasan/report.c:252 [] kasan_report_error mm/kasan/report.c:351 [inline] [] kasan_report.cold.7+0x175/0x2f7 mm/kasan/report.c:408 [] __asan_report_load_n_noabort+0xf/0x20 mm/kasan/report.c:439 [] ip6_tnl_xmit2+0x2043/0x20d0 net/ipv6/ip6_tunnel.c:987 [] ip4ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1129 [inline] [] ip6_tnl_xmit+0x910/0xc60 net/ipv6/ip6_tunnel.c:1203 [] __netdev_start_xmit include/linux/netdevice.h:3743 [inline] [] netdev_start_xmit include/linux/netdevice.h:3752 [inline] [] xmit_one net/core/dev.c:2759 [inline] [] dev_hard_start_xmit+0x7b1/0x11c0 net/core/dev.c:2775 [] __dev_queue_xmit+0x16c0/0x1c80 net/core/dev.c:3207 [] dev_queue_xmit+0x17/0x20 net/core/dev.c:3241 [] neigh_direct_output+0x15/0x20 net/core/neighbour.c:1366 [] dst_neigh_output include/net/dst.h:461 [inline] [] ip_finish_output2+0x6ab/0x1110 net/ipv4/ip_output.c:213 [] ip_finish_output+0x7be/0xc00 net/ipv4/ip_output.c:288 [] NF_HOOK_COND include/linux/netfilter.h:240 [inline] [] ip_output+0x219/0x4c0 net/ipv4/ip_output.c:362 [] dst_output include/net/dst.h:498 [inline] [] ip_local_out+0x9b/0x180 net/ipv4/ip_output.c:119 [] ip_queue_xmit+0x88e/0x1af0 net/ipv4/ip_output.c:461 [] __tcp_transmit_skb+0x1691/0x2c50 net/ipv4/tcp_output.c:1034 [] tcp_transmit_skb net/ipv4/tcp_output.c:1047 [inline] [] tcp_write_xmit+0x6fb/0x4d20 net/ipv4/tcp_output.c:2137 [] __tcp_push_pending_frames+0xa0/0x290 net/ipv4/tcp_output.c:2319 [] tcp_send_fin+0x176/0xab0 net/ipv4/tcp_output.c:2895 [] tcp_close+0xca0/0xf70 net/ipv4/tcp.c:2112 [] inet_release+0xff/0x1d0 net/ipv4/af_inet.c:435 [] sock_release+0x96/0x1c0 net/socket.c:587 [] sock_close+0x16/0x20 net/socket.c:1038 [] __fput+0x235/0x6f0 fs/file_table.c:208 [] ____fput+0x15/0x20 fs/file_table.c:244 [] task_work_run+0x10f/0x190 kernel/task_work.c:115 [] exit_task_work include/linux/task_work.h:21 [inline] [] do_exit+0x9e5/0x26b0 kernel/exit.c:755 [] do_group_exit+0x111/0x330 kernel/exit.c:885 [] SYSC_exit_group kernel/exit.c:896 [inline] [] SyS_exit_group+0x1d/0x20 kernel/exit.c:894 [] entry_SYSCALL_64_fastpath+0x22/0x9e Allocated by task 3755: [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63 [] save_stack+0x43/0xd0 mm/kasan/kasan.c:512 [] set_track mm/kasan/kasan.c:524 [inline] [] kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:616 [] __kmalloc+0x124/0x310 mm/slub.c:3613 [] kmalloc include/linux/slab.h:481 [inline] [] kzalloc include/linux/slab.h:620 [inline] [] neigh_alloc net/core/neighbour.c:285 [inline] [] __neigh_create+0x1d6/0x1b20 net/core/neighbour.c:457 [] neigh_create include/net/neighbour.h:313 [inline] [] ipv4_neigh_lookup+0x4dd/0x700 net/ipv4/route.c:464 [] dst_neigh_lookup include/net/dst.h:466 [inline] [] ip6_tnl_xmit2+0x613/0x20d0 net/ipv6/ip6_tunnel.c:982 [] ip4ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1129 [inline] [] ip6_tnl_xmit+0x910/0xc60 net/ipv6/ip6_tunnel.c:1203 [] __netdev_start_xmit include/linux/netdevice.h:3743 [inline] [] netdev_start_xmit include/linux/netdevice.h:3752 [inline] [] xmit_one net/core/dev.c:2759 [inline] [] dev_hard_start_xmit+0x7b1/0x11c0 net/core/dev.c:2775 [] __dev_queue_xmit+0x16c0/0x1c80 net/core/dev.c:3207 [] dev_queue_xmit+0x17/0x20 net/core/dev.c:3241 [] neigh_direct_output+0x15/0x20 net/core/neighbour.c:1366 [] dst_neigh_output include/net/dst.h:461 [inline] [] ip_finish_output2+0x6ab/0x1110 net/ipv4/ip_output.c:213 [] ip_finish_output+0x7be/0xc00 net/ipv4/ip_output.c:288 [] NF_HOOK_COND include/linux/netfilter.h:240 [inline] [] ip_output+0x219/0x4c0 net/ipv4/ip_output.c:362 [] dst_output include/net/dst.h:498 [inline] [] ip_local_out+0x9b/0x180 net/ipv4/ip_output.c:119 [] ip_queue_xmit+0x88e/0x1af0 net/ipv4/ip_output.c:461 [] __tcp_transmit_skb+0x1691/0x2c50 net/ipv4/tcp_output.c:1034 [] tcp_transmit_skb net/ipv4/tcp_output.c:1047 [inline] [] tcp_write_xmit+0x6fb/0x4d20 net/ipv4/tcp_output.c:2137 [] __tcp_push_pending_frames+0xa0/0x290 net/ipv4/tcp_output.c:2319 [] tcp_send_fin+0x176/0xab0 net/ipv4/tcp_output.c:2895 [] tcp_close+0xca0/0xf70 net/ipv4/tcp.c:2112 [] inet_release+0xff/0x1d0 net/ipv4/af_inet.c:435 [] sock_release+0x96/0x1c0 net/socket.c:587 [] sock_close+0x16/0x20 net/socket.c:1038 [] __fput+0x235/0x6f0 fs/file_table.c:208 [] ____fput+0x15/0x20 fs/file_table.c:244 [] task_work_run+0x10f/0x190 kernel/task_work.c:115 [] exit_task_work include/linux/task_work.h:21 [inline] [] do_exit+0x9e5/0x26b0 kernel/exit.c:755 [] do_group_exit+0x111/0x330 kernel/exit.c:885 [] SYSC_exit_group kernel/exit.c:896 [inline] [] SyS_exit_group+0x1d/0x20 kernel/exit.c:894 [] entry_SYSCALL_64_fastpath+0x22/0x9e Freed by task 0: (stack is not available) The buggy address belongs to the object at ffff8800b0f6ad00 which belongs to the cache kmalloc-1024 of size 1024 The buggy address is located 688 bytes inside of 1024-byte region [ffff8800b0f6ad00, ffff8800b0f6b100) The buggy address belongs to the page: PANIC: double fault, error_code: 0x0 CPU: 1 PID: 3755 Comm: syz-executor021 Not tainted 4.4.147-ga5fc665 #80 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 task: ffff8801cbb10000 task.stack: ffff8801cbaf0000 RIP: 0010:[] [] dump_page_badflags+0x4/0x70 mm/debug.c:84 RSP: 0018:ffff880100000000 EFLAGS: 00010046 RAX: ffff8801cbb10000 RBX: ffffea0002c3da00 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff83aaad60 RDI: ffffea0002c3da00 RBP: ffff880100000000 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: ffffffff858f0274 R12: 0000000000000000 R13: ffffffff83aaad60 R14: ffff8800b0f6ad00 R15: ffff8800b0f6b100 FS: 0000000000000000(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff8800fffffff8 CR3: 000000000440c000 CR4: 00000000001606f0 Stack: Call Trace: Code: e8 3e 48 69 c0 80 06 00 00 f0 48 ff 80 28 5b 9f 84 5b 5d c3 48 89 df e8 3b c9 06 00 eb dd 66 0f 1f 84 00 00 00 00 00 55 48 89 e5 <41> 57 41 56 41 55 49 89 f5 41 54 49 89 d4 53 48 89 fb 48 83 ec