==================================================================
BUG: KASAN: global-out-of-bounds in fib6_add_rt2node net/ipv6/ip6_fib.c:1096 [inline]
BUG: KASAN: global-out-of-bounds in fib6_add+0xac4/0x3ac0 net/ipv6/ip6_fib.c:1488
Read of size 8 at addr ffff8000974c08a8 by task kworker/u8:0/12

CPU: 1 UID: 0 PID: 12 Comm: kworker/u8:0 Not tainted 6.15.0-rc7-syzkaller-gd7fa1af5b33e #0 PREEMPT 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025
Workqueue: events_unbound linkwatch_event
Call trace:
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:466 (C)
 __dump_stack+0x30/0x40 lib/dump_stack.c:94
 dump_stack_lvl+0xd8/0x12c lib/dump_stack.c:120
 print_address_description+0xa8/0x254 mm/kasan/report.c:408
 print_report+0x68/0x84 mm/kasan/report.c:521
 kasan_report+0xb0/0x110 mm/kasan/report.c:634
 __asan_report_load8_noabort+0x20/0x2c mm/kasan/report_generic.c:381
 fib6_add_rt2node net/ipv6/ip6_fib.c:1096 [inline]
 fib6_add+0xac4/0x3ac0 net/ipv6/ip6_fib.c:1488
 __ip6_ins_rt net/ipv6/route.c:1351 [inline]
 ip6_route_add+0x8c/0x18c net/ipv6/route.c:3900
 addrconf_add_mroute net/ipv6/addrconf.c:2551 [inline]
 addrconf_add_dev+0x204/0x2e4 net/ipv6/addrconf.c:2569
 addrconf_dev_config net/ipv6/addrconf.c:3477 [inline]
 addrconf_init_auto_addrs+0x4d4/0x990 net/ipv6/addrconf.c:3571
 addrconf_notify+0x8cc/0xcdc net/ipv6/addrconf.c:3744
 notifier_call_chain+0x1b8/0x4e4 kernel/notifier.c:85
 raw_notifier_call_chain+0x3c/0x50 kernel/notifier.c:453
 call_netdevice_notifiers_info net/core/dev.c:2176 [inline]
 netif_state_change+0x2b8/0x3fc net/core/dev.c:1530
 linkwatch_do_dev+0x108/0x1a8 net/core/link_watch.c:186
 __linkwatch_run_queue+0x498/0x7f8 net/core/link_watch.c:244
 linkwatch_event+0x58/0x68 net/core/link_watch.c:304
 process_one_work+0x7e8/0x156c kernel/workqueue.c:3238
 process_scheduled_works kernel/workqueue.c:3319 [inline]
 worker_thread+0x958/0xed8 kernel/workqueue.c:3400
 kthread+0x5fc/0x75c kernel/kthread.c:464
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:847

The buggy address belongs to the variable:
 binder_devices+0x8/0x20

The buggy address belongs to the virtual mapping at
 [ffff80008f290000, ffff800097531000) created by:
 declare_kernel_vmas+0xa8/0xb8 arch/arm64/mm/mmu.c:774

The buggy address belongs to the physical page:
page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2100c0
flags: 0x5ffc00000002000(reserved|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000002000 fffffdffc7403008 fffffdffc7403008 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8000974c0780: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
 ffff8000974c0800: f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
>ffff8000974c0880: f9 f9 f9 f9 00 f9 f9 f9 00 00 f9 f9 00 00 00 00
                                  ^
 ffff8000974c0900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8000974c0980: 00 00 00 00 00 00 00 00 00 00 04 f9 f9 f9 f9 f9
==================================================================
bridge0: port 2(bridge_slave_1) entered blocking state
bridge0: port 2(bridge_slave_1) entered forwarding state