KASAN: slab-out-of-bounds Read in __ipv6_addr_type

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 7e85a4b7 ANDROID: tracing: fix race condition reading save..
git tree: android-4.4
console output: https://syzkaller.appspot.com/x/log.txt?x=13b584ca400000
kernel config: https://syzkaller.appspot.com/x/.config?x=3b98108923701fc1
dashboard link: https://syzkaller.appspot.com/bug?extid=ec408b810864a735c0fe
compiler: gcc (GCC) 8.0.1 20180413 (experimental)

Unfortunately, I don't have any reproducer for this crash yet.

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+ec408b...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: slab-out-of-bounds in __ipv6_addr_type+0x26c/0x290
net/ipv6/addrconf_core.c:68
Read of size 4 at addr ffff8800af34d938 by task syz-executor7/19038

CPU: 1 PID: 19038 Comm: syz-executor7 Not tainted 4.4.153+ #92
0000000000000000 1a60c99b76b48111 ffff8800afc26c70 ffffffff81a4571d
ffffea0002bcd300 ffff8800af34d938 0000000000000000 ffff8800af34d938
ffff8801c9f7c400 ffff8800afc26ca8 ffffffff8146ae90 ffff8800af34d938
Call Trace:
[<ffffffff81a4571d>] __dump_stack lib/dump_stack.c:15 [inline]
[<ffffffff81a4571d>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
[<ffffffff8146ae90>] print_address_description+0x6c/0x217
mm/kasan/report.c:252
[<ffffffff8146b1b0>] kasan_report_error mm/kasan/report.c:351 [inline]
[<ffffffff8146b1b0>] kasan_report.cold.6+0x175/0x2f7 mm/kasan/report.c:408
[<ffffffff81460294>] __asan_report_load4_noabort+0x14/0x20
mm/kasan/report.c:428
[<ffffffff82622dfc>] __ipv6_addr_type+0x26c/0x290
net/ipv6/addrconf_core.c:68
[<ffffffff8261854b>] ipv6_addr_type include/net/ipv6.h:337 [inline]
[<ffffffff8261854b>] ip6_tnl_xmit2+0x2bb/0x2350 net/ipv6/ip6_tunnel.c:988
[<ffffffff8261befa>] ip4ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1129 [inline]
[<ffffffff8261befa>] ip6_tnl_xmit+0x91a/0xc70 net/ipv6/ip6_tunnel.c:1203
[<ffffffff821b1cbd>] __netdev_start_xmit include/linux/netdevice.h:3743
[inline]
[<ffffffff821b1cbd>] netdev_start_xmit include/linux/netdevice.h:3752
[inline]
[<ffffffff821b1cbd>] xmit_one net/core/dev.c:2759 [inline]
[<ffffffff821b1cbd>] dev_hard_start_xmit+0x7bd/0x11c0 net/core/dev.c:2775
[<ffffffff821b4075>] __dev_queue_xmit+0x16f5/0x1c30 net/core/dev.c:3207
[<ffffffff821b45c7>] dev_queue_xmit+0x17/0x20 net/core/dev.c:3241
[<ffffffff821c8f95>] neigh_direct_output+0x15/0x20
net/core/neighbour.c:1366
[<ffffffff8232f470>] dst_neigh_output include/net/dst.h:461 [inline]
[<ffffffff8232f470>] ip_finish_output2+0x8f0/0x1100
net/ipv4/ip_output.c:213
[<ffffffff82336302>] ip_finish_output+0x882/0xc00 net/ipv4/ip_output.c:288
[<ffffffff82339ef9>] NF_HOOK_COND include/linux/netfilter.h:240 [inline]
[<ffffffff82339ef9>] ip_output+0x219/0x4c0 net/ipv4/ip_output.c:362
[<ffffffff82336e1b>] dst_output include/net/dst.h:498 [inline]
[<ffffffff82336e1b>] ip_local_out+0x9b/0x180 net/ipv4/ip_output.c:119
[<ffffffff8233cb3c>] ip_send_skb+0x3c/0xc0 net/ipv4/ip_output.c:1453
[<ffffffff823e20e3>] udp_send_skb+0x503/0xc70 net/ipv4/udp.c:842
[<ffffffff823e8f69>] udp_sendmsg+0x16c9/0x1c70 net/ipv4/udp.c:1072
[<ffffffff82579a3d>] udpv6_sendmsg+0x12cd/0x24c0 net/ipv6/udp.c:1173
[<ffffffff82412203>] inet_sendmsg+0x203/0x4d0 net/ipv4/af_inet.c:755
[<ffffffff82146f7b>] sock_sendmsg_nosec net/socket.c:638 [inline]
[<ffffffff82146f7b>] sock_sendmsg+0xbb/0x110 net/socket.c:648
[<ffffffff82148da5>] ___sys_sendmsg+0x745/0x880 net/socket.c:1975
[<ffffffff8214bdf6>] __sys_sendmsg+0xd6/0x190 net/socket.c:2009
[<ffffffff8214bedd>] SYSC_sendmsg net/socket.c:2020 [inline]
[<ffffffff8214bedd>] SyS_sendmsg+0x2d/0x50 net/socket.c:2016
[<ffffffff8267cca1>] entry_SYSCALL_64_fastpath+0x1e/0x9a

Allocated by task 19038:
[<ffffffff8102dd46>] save_stack_trace+0x26/0x50
arch/x86/kernel/stacktrace.c:63
[<ffffffff8145f2f2>] save_stack mm/kasan/kasan.c:512 [inline]
[<ffffffff8145f2f2>] set_track mm/kasan/kasan.c:524 [inline]
[<ffffffff8145f2f2>] kasan_kmalloc.part.1+0x62/0xf0 mm/kasan/kasan.c:616
[<ffffffff8145f56f>] kasan_kmalloc+0xaf/0xc0 mm/kasan/kasan.c:601
[<ffffffff8145ba74>] __kmalloc+0x124/0x310 mm/slub.c:3613
[<ffffffff821d1016>] kmalloc include/linux/slab.h:481 [inline]
[<ffffffff821d1016>] kzalloc include/linux/slab.h:620 [inline]
[<ffffffff821d1016>] neigh_alloc net/core/neighbour.c:285 [inline]
[<ffffffff821d1016>] __neigh_create+0x1d6/0x1b20 net/core/neighbour.c:457
[<ffffffff82309c1e>] neigh_create include/net/neighbour.h:313 [inline]
[<ffffffff82309c1e>] ipv4_neigh_lookup+0x4de/0x700 net/ipv4/route.c:464
[<ffffffff8261851a>] dst_neigh_lookup include/net/dst.h:466 [inline]
[<ffffffff8261851a>] ip6_tnl_xmit2+0x28a/0x2350 net/ipv6/ip6_tunnel.c:982
[<ffffffff8261befa>] ip4ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1129 [inline]
[<ffffffff8261befa>] ip6_tnl_xmit+0x91a/0xc70 net/ipv6/ip6_tunnel.c:1203
[<ffffffff821b1cbd>] __netdev_start_xmit include/linux/netdevice.h:3743
[inline]
[<ffffffff821b1cbd>] netdev_start_xmit include/linux/netdevice.h:3752
[inline]
[<ffffffff821b1cbd>] xmit_one net/core/dev.c:2759 [inline]
[<ffffffff821b1cbd>] dev_hard_start_xmit+0x7bd/0x11c0 net/core/dev.c:2775
[<ffffffff821b4075>] __dev_queue_xmit+0x16f5/0x1c30 net/core/dev.c:3207
[<ffffffff821b45c7>] dev_queue_xmit+0x17/0x20 net/core/dev.c:3241
[<ffffffff821c8f95>] neigh_direct_output+0x15/0x20
net/core/neighbour.c:1366
[<ffffffff8232f470>] dst_neigh_output include/net/dst.h:461 [inline]
[<ffffffff8232f470>] ip_finish_output2+0x8f0/0x1100
net/ipv4/ip_output.c:213
[<ffffffff82336302>] ip_finish_output+0x882/0xc00 net/ipv4/ip_output.c:288
[<ffffffff82339ef9>] NF_HOOK_COND include/linux/netfilter.h:240 [inline]
[<ffffffff82339ef9>] ip_output+0x219/0x4c0 net/ipv4/ip_output.c:362
[<ffffffff82336e1b>] dst_output include/net/dst.h:498 [inline]
[<ffffffff82336e1b>] ip_local_out+0x9b/0x180 net/ipv4/ip_output.c:119
[<ffffffff8233cb3c>] ip_send_skb+0x3c/0xc0 net/ipv4/ip_output.c:1453
[<ffffffff823e20e3>] udp_send_skb+0x503/0xc70 net/ipv4/udp.c:842
[<ffffffff823e8f69>] udp_sendmsg+0x16c9/0x1c70 net/ipv4/udp.c:1072
[<ffffffff82579a3d>] udpv6_sendmsg+0x12cd/0x24c0 net/ipv6/udp.c:1173
[<ffffffff82412203>] inet_sendmsg+0x203/0x4d0 net/ipv4/af_inet.c:755
[<ffffffff82146f7b>] sock_sendmsg_nosec net/socket.c:638 [inline]
[<ffffffff82146f7b>] sock_sendmsg+0xbb/0x110 net/socket.c:648
[<ffffffff82148da5>] ___sys_sendmsg+0x745/0x880 net/socket.c:1975
[<ffffffff8214bdf6>] __sys_sendmsg+0xd6/0x190 net/socket.c:2009
[<ffffffff8214bedd>] SYSC_sendmsg net/socket.c:2020 [inline]
[<ffffffff8214bedd>] SyS_sendmsg+0x2d/0x50 net/socket.c:2016
[<ffffffff8267cca1>] entry_SYSCALL_64_fastpath+0x1e/0x9a

Freed by task 2137:
[<ffffffff8102dd46>] save_stack_trace+0x26/0x50
arch/x86/kernel/stacktrace.c:63
[<ffffffff8145fbec>] save_stack mm/kasan/kasan.c:512 [inline]
[<ffffffff8145fbec>] set_track mm/kasan/kasan.c:524 [inline]
[<ffffffff8145fbec>] kasan_slab_free+0xac/0x190 mm/kasan/kasan.c:589
[<ffffffff8145d104>] slab_free_hook mm/slub.c:1383 [inline]
[<ffffffff8145d104>] slab_free_freelist_hook mm/slub.c:1405 [inline]
[<ffffffff8145d104>] slab_free mm/slub.c:2859 [inline]
[<ffffffff8145d104>] kfree+0xf4/0x310 mm/slub.c:3749
[<ffffffff8121382e>] syslog_print kernel/printk/printk.c:1202 [inline]
[<ffffffff8121382e>] do_syslog+0x93e/0xb20 kernel/printk/printk.c:1331
[<ffffffff815c9a84>] kmsg_read+0x74/0xa0 fs/proc/kmsg.c:39
[<ffffffff815a275d>] proc_reg_read+0xfd/0x180 fs/proc/inode.c:202
[<ffffffff8147106c>] __vfs_read+0x11c/0x3d0 fs/read_write.c:432
[<ffffffff81472d10>] vfs_read+0x130/0x360 fs/read_write.c:454
[<ffffffff81475539>] SYSC_read fs/read_write.c:569 [inline]
[<ffffffff81475539>] SyS_read+0xd9/0x1c0 fs/read_write.c:562
[<ffffffff8267cca1>] entry_SYSCALL_64_fastpath+0x1e/0x9a

The buggy address belongs to the object at ffff8800af34d680
which belongs to the cache kmalloc-1024 of size 1024
The buggy address is located 696 bytes inside of
1024-byte region [ffff8800af34d680, ffff8800af34da80)
The buggy address belongs to the page:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 0 at kernel/locking/lockdep.c:973 lock_accessed
kernel/locking/lockdep.c:973 [inline]()
WARNING: CPU: 0 PID: 0 at kernel/locking/lockdep.c:973 __bfs+0x2a9/0x5f0
kernel/locking/lockdep.c:1040()


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.