[moderation] [net?] KASAN: slab-use-after-free Read in fib6_run_gc

[syzbot]

Hello,

syzbot found the following issue on:

HEAD commit: 0128e0962959 Merge branch 'for-next/core' into for-kernelci
git tree: git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux.git for-kernelci
console output: https://syzkaller.appspot.com/x/log.txt?x=14eb5456e80000
kernel config: https://syzkaller.appspot.com/x/.config?x=4a5315801b1125b7
dashboard link: https://syzkaller.appspot.com/bug?extid=9d5a439d6a945ff981b7
compiler: Debian clang version 15.0.6, GNU ld (GNU Binutils for Debian) 2.40
userspace arch: arm64
CC: [da...@davemloft.net dsa...@kernel.org edum...@google.com ku...@kernel.org linux-...@vger.kernel.org net...@vger.kernel.org pab...@redhat.com]

Unfortunately, I don't have any reproducer for this issue yet.

Downloadable assets:
disk image: https://storage.googleapis.com/syzbot-assets/6d500f037bb9/disk-0128e096.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/8052b4b0e8b4/vmlinux-0128e096.xz
kernel image: https://storage.googleapis.com/syzbot-assets/97b034884d53/Image-0128e096.gz.xz

IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+9d5a43...@syzkaller.appspotmail.com

==================================================================
BUG: KASAN: slab-use-after-free in fib6_gc_table net/ipv6/ip6_fib.c:2331 [inline]
BUG: KASAN: slab-use-after-free in fib6_gc_all net/ipv6/ip6_fib.c:2347 [inline]
BUG: KASAN: slab-use-after-free in fib6_run_gc+0x2fc/0x6a4 net/ipv6/ip6_fib.c:2369
Read of size 8 at addr ffff0000ca7a2038 by task swapper/0/0

CPU: 0 PID: 0 Comm: swapper/0 Not tainted 6.7.0-rc5-syzkaller-g0128e0962959 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023
Call trace:
dump_backtrace+0x1b8/0x1e4 arch/arm64/kernel/stacktrace.c:291
show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:298
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd0/0x124 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:364 [inline]
print_report+0x174/0x514 mm/kasan/report.c:475
kasan_report+0xd8/0x138 mm/kasan/report.c:588
__asan_report_load8_noabort+0x20/0x2c mm/kasan/report_generic.c:381
fib6_gc_table net/ipv6/ip6_fib.c:2331 [inline]
fib6_gc_all net/ipv6/ip6_fib.c:2347 [inline]
fib6_run_gc+0x2fc/0x6a4 net/ipv6/ip6_fib.c:2369
fib6_gc_timer_cb+0x28/0x38 net/ipv6/ip6_fib.c:2386
call_timer_fn+0x19c/0x8cc kernel/time/timer.c:1700
expire_timers kernel/time/timer.c:1751 [inline]
__run_timers+0x55c/0x734 kernel/time/timer.c:2022
run_timer_softirq+0x7c/0x114 kernel/time/timer.c:2035
__do_softirq+0x2d8/0xce4 kernel/softirq.c:553
____do_softirq+0x14/0x20 arch/arm64/kernel/irq.c:81
call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:886
do_softirq_own_stack+0x20/0x2c arch/arm64/kernel/irq.c:86
invoke_softirq kernel/softirq.c:434 [inline]
__irq_exit_rcu+0x1d8/0x434 kernel/softirq.c:632
irq_exit_rcu+0x14/0x84 kernel/softirq.c:644
__el1_irq arch/arm64/kernel/entry-common.c:503 [inline]
el1_interrupt+0x38/0x68 arch/arm64/kernel/entry-common.c:517
el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:522
el1h_64_irq+0x64/0x68 arch/arm64/kernel/entry.S:591
__daif_local_irq_enable arch/arm64/include/asm/irqflags.h:27 [inline]
arch_local_irq_enable+0x8/0xc arch/arm64/include/asm/irqflags.h:49
cpuidle_idle_call kernel/sched/idle.c:170 [inline]
do_idle+0x1f0/0x4e8 kernel/sched/idle.c:282
cpu_startup_entry+0x5c/0x74 kernel/sched/idle.c:380
rest_init+0x2dc/0x2f4 init/main.c:730
start_kernel+0x0/0x4e8 init/main.c:827
start_kernel+0x3e8/0x4e8 init/main.c:1072
__primary_switched+0xb8/0xc0 arch/arm64/kernel/head.S:523

Allocated by task 13265:
kasan_save_stack mm/kasan/common.c:45 [inline]
kasan_set_track+0x4c/0x7c mm/kasan/common.c:52
kasan_save_alloc_info+0x24/0x30 mm/kasan/generic.c:511
____kasan_kmalloc mm/kasan/common.c:374 [inline]
__kasan_kmalloc+0xac/0xc4 mm/kasan/common.c:383
kasan_kmalloc include/linux/kasan.h:198 [inline]
__do_kmalloc_node mm/slab_common.c:1007 [inline]
__kmalloc+0xcc/0x1b8 mm/slab_common.c:1020
kmalloc include/linux/slab.h:604 [inline]
kzalloc include/linux/slab.h:721 [inline]
fib6_info_alloc+0x38/0xf0 net/ipv6/ip6_fib.c:155
ip6_route_info_create+0x3b8/0xe88 net/ipv6/route.c:3749
ip6_route_add+0x38/0x168 net/ipv6/route.c:3843
rt6_add_dflt_router+0x1a0/0x378 net/ipv6/route.c:4375
ndisc_router_discovery+0x1844/0x2d30 net/ipv6/ndisc.c:1384
ndisc_rcv+0x3e0/0x5cc net/ipv6/ndisc.c:1856
icmpv6_rcv+0xd1c/0x1544 net/ipv6/icmp.c:979
ip6_protocol_deliver_rcu+0x930/0x11c4 net/ipv6/ip6_input.c:438
ip6_input_finish+0x164/0x298 net/ipv6/ip6_input.c:483
NF_HOOK+0x328/0x3d4 include/linux/netfilter.h:314
ip6_input net/ipv6/ip6_input.c:492 [inline]
ip6_mc_input+0x8f4/0xb20 net/ipv6/ip6_input.c:586
dst_input include/net/dst.h:461 [inline]
ip6_rcv_finish+0x1f4/0x220 net/ipv6/ip6_input.c:79
NF_HOOK+0x328/0x3d4 include/linux/netfilter.h:314
ipv6_rcv+0x9c/0xbc net/ipv6/ip6_input.c:310
__netif_receive_skb_one_core net/core/dev.c:5529 [inline]
__netif_receive_skb+0x18c/0x400 net/core/dev.c:5643
netif_receive_skb_internal net/core/dev.c:5729 [inline]
netif_receive_skb+0x1e0/0x8c4 net/core/dev.c:5788
tun_rx_batched+0x568/0x6e4
tun_get_user+0x2368/0x37b0 drivers/net/tun.c:2002
tun_chr_write_iter+0xfc/0x204 drivers/net/tun.c:2048
call_write_iter include/linux/fs.h:2020 [inline]
new_sync_write fs/read_write.c:491 [inline]
vfs_write+0x610/0x910 fs/read_write.c:584
ksys_write+0x15c/0x26c fs/read_write.c:637
__do_sys_write fs/read_write.c:649 [inline]
__se_sys_write fs/read_write.c:646 [inline]
__arm64_sys_write+0x7c/0x90 fs/read_write.c:646
__invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]
invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:51
el0_svc_common+0x130/0x23c arch/arm64/kernel/syscall.c:136
do_el0_svc+0x48/0x58 arch/arm64/kernel/syscall.c:155
el0_svc+0x54/0x158 arch/arm64/kernel/entry-common.c:678
el0t_64_sync_handler+0x84/0xfc arch/arm64/kernel/entry-common.c:696
el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:595

Last potentially related work creation:
kasan_save_stack+0x40/0x6c mm/kasan/common.c:45
__kasan_record_aux_stack+0xcc/0xe8 mm/kasan/generic.c:492
kasan_record_aux_stack_noalloc+0x14/0x20 mm/kasan/generic.c:502
__call_rcu_common kernel/rcu/tree.c:2681 [inline]
call_rcu+0x104/0xaf4 kernel/rcu/tree.c:2795
fib6_info_release include/net/ip6_fib.h:332 [inline]
nsim_rt6_release drivers/net/netdevsim/fib.c:515 [inline]
nsim_fib6_event_fini+0xf0/0x1f4 drivers/net/netdevsim/fib.c:841
nsim_fib_event drivers/net/netdevsim/fib.c:891 [inline]
nsim_fib_event_work+0xde0/0x32bc drivers/net/netdevsim/fib.c:1492
process_one_work+0x694/0x1204 kernel/workqueue.c:2627
process_scheduled_works kernel/workqueue.c:2700 [inline]
worker_thread+0x938/0xef4 kernel/workqueue.c:2781
kthread+0x288/0x310 kernel/kthread.c:388
ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:857

Second to last potentially related work creation:
kasan_save_stack+0x40/0x6c mm/kasan/common.c:45
__kasan_record_aux_stack+0xcc/0xe8 mm/kasan/generic.c:492
kasan_record_aux_stack_noalloc+0x14/0x20 mm/kasan/generic.c:502
insert_work+0x54/0x2d4 kernel/workqueue.c:1647
__queue_work+0xda8/0x12bc kernel/workqueue.c:1800
delayed_work_timer_fn+0x74/0x90 kernel/workqueue.c:1925
call_timer_fn+0x19c/0x8cc kernel/time/timer.c:1700
expire_timers kernel/time/timer.c:1746 [inline]
__run_timers+0x5b4/0x734 kernel/time/timer.c:2022
run_timer_softirq+0x7c/0x114 kernel/time/timer.c:2035
__do_softirq+0x2d8/0xce4 kernel/softirq.c:553

The buggy address belongs to the object at ffff0000ca7a2000
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 56 bytes inside of
freed 512-byte region [ffff0000ca7a2000, ffff0000ca7a2200)

The buggy address belongs to the physical page:
page:0000000073486593 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff0000ca7a2000 pfn:0x10a7a0
head:0000000073486593 order:2 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x5ffc00000000840(slab|head|node=0|zone=2|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 05ffc00000000840 ffff0000c0001c80 fffffc0003437d10 fffffc00035a2810
raw: ffff0000ca7a2000 000000000010000a 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
ffff0000ca7a1f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff0000ca7a1f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff0000ca7a2000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff0000ca7a2080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff0000ca7a2100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================


---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.

If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title

If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)

If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report

If you want to undo deduplication, reply with:
#syz undup

[syzbot]

Auto-closing this bug as obsolete.
Crashes did not happen for a while, no reproducer and no activity.