==================================================================
BUG: KASAN: use-after-free in __lock_acquire+0x104/0x6634 kernel/locking/lockdep.c:4933
Read of size 8 at addr ffff0000ca7a3818 by task syz.1.188/5232

CPU: 1 PID: 5232 Comm: syz.1.188 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
Call trace:
 dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 print_address_description+0x88/0x218 mm/kasan/report.c:316
 print_report+0x50/0x68 mm/kasan/report.c:420
 kasan_report+0xa8/0xfc mm/kasan/report.c:524
 __asan_report_load8_noabort+0x2c/0x38 mm/kasan/report_generic.c:351
 __lock_acquire+0x104/0x6634 kernel/locking/lockdep.c:4933
 lock_acquire+0x20c/0x638 kernel/locking/lockdep.c:5676
 __raw_spin_lock_irq include/linux/spinlock_api_smp.h:119 [inline]
 _raw_spin_lock_irq+0x70/0x98 kernel/locking/spinlock.c:170
 spin_lock_irq include/linux/spinlock.h:376 [inline]
 gadget_dev_open+0x50/0x1c4 drivers/usb/gadget/legacy/inode.c:1914
 do_dentry_open+0x738/0xf8c fs/open.c:882
 vfs_open+0x7c/0x90 fs/open.c:1015
 do_open fs/namei.c:3677 [inline]
 path_openat+0x1fc0/0x27a0 fs/namei.c:3834
 do_filp_open+0x198/0x38c fs/namei.c:3861
 do_sys_openat2+0x134/0x3fc fs/open.c:1320
 do_sys_open fs/open.c:1336 [inline]
 __do_sys_openat fs/open.c:1352 [inline]
 __se_sys_openat fs/open.c:1347 [inline]
 __arm64_sys_openat+0x11c/0x150 fs/open.c:1347
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585

Allocated by task 39:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4c/0x80 mm/kasan/common.c:53
 kasan_save_alloc_info+0x24/0x30 mm/kasan/generic.c:505
 ____kasan_kmalloc mm/kasan/common.c:375 [inline]
 __kasan_kmalloc+0xa0/0xb8 mm/kasan/common.c:384
 kasan_kmalloc include/linux/kasan.h:211 [inline]
 __do_kmalloc_node mm/slab_common.c:936 [inline]
 __kmalloc_node_track_caller+0xcc/0x174 mm/slab_common.c:956
 kmalloc_reserve net/core/skbuff.c:446 [inline]
 __alloc_skb+0x260/0x728 net/core/skbuff.c:515
 alloc_skb include/linux/skbuff.h:1303 [inline]
 nlmsg_new include/net/netlink.h:998 [inline]
 inet6_rt_notify+0xbc/0x228 net/ipv6/route.c:6246
 fib6_del_route net/ipv6/ip6_fib.c:2002 [inline]
 fib6_del+0xd7c/0x121c net/ipv6/ip6_fib.c:2037
 fib6_clean_node+0x230/0x4bc net/ipv6/ip6_fib.c:2199
 fib6_walk_continue+0x578/0x7a0 net/ipv6/ip6_fib.c:2121
 fib6_walk+0x144/0x260 net/ipv6/ip6_fib.c:2169
 fib6_clean_tree net/ipv6/ip6_fib.c:2249 [inline]
 __fib6_clean_all+0x1f8/0x338 net/ipv6/ip6_fib.c:2265
 fib6_clean_all+0x3c/0x50 net/ipv6/ip6_fib.c:2276
 rt6_sync_down_dev net/ipv6/route.c:4946 [inline]
 rt6_disable_ip+0x108/0x7c4 net/ipv6/route.c:4951
 addrconf_ifdown+0x150/0x1630 net/ipv6/addrconf.c:3805
 addrconf_notify+0x344/0xc98 net/ipv6/addrconf.c:-1
 notifier_call_chain kernel/notifier.c:87 [inline]
 raw_notifier_call_chain+0xd8/0x168 kernel/notifier.c:455
 call_netdevice_notifiers_info net/core/dev.c:2014 [inline]
 call_netdevice_notifiers_extack net/core/dev.c:2052 [inline]
 call_netdevice_notifiers net/core/dev.c:2066 [inline]
 dev_close_many+0x2d4/0x448 net/core/dev.c:1614
 unregister_netdevice_many_notify+0x3f4/0x1900 net/core/dev.c:10997
 unregister_netdevice_many net/core/dev.c:11077 [inline]
 default_device_exit_batch+0x9d4/0xa70 net/core/dev.c:11549
 ops_exit_list net/core/net_namespace.c:177 [inline]
 cleanup_net+0x650/0xa90 net/core/net_namespace.c:640
 process_one_work+0x7e4/0x13bc kernel/workqueue.c:2292
 worker_thread+0x8cc/0xfe8 kernel/workqueue.c:2439
 kthread+0x254/0x2e0 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850

Freed by task 39:
 kasan_save_stack mm/kasan/common.c:46 [inline]
 kasan_set_track+0x4c/0x80 mm/kasan/common.c:53
 kasan_save_free_info+0x38/0x5c mm/kasan/generic.c:516
 ____kasan_slab_free+0x148/0x1b0 mm/kasan/common.c:237
 __kasan_slab_free+0x18/0x28 mm/kasan/common.c:245
 kasan_slab_free include/linux/kasan.h:177 [inline]
 slab_free_hook mm/slub.c:1729 [inline]
 slab_free_freelist_hook+0x16c/0x1e8 mm/slub.c:1755
 slab_free mm/slub.c:3687 [inline]
 __kmem_cache_free+0xbc/0x21c mm/slub.c:3700
 kfree+0xd0/0x1a8 mm/slab_common.c:988
 skb_free_head net/core/skbuff.c:762 [inline]
 skb_release_data+0x3d8/0x63c net/core/skbuff.c:791
 skb_release_all net/core/skbuff.c:856 [inline]
 __kfree_skb net/core/skbuff.c:870 [inline]
 consume_skb+0xa0/0x104 net/core/skbuff.c:1035
 netlink_broadcast+0xf00/0x1054 net/netlink/af_netlink.c:1526
 nlmsg_multicast include/net/netlink.h:1078 [inline]
 nlmsg_notify+0xf0/0x1d4 net/netlink/af_netlink.c:2559
 rtnl_notify+0xa0/0xd8 net/core/rtnetlink.c:799
 inet6_rt_notify+0x158/0x228 net/ipv6/route.c:6258
 fib6_del_route net/ipv6/ip6_fib.c:2002 [inline]
 fib6_del+0xd7c/0x121c net/ipv6/ip6_fib.c:2037
 fib6_clean_node+0x230/0x4bc net/ipv6/ip6_fib.c:2199
 fib6_walk_continue+0x578/0x7a0 net/ipv6/ip6_fib.c:2121
 fib6_walk+0x144/0x260 net/ipv6/ip6_fib.c:2169
 fib6_clean_tree net/ipv6/ip6_fib.c:2249 [inline]
 __fib6_clean_all+0x1f8/0x338 net/ipv6/ip6_fib.c:2265
 fib6_clean_all+0x3c/0x50 net/ipv6/ip6_fib.c:2276
 rt6_sync_down_dev net/ipv6/route.c:4946 [inline]
 rt6_disable_ip+0x108/0x7c4 net/ipv6/route.c:4951
 addrconf_ifdown+0x150/0x1630 net/ipv6/addrconf.c:3805
 addrconf_notify+0x344/0xc98 net/ipv6/addrconf.c:-1
 notifier_call_chain kernel/notifier.c:87 [inline]
 raw_notifier_call_chain+0xd8/0x168 kernel/notifier.c:455
 call_netdevice_notifiers_info net/core/dev.c:2014 [inline]
 call_netdevice_notifiers_extack net/core/dev.c:2052 [inline]
 call_netdevice_notifiers net/core/dev.c:2066 [inline]
 dev_close_many+0x2d4/0x448 net/core/dev.c:1614
 unregister_netdevice_many_notify+0x3f4/0x1900 net/core/dev.c:10997
 unregister_netdevice_many net/core/dev.c:11077 [inline]
 default_device_exit_batch+0x9d4/0xa70 net/core/dev.c:11549
 ops_exit_list net/core/net_namespace.c:177 [inline]
 cleanup_net+0x650/0xa90 net/core/net_namespace.c:640
 process_one_work+0x7e4/0x13bc kernel/workqueue.c:2292
 worker_thread+0x8cc/0xfe8 kernel/workqueue.c:2439
 kthread+0x254/0x2e0 kernel/kthread.c:376
 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:850

The buggy address belongs to the object at ffff0000ca7a3800
 which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 24 bytes inside of
 1024-byte region [ffff0000ca7a3800, ffff0000ca7a3c00)

The buggy address belongs to the physical page:
page:000000009a2c3357 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10a7a0
head:000000009a2c3357 order:3 compound_mapcount:0 compound_pincount:0
flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000010200 0000000000000000 dead000000000001 ffff0000c0002780
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000ca7a3700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff0000ca7a3780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff0000ca7a3800: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                            ^
 ffff0000ca7a3880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff0000ca7a3900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
================================================================================
UBSAN: array-index-out-of-bounds in kernel/locking/qspinlock.c:131:9
index 16284 is out of range for type 'unsigned long[8]'
CPU: 1 PID: 5232 Comm: syz.1.188 Tainted: G    B              syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/07/2026
Call trace:
 dump_backtrace+0x1c4/0x1f0 arch/arm64/kernel/stacktrace.c:158
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:165
 __dump_stack+0x30/0x40 lib/dump_stack.c:88
 dump_stack_lvl+0xf4/0x15c lib/dump_stack.c:106
 dump_stack+0x1c/0x5c lib/dump_stack.c:113
 ubsan_epilogue+0x14/0x48 lib/ubsan.c:151
 __ubsan_handle_out_of_bounds+0xd0/0xf8 lib/ubsan.c:282
 decode_tail kernel/locking/qspinlock.c:131 [inline]
 queued_spin_lock_slowpath+0x8a8/0xc14 kernel/locking/qspinlock.c:471
 queued_spin_lock include/asm-generic/qspinlock.h:114 [inline]
 do_raw_spin_lock+0x2f4/0x2f8 kernel/locking/spinlock_debug.c:115
 __raw_spin_lock_irq include/linux/spinlock_api_smp.h:120 [inline]
 _raw_spin_lock_irq+0x78/0x98 kernel/locking/spinlock.c:170
 spin_lock_irq include/linux/spinlock.h:376 [inline]
 gadget_dev_open+0x50/0x1c4 drivers/usb/gadget/legacy/inode.c:1914
 do_dentry_open+0x738/0xf8c fs/open.c:882
 vfs_open+0x7c/0x90 fs/open.c:1015
 do_open fs/namei.c:3677 [inline]
 path_openat+0x1fc0/0x27a0 fs/namei.c:3834
 do_filp_open+0x198/0x38c fs/namei.c:3861
 do_sys_openat2+0x134/0x3fc fs/open.c:1320
 do_sys_open fs/open.c:1336 [inline]
 __do_sys_openat fs/open.c:1352 [inline]
 __se_sys_openat fs/open.c:1347 [inline]
 __arm64_sys_openat+0x11c/0x150 fs/open.c:1347
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x290 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x13c/0x258 arch/arm64/kernel/syscall.c:140
 do_el0_svc+0x5c/0x134 arch/arm64/kernel/syscall.c:204
 el0_svc+0x58/0x128 arch/arm64/kernel/entry-common.c:637
 el0t_64_sync_handler+0x84/0xf0 arch/arm64/kernel/entry-common.c:655
 el0t_64_sync+0x18c/0x190 arch/arm64/kernel/entry.S:585
================================================================================