usercopy: Kernel memory exposure attempt detected from SLUB object 'skbuff_fclone_cache' (offset 332, size 4)!
------------[ cut here ]------------
kernel BUG at mm/usercopy.c:99!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 4047 Comm: syz.8.1015 Tainted: G W syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026
RIP: 0010:usercopy_abort+0x85/0x90 mm/usercopy.c:99
Code: 89 cb 49 c7 c6 00 aa 4b 85 4c 0f 44 f6 48 c7 c7 40 aa 4b 85 4c 89 de 4c 89 c9 4d 89 d1 50 53 41 56 e8 0f bf ff ff 48 83 c4 18 <0f> 0b 00 00 cc cc 00 00 cc cc 00 55 48 89 e5 53 48 89 fb e8 43 18
RSP: 0018:ffffc90000b774c0 EFLAGS: 00010296
RAX: 000000000000006e RBX: 000000000000014c RCX: 78f06aa025ffcd00
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: ffffc90000b774d0 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff5200016edf4 R12: ffff8881081aac00
R13: dffffc0000000000 R14: ffffffff854baa00 R15: 000000000000014c
FS: 00007ffaf5d826c0(0000) GS:ffff8881f7100000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c312d40 CR3: 0000000140821000 CR4: 00000000003526a0
DR0: 0000000007300000 DR1: 0000000000000004 DR2: 0000000000000004
DR3: 0000000000000004 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
__check_heap_object+0x133/0x170 mm/slub.c:4551
check_heap_object mm/usercopy.c:240 [inline]
__check_object_size+0x219/0x3b0 mm/usercopy.c:286
check_object_size include/linux/thread_info.h:199 [inline]
put_cmsg+0x1c4/0x5d0 net/core/scm.c:238
sock_recv_drops net/socket.c:947 [inline]
__sock_recv_ts_and_drops+0x47b/0x560 net/socket.c:955
sock_recv_ts_and_drops include/net/sock.h:2738 [inline]
udp_recvmsg+0x8d9/0x1120 net/ipv4/udp.c:1939
inet_recvmsg+0x13a/0x470 net/ipv4/af_inet.c:861
____sys_recvmsg+0x2ca/0x5b0 net/socket.c:-1
___sys_recvmsg+0x213/0x5c0 net/socket.c:2696
do_recvmmsg+0x360/0x7d0 net/socket.c:2790
__sys_recvmmsg net/socket.c:2869 [inline]
__do_sys_recvmmsg net/socket.c:2892 [inline]
__se_sys_recvmmsg net/socket.c:2885 [inline]
__x64_sys_recvmmsg+0x195/0x250 net/socket.c:2885
x64_sys_call+0x297/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:300
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7ffaf7327e59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffaf5d82028 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: ffffffffffffffda RBX: 00007ffaf75a0fa0 RCX: 00007ffaf7327e59
RDX: 0000000000000001 RSI: 0000200000009680 RDI: 0000000000000003
RBP: 00007ffaf73bde6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000010103 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffaf75a1038 R14: 00007ffaf75a0fa0 R15: 00007ffebc03dfe8
</TASK>
Modules linked in:
---[ end trace 8864f83701f9ed55 ]---
RIP: 0010:usercopy_abort+0x85/0x90 mm/usercopy.c:99
Code: 89 cb 49 c7 c6 00 aa 4b 85 4c 0f 44 f6 48 c7 c7 40 aa 4b 85 4c 89 de 4c 89 c9 4d 89 d1 50 53 41 56 e8 0f bf ff ff 48 83 c4 18 <0f> 0b 00 00 cc cc 00 00 cc cc 00 55 48 89 e5 53 48 89 fb e8 43 18
RSP: 0018:ffffc90000b774c0 EFLAGS: 00010296
RAX: 000000000000006e RBX: 000000000000014c RCX: 78f06aa025ffcd00
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000
RBP: ffffc90000b774d0 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff5200016edf4 R12: ffff8881081aac00
R13: dffffc0000000000 R14: ffffffff854baa00 R15: 000000000000014c
FS: 00007ffaf5d826c0(0000) GS:ffff8881f7000000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f12b62bcfa8 CR3: 0000000140821000 CR4: 00000000003526b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400