BUG: KASAN: stack-out-of-bounds in memcmp+0xe3/0x160 lib/string.c:768 at addr ffff8801d0c1f8c0
Read of size 1 by task syzkaller788407/3239
page:ffffea00074307c0 count:0 mapcount:0 mapping: (null) index:0x0
flags: 0x8000000000000000()
page dumped because: kasan: bad access detected
CPU: 1 PID: 3239 Comm: syzkaller788407 Not tainted 4.9.40-ged32335 #11
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
ffff8801d0c1f3d0 ffffffff81d8d829 ffffed003a183f18 0000000000000001
0000000000000000 ffffed003a183f18 ffff8801d0c1f8c0 ffff8801d0c1f458
ffffffff81537fa3 ffff8801d0679fb0 ffffffff852fb640 ffffffff81dab5c3
Call Trace:
[<ffffffff81d8d829>] __dump_stack lib/dump_stack.c:15 [inline]
[<ffffffff81d8d829>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
[<ffffffff81537fa3>] print_address_description mm/kasan/report.c:208 [inline]
[<ffffffff81537fa3>] kasan_report_error mm/kasan/report.c:287 [inline]
[<ffffffff81537fa3>] kasan_report.part.1+0x4c3/0x500 mm/kasan/report.c:309
[<ffffffff81538009>] kasan_report mm/kasan/report.c:327 [inline]
[<ffffffff81538009>] __asan_report_load1_noabort+0x29/0x30 mm/kasan/report.c:327
[<ffffffff81dab5c3>] memcmp+0xe3/0x160 lib/string.c:768
[<ffffffff833b0537>] addr_match include/net/xfrm.h:830 [inline]
[<ffffffff833b0537>] __xfrm6_selector_match net/xfrm/xfrm_policy.c:87 [inline]
[<ffffffff833b0537>] xfrm_selector_match+0x1c7/0xe40 net/xfrm/xfrm_policy.c:101
[<ffffffff833b12c3>] xfrm_sk_policy_lookup+0x113/0x390 net/xfrm/xfrm_policy.c:1259
[<ffffffff833b37c3>] xfrm_lookup+0x1b3/0xc00 net/xfrm/xfrm_policy.c:2209
[<ffffffff833b5109>] xfrm_lookup_route+0x39/0x1a0 net/xfrm/xfrm_policy.c:2343
[<ffffffff831cfd7f>] ip_route_output_flow+0x7f/0xa0 net/ipv4/route.c:2430
[<ffffffff832ac8a6>] udp_sendmsg+0xe36/0x1c10 net/ipv4/udp.c:1026
[<ffffffff83479108>] udpv6_sendmsg+0x588/0x2390 net/ipv6/udp.c:1085
[<ffffffff832dfaac>] inet_sendmsg+0x2bc/0x4c0 net/ipv4/af_inet.c:753
[<ffffffff82ec5b9a>] sock_sendmsg_nosec net/socket.c:635 [inline]
[<ffffffff82ec5b9a>] sock_sendmsg+0xca/0x110 net/socket.c:645
[<ffffffff82ec6af8>] SYSC_sendto+0x2c8/0x340 net/socket.c:1670
[<ffffffff82ec8fa0>] SyS_sendto+0x40/0x50 net/socket.c:1638
[<ffffffff838a06c5>] entry_SYSCALL_64_fastpath+0x23/0xc6
Memory state around the buggy address:
ffff8801d0c1f780: 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1
ffff8801d0c1f800: f1 00 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 f2 f2 f2
>ffff8801d0c1f880: f2 00 00 00 00 00 00 00 f2 f2 f2 f2 f2 00 00 00
^
ffff8801d0c1f900: 00 00 00 00 00 00 f2 f2 f2 00 00 00 00 00 00 00
ffff8801d0c1f980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================