device hsr_slave_1 entered promiscuous mode IPv6: ADDRCONF(NETDEV_UP): hsr_slave_0: link is not ready IPv6: ADDRCONF(NETDEV_UP): hsr_slave_1: link is not ready IPv6: ADDRCONF(NETDEV_UP): vxcan1: link is not ready ================================================================== BUG: KASAN: use-after-free in memcpy include/linux/string.h:347 [inline] BUG: KASAN: use-after-free in memcpy_dir crypto/scatterwalk.c:28 [inline] BUG: KASAN: use-after-free in scatterwalk_copychunks+0x207/0x690 crypto/scatterwalk.c:43 8021q: adding VLAN 0 to HW filter on device batadv0 Read of size 4096 at addr ffff8880a5c11000 by task syz-executor.3/7098 CPU: 1 PID: 7098 Comm: syz-executor.3 Not tainted 4.14.170-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0xf7/0x13b lib/dump_stack.c:58 print_address_description.cold.7+0x9/0x1c9 mm/kasan/report.c:252 kasan_report_error mm/kasan/report.c:351 [inline] kasan_report.cold.8+0x11a/0x2d3 mm/kasan/report.c:409 check_memory_region_inline mm/kasan/kasan.c:260 [inline] check_memory_region+0x13e/0x1b0 mm/kasan/kasan.c:267 memcpy+0x23/0x50 mm/kasan/kasan.c:302 memcpy include/linux/string.h:347 [inline] memcpy_dir crypto/scatterwalk.c:28 [inline] scatterwalk_copychunks+0x207/0x690 crypto/scatterwalk.c:43 scatterwalk_map_and_copy+0x10d/0x1a0 crypto/scatterwalk.c:72 gcmaes_encrypt.constprop.14+0x1c0/0xae0 arch/x86/crypto/aesni-intel_glue.c:778 generic_gcmaes_encrypt+0xf8/0x13d arch/x86/crypto/aesni-intel_glue.c:1111 crypto_aead_encrypt include/crypto/aead.h:330 [inline] gcmaes_wrapper_encrypt+0xe0/0x140 arch/x86/crypto/aesni-intel_glue.c:945 crypto_aead_encrypt include/crypto/aead.h:330 [inline] tls_do_encryption net/tls/tls_sw.c:234 [inline] tls_push_record+0x8e6/0x14c0 net/tls/tls_sw.c:270 tls_sw_sendpage+0x443/0xc50 net/tls/tls_sw.c:617 inet_sendpage+0x122/0x600 net/ipv4/af_inet.c:779 kernel_sendpage+0x60/0xd0 net/socket.c:3407 sock_sendpage+0x6d/0xd0 net/socket.c:871 pipe_to_sendpage+0x206/0x420 fs/splice.c:451 splice_from_pipe_feed fs/splice.c:502 [inline] __splice_from_pipe+0x2cb/0x720 fs/splice.c:626 splice_from_pipe+0xb5/0x110 fs/splice.c:661 generic_splice_sendpage+0x10/0x20 fs/splice.c:832 do_splice_from fs/splice.c:851 [inline] do_splice fs/splice.c:1147 [inline] SYSC_splice fs/splice.c:1402 [inline] SyS_splice+0x6e9/0x1580 fs/splice.c:1382 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x459a29 RSP: 002b:00007fd0736e6c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000113 RAX: ffffffffffffffda RBX: 00007fd0736e6c90 RCX: 0000000000459a29 RDX: 0000000000000004 RSI: 0000000000000000 RDI: 0000000000000003 RBP: 000000000075bf20 R08: 0000000100000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007fd0736e76d4 R13: 00000000004c9222 R14: 00000000004df820 R15: 0000000000000005 Allocated by task 4108: save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59 save_stack+0x43/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:551 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:489 kmem_cache_alloc+0x12e/0x790 mm/slab.c:3552 ptlock_alloc+0x1d/0x70 mm/memory.c:4741 ptlock_init include/linux/mm.h:1752 [inline] pgtable_page_ctor include/linux/mm.h:1786 [inline] pte_alloc_one+0x46/0xd0 arch/x86/mm/pgtable.c:33 __pte_alloc+0x1d/0x280 mm/memory.c:656 copy_pte_range mm/memory.c:1081 [inline] copy_pmd_range mm/memory.c:1157 [inline] copy_pud_range mm/memory.c:1191 [inline] copy_p4d_range mm/memory.c:1213 [inline] copy_page_range+0xfed/0x1970 mm/memory.c:1275 dup_mmap kernel/fork.c:709 [inline] dup_mm kernel/fork.c:1199 [inline] copy_mm kernel/fork.c:1254 [inline] copy_process.part.37+0x5d91/0x66e0 kernel/fork.c:1771 copy_process kernel/fork.c:1586 [inline] _do_fork+0x155/0xbb0 kernel/fork.c:2070 SYSC_clone kernel/fork.c:2180 [inline] SyS_clone+0x14/0x20 kernel/fork.c:2174 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 Freed by task 5736: save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59 save_stack+0x43/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524 __cache_free mm/slab.c:3496 [inline] kmem_cache_free+0x80/0x2d0 mm/slab.c:3758 ptlock_free+0x33/0x3d mm/memory.c:4750 pte_lock_deinit include/linux/mm.h:1762 [inline] pgtable_page_dtor include/linux/mm.h:1794 [inline] ___pte_free_tlb+0x3c/0xc0 arch/x86/mm/pgtable.c:59 __pte_free_tlb arch/x86/include/asm/pgalloc.h:73 [inline] free_pte_range mm/memory.c:449 [inline] free_pmd_range mm/memory.c:467 [inline] free_pud_range mm/memory.c:501 [inline] free_p4d_range mm/memory.c:534 [inline] free_pgd_range+0x894/0xae0 mm/memory.c:614 free_pgtables+0x237/0x310 mm/memory.c:646 exit_mmap+0x258/0x450 mm/mmap.c:3057 __mmput kernel/fork.c:930 [inline] mmput+0xed/0x3c0 kernel/fork.c:951 exit_mm kernel/exit.c:545 [inline] do_exit+0x8ae/0x2c00 kernel/exit.c:845 do_group_exit+0xf4/0x2f0 kernel/exit.c:955 SYSC_exit_group kernel/exit.c:966 [inline] SyS_exit_group+0x18/0x20 kernel/exit.c:964 do_syscall_64+0x1c7/0x5b0 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 The buggy address belongs to the object at ffff8880a5c11000 which belongs to the cache page->ptl of size 56 The buggy address is located 0 bytes inside of 56-byte region [ffff8880a5c11000, ffff8880a5c11038) The buggy address belongs to the page: page:ffffea0002970440 count:1 mapcount:0 mapping:ffff8880a5c11000 index:0xffff8880a5c11c08 flags: 0x1fffc0000000100(slab) raw: 01fffc0000000100 ffff8880a5c11000 ffff8880a5c11c08 0000000100000002 raw: ffffea00029643a0 ffffea0002946520 ffff8880aa810040 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880a5c10f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880a5c10f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff8880a5c11000: fb fb fb fb fb fb fb fc fc fc fc fb fb fb fb fb ^ ffff8880a5c11080: fb fb fc fc fc fc fb fb fb fb fb fb fb fc fc fc ffff8880a5c11100: fc fb fb fb fb fb fb fb fc fc fc fc fb fb fb fb ==================================================================