==================================================================
BUG: KASAN: use-after-free in memcpy include/linux/fortify-string.h:191 [inline]
BUG: KASAN: use-after-free in page_to_skb+0x5cf/0xb70 drivers/net/virtio_net.c:480
Read of size 12 at addr ffff88801463f800 by task ifupdown-hotplu/8190

CPU: 0 PID: 8190 Comm: ifupdown-hotplu Not tainted 5.12.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x141/0x1d7 lib/dump_stack.c:120
 print_address_description.constprop.0.cold+0x5b/0x2f8 mm/kasan/report.c:232
 __kasan_report mm/kasan/report.c:399 [inline]
 kasan_report.cold+0x7c/0xd8 mm/kasan/report.c:416
 check_region_inline mm/kasan/generic.c:180 [inline]
 kasan_check_range+0x13d/0x180 mm/kasan/generic.c:186
 memcpy+0x20/0x60 mm/kasan/shadow.c:65
 memcpy include/linux/fortify-string.h:191 [inline]
 page_to_skb+0x5cf/0xb70 drivers/net/virtio_net.c:480
 receive_mergeable drivers/net/virtio_net.c:1009 [inline]
 receive_buf+0x2b82/0x6220 drivers/net/virtio_net.c:1119
 virtnet_receive drivers/net/virtio_net.c:1411 [inline]
 virtnet_poll+0x568/0x10b0 drivers/net/virtio_net.c:1516
 __napi_poll+0xaf/0x440 net/core/dev.c:6962
 napi_poll net/core/dev.c:7029 [inline]
 net_rx_action+0x801/0xb40 net/core/dev.c:7116
 __do_softirq+0x29b/0x9f6 kernel/softirq.c:345
 invoke_softirq kernel/softirq.c:221 [inline]
 __irq_exit_rcu kernel/softirq.c:422 [inline]
 irq_exit_rcu+0x134/0x200 kernel/softirq.c:434
 common_interrupt+0xa4/0xd0 arch/x86/kernel/irq.c:240
 </IRQ>
 asm_common_interrupt+0x1e/0x40 arch/x86/include/asm/idtentry.h:623
RIP: 0010:__orc_find+0xa8/0xf0 arch/x86/kernel/unwind_orc.c:60
Code: 75 48 48 63 03 48 01 d8 48 39 c1 73 b0 4c 8d 63 fc 49 39 ec 73 b3 4d 29 ee 49 c1 fe 02 4b 8d 04 76 48 8d 04 46 48 83 c4 10 5b <5d> 41 5c 41 5d 41 5e 41 5f c3 48 83 c4 10 31 c0 5b 5d 41 5c 41 5d
RSP: 0018:ffffc9000162f668 EFLAGS: 00000286
RAX: ffffffff8e3f48b8 RBX: 1ffff920002c5edb RCX: ffffffff814cf47e
RDX: 0000000000000000 RSI: ffffffff8e3f48b8 RDI: ffffffff8dd377f0
RBP: ffffffff8dd377f4 R08: 0000000000000000 R09: ffffffff8e3f48b8
R10: fffff520002c5ef9 R11: 0000000000084087 R12: ffffffff8dd377f0
R13: ffffffff8dd377f0 R14: 0000000000000000 R15: dffffc0000000000
 orc_find arch/x86/kernel/unwind_orc.c:173 [inline]
 unwind_next_frame+0x32a/0x1ce0 arch/x86/kernel/unwind_orc.c:443
 arch_stack_walk+0x7d/0xe0 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x8c/0xc0 kernel/stacktrace.c:121
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38
 kasan_set_track mm/kasan/common.c:46 [inline]
 set_alloc_info mm/kasan/common.c:427 [inline]
 ____kasan_kmalloc mm/kasan/common.c:506 [inline]
 ____kasan_kmalloc mm/kasan/common.c:465 [inline]
 __kasan_kmalloc+0x99/0xc0 mm/kasan/common.c:515
 kmalloc include/linux/slab.h:559 [inline]
 kzalloc include/linux/slab.h:684 [inline]
 lsm_cred_alloc security/security.c:534 [inline]
 security_prepare_creds+0x10e/0x190 security/security.c:1646
 prepare_creds+0x509/0x730 kernel/cred.c:285
 copy_creds+0x9f/0x770 kernel/cred.c:358
 copy_process+0x128d/0x71e0 kernel/fork.c:1991
 kernel_clone+0xe7/0xab0 kernel/fork.c:2505
 __do_sys_clone+0xc8/0x110 kernel/fork.c:2622
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7fa791fb338b
Code: db 45 85 f6 0f 85 95 01 00 00 64 4c 8b 04 25 10 00 00 00 31 d2 4d 8d 90 d0 02 00 00 31 f6 bf 11 00 20 01 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 de 00 00 00 85 c0 41 89 c5 0f 85 e5 00 00
RSP: 002b:00007ffdae3d1c70 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa791fb338b
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 00007ffdae3d1ca0 R08: 00007fa7924b9480 R09: 0000000000000030
R10: 00007fa7924b9750 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 000055923e471288

general protection fault, probably for non-canonical address 0xdead000000000400: 0000 [#1] PREEMPT SMP KASAN
CPU: 0 PID: 8190 Comm: ifupdown-hotplu Not tainted 5.12.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:nearest_obj include/linux/slub_def.h:169 [inline]
RIP: 0010:print_address_description.constprop.0.cold+0xbf/0x2f8 mm/kasan/report.c:237
Code: 00 48 8b 00 f6 c4 02 0f 84 71 ff ff ff 48 8b 5d 18 b9 0b 00 00 00 b8 11 ff ff 01 48 c1 e1 29 48 c1 e0 27 48 01 e9 48 c1 f9 06 <8b> 73 18 48 c1 e1 0c 48 01 c1 4c 89 e0 48 29 c8 48 99 48 f7 fe 0f
RSP: 0018:ffffc90000007978 EFLAGS: 00010006
RAX: ffff888000000000 RBX: dead000000000400 RCX: 000000000001463f
RDX: ffffea0000518e01 RSI: ffffffff815c5205 RDI: fffff52000000f21
RBP: ffffea0000518fc0 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff815bdf9e R11: 0000000000000000 R12: ffff88801463f800
R13: ffffffff84bb8def R14: ffffffff84bb8def R15: ffff88801ae4ac00
FS:  00007fa7924b9480(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa792294b00 CR3: 00000000261d2000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 __kasan_report mm/kasan/report.c:399 [inline]
 kasan_report.cold+0x7c/0xd8 mm/kasan/report.c:416
 check_region_inline mm/kasan/generic.c:180 [inline]
 kasan_check_range+0x13d/0x180 mm/kasan/generic.c:186
 memcpy+0x20/0x60 mm/kasan/shadow.c:65
 memcpy include/linux/fortify-string.h:191 [inline]
 page_to_skb+0x5cf/0xb70 drivers/net/virtio_net.c:480
 receive_mergeable drivers/net/virtio_net.c:1009 [inline]
 receive_buf+0x2b82/0x6220 drivers/net/virtio_net.c:1119
 virtnet_receive drivers/net/virtio_net.c:1411 [inline]
 virtnet_poll+0x568/0x10b0 drivers/net/virtio_net.c:1516
 __napi_poll+0xaf/0x440 net/core/dev.c:6962
 napi_poll net/core/dev.c:7029 [inline]
 net_rx_action+0x801/0xb40 net/core/dev.c:7116
 __do_softirq+0x29b/0x9f6 kernel/softirq.c:345
 invoke_softirq kernel/softirq.c:221 [inline]
 __irq_exit_rcu kernel/softirq.c:422 [inline]
 irq_exit_rcu+0x134/0x200 kernel/softirq.c:434
 common_interrupt+0xa4/0xd0 arch/x86/kernel/irq.c:240
 </IRQ>
 asm_common_interrupt+0x1e/0x40 arch/x86/include/asm/idtentry.h:623
RIP: 0010:__orc_find+0xa8/0xf0 arch/x86/kernel/unwind_orc.c:60
Code: 75 48 48 63 03 48 01 d8 48 39 c1 73 b0 4c 8d 63 fc 49 39 ec 73 b3 4d 29 ee 49 c1 fe 02 4b 8d 04 76 48 8d 04 46 48 83 c4 10 5b <5d> 41 5c 41 5d 41 5e 41 5f c3 48 83 c4 10 31 c0 5b 5d 41 5c 41 5d
RSP: 0018:ffffc9000162f668 EFLAGS: 00000286
RAX: ffffffff8e3f48b8 RBX: 1ffff920002c5edb RCX: ffffffff814cf47e
RDX: 0000000000000000 RSI: ffffffff8e3f48b8 RDI: ffffffff8dd377f0
RBP: ffffffff8dd377f4 R08: 0000000000000000 R09: ffffffff8e3f48b8
R10: fffff520002c5ef9 R11: 0000000000084087 R12: ffffffff8dd377f0
R13: ffffffff8dd377f0 R14: 0000000000000000 R15: dffffc0000000000
 orc_find arch/x86/kernel/unwind_orc.c:173 [inline]
 unwind_next_frame+0x32a/0x1ce0 arch/x86/kernel/unwind_orc.c:443
 arch_stack_walk+0x7d/0xe0 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x8c/0xc0 kernel/stacktrace.c:121
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38
 kasan_set_track mm/kasan/common.c:46 [inline]
 set_alloc_info mm/kasan/common.c:427 [inline]
 ____kasan_kmalloc mm/kasan/common.c:506 [inline]
 ____kasan_kmalloc mm/kasan/common.c:465 [inline]
 __kasan_kmalloc+0x99/0xc0 mm/kasan/common.c:515
 kmalloc include/linux/slab.h:559 [inline]
 kzalloc include/linux/slab.h:684 [inline]
 lsm_cred_alloc security/security.c:534 [inline]
 security_prepare_creds+0x10e/0x190 security/security.c:1646
 prepare_creds+0x509/0x730 kernel/cred.c:285
 copy_creds+0x9f/0x770 kernel/cred.c:358
 copy_process+0x128d/0x71e0 kernel/fork.c:1991
 kernel_clone+0xe7/0xab0 kernel/fork.c:2505
 __do_sys_clone+0xc8/0x110 kernel/fork.c:2622
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7fa791fb338b
Code: db 45 85 f6 0f 85 95 01 00 00 64 4c 8b 04 25 10 00 00 00 31 d2 4d 8d 90 d0 02 00 00 31 f6 bf 11 00 20 01 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 0f 87 de 00 00 00 85 c0 41 89 c5 0f 85 e5 00 00
RSP: 002b:00007ffdae3d1c70 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fa791fb338b
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 00007ffdae3d1ca0 R08: 00007fa7924b9480 R09: 0000000000000030
R10: 00007fa7924b9750 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 000055923e471288
Modules linked in:
---[ end trace 8cf0d304383b5810 ]---
RIP: 0010:nearest_obj include/linux/slub_def.h:169 [inline]
RIP: 0010:print_address_description.constprop.0.cold+0xbf/0x2f8 mm/kasan/report.c:237
Code: 00 48 8b 00 f6 c4 02 0f 84 71 ff ff ff 48 8b 5d 18 b9 0b 00 00 00 b8 11 ff ff 01 48 c1 e1 29 48 c1 e0 27 48 01 e9 48 c1 f9 06 <8b> 73 18 48 c1 e1 0c 48 01 c1 4c 89 e0 48 29 c8 48 99 48 f7 fe 0f
RSP: 0018:ffffc90000007978 EFLAGS: 00010006
RAX: ffff888000000000 RBX: dead000000000400 RCX: 000000000001463f
RDX: ffffea0000518e01 RSI: ffffffff815c5205 RDI: fffff52000000f21
RBP: ffffea0000518fc0 R08: 0000000000000000 R09: 0000000000000000
R10: ffffffff815bdf9e R11: 0000000000000000 R12: ffff88801463f800
R13: ffffffff84bb8def R14: ffffffff84bb8def R15: ffff88801ae4ac00
FS:  00007fa7924b9480(0000) GS:ffff8880b9c00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa792294b00 CR3: 00000000261d2000 CR4: 00000000001506f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400