================================================================== BUG: KASAN: slab-out-of-bounds in __xfrm6_tunnel_spi_lookup+0x3a9/0x3b0 net/ipv6/xfrm6_tunnel.c:79 Read of size 8 at addr ffff88809e400388 by task syz-executor.0/32118 CPU: 0 PID: 32118 Comm: syz-executor.0 Not tainted 5.8.0-rc5-next-20200716-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x18f/0x20d lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xae/0x497 mm/kasan/report.c:383 __kasan_report mm/kasan/report.c:513 [inline] kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530 __xfrm6_tunnel_spi_lookup+0x3a9/0x3b0 net/ipv6/xfrm6_tunnel.c:79 xfrm6_tunnel_spi_lookup+0x8a/0x1d0 net/ipv6/xfrm6_tunnel.c:95 ipcomp6_tunnel_attach net/ipv6/ipcomp6.c:119 [inline] ipcomp6_init_state net/ipv6/ipcomp6.c:159 [inline] ipcomp6_init_state+0x1de/0x700 net/ipv6/ipcomp6.c:139 __xfrm_init_state+0x9a6/0x14b0 net/xfrm/xfrm_state.c:2498 xfrm_init_state+0x1a/0x70 net/xfrm/xfrm_state.c:2525 pfkey_msg2xfrm_state net/key/af_key.c:1291 [inline] pfkey_add+0x1a10/0x2b70 net/key/af_key.c:1508 pfkey_process+0x66d/0x7a0 net/key/af_key.c:2834 pfkey_sendmsg+0x42d/0x800 net/key/af_key.c:3673 sock_sendmsg_nosec net/socket.c:651 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:671 ____sys_sendmsg+0x331/0x810 net/socket.c:2362 ___sys_sendmsg+0xf3/0x170 net/socket.c:2416 __sys_sendmmsg+0x195/0x480 net/socket.c:2506 __do_sys_sendmmsg net/socket.c:2535 [inline] __se_sys_sendmmsg net/socket.c:2532 [inline] __x64_sys_sendmmsg+0x99/0x100 net/socket.c:2532 do_syscall_64+0x60/0xe0 arch/x86/entry/common.c:384 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x45c1d9 Code: Bad RIP value. RSP: 002b:00007f9b104e9c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: ffffffffffffffda RBX: 0000000000025a40 RCX: 000000000045c1d9 RDX: 0000000000000393 RSI: 0000000020000180 RDI: 0000000000000003 RBP: 000000000078bf48 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000078bf0c R13: 00007fffda2ff82f R14: 00007f9b104ea9c0 R15: 000000000078bf0c Allocated by task 6838: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48 kasan_set_track mm/kasan/common.c:56 [inline] __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:461 __do_kmalloc mm/slab.c:3655 [inline] __kmalloc+0x1a8/0x320 mm/slab.c:3664 kmalloc include/linux/slab.h:559 [inline] kzalloc include/linux/slab.h:666 [inline] ops_init+0xfb/0x470 net/core/net_namespace.c:141 setup_net+0x2d8/0x850 net/core/net_namespace.c:341 copy_net_ns+0x2cf/0x5e0 net/core/net_namespace.c:482 create_new_namespaces+0x3f6/0xb10 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0xbd/0x1f0 kernel/nsproxy.c:231 ksys_unshare+0x445/0x8e0 kernel/fork.c:2927 __do_sys_unshare kernel/fork.c:2995 [inline] __se_sys_unshare kernel/fork.c:2993 [inline] __x64_sys_unshare+0x2d/0x40 kernel/fork.c:2993 do_syscall_64+0x60/0xe0 arch/x86/entry/common.c:384 entry_SYSCALL_64_after_hwframe+0x44/0xa9 The buggy address belongs to the object at ffff88809e400000 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 392 bytes to the right of 512-byte region [ffff88809e400000, ffff88809e400200) The buggy address belongs to the page: page:00000000f37d1918 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x9e400 flags: 0xfffe0000000200(slab) raw: 00fffe0000000200 ffffea000289af88 ffffea0002774e88 ffff8880aa000600 raw: 0000000000000000 ffff88809e400000 0000000100000004 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88809e400280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88809e400300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88809e400380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff88809e400400: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff88809e400480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================