================================================================== BUG: KASAN: slab-out-of-bounds in memcpy include/linux/string.h:447 [inline] BUG: KASAN: slab-out-of-bounds in skb_put_data include/linux/skbuff.h:2280 [inline] BUG: KASAN: slab-out-of-bounds in qrtr_endpoint_post+0x5c0/0x11b0 net/qrtr/qrtr.c:499 Read of size 4294967295 at addr ffff888014e170e4 by task syz-executor.0/2821 CPU: 0 PID: 2821 Comm: syz-executor.0 Not tainted 5.11.0-rc2-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x107/0x163 lib/dump_stack.c:120 print_address_description.constprop.0.cold+0x5b/0x2c6 mm/kasan/report.c:230 __kasan_report mm/kasan/report.c:396 [inline] kasan_report.cold+0x79/0xd5 mm/kasan/report.c:413 check_memory_region_inline mm/kasan/generic.c:179 [inline] check_memory_region+0x13d/0x180 mm/kasan/generic.c:185 memcpy+0x20/0x60 mm/kasan/shadow.c:64 memcpy include/linux/string.h:447 [inline] skb_put_data include/linux/skbuff.h:2280 [inline] qrtr_endpoint_post+0x5c0/0x11b0 net/qrtr/qrtr.c:499 qrtr_tun_write_iter+0xf5/0x180 net/qrtr/tun.c:92 call_write_iter include/linux/fs.h:1901 [inline] new_sync_write+0x426/0x650 fs/read_write.c:518 vfs_write+0x791/0xa30 fs/read_write.c:605 ksys_write+0x12d/0x250 fs/read_write.c:658 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x45e219 Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007fe2f7b91c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000045e219 RDX: 00000000000000e4 RSI: 0000000020000000 RDI: 0000000000000009 RBP: 000000000119bfc0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000119bf8c R13: 00007ffc12a6e75f R14: 00007fe2f7b929c0 R15: 000000000119bf8c Allocated by task 2821: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:38 kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:401 [inline] ____kasan_kmalloc.constprop.0+0x7f/0xa0 mm/kasan/common.c:429 kasan_kmalloc include/linux/kasan.h:215 [inline] __do_kmalloc mm/slab.c:3659 [inline] __kmalloc+0x20c/0x440 mm/slab.c:3668 kmalloc include/linux/slab.h:557 [inline] kzalloc include/linux/slab.h:682 [inline] qrtr_tun_write_iter+0x8a/0x180 net/qrtr/tun.c:83 call_write_iter include/linux/fs.h:1901 [inline] new_sync_write+0x426/0x650 fs/read_write.c:518 vfs_write+0x791/0xa30 fs/read_write.c:605 ksys_write+0x12d/0x250 fs/read_write.c:658 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 The buggy address belongs to the object at ffff888014e17000 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 228 bytes inside of 256-byte region [ffff888014e17000, ffff888014e17100) The buggy address belongs to the page: page:00000000bfdf38f5 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x14e17 flags: 0xfff00000000200(slab) raw: 00fff00000000200 ffffea00024b0408 ffffea0001ee7148 ffff888010040500 raw: 0000000000000000 ffff888014e17000 0000000100000008 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888014e16f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888014e17000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff888014e17080: 00 00 00 00 00 00 00 00 00 00 00 00 04 fc fc fc ^ ffff888014e17100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888014e17180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================