==================================================================
BUG: KASAN: use-after-free in crypto_aead_alg include/crypto/aead.h:198 [inline]
BUG: KASAN: use-after-free in crypto_aead_encrypt include/crypto/aead.h:330 [inline]
BUG: KASAN: use-after-free in _aead_recvmsg crypto/algif_aead.c:308 [inline]
BUG: KASAN: use-after-free in aead_recvmsg+0x1758/0x1bc0 crypto/algif_aead.c:329
BUG: unable to handle kernel NULL pointer dereference at           (null)
IP:           (null)
PGD 1cc557067 P4D 1cc557067 PUD 1d76a3067 PMD 0 
Oops: 0010 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 3157 Comm: syzkaller898400 Not tainted 4.15.0-rc2+ #207
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: 000000003ed9b163 task.stack: 00000000fbefd28b
RIP: 0010:          (null)
RSP: 0018:ffff8801cbd4f818 EFLAGS: 00010286
RAX: ffff8801cb0f1a80 RBX: 1ffff100397a9f04 RCX: ffffffff823a8ded
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff8801cbd4f820
RBP: ffff8801cbd4f9c0 R08: 0000000000000000 R09: ffff8801cac88010
R10: 0000000000000008 R11: ffffed0039591009 R12: ffff8801caf42898
R13: ffff8801cb0f1aa8 R14: ffff8801cbd4f820 R15: dffffc0000000000
FS:  0000000001440880(0000) GS:ffff8801db400000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 00000001cc6c8000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 sock_recvmsg_nosec net/socket.c:805 [inline]
 sock_recvmsg+0xc9/0x110 net/socket.c:812
 sock_read_iter+0x361/0x560 net/socket.c:889
 call_read_iter include/linux/fs.h:1766 [inline]
 aio_read+0x2b0/0x3a0 fs/aio.c:1501
 io_submit_one fs/aio.c:1611 [inline]
 do_io_submit+0xf99/0x14f0 fs/aio.c:1682
 SYSC_io_submit fs/aio.c:1707 [inline]
 SyS_io_submit+0x27/0x30 fs/aio.c:1704
 entry_SYSCALL_64_fastpath+0x1f/0x96
RIP: 0033:0x440c69
RSP: 002b:00007ffe1ae17f08 EFLAGS: 00000213 ORIG_RAX: 00000000000000d1
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000440c69
RDX: 0000000020bd9fe0 RSI: 0000000000000002 RDI: 00007f18fa7c2000
RBP: 000000000000c6ca R08: 0000000000000000 R09: 0000000000000004
R10: 0000000000000000 R11: 0000000000000213 R12: 0000000000000000
R13: 00000000004020f0 R14: 0000000000000000 R15: 0000000000000000
Code:  Bad RIP value.
RIP:           (null) RSP: ffff8801cbd4f818
CR2: 0000000000000000
---[ end trace e5d78baad04b96d9 ]---