==================================================================
BUG: KASAN: out-of-bounds in csd_lock_record+0xcb/0xe0 kernel/smp.c:118
Read of size 8 at addr ffffc9000718f5b0 by task syz-executor.5/10455

CPU: 0 PID: 10455 Comm: syz-executor.5 Not tainted 5.8.0-rc3-next-20200703-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x18f/0x20d lib/dump_stack.c:118
 print_address_description.constprop.0.cold+0x5/0x436 mm/kasan/report.c:383
 __kasan_report mm/kasan/report.c:513 [inline]
 kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530
 csd_lock_record+0xcb/0xe0 kernel/smp.c:118
 flush_smp_call_function_queue+0x285/0x730 kernel/smp.c:391
 __sysvec_call_function_single+0x98/0x490 arch/x86/kernel/smp.c:248
 asm_call_on_stack+0xf/0x20 arch/x86/entry/entry_64.S:706
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:22 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:48 [inline]
 sysvec_call_function_single+0xe0/0x120 arch/x86/kernel/smp.c:243
 asm_sysvec_call_function_single+0x12/0x20 arch/x86/include/asm/idtentry.h:604
RIP: 0010:deref_stack_reg+0xf6/0x150 arch/x86/kernel/unwind_orc.c:361
Code: ba f5 ff 41 89 c0 31 c0 45 85 c0 75 27 48 ba 00 00 00 00 00 fc ff df 48 89 d9 48 89 ef e8 12 f9 ff ff 48 c1 e9 03 80 3c 11 00 <75> 31 48 89 03 b8 01 00 00 00 48 83 c4 08 5b 5d 41 5c 41 5d c3 e8
RSP: 0018:ffffc90005636b80 EFLAGS: 00000246
RAX: ffffffff81e907d0 RBX: ffffc90005636cd0 RCX: 1ffff92000ac6d9a
RDX: dffffc0000000000 RSI: ffffc90005637240 RDI: ffffc90005637240
RBP: ffffc90005637240 R08: ffffffff8b27a604 R09: ffffffff8b27a608
R10: 000000000007201e R11: 0000000000000001 R12: ffffc90005636c88
R13: ffffc90005630000 R14: ffffc90005636cd8 R15: ffffc90005636c88
 unwind_next_frame+0xc3b/0x1f90 arch/x86/kernel/unwind_orc.c:534
 arch_stack_walk+0x81/0xf0 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0x8c/0xc0 kernel/stacktrace.c:123
 save_stack+0x1b/0x40 mm/kasan/common.c:48
 set_track mm/kasan/common.c:56 [inline]
 __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:494
 __do_kmalloc mm/slab.c:3659 [inline]
 __kmalloc_track_caller+0x18d/0x4d0 mm/slab.c:3674
 kstrdup+0x36/0x70 mm/util.c:60
 kstrdup_const+0x53/0x80 mm/util.c:82
 __kernfs_new_node+0x9d/0x880 fs/kernfs/dir.c:623
 kernfs_new_node+0x93/0x120 fs/kernfs/dir.c:689
 kernfs_create_link+0xcb/0x225 fs/kernfs/symlink.c:39
 sysfs_do_create_link_sd+0x90/0x140 fs/sysfs/symlink.c:44
 sysfs_do_create_link fs/sysfs/symlink.c:80 [inline]
 sysfs_create_link+0x5f/0xc0 fs/sysfs/symlink.c:92
 device_add_class_symlinks drivers/base/core.c:2420 [inline]
 device_add+0x6ff/0x1b00 drivers/base/core.c:2628
 device_create_groups_vargs+0x203/0x280 drivers/base/core.c:3327
 device_create+0xdf/0x120 drivers/base/core.c:3369
 mac80211_hwsim_new_radio+0x382/0x4540 drivers/net/wireless/mac80211_hwsim.c:2909
 hwsim_new_radio_nl+0x93e/0xf8c drivers/net/wireless/mac80211_hwsim.c:3744
 genl_family_rcv_msg_doit net/netlink/genetlink.c:669 [inline]
 genl_family_rcv_msg net/netlink/genetlink.c:714 [inline]
 genl_rcv_msg+0x61d/0x980 net/netlink/genetlink.c:731
 netlink_rcv_skb+0x15a/0x430 net/netlink/af_netlink.c:2469
 genl_rcv+0x24/0x40 net/netlink/genetlink.c:742
 netlink_unicast_kernel net/netlink/af_netlink.c:1303 [inline]
 netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1329
 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1918
 sock_sendmsg_nosec net/socket.c:652 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:672
 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2352
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2406
 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2439
 do_syscall_64+0x60/0xe0 arch/x86/entry/common.c:367
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45cb29
Code: Bad RIP value.
RSP: 002b:00007f83c4f3bc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00000000005025a0 RCX: 000000000045cb29
RDX: 0000000000000000 RSI: 0000000020000000 RDI: 0000000000000008
RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 0000000000000a3c R14: 00000000004cd22e R15: 00007f83c4f3c6d4


Memory state around the buggy address:
 ffffc9000718f480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffc9000718f500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffc9000718f580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                     ^
 ffffc9000718f600: f1 f1 f1 f1 00 00 00 00 f3 f3 f3 f3 00 00 00 00
 ffffc9000718f680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================