================================================================== BUG: KASAN: slab-out-of-bounds in __xfrm6_tunnel_spi_check+0x316/0x330 net/ipv6/xfrm6_tunnel.c:108 Read of size 8 at addr ffff888094da1fc8 by task syz-executor.2/12492 CPU: 1 PID: 12492 Comm: syz-executor.2 Not tainted 5.8.0-rc5-next-20200716-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x18f/0x20d lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xae/0x497 mm/kasan/report.c:383 __kasan_report mm/kasan/report.c:513 [inline] kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530 __xfrm6_tunnel_spi_check+0x316/0x330 net/ipv6/xfrm6_tunnel.c:108 __xfrm6_tunnel_alloc_spi net/ipv6/xfrm6_tunnel.c:131 [inline] xfrm6_tunnel_alloc_spi+0x296/0x8a0 net/ipv6/xfrm6_tunnel.c:174 ipcomp6_tunnel_create net/ipv6/ipcomp6.c:84 [inline] ipcomp6_tunnel_attach net/ipv6/ipcomp6.c:124 [inline] ipcomp6_init_state net/ipv6/ipcomp6.c:159 [inline] ipcomp6_init_state+0x2af/0x700 net/ipv6/ipcomp6.c:139 __xfrm_init_state+0x9a6/0x14b0 net/xfrm/xfrm_state.c:2498 xfrm_init_state+0x1a/0x70 net/xfrm/xfrm_state.c:2525 pfkey_msg2xfrm_state net/key/af_key.c:1291 [inline] pfkey_add+0x1a10/0x2b70 net/key/af_key.c:1508 pfkey_process+0x66d/0x7a0 net/key/af_key.c:2834 pfkey_sendmsg+0x42d/0x800 net/key/af_key.c:3673 sock_sendmsg_nosec net/socket.c:651 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:671 ____sys_sendmsg+0x331/0x810 net/socket.c:2362 ___sys_sendmsg+0xf3/0x170 net/socket.c:2416 __sys_sendmmsg+0x195/0x480 net/socket.c:2506 __do_sys_sendmmsg net/socket.c:2535 [inline] __se_sys_sendmmsg net/socket.c:2532 [inline] __x64_sys_sendmmsg+0x99/0x100 net/socket.c:2532 do_syscall_64+0x60/0xe0 arch/x86/entry/common.c:384 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x45c1d9 Code: Bad RIP value. RSP: 002b:00007fae3bc15c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: ffffffffffffffda RBX: 0000000000025a40 RCX: 000000000045c1d9 RDX: 0400000000000282 RSI: 0000000020000180 RDI: 0000000000000003 RBP: 000000000078bf48 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 000000000078bf0c R13: 00007ffd33f3159f R14: 00007fae3bc169c0 R15: 000000000078bf0c Allocated by task 7078: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48 kasan_set_track mm/kasan/common.c:56 [inline] __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:461 kmem_cache_alloc_trace+0x16e/0x2c0 mm/slab.c:3550 kmalloc include/linux/slab.h:554 [inline] kzalloc include/linux/slab.h:666 [inline] inetdev_init+0x68/0x4f0 net/ipv4/devinet.c:259 inetdev_event+0x9b8/0x14fd net/ipv4/devinet.c:1531 notifier_call_chain+0xb5/0x200 kernel/notifier.c:83 call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:2033 call_netdevice_notifiers_extack net/core/dev.c:2045 [inline] call_netdevice_notifiers net/core/dev.c:2059 [inline] register_netdevice+0x100f/0x1540 net/core/dev.c:9554 __ip_tunnel_create+0x398/0x580 net/ipv4/ip_tunnel.c:267 ip_tunnel_init_net+0x32b/0x980 net/ipv4/ip_tunnel.c:1072 vti_init_net+0x2a/0x360 net/ipv4/ip_vti.c:495 ops_init+0xaf/0x470 net/core/net_namespace.c:151 setup_net+0x2d8/0x850 net/core/net_namespace.c:341 copy_net_ns+0x2cf/0x5e0 net/core/net_namespace.c:482 create_new_namespaces+0x3f6/0xb10 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0xbd/0x1f0 kernel/nsproxy.c:231 ksys_unshare+0x445/0x8e0 kernel/fork.c:2927 __do_sys_unshare kernel/fork.c:2995 [inline] __se_sys_unshare kernel/fork.c:2993 [inline] __x64_sys_unshare+0x2d/0x40 kernel/fork.c:2993 do_syscall_64+0x60/0xe0 arch/x86/entry/common.c:384 entry_SYSCALL_64_after_hwframe+0x44/0xa9 The buggy address belongs to the object at ffff888094da1c00 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 456 bytes to the right of 512-byte region [ffff888094da1c00, ffff888094da1e00) The buggy address belongs to the page: page:000000001f022d12 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888094da1800 pfn:0x94da1 flags: 0xfffe0000000200(slab) raw: 00fffe0000000200 ffffea000154dc88 ffffea0002167788 ffff8880aa000600 raw: ffff888094da1800 ffff888094da1000 0000000100000003 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888094da1e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888094da1f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888094da1f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff888094da2000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888094da2080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================