==================================================================
BUG: KASAN: slab-out-of-bounds in decode_session6+0x1059/0x1880 net/xfrm/xfrm_policy.c:3375
Read of size 1 at addr ffff88806f5f765b by task syz-executor.0/3866
CPU: 2 PID: 3866 Comm: syz-executor.0 Not tainted 6.1.0-rc7-syzkaller-00101-g01f856ae6d0c #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xd1/0x138 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:284 [inline]
print_report+0x15e/0x45d mm/kasan/report.c:395
kasan_report+0xbf/0x1f0 mm/kasan/report.c:495
decode_session6+0x1059/0x1880 net/xfrm/xfrm_policy.c:3375
__xfrm_decode_session+0x54/0xb0 net/xfrm/xfrm_policy.c:3481
xfrm_decode_session include/net/xfrm.h:1168 [inline]
vti6_tnl_xmit+0x41d/0x1fa0 net/ipv6/ip6_vti.c:577
__netdev_start_xmit include/linux/netdevice.h:4840 [inline]
netdev_start_xmit include/linux/netdevice.h:4854 [inline]
xmit_one net/core/dev.c:3590 [inline]
dev_hard_start_xmit+0x1c2/0x990 net/core/dev.c:3606
sch_direct_xmit+0x1a3/0xbe0 net/sched/sch_generic.c:342
qdisc_restart net/sched/sch_generic.c:407 [inline]
__qdisc_run+0x4da/0x1750 net/sched/sch_generic.c:415
__dev_xmit_skb net/core/dev.c:3880 [inline]
__dev_queue_xmit+0x230b/0x3ba0 net/core/dev.c:4222
dev_queue_xmit include/linux/netdevice.h:3008 [inline]
neigh_connected_output+0x3c4/0x520 net/core/neighbour.c:1600
neigh_output include/net/neighbour.h:546 [inline]
ip6_finish_output2+0x56c/0x1530 net/ipv6/ip6_output.c:134
__ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
ip6_finish_output+0x694/0x1170 net/ipv6/ip6_output.c:206
NF_HOOK_COND include/linux/netfilter.h:291 [inline]
ip6_output+0x1f1/0x540 net/ipv6/ip6_output.c:227
dst_output include/net/dst.h:445 [inline]
NF_HOOK include/linux/netfilter.h:302 [inline]
ndisc_send_skb+0xa63/0x1740 net/ipv6/ndisc.c:508
ndisc_send_rs+0x132/0x6f0 net/ipv6/ndisc.c:718
addrconf_rs_timer+0x3f1/0x810 net/ipv6/addrconf.c:3931
call_timer_fn+0x1da/0x7c0 kernel/time/timer.c:1474
expire_timers kernel/time/timer.c:1519 [inline]
__run_timers.part.0+0x6a2/0xaf0 kernel/time/timer.c:1790
__run_timers kernel/time/timer.c:1768 [inline]
run_timer_softirq+0xb7/0x1d0 kernel/time/timer.c:1803
__do_softirq+0x1fb/0xadc kernel/softirq.c:571
invoke_softirq kernel/softirq.c:445 [inline]
__irq_exit_rcu+0x123/0x180 kernel/softirq.c:650
irq_exit_rcu+0x9/0x20 kernel/softirq.c:662
sysvec_apic_timer_interrupt+0x97/0xc0 arch/x86/kernel/apic/apic.c:1107
asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0x3c/0x70 kernel/locking/spinlock.c:194
Code: 74 24 10 e8 76 8e 72 f7 48 89 ef e8 1e fb 72 f7 81 e3 00 02 00 00 75 25 9c 58 f6 c4 02 75 2d 48 85 db 74 01 fb bf 01 00 00 00 8f 83 65 f7 65 8b 05 f8 07 12 76 85 c0 74 0a 5b 5d c3 e8 2c 28
RSP: 0018:ffffc90004de7940 EFLAGS: 00000206
RAX: 0000000000000002 RBX: 0000000000000200 RCX: 1ffffffff22260ae
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000001
RBP: ffff888026f0f338 R08: 0000000000000001 R09: ffffffff910f3ae7
R10: 0000000000000001 R11: 0000000000000000 R12: ffffea0001c75f00
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
__set_page_dirty include/linux/pagemap.h:1053 [inline]
mark_buffer_dirty+0x70d/0xa40 fs/buffer.c:1105
__block_commit_write.constprop.0.isra.0+0x19d/0x330 fs/buffer.c:2065
block_write_end+0x53/0x220 fs/buffer.c:2144
generic_write_end+0x8d/0x440 fs/buffer.c:2158
ext4_da_write_end+0x1f5/0xa30 fs/ext4/inode.c:3096
generic_perform_write+0x316/0x570 mm/filemap.c:3764
ext4_buffered_write_iter+0x15b/0x460 fs/ext4/file.c:285
ext4_file_write_iter+0x8bc/0x16e0 fs/ext4/file.c:700
call_write_iter include/linux/fs.h:2199 [inline]
new_sync_write fs/read_write.c:491 [inline]
vfs_write+0x9ed/0xdd0 fs/read_write.c:584
ksys_write+0x12b/0x250 fs/read_write.c:637
do_syscall_32_irqs_on arch/x86/entry/common.c:112 [inline]
__do_fast_syscall_32+0x65/0xf0 arch/x86/entry/common.c:178
do_fast_syscall_32+0x33/0x70 arch/x86/entry/common.c:203
entry_SYSENTER_compat_after_hwframe+0x70/0x82
RIP: 0023:0xf7f03549
Code: 03 74 c0 01 10 05 03 74 b8 01 10 06 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 8d b4 26 00 00 00 00 8d b4 26 00 00 00 00
RSP: 002b:00000000f7efe5cc EFLAGS: 00000296 ORIG_RAX: 0000000000000004
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000200011c0
RDX: 00000000fffffeaa RSI: 0000000000000000 RDI: 0000000000000000
RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000296 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
The buggy address belongs to the object at ffff88806f5f7400
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 91 bytes to the right of
512-byte region [ffff88806f5f7400, ffff88806f5f7600)
The buggy address belongs to the physical page:
page:ffffea0001bd7d00 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88806f5f4400 pfn:0x6f5f4
head:ffffea0001bd7d00 order:2 compound_mapcount:0 compound_pincount:0
flags: 0x4fff00000010200(slab|head|node=1|zone=1|lastcpupid=0x7ff)
raw: 04fff00000010200 0000000000000000 dead000000000001 ffff888012042c80
raw: ffff88806f5f4400 0000000080100001 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 3744, tgid 3744 (syz-executor.1), ts 202197898835, free_ts 0
prep_new_page mm/page_alloc.c:2539 [inline]
get_page_from_freelist+0x10b5/0x2d50 mm/page_alloc.c:4291
__alloc_pages+0x1cb/0x5b0 mm/page_alloc.c:5558
__alloc_pages_node include/linux/gfp.h:223 [inline]
alloc_slab_page mm/slub.c:1796 [inline]
allocate_slab+0x80/0x300 mm/slub.c:1939
new_slab mm/slub.c:1992 [inline]
___slab_alloc+0xa91/0x1400 mm/slub.c:3180
__slab_alloc.constprop.0+0x56/0xa0 mm/slub.c:3279
slab_alloc_node mm/slub.c:3364 [inline]
__kmem_cache_alloc_node+0x199/0x3e0 mm/slub.c:3437
kmalloc_node_trace+0x21/0x60 mm/slab_common.c:1058
kmalloc_node include/linux/slab.h:575 [inline]
kzalloc_node include/linux/slab.h:700 [inline]
alloc_fair_sched_group+0x1b5/0x430 kernel/sched/fair.c:11892
sched_create_group+0x2e/0x80 kernel/sched/core.c:10113
cpu_cgroup_css_alloc+0xe/0x30 kernel/sched/core.c:10262
css_create kernel/cgroup/cgroup.c:5526 [inline]
cgroup_apply_control_enable+0x4b8/0xc00 kernel/cgroup/cgroup.c:3235
cgroup_mkdir+0x5b9/0x11b0 kernel/cgroup/cgroup.c:5743
kernfs_iop_mkdir+0x14a/0x1d0 fs/kernfs/dir.c:1196
vfs_mkdir+0x48d/0x740 fs/namei.c:4036
do_mkdirat+0x290/0x310 fs/namei.c:4061
__do_sys_mkdirat fs/namei.c:4076 [inline]
__se_sys_mkdirat fs/namei.c:4074 [inline]
__ia32_sys_mkdirat+0x85/0xb0 fs/namei.c:4074
page_owner free stack trace missing
Memory state around the buggy address:
ffff88806f5f7500: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88806f5f7580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88806f5f7600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff88806f5f7680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88806f5f7700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
----------------
Code disassembly (best guess):
0: 74 24 je 0x26
2: 10 e8 adc %ch,%al
4: 76 8e jbe 0xffffff94
6: 72 f7 jb 0xffffffff
8: 48 89 ef mov %rbp,%rdi
b: e8 1e fb 72 f7 callq 0xf772fb2e
10: 81 e3 00 02 00 00 and $0x200,%ebx
16: 75 25 jne 0x3d
18: 9c pushfq
19: 58 pop %rax
1a: f6 c4 02 test $0x2,%ah
1d: 75 2d jne 0x4c
1f: 48 85 db test %rbx,%rbx
22: 74 01 je 0x25
24: fb sti
25: bf 01 00 00 00 mov $0x1,%edi
* 2a: e8 8f 83 65 f7 callq 0xf76583be <-- trapping instruction
2f: 65 8b 05 f8 07 12 76 mov %gs:0x761207f8(%rip),%eax # 0x7612082e
36: 85 c0 test %eax,%eax
38: 74 0a je 0x44
3a: 5b pop %rbx
3b: 5d pop %rbp
3c: c3 retq
3d: e8 .byte 0xe8
3e: 2c 28 sub $0x28,%al