==================================================================
BUG: KASAN: out-of-bounds in csd_lock_record+0xd2/0xe0 kernel/smp.c:119
Read of size 8 at addr ffffc900041b7578 by task syz-executor.4/12149

CPU: 0 PID: 12149 Comm: syz-executor.4 Not tainted 5.8.0-rc3-next-20200703-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x18f/0x20d lib/dump_stack.c:118
 print_address_description.constprop.0.cold+0x5/0x436 mm/kasan/report.c:383
 __kasan_report mm/kasan/report.c:513 [inline]
 kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530
 csd_lock_record+0xd2/0xe0 kernel/smp.c:119
 flush_smp_call_function_queue+0x285/0x730 kernel/smp.c:391
 __sysvec_call_function_single+0x98/0x490 arch/x86/kernel/smp.c:248
 asm_call_on_stack+0xf/0x20 arch/x86/entry/entry_64.S:706
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:22 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:48 [inline]
 sysvec_call_function_single+0xe0/0x120 arch/x86/kernel/smp.c:243
 asm_sysvec_call_function_single+0x12/0x20 arch/x86/include/asm/idtentry.h:604
RIP: 0010:__preempt_count_sub arch/x86/include/asm/preempt.h:84 [inline]
RIP: 0010:preempt_count_sub+0x56/0x150 kernel/sched/core.c:3900
Code: 85 e4 00 00 00 8b 0d 59 cb 42 0b 85 c9 75 1b 65 8b 05 2e 78 b2 7e 89 c2 81 e2 ff ff ff 7f 39 d3 7f 13 81 fb fe 00 00 00 76 63 <f7> db 65 01 1d 11 78 b2 7e 5b c3 e8 aa 6f 9a 06 85 c0 74 f5 48 c7
RSP: 0018:ffffc90004476c60 EFLAGS: 00000202
RAX: 0000000080000201 RBX: 0000000000000001 RCX: 0000000000000000
RDX: 0000000000000201 RSI: 0000000000000004 RDI: 0000000000000001
RBP: ffffffff89a71340 R08: 0000000000000000 R09: ffffffff89a71343
R10: fffffbfff134e268 R11: 0000000000000000 R12: ffffffff89a71340
R13: 0000000000008363 R14: 0000000000000000 R15: 0000000000000001
 __raw_spin_unlock include/linux/spinlock_api_smp.h:152 [inline]
 _raw_spin_unlock+0x24/0x40 kernel/locking/spinlock.c:183
 spin_unlock include/linux/spinlock.h:394 [inline]
 get_next_corpse net/netfilter/nf_conntrack_core.c:2235 [inline]
 nf_ct_iterate_cleanup+0x88/0x330 net/netfilter/nf_conntrack_core.c:2259
 nf_ct_iterate_cleanup_net net/netfilter/nf_conntrack_core.c:2344 [inline]
 nf_ct_iterate_cleanup_net+0x113/0x170 net/netfilter/nf_conntrack_core.c:2329
 masq_device_event+0xae/0xe0 net/netfilter/nf_nat_masquerade.c:88
 notifier_call_chain+0xb5/0x200 kernel/notifier.c:83
 call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:2033
 call_netdevice_notifiers_extack net/core/dev.c:2045 [inline]
 call_netdevice_notifiers net/core/dev.c:2059 [inline]
 __dev_notify_flags+0x1da/0x2b0 net/core/dev.c:8327
 dev_change_flags+0x100/0x160 net/core/dev.c:8363
 do_setlink+0x87d/0x35c0 net/core/rtnetlink.c:2604
 rtnl_group_changelink net/core/rtnetlink.c:3123 [inline]
 __rtnl_newlink+0xdea/0x1730 net/core/rtnetlink.c:3277
 rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3397
 rtnetlink_rcv_msg+0x44e/0xad0 net/core/rtnetlink.c:5460
 netlink_rcv_skb+0x15a/0x430 net/netlink/af_netlink.c:2469
 netlink_unicast_kernel net/netlink/af_netlink.c:1303 [inline]
 netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1329
 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1918
 sock_sendmsg_nosec net/socket.c:652 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:672
 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2352
 ___sys_sendmsg+0xf3/0x170 net/socket.c:2406
 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2439
 do_syscall_64+0x60/0xe0 arch/x86/entry/common.c:367
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45cb29
Code: Bad RIP value.
RSP: 002b:00007f6d6be61c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 0000000000502760 RCX: 000000000045cb29
RDX: 0000000000000000 RSI: 0000000020000140 RDI: 0000000000000004
RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 0000000000000a43 R14: 00000000004cd2a1 R15: 00007f6d6be626d4


Memory state around the buggy address:
 ffffc900041b7480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffc900041b7500: 00 00 00 00 f1 f1 f1 f1 00 00 00 00 f3 f3 f3 f3
>ffffc900041b7580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                   ^
 ffffc900041b7600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffc900041b7680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================