RDS: rds_bind could not find a transport for 224.0.0.1, load rds_tcp or rds_rdma? ================================================================== BUG: KASAN: slab-out-of-bounds in erspan_build_header+0x3bf/0x3d0 net/ipv4/ip_gre.c:698 Read of size 2 at addr ffff8801d3c37a0b by task syz-executor3/25375 CPU: 0 PID: 25375 Comm: syz-executor3 Not tainted 4.15.0-rc9+ #282 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 print_address_description+0x73/0x250 mm/kasan/report.c:252 kasan_report_error mm/kasan/report.c:351 [inline] kasan_report+0x25b/0x340 mm/kasan/report.c:409 __asan_report_load_n_noabort+0xf/0x20 mm/kasan/report.c:440 erspan_build_header+0x3bf/0x3d0 net/ipv4/ip_gre.c:698 erspan_xmit+0x3b8/0x13b0 net/ipv4/ip_gre.c:740 __netdev_start_xmit include/linux/netdevice.h:4042 [inline] netdev_start_xmit include/linux/netdevice.h:4051 [inline] packet_direct_xmit+0x315/0x6b0 net/packet/af_packet.c:266 packet_snd net/packet/af_packet.c:2943 [inline] packet_sendmsg+0x3aed/0x60b0 net/packet/af_packet.c:2968 sock_sendmsg_nosec net/socket.c:638 [inline] sock_sendmsg+0xca/0x110 net/socket.c:648 SYSC_sendto+0x361/0x5c0 net/socket.c:1729 SyS_sendto+0x40/0x50 net/socket.c:1697 entry_SYSCALL_64_fastpath+0x29/0xa0 RIP: 0033:0x452f19 RSP: 002b:00007f791b505c58 EFLAGS: 00000212 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 000000000071bea0 RCX: 0000000000452f19 RDX: 0000000000000001 RSI: 0000000020012fff RDI: 0000000000000013 RBP: 00000000000003d6 R08: 0000000020008000 R09: 000000000000001c R10: fffffffffffffffc R11: 0000000000000212 R12: 00000000006f4cb0 R13: 00000000ffffffff R14: 00007f791b5066d4 R15: 0000000000000000 Allocated by task 25234: save_stack+0x43/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551 kmem_cache_alloc_trace+0x136/0x750 mm/slab.c:3610 kmalloc include/linux/slab.h:499 [inline] kzalloc include/linux/slab.h:688 [inline] sctp_association_new+0x114/0x2130 net/sctp/associola.c:308 __sctp_connect+0x5f9/0xca0 net/sctp/socket.c:1200 sctp_connect+0xb4/0xf0 net/sctp/socket.c:4273 inet_dgram_connect+0x16b/0x1f0 net/ipv4/af_inet.c:541 SYSC_connect+0x213/0x4a0 net/socket.c:1621 SyS_connect+0x24/0x30 net/socket.c:1602 entry_SYSCALL_64_fastpath+0x29/0xa0 Freed by task 25221: save_stack+0x43/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524 __cache_free mm/slab.c:3488 [inline] kfree+0xd6/0x260 mm/slab.c:3803 sctp_association_destroy net/sctp/associola.c:434 [inline] sctp_association_put+0x21c/0x2f0 net/sctp/associola.c:883 sctp_association_free+0x688/0x930 net/sctp/associola.c:412 sctp_cmd_delete_tcb net/sctp/sm_sideeffect.c:939 [inline] sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1355 [inline] sctp_side_effects net/sctp/sm_sideeffect.c:1222 [inline] sctp_do_sm+0x271b/0x6a20 net/sctp/sm_sideeffect.c:1193 sctp_primitive_SHUTDOWN+0xa0/0xd0 net/sctp/primitive.c:104 sctp_close+0x3c6/0x980 net/sctp/socket.c:1561 inet_release+0xed/0x1c0 net/ipv4/af_inet.c:426 sock_release+0x8d/0x1e0 net/socket.c:602 sock_close+0x16/0x20 net/socket.c:1131 __fput+0x327/0x7e0 fs/file_table.c:210 ____fput+0x15/0x20 fs/file_table.c:244 task_work_run+0x199/0x270 kernel/task_work.c:113 exit_task_work include/linux/task_work.h:22 [inline] do_exit+0x9bb/0x1ad0 kernel/exit.c:865 do_group_exit+0x149/0x400 kernel/exit.c:968 SYSC_exit_group kernel/exit.c:979 [inline] SyS_exit_group+0x1d/0x20 kernel/exit.c:977 entry_SYSCALL_64_fastpath+0x29/0xa0 The buggy address belongs to the object at ffff8801d3c367c0 which belongs to the cache kmalloc-4096 of size 4096 The buggy address is located 587 bytes to the right of 4096-byte region [ffff8801d3c367c0, ffff8801d3c377c0) The buggy address belongs to the page: page:ffffea00074f0d80 count:1 mapcount:0 mapping:ffff8801d3c367c0 index:0x0 compound_mapcount: 0 flags: 0x2fffc0000008100(slab|head) raw: 02fffc0000008100 ffff8801d3c367c0 0000000000000000 0000000100000001 raw: ffffea0006f2ba20 ffffea000750be20 ffff8801dac00dc0 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8801d3c37900: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8801d3c37980: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff8801d3c37a00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff8801d3c37a80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8801d3c37b00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================