==================================================================
BUG: KASAN: use-after-free in __le32_to_cpup include/uapi/linux/byteorder/little_endian.h:58 [inline]
BUG: KASAN: use-after-free in le32_to_cpuvp crypto/chacha20_generic.c:19 [inline]
BUG: KASAN: use-after-free in crypto_chacha20_init crypto/chacha20_generic.c:58 [inline]
BUG: KASAN: use-after-free in crypto_chacha20_crypt+0xaf1/0xbd0 crypto/chacha20_generic.c:91
Read of size 4 at addr ffff880100000003 by task kworker/1:2/3704

CPU: 1 PID: 3704 Comm: kworker/1:2 Not tainted 4.15.0-rc2+ #153
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: crypto cryptd_queue_worker
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x194/0x257 lib/dump_stack.c:53
 print_address_description+0x73/0x250 mm/kasan/report.c:252
 kasan_report_error mm/kasan/report.c:351 [inline]
 kasan_report+0x25b/0x340 mm/kasan/report.c:409
 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:429
 __le32_to_cpup include/uapi/linux/byteorder/little_endian.h:58 [inline]
 le32_to_cpuvp crypto/chacha20_generic.c:19 [inline]
 crypto_chacha20_init crypto/chacha20_generic.c:58 [inline]
 crypto_chacha20_crypt+0xaf1/0xbd0 crypto/chacha20_generic.c:91
 chacha20_simd+0xe4/0x410 arch/x86/crypto/chacha20_glue.c:78
 crypto_skcipher_encrypt include/crypto/skcipher.h:445 [inline]
 cryptd_skcipher_encrypt+0x2de/0x5a0 crypto/cryptd.c:495
 cryptd_queue_worker+0xff/0x1b0 crypto/cryptd.c:190
 process_one_work+0xbfd/0x1be0 kernel/workqueue.c:2112
 worker_thread+0x223/0x1990 kernel/workqueue.c:2246
 kthread+0x37a/0x440 kernel/kthread.c:238
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:441

The buggy address belongs to the page:
page:000000006aa99f09 count:0 mapcount:-127 mapping:          (null) index:0x0
flags: 0x2fffc0000000000()
raw: 02fffc0000000000 0000000000000000 0000000000000000 00000000ffffff80
raw: ffff88021fffae20 ffffea0004010020 000000000000000a 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
BUG: unable to handle kernel paging request at ffffed001fffffe0
IP: memcpy_erms+0x6/0x10 arch/x86/lib/memcpy_64.S:53
PGD 21ffd6067 P4D 21ffd6067 PUD 21ffd5067 PMD 0 
Oops: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 3704 Comm: kworker/1:2 Not tainted 4.15.0-rc2+ #153
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: crypto cryptd_queue_worker
RIP: 0010:memcpy_erms+0x6/0x10 arch/x86/lib/memcpy_64.S:53
RSP: 0018:ffff8801d8796f88 EFLAGS: 00010096
RAX: ffff8801d8796f94 RBX: ffffed001fffffe0 RCX: 0000000000000010
RDX: 0000000000000010 RSI: ffffed001fffffe0 RDI: ffff8801d8796f94
RBP: ffff8801d8796fe0 R08: ffffed003b0f2df7 R09: ffffed003b0f2df7
R10: dffffc0000000000 R11: ffffed003b0f2df6 R12: 00000000fffffffe
R13: ffff8800ffffff00 R14: ffffed0020000000 R15: 0000000000000014
FS:  0000000000000000(0000) GS:ffff8801db500000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffed001fffffe0 CR3: 00000001bfe5c000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 kasan_report_error mm/kasan/report.c:353 [inline]
 kasan_report+0x26f/0x340 mm/kasan/report.c:409
 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:429
 __le32_to_cpup include/uapi/linux/byteorder/little_endian.h:58 [inline]
 le32_to_cpuvp crypto/chacha20_generic.c:19 [inline]
 crypto_chacha20_init crypto/chacha20_generic.c:58 [inline]
 crypto_chacha20_crypt+0xaf1/0xbd0 crypto/chacha20_generic.c:91
 chacha20_simd+0xe4/0x410 arch/x86/crypto/chacha20_glue.c:78
 crypto_skcipher_encrypt include/crypto/skcipher.h:445 [inline]
 cryptd_skcipher_encrypt+0x2de/0x5a0 crypto/cryptd.c:495
 cryptd_queue_worker+0xff/0x1b0 crypto/cryptd.c:190
 process_one_work+0xbfd/0x1be0 kernel/workqueue.c:2112
 worker_thread+0x223/0x1990 kernel/workqueue.c:2246
 kthread+0x37a/0x440 kernel/kthread.c:238
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:441
Code: 90 90 90 90 90 eb 1e 0f 1f 00 48 89 f8 48 89 d1 48 c1 e9 03 83 e2 07 f3 48 a5 89 d1 f3 a4 c3 66 0f 1f 44 00 00 48 89 f8 48 89 d1 <f3> a4 c3 0f 1f 80 00 00 00 00 48 89 f8 48 83 fa 20 72 7e 40 38 
RIP: memcpy_erms+0x6/0x10 arch/x86/lib/memcpy_64.S:53 RSP: ffff8801d8796f88
CR2: ffffed001fffffe0
---[ end trace bef0cde3741c686a ]---