==================================================================
BUG: KASAN: use-after-free in __xfrm_policy_eval_candidates net/xfrm/xfrm_policy.c:2019 [inline]
BUG: KASAN: use-after-free in xfrm_policy_eval_candidates net/xfrm/xfrm_policy.c:2053 [inline]
BUG: KASAN: use-after-free in xfrm_policy_lookup_bytype+0xe5d/0xe80 net/xfrm/xfrm_policy.c:2113
Read of size 4 at addr ffff8881d91820b4 by task syz-executor4/8182

CPU: 0 PID: 8182 Comm: syz-executor4 Not tainted 4.20.0-rc7+ #357
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x244/0x39d lib/dump_stack.c:113
 print_address_description.cold.7+0x9/0x1ff mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report.cold.8+0x242/0x309 mm/kasan/report.c:412
 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:432
 __xfrm_policy_eval_candidates net/xfrm/xfrm_policy.c:2019 [inline]
 xfrm_policy_eval_candidates net/xfrm/xfrm_policy.c:2053 [inline]
 xfrm_policy_lookup_bytype+0xe5d/0xe80 net/xfrm/xfrm_policy.c:2113
 __xfrm_policy_check+0x235f/0x2c40 net/xfrm/xfrm_policy.c:3376
 __xfrm_policy_check2 include/net/xfrm.h:1166 [inline]
 xfrm_policy_check include/net/xfrm.h:1175 [inline]
 xfrm6_policy_check include/net/xfrm.h:1185 [inline]
 udpv6_queue_rcv_one_skb+0x517/0x16b0 net/ipv6/udp.c:615
 udpv6_queue_rcv_skb+0x594/0x8f0 net/ipv6/udp.c:699
 __udp6_lib_mcast_deliver net/ipv6/udp.c:812 [inline]
 __udp6_lib_rcv+0x1ecf/0x3190 net/ipv6/udp.c:916
 udpv6_rcv+0x21/0x30 net/ipv6/udp.c:1026
 ip6_protocol_deliver_rcu+0x372/0x1940 net/ipv6/ip6_input.c:394
 ip6_input_finish+0x84/0x170 net/ipv6/ip6_input.c:434
 NF_HOOK include/linux/netfilter.h:289 [inline]
 ip6_input+0xe9/0x600 net/ipv6/ip6_input.c:443
 ip6_mc_input+0x514/0x11c0 net/ipv6/ip6_input.c:537
 dst_input include/net/dst.h:450 [inline]
 ip6_rcv_finish+0x17a/0x330 net/ipv6/ip6_input.c:76
 NF_HOOK include/linux/netfilter.h:289 [inline]
 ipv6_rcv+0x115/0x640 net/ipv6/ip6_input.c:272
 __netif_receive_skb_one_core+0x14d/0x200 net/core/dev.c:4973
 __netif_receive_skb+0x2c/0x1e0 net/core/dev.c:5083
 process_backlog+0x24e/0x7a0 net/core/dev.c:5923
 napi_poll net/core/dev.c:6346 [inline]
 net_rx_action+0x7fa/0x19b0 net/core/dev.c:6412
 __do_softirq+0x308/0xb7e kernel/softirq.c:292
 do_softirq_own_stack+0x2a/0x40 arch/x86/entry/entry_64.S:1027
 </IRQ>
 do_softirq.part.14+0x126/0x160 kernel/softirq.c:337
 do_softirq+0x19/0x20 kernel/softirq.c:340
 netif_rx_ni+0x521/0x860 net/core/dev.c:4569
 dev_loopback_xmit+0x287/0x8c0 net/core/dev.c:3576
 NF_HOOK include/linux/netfilter.h:289 [inline]
 ip6_finish_output2+0x193a/0x2930 net/ipv6/ip6_output.c:84
 ip6_finish_output+0x583/0xc50 net/ipv6/ip6_output.c:154
 NF_HOOK_COND include/linux/netfilter.h:278 [inline]
 ip6_output+0x232/0x9d0 net/ipv6/ip6_output.c:171
 dst_output include/net/dst.h:444 [inline]
 ip6_local_out+0xc5/0x1b0 net/ipv6/output_core.c:176
 ip6_send_skb+0xbc/0x340 net/ipv6/ip6_output.c:1727
 udp_v6_send_skb.isra.32+0x831/0x14a0 net/ipv6/udp.c:1169
 udpv6_sendmsg+0x2d86/0x36a0 net/ipv6/udp.c:1466
kasan: CONFIG_KASAN_INLINE enabled
 inet_sendmsg+0x1a1/0x690 net/ipv4/af_inet.c:798
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 8183 Comm: syz-executor4 Not tainted 4.20.0-rc7+ #357
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__xfrm_policy_eval_candidates net/xfrm/xfrm_policy.c:2019 [inline]
RIP: 0010:xfrm_policy_eval_candidates net/xfrm/xfrm_policy.c:2053 [inline]
RIP: 0010:xfrm_policy_lookup_bytype+0xc1b/0xe80 net/xfrm/xfrm_policy.c:2113
 sock_sendmsg_nosec net/socket.c:621 [inline]
 sock_sendmsg+0xd5/0x120 net/socket.c:631
Code: 78 fe ff ff e8 56 0b af fa 4d 89 e6 49 83 ee 08 0f 84 66 fe ff ff e8 44 0b af fa 49 8d bc 24 ac 00 00 00 48 89 f8 48 c1 e8 03 <42> 0f b6 14 28 48 89 f8 83 e0 07 83 c0 03 38 d0 7c 08 84 d2 0f 85
 __sys_sendto+0x3d7/0x670 net/socket.c:1788
RSP: 0018:ffff8881dad06858 EFLAGS: 00010207
RAX: 0686c6866626a5db RBX: 0000000000000000 RCX: ffffffff86d07a0c
RDX: 0000000000000100 RSI: ffffffff86d07a2c RDI: 3436343331352ede
RBP: ffff8881dad06b10 R08: ffff8881c392c580 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 3436343331352e32
R13: dffffc0000000000 R14: 3436343331352e2a R15: 00000000ffffffff
FS:  00007f69ed636700(0000) GS:ffff8881dad00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b2c324000 CR3: 000000018dac6000 CR4: 00000000001406e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <IRQ>
 __do_sys_sendto net/socket.c:1800 [inline]
 __se_sys_sendto net/socket.c:1796 [inline]
 __x64_sys_sendto+0xe1/0x1a0 net/socket.c:1796
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 __xfrm_policy_check+0x235f/0x2c40 net/xfrm/xfrm_policy.c:3376
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x457669
Code: fd b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f69ed656c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000457669
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000004
RBP: 000000000072bfa0 R08: 0000000020000300 R09: 000000000000001c
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f69ed6576d4
R13: 00000000004c4539 R14: 00000000004d75a8 R15: 00000000ffffffff
 __xfrm_policy_check2 include/net/xfrm.h:1166 [inline]
 xfrm_policy_check include/net/xfrm.h:1175 [inline]
 xfrm6_policy_check include/net/xfrm.h:1185 [inline]
 udpv6_queue_rcv_one_skb+0x517/0x16b0 net/ipv6/udp.c:615

Allocated by task 6070:
 save_stack+0x43/0xd0 mm/kasan/kasan.c:448
 set_track mm/kasan/kasan.c:460 [inline]
 kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:553
 udpv6_queue_rcv_skb+0x594/0x8f0 net/ipv6/udp.c:699
 kmem_cache_alloc_trace+0x152/0x750 mm/slab.c:3620
 __udp6_lib_mcast_deliver net/ipv6/udp.c:812 [inline]
 __udp6_lib_rcv+0x1ecf/0x3190 net/ipv6/udp.c:916
 kmalloc include/linux/slab.h:546 [inline]
 syslog_print kernel/printk/printk.c:1301 [inline]
 do_syslog+0xb9b/0x1690 kernel/printk/printk.c:1469
 kmsg_read+0x8f/0xc0 fs/proc/kmsg.c:40
 proc_reg_read+0x2a3/0x3d0 fs/proc/inode.c:231
 __vfs_read+0x117/0x9b0 fs/read_write.c:416
 vfs_read+0x17f/0x3c0 fs/read_write.c:452
 ksys_read+0x101/0x260 fs/read_write.c:578
 __do_sys_read fs/read_write.c:588 [inline]
 __se_sys_read fs/read_write.c:586 [inline]
 __x64_sys_read+0x73/0xb0 fs/read_write.c:586
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 udpv6_rcv+0x21/0x30 net/ipv6/udp.c:1026
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
 ip6_protocol_deliver_rcu+0x372/0x1940 net/ipv6/ip6_input.c:394

Freed by task 6070:
 save_stack+0x43/0xd0 mm/kasan/kasan.c:448
 ip6_input_finish+0x84/0x170 net/ipv6/ip6_input.c:434
 set_track mm/kasan/kasan.c:460 [inline]
 __kasan_slab_free+0x102/0x150 mm/kasan/kasan.c:521
 NF_HOOK include/linux/netfilter.h:289 [inline]
 ip6_input+0xe9/0x600 net/ipv6/ip6_input.c:443
 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
 __cache_free mm/slab.c:3498 [inline]
 kfree+0xcf/0x230 mm/slab.c:3817
 syslog_print kernel/printk/printk.c:1352 [inline]
 do_syslog+0x147b/0x1690 kernel/printk/printk.c:1469
 kmsg_read+0x8f/0xc0 fs/proc/kmsg.c:40
 proc_reg_read+0x2a3/0x3d0 fs/proc/inode.c:231
 __vfs_read+0x117/0x9b0 fs/read_write.c:416
 ip6_mc_input+0x514/0x11c0 net/ipv6/ip6_input.c:537
 vfs_read+0x17f/0x3c0 fs/read_write.c:452
 ksys_read+0x101/0x260 fs/read_write.c:578
 __do_sys_read fs/read_write.c:588 [inline]
 __se_sys_read fs/read_write.c:586 [inline]
 __x64_sys_read+0x73/0xb0 fs/read_write.c:586
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

The buggy address belongs to the object at ffff8881d9182000
 which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 180 bytes inside of
 1024-byte region [ffff8881d9182000, ffff8881d9182400)
 dst_input include/net/dst.h:450 [inline]
 ip6_rcv_finish+0x17a/0x330 net/ipv6/ip6_input.c:76
The buggy address belongs to the page:
 NF_HOOK include/linux/netfilter.h:289 [inline]
 ipv6_rcv+0x115/0x640 net/ipv6/ip6_input.c:272
page:ffffea0007646080 count:1 mapcount:0 mapping:ffff8881da800ac0 index:0x0 compound_mapcount: 0
flags: 0x2fffc0000010200(slab|head)
raw: 02fffc0000010200 ffffea0006ee3808 ffffea0005de5a08 ffff8881da800ac0
raw: 0000000000000000 ffff8881d9182000 0000000100000007 0000000000000000
page dumped because: kasan: bad access detected
 __netif_receive_skb_one_core+0x14d/0x200 net/core/dev.c:4973

Memory state around the buggy address:
 ffff8881d9181f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8881d9182000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8881d9182080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 __netif_receive_skb+0x2c/0x1e0 net/core/dev.c:5083
                                     ^
 process_backlog+0x24e/0x7a0 net/core/dev.c:5923
 ffff8881d9182100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 napi_poll net/core/dev.c:6346 [inline]
 net_rx_action+0x7fa/0x19b0 net/core/dev.c:6412
 ffff8881d9182180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================