netlink: 'syz.2.85': attribute type 30 has an invalid length. ================================================================== BUG: KASAN: slab-out-of-bounds in xfrm_policy_inexact_list_reinsert+0x5b0/0x660 net/xfrm/xfrm_policy.c:853 Read of size 1 at addr ffff888119a4f3d8 by task syz.2.85/645 CPU: 1 PID: 645 Comm: syz.2.85 Not tainted 5.10.233-syzkaller-00881-gfbe98d68b6b3 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack_lvl+0x1e2/0x24b lib/dump_stack.c:118 print_address_description+0x81/0x3b0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:435 [inline] kasan_report+0x179/0x1c0 mm/kasan/report.c:452 __asan_report_load1_noabort+0x14/0x20 mm/kasan/report_generic.c:306 xfrm_policy_inexact_list_reinsert+0x5b0/0x660 net/xfrm/xfrm_policy.c:853 xfrm_policy_inexact_node_merge net/xfrm/xfrm_policy.c:985 [inline] xfrm_policy_inexact_insert_node+0x917/0xb00 net/xfrm/xfrm_policy.c:1041 xfrm_policy_inexact_alloc_chain+0x4ec/0xaf0 net/xfrm/xfrm_policy.c:1157 xfrm_policy_inexact_insert+0x6a/0x1160 net/xfrm/xfrm_policy.c:1200 xfrm_policy_insert+0xe7/0x940 net/xfrm/xfrm_policy.c:1583 xfrm_add_policy+0x4f2/0x980 net/xfrm/xfrm_user.c:1733 xfrm_user_rcv_msg+0x4e7/0x7c0 net/xfrm/xfrm_user.c:2789 netlink_rcv_skb+0x1cf/0x410 net/netlink/af_netlink.c:2485 xfrm_netlink_rcv+0x72/0x90 net/xfrm/xfrm_user.c:2811 netlink_unicast_kernel net/netlink/af_netlink.c:1307 [inline] netlink_unicast+0x8df/0xac0 net/netlink/af_netlink.c:1333 netlink_sendmsg+0xa46/0xd00 net/netlink/af_netlink.c:1901 sock_sendmsg_nosec net/socket.c:652 [inline] __sock_sendmsg net/socket.c:664 [inline] ____sys_sendmsg+0x59e/0x8f0 net/socket.c:2376 ___sys_sendmsg+0x252/0x2e0 net/socket.c:2430 __sys_sendmsg net/socket.c:2459 [inline] __do_sys_sendmsg net/socket.c:2468 [inline] __se_sys_sendmsg+0x1b1/0x280 net/socket.c:2466 __x64_sys_sendmsg+0x7b/0x90 net/socket.c:2466 do_syscall_64+0x34/0x70 entry_SYSCALL_64_after_hwframe+0x61/0xcb RIP: 0033:0x7fd12a3fcd29 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007fd128a67038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00007fd12a615fa0 RCX: 00007fd12a3fcd29 RDX: 0000000000000000 RSI: 0000000020000580 RDI: 0000000000000003 RBP: 00007fd12a47e2a0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000000 R14: 00007fd12a615fa0 R15: 00007ffdf1691c08 Allocated by task 645: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:45 [inline] set_alloc_info mm/kasan/common.c:430 [inline] ____kasan_kmalloc+0xdb/0x110 mm/kasan/common.c:509 __kasan_kmalloc+0x9/0x10 mm/kasan/common.c:518 kasan_kmalloc include/linux/kasan.h:254 [inline] __kmalloc+0x1aa/0x330 mm/slub.c:4033 kmalloc include/linux/slab.h:557 [inline] sk_prot_alloc+0xbe/0x370 net/core/sock.c:1716 sk_alloc+0x38/0x4d0 net/core/sock.c:1774 pfkey_create+0x12c/0x620 net/key/af_key.c:154 __sock_create+0x3a6/0x760 net/socket.c:1436 sock_create net/socket.c:1487 [inline] __sys_socket+0x132/0x370 net/socket.c:1529 __do_sys_socket net/socket.c:1538 [inline] __se_sys_socket net/socket.c:1536 [inline] __x64_sys_socket+0x7a/0x90 net/socket.c:1536 do_syscall_64+0x34/0x70 entry_SYSCALL_64_after_hwframe+0x61/0xcb The buggy address belongs to the object at ffff888119a4f000 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 984 bytes inside of 1024-byte region [ffff888119a4f000, ffff888119a4f400) The buggy address belongs to the page: page:ffffea0004669200 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x119a48 head:ffffea0004669200 order:3 compound_mapcount:0 compound_pincount:0 flags: 0x4000000000010200(slab|head) raw: 4000000000010200 ffffea000463a200 0000000200000002 ffff888100042f00 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 143, ts 4985274851, free_ts 0 set_page_owner include/linux/page_owner.h:35 [inline] post_alloc_hook mm/page_alloc.c:2456 [inline] prep_new_page+0x166/0x180 mm/page_alloc.c:2462 get_page_from_freelist+0x2d8c/0x2f30 mm/page_alloc.c:4254 __alloc_pages_nodemask+0x435/0xaf0 mm/page_alloc.c:5348 allocate_slab mm/slub.c:1808 [inline] new_slab+0x80/0x400 mm/slub.c:1869 new_slab_objects mm/slub.c:2627 [inline] ___slab_alloc+0x302/0x4b0 mm/slub.c:2791 __slab_alloc+0x63/0xa0 mm/slub.c:2831 slab_alloc_node mm/slub.c:2913 [inline] slab_alloc mm/slub.c:2955 [inline] __kmalloc+0x204/0x330 mm/slub.c:4029 kmalloc include/linux/slab.h:557 [inline] load_elf_phdrs fs/binfmt_elf.c:480 [inline] load_elf_binary+0x2ec/0x2750 fs/binfmt_elf.c:860 search_binary_handler fs/exec.c:1726 [inline] exec_binprm fs/exec.c:1767 [inline] bprm_execve+0x81b/0x1600 fs/exec.c:1843 do_execveat_common+0x959/0xac0 fs/exec.c:1954 do_execve fs/exec.c:2024 [inline] __do_sys_execve fs/exec.c:2100 [inline] __se_sys_execve fs/exec.c:2095 [inline] __x64_sys_execve+0x92/0xb0 fs/exec.c:2095 do_syscall_64+0x34/0x70 entry_SYSCALL_64_after_hwframe+0x61/0xcb page_owner free stack trace missing Memory state around the buggy address: ffff888119a4f280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888119a4f300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff888119a4f380: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc ^ ffff888119a4f400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888119a4f480: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================