================================================================== BUG: KASAN: slab-out-of-bounds in erspan_build_header+0x392/0x3b0 net/ipv4/ip_gre.c:706 Read of size 2 at addr ffff8880a630b80b by task syz-executor.3/19918 CPU: 1 PID: 19918 Comm: syz-executor.3 Not tainted 4.14.120 #13 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x138/0x19c lib/dump_stack.c:53 print_address_description.cold+0x7c/0x1dc mm/kasan/report.c:252 kasan_report_error mm/kasan/report.c:351 [inline] kasan_report mm/kasan/report.c:409 [inline] kasan_report.cold+0x11e/0x2db mm/kasan/report.c:393 __asan_report_load_n_noabort+0xf/0x20 mm/kasan/report.c:440 erspan_build_header+0x392/0x3b0 net/ipv4/ip_gre.c:706 erspan_xmit net/ipv4/ip_gre.c:748 [inline] erspan_xmit+0x3ec/0x11c0 net/ipv4/ip_gre.c:725 __netdev_start_xmit include/linux/netdevice.h:4033 [inline] netdev_start_xmit include/linux/netdevice.h:4042 [inline] packet_direct_xmit+0x438/0x640 net/packet/af_packet.c:269 packet_snd net/packet/af_packet.c:2973 [inline] packet_sendmsg+0x329f/0x5930 net/packet/af_packet.c:2998 sock_sendmsg_nosec net/socket.c:646 [inline] sock_sendmsg+0xd0/0x110 net/socket.c:656 ___sys_sendmsg+0x70c/0x850 net/socket.c:2062 __sys_sendmsg+0xb9/0x140 net/socket.c:2096 SYSC_sendmsg net/socket.c:2107 [inline] SyS_sendmsg+0x2d/0x50 net/socket.c:2103 do_syscall_64+0x1eb/0x640 arch/x86/entry/common.c:292 entry_SYSCALL_64_after_hwframe+0x42/0xb7 RIP: 0033:0x458da9 RSP: 002b:00007f0692cbbc78 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000458da9 RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000003 RBP: 000000000073bfa0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f0692cbc6d4 R13: 00000000004c6745 R14: 00000000004db370 R15: 00000000ffffffff Allocated by task 1: save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59 save_stack+0x45/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc mm/kasan/kasan.c:551 [inline] kasan_kmalloc+0xce/0xf0 mm/kasan/kasan.c:529 __do_kmalloc mm/slab.c:3720 [inline] __kmalloc_track_caller+0x159/0x790 mm/slab.c:3735 kstrdup+0x3a/0x70 mm/util.c:56 kstrdup_const+0x48/0x60 mm/util.c:77 __kernfs_new_node+0x2f/0x420 fs/kernfs/dir.c:629 kernfs_new_node+0x80/0xf0 fs/kernfs/dir.c:678 kernfs_create_dir_ns+0x41/0x140 fs/kernfs/dir.c:999 sysfs_create_dir_ns+0xbe/0x1d0 fs/sysfs/dir.c:55 create_dir lib/kobject.c:71 [inline] kobject_add_internal.part.0.cold+0x114/0x5b1 lib/kobject.c:229 kobject_add_internal lib/kobject.c:205 [inline] kobject_add_varg lib/kobject.c:364 [inline] kobject_add+0x11f/0x180 lib/kobject.c:409 device_add+0x383/0x1490 drivers/base/core.c:1809 device_register+0x1e/0x30 drivers/base/core.c:1928 tty_register_device_attr+0x31e/0x6f0 drivers/tty/tty_io.c:2991 tty_register_device drivers/tty/tty_io.c:2925 [inline] tty_register_driver+0x3df/0x7d0 drivers/tty/tty_io.c:3196 legacy_pty_init drivers/tty/pty.c:595 [inline] pty_init+0x688/0xe81 drivers/tty/pty.c:954 do_one_initcall+0xa0/0x220 init/main.c:825 do_initcall_level init/main.c:891 [inline] do_initcalls init/main.c:899 [inline] do_basic_setup init/main.c:917 [inline] kernel_init_freeable+0x474/0x538 init/main.c:1074 kernel_init+0x12/0x162 init/main.c:999 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:402 Freed by task 0: (stack is not available) The buggy address belongs to the object at ffff8880a630b800 which belongs to the cache kmalloc-32 of size 32 The buggy address is located 11 bytes inside of 32-byte region [ffff8880a630b800, ffff8880a630b820) The buggy address belongs to the page: page:ffffea000298c2c0 count:1 mapcount:0 mapping:ffff8880a630b000 index:0xffff8880a630bfc1 flags: 0x1fffc0000000100(slab) raw: 01fffc0000000100 ffff8880a630b000 ffff8880a630bfc1 0000000100000034 raw: ffffea00028042e0 ffffea0002434fa0 ffff8880aa8001c0 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880a630b700: 06 fc fc fc fc fc fc fc 05 fc fc fc fc fc fc fc ffff8880a630b780: fb fb fb fb fc fc fc fc 06 fc fc fc fc fc fc fc >ffff8880a630b800: 06 fc fc fc fc fc fc fc 06 fc fc fc fc fc fc fc ^ ffff8880a630b880: 05 fc fc fc fc fc fc fc fb fb fb fb fc fc fc fc ffff8880a630b900: 05 fc fc fc fc fc fc fc 05 fc fc fc fc fc fc fc ==================================================================