==================================================================
BUG: KASAN: slab-out-of-bounds in decode_session6+0xfc3/0x17f0 net/xfrm/xfrm_policy.c:3376
Read of size 1 at addr ffff88802561e6fc by task swapper/1/0
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 6.0.0-rc2-syzkaller-00054-gc40e8341e3b3 #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:317 [inline]
print_report.cold+0x2ba/0x6e9 mm/kasan/report.c:433
kasan_report+0xb1/0x1e0 mm/kasan/report.c:495
decode_session6+0xfc3/0x17f0 net/xfrm/xfrm_policy.c:3376
__xfrm_decode_session+0x50/0xb0 net/xfrm/xfrm_policy.c:3482
xfrm_decode_session include/net/xfrm.h:1160 [inline]
vti6_tnl_xmit+0x419/0x1f90 net/ipv6/ip6_vti.c:577
__netdev_start_xmit include/linux/netdevice.h:4805 [inline]
netdev_start_xmit include/linux/netdevice.h:4819 [inline]
xmit_one net/core/dev.c:3590 [inline]
dev_hard_start_xmit+0x183/0x880 net/core/dev.c:3606
sch_direct_xmit+0x19f/0xbe0 net/sched/sch_generic.c:342
qdisc_restart net/sched/sch_generic.c:407 [inline]
__qdisc_run+0x4bb/0x1710 net/sched/sch_generic.c:415
__dev_xmit_skb net/core/dev.c:3880 [inline]
__dev_queue_xmit+0x2299/0x3ad0 net/core/dev.c:4222
dev_queue_xmit include/linux/netdevice.h:2994 [inline]
neigh_connected_output+0x3c0/0x520 net/core/neighbour.c:1575
neigh_output include/net/neighbour.h:551 [inline]
ip6_finish_output2+0x564/0x1520 net/ipv6/ip6_output.c:134
__ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
ip6_finish_output+0x690/0x1160 net/ipv6/ip6_output.c:206
NF_HOOK_COND include/linux/netfilter.h:296 [inline]
ip6_output+0x1ed/0x540 net/ipv6/ip6_output.c:227
dst_output include/net/dst.h:451 [inline]
NF_HOOK include/linux/netfilter.h:307 [inline]
ndisc_send_skb+0xa5f/0x1730 net/ipv6/ndisc.c:508
ndisc_send_rs+0x12e/0x6f0 net/ipv6/ndisc.c:718
addrconf_rs_timer+0x3ed/0x820 net/ipv6/addrconf.c:3927
call_timer_fn+0x1a0/0x6b0 kernel/time/timer.c:1474
expire_timers kernel/time/timer.c:1519 [inline]
__run_timers.part.0+0x674/0xa80 kernel/time/timer.c:1790
__run_timers kernel/time/timer.c:1768 [inline]
run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1803
__do_softirq+0x1d3/0x9c6 kernel/softirq.c:571
invoke_softirq kernel/softirq.c:445 [inline]
__irq_exit_rcu+0x123/0x180 kernel/softirq.c:650
irq_exit_rcu+0x5/0x20 kernel/softirq.c:662
sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1106
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:tick_nohz_idle_enter+0x19f/0x250 kernel/time/tick-sched.c:1163
Code: df 48 c1 ea 03 0f b6 04 02 48 89 ea 83 e2 07 38 d0 7f 04 84 c0 75 78 80 4b 4c 04 e8 fb 37 ec ff e8 66 86 12 00 fb 48 83 c4 08 <5b> 5d c3 e8 f9 0e 0c 00 65 8b 1d 0e 4b 93 7e 31 ff 89 de e8 a9 0b
RSP: 0018:ffffc9000067fe00 EFLAGS: 00000296
RAX: 00000000005f5217 RBX: ffff88802c92ae60 RCX: 1ffffffff1bbb881
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffff88802c92aeac R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff8f507057 R11: 0000000000000001 R12: 0000000000000000
R13: 0000000000000001 R14: 0000000000000000 R15: 0000000000000000
do_idle+0x94/0x590 kernel/sched/idle.c:277
cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:400
start_secondary+0x21d/0x2b0 arch/x86/kernel/smpboot.c:262
secondary_startup_64_no_verify+0xce/0xdb
Allocated by task 4216:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:38
kasan_set_track mm/kasan/common.c:45 [inline]
set_alloc_info mm/kasan/common.c:437 [inline]
____kasan_kmalloc mm/kasan/common.c:516 [inline]
____kasan_kmalloc mm/kasan/common.c:475 [inline]
__kasan_kmalloc+0xa6/0xd0 mm/kasan/common.c:525
kmalloc_reserve net/core/skbuff.c:358 [inline]
__alloc_skb+0xd9/0x2f0 net/core/skbuff.c:430
__netdev_alloc_skb+0x70/0x400 net/core/skbuff.c:496
__netdev_alloc_skb_ip_align include/linux/skbuff.h:3149 [inline]
netdev_alloc_skb_ip_align include/linux/skbuff.h:3159 [inline]
batadv_iv_ogm_aggregate_new+0x106/0x4e0 net/batman-adv/bat_iv_ogm.c:559
batadv_iv_ogm_queue_add net/batman-adv/bat_iv_ogm.c:671 [inline]
batadv_iv_ogm_schedule_buff+0xe46/0x1430 net/batman-adv/bat_iv_ogm.c:850
batadv_iv_ogm_schedule net/batman-adv/bat_iv_ogm.c:869 [inline]
batadv_iv_ogm_schedule net/batman-adv/bat_iv_ogm.c:862 [inline]
batadv_iv_send_outstanding_bat_ogm_packet+0x740/0x910 net/batman-adv/bat_iv_ogm.c:1713
process_one_work+0x991/0x1610 kernel/workqueue.c:2289
worker_thread+0x665/0x1080 kernel/workqueue.c:2436
kthread+0x2e4/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
The buggy address belongs to the object at ffff88802561e000
which belongs to the cache kmalloc-1k of size 1024
The buggy address is located 764 bytes to the right of
1024-byte region [ffff88802561e000, ffff88802561e400)
The buggy address belongs to the physical page:
page:ffffea0000958780 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88802561e000 pfn:0x2561e
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 ffffea000057f688 ffffea0000736d88 ffff888011840700
raw: ffff88802561e000 ffff88802561e000 0000000100000001 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2c2220(__GFP_HIGH|__GFP_ATOMIC|__GFP_NOWARN|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_THISNODE), pid 4499, tgid 4499 (syz-executor.0), ts 460240038673, free_ts 454733329566
prep_new_page mm/page_alloc.c:2532 [inline]
get_page_from_freelist+0x109b/0x2ce0 mm/page_alloc.c:4283
__alloc_pages_slowpath.constprop.0+0x2d7/0x2240 mm/page_alloc.c:5058
__alloc_pages+0x43d/0x510 mm/page_alloc.c:5528
__alloc_pages_node include/linux/gfp.h:243 [inline]
kmem_getpages mm/slab.c:1363 [inline]
cache_grow_begin+0x75/0x360 mm/slab.c:2569
cache_alloc_refill+0x27f/0x380 mm/slab.c:2942
____cache_alloc mm/slab.c:3018 [inline]
____cache_alloc mm/slab.c:3001 [inline]
slab_alloc_node mm/slab.c:3220 [inline]
kmem_cache_alloc_node_trace+0x50a/0x570 mm/slab.c:3601
__do_kmalloc_node mm/slab.c:3623 [inline]
__kmalloc_node_track_caller+0x38/0x60 mm/slab.c:3638
kmalloc_reserve net/core/skbuff.c:358 [inline]
__alloc_skb+0xd9/0x2f0 net/core/skbuff.c:430
alloc_skb include/linux/skbuff.h:1257 [inline]
nlmsg_new include/net/netlink.h:953 [inline]
inet6_rt_notify+0xec/0x2b0 net/ipv6/route.c:6172
fib6_add_rt2node net/ipv6/ip6_fib.c:1252 [inline]
fib6_add+0x26e7/0x3f10 net/ipv6/ip6_fib.c:1478
__ip6_ins_rt net/ipv6/route.c:1302 [inline]
ip6_route_add+0x8b/0x150 net/ipv6/route.c:3847
addrconf_prefix_route+0x30a/0x4e0 net/ipv6/addrconf.c:2425
fixup_permanent_addr net/ipv6/addrconf.c:3476 [inline]
addrconf_permanent_addr net/ipv6/addrconf.c:3500 [inline]
addrconf_notify+0x129d/0x1b90 net/ipv6/addrconf.c:3568
notifier_call_chain+0xb5/0x200 kernel/notifier.c:87
call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:1945
call_netdevice_notifiers_extack net/core/dev.c:1983 [inline]
call_netdevice_notifiers net/core/dev.c:1997 [inline]
__dev_notify_flags+0x110/0x2b0 net/core/dev.c:8594
page last free stack trace:
reset_page_owner include/linux/page_owner.h:24 [inline]
free_pages_prepare mm/page_alloc.c:1449 [inline]
free_pcp_prepare+0x5e4/0xd20 mm/page_alloc.c:1499
free_unref_page_prepare mm/page_alloc.c:3380 [inline]
free_unref_page+0x19/0x4d0 mm/page_alloc.c:3476
slab_destroy mm/slab.c:1615 [inline]
slabs_destroy+0x89/0xc0 mm/slab.c:1635
cache_flusharray mm/slab.c:3389 [inline]
___cache_free+0x2a8/0x3d0 mm/slab.c:3452
qlink_free mm/kasan/quarantine.c:168 [inline]
qlist_free_all+0x4f/0x1b0 mm/kasan/quarantine.c:187
kasan_quarantine_reduce+0x180/0x200 mm/kasan/quarantine.c:294
__kasan_slab_alloc+0x97/0xb0 mm/kasan/common.c:447
kasan_slab_alloc include/linux/kasan.h:224 [inline]
slab_post_alloc_hook mm/slab.h:727 [inline]
slab_alloc mm/slab.c:3294 [inline]
__kmem_cache_alloc_lru mm/slab.c:3471 [inline]
kmem_cache_alloc+0x214/0x520 mm/slab.c:3491
getname_flags.part.0+0x50/0x4f0 fs/namei.c:139
getname_flags+0x9a/0xe0 include/linux/audit.h:320
vfs_fstatat+0x73/0xb0 fs/stat.c:254
__do_sys_newfstatat+0x91/0x110 fs/stat.c:425
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x63/0xcd
Memory state around the buggy address:
ffff88802561e580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88802561e600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88802561e680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff88802561e700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff88802561e780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
----------------
Code disassembly (best guess), 1 bytes skipped:
0: 48 c1 ea 03 shr $0x3,%rdx
4: 0f b6 04 02 movzbl (%rdx,%rax,1),%eax
8: 48 89 ea mov %rbp,%rdx
b: 83 e2 07 and $0x7,%edx
e: 38 d0 cmp %dl,%al
10: 7f 04 jg 0x16
12: 84 c0 test %al,%al
14: 75 78 jne 0x8e
16: 80 4b 4c 04 orb $0x4,0x4c(%rbx)
1a: e8 fb 37 ec ff callq 0xffec381a
1f: e8 66 86 12 00 callq 0x12868a
24: fb sti
25: 48 83 c4 08 add $0x8,%rsp
* 29: 5b pop %rbx <-- trapping instruction
2a: 5d pop %rbp
2b: c3 retq
2c: e8 f9 0e 0c 00 callq 0xc0f2a
31: 65 8b 1d 0e 4b 93 7e mov %gs:0x7e934b0e(%rip),%ebx # 0x7e934b46
38: 31 ff xor %edi,%edi
3a: 89 de mov %ebx,%esi
3c: e8 .byte 0xe8
3d: a9 .byte 0xa9
3e: 0b .byte 0xb