==================================================================
BUG: KASAN: slab-out-of-bounds in _copy_to_user+0x9a/0xc0 lib/usercopy.c:27
Read of size 337 at addr ffff88016e78fffd by task syz-executor4/24726

CPU: 1 PID: 24726 Comm: syz-executor4 Not tainted 4.14.74+ #17
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0xb9/0x11b lib/dump_stack.c:53
 print_address_description+0x60/0x22b mm/kasan/report.c:252
 kasan_report_error mm/kasan/report.c:351 [inline]
 kasan_report.cold.6+0x11b/0x2dd mm/kasan/report.c:409
 _copy_to_user+0x9a/0xc0 lib/usercopy.c:27
 copy_to_user include/linux/uaccess.h:155 [inline]
 bpf_test_finish.isra.0+0xc8/0x190 net/bpf/test_run.c:59
 bpf_prog_test_run_skb+0x4d0/0x8c0 net/bpf/test_run.c:144
 bpf_prog_test_run kernel/bpf/syscall.c:1330 [inline]
 SYSC_bpf kernel/bpf/syscall.c:1602 [inline]
 SyS_bpf+0x79d/0x3640 kernel/bpf/syscall.c:1547
 do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x457579
RSP: 002b:00007f9f8f325c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457579
RDX: 0000000000000028 RSI: 0000000020000100 RDI: 000000000000000a
RBP: 000000000072bf00 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f9f8f3266d4
R13: 00000000004bd8a6 R14: 00000000004cc208 R15: 00000000ffffffff

Allocated by task 23561:
 save_stack mm/kasan/kasan.c:447 [inline]
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_kmalloc.part.1+0x4f/0xd0 mm/kasan/kasan.c:551
 slab_post_alloc_hook mm/slab.h:442 [inline]
 slab_alloc_node mm/slub.c:2723 [inline]
 slab_alloc mm/slub.c:2731 [inline]
 __kmalloc_track_caller+0x104/0x300 mm/slub.c:4288
 __kmalloc_reserve.isra.8+0x2f/0xc0 net/core/skbuff.c:137
 __alloc_skb+0x105/0x550 net/core/skbuff.c:205
 alloc_skb_fclone include/linux/skbuff.h:1022 [inline]
 sk_stream_alloc_skb+0xe7/0x7c0 net/ipv4/tcp.c:855
 tcp_sendmsg_locked+0xef4/0x3250 net/ipv4/tcp.c:1284
 tcp_sendmsg+0x2a/0x40 net/ipv4/tcp.c:1446
 inet_sendmsg+0x168/0x540 net/ipv4/af_inet.c:781
 sock_sendmsg_nosec net/socket.c:645 [inline]
 sock_sendmsg+0xb5/0x100 net/socket.c:655
 sock_write_iter+0x209/0x350 net/socket.c:924
 call_write_iter include/linux/fs.h:1782 [inline]
 new_sync_write fs/read_write.c:471 [inline]
 __vfs_write+0x417/0x5c0 fs/read_write.c:484
 vfs_write+0x17f/0x4d0 fs/read_write.c:546
 SYSC_write fs/read_write.c:593 [inline]
 SyS_write+0xc2/0x1a0 fs/read_write.c:585
 do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
 entry_SYSCALL_64_after_hwframe+0x42/0xb7

Freed by task 23567:
 save_stack mm/kasan/kasan.c:447 [inline]
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_slab_free+0xac/0x190 mm/kasan/kasan.c:524
 slab_free_hook mm/slub.c:1389 [inline]
 slab_free_freelist_hook mm/slub.c:1410 [inline]
 slab_free mm/slub.c:2966 [inline]
 kfree+0xf5/0x310 mm/slub.c:3897
 skb_free_head+0x83/0xa0 net/core/skbuff.c:550
 skb_release_data+0x495/0x610 net/core/skbuff.c:570
 skb_release_all+0x46/0x60 net/core/skbuff.c:627
 __kfree_skb+0x11/0x20 net/core/skbuff.c:641
 sk_wmem_free_skb include/net/sock.h:1406 [inline]
 tcp_write_queue_purge include/net/tcp.h:1621 [inline]
 tcp_v4_destroy_sock+0x21a/0x6a0 net/ipv4/tcp_ipv4.c:1899
 inet_csk_destroy_sock+0x16f/0x400 net/ipv4/inet_connection_sock.c:834
 tcp_close+0x970/0x1030 net/ipv4/tcp.c:2291
 inet_release+0xf7/0x1c0 net/ipv4/af_inet.c:444
 __sock_release+0xce/0x250 net/socket.c:602
 sock_close+0x15/0x20 net/socket.c:1138
 __fput+0x25e/0x6f0 fs/file_table.c:210
 task_work_run+0x116/0x190 kernel/task_work.c:113
 exit_task_work include/linux/task_work.h:22 [inline]
 do_exit+0x8f8/0x2800 kernel/exit.c:865
 do_group_exit+0x100/0x2e0 kernel/exit.c:968
 get_signal+0x4e5/0x1470 kernel/signal.c:2348
 do_signal+0x8f/0x1660 arch/x86/kernel/signal.c:809
 exit_to_usermode_loop+0x116/0x150 arch/x86/entry/common.c:159
 prepare_exit_to_usermode arch/x86/entry/common.c:198 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:267 [inline]
 do_syscall_64+0x35d/0x4b0 arch/x86/entry/common.c:294
 entry_SYSCALL_64_after_hwframe+0x42/0xb7

The buggy address belongs to the object at ffff88016e78fa80
 which belongs to the cache kmalloc-1024 of size 1024
The buggy address is located 381 bytes to the right of
 1024-byte region [ffff88016e78fa80, ffff88016e78fe80)
The buggy address belongs to the page:
page:ffffea0005b9e300 count:1 mapcount:0 mapping:          (null) index:0x0 compound_mapcount: 0
flags: 0x4000000000008100(slab|head)
raw: 4000000000008100 0000000000000000 0000000000000000 00000001000e000e
raw: dead000000000100 dead000000000200 ffff8801da802a00 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88016e78fe80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88016e78ff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88016e78ff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                                                                ^
 ffff88016e790000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff88016e790080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
usercopy: kernel memory exposure attempt detected from ffff8801c30e41fd (kmalloc-8192) (337 bytes)
------------[ cut here ]------------
kernel BUG at mm/usercopy.c:72!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN NOPTI
Modules linked in:
CPU: 0 PID: 24751 Comm: syz-executor4 Tainted: G    B           4.14.74+ #17
task: ffff8801a0d82f00 task.stack: ffff8801d2e10000
RIP: 0010:report_usercopy mm/usercopy.c:64 [inline]
RIP: 0010:__check_object_size+0x311/0x3a2 mm/usercopy.c:264
RSP: 0018:ffff8801d2e17b58 EFLAGS: 00010282
RAX: 0000000000000062 RBX: 0000000000000151 RCX: 000000000002be2d
RDX: 0000000000000000 RSI: ffffc900049a3000 RDI: ffffffff8b3d03a0
RBP: ffff8801c30e41fd R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff898bfca0
R13: 0000000000000001 R14: ffffffff898bfc60 R15: ffffea00070c3800
FS:  00007f9f8f305700(0000) GS:ffff8801dba00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f628ee4e1c4 CR3: 00000001d61de002 CR4: 00000000001606b0
DR0: 0000000020000000 DR1: 0000000020000000 DR2: 0000000020000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
Call Trace:
 check_object_size include/linux/thread_info.h:108 [inline]
 check_copy_size include/linux/thread_info.h:139 [inline]
 copy_to_user include/linux/uaccess.h:154 [inline]
 bpf_test_finish.isra.0+0xba/0x190 net/bpf/test_run.c:59
 bpf_prog_test_run_skb+0x4d0/0x8c0 net/bpf/test_run.c:144
 bpf_prog_test_run kernel/bpf/syscall.c:1330 [inline]
 SYSC_bpf kernel/bpf/syscall.c:1602 [inline]
 SyS_bpf+0x79d/0x3640 kernel/bpf/syscall.c:1547
 do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x457579
RSP: 002b:00007f9f8f304c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000141
RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000457579
RDX: 0000000000000028 RSI: 0000000020000100 RDI: 000000000000000a
RBP: 000000000072bfa0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f9f8f3056d4
R13: 00000000004bd8a6 R14: 00000000004cc208 R15: 00000000ffffffff
Code: fc 8b 89 4c 0f 45 e2 e8 ce d5 db ff 48 8b 04 24 49 89 d9 48 89 e9 4c 89 f2 4c 89 e6 48 c7 c7 e0 fc