==================================================================
BUG: KASAN: slab-out-of-bounds in pfkey_sadb2xfrm_user_sec_ctx net/key/af_key.c:474 [inline] at addr ffff8801d56d3018
BUG: KASAN: slab-out-of-bounds in pfkey_compile_policy+0x8e6/0xd40 net/key/af_key.c:3306 at addr ffff8801d56d3018
Read of size 1280 by task syzkaller694191/3323
CPU: 0 PID: 3323 Comm: syzkaller694191 Not tainted 4.9.69-g3f1d77c #4
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801d5ca77d8 ffffffff81d90a29 ffff8801da0013c0 ffff8801d56d3000
 ffff8801d56d3100 ffffed003aada618 ffff8801d56d3018 ffff8801d5ca7800
 ffffffff8153a45c ffffed003aada618 ffff8801da0013c0 0000000000000000
Call Trace:
 [<ffffffff81d90a29>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d90a29>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff8153a45c>] kasan_object_err+0x1c/0x70 mm/kasan/report.c:160
 [<ffffffff8153a71c>] print_address_description mm/kasan/report.c:198 [inline]
 [<ffffffff8153a71c>] kasan_report_error mm/kasan/report.c:287 [inline]
 [<ffffffff8153a71c>] kasan_report.part.1+0x21c/0x500 mm/kasan/report.c:309
 [<ffffffff8153ace1>] kasan_report+0x21/0x30 mm/kasan/report.c:310
 [<ffffffff81539627>] check_memory_region_inline mm/kasan/kasan.c:308 [inline]
 [<ffffffff81539627>] check_memory_region+0x137/0x190 mm/kasan/kasan.c:315
 [<ffffffff81539b23>] memcpy+0x23/0x50 mm/kasan/kasan.c:350
 [<ffffffff83575136>] pfkey_sadb2xfrm_user_sec_ctx net/key/af_key.c:474 [inline]
 [<ffffffff83575136>] pfkey_compile_policy+0x8e6/0xd40 net/key/af_key.c:3306
 [<ffffffff833ce0de>] xfrm_user_policy+0x2fe/0x530 net/xfrm/xfrm_state.c:1907
 [<ffffffff83208467>] do_ip_setsockopt.isra.12+0x1977/0x2960 net/ipv4/ip_sockglue.c:1151
 [<ffffffff8320954f>] compat_ip_setsockopt+0x4f/0xf0 net/ipv4/ip_sockglue.c:1269
 [<ffffffff83212eb5>] inet_csk_compat_setsockopt+0x95/0x120 net/ipv4/inet_connection_sock.c:914
 [<ffffffff8322924d>] compat_tcp_setsockopt+0x3d/0x70 net/ipv4/tcp.c:2747
 [<ffffffff82ed6352>] compat_sock_common_setsockopt+0xb2/0x140 net/core/sock.c:2717
 [<ffffffff82fd5989>] C_SYSC_setsockopt net/compat.c:398 [inline]
 [<ffffffff82fd5989>] compat_SyS_setsockopt+0x149/0x290 net/compat.c:381
 [<ffffffff81006fc7>] do_syscall_32_irqs_on arch/x86/entry/common.c:322 [inline]
 [<ffffffff81006fc7>] do_fast_syscall_32+0x2f7/0x890 arch/x86/entry/common.c:384
 [<ffffffff838ac161>] entry_SYSENTER_compat+0x51/0x60 arch/x86/entry/entry_64_compat.S:124
Object at ffff8801d56d3000, in cache kmalloc-256 size: 256
Allocated:
PID = 3323
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack+0x43/0xd0 mm/kasan/kasan.c:495
 set_track mm/kasan/kasan.c:507 [inline]
 kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:598
 __kmalloc+0x11d/0x310 mm/slub.c:3741
 kmalloc include/linux/slab.h:495 [inline]
 xfrm_user_policy+0xc1/0x530 net/xfrm/xfrm_state.c:1896
 do_ip_setsockopt.isra.12+0x1977/0x2960 net/ipv4/ip_sockglue.c:1151
 compat_ip_setsockopt+0x4f/0xf0 net/ipv4/ip_sockglue.c:1269
 inet_csk_compat_setsockopt+0x95/0x120 net/ipv4/inet_connection_sock.c:914
 compat_tcp_setsockopt+0x3d/0x70 net/ipv4/tcp.c:2747
 compat_sock_common_setsockopt+0xb2/0x140 net/core/sock.c:2717
 C_SYSC_setsockopt net/compat.c:398 [inline]
 compat_SyS_setsockopt+0x149/0x290 net/compat.c:381
 do_syscall_32_irqs_on arch/x86/entry/common.c:322 [inline]
 do_fast_syscall_32+0x2f7/0x890 arch/x86/entry/common.c:384
 entry_SYSENTER_compat+0x51/0x60 arch/x86/entry/entry_64_compat.S:124
Freed:
PID = 0
(stack is not available)
Memory state around the buggy address:
 ffff8801d56d2f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8801d56d3000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8801d56d3080: 00 00 00 00 00 00 00 00 02 fc fc fc fc fc fc fc
                                           ^
 ffff8801d56d3100: fc fc fc fc fc fc fc fc fc fc fc