==================================================================
BUG: KASAN: use-after-free in decode_session6 net/xfrm/xfrm_policy.c:3384 [inline]
BUG: KASAN: use-after-free in __xfrm_decode_session+0x1520/0x1d20 net/xfrm/xfrm_policy.c:3491
Read of size 1 at addr ffff0000d3f756b9 by task syz-executor.5/3984

CPU: 0 PID: 3984 Comm: syz-executor.5 Not tainted 5.15.122-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/03/2023
Call trace:
 dump_backtrace+0x0/0x530 arch/arm64/kernel/stacktrace.c:152
 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x108/0x170 lib/dump_stack.c:106
 print_address_description+0x7c/0x3f0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:434 [inline]
 kasan_report+0x174/0x1e4 mm/kasan/report.c:451
 __asan_report_load1_noabort+0x44/0x50 mm/kasan/report_generic.c:306
 decode_session6 net/xfrm/xfrm_policy.c:3384 [inline]
 __xfrm_decode_session+0x1520/0x1d20 net/xfrm/xfrm_policy.c:3491
 xfrm_decode_session include/net/xfrm.h:1156 [inline]
 xfrmi_xmit+0x1a0/0x12f8 net/xfrm/xfrm_interface_core.c:402
 __netdev_start_xmit include/linux/netdevice.h:5018 [inline]
 netdev_start_xmit include/linux/netdevice.h:5032 [inline]
 xmit_one net/core/dev.c:3594 [inline]
 dev_hard_start_xmit+0x2bc/0x92c net/core/dev.c:3610
 sch_direct_xmit+0x2e0/0x484 net/sched/sch_generic.c:342
 qdisc_restart net/sched/sch_generic.c:407 [inline]
 __qdisc_run+0x878/0x1fc0 net/sched/sch_generic.c:415
 __dev_xmit_skb net/core/dev.c:3879 [inline]
 __dev_queue_xmit+0x1068/0x2a6c net/core/dev.c:4190
 dev_queue_xmit+0x24/0x34 net/core/dev.c:4258
 neigh_connected_output+0x334/0x378 net/core/neighbour.c:1522
 neigh_output include/net/neighbour.h:509 [inline]
 ip6_finish_output2+0x1344/0x1c48 net/ipv6/ip6_output.c:126
 __ip6_finish_output+0x518/0x67c net/ipv6/ip6_output.c:191
 ip6_finish_output+0x40/0x218 net/ipv6/ip6_output.c:201
 NF_HOOK_COND include/linux/netfilter.h:291 [inline]
 ip6_output+0x270/0x594 net/ipv6/ip6_output.c:224
 dst_output include/net/dst.h:443 [inline]
 NF_HOOK include/linux/netfilter.h:302 [inline]
 ndisc_send_skb+0xbf8/0x1788 net/ipv6/ndisc.c:508
 ndisc_send_rs+0x494/0x5fc net/ipv6/ndisc.c:702
 addrconf_rs_timer+0x308/0x5a8 net/ipv6/addrconf.c:3931
 call_timer_fn+0x19c/0x8f0 kernel/time/timer.c:1421
 expire_timers kernel/time/timer.c:1466 [inline]
 __run_timers+0x554/0x718 kernel/time/timer.c:1737
 run_timer_softirq+0x7c/0x114 kernel/time/timer.c:1750
 __do_softirq+0x344/0xe20 kernel/softirq.c:558
 do_softirq_own_stack include/asm-generic/softirq_stack.h:10 [inline]
 invoke_softirq kernel/softirq.c:439 [inline]
 __irq_exit_rcu+0x28c/0x534 kernel/softirq.c:636
 irq_exit+0x14/0x88 kernel/softirq.c:660
 handle_domain_irq+0xf4/0x178 kernel/irq/irqdesc.c:710
 gic_handle_irq+0x78/0x1c8 drivers/irqchip/irq-gic-v3.c:758
 call_on_irq_stack+0x24/0x4c arch/arm64/kernel/entry.S:899
 do_interrupt_handler+0x74/0x94 arch/arm64/kernel/entry-common.c:267
 el1_interrupt+0x30/0x58 arch/arm64/kernel/entry-common.c:442
 el1h_64_irq_handler+0x18/0x24 arch/arm64/kernel/entry-common.c:458
 el1h_64_irq+0x78/0x7c arch/arm64/kernel/entry.S:580
 arch_local_irq_restore arch/arm64/include/asm/irqflags.h:122 [inline]
 consume_stock mm/memcontrol.c:2209 [inline]
 try_charge_memcg+0x254/0x13d8 mm/memcontrol.c:2604
 obj_cgroup_charge_pages+0xb0/0x1d0 mm/memcontrol.c:3014
 __memcg_kmem_charge_page+0x454/0x7ec mm/memcontrol.c:3054
 __alloc_pages+0x240/0x674 mm/page_alloc.c:5438
 alloc_pages+0x390/0x634
 __pte_alloc_one include/asm-generic/pgalloc.h:63 [inline]
 pte_alloc_one+0x2c/0x258 include/asm-generic/pgalloc.h:85
 __pte_alloc+0x84/0x2c4 mm/memory.c:439
 copy_pte_range mm/memory.c:1021 [inline]
 copy_pmd_range mm/memory.c:1156 [inline]
 copy_pud_range mm/memory.c:1193 [inline]
 copy_p4d_range mm/memory.c:1217 [inline]
 copy_page_range+0x2734/0x2dac mm/memory.c:1290
 dup_mmap kernel/fork.c:614 [inline]
 dup_mm+0x8e4/0xfb0 kernel/fork.c:1457
 copy_mm+0xe0/0x1c0 kernel/fork.c:1509
 copy_process+0x1680/0x3750 kernel/fork.c:2198
 kernel_clone+0x1d8/0xa58 kernel/fork.c:2601
 __do_sys_clone kernel/fork.c:2718 [inline]
 __se_sys_clone kernel/fork.c:2686 [inline]
 __arm64_sys_clone+0x1f0/0x24c kernel/fork.c:2686
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584

Allocated by task 4114:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:46 [inline]
 set_alloc_info mm/kasan/common.c:434 [inline]
 __kasan_slab_alloc+0x8c/0xcc mm/kasan/common.c:467
 kasan_slab_alloc include/linux/kasan.h:254 [inline]
 slab_post_alloc_hook+0x74/0x3f4 mm/slab.h:519
 slab_alloc_node mm/slub.c:3220 [inline]
 slab_alloc mm/slub.c:3228 [inline]
 kmem_cache_alloc+0x1dc/0x45c mm/slub.c:3233
 skb_clone+0x180/0x304 net/core/skbuff.c:1523
 dev_queue_xmit_nit+0x21c/0x970 net/core/dev.c:2290
 xmit_one net/core/dev.c:3589 [inline]
 dev_hard_start_xmit+0x110/0x92c net/core/dev.c:3610
 sch_direct_xmit+0x2e0/0x484 net/sched/sch_generic.c:342
 __dev_xmit_skb net/core/dev.c:3821 [inline]
 __dev_queue_xmit+0x14b4/0x2a6c net/core/dev.c:4190
 dev_queue_xmit+0x24/0x34 net/core/dev.c:4258
 neigh_hh_output include/net/neighbour.h:493 [inline]
 neigh_output include/net/neighbour.h:507 [inline]
 ip_finish_output2+0xd50/0x1330 net/ipv4/ip_output.c:228
 __ip_finish_output+0x1b0/0x458
 ip_finish_output+0x40/0x218 net/ipv4/ip_output.c:316
 NF_HOOK_COND include/linux/netfilter.h:291 [inline]
 ip_output+0x330/0x49c net/ipv4/ip_output.c:430
 dst_output include/net/dst.h:443 [inline]
 ip_local_out net/ipv4/ip_output.c:126 [inline]
 __ip_queue_xmit+0xe70/0x1930 net/ipv4/ip_output.c:532
 ip_queue_xmit+0x5c/0x78 net/ipv4/ip_output.c:546
 __tcp_transmit_skb+0x1954/0x3218 net/ipv4/tcp_output.c:1403
 tcp_transmit_skb net/ipv4/tcp_output.c:1421 [inline]
 tcp_write_xmit+0x12bc/0x4dc0 net/ipv4/tcp_output.c:2694
 __tcp_push_pending_frames+0x98/0x228 net/ipv4/tcp_output.c:2878
 tcp_push+0x41c/0x648 net/ipv4/tcp.c:736
 tcp_sendmsg_locked+0x2a68/0x313c net/ipv4/tcp.c:1432
 tcp_sendmsg+0x40/0x64 net/ipv4/tcp.c:1462
 inet_sendmsg+0x15c/0x290 net/ipv4/af_inet.c:825
 sock_sendmsg_nosec net/socket.c:704 [inline]
 sock_sendmsg net/socket.c:724 [inline]
 sock_write_iter+0x2b0/0x3f8 net/socket.c:1060
 call_write_iter include/linux/fs.h:2103 [inline]
 new_sync_write fs/read_write.c:507 [inline]
 vfs_write+0x87c/0xb3c fs/read_write.c:594
 ksys_write+0x15c/0x26c fs/read_write.c:647
 __do_sys_write fs/read_write.c:659 [inline]
 __se_sys_write fs/read_write.c:656 [inline]
 __arm64_sys_write+0x7c/0x90 fs/read_write.c:656
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584

Freed by task 4114:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track+0x4c/0x84 mm/kasan/common.c:46
 kasan_set_free_info+0x28/0x4c mm/kasan/generic.c:360
 ____kasan_slab_free+0x118/0x164 mm/kasan/common.c:366
 __kasan_slab_free+0x18/0x28 mm/kasan/common.c:374
 kasan_slab_free include/linux/kasan.h:230 [inline]
 slab_free_hook mm/slub.c:1705 [inline]
 slab_free_freelist_hook+0x128/0x1ec mm/slub.c:1731
 slab_free mm/slub.c:3499 [inline]
 kmem_cache_free+0xdc/0x3c4 mm/slub.c:3515
 kfree_skbmem+0x114/0x1b0
 __kfree_skb net/core/skbuff.c:757 [inline]
 consume_skb+0x140/0x40c net/core/skbuff.c:914
 packet_rcv+0x114/0xf9c net/packet/af_packet.c:2192
 dev_queue_xmit_nit+0x83c/0x970 net/core/dev.c:2322
 xmit_one net/core/dev.c:3589 [inline]
 dev_hard_start_xmit+0x110/0x92c net/core/dev.c:3610
 sch_direct_xmit+0x2e0/0x484 net/sched/sch_generic.c:342
 __dev_xmit_skb net/core/dev.c:3821 [inline]
 __dev_queue_xmit+0x14b4/0x2a6c net/core/dev.c:4190
 dev_queue_xmit+0x24/0x34 net/core/dev.c:4258
 neigh_hh_output include/net/neighbour.h:493 [inline]
 neigh_output include/net/neighbour.h:507 [inline]
 ip_finish_output2+0xd50/0x1330 net/ipv4/ip_output.c:228
 __ip_finish_output+0x1b0/0x458
 ip_finish_output+0x40/0x218 net/ipv4/ip_output.c:316
 NF_HOOK_COND include/linux/netfilter.h:291 [inline]
 ip_output+0x330/0x49c net/ipv4/ip_output.c:430
 dst_output include/net/dst.h:443 [inline]
 ip_local_out net/ipv4/ip_output.c:126 [inline]
 __ip_queue_xmit+0xe70/0x1930 net/ipv4/ip_output.c:532
 ip_queue_xmit+0x5c/0x78 net/ipv4/ip_output.c:546
 __tcp_transmit_skb+0x1954/0x3218 net/ipv4/tcp_output.c:1403
 tcp_transmit_skb net/ipv4/tcp_output.c:1421 [inline]
 tcp_write_xmit+0x12bc/0x4dc0 net/ipv4/tcp_output.c:2694
 __tcp_push_pending_frames+0x98/0x228 net/ipv4/tcp_output.c:2878
 tcp_push+0x41c/0x648 net/ipv4/tcp.c:736
 tcp_sendmsg_locked+0x2a68/0x313c net/ipv4/tcp.c:1432
 tcp_sendmsg+0x40/0x64 net/ipv4/tcp.c:1462
 inet_sendmsg+0x15c/0x290 net/ipv4/af_inet.c:825
 sock_sendmsg_nosec net/socket.c:704 [inline]
 sock_sendmsg net/socket.c:724 [inline]
 sock_write_iter+0x2b0/0x3f8 net/socket.c:1060
 call_write_iter include/linux/fs.h:2103 [inline]
 new_sync_write fs/read_write.c:507 [inline]
 vfs_write+0x87c/0xb3c fs/read_write.c:594
 ksys_write+0x15c/0x26c fs/read_write.c:647
 __do_sys_write fs/read_write.c:659 [inline]
 __se_sys_write fs/read_write.c:656 [inline]
 __arm64_sys_write+0x7c/0x90 fs/read_write.c:656
 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline]
 invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52
 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142
 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181
 el0_svc+0x7c/0x1f0 arch/arm64/kernel/entry-common.c:596
 el0t_64_sync_handler+0x84/0xe4 arch/arm64/kernel/entry-common.c:614
 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584

The buggy address belongs to the object at ffff0000d3f75640
 which belongs to the cache skbuff_head_cache of size 232
The buggy address is located 121 bytes inside of
 232-byte region [ffff0000d3f75640, ffff0000d3f75728)
The buggy address belongs to the page:
page:0000000041b756b0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x113f75
flags: 0x5ffc00000000200(slab|node=0|zone=2|lastcpupid=0x7ff)
raw: 05ffc00000000200 dead000000000100 dead000000000122 ffff0000c0854000
raw: 0000000000000000 00000000000c000c 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000d3f75580: fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc
 ffff0000d3f75600: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb
>ffff0000d3f75680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                        ^
 ffff0000d3f75700: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc
 ffff0000d3f75780: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================