================================================================== BUG: KASAN: invalid-access in tomoyo_memory_ok+0x1c/0xb0 security/tomoyo/memory.c:50 Read of size 1 at addr f8ff00007b65e000 by task ln/3074 Pointer tag: [f8], memory tag: [f0] CPU: 1 PID: 3074 Comm: ln Not tainted 5.12.0-rc3-syzkaller-00003-g1a4431a5db2b #0 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x0/0x1b0 arch/arm64/kernel/stacktrace.c:112 show_stack+0x18/0x70 arch/arm64/kernel/stacktrace.c:191 __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0xd0/0x12c lib/dump_stack.c:120 print_address_description+0x70/0x29c mm/kasan/report.c:232 __kasan_report mm/kasan/report.c:399 [inline] kasan_report+0x134/0x380 mm/kasan/report.c:416 __kasan_check_byte+0x60/0x70 mm/kasan/common.c:580 kasan_check_byte include/linux/kasan.h:265 [inline] ksize+0x90/0xcc mm/slab_common.c:1250 tomoyo_memory_ok+0x1c/0xb0 security/tomoyo/memory.c:50 tomoyo_commit_ok+0x30/0x94 security/tomoyo/memory.c:78 tomoyo_update_domain+0xb8/0x200 security/tomoyo/domain.c:139 tomoyo_update_path_acl security/tomoyo/file.c:398 [inline] tomoyo_write_file+0x210/0x460 security/tomoyo/file.c:1022 tomoyo_write_domain2+0x6c/0xc0 security/tomoyo/common.c:1152 tomoyo_add_entry security/tomoyo/common.c:2042 [inline] tomoyo_supervisor+0x4a8/0x640 security/tomoyo/common.c:2103 tomoyo_audit_path_log security/tomoyo/file.c:168 [inline] tomoyo_path_permission security/tomoyo/file.c:587 [inline] tomoyo_path_permission+0x9c/0xdc security/tomoyo/file.c:573 tomoyo_path_perm+0x190/0x1d0 security/tomoyo/file.c:838 tomoyo_path_symlink+0x34/0x60 security/tomoyo/tomoyo.c:200 security_path_symlink+0x54/0x90 security/security.c:1119 do_symlinkat+0x88/0x150 fs/namei.c:4201 __do_sys_symlinkat fs/namei.c:4222 [inline] __se_sys_symlinkat fs/namei.c:4219 [inline] __arm64_sys_symlinkat+0x24/0x30 fs/namei.c:4219 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline] invoke_syscall arch/arm64/kernel/syscall.c:49 [inline] el0_svc_common.constprop.0+0x60/0x120 arch/arm64/kernel/syscall.c:129 do_el0_svc+0x74/0x90 arch/arm64/kernel/syscall.c:168 el0_svc+0x2c/0x54 arch/arm64/kernel/entry-common.c:416 el0_sync_handler+0x1a4/0x1b0 arch/arm64/kernel/entry-common.c:432 el0_sync+0x18c/0x1c0 arch/arm64/kernel/entry.S:699 Allocated by task 2846403498: ------------[ cut here ]------------ slab index 831406 out of bounds (201) for stack id adacafae WARNING: CPU: 1 PID: 3074 at lib/stackdepot.c:236 stack_depot_fetch+0x68/0x84 lib/stackdepot.c:236 Modules linked in: CPU: 1 PID: 3074 Comm: ln Not tainted 5.12.0-rc3-syzkaller-00003-g1a4431a5db2b #0 Hardware name: linux,dummy-virt (DT) pstate: 60400089 (nZCv daIf +PAN -UAO -TCO BTYPE=--) pc : stack_depot_fetch+0x68/0x84 lib/stackdepot.c:236 lr : stack_depot_fetch+0x68/0x84 lib/stackdepot.c:236 sp : ffff800015f6b760 x29: ffff800015f6b760 x28: ffff8000127d02e0 x27: 0000000000000000 x26: 0000000000000000 x25: 0000000000000030 x24: fcff000003001200 x23: 00000000000000f8 x22: ffff800011d11c38 x21: 00ff00007b65e000 x20: ffff00007b65e000 x19: ffff00007b65e080 x18: 00000000fffffffb x17: 0000000000000000 x16: 0000000000000000 x15: 0000000000000020 x14: ffffffffffffffff x13: 00000000000002e9 x12: ffff800015f6b410 x11: ffff80001278be70 x10: 00000000ffffe000 x9 : ffff80001278be70 x8 : ffff8000126dbe70 x7 : ffff80001278be70 x6 : 0000000000000000 x5 : 0000000000000000 x4 : 0000000000015ff5 x3 : 00000000ffffffff x2 : 0000000000000000 x1 : 0000000000000000 x0 : f2ff0000033f6ac0 Call trace: stack_depot_fetch+0x68/0x84 lib/stackdepot.c:236 print_stack mm/kasan/report.c:116 [inline] print_track+0x34/0x64 mm/kasan/report.c:124 describe_object_stacks mm/kasan/report.c:178 [inline] describe_object mm/kasan/report.c:208 [inline] print_address_description+0x14c/0x29c mm/kasan/report.c:239 __kasan_report mm/kasan/report.c:399 [inline] kasan_report+0x134/0x380 mm/kasan/report.c:416 __kasan_check_byte+0x60/0x70 mm/kasan/common.c:580 kasan_check_byte include/linux/kasan.h:265 [inline] ksize+0x90/0xcc mm/slab_common.c:1250 tomoyo_memory_ok+0x1c/0xb0 security/tomoyo/memory.c:50 tomoyo_commit_ok+0x30/0x94 security/tomoyo/memory.c:78 tomoyo_update_domain+0xb8/0x200 security/tomoyo/domain.c:139 tomoyo_update_path_acl security/tomoyo/file.c:398 [inline] tomoyo_write_file+0x210/0x460 security/tomoyo/file.c:1022 tomoyo_write_domain2+0x6c/0xc0 security/tomoyo/common.c:1152 tomoyo_add_entry security/tomoyo/common.c:2042 [inline] tomoyo_supervisor+0x4a8/0x640 security/tomoyo/common.c:2103 tomoyo_audit_path_log security/tomoyo/file.c:168 [inline] tomoyo_path_permission security/tomoyo/file.c:587 [inline] tomoyo_path_permission+0x9c/0xdc security/tomoyo/file.c:573 tomoyo_path_perm+0x190/0x1d0 security/tomoyo/file.c:838 tomoyo_path_symlink+0x34/0x60 security/tomoyo/tomoyo.c:200 security_path_symlink+0x54/0x90 security/security.c:1119 do_symlinkat+0x88/0x150 fs/namei.c:4201 __do_sys_symlinkat fs/namei.c:4222 [inline] __se_sys_symlinkat fs/namei.c:4219 [inline] __arm64_sys_symlinkat+0x24/0x30 fs/namei.c:4219 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline] invoke_syscall arch/arm64/kernel/syscall.c:49 [inline] el0_svc_common.constprop.0+0x60/0x120 arch/arm64/kernel/syscall.c:129 do_el0_svc+0x74/0x90 arch/arm64/kernel/syscall.c:168 el0_svc+0x2c/0x54 arch/arm64/kernel/entry-common.c:416 el0_sync_handler+0x1a4/0x1b0 arch/arm64/kernel/entry-common.c:432 el0_sync+0x18c/0x1c0 arch/arm64/kernel/entry.S:699