================================================================== BUG: KASAN: global-out-of-bounds in memcmp+0x2a/0x6c lib/string.c:692 Read of size 1 at addr ffffffff85e0a860 by task syz-executor.0/14397 CPU: 1 PID: 14397 Comm: syz-executor.0 Not tainted 6.5.0-rc1-syzkaller-00018-g7e3811521dc3 #0 Hardware name: riscv-virtio,qemu (DT) Call Trace: [<ffffffff8000b6c6>] dump_backtrace+0x2e/0x3c arch/riscv/kernel/stacktrace.c:121 [<ffffffff8354e08e>] show_stack+0x34/0x40 arch/riscv/kernel/stacktrace.c:127 [<ffffffff8358dc56>] __dump_stack lib/dump_stack.c:88 [inline] [<ffffffff8358dc56>] dump_stack_lvl+0xe8/0x154 lib/dump_stack.c:106 [<ffffffff83555204>] print_address_description mm/kasan/report.c:364 [inline] [<ffffffff83555204>] print_report+0x1e4/0x4f4 mm/kasan/report.c:475 [<ffffffff8055cb62>] kasan_report+0xf0/0x1b8 mm/kasan/report.c:588 [<ffffffff8055d9d2>] check_region_inline mm/kasan/generic.c:181 [inline] [<ffffffff8055d9d2>] __asan_load1+0x68/0x80 mm/kasan/generic.c:257 [<ffffffff83534a7a>] memcmp+0x2a/0x6c lib/string.c:692 [<ffffffff82a500ac>] __hw_addr_add_ex+0xce/0x3f6 net/core/dev_addr_lists.c:88 [<ffffffff82a52032>] __dev_mc_add net/core/dev_addr_lists.c:867 [inline] [<ffffffff82a52032>] dev_mc_add+0x7c/0xc4 net/core/dev_addr_lists.c:885 [<ffffffff82b3b1a8>] mrp_init_applicant+0xc4/0x3c0 net/802/mrp.c:872 [<ffffffff832841c4>] vlan_mvrp_init_applicant+0x26/0x30 net/8021q/vlan_mvrp.c:57 [<ffffffff8327e196>] register_vlan_dev+0x142/0x59c net/8021q/vlan.c:170 [<ffffffff8327ea1a>] register_vlan_device net/8021q/vlan.c:277 [inline] [<ffffffff8327ea1a>] vlan_ioctl_handler+0x42a/0x712 net/8021q/vlan.c:621 [<ffffffff829d14a6>] sock_ioctl+0x1aa/0x66c net/socket.c:1271 [<ffffffff805f3e5a>] vfs_ioctl fs/ioctl.c:51 [inline] [<ffffffff805f3e5a>] __do_sys_ioctl fs/ioctl.c:870 [inline] [<ffffffff805f3e5a>] sys_ioctl+0x114/0x14e fs/ioctl.c:856 [<ffffffff8000a6c0>] syscall_handler+0xfa/0x148 arch/riscv/include/asm/syscall.h:90 [<ffffffff8358f018>] do_trap_ecall_u+0x96/0x98 arch/riscv/kernel/traps.c:310 [<ffffffff80005b78>] ret_from_exception+0x0/0x64 arch/riscv/kernel/entry.S:102 The buggy address belongs to the variable: vlan_mrp_app+0x60/0x2060 The buggy address belongs to the physical page: page:ff1c000002180280 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x8600a flags: 0xffe000000001000(reserved|node=0|zone=0|lastcpupid=0x7ff) page_type: 0xffffffff() raw: 0ffe000000001000 ff1c000002180288 ff1c000002180288 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner info is not present (never set?) Memory state around the buggy address: ffffffff85e0a700: 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9 ffffffff85e0a780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffffff85e0a800: 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9 ^ ffffffff85e0a880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffffffff85e0a900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================