==================================================================
BUG: KASAN: stack-out-of-bounds in memcmp+0xe3/0x160 lib/string.c:768 at addr ffff8801cc4478c0
Read of size 1 by task syz-executor7/7329
page:ffffea00073111c0 count:0 mapcount:0 mapping:          (null) index:0x0
flags: 0x8000000000000000()
page dumped because: kasan: bad access detected
CPU: 1 PID: 7329 Comm: syz-executor7 Not tainted 4.9.40-ged32335 #11
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801cc4473d0 ffffffff81d8d829 ffffed0039888f18 0000000000000001
 0000000000000000 ffffed0039888f18 ffff8801cc4478c0 ffff8801cc447458
 ffffffff81537fa3 ffff8801cfd95e00 ffff8801cfd96680 ffffffff81dab5c3
Call Trace:
 [<ffffffff81d8d829>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d8d829>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81537fa3>] print_address_description mm/kasan/report.c:208 [inline]
 [<ffffffff81537fa3>] kasan_report_error mm/kasan/report.c:287 [inline]
 [<ffffffff81537fa3>] kasan_report.part.1+0x4c3/0x500 mm/kasan/report.c:309
 [<ffffffff81538009>] kasan_report mm/kasan/report.c:327 [inline]
 [<ffffffff81538009>] __asan_report_load1_noabort+0x29/0x30 mm/kasan/report.c:327
 [<ffffffff81dab5c3>] memcmp+0xe3/0x160 lib/string.c:768
 [<ffffffff833b0537>] addr_match include/net/xfrm.h:830 [inline]
 [<ffffffff833b0537>] __xfrm6_selector_match net/xfrm/xfrm_policy.c:87 [inline]
 [<ffffffff833b0537>] xfrm_selector_match+0x1c7/0xe40 net/xfrm/xfrm_policy.c:101
 [<ffffffff833b12c3>] xfrm_sk_policy_lookup+0x113/0x390 net/xfrm/xfrm_policy.c:1259
 [<ffffffff833b37c3>] xfrm_lookup+0x1b3/0xc00 net/xfrm/xfrm_policy.c:2209
 [<ffffffff833b5109>] xfrm_lookup_route+0x39/0x1a0 net/xfrm/xfrm_policy.c:2343
 [<ffffffff831cfd7f>] ip_route_output_flow+0x7f/0xa0 net/ipv4/route.c:2430
 [<ffffffff832ac8a6>] udp_sendmsg+0xe36/0x1c10 net/ipv4/udp.c:1026
 [<ffffffff83479108>] udpv6_sendmsg+0x588/0x2390 net/ipv6/udp.c:1085
 [<ffffffff832dfaac>] inet_sendmsg+0x2bc/0x4c0 net/ipv4/af_inet.c:753
 [<ffffffff82ec5b9a>] sock_sendmsg_nosec net/socket.c:635 [inline]
 [<ffffffff82ec5b9a>] sock_sendmsg+0xca/0x110 net/socket.c:645
 [<ffffffff82ec6af8>] SYSC_sendto+0x2c8/0x340 net/socket.c:1670
 [<ffffffff82ec8fa0>] SyS_sendto+0x40/0x50 net/socket.c:1638
 [<ffffffff838a06c5>] entry_SYSCALL_64_fastpath+0x23/0xc6
Memory state around the buggy address:
 ffff8801cc447780: 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1
 ffff8801cc447800: f1 00 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 f2 f2 f2
>ffff8801cc447880: f2 00 00 00 00 00 00 00 f2 f2 f2 f2 f2 00 00 00
                                           ^
 ffff8801cc447900: 00 00 00 00 00 00 f2 f2 f2 00 00 00 00 00 00 00
 ffff8801cc447980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
==================================================================
BUG: KASAN: stack-out-of-bounds in memcmp+0x126/0x160 lib/string.c:768 at addr ffff8801cc4478c1
Read of size 1 by task syz-executor7/7329
page:ffffea00073111c0 count:0 mapcount:0 mapping:          (null) index:0x0
flags: 0x8000000000000000()
page dumped because: kasan: bad access detected
CPU: 1 PID: 7329 Comm: syz-executor7 Tainted: G    B           4.9.40-ged32335 #11
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801cc4473d0 ffffffff81d8d829 ffffed0039888f18 0000000000000001
 0000000000000000 ffffed0039888f18 ffff8801cc4478c1 ffff8801cc447458
 ffffffff81537fa3 0000000000000010 ffff880100000000 ffffffff81dab606
Call Trace:
 [<ffffffff81d8d829>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d8d829>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81537fa3>] print_address_description mm/kasan/report.c:208 [inline]
 [<ffffffff81537fa3>] kasan_report_error mm/kasan/report.c:287 [inline]
 [<ffffffff81537fa3>] kasan_report.part.1+0x4c3/0x500 mm/kasan/report.c:309
 [<ffffffff81538009>] kasan_report mm/kasan/report.c:327 [inline]
 [<ffffffff81538009>] __asan_report_load1_noabort+0x29/0x30 mm/kasan/report.c:327
 [<ffffffff81dab606>] memcmp+0x126/0x160 lib/string.c:768
 [<ffffffff833b0537>] addr_match include/net/xfrm.h:830 [inline]
 [<ffffffff833b0537>] __xfrm6_selector_match net/xfrm/xfrm_policy.c:87 [inline]
 [<ffffffff833b0537>] xfrm_selector_match+0x1c7/0xe40 net/xfrm/xfrm_policy.c:101
 [<ffffffff833b12c3>] xfrm_sk_policy_lookup+0x113/0x390 net/xfrm/xfrm_policy.c:1259
 [<ffffffff833b37c3>] xfrm_lookup+0x1b3/0xc00 net/xfrm/xfrm_policy.c:2209
 [<ffffffff833b5109>] xfrm_lookup_route+0x39/0x1a0 net/xfrm/xfrm_policy.c:2343
 [<ffffffff831cfd7f>] ip_route_output_flow+0x7f/0xa0 net/ipv4/route.c:2430
 [<ffffffff832ac8a6>] udp_sendmsg+0xe36/0x1c10 net/ipv4/udp.c:1026
 [<ffffffff83479108>] udpv6_sendmsg+0x588/0x2390 net/ipv6/udp.c:1085
 [<ffffffff832dfaac>] inet_sendmsg+0x2bc/0x4c0 net/ipv4/af_inet.c:753
 [<ffffffff82ec5b9a>] sock_sendmsg_nosec net/socket.c:635 [inline]
 [<ffffffff82ec5b9a>] sock_sendmsg+0xca/0x110 net/socket.c:645
 [<ffffffff82ec6af8>] SYSC_sendto+0x2c8/0x340 net/socket.c:1670
 [<ffffffff82ec8fa0>] SyS_sendto+0x40/0x50 net/socket.c:1638
 [<ffffffff838a06c5>] entry_SYSCALL_64_fastpath+0x23/0xc6
Memory state around the buggy address:
 ffff8801cc447780: 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1
 ffff8801cc447800: f1 00 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 f2 f2 f2
>ffff8801cc447880: f2 00 00 00 00 00 00 00 f2 f2 f2 f2 f2 00 00 00
                                           ^
 ffff8801cc447900: 00 00 00 00 00 00 f2 f2 f2 00 00 00 00 00 00 00
 ffff8801cc447980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
==================================================================
BUG: KASAN: stack-out-of-bounds in memcmp+0xe3/0x160 lib/string.c:768 at addr ffff8801d048f8c0
Read of size 1 by task syz-executor7/7378
page:ffffea00074123c0 count:0 mapcount:0 mapping:          (null) index:0x0
flags: 0x8000000000000000()
page dumped because: kasan: bad access detected
CPU: 1 PID: 7378 Comm: syz-executor7 Tainted: G    B           4.9.40-ged32335 #11
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801d048f3d0 ffffffff81d8d829 ffffed003a091f18 0000000000000001
 0000000000000000 ffffed003a091f18 ffff8801d048f8c0 ffff8801d048f458
 ffffffff81537fa3 0000000000000000 0000000000000000 ffffffff81dab5c3
Call Trace:
 [<ffffffff81d8d829>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d8d829>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81537fa3>] print_address_description mm/kasan/report.c:208 [inline]
 [<ffffffff81537fa3>] kasan_report_error mm/kasan/report.c:287 [inline]
 [<ffffffff81537fa3>] kasan_report.part.1+0x4c3/0x500 mm/kasan/report.c:309
 [<ffffffff81538009>] kasan_report mm/kasan/report.c:327 [inline]
 [<ffffffff81538009>] __asan_report_load1_noabort+0x29/0x30 mm/kasan/report.c:327
 [<ffffffff81dab5c3>] memcmp+0xe3/0x160 lib/string.c:768
 [<ffffffff833b0537>] addr_match include/net/xfrm.h:830 [inline]
 [<ffffffff833b0537>] __xfrm6_selector_match net/xfrm/xfrm_policy.c:87 [inline]
 [<ffffffff833b0537>] xfrm_selector_match+0x1c7/0xe40 net/xfrm/xfrm_policy.c:101
 [<ffffffff833b12c3>] xfrm_sk_policy_lookup+0x113/0x390 net/xfrm/xfrm_policy.c:1259
 [<ffffffff833b37c3>] xfrm_lookup+0x1b3/0xc00 net/xfrm/xfrm_policy.c:2209
 [<ffffffff833b5109>] xfrm_lookup_route+0x39/0x1a0 net/xfrm/xfrm_policy.c:2343
 [<ffffffff831cfd7f>] ip_route_output_flow+0x7f/0xa0 net/ipv4/route.c:2430
 [<ffffffff832ac8a6>] udp_sendmsg+0xe36/0x1c10 net/ipv4/udp.c:1026
 [<ffffffff83479108>] udpv6_sendmsg+0x588/0x2390 net/ipv6/udp.c:1085
 [<ffffffff832dfaac>] inet_sendmsg+0x2bc/0x4c0 net/ipv4/af_inet.c:753
 [<ffffffff82ec5b9a>] sock_sendmsg_nosec net/socket.c:635 [inline]
 [<ffffffff82ec5b9a>] sock_sendmsg+0xca/0x110 net/socket.c:645
 [<ffffffff82ec6af8>] SYSC_sendto+0x2c8/0x340 net/socket.c:1670
 [<ffffffff82ec8fa0>] SyS_sendto+0x40/0x50 net/socket.c:1638
 [<ffffffff838a06c5>] entry_SYSCALL_64_fastpath+0x23/0xc6
Memory state around the buggy address:
 ffff8801d048f780: 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1
 ffff8801d048f800: f1 00 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 f2 f2 f2
>ffff8801d048f880: f2 00 00 00 00 00 00 00 f2 f2 f2 f2 f2 00 00 00
                                           ^
 ffff8801d048f900: 00 00 00 00 00 00 f2 f2 f2 00 00 00 00 00 00 00
 ffff8801d048f980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=7961 comm=syz-executor6
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=7961 comm=syz-executor6
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=7961 comm=syz-executor6
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=7961 comm=syz-executor6
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=7982 comm=syz-executor6
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=7982 comm=syz-executor6
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=7982 comm=syz-executor6
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pig=7982 comm=syz-executor6
binder: 8512:8519 ioctl 5608 0 returned -22
binder: 8512:8519 ioctl 4b48 20000ffc returned -22
binder: 8512:8519 ioctl 540f 20000000 returned -22
binder: 8512:8519 ioctl 5608 0 returned -22
binder: 8512:8555 ioctl 4b48 20000ffc returned -22
binder: 8512:8561 ioctl 540f 20000000 returned -22
binder: 8759:8763 ioctl 5603 20003ffa returned -22
binder: 8759:8763 ioctl 5603 20003ffa returned -22
binder: 9399:9405 ioctl c08c5334 2040bf74 returned -22
selinux_nlmsg_perm: 24 callbacks suppressed
SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pig=9444 comm=syz-executor6
SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pig=9467 comm=syz-executor6
SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pig=9467 comm=syz-executor6
SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pig=9467 comm=syz-executor6
SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pig=9467 comm=syz-executor6
SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pig=9467 comm=syz-executor6
SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pig=9467 comm=syz-executor6
SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pig=9467 comm=syz-executor6
SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pig=9467 comm=syz-executor6
SELinux: unrecognized netlink message: protocol=6 nlmsg_type=0 sclass=netlink_xfrm_socket pig=9467 comm=syz-executor6
binder: 9481:9492 ioctl 5414 20ec8000 returned -22
binder: 9481:9520 ioctl 5414 20ec8000 returned -22
binder: 10791:10794 ioctl 8906 20000000 returned -22
binder: 10791:10794 ioctl 8906 20000000 returned -22
nla_parse: 3 callbacks suppressed
netlink: 8 bytes leftover after parsing attributes in process `syz-executor0'.
netlink: 8 bytes leftover after parsing attributes in process `syz-executor0'.
mmap: syz-executor3 (13072): VmData 1896448 exceed data ulimit 0. Update limits or use boot option ignore_rlimit_data.