================================================================== BUG: KASAN: slab-out-of-bounds in __xfrm6_tunnel_alloc_spi net/ipv6/xfrm6_tunnel.c:124 [inline] BUG: KASAN: slab-out-of-bounds in xfrm6_tunnel_alloc_spi+0x779/0x8a0 net/ipv6/xfrm6_tunnel.c:174 Read of size 4 at addr ffff88809a0f0000 by task syz-executor548/6859 CPU: 0 PID: 6859 Comm: syz-executor548 Not tainted 5.8.0-rc5-next-20200716-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x18f/0x20d lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xae/0x497 mm/kasan/report.c:383 __kasan_report mm/kasan/report.c:513 [inline] kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530 __xfrm6_tunnel_alloc_spi net/ipv6/xfrm6_tunnel.c:124 [inline] xfrm6_tunnel_alloc_spi+0x779/0x8a0 net/ipv6/xfrm6_tunnel.c:174 ipcomp6_tunnel_create net/ipv6/ipcomp6.c:84 [inline] ipcomp6_tunnel_attach net/ipv6/ipcomp6.c:124 [inline] ipcomp6_init_state net/ipv6/ipcomp6.c:159 [inline] ipcomp6_init_state+0x2af/0x700 net/ipv6/ipcomp6.c:139 __xfrm_init_state+0x9a6/0x14b0 net/xfrm/xfrm_state.c:2498 xfrm_state_construct net/xfrm/xfrm_user.c:627 [inline] xfrm_add_sa+0x1db9/0x34f0 net/xfrm/xfrm_user.c:684 xfrm_user_rcv_msg+0x414/0x700 net/xfrm/xfrm_user.c:2684 netlink_rcv_skb+0x15a/0x430 net/netlink/af_netlink.c:2469 xfrm_netlink_rcv+0x6b/0x90 net/xfrm/xfrm_user.c:2692 netlink_unicast_kernel net/netlink/af_netlink.c:1303 [inline] netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1329 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1918 sock_sendmsg_nosec net/socket.c:651 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:671 ____sys_sendmsg+0x6e8/0x810 net/socket.c:2362 ___sys_sendmsg+0xf3/0x170 net/socket.c:2416 __sys_sendmsg+0xe5/0x1b0 net/socket.c:2449 do_syscall_64+0x60/0xe0 arch/x86/entry/common.c:384 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x440589 Code: Bad RIP value. RSP: 002b:00007fffac3b0bc8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 00000000004002c8 RCX: 0000000000440589 RDX: 0000000000000000 RSI: 0000000020000180 RDI: 0000000000000003 RBP: 00000000006ca018 R08: 0000000000000000 R09: 00000000004002c8 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000401d90 R13: 0000000000401e20 R14: 0000000000000000 R15: 0000000000000000 Allocated by task 1: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48 kasan_set_track mm/kasan/common.c:56 [inline] __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:461 slab_post_alloc_hook mm/slab.h:535 [inline] slab_alloc mm/slab.c:3312 [inline] kmem_cache_alloc+0x138/0x3a0 mm/slab.c:3482 kmem_cache_zalloc include/linux/slab.h:656 [inline] __alloc_file+0x21/0x350 fs/file_table.c:101 alloc_empty_file+0x6d/0x170 fs/file_table.c:151 path_openat+0xe3/0x2720 fs/namei.c:3352 do_filp_open+0x17e/0x3c0 fs/namei.c:3393 do_sys_openat2+0x16d/0x3e0 fs/open.c:1173 do_sys_open fs/open.c:1189 [inline] ksys_open include/linux/syscalls.h:1398 [inline] __do_sys_open fs/open.c:1195 [inline] __se_sys_open fs/open.c:1193 [inline] __x64_sys_open+0x119/0x1c0 fs/open.c:1193 do_syscall_64+0x60/0xe0 arch/x86/entry/common.c:384 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Freed by task 16: kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48 kasan_set_track+0x1c/0x30 mm/kasan/common.c:56 kasan_set_free_info+0x1b/0x30 mm/kasan/generic.c:355 __kasan_slab_free+0xd8/0x120 mm/kasan/common.c:422 __cache_free mm/slab.c:3418 [inline] kmem_cache_free.part.0+0x67/0x1f0 mm/slab.c:3693 rcu_do_batch kernel/rcu/tree.c:2418 [inline] rcu_core+0x5dc/0x11d0 kernel/rcu/tree.c:2645 __do_softirq+0x34c/0xa60 kernel/softirq.c:292 Last call_rcu(): kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48 kasan_record_aux_stack+0x82/0xb0 mm/kasan/generic.c:346 __call_rcu kernel/rcu/tree.c:2883 [inline] call_rcu+0x14f/0x7e0 kernel/rcu/tree.c:2957 task_work_run+0xdd/0x190 kernel/task_work.c:135 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_usermode_loop arch/x86/entry/common.c:239 [inline] __prepare_exit_to_usermode+0x1e0/0x1f0 arch/x86/entry/common.c:269 do_syscall_64+0x6c/0xe0 arch/x86/entry/common.c:393 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Second to last call_rcu(): kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48 kasan_record_aux_stack+0x82/0xb0 mm/kasan/generic.c:346 __call_rcu kernel/rcu/tree.c:2883 [inline] call_rcu+0x14f/0x7e0 kernel/rcu/tree.c:2957 task_work_run+0xdd/0x190 kernel/task_work.c:135 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_usermode_loop arch/x86/entry/common.c:239 [inline] __prepare_exit_to_usermode+0x1e0/0x1f0 arch/x86/entry/common.c:269 do_syscall_64+0x6c/0xe0 arch/x86/entry/common.c:393 entry_SYSCALL_64_after_hwframe+0x44/0xa9 The buggy address belongs to the object at ffff88809a0f00c0 which belongs to the cache filp of size 488 The buggy address is located 192 bytes to the left of 488-byte region [ffff88809a0f00c0, ffff88809a0f02a8) The buggy address belongs to the page: page:00000000d795ace4 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x9a0f0 flags: 0xfffe0000000200(slab) raw: 00fffe0000000200 ffffea00029cbfc8 ffffea00024090c8 ffff8880aa203d00 raw: 0000000000000000 ffff88809a0f00c0 0000000100000006 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88809a0eff00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88809a0eff80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88809a0f0000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff88809a0f0080: fc fc fc fc fc fc fc fc fa fb fb fb fb fb fb fb ffff88809a0f0100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================