================================================================== BUG: KASAN: slab-out-of-bounds in decode_session6 net/xfrm/xfrm_policy.c:3393 [inline] BUG: KASAN: slab-out-of-bounds in __xfrm_decode_session+0x1cfb/0x2e90 net/xfrm/xfrm_policy.c:3485 Read of size 1 at addr ffff88808f0d2f0d by task syz-executor.3/21442 CPU: 1 PID: 21442 Comm: syz-executor.3 Not tainted 5.6.0-rc5-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x188/0x20d lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xd3/0x315 mm/kasan/report.c:374 __kasan_report.cold+0x1a/0x32 mm/kasan/report.c:506 kasan_report+0xe/0x20 mm/kasan/common.c:641 decode_session6 net/xfrm/xfrm_policy.c:3393 [inline] __xfrm_decode_session+0x1cfb/0x2e90 net/xfrm/xfrm_policy.c:3485 xfrm_decode_session include/net/xfrm.h:1138 [inline] vti_tunnel_xmit+0x258/0x1790 net/ipv4/ip_vti.c:278 __netdev_start_xmit include/linux/netdevice.h:4523 [inline] netdev_start_xmit include/linux/netdevice.h:4537 [inline] xmit_one net/core/dev.c:3477 [inline] dev_hard_start_xmit+0x1a4/0x9b0 net/core/dev.c:3493 sch_direct_xmit+0x345/0xc20 net/sched/sch_generic.c:313 qdisc_restart net/sched/sch_generic.c:376 [inline] __qdisc_run+0x4d1/0x17b0 net/sched/sch_generic.c:384 __dev_xmit_skb net/core/dev.c:3716 [inline] __dev_queue_xmit+0x165b/0x30a0 net/core/dev.c:4021 neigh_output include/net/neighbour.h:510 [inline] ip6_finish_output2+0x1091/0x25b0 net/ipv6/ip6_output.c:116 ip6_fragment+0x1479/0x2540 net/ipv6/ip6_output.c:919 __ip6_finish_output+0x573/0xab0 net/ipv6/ip6_output.c:140 ip6_finish_output+0x34/0x1f0 net/ipv6/ip6_output.c:152 NF_HOOK_COND include/linux/netfilter.h:296 [inline] ip6_output+0x239/0x810 net/ipv6/ip6_output.c:175 dst_output include/net/dst.h:436 [inline] NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ip6_xmit+0xe1a/0x2090 net/ipv6/ip6_output.c:279 sctp_v6_xmit+0x33b/0x690 net/sctp/ipv6.c:217 sctp_packet_transmit+0x1a05/0x3490 net/sctp/output.c:629 sctp_packet_singleton net/sctp/outqueue.c:773 [inline] sctp_outq_flush_ctrl.constprop.0+0x6ca/0xc40 net/sctp/outqueue.c:904 sctp_outq_flush+0xf8/0x2340 net/sctp/outqueue.c:1186 sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1793 [inline] sctp_side_effects net/sctp/sm_sideeffect.c:1185 [inline] sctp_do_sm+0x4cb/0x4ed0 net/sctp/sm_sideeffect.c:1156 sctp_primitive_ASSOCIATE+0x98/0xc0 net/sctp/primitive.c:73 __sctp_connect+0xa0e/0xc70 net/sctp/socket.c:1212 sctp_connect net/sctp/socket.c:4893 [inline] sctp_inet_connect+0x14b/0x1b0 net/sctp/socket.c:4908 __sys_connect_file+0x14f/0x190 net/socket.c:1857 __sys_connect+0x160/0x190 net/socket.c:1874 __do_sys_connect net/socket.c:1885 [inline] __se_sys_connect net/socket.c:1882 [inline] __ia32_sys_connect+0x6e/0xb0 net/socket.c:1882 do_syscall_32_irqs_on arch/x86/entry/common.c:337 [inline] do_fast_syscall_32+0x270/0xe8f arch/x86/entry/common.c:408 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139 Allocated by task 21442: save_stack+0x1b/0x80 mm/kasan/common.c:72 set_track mm/kasan/common.c:80 [inline] __kasan_kmalloc mm/kasan/common.c:515 [inline] __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:488 __kmalloc_reserve.isra.0+0x39/0xe0 net/core/skbuff.c:142 __alloc_skb+0xef/0x5a0 net/core/skbuff.c:210 alloc_skb include/linux/skbuff.h:1081 [inline] ip6_frag_next+0x16a/0xb40 net/ipv6/ip6_output.c:703 ip6_fragment+0x1425/0x2540 net/ipv6/ip6_output.c:909 __ip6_finish_output+0x573/0xab0 net/ipv6/ip6_output.c:140 ip6_finish_output+0x34/0x1f0 net/ipv6/ip6_output.c:152 NF_HOOK_COND include/linux/netfilter.h:296 [inline] ip6_output+0x239/0x810 net/ipv6/ip6_output.c:175 dst_output include/net/dst.h:436 [inline] NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ip6_xmit+0xe1a/0x2090 net/ipv6/ip6_output.c:279 sctp_v6_xmit+0x33b/0x690 net/sctp/ipv6.c:217 sctp_packet_transmit+0x1a05/0x3490 net/sctp/output.c:629 sctp_packet_singleton net/sctp/outqueue.c:773 [inline] sctp_outq_flush_ctrl.constprop.0+0x6ca/0xc40 net/sctp/outqueue.c:904 sctp_outq_flush+0xf8/0x2340 net/sctp/outqueue.c:1186 sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1793 [inline] sctp_side_effects net/sctp/sm_sideeffect.c:1185 [inline] sctp_do_sm+0x4cb/0x4ed0 net/sctp/sm_sideeffect.c:1156 sctp_primitive_ASSOCIATE+0x98/0xc0 net/sctp/primitive.c:73 __sctp_connect+0xa0e/0xc70 net/sctp/socket.c:1212 sctp_connect net/sctp/socket.c:4893 [inline] sctp_inet_connect+0x14b/0x1b0 net/sctp/socket.c:4908 __sys_connect_file+0x14f/0x190 net/socket.c:1857 __sys_connect+0x160/0x190 net/socket.c:1874 __do_sys_connect net/socket.c:1885 [inline] __se_sys_connect net/socket.c:1882 [inline] __ia32_sys_connect+0x6e/0xb0 net/socket.c:1882 do_syscall_32_irqs_on arch/x86/entry/common.c:337 [inline] do_fast_syscall_32+0x270/0xe8f arch/x86/entry/common.c:408 entry_SYSENTER_compat+0x70/0x7f arch/x86/entry/entry_64_compat.S:139 Freed by task 0: (stack is not available) The buggy address belongs to the object at ffff88808f0d2000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 1805 bytes to the right of 2048-byte region [ffff88808f0d2000, ffff88808f0d2800) The buggy address belongs to the page: page:ffffea00023c3480 refcount:1 mapcount:0 mapping:ffff8880aa000e00 index:0x0 flags: 0xfffe0000000200(slab) raw: 00fffe0000000200 ffffea00021f0988 ffffea0002370d48 ffff8880aa000e00 raw: 0000000000000000 ffff88808f0d2000 0000000100000001 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88808f0d2e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88808f0d2e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88808f0d2f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff88808f0d2f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88808f0d3000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================