random: sshd: uninitialized urandom read (32 bytes read, 121 bits of entropy available)
random: sshd: uninitialized urandom read (32 bytes read, 125 bits of entropy available)
random: nonblocking pool is initialized
IPVS: Creating netns size=2552 id=1
==================================================================
BUG: KASAN: slab-out-of-bounds in pfkey_msg2xfrm_state net/key/af_key.c:1227 [inline]
BUG: KASAN: slab-out-of-bounds in pfkey_add+0x153f/0x3490 net/key/af_key.c:1506
Read of size 2368 at addr ffff8801d95582c0 by task syz-executor0/3795

CPU: 1 PID: 3795 Comm: syz-executor0 Not tainted 4.4.120-gd63fdf6 #29
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 0000000000000000 ec840d6936bc4a2f ffff8800a99176f8 ffffffff81d0408d
 ffffea0007655600 ffff8801d95582c0 0000000000000000 ffff8801d9558480
 ffff8800a9917938 ffff8800a9917730 ffffffff814fe143 ffff8801d95582c0
Call Trace:
 [<ffffffff81d0408d>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d0408d>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
 [<ffffffff814fe143>] print_address_description+0x73/0x260 mm/kasan/report.c:252
 [<ffffffff814fe655>] kasan_report_error mm/kasan/report.c:351 [inline]
 [<ffffffff814fe655>] kasan_report+0x285/0x370 mm/kasan/report.c:408
 [<ffffffff814fd097>] check_memory_region_inline mm/kasan/kasan.c:325 [inline]
 [<ffffffff814fd097>] check_memory_region+0x137/0x190 mm/kasan/kasan.c:332
 [<ffffffff814fd5d3>] memcpy+0x23/0x50 mm/kasan/kasan.c:367
 [<ffffffff83445d9f>] pfkey_msg2xfrm_state net/key/af_key.c:1227 [inline]
 [<ffffffff83445d9f>] pfkey_add+0x153f/0x3490 net/key/af_key.c:1506
 [<ffffffff8344a45b>] pfkey_process+0x68b/0x750 net/key/af_key.c:2834
 [<ffffffff8344bcb9>] pfkey_sendmsg+0x3a9/0x760 net/key/af_key.c:3678
 [<ffffffff82deba6a>] sock_sendmsg_nosec net/socket.c:625 [inline]
 [<ffffffff82deba6a>] sock_sendmsg+0xca/0x110 net/socket.c:635
 [<ffffffff82ded641>] ___sys_sendmsg+0x6c1/0x7c0 net/socket.c:1962
 [<ffffffff82def693>] __sys_sendmsg+0xd3/0x190 net/socket.c:1996
 [<ffffffff82eda56a>] C_SYSC_sendmsg net/compat.c:720 [inline]
 [<ffffffff82eda56a>] compat_SyS_sendmsg+0x2a/0x40 net/compat.c:718
 [<ffffffff81006d91>] do_syscall_32_irqs_on arch/x86/entry/common.c:392 [inline]
 [<ffffffff81006d91>] do_fast_syscall_32+0x321/0x8a0 arch/x86/entry/common.c:459
 [<ffffffff837752ea>] sysenter_flags_fixed+0xd/0x17

Allocated by task 3795:
 [<ffffffff81035d96>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63
 [<ffffffff814fd1b3>] save_stack+0x43/0xd0 mm/kasan/kasan.c:512
 [<ffffffff814fd47d>] set_track mm/kasan/kasan.c:524 [inline]
 [<ffffffff814fd47d>] kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:616
 [<ffffffff814fdc54>] kasan_krealloc+0x64/0x80 mm/kasan/kasan.c:654
 [<ffffffff814f6a52>] ksize+0x92/0xf0 mm/slub.c:3727
 [<ffffffff82e06b22>] __alloc_skb+0x132/0x600 net/core/skbuff.c:237
 [<ffffffff8344ba45>] alloc_skb include/linux/skbuff.h:815 [inline]
 [<ffffffff8344ba45>] pfkey_sendmsg+0x135/0x760 net/key/af_key.c:3665
 [<ffffffff82deba6a>] sock_sendmsg_nosec net/socket.c:625 [inline]
 [<ffffffff82deba6a>] sock_sendmsg+0xca/0x110 net/socket.c:635
 [<ffffffff82ded641>] ___sys_sendmsg+0x6c1/0x7c0 net/socket.c:1962
 [<ffffffff82def693>] __sys_sendmsg+0xd3/0x190 net/socket.c:1996
 [<ffffffff82eda56a>] C_SYSC_sendmsg net/compat.c:720 [inline]
 [<ffffffff82eda56a>] compat_SyS_sendmsg+0x2a/0x40 net/compat.c:718
 [<ffffffff81006d91>] do_syscall_32_irqs_on arch/x86/entry/common.c:392 [inline]
 [<ffffffff81006d91>] do_fast_syscall_32+0x321/0x8a0 arch/x86/entry/common.c:459
 [<ffffffff837752ea>] sysenter_flags_fixed+0xd/0x17

Freed by task 0:
(stack is not available)

The buggy address belongs to the object at ffff8801d9558280
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 64 bytes inside of
 512-byte region [ffff8801d9558280, ffff8801d9558480)
The buggy address belongs to the page:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access[   32.456316] ------------[ cut here ]------------
WARNING: CPU: 0 PID: 3790 at kernel/sched/core.c:7944 __might_sleep+0x138/0x1a0 kernel/sched/core.c:7939()
do not call blocking ops when !TASK_RUNNING; state=1 set at [<ffffffff81138a30>] do_wait+0x270/0xa20 kernel/exit.c:1503