==================================================================
kasan: CONFIG_KASAN_INLINE enabled
BUG: KASAN: slab-out-of-bounds in memset include/linux/string.h:330 [inline]
BUG: KASAN: slab-out-of-bounds in vmac_final+0x161/0x26a0 crypto/vmac.c:611
Write of size 18446744073709551516 at addr ffff8801ac760f0c by task syz-executor345/4580
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] SMP KASAN

CPU: 1 PID: 4580 Comm: syz-executor345 Not tainted 4.17.0+ #98
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1b9/0x294 lib/dump_stack.c:113
 print_address_description+0x6c/0x20b mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412
 check_memory_region_inline mm/kasan/kasan.c:260 [inline]
 check_memory_region+0x13e/0x1b0 mm/kasan/kasan.c:267
 memset+0x23/0x40 mm/kasan/kasan.c:285
 memset include/linux/string.h:330 [inline]
 vmac_final+0x161/0x26a0 crypto/vmac.c:611
 crypto_shash_final+0x104/0x260 crypto/shash.c:152
 shash_async_final+0x35/0x40 crypto/shash.c:252
 crypto_ahash_op+0xcf/0x180 crypto/ahash.c:362
 crypto_ahash_final+0x57/0x70 crypto/ahash.c:367
 hash_sendmsg+0x750/0xac0 crypto/algif_hash.c:126
 sock_sendmsg_nosec net/socket.c:645 [inline]
 sock_sendmsg+0xd5/0x120 net/socket.c:655
 ___sys_sendmsg+0x805/0x940 net/socket.c:2161
CPU: 0 PID: 0 Comm:  Not tainted 4.17.0+ #98
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__read_once_size include/linux/compiler.h:188 [inline]
RIP: 0010:get_running_cputimer include/linux/sched/cputime.h:85 [inline]
RIP: 0010:account_group_system_time include/linux/sched/cputime.h:149 [inline]
RIP: 0010:account_system_index_time+0xea/0x5b0 kernel/sched/cputime.c:168
Code: 
63 
04 00 
00 
 __sys_sendmsg+0x115/0x270 net/socket.c:2199
48 8b 
83 
b8 
06 
 __do_sys_sendmsg net/socket.c:2208 [inline]
 __se_sys_sendmsg net/socket.c:2206 [inline]
 __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2206
00 
 do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:290
00 
48 
ba 
00 
00 
00 00 
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
00 
RIP: 0033:0x445e69
fc 
Code: 
ff df 
e8 
48 
5c 
8d 
e7 
b8 
ff 
38 
ff 
01 
48 
00 
83 
00 
c4 
48 8d 
18 
88 
c3 
20 
0f 
01 
1f 
00 
80 00 
00 
00 
48 
00 
89 
00 
fe 
48 
48 
89 
c1 
f8 
ee 
48 
03 
89 
<0f> 
f7 
b6 
48 
14 
89 
16 
d6 
48 
48 
89 
89 
fe 
ca 
83 
4d 
e6 
89 
07 
c2 
40 
4d 
38 
89 
f2 
c8 
7f 
4c 
08 
8b 
84 
4c 
d2 
24 
0f 
08 
85 
0f 
f6 
05 
03 
<48> 
00 
3d 
01 
RSP: 0018:ffff8801dae07980 EFLAGS: 00010006
f0 
ff 
RAX: 0000000000000000 RBX: ffff8801ad1a4500 RCX: 0000000000000120
ff 
RDX: dffffc0000000000 RSI: 0000000000000027 RDI: 0000000000000138
0f 
RBP: ffff8801dae07a68 R08: ffff8801ad1a4500 R09: 0000000000000000
83 
R10: ffffed0043fff001 R11: ffff88021fff8017 R12: ffff8801dae07a40
eb 
R13: ffff8801ad1a4500 R14: 00000000000f4240 R15: 0000000000000002
51 
FS:  00007fd7e78fb700(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
00 
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
00 
CR2: 00007fd7e78b8e78 CR3: 00000001ae829000 CR4: 00000000001406f0
c3 
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
66 
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
2e 
Call Trace:
0f 
 <IRQ>
1f 
84 
00 
00 
00 
00 
 account_system_time+0x7f/0xb0 kernel/sched/cputime.c:199
 account_process_tick+0x76/0x240 kernel/sched/cputime.c:498
RSP: 002b:00007fd7e78d9db8 EFLAGS: 00000246
 ORIG_RAX: 000000000000002e
 update_process_times+0x21/0x70 kernel/time/timer.c:1634
RAX: ffffffffffffffda RBX: 00000000006dac5c RCX: 0000000000445e69
 tick_sched_handle+0x9f/0x180 kernel/time/tick-sched.c:164
RDX: 0000000000000000 RSI: 00000000200000c0 RDI: 00000000000003ff
 tick_sched_timer+0x45/0x130 kernel/time/tick-sched.c:1274
RBP: 00000000006dac58 R08: 0000000000000000 R09: 0000000000000000
 __run_hrtimer kernel/time/hrtimer.c:1398 [inline]
 __hrtimer_run_queues+0x3e3/0x10a0 kernel/time/hrtimer.c:1460
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007ffde323e10f R14: 00007fd7e78da9c0 R15: 000000000000000b

Allocated by task 4557:
 save_stack+0x43/0xd0 mm/kasan/kasan.c:448
 set_track mm/kasan/kasan.c:460 [inline]
 kasan_kmalloc+0xc4/0xe0 mm/kasan/kasan.c:553
 __do_kmalloc mm/slab.c:3718 [inline]
 __kmalloc+0x14e/0x760 mm/slab.c:3727
 kmalloc include/linux/slab.h:518 [inline]
 kzalloc include/linux/slab.h:706 [inline]
 crypto_create_tfm+0x87/0x310 crypto/api.c:464
 crypto_init_shash_ops_async+0x5d/0x3e4 crypto/shash.c:357
 crypto_ahash_init_tfm+0x357/0x430 crypto/ahash.c:458
 crypto_create_tfm+0xe9/0x310 crypto/api.c:471
 crypto_alloc_tfm+0x1b5/0x2d0 crypto/api.c:543
 crypto_alloc_ahash+0x2c/0x40 crypto/ahash.c:539
 hrtimer_interrupt+0x2f3/0x750 kernel/time/hrtimer.c:1518
 hash_bind+0x25/0x30 crypto/algif_hash.c:408
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1025 [inline]
 smp_apic_timer_interrupt+0x15d/0x710 arch/x86/kernel/apic/apic.c:1050
 alg_bind+0x2be/0x560 crypto/af_alg.c:183
 __sys_bind+0x331/0x440 net/socket.c:1528
 __do_sys_bind net/socket.c:1539 [inline]
 __se_sys_bind net/socket.c:1537 [inline]
 __x64_sys_bind+0x73/0xb0 net/socket.c:1537
 do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:863
Freed by task 0:
 </IRQ>
(stack is not available)
Modules linked in:

The buggy address belongs to the object at ffff8801ac760d00
 which belongs to the cache kmalloc-512 of size 512
Dumping ftrace buffer:
The buggy address is located 12 bytes to the right of
 512-byte region [ffff8801ac760d00, ffff8801ac760f00)
   (ftrace buffer empty)
The buggy address belongs to the page:
---[ end trace d7db9a753b3ac637 ]---
page:ffffea0006b1d800 count:1 mapcount:0 mapping:ffff8801da800940 index:0x0
RIP: 0010:__read_once_size include/linux/compiler.h:188 [inline]
RIP: 0010:get_running_cputimer include/linux/sched/cputime.h:85 [inline]
RIP: 0010:account_group_system_time include/linux/sched/cputime.h:149 [inline]
RIP: 0010:account_system_index_time+0xea/0x5b0 kernel/sched/cputime.c:168
Code: 
flags: 0x2fffc0000000100(slab)
63 
raw: 02fffc0000000100 ffffea000762d788 ffffea0007626dc8 ffff8801da800940
04 
raw: 0000000000000000 ffff8801ac760080 0000000100000006 0000000000000000
00 
page dumped because: kasan: bad access detected
00 

48 
Memory state around the buggy address:
8b 
 ffff8801ac760e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
83 
 ffff8801ac760e80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
b8 
>ffff8801ac760f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
06 
                      ^
00 
 ffff8801ac760f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
00 
 ffff8801ac761000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
48 
==================================================================
ba 
BUG: unable to handle kernel 
00 
NULL pointer dereference
00 00 
 at 0000000000000000
00 
PGD 1ae22a067 
00 
P4D 1ae22a067 
fc 
PUD 1adcde067 
ff 
PMD 0 
df 
48 
Oops: 0010 [#2] SMP KASAN
8d 
CPU: 1 PID: 4580 Comm: syz-executor345 Tainted: G    B D           4.17.0+ #98
b8 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
38 
RIP: 0010:          (null)
01 
Code: 
00 
Bad RIP value.
00 
RSP: 0018:ffff8801daf07b58 EFLAGS: 00010006
48 
8d 
RAX: 0000000000000000 RBX: ffff8801ad297ce0 RCX: ffffffff8168de27
88 
RDX: 0000000000010000 RSI: ffffffff8168d644 RDI: ffff8801ad297ce0
20 
RBP: ffff8801daf07de0 R08: ffff8801ae6ae300 R09: ffffed003b5e4b90
01 
R10: ffffed003b5e4b90 R11: ffff8801daf25c83 R12: ffff8801daf25d00
00 
R13: 0000000000000000 R14: dffffc0000000000 R15: 0000000000000000
00 
FS:  00007fd7e78da700(0000) GS:ffff8801daf00000(0000) knlGS:0000000000000000
48 
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
89 
CR2: ffffffffffffffd6 CR3: 00000001ae829000 CR4: 00000000001406e0
fe 
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
48 
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
c1 ee 
Call Trace:
03 
 <IRQ>
<0f> 
b6 
14 
16 
48 
89 
fe 
83 
e6 
07 
40 
 hrtimer_interrupt+0x2f3/0x750 kernel/time/hrtimer.c:1518
38 
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1025 [inline]
 smp_apic_timer_interrupt+0x15d/0x710 arch/x86/kernel/apic/apic.c:1050
f2 
7f 
08 
84 
d2 
0f 
85 
 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:863
f6 
 </IRQ>
03 
RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:783 [inline]
RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:160 [inline]
RIP: 0010:_raw_spin_unlock_irqrestore+0xa1/0xc0 kernel/locking/spinlock.c:184
00 
Code: 
68 
RSP: 0018:ffff8801dae07980 EFLAGS: 00010006
a8 
f1 
RAX: 0000000000000000 RBX: ffff8801ad1a4500 RCX: 0000000000000120
88 
RDX: dffffc0000000000 RSI: 0000000000000027 RDI: 0000000000000138
48 
RBP: ffff8801dae07a68 R08: ffff8801ad1a4500 R09: 0000000000000000
b8 
R10: ffffed0043fff001 R11: ffff88021fff8017 R12: ffff8801dae07a40
00 
R13: ffff8801ad1a4500 R14: 00000000000f4240 R15: 0000000000000002
00 
FS:  00007fd7e78fb700(0000) GS:ffff8801dae00000(0000) knlGS:0000000000000000
00 
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
00 
CR2: 00007fd7e78b8e78 CR3: 00000001ae829000 CR4: 00000000001406f0
00 
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
fc 
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
ff