================================================================== BUG: KASAN: slab-out-of-bounds in __swab64p include/uapi/linux/swab.h:192 [inline] BUG: KASAN: slab-out-of-bounds in __be64_to_cpup include/uapi/linux/byteorder/little_endian.h:74 [inline] BUG: KASAN: slab-out-of-bounds in is_tx_ready include/net/tls.h:354 [inline] BUG: KASAN: slab-out-of-bounds in tls_write_space+0x29d/0x2d0 net/tls/tls_main.c:236 Read of size 8 at addr ffff8801bc6df270 by task ksoftirqd/1/18 CPU: 1 PID: 18 Comm: ksoftirqd/1 Not tainted 4.19.0-rc4+ #230 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1c4/0x2b4 lib/dump_stack.c:113 print_address_description.cold.8+0x9/0x1ff mm/kasan/report.c:256 kasan_report_error mm/kasan/report.c:354 [inline] kasan_report.cold.9+0x242/0x309 mm/kasan/report.c:412 __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433 __swab64p include/uapi/linux/swab.h:192 [inline] __be64_to_cpup include/uapi/linux/byteorder/little_endian.h:74 [inline] is_tx_ready include/net/tls.h:354 [inline] tls_write_space+0x29d/0x2d0 net/tls/tls_main.c:236 tcp_new_space net/ipv4/tcp_input.c:5154 [inline] tcp_check_space+0x53f/0x920 net/ipv4/tcp_input.c:5165 tcp_data_snd_check net/ipv4/tcp_input.c:5175 [inline] tcp_rcv_established+0xde8/0x2120 net/ipv4/tcp_input.c:5656 tcp_v6_do_rcv+0x4b3/0x13c0 net/ipv6/tcp_ipv6.c:1326 tcp_v6_rcv+0x2f7a/0x38a0 net/ipv6/tcp_ipv6.c:1555 ip6_input_finish+0x3fc/0x1aa0 net/ipv6/ip6_input.c:384 NF_HOOK include/linux/netfilter.h:287 [inline] ip6_input+0xe9/0x600 net/ipv6/ip6_input.c:427 dst_input include/net/dst.h:450 [inline] ip6_rcv_finish+0x17a/0x330 net/ipv6/ip6_input.c:76 NF_HOOK include/linux/netfilter.h:287 [inline] ipv6_rcv+0x113/0x640 net/ipv6/ip6_input.c:272 __netif_receive_skb_one_core+0x14d/0x200 net/core/dev.c:4894 __netif_receive_skb+0x2c/0x1e0 net/core/dev.c:5004 process_backlog+0x217/0x760 net/core/dev.c:5808 napi_poll net/core/dev.c:6228 [inline] net_rx_action+0x7c5/0x1950 net/core/dev.c:6294 __do_softirq+0x30b/0xad8 kernel/softirq.c:292 run_ksoftirqd+0x94/0x100 kernel/softirq.c:653 smpboot_thread_fn+0x68b/0xa00 kernel/smpboot.c:164 kthread+0x35a/0x420 kernel/kthread.c:246 ret_from_fork+0x3a/0x50 arch/x86/entry/entry_64.S:413 Allocated by task 5614: save_stack+0x43/0xd0 mm/kasan/kasan.c:448 set_track mm/kasan/kasan.c:460 [inline] kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:553 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:490 kmem_cache_alloc+0x12e/0x730 mm/slab.c:3554 kmem_cache_zalloc include/linux/slab.h:697 [inline] __kernfs_new_node+0x127/0x8d0 fs/kernfs/dir.c:634 kernfs_new_node+0x95/0x120 fs/kernfs/dir.c:695 __kernfs_create_file+0x5a/0x340 fs/kernfs/file.c:992 sysfs_add_file_mode_ns+0x222/0x530 fs/sysfs/file.c:306 create_files fs/sysfs/group.c:63 [inline] internal_create_group+0x3df/0xd80 fs/sysfs/group.c:147 sysfs_create_group fs/sysfs/group.c:173 [inline] sysfs_create_groups+0x9b/0x141 fs/sysfs/group.c:200 device_add_groups drivers/base/core.c:1110 [inline] device_add_attrs drivers/base/core.c:1258 [inline] device_add+0x691/0x17f0 drivers/base/core.c:1896 netdev_register_kobject+0x187/0x3f0 net/core/net-sysfs.c:1751 register_netdevice+0x99a/0x10f0 net/core/dev.c:8480 veth_newlink+0x5e7/0xa70 drivers/net/veth.c:1179 rtnl_newlink+0xec6/0x1d40 net/core/rtnetlink.c:3112 rtnetlink_rcv_msg+0x46a/0xc20 net/core/rtnetlink.c:4724 netlink_rcv_skb+0x172/0x440 net/netlink/af_netlink.c:2447 rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:4742 netlink_unicast_kernel net/netlink/af_netlink.c:1310 [inline] netlink_unicast+0x5a5/0x760 net/netlink/af_netlink.c:1336 netlink_sendmsg+0xa18/0xfc0 net/netlink/af_netlink.c:1901 sock_sendmsg_nosec net/socket.c:621 [inline] sock_sendmsg+0xd5/0x120 net/socket.c:631 ___sys_sendmsg+0x7fd/0x930 net/socket.c:2116 __sys_sendmsg+0x11d/0x280 net/socket.c:2154 __do_sys_sendmsg net/socket.c:2163 [inline] __se_sys_sendmsg net/socket.c:2161 [inline] __x64_sys_sendmsg+0x78/0xb0 net/socket.c:2161 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 0: (stack is not available) The buggy address belongs to the object at ffff8801bc6df1c0 which belongs to the cache kernfs_node_cache of size 160 The buggy address is located 16 bytes to the right of 160-byte region [ffff8801bc6df1c0, ffff8801bc6df260) The buggy address belongs to the page: page:ffffea0006f1b7c0 count:1 mapcount:0 mapping:ffff8801da972600 index:0xffff8801bc6dffee flags: 0x2fffc0000000100(slab) raw: 02fffc0000000100 ffffea000715f7c8 ffffea000725fcc8 ffff8801da972600 raw: ffff8801bc6dffee ffff8801bc6df000 0000000100000012 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8801bc6df100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8801bc6df180: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00 >ffff8801bc6df200: 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc ^ ffff8801bc6df280: fc fc fc fc 00 00 00 00 00 00 00 00 00 00 00 00 ffff8801bc6df300: 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc fc ==================================================================