BUG: KASAN: stack-out-of-bounds in xfrm_state_find+0x2453/0x2830 net/xfrm/xfrm_state.c:822 at addr ffff8801db207580
Read of size 4 by task syzkaller880175/3292
page:ffffea00076c81c0 count:1 mapcount:0 mapping:          (null) index:0x0
flags: 0x8000000000000400(reserved)
page dumped because: kasan: bad access detected
CPU: 0 PID: 3292 Comm: syzkaller880175 Not tainted 4.9.42-g02f29ab #24
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801db206c68 ffffffff81d92909 ffffed003b640eb0 0000000000000004
 0000000000000000 ffffed003b640eb0 ffff8801db207580 ffff8801db206cf0
 ffffffff8153ca83 0000000000000000 0000000000000002 ffffffff833cdea3
Call Trace:
 <IRQ> [   59.933502]  [<ffffffff81d92909>] __dump_stack lib/dump_stack.c:15 [inline]
 <IRQ> [   59.933502]  [<ffffffff81d92909>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff8153ca83>] print_address_description mm/kasan/report.c:208 [inline]
 [<ffffffff8153ca83>] kasan_report_error mm/kasan/report.c:287 [inline]
 [<ffffffff8153ca83>] kasan_report.part.1+0x4c3/0x500 mm/kasan/report.c:309
 [<ffffffff8153cb49>] kasan_report mm/kasan/report.c:329 [inline]
 [<ffffffff8153cb49>] __asan_report_load4_noabort+0x29/0x30 mm/kasan/report.c:329
 [<ffffffff833cdea3>] xfrm_state_find+0x2453/0x2830 net/xfrm/xfrm_state.c:822
 [<ffffffff833b32a8>] xfrm_tmpl_resolve_one net/xfrm/xfrm_policy.c:1475 [inline]
 [<ffffffff833b32a8>] xfrm_tmpl_resolve+0x298/0xa90 net/xfrm/xfrm_policy.c:1519
 [<ffffffff833b3c77>] xfrm_resolve_and_create_bundle+0xd7/0x1d50 net/xfrm/xfrm_policy.c:1866
 [<ffffffff833b94f4>] xfrm_lookup+0x984/0xbf0 net/xfrm/xfrm_policy.c:2220
 [<ffffffff833ba659>] xfrm_lookup_route+0x39/0x1a0 net/xfrm/xfrm_policy.c:2342
 [<ffffffff831d4f9f>] ip_route_output_flow+0x7f/0xa0 net/ipv4/route.c:2430
 [<ffffffff83212a88>] inet_csk_route_req+0x5d8/0x9a0 net/ipv4/inet_connection_sock.c:420
 [<ffffffff83287ed3>] tcp_v4_send_synack+0x203/0x290 net/ipv4/tcp_ipv4.c:857
 [<ffffffff8325bbd1>] tcp_rtx_synack+0x121/0x1a0 net/ipv4/tcp_output.c:3618
 [<ffffffff83210374>] inet_rtx_syn_ack+0x64/0xd0 net/ipv4/inet_connection_sock.c:504
 [<ffffffff8328e546>] tcp_check_req+0x926/0x11e0 net/ipv4/tcp_minisocks.c:626
 [<ffffffff83289bde>] tcp_v4_rcv+0x14de/0x29c0 net/ipv4/tcp_ipv4.c:1673
 [<ffffffff831e29d5>] ip_local_deliver_finish+0x285/0xa80 net/ipv4/ip_input.c:216
 [<ffffffff831e3a1a>] NF_HOOK_THRESH include/linux/netfilter.h:232 [inline]
 [<ffffffff831e3a1a>] NF_HOOK include/linux/netfilter.h:255 [inline]
 [<ffffffff831e3a1a>] ip_local_deliver+0x30a/0x4d0 net/ipv4/ip_input.c:257
 [<ffffffff831e156b>] dst_input include/net/dst.h:513 [inline]
 [<ffffffff831e156b>] ip_rcv_finish+0x71b/0x1900 net/ipv4/ip_input.c:396
 [<ffffffff831e47a2>] NF_HOOK_THRESH include/linux/netfilter.h:232 [inline]
 [<ffffffff831e47a2>] NF_HOOK include/linux/netfilter.h:255 [inline]
 [<ffffffff831e47a2>] ip_rcv+0xbc2/0x1620 net/ipv4/ip_input.c:487
 [<ffffffff82f2f5b3>] __netif_receive_skb_core+0xa33/0x29e0 net/core/dev.c:4237
 [<ffffffff82f315bb>] __netif_receive_skb+0x5b/0x1c0 net/core/dev.c:4275
 [<ffffffff82f318f4>] process_backlog+0x1d4/0x690 net/core/dev.c:4896
 [<ffffffff82f379e6>] napi_poll net/core/dev.c:5197 [inline]
 [<ffffffff82f379e6>] net_rx_action+0x396/0xe00 net/core/dev.c:5262
 [<ffffffff838a889d>] __do_softirq+0x22d/0x964 kernel/softirq.c:284
 [<ffffffff838a6a2c>] do_softirq_own_stack+0x1c/0x30 arch/x86/entry/entry_64.S:904
 <EOI> [   60.537288]  [<ffffffff81145ed9>] do_softirq.part.16+0x99/0xb0 kernel/softirq.c:328
 [<ffffffff811476c8>] do_softirq+0x18/0x20 kernel/softirq.c:316
 [<ffffffff82f34f00>] netif_rx_ni+0x140/0x320 net/core/dev.c:3867
 [<ffffffff8270e135>] tun_get_user+0xac5/0x2080 drivers/net/tun.c:1319
 [<ffffffff8270f905>] tun_chr_write_iter+0xd5/0x190 drivers/net/tun.c:1342
 [<ffffffff8156a84f>] new_sync_write fs/read_write.c:499 [inline]
 [<ffffffff8156a84f>] __vfs_write+0x4bf/0x680 fs/read_write.c:512
 [<ffffffff8156e5c0>] vfs_write+0x170/0x4e0 fs/read_write.c:560
 [<ffffffff81571fb9>] SYSC_write fs/read_write.c:607 [inline]
 [<ffffffff81571fb9>] SyS_write+0xd9/0x1b0 fs/read_write.c:599
 [<ffffffff838a5a05>] entry_SYSCALL_64_fastpath+0x23/0xc6
Memory state around the buggy address:
 ffff8801db207480: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8801db207500: 00 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00 00 00
>ffff8801db207580: f2 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
                   ^
 ffff8801db207600: 00 00 00 00 00 00 00 00 00 00 f2 f2 00 00 00 00
 ffff8801db207680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
==================================================================
BUG: KASAN: stack-out-of-bounds in __xfrm_dst_hash net/xfrm/xfrm_hash.h:90 [inline] at addr ffff8801db207580
BUG: KASAN: stack-out-of-bounds in xfrm_dst_hash net/xfrm/xfrm_state.c:60 [inline] at addr ffff8801db207580
BUG: KASAN: stack-out-of-bounds in xfrm_state_find+0xc9b/0x2830 net/xfrm/xfrm_state.c:822 at addr ffff8801db207580
Read of size 4 by task syzkaller880175/3292
page:ffffea00076c81c0 count:1 mapcount:0 mapping:          (null) index:0x0
flags: 0x8000000000000400(reserved)
page dumped because: kasan: bad access detected
CPU: 0 PID: 3292 Comm: syzkaller880175 Tainted: G    B           4.9.42-g02f29ab #24
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801db206c68 ffffffff81d92909 ffffed003b640eb0 0000000000000004
 0000000000000000 ffffed003b640eb0 ffff8801db207580 ffff8801db206cf0
 ffffffff8153ca83 0000000000000010 0000000000000000 ffffffff833cc6eb
Call Trace:
 <IRQ> [   60.801707]  [<ffffffff81d92909>] __dump_stack lib/dump_stack.c:15 [inline]
 <IRQ> [   60.801707]  [<ffffffff81d92909>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff8153ca83>] print_address_description mm/kasan/report.c:208 [inline]
 [<ffffffff8153ca83>] kasan_report_error mm/kasan/report.c:287 [inline]
 [<ffffffff8153ca83>] kasan_report.part.1+0x4c3/0x500 mm/kasan/report.c:309
 [<ffffffff8153cb49>] kasan_report mm/kasan/report.c:329 [inline]
 [<ffffffff8153cb49>] __asan_report_load4_noabort+0x29/0x30 mm/kasan/report.c:329
 [<ffffffff833cc6eb>] __xfrm_dst_hash net/xfrm/xfrm_hash.h:90 [inline]
 [<ffffffff833cc6eb>] xfrm_dst_hash net/xfrm/xfrm_state.c:60 [inline]
 [<ffffffff833cc6eb>] xfrm_state_find+0xc9b/0x2830 net/xfrm/xfrm_state.c:822
 [<ffffffff833b32a8>] xfrm_tmpl_resolve_one net/xfrm/xfrm_policy.c:1475 [inline]
 [<ffffffff833b32a8>] xfrm_tmpl_resolve+0x298/0xa90 net/xfrm/xfrm_policy.c:1519