================================================================== BUG: KASAN: slab-out-of-bounds in decode_session6 net/xfrm/xfrm_policy.c:3394 [inline] BUG: KASAN: slab-out-of-bounds in __xfrm_decode_session+0x1cfb/0x2e90 net/xfrm/xfrm_policy.c:3486 Read of size 1 at addr ffff8880a28eb663 by task kworker/u4:2/31985 CPU: 1 PID: 31985 Comm: kworker/u4:2 Not tainted 5.7.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: bat_events batadv_nc_worker Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x188/0x20d lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xd3/0x315 mm/kasan/report.c:382 __kasan_report.cold+0x35/0x4d mm/kasan/report.c:511 kasan_report+0x33/0x50 mm/kasan/common.c:625 decode_session6 net/xfrm/xfrm_policy.c:3394 [inline] __xfrm_decode_session+0x1cfb/0x2e90 net/xfrm/xfrm_policy.c:3486 xfrm_decode_session include/net/xfrm.h:1138 [inline] vti6_tnl_xmit+0x5b8/0x1d30 net/ipv6/ip6_vti.c:566 __netdev_start_xmit include/linux/netdevice.h:4533 [inline] netdev_start_xmit include/linux/netdevice.h:4547 [inline] xmit_one net/core/dev.c:3477 [inline] dev_hard_start_xmit+0x1a4/0x9b0 net/core/dev.c:3493 sch_direct_xmit+0x345/0xc20 net/sched/sch_generic.c:313 qdisc_restart net/sched/sch_generic.c:376 [inline] __qdisc_run+0x4d1/0x17b0 net/sched/sch_generic.c:384 __dev_xmit_skb net/core/dev.c:3716 [inline] __dev_queue_xmit+0x165b/0x30a0 net/core/dev.c:4021 neigh_output include/net/neighbour.h:510 [inline] ip6_finish_output2+0x1091/0x25b0 net/ipv6/ip6_output.c:117 __ip6_finish_output+0x442/0xab0 net/ipv6/ip6_output.c:143 ip6_finish_output+0x34/0x1f0 net/ipv6/ip6_output.c:153 NF_HOOK_COND include/linux/netfilter.h:296 [inline] ip6_output+0x239/0x810 net/ipv6/ip6_output.c:176 dst_output include/net/dst.h:435 [inline] NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] mld_sendpack+0x961/0xdf0 net/ipv6/mcast.c:1682 mld_send_cr net/ipv6/mcast.c:1978 [inline] mld_ifc_timer_expire+0x42e/0x920 net/ipv6/mcast.c:2477 call_timer_fn+0x1ac/0x780 kernel/time/timer.c:1405 expire_timers kernel/time/timer.c:1450 [inline] __run_timers kernel/time/timer.c:1774 [inline] __run_timers kernel/time/timer.c:1741 [inline] run_timer_softirq+0x623/0x1600 kernel/time/timer.c:1787 __do_softirq+0x26c/0x9f7 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0x192/0x1d0 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:546 [inline] smp_apic_timer_interrupt+0x19e/0x600 arch/x86/kernel/apic/apic.c:1140 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829 RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:759 [inline] RIP: 0010:queue_delayed_work_on+0x125/0x210 kernel/workqueue.c:1677 Code: 00 fc ff df 48 c1 e8 03 80 3c 10 00 0f 85 d8 00 00 00 48 83 3d 9b e4 48 08 00 0f 84 9a 00 00 00 e8 20 54 27 00 48 89 df 57 9d <0f> 1f 44 00 00 e8 11 54 27 00 44 89 f8 48 83 c4 08 5b 5d 41 5c 41 RSP: 0018:ffffc90001997ce8 EFLAGS: 00000293 ORIG_RAX: ffffffffffffff13 RAX: ffff8880a30fe280 RBX: 0000000000000293 RCX: 1ffffffff1865c93 RDX: 0000000000000000 RSI: ffffffff814bdb90 RDI: 0000000000000293 RBP: 0000000000000200 R08: 0000000000000001 R09: fffffbfff185cf55 R10: ffffffff8c2e7aa7 R11: fffffbfff185cf54 R12: ffff888060cc5660 R13: ffff888099dd6800 R14: 0000000000000001 R15: 0000000000000001 process_one_work+0x965/0x16a0 kernel/workqueue.c:2268 worker_thread+0x96/0xe20 kernel/workqueue.c:2414 kthread+0x388/0x470 kernel/kthread.c:268 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Allocated by task 529: save_stack+0x1b/0x40 mm/kasan/common.c:49 set_track mm/kasan/common.c:57 [inline] __kasan_kmalloc mm/kasan/common.c:495 [inline] __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:468 slab_post_alloc_hook mm/slab.h:586 [inline] slab_alloc_node mm/slab.c:3263 [inline] kmem_cache_alloc_node+0x13c/0x760 mm/slab.c:3575 __alloc_skb+0xba/0x5a0 net/core/skbuff.c:198 alloc_skb include/linux/skbuff.h:1083 [inline] nsim_dev_trap_skb_build drivers/net/netdevsim/dev.c:492 [inline] nsim_dev_trap_report drivers/net/netdevsim/dev.c:549 [inline] nsim_dev_trap_report_work+0x2bb/0xbc0 drivers/net/netdevsim/dev.c:590 process_one_work+0x965/0x16a0 kernel/workqueue.c:2268 worker_thread+0x96/0xe20 kernel/workqueue.c:2414 kthread+0x388/0x470 kernel/kthread.c:268 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 Freed by task 529: save_stack+0x1b/0x40 mm/kasan/common.c:49 set_track mm/kasan/common.c:57 [inline] kasan_set_free_info mm/kasan/common.c:317 [inline] __kasan_slab_free+0xf7/0x140 mm/kasan/common.c:456 __cache_free mm/slab.c:3426 [inline] kmem_cache_free+0x7f/0x320 mm/slab.c:3694 kfree_skbmem net/core/skbuff.c:622 [inline] kfree_skbmem+0xef/0x1b0 net/core/skbuff.c:616 __kfree_skb net/core/skbuff.c:679 [inline] consume_skb net/core/skbuff.c:837 [inline] consume_skb+0xfb/0x400 net/core/skbuff.c:831 nsim_dev_trap_report drivers/net/netdevsim/dev.c:565 [inline] nsim_dev_trap_report_work+0x86d/0xbc0 drivers/net/netdevsim/dev.c:590 process_one_work+0x965/0x16a0 kernel/workqueue.c:2268 worker_thread+0x96/0xe20 kernel/workqueue.c:2414 kthread+0x388/0x470 kernel/kthread.c:268 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 The buggy address belongs to the object at ffff8880a28eb580 which belongs to the cache skbuff_head_cache of size 224 The buggy address is located 3 bytes to the right of 224-byte region [ffff8880a28eb580, ffff8880a28eb660) The buggy address belongs to the page: page:ffffea00028a3ac0 refcount:1 mapcount:0 mapping:000000002636ac02 index:0x0 flags: 0xfffe0000000200(slab) raw: 00fffe0000000200 ffffea0001bef748 ffffea00029d4808 ffff88821b777700 raw: 0000000000000000 ffff8880a28eb080 000000010000000c 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880a28eb500: fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc fc ffff8880a28eb580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff8880a28eb600: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ^ ffff8880a28eb680: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb ffff8880a28eb700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================