==================================================================
BUG: KASAN: use-after-free in decode_session6+0x10e1/0x1950 net/xfrm/xfrm_policy.c:3460
Read of size 1 at addr ffff88803fca9b54 by task syz-executor.4/31365

CPU: 0 PID: 31365 Comm: syz-executor.4 Not tainted 6.5.0-rc5-syzkaller-00362-ga785fd28d31f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:364 [inline]
 print_report+0xc4/0x620 mm/kasan/report.c:475
 kasan_report+0xda/0x110 mm/kasan/report.c:588
 decode_session6+0x10e1/0x1950 net/xfrm/xfrm_policy.c:3460
 __xfrm_decode_session+0x54/0xb0 net/xfrm/xfrm_policy.c:3566
 xfrm_decode_session include/net/xfrm.h:1216 [inline]
 vti6_tnl_xmit+0x3f3/0x1e70 net/ipv6/ip6_vti.c:575
 __netdev_start_xmit include/linux/netdevice.h:4910 [inline]
 netdev_start_xmit include/linux/netdevice.h:4924 [inline]
 xmit_one net/core/dev.c:3537 [inline]
 dev_hard_start_xmit+0x13d/0x6c0 net/core/dev.c:3553
 sch_direct_xmit+0x1ac/0xc20 net/sched/sch_generic.c:342
 qdisc_restart net/sched/sch_generic.c:407 [inline]
 __qdisc_run+0x540/0x19d0 net/sched/sch_generic.c:415
 __dev_xmit_skb net/core/dev.c:3827 [inline]
 __dev_queue_xmit+0x26ab/0x3f20 net/core/dev.c:4169
 dev_queue_xmit include/linux/netdevice.h:3088 [inline]
 neigh_connected_output+0x42c/0x5d0 net/core/neighbour.c:1581
 neigh_output include/net/neighbour.h:544 [inline]
 ip6_finish_output2+0x5d0/0x1b20 net/ipv6/ip6_output.c:135
 __ip6_finish_output net/ipv6/ip6_output.c:196 [inline]
 ip6_finish_output+0x485/0x11d0 net/ipv6/ip6_output.c:207
 NF_HOOK_COND include/linux/netfilter.h:292 [inline]
 ip6_output+0x243/0x890 net/ipv6/ip6_output.c:228
 dst_output include/net/dst.h:458 [inline]
 NF_HOOK.constprop.0+0xfd/0x540 include/linux/netfilter.h:303
 ndisc_send_skb+0x9e8/0x1430 net/ipv6/ndisc.c:509
 ndisc_send_rs+0x133/0x690 net/ipv6/ndisc.c:719
 addrconf_rs_timer+0x412/0x840 net/ipv6/addrconf.c:3941
 call_timer_fn+0x1a0/0x580 kernel/time/timer.c:1700
 expire_timers kernel/time/timer.c:1751 [inline]
 __run_timers+0x764/0xb10 kernel/time/timer.c:2022
 run_timer_softirq+0x58/0xd0 kernel/time/timer.c:2035
 __do_softirq+0x218/0x965 kernel/softirq.c:553
 invoke_softirq kernel/softirq.c:427 [inline]
 __irq_exit_rcu kernel/softirq.c:632 [inline]
 irq_exit_rcu+0xb7/0x120 kernel/softirq.c:644
 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1109
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645
RIP: 0010:__copy_msghdr+0x2c2/0x460 net/socket.c:2411
Code: 81 fd 00 04 00 00 0f 87 2a 01 00 00 e8 37 5a 68 f9 48 8d 7b 50 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 80 3c 02 00 <0f> 85 26 01 00 00 48 8d 7b 58 48 c7 43 50 00 00 00 00 48 b8 00 00
RSP: 0018:ffffc9000346fa60 EFLAGS: 00000246
RAX: dffffc0000000000 RBX: ffffc9000346fdb0 RCX: ffffc9000f6b9000
RDX: 1ffff9200068dfc0 RSI: ffffffff881dae69 RDI: ffffc9000346fe00
RBP: 0000000000000000 R08: 0000000000000007 R09: 0000000000000400
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
R13: ffffc9000346fbb0 R14: ffffc9000346fb90 R15: ffffc9000346faa8
 copy_msghdr_from_user+0xc2/0x160 net/socket.c:2427
 recvmsg_copy_msghdr net/socket.c:2679 [inline]
 ___sys_recvmsg+0xdc/0x1a0 net/socket.c:2751
 do_recvmmsg+0x2af/0x740 net/socket.c:2849
 __sys_recvmmsg net/socket.c:2928 [inline]
 __do_sys_recvmmsg net/socket.c:2951 [inline]
 __se_sys_recvmmsg net/socket.c:2944 [inline]
 __x64_sys_recvmmsg+0x235/0x290 net/socket.c:2944
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f900b27cae9
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f900bfa70c8 EFLAGS: 00000246 ORIG_RAX: 000000000000012b
RAX: ffffffffffffffda RBX: 00007f900b39c050 RCX: 00007f900b27cae9
RDX: 0000000000010106 RSI: 00000000200000c0 RDI: 0000000000000005
RBP: 00007f900b2c847a R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000006e R14: 00007f900b39c050 R15: 00007ffda0191518
 </TASK>

The buggy address belongs to the physical page:
page:ffffea0000ff2a40 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x3fca9
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000000000 dead000000000100 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x102dc2(GFP_HIGHUSER|__GFP_NOWARN|__GFP_ZERO), pid 26399, tgid 26391 (syz-executor.2), ts 1543053033585, free_ts 1543198875729
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x2d2/0x350 mm/page_alloc.c:1570
 prep_new_page mm/page_alloc.c:1577 [inline]
 get_page_from_freelist+0x10a9/0x31e0 mm/page_alloc.c:3221
 __alloc_pages+0x1d0/0x4a0 mm/page_alloc.c:4477
 alloc_pages+0x1a9/0x270 mm/mempolicy.c:2292
 vm_area_alloc_pages mm/vmalloc.c:3059 [inline]
 __vmalloc_area_node mm/vmalloc.c:3135 [inline]
 __vmalloc_node_range+0xa6e/0x1540 mm/vmalloc.c:3316
 __vmalloc_node mm/vmalloc.c:3381 [inline]
 vzalloc+0x6b/0x80 mm/vmalloc.c:3454
 bpf_check+0x205/0xaab0 kernel/bpf/verifier.c:19416
 bpf_prog_load+0x153a/0x2270 kernel/bpf/syscall.c:2707
 __sys_bpf+0xb8a/0x4e20 kernel/bpf/syscall.c:5137
 __do_sys_bpf kernel/bpf/syscall.c:5241 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5239 [inline]
 __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5239
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1161 [inline]
 free_unref_page_prepare+0x508/0xb90 mm/page_alloc.c:2348
 free_unref_page+0x33/0x3b0 mm/page_alloc.c:2443
 vfree+0x181/0x7a0 mm/vmalloc.c:2842
 bpf_check+0x11e1/0xaab0 kernel/bpf/verifier.c:19626
 bpf_prog_load+0x153a/0x2270 kernel/bpf/syscall.c:2707
 __sys_bpf+0xb8a/0x4e20 kernel/bpf/syscall.c:5137
 __do_sys_bpf kernel/bpf/syscall.c:5241 [inline]
 __se_sys_bpf kernel/bpf/syscall.c:5239 [inline]
 __x64_sys_bpf+0x78/0xc0 kernel/bpf/syscall.c:5239
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Memory state around the buggy address:
 ffff88803fca9a00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88803fca9a80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff88803fca9b00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                 ^
 ffff88803fca9b80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff88803fca9c00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
vkms_vblank_simulate: vblank timer overrun
----------------
Code disassembly (best guess):
   0:	81 fd 00 04 00 00    	cmp    $0x400,%ebp
   6:	0f 87 2a 01 00 00    	ja     0x136
   c:	e8 37 5a 68 f9       	call   0xf9685a48
  11:	48 8d 7b 50          	lea    0x50(%rbx),%rdi
  15:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  1c:	fc ff df
  1f:	48 89 fa             	mov    %rdi,%rdx
  22:	48 c1 ea 03          	shr    $0x3,%rdx
  26:	80 3c 02 00          	cmpb   $0x0,(%rdx,%rax,1)
* 2a:	0f 85 26 01 00 00    	jne    0x156 <-- trapping instruction
  30:	48 8d 7b 58          	lea    0x58(%rbx),%rdi
  34:	48 c7 43 50 00 00 00 	movq   $0x0,0x50(%rbx)
  3b:	00
  3c:	48                   	rex.W
  3d:	b8                   	.byte 0xb8