==================================================================
BUG: KASAN: slab-out-of-bounds in dsa_user_to_port net/dsa/user.h:58 [inline]
BUG: KASAN: slab-out-of-bounds in dsa_user_changeupper+0x3bc/0x49c net/dsa/user.c:2809
Read of size 8 at addr ffff00000aef2c70 by task syz-executor.1/6478

CPU: 1 PID: 6478 Comm: syz-executor.1 Not tainted 6.7.0-syzkaller-11705-gb0d326da462e #0
Hardware name: linux,dummy-virt (DT)
Call trace:
 dump_backtrace+0x9c/0x11c arch/arm64/kernel/stacktrace.c:291
 show_stack+0x18/0x24 arch/arm64/kernel/stacktrace.c:298
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x74/0xd4 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:377 [inline]
 print_report+0xd8/0x598 mm/kasan/report.c:488
 kasan_report+0xc8/0x108 mm/kasan/report.c:601
 __asan_report_load8_noabort+0x20/0x2c mm/kasan/report_generic.c:381
 dsa_user_to_port net/dsa/user.h:58 [inline]
 dsa_user_changeupper+0x3bc/0x49c net/dsa/user.c:2809
 dsa_user_netdevice_event+0xb68/0x1ef0 net/dsa/user.c:3345
 notifier_call_chain+0x134/0x3f4 kernel/notifier.c:93
 raw_notifier_call_chain+0x18/0x24 kernel/notifier.c:461
 call_netdevice_notifiers_info+0x88/0xe8 net/core/dev.c:1966
 __netdev_upper_dev_link+0x2c8/0x598 net/core/dev.c:7759
 netdev_upper_dev_link+0x80/0xb0 net/core/dev.c:7800
 register_vlan_dev+0x270/0x69c net/8021q/vlan.c:183
 register_vlan_device net/8021q/vlan.c:277 [inline]
 vlan_ioctl_handler+0x58c/0x918 net/8021q/vlan.c:621
 sock_ioctl+0x434/0x5dc net/socket.c:1305
 vfs_ioctl fs/ioctl.c:51 [inline]
 __do_sys_ioctl fs/ioctl.c:871 [inline]
 __se_sys_ioctl fs/ioctl.c:857 [inline]
 __arm64_sys_ioctl+0x124/0x190 fs/ioctl.c:857
 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]
 invoke_syscall+0x6c/0x258 arch/arm64/kernel/syscall.c:51
 el0_svc_common.constprop.0+0xac/0x230 arch/arm64/kernel/syscall.c:136
 do_el0_svc+0x40/0x58 arch/arm64/kernel/syscall.c:155
 el0_svc+0x58/0x140 arch/arm64/kernel/entry-common.c:678
 el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:696
 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:595

Allocated by task 3158:
 kasan_save_stack+0x3c/0x64 mm/kasan/common.c:47
 kasan_save_track+0x20/0x3c mm/kasan/common.c:68
 kasan_save_alloc_info+0x68/0x78 mm/kasan/generic.c:626
 poison_kmalloc_redzone mm/kasan/common.c:372 [inline]
 __kasan_kmalloc+0xb8/0xbc mm/kasan/common.c:389
 kasan_kmalloc include/linux/kasan.h:211 [inline]
 __do_kmalloc_node mm/slub.c:3981 [inline]
 __kmalloc_node+0x1e0/0x420 mm/slub.c:3988
 kmalloc_node include/linux/slab.h:610 [inline]
 kvmalloc_node+0x1c/0x144 mm/util.c:617
 kvmalloc include/linux/slab.h:728 [inline]
 kvzalloc include/linux/slab.h:736 [inline]
 alloc_netdev_mqs+0x6c/0xe08 net/core/dev.c:10826
 rtnl_create_link+0x900/0xbc8 net/core/rtnetlink.c:3379
 rtnl_newlink_create net/core/rtnetlink.c:3505 [inline]
 __rtnl_newlink+0xac4/0x11e0 net/core/rtnetlink.c:3735
 rtnl_newlink+0x6c/0xa4 net/core/rtnetlink.c:3748
 rtnetlink_rcv_msg+0x2e8/0x870 net/core/rtnetlink.c:6615
 netlink_rcv_skb+0x18c/0x330 net/netlink/af_netlink.c:2543
 rtnetlink_rcv+0x18/0x24 net/core/rtnetlink.c:6633
 netlink_unicast_kernel net/netlink/af_netlink.c:1341 [inline]
 netlink_unicast+0x3bc/0x660 net/netlink/af_netlink.c:1367
 netlink_sendmsg+0x654/0xa40 net/netlink/af_netlink.c:1908
 sock_sendmsg_nosec net/socket.c:730 [inline]
 __sock_sendmsg+0xc8/0x168 net/socket.c:745
 __sys_sendto+0x1a8/0x254 net/socket.c:2191
 __do_sys_sendto net/socket.c:2203 [inline]
 __se_sys_sendto net/socket.c:2199 [inline]
 __arm64_sys_sendto+0xc0/0x134 net/socket.c:2199
 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]
 invoke_syscall+0x6c/0x258 arch/arm64/kernel/syscall.c:51
 el0_svc_common.constprop.0+0xac/0x230 arch/arm64/kernel/syscall.c:136
 do_el0_svc+0x40/0x58 arch/arm64/kernel/syscall.c:155
 el0_svc+0x58/0x140 arch/arm64/kernel/entry-common.c:678
 el0t_64_sync_handler+0x100/0x12c arch/arm64/kernel/entry-common.c:696
 el0t_64_sync+0x190/0x194 arch/arm64/kernel/entry.S:595

The buggy address belongs to the object at ffff00000aef2000
 which belongs to the cache kmalloc-cg-4k of size 4096
The buggy address is located 1 bytes to the right of
 allocated 3183-byte region [ffff00000aef2000, ffff00000aef2c6f)

The buggy address belongs to the physical page:
page:000000007668eddb refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x4aef0
head:000000007668eddb order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0x1ffc00000000840(slab|head|node=0|zone=0|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 01ffc00000000840 ffff000009c0f500 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000040004 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff00000aef2b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff00000aef2b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff00000aef2c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 07 fc fc
                                                             ^
 ffff00000aef2c80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff00000aef2d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=6478 comm=syz-executor.1