================================================================== BUG: KASAN: use-after-free in memcpy include/linux/string.h:377 [inline] BUG: KASAN: use-after-free in memcpy_dir crypto/scatterwalk.c:28 [inline] BUG: KASAN: use-after-free in scatterwalk_copychunks+0x271/0x6a0 crypto/scatterwalk.c:43 Read of size 4096 at addr ffff8880357e0000 by task syz-executor.0/19948 CPU: 0 PID: 19948 Comm: syz-executor.0 Not tainted 4.19.211-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/12/2023 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x1fc/0x2ef lib/dump_stack.c:118 print_address_description.cold+0x54/0x219 mm/kasan/report.c:256 kasan_report_error.cold+0x8a/0x1b9 mm/kasan/report.c:354 kasan_report+0x8f/0xa0 mm/kasan/report.c:412 memcpy+0x20/0x50 mm/kasan/kasan.c:302 memcpy include/linux/string.h:377 [inline] memcpy_dir crypto/scatterwalk.c:28 [inline] scatterwalk_copychunks+0x271/0x6a0 crypto/scatterwalk.c:43 scatterwalk_map_and_copy crypto/scatterwalk.c:72 [inline] scatterwalk_map_and_copy+0x121/0x1a0 crypto/scatterwalk.c:60 gcmaes_encrypt.constprop.0+0x760/0xd90 arch/x86/crypto/aesni-intel_glue.c:956 TCP: request_sock_TCPv6: Possible SYN flooding on port 20002. Sending cookies. Check SNMP counters. The buggy address belongs to the page: page:ffffea0000d5f800 count:0 mapcount:-128 mapping:0000000000000000 index:0x1 flags: 0xfff00000000000() raw: 00fff00000000000 ffffea0000d88808 ffffea0000d63808 0000000000000000 raw: 0000000000000001 0000000000000005 00000000ffffff7f 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8880357dff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8880357dff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff8880357e0000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff8880357e0080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff8880357e0100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ==================================================================