==================================================================
BUG: KASAN: slab-out-of-bounds in pfkey_sadb2xfrm_user_sec_ctx net/key/af_key.c:474 [inline] at addr ffff8801cf1ef158
BUG: KASAN: slab-out-of-bounds in pfkey_compile_policy+0x8e6/0xd40 net/key/af_key.c:3306 at addr ffff8801cf1ef158
Read of size 1280 by task syzkaller254444/3327
CPU: 1 PID: 3327 Comm: syzkaller254444 Not tainted 4.9.67-gf26d3c7 #2
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801cb7677d8 ffffffff81d906e9 ffff8801da0013c0 ffff8801cf1ef140
 ffff8801cf1ef240 ffffed0039e3de40 ffff8801cf1ef158 ffff8801cb767800
 ffffffff8153a2cc ffffed0039e3de40 ffff8801da0013c0 0000000000000000
Call Trace:
 [<ffffffff81d906e9>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d906e9>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff8153a2cc>] kasan_object_err+0x1c/0x70 mm/kasan/report.c:160
 [<ffffffff8153a58c>] print_address_description mm/kasan/report.c:198 [inline]
 [<ffffffff8153a58c>] kasan_report_error mm/kasan/report.c:287 [inline]
 [<ffffffff8153a58c>] kasan_report.part.1+0x21c/0x500 mm/kasan/report.c:309
 [<ffffffff8153ab51>] kasan_report+0x21/0x30 mm/kasan/report.c:310
 [<ffffffff81539497>] check_memory_region_inline mm/kasan/kasan.c:308 [inline]
 [<ffffffff81539497>] check_memory_region+0x137/0x190 mm/kasan/kasan.c:315
 [<ffffffff81539993>] memcpy+0x23/0x50 mm/kasan/kasan.c:350
 [<ffffffff83574016>] pfkey_sadb2xfrm_user_sec_ctx net/key/af_key.c:474 [inline]
 [<ffffffff83574016>] pfkey_compile_policy+0x8e6/0xd40 net/key/af_key.c:3306
 [<ffffffff833ccfbe>] xfrm_user_policy+0x2fe/0x530 net/xfrm/xfrm_state.c:1907
 [<ffffffff83207417>] do_ip_setsockopt.isra.12+0x1977/0x2960 net/ipv4/ip_sockglue.c:1151
 [<ffffffff832084ff>] compat_ip_setsockopt+0x4f/0xf0 net/ipv4/ip_sockglue.c:1269
 [<ffffffff83211e65>] inet_csk_compat_setsockopt+0x95/0x120 net/ipv4/inet_connection_sock.c:914
 [<ffffffff832281fd>] compat_tcp_setsockopt+0x3d/0x70 net/ipv4/tcp.c:2747
 [<ffffffff82ed5352>] compat_sock_common_setsockopt+0xb2/0x140 net/core/sock.c:2717
 [<ffffffff82fd4989>] C_SYSC_setsockopt net/compat.c:398 [inline]
 [<ffffffff82fd4989>] compat_SyS_setsockopt+0x149/0x290 net/compat.c:381
 [<ffffffff81006fc7>] do_syscall_32_irqs_on arch/x86/entry/common.c:322 [inline]
 [<ffffffff81006fc7>] do_fast_syscall_32+0x2f7/0x890 arch/x86/entry/common.c:384
 [<ffffffff838aafe1>] entry_SYSENTER_compat+0x51/0x60 arch/x86/entry/entry_64_compat.S:124
Object at ffff8801cf1ef140, in cache kmalloc-256 size: 256
Allocated:
PID = 3327
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack+0x43/0xd0 mm/kasan/kasan.c:495
 set_track mm/kasan/kasan.c:507 [inline]
 kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:598
 __kmalloc+0x11d/0x310 mm/slub.c:3741
 kmalloc include/linux/slab.h:495 [inline]
 xfrm_user_policy+0xc1/0x530 net/xfrm/xfrm_state.c:1896
 do_ip_setsockopt.isra.12+0x1977/0x2960 net/ipv4/ip_sockglue.c:1151
 compat_ip_setsockopt+0x4f/0xf0 net/ipv4/ip_sockglue.c:1269
 inet_csk_compat_setsockopt+0x95/0x120 net/ipv4/inet_connection_sock.c:914
 compat_tcp_setsockopt+0x3d/0x70 net/ipv4/tcp.c:2747
 compat_sock_common_setsockopt+0xb2/0x140 net/core/sock.c:2717
 C_SYSC_setsockopt net/compat.c:398 [inline]
 compat_SyS_setsockopt+0x149/0x290 net/compat.c:381
 do_syscall_32_irqs_on arch/x86/entry/common.c:322 [inline]
 do_fast_syscall_32+0x2f7/0x890 arch/x86/entry/common.c:384
 entry_SYSENTER_compat+0x51/0x60 arch/x86/entry/entry_64_compat.S:124
Freed:
PID = 2996
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack+0x43/0xd0 mm/kasan/kasan.c:495
 set_track mm/kasan/kasan.c:507 [inline]
 kasan_slab_free+0x73/0xc0 mm/kasan/kasan.c:571
 slab_free_hook mm/slub.c:1355 [inline]
 slab_free_freelist_hook mm/slub.c:1377 [inline]
 slab_free mm/slub.c:2958 [inline]
 kfree+0xf0/0x2f0 mm/slub.c:3878
 free_bprm+0x19d/0x200 fs/exec.c:1395
 do_execveat_common.isra.37+0x17df/0x1f10 fs/exec.c:1795
 do_execve fs/exec.c:1830 [inline]
 SYSC_execve fs/exec.c:1911 [inline]
 SyS_execve+0x42/0x50 fs/exec.c:1906
 do_syscall_64+0x197/0x490 arch/x86/entry/common.c:280
 return_from_SYSCALL_64+0x0/0x7a
Memory state around the buggy address:
 ffff8801cf1ef100: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
 ffff8801cf1ef180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8801cf1ef200: 02 fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                   ^
 ffff8801cf1ef280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8801cf1ef300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
======================================