================================================================== BUG: KASAN: stack-out-of-bounds in deref_stack_reg+0x1b8/0x1d0 Read of size 8 at addr ffff8801bf3f7748 by task sh/17569 CPU: 1 PID: 17569 Comm: sh Not tainted 4.14.0-rc5-next-20171017+ #34 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: dump_stack+0x173/0x237 print_address_description+0x6e/0x250 kasan_report+0x251/0x340 deref_stack_reg+0x1b8/0x1d0 unwind_next_frame+0xebc/0x1df0 __save_stack_trace+0x6e/0xd0 save_stack+0x32/0xb0 kasan_slab_free+0x71/0xc0 kfree+0xc8/0x250 security_sk_free+0x42/0x80 __sk_destruct+0x601/0x8a0 sk_destruct+0x43/0x70 __sk_free+0x52/0x220 sk_free+0x26/0x30 deferred_put_nlk_sk+0x138/0x2f0 rcu_process_callbacks+0xcd4/0x1600 __do_softirq+0x2ba/0xafb irq_exit+0x1c7/0x200 smp_apic_timer_interrupt+0x154/0x6b0 apic_timer_interrupt+0x96/0xa0 RIP: 0010:lock_is_held_type+0x84/0x200 RSP: 0018:ffff8801bf3f75d0 EFLAGS: 00000282 ORIG_RAX: ffffffffffffff11 RAX: dffffc0000000000 RBX: ffff8801c1b68640 RCX: 0000000000000000 RDX: 1ffffffff0ad8f50 RSI: 00000000ffffffff RDI: ffffffff856c7a80 RBP: ffff8801dac78680 R08: 0000000000000002 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: ffffffff85737c60 R13: ffffffff81941e63 R14: ffff8801c7ad81f0 R15: ffff8801c7ad81f8 unlink_anon_vmas+0x533/0x900 The buggy address belongs to the page: page:ffffea0006fcfdc0 count:0 mapcount:0 mapping: (null) index:0x0 flags: 0x200000000000000() raw: 0200000000000000 0000000000000000 0000000000000000 00000000ffffffff raw: 0000000000000000 0000000100000001 0000000000000000 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8801bf3f7600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 ffff8801bf3f7680: f1 f1 f1 f8 f2 f2 f2 f2 f2 f2 f2 00 f2 f2 f2 f2 >ffff8801bf3f7700: f2 f2 f2 f8 f2 f2 f2 f3 f3 f3 f3 00 00 00 00 00 ^ ffff8801bf3f7780: 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 ffff8801bf3f7800: f1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================