================================================================== BUG: KASAN: slab-out-of-bounds in decode_session6 net/xfrm/xfrm_policy.c:3389 [inline] BUG: KASAN: slab-out-of-bounds in __xfrm_decode_session+0x1cfb/0x2e90 net/xfrm/xfrm_policy.c:3481 Read of size 1 at addr ffff888041e07f99 by task syz-executor.5/19320 CPU: 1 PID: 19320 Comm: syz-executor.5 Not tainted 5.7.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x188/0x20d lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xd3/0x413 mm/kasan/report.c:383 __kasan_report mm/kasan/report.c:513 [inline] kasan_report.cold+0x1f/0x37 mm/kasan/report.c:530 decode_session6 net/xfrm/xfrm_policy.c:3389 [inline] __xfrm_decode_session+0x1cfb/0x2e90 net/xfrm/xfrm_policy.c:3481 xfrm_decode_session include/net/xfrm.h:1133 [inline] vti6_tnl_xmit+0x5b8/0x1d30 net/ipv6/ip6_vti.c:577 __netdev_start_xmit include/linux/netdevice.h:4607 [inline] netdev_start_xmit include/linux/netdevice.h:4621 [inline] xmit_one net/core/dev.c:3545 [inline] dev_hard_start_xmit+0x1a4/0x9b0 net/core/dev.c:3561 sch_direct_xmit+0x345/0xc20 net/sched/sch_generic.c:313 qdisc_restart net/sched/sch_generic.c:376 [inline] __qdisc_run+0x4d1/0x17b0 net/sched/sch_generic.c:384 __dev_xmit_skb net/core/dev.c:3784 [inline] __dev_queue_xmit+0x165b/0x30a0 net/core/dev.c:4089 neigh_output include/net/neighbour.h:510 [inline] ip6_finish_output2+0x1091/0x25b0 net/ipv6/ip6_output.c:117 __ip6_finish_output+0x442/0xab0 net/ipv6/ip6_output.c:143 ip6_finish_output+0x34/0x1f0 net/ipv6/ip6_output.c:153 NF_HOOK_COND include/linux/netfilter.h:296 [inline] ip6_output+0x239/0x810 net/ipv6/ip6_output.c:176 dst_output include/net/dst.h:435 [inline] NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] mld_sendpack+0x961/0xdf0 net/ipv6/mcast.c:1679 mld_send_cr net/ipv6/mcast.c:1975 [inline] mld_ifc_timer_expire+0x42e/0x920 net/ipv6/mcast.c:2474 call_timer_fn+0x1ac/0x780 kernel/time/timer.c:1404 expire_timers kernel/time/timer.c:1449 [inline] __run_timers kernel/time/timer.c:1773 [inline] __run_timers kernel/time/timer.c:1740 [inline] run_timer_softirq+0x623/0x1600 kernel/time/timer.c:1786 __do_softirq+0x26c/0x9f7 kernel/softirq.c:292 invoke_softirq kernel/softirq.c:373 [inline] irq_exit+0x192/0x1d0 kernel/softirq.c:413 exiting_irq arch/x86/include/asm/apic.h:546 [inline] smp_apic_timer_interrupt+0x19e/0x600 arch/x86/kernel/apic/apic.c:1107 apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:829 RIP: 0010:arch_local_irq_restore arch/x86/include/asm/paravirt.h:759 [inline] RIP: 0010:console_unlock+0xba8/0xf00 kernel/printk/printk.c:2523 Code: 89 48 c1 e8 03 42 80 3c 38 00 0f 85 36 03 00 00 48 83 3d ea e3 37 08 00 0f 84 8e 01 00 00 e8 0f c4 16 00 48 8b 7c 24 28 57 9d <0f> 1f 44 00 00 eb 88 e8 fc c3 16 00 c7 05 62 e2 0c 0b 00 00 00 00 RSP: 0018:ffffc9000774fa40 EFLAGS: 00000212 ORIG_RAX: ffffffffffffff13 RAX: 0000000000040000 RBX: 0000000000000200 RCX: ffffc90013b1c000 RDX: 000000000001b687 RSI: ffffffff815ccde1 RDI: 0000000000000212 RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000001 R10: ffffffff8c31d9a7 R11: fffffbfff1863b34 R12: ffffffff84b81fd0 R13: ffffffff8a18d330 R14: 0000000000000041 R15: dffffc0000000000 vprintk_emit+0x2c4/0x730 kernel/printk/printk.c:2032 vprintk_func+0x8f/0x1a6 kernel/printk/printk_safe.c:386 printk+0xba/0xed kernel/printk/printk.c:2092 __ip_vs_ftp_init.cold+0x5b/0x6a net/netfilter/ipvs/ip_vs_ftp.c:594 ops_init+0xaf/0x420 net/core/net_namespace.c:151 setup_net+0x2de/0x860 net/core/net_namespace.c:341 copy_net_ns+0x293/0x590 net/core/net_namespace.c:482 create_new_namespaces+0x3fb/0xb30 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0xbd/0x1f0 kernel/nsproxy.c:231 ksys_unshare+0x43d/0x8e0 kernel/fork.c:2984 __do_sys_unshare kernel/fork.c:3052 [inline] __se_sys_unshare kernel/fork.c:3050 [inline] __x64_sys_unshare+0x2d/0x40 kernel/fork.c:3050 do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295 entry_SYSCALL_64_after_hwframe+0x49/0xb3 RIP: 0033:0x45ca69 Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f7312368c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000110 RAX: ffffffffffffffda RBX: 000000000050a200 RCX: 000000000045ca69 RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000040000000 RBP: 000000000078bf00 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff R13: 0000000000000c4e R14: 00000000004ce9fd R15: 00007f73123696d4 Allocated by task 18930: save_stack+0x1b/0x40 mm/kasan/common.c:48 set_track mm/kasan/common.c:56 [inline] __kasan_kmalloc mm/kasan/common.c:494 [inline] __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:467 __do_kmalloc mm/slab.c:3656 [inline] __kmalloc_track_caller+0x159/0x7a0 mm/slab.c:3671 kmemdup+0x23/0x50 mm/util.c:127 kmemdup include/linux/string.h:454 [inline] __ip_vs_lblc_init+0x73/0x350 net/netfilter/ipvs/ip_vs_lblc.c:558 ops_init+0xaf/0x420 net/core/net_namespace.c:151 setup_net+0x2de/0x860 net/core/net_namespace.c:341 copy_net_ns+0x293/0x590 net/core/net_namespace.c:482 create_new_namespaces+0x3fb/0xb30 kernel/nsproxy.c:110 unshare_nsproxy_namespaces+0xbd/0x1f0 kernel/nsproxy.c:231 ksys_unshare+0x43d/0x8e0 kernel/fork.c:2984 __do_sys_unshare kernel/fork.c:3052 [inline] __se_sys_unshare kernel/fork.c:3050 [inline] __x64_sys_unshare+0x2d/0x40 kernel/fork.c:3050 do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295 entry_SYSCALL_64_after_hwframe+0x49/0xb3 Freed by task 23938: save_stack+0x1b/0x40 mm/kasan/common.c:48 set_track mm/kasan/common.c:56 [inline] kasan_set_free_info mm/kasan/common.c:316 [inline] __kasan_slab_free+0xf7/0x140 mm/kasan/common.c:455 __cache_free mm/slab.c:3426 [inline] kmem_cache_free_bulk+0x7d/0x280 mm/slab.c:3721 kfree_bulk include/linux/slab.h:412 [inline] kfree_rcu_work+0x1a1/0x480 kernel/rcu/tree.c:3051 process_one_work+0x965/0x16a0 kernel/workqueue.c:2268 worker_thread+0x96/0xe20 kernel/workqueue.c:2414 kthread+0x388/0x470 kernel/kthread.c:268 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:351 The buggy address belongs to the object at ffff888041e07f00 which belongs to the cache kmalloc-128 of size 128 The buggy address is located 25 bytes to the right of 128-byte region [ffff888041e07f00, ffff888041e07f80) The buggy address belongs to the page: page:ffffea00010781c0 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 flags: 0xfffe0000000200(slab) raw: 00fffe0000000200 ffffea00003dce08 ffffea0002593688 ffff8880aa000700 raw: 0000000000000000 ffff888041e07000 0000000100000010 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888041e07e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888041e07f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffff888041e07f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff888041e08000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff888041e08080: 00 00 00 00 00 fc fc fc fc fc fc fc fc 00 00 00 ==================================================================