==================================================================
BUG: KASAN: slab-use-after-free in decode_session6+0x10e1/0x1950 net/xfrm/xfrm_policy.c:3460
Read of size 1 at addr ffff8880805361d2 by task syz-executor.3/5751

CPU: 1 PID: 5751 Comm: syz-executor.3 Not tainted 6.5.0-rc6-syzkaller-00036-g4853c74bd7ab #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/26/2023
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xd9/0x1b0 lib/dump_stack.c:106
 print_address_description mm/kasan/report.c:364 [inline]
 print_report+0xc4/0x620 mm/kasan/report.c:475
 kasan_report+0xda/0x110 mm/kasan/report.c:588
 decode_session6+0x10e1/0x1950 net/xfrm/xfrm_policy.c:3460
 __xfrm_decode_session+0x54/0xb0 net/xfrm/xfrm_policy.c:3566
 xfrm_decode_session include/net/xfrm.h:1216 [inline]
 xfrmi_xmit+0x17c/0x1ca0 net/xfrm/xfrm_interface_core.c:540
 __netdev_start_xmit include/linux/netdevice.h:4910 [inline]
 netdev_start_xmit include/linux/netdevice.h:4924 [inline]
 xmit_one net/core/dev.c:3537 [inline]
 dev_hard_start_xmit+0x13d/0x6c0 net/core/dev.c:3553
 sch_direct_xmit+0x1ac/0xc20 net/sched/sch_generic.c:342
 qdisc_restart net/sched/sch_generic.c:407 [inline]
 __qdisc_run+0x540/0x19d0 net/sched/sch_generic.c:415
 __dev_xmit_skb net/core/dev.c:3827 [inline]
 __dev_queue_xmit+0x26ab/0x3f20 net/core/dev.c:4169
 dev_queue_xmit include/linux/netdevice.h:3088 [inline]
 neigh_connected_output+0x42c/0x5d0 net/core/neighbour.c:1581
 neigh_output include/net/neighbour.h:544 [inline]
 ip6_finish_output2+0x5d0/0x1b20 net/ipv6/ip6_output.c:135
 __ip6_finish_output net/ipv6/ip6_output.c:196 [inline]
 ip6_finish_output+0x485/0x11d0 net/ipv6/ip6_output.c:207
 NF_HOOK_COND include/linux/netfilter.h:292 [inline]
 ip6_output+0x243/0x890 net/ipv6/ip6_output.c:228
 dst_output include/net/dst.h:458 [inline]
 NF_HOOK.constprop.0+0xfd/0x540 include/linux/netfilter.h:303
 ndisc_send_skb+0x9e8/0x1430 net/ipv6/ndisc.c:509
 ndisc_send_rs+0x133/0x690 net/ipv6/ndisc.c:719
 addrconf_rs_timer+0x412/0x840 net/ipv6/addrconf.c:3941
 call_timer_fn+0x1a0/0x580 kernel/time/timer.c:1700
 expire_timers kernel/time/timer.c:1751 [inline]
 __run_timers+0x764/0xb10 kernel/time/timer.c:2022
 run_timer_softirq+0x58/0xd0 kernel/time/timer.c:2035
 __do_softirq+0x218/0x965 kernel/softirq.c:553
 invoke_softirq kernel/softirq.c:427 [inline]
 __irq_exit_rcu kernel/softirq.c:632 [inline]
 irq_exit_rcu+0xb7/0x120 kernel/softirq.c:644
 sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1109
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:645
RIP: 0010:lock_acquire+0x1ef/0x510 kernel/locking/lockdep.c:5729
Code: c1 05 d5 6e 9b 7e 83 f8 01 0f 85 b0 02 00 00 9c 58 f6 c4 02 0f 85 9b 02 00 00 48 85 ed 74 01 fb 48 b8 00 00 00 00 00 fc ff df <48> 01 c3 48 c7 03 00 00 00 00 48 c7 43 08 00 00 00 00 48 8b 84 24
RSP: 0018:ffffc9000b6bf270 EFLAGS: 00000206
RAX: dffffc0000000000 RBX: 1ffff920016d7e50 RCX: 0000000000000001
RDX: 1ffff1100547a158 RSI: ffffffff8a6c83a0 RDI: ffffffff8ac81200
RBP: 0000000000000200 R08: 0000000000000000 R09: fffffbfff2309dd0
R10: ffffffff9184ee87 R11: 0000000000094000 R12: 0000000000000000
R13: 0000000000000000 R14: ffffffff8c9a7400 R15: 0000000000000000
 rcu_lock_acquire include/linux/rcupdate.h:303 [inline]
 rcu_read_lock include/linux/rcupdate.h:749 [inline]
 page_ext_get+0x3c/0x310 mm/page_ext.c:167
 __page_table_check_zero+0x139/0x5e0 mm/page_table_check.c:142
 prep_new_page mm/page_alloc.c:1577 [inline]
 get_page_from_freelist+0x10a9/0x31e0 mm/page_alloc.c:3221
 __alloc_pages+0x1d0/0x4a0 mm/page_alloc.c:4477
 alloc_pages+0x1a9/0x270 mm/mempolicy.c:2292
 __pte_alloc_one include/asm-generic/pgalloc.h:63 [inline]
 pte_alloc_one+0x1a/0x240 arch/x86/mm/pgtable.c:33
 __pte_alloc+0x6e/0x270 mm/memory.c:440
 copy_pte_range mm/memory.c:1028 [inline]
 copy_pmd_range mm/memory.c:1167 [inline]
 copy_pud_range mm/memory.c:1204 [inline]
 copy_p4d_range mm/memory.c:1228 [inline]
 copy_page_range+0x1f9b/0x3dd0 mm/memory.c:1326
 dup_mmap+0x1376/0x1c70 kernel/fork.c:758
 dup_mm kernel/fork.c:1689 [inline]
 copy_mm kernel/fork.c:1738 [inline]
 copy_process+0x6c11/0x7400 kernel/fork.c:2504
 kernel_clone+0xfd/0x8f0 kernel/fork.c:2912
 __do_sys_clone+0xba/0x100 kernel/fork.c:3055
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f053c279b13
Code: 1f 84 00 00 00 00 00 64 48 8b 04 25 10 00 00 00 45 31 c0 31 d2 31 f6 bf 11 00 20 01 4c 8d 90 d0 02 00 00 b8 38 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 35 89 c2 85 c0 75 2c 64 48 8b 04 25 10 00 00
RSP: 002b:00007f053c4bfc58 EFLAGS: 00000246 ORIG_RAX: 0000000000000038
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f053c279b13
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000001200011
RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000
R10: 00005555571cd750 R11: 0000000000000246 R12: 0000000000000000
R13: 0000000000000000 R14: 0000000000000001 R15: 0000000000000001
 </TASK>

Allocated by task 4480:
 kasan_save_stack+0x33/0x50 mm/kasan/common.c:45
 kasan_set_track+0x25/0x30 mm/kasan/common.c:52
 __kasan_slab_alloc+0x81/0x90 mm/kasan/common.c:328
 kasan_slab_alloc include/linux/kasan.h:186 [inline]
 slab_post_alloc_hook mm/slab.h:762 [inline]
 slab_alloc_node mm/slub.c:3470 [inline]
 slab_alloc mm/slub.c:3478 [inline]
 __kmem_cache_alloc_lru mm/slub.c:3485 [inline]
 kmem_cache_alloc+0x172/0x3b0 mm/slub.c:3494
 getname_flags.part.0+0x50/0x4d0 fs/namei.c:140
 getname_flags+0x9c/0xf0 include/linux/audit.h:319
 vfs_fstatat+0x77/0xb0 fs/stat.c:275
 __do_sys_newfstatat+0x98/0x110 fs/stat.c:446
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Freed by task 4480:
 kasan_save_stack+0x33/0x50 mm/kasan/common.c:45
 kasan_set_track+0x25/0x30 mm/kasan/common.c:52
 kasan_save_free_info+0x2b/0x40 mm/kasan/generic.c:522
 ____kasan_slab_free mm/kasan/common.c:236 [inline]
 ____kasan_slab_free+0x15e/0x1b0 mm/kasan/common.c:200
 kasan_slab_free include/linux/kasan.h:162 [inline]
 slab_free_hook mm/slub.c:1792 [inline]
 slab_free_freelist_hook+0x10b/0x1e0 mm/slub.c:1818
 slab_free mm/slub.c:3801 [inline]
 kmem_cache_free+0xf0/0x490 mm/slub.c:3823
 putname fs/namei.c:273 [inline]
 putname+0x101/0x140 fs/namei.c:259
 vfs_fstatat+0x9a/0xb0 fs/stat.c:277
 __do_sys_newfstatat+0x98/0x110 fs/stat.c:446
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

The buggy address belongs to the object at ffff888080535500
 which belongs to the cache names_cache of size 4096
The buggy address is located 3282 bytes inside of
 freed 4096-byte region [ffff888080535500, ffff888080536500)

The buggy address belongs to the physical page:
page:ffffea0002014c00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x80530
head:ffffea0002014c00 order:3 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: 0xffffffff()
raw: 00fff00000010200 ffff888014675780 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000070007 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 4480, tgid 4480 (udevd), ts 2143924674526, free_ts 2143912783218
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook+0x2d2/0x350 mm/page_alloc.c:1570
 prep_new_page mm/page_alloc.c:1577 [inline]
 get_page_from_freelist+0x10a9/0x31e0 mm/page_alloc.c:3221
 __alloc_pages+0x1d0/0x4a0 mm/page_alloc.c:4477
 alloc_pages+0x1a9/0x270 mm/mempolicy.c:2292
 alloc_slab_page mm/slub.c:1862 [inline]
 allocate_slab+0x24e/0x380 mm/slub.c:2009
 new_slab mm/slub.c:2062 [inline]
 ___slab_alloc+0x8bc/0x1570 mm/slub.c:3215
 __slab_alloc.constprop.0+0x56/0xa0 mm/slub.c:3314
 __slab_alloc_node mm/slub.c:3367 [inline]
 slab_alloc_node mm/slub.c:3460 [inline]
 slab_alloc mm/slub.c:3478 [inline]
 __kmem_cache_alloc_lru mm/slub.c:3485 [inline]
 kmem_cache_alloc+0x392/0x3b0 mm/slub.c:3494
 getname_flags.part.0+0x50/0x4d0 fs/namei.c:140
 getname_flags+0x9c/0xf0 include/linux/audit.h:319
 user_path_at_empty+0x2c/0x60 fs/namei.c:2906
 do_readlinkat+0xdd/0x2f0 fs/stat.c:477
 __do_sys_readlink fs/stat.c:510 [inline]
 __se_sys_readlink fs/stat.c:507 [inline]
 __x64_sys_readlink+0x78/0xb0 fs/stat.c:507
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1161 [inline]
 free_unref_page_prepare+0x508/0xb90 mm/page_alloc.c:2348
 free_unref_page+0x33/0x3b0 mm/page_alloc.c:2443
 __unfreeze_partials+0x21d/0x240 mm/slub.c:2647
 qlink_free mm/kasan/quarantine.c:166 [inline]
 qlist_free_all+0x6a/0x170 mm/kasan/quarantine.c:185
 kasan_quarantine_reduce+0x18b/0x1d0 mm/kasan/quarantine.c:292
 __kasan_slab_alloc+0x65/0x90 mm/kasan/common.c:305
 kasan_slab_alloc include/linux/kasan.h:186 [inline]
 slab_post_alloc_hook mm/slab.h:762 [inline]
 slab_alloc_node mm/slub.c:3470 [inline]
 slab_alloc mm/slub.c:3478 [inline]
 __kmem_cache_alloc_lru mm/slub.c:3485 [inline]
 kmem_cache_alloc+0x172/0x3b0 mm/slub.c:3494
 getname_flags.part.0+0x50/0x4d0 fs/namei.c:140
 getname_flags+0x9c/0xf0 include/linux/audit.h:319
 user_path_at_empty+0x2c/0x60 fs/namei.c:2906
 user_path_at include/linux/namei.h:57 [inline]
 ksys_umount fs/namespace.c:1914 [inline]
 __do_sys_umount fs/namespace.c:1922 [inline]
 __se_sys_umount fs/namespace.c:1920 [inline]
 __x64_sys_umount+0x10e/0x1a0 fs/namespace.c:1920
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x38/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

Memory state around the buggy address:
 ffff888080536080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888080536100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888080536180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                                                 ^
 ffff888080536200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888080536280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
----------------
Code disassembly (best guess):
   0:	c1 05 d5 6e 9b 7e 83 	roll   $0x83,0x7e9b6ed5(%rip)        # 0x7e9b6edc
   7:	f8                   	clc
   8:	01 0f                	add    %ecx,(%rdi)
   a:	85 b0 02 00 00 9c    	test   %esi,-0x63fffffe(%rax)
  10:	58                   	pop    %rax
  11:	f6 c4 02             	test   $0x2,%ah
  14:	0f 85 9b 02 00 00    	jne    0x2b5
  1a:	48 85 ed             	test   %rbp,%rbp
  1d:	74 01                	je     0x20
  1f:	fb                   	sti
  20:	48 b8 00 00 00 00 00 	movabs $0xdffffc0000000000,%rax
  27:	fc ff df
* 2a:	48 01 c3             	add    %rax,%rbx <-- trapping instruction
  2d:	48 c7 03 00 00 00 00 	movq   $0x0,(%rbx)
  34:	48 c7 43 08 00 00 00 	movq   $0x0,0x8(%rbx)
  3b:	00
  3c:	48                   	rex.W
  3d:	8b                   	.byte 0x8b
  3e:	84                   	.byte 0x84
  3f:	24                   	.byte 0x24