==================================================================
BUG: KASAN: slab-out-of-bounds in pfkey_msg2xfrm_state net/key/af_key.c:1227 [inline]
BUG: KASAN: slab-out-of-bounds in pfkey_add+0x145d/0x3220 net/key/af_key.c:1506
Read of size 1025 at addr ffff88009fdc2c98 by task syz-executor4/6409

CPU: 0 PID: 6409 Comm: syz-executor4 Not tainted 4.4.135-gb68f27c #54
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 0000000000000000 032f689db6d86451 ffff88009fe5f740 ffffffff81e0ed0d
 ffffea00027f7080 ffff88009fdc2c98 0000000000000000 ffff88009fdc2e80
 ffff88009fdc2c80 ffff88009fe5f778 ffffffff81515946 ffff88009fdc2c98
Call Trace:
 [<ffffffff81e0ed0d>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81e0ed0d>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
 [<ffffffff81515946>] print_address_description+0x6c/0x216 mm/kasan/report.c:252
 [<ffffffff81515c65>] kasan_report_error mm/kasan/report.c:351 [inline]
 [<ffffffff81515c65>] kasan_report.cold.7+0x175/0x2f7 mm/kasan/report.c:408
 [<ffffffff814f86df>] check_memory_region_inline mm/kasan/kasan.c:325 [inline]
 [<ffffffff814f86df>] check_memory_region+0x14f/0x1b0 mm/kasan/kasan.c:332
 [<ffffffff814f8c23>] memcpy+0x23/0x50 mm/kasan/kasan.c:367
 [<ffffffff835876ad>] pfkey_msg2xfrm_state net/key/af_key.c:1227 [inline]
 [<ffffffff835876ad>] pfkey_add+0x145d/0x3220 net/key/af_key.c:1506
 [<ffffffff8358bd41>] pfkey_process+0x671/0x740 net/key/af_key.c:2834
 [<ffffffff8358d576>] pfkey_sendmsg+0x346/0xae0 net/key/af_key.c:3678
 [<ffffffff82f1e15c>] sock_sendmsg_nosec net/socket.c:625 [inline]
 [<ffffffff82f1e15c>] sock_sendmsg+0xcc/0x110 net/socket.c:635
 [<ffffffff82f1fc25>] ___sys_sendmsg+0x745/0x880 net/socket.c:1962
 [<ffffffff82f21cc6>] __sys_sendmsg+0xd6/0x190 net/socket.c:1996
 [<ffffffff82f21dad>] SYSC_sendmsg net/socket.c:2007 [inline]
 [<ffffffff82f21dad>] SyS_sendmsg+0x2d/0x50 net/socket.c:2003
 [<ffffffff838c2765>] entry_SYSCALL_64_fastpath+0x22/0x9e

Allocated by task 6409:
 [<ffffffff810341d6>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63
 [<ffffffff814f8803>] save_stack+0x43/0xd0 mm/kasan/kasan.c:512
 [<ffffffff814f8ae7>] set_track mm/kasan/kasan.c:524 [inline]
 [<ffffffff814f8ae7>] kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:616
 [<ffffffff814f92c4>] kasan_krealloc+0x64/0x80 mm/kasan/kasan.c:654
 [<ffffffff814f24ba>] ksize+0x8a/0xf0 mm/slub.c:3727
 [<ffffffff82f38053>] __alloc_skb+0x133/0x600 net/core/skbuff.c:237
 [<ffffffff8358d32e>] alloc_skb include/linux/skbuff.h:815 [inline]
 [<ffffffff8358d32e>] pfkey_sendmsg+0xfe/0xae0 net/key/af_key.c:3665
 [<ffffffff82f1e15c>] sock_sendmsg_nosec net/socket.c:625 [inline]
 [<ffffffff82f1e15c>] sock_sendmsg+0xcc/0x110 net/socket.c:635
 [<ffffffff82f1fc25>] ___sys_sendmsg+0x745/0x880 net/socket.c:1962
 [<ffffffff82f21cc6>] __sys_sendmsg+0xd6/0x190 net/socket.c:1996
 [<ffffffff82f21dad>] SYSC_sendmsg net/socket.c:2007 [inline]
 [<ffffffff82f21dad>] SyS_sendmsg+0x2d/0x50 net/socket.c:2003
 [<ffffffff838c2765>] entry_SYSCALL_64_fastpath+0x22/0x9e

Freed by task 4577:
 [<ffffffff810341d6>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63
 [<ffffffff814f8803>] save_stack+0x43/0xd0 mm/kasan/kasan.c:512
 [<ffffffff814f9132>] set_track mm/kasan/kasan.c:524 [inline]
 [<ffffffff814f9132>] kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:589
 [<ffffffff814f6634>] slab_free_hook mm/slub.c:1383 [inline]
 [<ffffffff814f6634>] slab_free_freelist_hook mm/slub.c:1405 [inline]
 [<ffffffff814f6634>] slab_free mm/slub.c:2859 [inline]
 [<ffffffff814f6634>] kfree+0xf4/0x310 mm/slub.c:3749
 [<ffffffff82f37134>] skb_free_head net/core/skbuff.c:571 [inline]
 [<ffffffff82f37134>] skb_release_data+0x304/0x3b0 net/core/skbuff.c:602
 [<ffffffff82f3722a>] skb_release_all+0x4a/0x60 net/core/skbuff.c:661
 [<ffffffff82f37833>] __kfree_skb net/core/skbuff.c:675 [inline]
 [<ffffffff82f37833>] consume_skb+0xf3/0x3d0 net/core/skbuff.c:748
 [<ffffffff830b9261>] netlink_unicast_kernel net/netlink/af_netlink.c:1271 [inline]
 [<ffffffff830b9261>] netlink_unicast+0x4f1/0x700 net/netlink/af_netlink.c:1296
 [<ffffffff830b9c05>] netlink_sendmsg+0x795/0xc30 net/netlink/af_netlink.c:1852
 [<ffffffff82f1e15c>] sock_sendmsg_nosec net/socket.c:625 [inline]
 [<ffffffff82f1e15c>] sock_sendmsg+0xcc/0x110 net/socket.c:635
 [<ffffffff82f1ee3c>] SYSC_sendto+0x21c/0x370 net/socket.c:1665
 [<ffffffff82f214c0>] SyS_sendto+0x40/0x50 net/socket.c:1633
 [<ffffffff838c2765>] entry_SYSCALL_64_fastpath+0x22/0x9e

The buggy address belongs to the object at ffff88009fdc2c80
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 24 bytes inside of
 512-byte region [ffff88009fdc2c80, ffff88009fdc2e80)
The buggy address belongs to the page:
swap_dup: Bad swap file entry 7fffc4004fee10
swap_dup: Bad swap file entry 7fffc4004fee11
swap_dup: Bad swap file entry 7fffc4004fee12
swap_dup: Bad swap file entry 7fffc4004fee13
swap_dup: Bad swap file entry 7fffc4004fee14
swap_dup: Bad swap file entry 7fffc4004fee15
swap_dup: Bad swap file entry 7fffc4004fee16
swap_dup: Bad swap file entry 7fffc4004fee17
swap_dup: Bad swap file entry 7fffc4004fee17
syz-executor1 invoked oom-killer: gfp_mask=0x0, order=0, oom_score_adj=0
syz-executor1 cpuset=/ mems_allowed=0
CPU: 1 PID: 6413 Comm: syz-executor1 Not tainted 4.4.135-gb68f27c #54
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 0000000000000000 1eb8b9dd4a24ec91 ffff8800b594fc28 ffffffff81e0ed0d
 ffff8800b594fe38 0000000000000000 0000000000000000 0000000000000000
 ffff8800aca49f70 ffff8800b594fc90 ffffffff815109a9 ffffffff838c1d15
Call Trace:
 [<ffffffff81e0ed0d>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81e0ed0d>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
 [<ffffffff815109a9>] dump_header.isra.12+0x112/0x501 mm/oom_kill.c:393
 [<ffffffff81510db0>] oom_kill_process.cold.17+0x18/0x891 mm/oom_kill.c:534
 [<ffffffff81429d5e>] out_of_memory+0x48e/0xab0 mm/oom_kill.c:727
 [<ffffffff8142a448>] pagefault_out_of_memory+0xc8/0x140 mm/oom_kill.c:758
 [<ffffffff810d75c2>] mm_fault_error+0x142/0x2c0 arch/x86/mm/fault.c:907
 [<ffffffff810d802e>] __do_page_fault+0x8ee/0xa10 arch/x86/mm/fault.c:1273
 [<ffffffff810d8177>] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1308
 [<ffffffff838c3b48>] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1037
Mem-Info:
active_anon:84040 inactive_anon:44 isolated_anon:0
 active_file:3541 inactive_file:10563 isolated_file:0
 unevictable:0 dirty:83 writeback:0 unstable:0
 slab_reclaimable:4714 slab_unreclaimable:61818
 mapped:74255 shmem:50 pagetables:993 bounce:0
 free:1390544 free_pcp:619 free_cma:0
DMA free:15904kB min:160kB low:200kB high:240kB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:15992kB managed:15904kB mlocked:0kB dirty:0kB writeback:0kB mapped:0kB shmem:0kB slab_reclaimable:0kB slab_unreclaimable:0kB kernel_stack:0kB pagetables:0kB unstable:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? yes
lowmem_reserve[]: 0 2908 6409 6409
DMA32 free:2515892kB min:30596kB low:38244kB high:45892kB active_anon:153236kB inactive_anon:128kB active_file:8804kB inactive_file:23768kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:3129292kB managed:2980440kB mlocked:0kB dirty:184kB writeback:0kB mapped:140424kB shmem:144kB slab_reclaimable:9844kB slab_unreclaimable:112032kB kernel_stack:2688kB pagetables:1912kB unstable:0kB bounce:0kB free_pcp:1172kB local_pcp:628kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no
lowmem_reserve[]: 0 0 3500 3500
Normal free:3030380kB min:36820kB low:46024kB high:55228kB active_anon:182924kB inactive_anon:48kB active_file:5360kB inactive_file:18484kB unevictable:0kB isolated(anon):0kB isolated(file):0kB present:4718592kB managed:3584660kB mlocked:0kB dirty:148kB writeback:0kB mapped:156596kB shmem:56kB slab_reclaimable:9012kB slab_unreclaimable:135240kB kernel_stack:3808kB pagetables:2060kB unstable:0kB bounce:0kB free_pcp:1300kB local_pcp:692kB free_cma:0kB writeback_tmp:0kB pages_scanned:0 all_unreclaimable? no
lowmem_reserve[]: 0 0 0 0
DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 2*64kB (U) 1*128kB (U) 1*256kB (U) 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15904kB
DMA32: 193*4kB (UM) 51*8kB (UM) 77*16kB (UME) 9*32kB (UME) 27*64kB (UME) 7*128kB (UM) 9*256kB (UME) 1*512kB (E) 3*1024kB (UME) 3*2048kB (UM) 610*4096kB (M) = 2515916kB
Normal: 133*4kB (UM) 29*8kB (UME) 9*16kB (UME) 31*32kB (UME) 22*64kB (UME) 23*128kB (UME) 13*256kB (UME) 6*512kB (ME) 7*1024kB (UME) 2*2048kB (UM) 734*4096kB (M) = 3030380kB
Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB
14153 total pagecache pages
0 pages in swap cache
Swap cache stats: add 0, delete 0, find 0/1
Free swap  = 0kB
Total swap = 0kB
1965969 pages RAM
0 pages HighMem/MovableOnly
320718 pages reserved
[ pid ]   uid  tgid total_vm      rss nr_ptes nr_pmds swapents oom_score_adj name
[ 2025]     0  2025     5449      711      16       3        0         -1000 udevd
[ 2336]     0  2336     5448      643      15       3        0         -1000 udevd
[ 2337]     0  2337     5448      643      15       3        0         -1000 udevd
[ 3584]     0  3584     2493      795       8       3        0             0 dhclient
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral protection fault: 0000 [#1] PREEMPT SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 3920 Comm: syz-executor4 Not tainted 4.4.135-gb68f27c #54
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8801d80d8000 task.stack: ffff8801d8000000
RIP: 0010:[<ffffffff811a60fd>]  [<ffffffff811a60fd>] task_curr kernel/sched/core.c:1025 [inline]
RIP: 0010:[<ffffffff811a60fd>]  [<ffffffff811a60fd>] kick_process+0xdd/0x1c0 kernel/sched/core.c:1567
RSP: 0018:ffff8801d8007b88  EFLAGS: 00010006
RAX: dffffc0000000000 RBX: 000000000001f4c0 RCX: 0000000000000000
RDX: 0000000090705618 RSI: ffffffff81e6e89b RDI: 000000048382b0c0
RBP: ffff8801d8007ba8 R08: ffffffff85349080 R09: 0000000000000001
R10: 0000000000000000 R11: ffff8801d80d8000 R12: ffff8800b61a0000
R13: 000000009fdc2c80 R14: 000000009fdc2c80 R15: ffff8800bac878c0
FS:  0000000002147940(0063) GS:ffff8801db300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000000072bee1 CR3: 00000001baf98000 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 ffff8800b61a0000 0000000000000080 ffff8801d0e63000 0000000000000100
 ffff8801d8007bc8 ffffffff81155aff ffff8800b61a0000 dffffc0000000000
 ffff8801d8007c20 ffffffff8115617b ffff8800bac87930 ffffffff81157a86
Call Trace:
 [<ffffffff81155aff>] signal_wake_up_state+0x5f/0x70 kernel/signal.c:660
 [<ffffffff8115617b>] signal_wake_up include/linux/sched.h:3323 [inline]
 [<ffffffff8115617b>] complete_signal+0x62b/0x790 kernel/signal.c:942
 [<ffffffff811576c5>] __send_signal+0x4d5/0x11b0 kernel/signal.c:1080
 [<ffffffff811583ea>] send_signal+0x4a/0xc0 kernel/signal.c:1096
 [<ffffffff8115aad4>] do_send_sig_info+0xa4/0x130 kernel/signal.c:1151
 [<ffffffff8115b986>] group_send_sig_info+0xf6/0x170 kernel/signal.c:1273
 [<ffffffff8115ba90>] __kill_pgrp_info+0x90/0x120 kernel/signal.c:1291
 [<ffffffff8115bf67>] kill_something_info kernel/signal.c:1401 [inline]
 [<ffffffff8115bf67>] SYSC_kill+0x237/0x5c0 kernel/signal.c:2878
 [<ffffffff81161fac>] SyS_kill+0x1c/0x30 kernel/signal.c:2868
 [<ffffffff838c2765>] entry_SYSCALL_64_fastpath+0x22/0x9e
Code: 04 02 84 c0 74 08 3c 03 0f 8e b4 00 00 00 48 b8 00 00 00 00 00 fc ff df 45 8b 6d 10 4a 8d 3c ed c0 4c a1 84 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 ae 00 00 00 4a 03 1c ed c0 4c a1 84 48 b8 00 
RIP  [<ffffffff811a60fd>] task_curr kernel/sched/core.c:1025 [inline]
RIP  [<ffffffff811a60fd>] kick_process+0xdd/0x1c0 kernel/sched/core.c:1567
 RSP <ffff8801d8007b88>
---[ end trace 784a8337d6d0140c ]---