==================================================================
BUG: KASAN: slab-out-of-bounds in decode_session6+0xe7c/0x1580 net/xfrm/xfrm_policy.c:3393
Read of size 1 at addr ffff888017338e2e by task syz-executor.2/8489

CPU: 0 PID: 8489 Comm: syz-executor.2 Not tainted 5.10.0-rc7-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:118
 print_address_description.constprop.0.cold+0xae/0x497 mm/kasan/report.c:385
 __kasan_report mm/kasan/report.c:545 [inline]
 kasan_report.cold+0x1f/0x37 mm/kasan/report.c:562
 decode_session6+0xe7c/0x1580 net/xfrm/xfrm_policy.c:3393
 __xfrm_decode_session+0x50/0xb0 net/xfrm/xfrm_policy.c:3485
 xfrm_decode_session include/net/xfrm.h:1137 [inline]
 vti_tunnel_xmit+0x264/0x1980 net/ipv4/ip_vti.c:292
 __netdev_start_xmit include/linux/netdevice.h:4735 [inline]
 netdev_start_xmit include/linux/netdevice.h:4749 [inline]
 xmit_one net/core/dev.c:3564 [inline]
 dev_hard_start_xmit+0x1eb/0x920 net/core/dev.c:3580
 sch_direct_xmit+0x2e1/0xbd0 net/sched/sch_generic.c:313
 qdisc_restart net/sched/sch_generic.c:376 [inline]
 __qdisc_run+0x4ba/0x15e0 net/sched/sch_generic.c:384
 __dev_xmit_skb net/core/dev.c:3803 [inline]
 __dev_queue_xmit+0x19fa/0x2da0 net/core/dev.c:4108
 neigh_connected_output+0x380/0x4c0 net/core/neighbour.c:1520
 neigh_output include/net/neighbour.h:510 [inline]
 ip6_finish_output2+0x6b8/0x16c0 net/ipv6/ip6_output.c:117
 __ip6_finish_output net/ipv6/ip6_output.c:143 [inline]
 __ip6_finish_output+0x447/0xab0 net/ipv6/ip6_output.c:128
 ip6_finish_output+0x34/0x1f0 net/ipv6/ip6_output.c:153
 NF_HOOK_COND include/linux/netfilter.h:290 [inline]
 ip6_output+0x1db/0x520 net/ipv6/ip6_output.c:176
 dst_output include/net/dst.h:443 [inline]
 NF_HOOK include/linux/netfilter.h:301 [inline]
 ndisc_send_skb+0xa69/0x1720 net/ipv6/ndisc.c:508
 ndisc_send_rs+0x12e/0x700 net/ipv6/ndisc.c:702
 addrconf_rs_timer+0x3f2/0x820 net/ipv6/addrconf.c:3873
 call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1410
 expire_timers kernel/time/timer.c:1455 [inline]
 __run_timers.part.0+0x67c/0xa50 kernel/time/timer.c:1747
 __run_timers kernel/time/timer.c:1728 [inline]
 run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1760
 __do_softirq+0x2a0/0x9f6 kernel/softirq.c:298
 asm_call_irq_on_stack+0xf/0x20
 </IRQ>
 __run_on_irqstack arch/x86/include/asm/irq_stack.h:26 [inline]
 run_on_irqstack_cond arch/x86/include/asm/irq_stack.h:77 [inline]
 do_softirq_own_stack+0xaa/0xd0 arch/x86/kernel/irq_64.c:77
 invoke_softirq kernel/softirq.c:393 [inline]
 __irq_exit_rcu kernel/softirq.c:423 [inline]
 irq_exit_rcu+0x132/0x200 kernel/softirq.c:435
 sysvec_apic_timer_interrupt+0x4d/0x100 arch/x86/kernel/apic/apic.c:1091
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:631
RIP: 0010:arch_static_branch_jump arch/x86/include/asm/jump_label.h:41 [inline]
RIP: 0010:slab_want_init_on_alloc mm/slab.h:623 [inline]
RIP: 0010:slab_alloc_node mm/slab.c:3253 [inline]
RIP: 0010:kmem_cache_alloc_node_trace+0x1ad/0x520 mm/slab.c:3594
Code: 00 00 44 89 64 24 0c 8b 54 24 0c 89 de 48 89 ef e8 48 e1 ff ff 48 89 44 24 28 48 83 7c 24 18 00 0f 85 d8 01 00 00 ff 34 24 9d <e9> 02 01 00 00 f6 c7 01 4c 8b 44 24 28 0f 85 16 01 00 00 23 1d da
RSP: 0018:ffffc900017377c8 EFLAGS: 00000246
RAX: 0000000000054327 RBX: 0000000000000cc0 RCX: ffffffff8155a907
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffff888010040100 R08: 0000000000000001 R09: ffffffff8ebb96df
R10: fffffbfff1d772db R11: 0000000000000000 R12: 0000000000000000
R13: 0000000000000cc0 R14: 0000000000000010 R15: 0000000000000000
 __do_kmalloc_node mm/slab.c:3616 [inline]
 __kmalloc_node+0x38/0x60 mm/slab.c:3624
 kmalloc_node include/linux/slab.h:575 [inline]
 kvmalloc_node+0x61/0xf0 mm/util.c:575
 xt_jumpstack_alloc net/netfilter/x_tables.c:1323 [inline]
 xt_replace_table+0x195/0x600 net/netfilter/x_tables.c:1369
 __do_replace+0x1d7/0x8c0 net/ipv6/netfilter/ip6_tables.c:1083
 do_replace net/ipv6/netfilter/ip6_tables.c:1156 [inline]
 do_ip6t_set_ctl+0x8ec/0xb70 net/ipv6/netfilter/ip6_tables.c:1636
 nf_setsockopt+0x83/0xe0 net/netfilter/nf_sockopt.c:101
 ipv6_setsockopt+0x122/0x180 net/ipv6/ipv6_sockglue.c:1008
 tcp_setsockopt+0x136/0x2590 net/ipv4/tcp.c:3338
 __sys_setsockopt+0x2db/0x610 net/socket.c:2132
 __do_sys_setsockopt net/socket.c:2143 [inline]
 __se_sys_setsockopt net/socket.c:2140 [inline]
 __x64_sys_setsockopt+0xba/0x150 net/socket.c:2140
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x460c8a
Code: 49 89 ca b8 37 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 ca 88 fb ff c3 66 0f 1f 84 00 00 00 00 00 49 89 ca b8 36 00 00 00 0f 05 <48> 3d 01 f0 ff ff 0f 83 aa 88 fb ff c3 66 0f 1f 84 00 00 00 00 00
RSP: 002b:00007ffefd006e98 EFLAGS: 00000202 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 00007ffefd006ec0 RCX: 0000000000460c8a
RDX: 0000000000000040 RSI: 0000000000000029 RDI: 0000000000000003
RBP: 000000000074cca0 R08: 00000000000003b8 R09: 0000000000004000
R10: 000000000074c640 R11: 0000000000000202 R12: 00007ffefd006f20
R13: 0000000000000003 R14: 000000000074c5e0 R15: 0000000000000029

Allocated by task 8491:
 kasan_save_stack+0x1b/0x40 mm/kasan/common.c:48
 kasan_set_track mm/kasan/common.c:56 [inline]
 __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:461
 __do_kmalloc mm/slab.c:3657 [inline]
 __kmalloc_track_caller+0x223/0x450 mm/slab.c:3672
 kmemdup+0x23/0x50 mm/util.c:128
 kmemdup include/linux/string.h:472 [inline]
 neigh_sysctl_register+0x9a/0x680 net/core/neighbour.c:3631
 devinet_sysctl_register+0xb1/0x230 net/ipv4/devinet.c:2609
 inetdev_init+0x225/0x4f0 net/ipv4/devinet.c:276
 inetdev_event+0x9c7/0x1530 net/ipv4/devinet.c:1531
 notifier_call_chain+0xb5/0x200 kernel/notifier.c:83
 call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:2035
 call_netdevice_notifiers_extack net/core/dev.c:2047 [inline]
 call_netdevice_notifiers net/core/dev.c:2061 [inline]
 register_netdevice+0x1068/0x1630 net/core/dev.c:10013
 veth_newlink+0x3fe/0x9f0 drivers/net/veth.c:1359
 __rtnl_newlink+0x108b/0x1740 net/core/rtnetlink.c:3441
 rtnl_newlink+0x64/0xa0 net/core/rtnetlink.c:3500
 rtnetlink_rcv_msg+0x44e/0xad0 net/core/rtnetlink.c:5562
 netlink_rcv_skb+0x153/0x420 net/netlink/af_netlink.c:2494
 netlink_unicast_kernel net/netlink/af_netlink.c:1304 [inline]
 netlink_unicast+0x533/0x7d0 net/netlink/af_netlink.c:1330
 netlink_sendmsg+0x856/0xd90 net/netlink/af_netlink.c:1919
 sock_sendmsg_nosec net/socket.c:651 [inline]
 sock_sendmsg+0xcf/0x120 net/socket.c:671
 __sys_sendto+0x21c/0x320 net/socket.c:1992
 __do_sys_sendto net/socket.c:2004 [inline]
 __se_sys_sendto net/socket.c:2000 [inline]
 __x64_sys_sendto+0xdd/0x1b0 net/socket.c:2000
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

The buggy address belongs to the object at ffff888017338000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 1582 bytes to the right of
 2048-byte region [ffff888017338000, ffff888017338800)
The buggy address belongs to the page:
page:0000000031ef456a refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x17338
flags: 0xfff00000000200(slab)
raw: 00fff00000000200 ffffea0000af1d08 ffffea00005f38c8 ffff888010040800
raw: 0000000000000000 ffff888017338000 0000000100000001 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff888017338d00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888017338d80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888017338e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                                  ^
 ffff888017338e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888017338f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================