==================================================================
BUG: KASAN: slab-out-of-bounds in decode_session6+0xfc3/0x17f0 net/xfrm/xfrm_policy.c:3375
Read of size 1 at addr ffff888050ea4fae by task swapper/3/0
CPU: 3 PID: 0 Comm: swapper/3 Not tainted 6.1.0-rc2-syzkaller-00107-g200204f56f3b #0
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.14.0-2 04/01/2014
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
print_address_description mm/kasan/report.c:284 [inline]
print_report+0x15e/0x45d mm/kasan/report.c:395
kasan_report+0xbb/0x1f0 mm/kasan/report.c:495
decode_session6+0xfc3/0x17f0 net/xfrm/xfrm_policy.c:3375
__xfrm_decode_session+0x50/0xb0 net/xfrm/xfrm_policy.c:3481
xfrm_decode_session include/net/xfrm.h:1168 [inline]
xfrmi_xmit+0x175/0x1b90 net/xfrm/xfrm_interface.c:485
__netdev_start_xmit include/linux/netdevice.h:4840 [inline]
netdev_start_xmit include/linux/netdevice.h:4854 [inline]
xmit_one net/core/dev.c:3590 [inline]
dev_hard_start_xmit+0x1be/0x990 net/core/dev.c:3606
sch_direct_xmit+0x19f/0xbe0 net/sched/sch_generic.c:342
qdisc_restart net/sched/sch_generic.c:407 [inline]
__qdisc_run+0x4d6/0x1750 net/sched/sch_generic.c:415
__dev_xmit_skb net/core/dev.c:3880 [inline]
__dev_queue_xmit+0x22a9/0x3b60 net/core/dev.c:4222
dev_queue_xmit include/linux/netdevice.h:3008 [inline]
neigh_connected_output+0x3c0/0x520 net/core/neighbour.c:1581
neigh_output include/net/neighbour.h:546 [inline]
ip6_finish_output2+0x564/0x1520 net/ipv6/ip6_output.c:134
__ip6_finish_output net/ipv6/ip6_output.c:195 [inline]
ip6_finish_output+0x690/0x1160 net/ipv6/ip6_output.c:206
NF_HOOK_COND include/linux/netfilter.h:291 [inline]
ip6_output+0x1ed/0x540 net/ipv6/ip6_output.c:227
dst_output include/net/dst.h:445 [inline]
NF_HOOK include/linux/netfilter.h:302 [inline]
ndisc_send_skb+0xa5f/0x1730 net/ipv6/ndisc.c:508
ndisc_send_rs+0x12e/0x6f0 net/ipv6/ndisc.c:718
addrconf_rs_timer+0x3ed/0x810 net/ipv6/addrconf.c:3931
call_timer_fn+0x1da/0x7c0 kernel/time/timer.c:1474
expire_timers kernel/time/timer.c:1519 [inline]
__run_timers.part.0+0x6a2/0xaf0 kernel/time/timer.c:1790
__run_timers kernel/time/timer.c:1768 [inline]
run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1803
__do_softirq+0x1f7/0xad8 kernel/softirq.c:571
invoke_softirq kernel/softirq.c:445 [inline]
__irq_exit_rcu+0x123/0x180 kernel/softirq.c:650
irq_exit_rcu+0x5/0x20 kernel/softirq.c:662
sysvec_apic_timer_interrupt+0x93/0xc0 arch/x86/kernel/apic/apic.c:1107
asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:649
RIP: 0010:default_idle+0xb/0x10 arch/x86/kernel/process.c:731
Code: f8 e9 8c fd ff ff 4c 89 f7 e8 41 5c 37 f8 e9 3a fd ff ff cc cc cc cc cc cc cc cc cc cc cc cc 66 90 0f 00 2d 27 48 55 00 fb f4 0f 1f 40 00 41 54 be 08 00 00 00 53 65 48 8b 1c 25 80 6f 02 00
RSP: 0018:ffffc9000047fdf8 EFLAGS: 00000246
RAX: 0000000000000003 RBX: ffff888012141d40 RCX: ffffffff898e7ec5
RDX: ffffed100596698a RSI: 0000000000000000 RDI: ffffffff899199cf
RBP: dffffc0000000000 R08: 0000000000000000 R09: ffff88802cb34c4b
R10: ffffed1005966989 R11: 0000000000000001 R12: 0000000000000003
R13: 0000000000000003 R14: ffffffff8de21a10 R15: 0000000000000000
default_idle_call+0x80/0xc0 kernel/sched/idle.c:109
cpuidle_idle_call kernel/sched/idle.c:191 [inline]
do_idle+0x410/0x590 kernel/sched/idle.c:303
cpu_startup_entry+0x14/0x20 kernel/sched/idle.c:400
start_secondary+0x252/0x300 arch/x86/kernel/smpboot.c:262
secondary_startup_64_no_verify+0xce/0xdb
Allocated by task 24:
kasan_save_stack+0x1e/0x40 mm/kasan/common.c:45
kasan_set_track+0x21/0x30 mm/kasan/common.c:52
____kasan_kmalloc mm/kasan/common.c:371 [inline]
____kasan_kmalloc mm/kasan/common.c:330 [inline]
__kasan_kmalloc+0xa1/0xb0 mm/kasan/common.c:380
kmalloc include/linux/slab.h:576 [inline]
kzalloc include/linux/slab.h:712 [inline]
mca_alloc net/ipv6/mcast.c:880 [inline]
__ipv6_dev_mc_inc+0x3de/0xec0 net/ipv6/mcast.c:936
addrconf_join_solict net/ipv6/addrconf.c:2180 [inline]
addrconf_join_solict net/ipv6/addrconf.c:2172 [inline]
addrconf_dad_begin net/ipv6/addrconf.c:3991 [inline]
addrconf_dad_work+0xc56/0x12d0 net/ipv6/addrconf.c:4116
process_one_work+0x9bf/0x1710 kernel/workqueue.c:2289
worker_thread+0x665/0x1080 kernel/workqueue.c:2436
kthread+0x2e4/0x3a0 kernel/kthread.c:376
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:306
The buggy address belongs to the object at ffff888050ea4c00
which belongs to the cache kmalloc-512 of size 512
The buggy address is located 430 bytes to the right of
512-byte region [ffff888050ea4c00, ffff888050ea4e00)
The buggy address belongs to the physical page:
page:ffffea000143a900 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x50ea4
head:ffffea000143a900 order:2 compound_mapcount:0 compound_pincount:0
flags: 0x4fff00000010200(slab|head|node=1|zone=1|lastcpupid=0x7ff)
raw: 04fff00000010200 0000000000000000 dead000000000001 ffff888011842c80
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3705, tgid 3705 (syz-executor.2), ts 185249817447, free_ts 0
prep_new_page mm/page_alloc.c:2538 [inline]
get_page_from_freelist+0x10b5/0x2d50 mm/page_alloc.c:4287
__alloc_pages+0x1c7/0x5a0 mm/page_alloc.c:5554
alloc_pages+0x1a6/0x270 mm/mempolicy.c:2285
alloc_slab_page mm/slub.c:1794 [inline]
allocate_slab+0x213/0x300 mm/slub.c:1939
new_slab mm/slub.c:1992 [inline]
___slab_alloc+0xa91/0x1400 mm/slub.c:3180
__slab_alloc.constprop.0+0x56/0xa0 mm/slub.c:3279
slab_alloc_node mm/slub.c:3364 [inline]
__kmem_cache_alloc_node+0x191/0x3e0 mm/slub.c:3437
kmalloc_trace+0x22/0x60 mm/slab_common.c:1046
kmalloc include/linux/slab.h:576 [inline]
kzalloc include/linux/slab.h:712 [inline]
mca_alloc net/ipv6/mcast.c:880 [inline]
__ipv6_dev_mc_inc+0x3de/0xec0 net/ipv6/mcast.c:936
ipv6_add_dev+0xb0b/0x1320 net/ipv6/addrconf.c:465
addrconf_notify+0x6f9/0x1c10 net/ipv6/addrconf.c:3528
notifier_call_chain+0xb5/0x200 kernel/notifier.c:87
call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:1945
call_netdevice_notifiers_extack net/core/dev.c:1983 [inline]
call_netdevice_notifiers net/core/dev.c:1997 [inline]
register_netdevice+0x10bb/0x1670 net/core/dev.c:10090
bond_newlink drivers/net/bonding/bond_netlink.c:560 [inline]
bond_newlink+0x47/0xa0 drivers/net/bonding/bond_netlink.c:550
rtnl_newlink_create net/core/rtnetlink.c:3364 [inline]
__rtnl_newlink+0x1087/0x17e0 net/core/rtnetlink.c:3581
page_owner free stack trace missing
Memory state around the buggy address:
ffff888050ea4e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
ffff888050ea4f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff888050ea4f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
^
ffff888050ea5000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff888050ea5080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
----------------
Code disassembly (best guess):
0: f8 clc
1: e9 8c fd ff ff jmpq 0xfffffd92
6: 4c 89 f7 mov %r14,%rdi
9: e8 41 5c 37 f8 callq 0xf8375c4f
e: e9 3a fd ff ff jmpq 0xfffffd4d
13: cc int3
14: cc int3
15: cc int3
16: cc int3
17: cc int3
18: cc int3
19: cc int3
1a: cc int3
1b: cc int3
1c: cc int3
1d: cc int3
1e: cc int3
1f: 66 90 xchg %ax,%ax
21: 0f 00 2d 27 48 55 00 verw 0x554827(%rip) # 0x55484f
28: fb sti
29: f4 hlt
* 2a: c3 retq <-- trapping instruction
2b: 0f 1f 40 00 nopl 0x0(%rax)
2f: 41 54 push %r12
31: be 08 00 00 00 mov $0x8,%esi
36: 53 push %rbx
37: 65 48 8b 1c 25 80 6f mov %gs:0x26f80,%rbx
3e: 02 00