netlink: 4 bytes leftover after parsing attributes in process `syz-executor.0'. ================================================================== BUG: KASAN: slab-out-of-bounds in perf_output_read_group kernel/events/core.c:5882 [inline] BUG: KASAN: slab-out-of-bounds in perf_output_read+0xe58/0xfc0 kernel/events/core.c:5917 Read of size 8 at addr ffff8881a3107f08 by task syz-executor.4/30721 CPU: 1 PID: 30721 Comm: syz-executor.4 Not tainted 4.14.112+ #56 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0xb9/0x10e lib/dump_stack.c:53 print_address_description+0x60/0x226 mm/kasan/report.c:252 kasan_report_error mm/kasan/report.c:351 [inline] kasan_report mm/kasan/report.c:409 [inline] kasan_report.cold+0x88/0x2a5 mm/kasan/report.c:393 Allocated by task 30721: save_stack mm/kasan/kasan.c:447 [inline] set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc.part.0+0x4f/0xd0 mm/kasan/kasan.c:551 kmem_cache_alloc_trace+0x126/0x310 mm/slub.c:2750 kmalloc include/linux/slab.h:488 [inline] kzalloc include/linux/slab.h:661 [inline] alloc_perf_context+0x44/0xe0 kernel/events/core.c:3864 find_get_context.isra.0+0x119/0x550 kernel/events/core.c:3953 SYSC_perf_event_open kernel/events/core.c:10158 [inline] SyS_perf_event_open+0x9d3/0x2520 kernel/events/core.c:9986 do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289 Freed by task 28785: save_stack mm/kasan/kasan.c:447 [inline] set_track mm/kasan/kasan.c:459 [inline] kasan_slab_free+0xb0/0x190 mm/kasan/kasan.c:524 slab_free_hook mm/slub.c:1389 [inline] slab_free_freelist_hook mm/slub.c:1410 [inline] slab_free mm/slub.c:2966 [inline] kfree+0xf5/0x310 mm/slub.c:3897 load_elf_binary+0x1bf2/0x4530 fs/binfmt_elf.c:1096 search_binary_handler fs/exec.c:1638 [inline] search_binary_handler+0x13f/0x6d0 fs/exec.c:1616 exec_binprm fs/exec.c:1680 [inline] do_execveat_common.isra.0+0xf5f/0x1c30 fs/exec.c:1802 do_execve fs/exec.c:1847 [inline] SYSC_execve fs/exec.c:1928 [inline] SyS_execve+0x34/0x40 fs/exec.c:1923 do_syscall_64+0x19b/0x4b0 arch/x86/entry/common.c:289 The buggy address belongs to the object at ffff8881a3107b80 which belongs to the cache kmalloc-512 of size 512 The buggy address is located 392 bytes to the right of 512-byte region [ffff8881a3107b80, ffff8881a3107d80) The buggy address belongs to the page: page:ffffea00068c4180 count:1 mapcount:0 mapping: (null) index:0xffff8881a3107900 compound_mapcount: 0 flags: 0x4000000000010200(slab|head) raw: 4000000000010200 0000000000000000 ffff8881a3107900 00000001800c000b raw: ffffea0007170500 0000000600000004 ffff8881d6402c00 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8881a3107e00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8881a3107e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff8881a3107f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff8881a3107f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8881a3108000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================