================================================================== BUG: KASAN: use-after-free in parse_ipsecrequest net/key/af_key.c:1906 [inline] at addr ffff8801cc3b62b6 BUG: KASAN: use-after-free in parse_ipsecrequests+0xc7d/0xd00 net/key/af_key.c:1958 at addr ffff8801cc3b62b6 Read of size 1 by task syz-executor5/14721 page:ffffea000730ed80 count:0 mapcount:0 mapping: (null) index:0x0 flags: 0x200000000000000() page dumped because: kasan: bad access detected CPU: 0 PID: 14721 Comm: syz-executor5 Not tainted 4.9.39-g5b07c2d #4 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801b3b9f7b0 ffffffff81eacd59 ffffed0039876c56 0000000000000001 0000000000000000 ffffed0039876c56 ffff8801cc3b62b6 ffff8801b3b9f830 ffffffff81547141 0000000000000387 ffff8801d8c74f00 ffffffff8358b4bd Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] print_address_description mm/kasan/report.c:208 [inline] [] kasan_report_error mm/kasan/report.c:287 [inline] [] kasan_report.part.1+0x4a1/0x4e0 mm/kasan/report.c:309 [] kasan_report mm/kasan/report.c:327 [inline] [] __asan_report_load1_noabort+0x29/0x30 mm/kasan/report.c:327 [] parse_ipsecrequest net/key/af_key.c:1906 [inline] [] parse_ipsecrequests+0xc7d/0xd00 net/key/af_key.c:1958 [] pfkey_compile_policy+0xa20/0xd40 net/key/af_key.c:3250 [] xfrm_user_policy+0x222/0x370 net/xfrm/xfrm_state.c:1900 [] do_ip_setsockopt.isra.11+0x193e/0x28f0 net/ipv4/ip_sockglue.c:1146 [] ip_setsockopt+0x3a/0xb0 net/ipv4/ip_sockglue.c:1235 [] tcp_setsockopt+0x82/0xd0 net/ipv4/tcp.c:2701 [] sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2705 [] SYSC_setsockopt net/socket.c:1771 [inline] [] SyS_setsockopt+0x158/0x240 net/socket.c:1750 [] entry_SYSCALL_64_fastpath+0x23/0xc6 Memory state around the buggy address: ffff8801cc3b6180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff8801cc3b6200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff8801cc3b6280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff8801cc3b6300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff8801cc3b6380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== ================================================================== BUG: KASAN: use-after-free in parse_ipsecrequest net/key/af_key.c:1906 [inline] at addr ffff8801cc3b69b6 BUG: KASAN: use-after-free in parse_ipsecrequests+0xc7d/0xd00 net/key/af_key.c:1958 at addr ffff8801cc3b69b6 Read of size 1 by task syz-executor5/14755 page:ffffea000730ed80 count:0 mapcount:0 mapping: (null) index:0x0 flags: 0x200000000000000() page dumped because: kasan: bad access detected CPU: 0 PID: 14755 Comm: syz-executor5 Tainted: G B 4.9.39-g5b07c2d #4 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801caf777b0 ffffffff81eacd59 ffffed0039876d36 0000000000000001 0000000000000000 ffffed0039876d36 ffff8801cc3b69b6 ffff8801caf77830 ffffffff81547141 0000000000000000 0000000000000000 ffffffff8358b4bd Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] print_address_description mm/kasan/report.c:208 [inline] [] kasan_report_error mm/kasan/report.c:287 [inline] [] kasan_report.part.1+0x4a1/0x4e0 mm/kasan/report.c:309 [] kasan_report mm/kasan/report.c:327 [inline] [] __asan_report_load1_noabort+0x29/0x30 mm/kasan/report.c:327 [] parse_ipsecrequest net/key/af_key.c:1906 [inline] [] parse_ipsecrequests+0xc7d/0xd00 net/key/af_key.c:1958 [] pfkey_compile_policy+0xa20/0xd40 net/key/af_key.c:3250 [] xfrm_user_policy+0x222/0x370 net/xfrm/xfrm_state.c:1900 [] do_ip_setsockopt.isra.11+0x193e/0x28f0 net/ipv4/ip_sockglue.c:1146 [] ip_setsockopt+0x3a/0xb0 net/ipv4/ip_sockglue.c:1235 [] tcp_setsockopt+0x82/0xd0 net/ipv4/tcp.c:2701 [] sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2705 [] SYSC_setsockopt net/socket.c:1771 [inline] [] SyS_setsockopt+0x158/0x240 net/socket.c:1750 [] entry_SYSCALL_64_fastpath+0x23/0xc6 Memory state around the buggy address: ffff8801cc3b6880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff8801cc3b6900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff8801cc3b6980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff8801cc3b6a00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff8801cc3b6a80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== nla_parse: 9 callbacks suppressed netlink: 48 bytes leftover after parsing attributes in process `syz-executor2'. netlink: 48 bytes leftover after parsing attributes in process `syz-executor2'.