================================================================== BUG: KASAN: slab-out-of-bounds in ip6_tnl_xmit2+0x229d/0x2350 net/ipv6/ip6_tunnel.c:987 Read of size 16 at addr ffff8800b4e0ddb0 by task syz-executor296/2493 CPU: 1 PID: 2493 Comm: syz-executor296 Not tainted 4.4.159+ #106 0000000000000000 548cb03a94ee5a49 ffff8801d1c36ca0 ffffffff81a9949d ffffea0002d38300 ffff8800b4e0ddb0 0000000000000000 ffff8800b4e0ddb8 ffff8800b73a4400 ffff8801d1c36cd8 ffffffff8148a809 ffff8800b4e0ddb0 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x124 lib/dump_stack.c:51 [] print_address_description+0x6c/0x217 mm/kasan/report.c:252 [] kasan_report_error mm/kasan/report.c:351 [inline] [] kasan_report.cold.6+0x175/0x2f7 mm/kasan/report.c:408 [] __asan_report_load_n_noabort+0xf/0x20 mm/kasan/report.c:439 [] ip6_tnl_xmit2+0x229d/0x2350 net/ipv6/ip6_tunnel.c:987 [] ip4ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1129 [inline] [] ip6_tnl_xmit+0x91a/0xc70 net/ipv6/ip6_tunnel.c:1203 [] __netdev_start_xmit include/linux/netdevice.h:3743 [inline] [] netdev_start_xmit include/linux/netdevice.h:3752 [inline] [] xmit_one net/core/dev.c:2759 [inline] [] dev_hard_start_xmit+0x7bd/0x11c0 net/core/dev.c:2775 [] __dev_queue_xmit+0x16f5/0x1c30 net/core/dev.c:3207 [] dev_queue_xmit+0x17/0x20 net/core/dev.c:3241 [] neigh_direct_output+0x15/0x20 net/core/neighbour.c:1369 [] dst_neigh_output include/net/dst.h:461 [inline] [] ip_finish_output2+0x8f0/0x1100 net/ipv4/ip_output.c:213 [] ip_finish_output+0x882/0xc00 net/ipv4/ip_output.c:288 [] NF_HOOK_COND include/linux/netfilter.h:240 [inline] [] ip_output+0x219/0x4c0 net/ipv4/ip_output.c:362 [] dst_output include/net/dst.h:498 [inline] [] ip_local_out+0x9b/0x180 net/ipv4/ip_output.c:119 [] ip_send_skb+0x3c/0xc0 net/ipv4/ip_output.c:1453 [] udp_send_skb+0x503/0xc70 net/ipv4/udp.c:842 [] udp_sendmsg+0x16c9/0x1c70 net/ipv4/udp.c:1072 [] udpv6_sendmsg+0x12cd/0x24c0 net/ipv6/udp.c:1173 [] inet_sendmsg+0x203/0x4d0 net/ipv4/af_inet.c:755 [] sock_sendmsg_nosec net/socket.c:638 [inline] [] sock_sendmsg+0xbb/0x110 net/socket.c:648 [] ___sys_sendmsg+0x745/0x880 net/socket.c:1975 [] __sys_sendmsg+0xd6/0x190 net/socket.c:2009 [] SYSC_sendmsg net/socket.c:2020 [inline] [] SyS_sendmsg+0x2d/0x50 net/socket.c:2016 [] entry_SYSCALL_64_fastpath+0x1e/0x9a Allocated by task 2493: [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63 [] save_stack mm/kasan/kasan.c:512 [inline] [] set_track mm/kasan/kasan.c:524 [inline] [] kasan_kmalloc.part.1+0x62/0xf0 mm/kasan/kasan.c:616 [] kasan_kmalloc+0xaf/0xc0 mm/kasan/kasan.c:601 [] __kmalloc+0x13d/0x330 mm/slub.c:3613 [] kmalloc include/linux/slab.h:481 [inline] [] kzalloc include/linux/slab.h:620 [inline] [] neigh_alloc net/core/neighbour.c:285 [inline] [] __neigh_create+0x1d6/0x1b20 net/core/neighbour.c:457 [] neigh_create include/net/neighbour.h:313 [inline] [] ipv4_neigh_lookup+0x4de/0x700 net/ipv4/route.c:464 [] dst_neigh_lookup include/net/dst.h:466 [inline] [] ip6_tnl_xmit2+0x28a/0x2350 net/ipv6/ip6_tunnel.c:982 [] ip4ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1129 [inline] [] ip6_tnl_xmit+0x91a/0xc70 net/ipv6/ip6_tunnel.c:1203 [] __netdev_start_xmit include/linux/netdevice.h:3743 [inline] [] netdev_start_xmit include/linux/netdevice.h:3752 [inline] [] xmit_one net/core/dev.c:2759 [inline] [] dev_hard_start_xmit+0x7bd/0x11c0 net/core/dev.c:2775 [] __dev_queue_xmit+0x16f5/0x1c30 net/core/dev.c:3207 [] dev_queue_xmit+0x17/0x20 net/core/dev.c:3241 [] neigh_direct_output+0x15/0x20 net/core/neighbour.c:1369 [] dst_neigh_output include/net/dst.h:461 [inline] [] ip_finish_output2+0x8f0/0x1100 net/ipv4/ip_output.c:213 [] ip_finish_output+0x882/0xc00 net/ipv4/ip_output.c:288 [] NF_HOOK_COND include/linux/netfilter.h:240 [inline] [] ip_output+0x219/0x4c0 net/ipv4/ip_output.c:362 [] dst_output include/net/dst.h:498 [inline] [] ip_local_out+0x9b/0x180 net/ipv4/ip_output.c:119 [] ip_send_skb+0x3c/0xc0 net/ipv4/ip_output.c:1453 [] udp_send_skb+0x503/0xc70 net/ipv4/udp.c:842 [] udp_sendmsg+0x16c9/0x1c70 net/ipv4/udp.c:1072 [] udpv6_sendmsg+0x12cd/0x24c0 net/ipv6/udp.c:1173 [] inet_sendmsg+0x203/0x4d0 net/ipv4/af_inet.c:755 [] sock_sendmsg_nosec net/socket.c:638 [inline] [] sock_sendmsg+0xbb/0x110 net/socket.c:648 [] ___sys_sendmsg+0x745/0x880 net/socket.c:1975 [] __sys_sendmsg+0xd6/0x190 net/socket.c:2009 [] SYSC_sendmsg net/socket.c:2020 [inline] [] SyS_sendmsg+0x2d/0x50 net/socket.c:2016 [] entry_SYSCALL_64_fastpath+0x1e/0x9a Freed by task 783: [] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63 [] save_stack mm/kasan/kasan.c:512 [inline] [] set_track mm/kasan/kasan.c:524 [inline] [] kasan_slab_free+0xac/0x190 mm/kasan/kasan.c:589 [] slab_free_hook mm/slub.c:1383 [inline] [] slab_free_freelist_hook mm/slub.c:1405 [inline] [] slab_free mm/slub.c:2859 [inline] [] kfree+0xf4/0x310 mm/slub.c:3749 [] free_pipe_info+0x210/0x2c0 fs/pipe.c:657 [] put_pipe_info+0xb8/0xe0 fs/pipe.c:548 [] pipe_release+0x1af/0x250 fs/pipe.c:569 [] __fput+0x235/0x6f0 fs/file_table.c:208 [] ____fput+0x15/0x20 fs/file_table.c:244 [] task_work_run+0x10f/0x190 kernel/task_work.c:115 [] exit_task_work include/linux/task_work.h:21 [inline] [] do_exit+0x9c5/0x28d0 kernel/exit.c:755 [] do_group_exit+0x111/0x300 kernel/exit.c:885 [] SYSC_exit_group kernel/exit.c:896 [inline] [] SyS_exit_group+0x1d/0x20 kernel/exit.c:894 [] entry_SYSCALL_64_fastpath+0x1e/0x9a The buggy address belongs to the object at ffff8800b4e0db00 which belongs to the cache kmalloc-1024 of size 1024 The buggy address is located 688 bytes inside of 1024-byte region [ffff8800b4e0db00, ffff8800b4e0df00) The buggy address belongs to the page: kasan: CONFIG_KASAN_INLINE enabled kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral protection fault: 0000 [#1] PREEMPT SMP KASAN Modules linked in: CPU: 0 PID: 1 Comm: init Not tainted 4.4.159+ #106 task: ffff8801da5f0000 task.stack: ffff8801da5f8000 RIP: 0010:[] [] find_stack lib/stackdepot.c:174 [inline] RIP: 0010:[] [] depot_save_stack+0x15f/0x5eb lib/stackdepot.c:225 RSP: 0018:ffff8801da5ffa28 EFLAGS: 00010293 RAX: ffff8801da5f0000 RBX: 0000000089b034d0 RCX: 0000000050b4b35b RDX: 0000000000000000 RSI: ffffffff81b3499f RDI: ffff8801da5ffa90 RBP: ffff8801da5ffa80 R08: ffff8801da5ffa90 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000003 R12: 4f5f4755425f4d56 R13: 0000000000000003 R14: 0000000000000048 R15: 00000000000034d0 FS: 00007feebda8e7a0(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007feebd418834 CR3: 00000001d7753000 CR4: 00000000001606b0 Stack: 024080c0da5f08c0 ffff8801da5ffaa8 ffff8801da5ffa90 ffff880100000009 0000000000000000 d067a1184c7f6081 ffff8800b2569740 00000000024080c0 0000000000000000 ffff8800b2569640 ffff8800b256973f ffff8801da5ffcb8 Call Trace: [] save_stack mm/kasan/kasan.c:518 [inline] [] set_track mm/kasan/kasan.c:524 [inline] [] kasan_kmalloc.part.1+0xc9/0xf0 mm/kasan/kasan.c:616 [] kasan_kmalloc+0xaf/0xc0 mm/kasan/kasan.c:601 [] kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:554 [] slab_post_alloc_hook mm/slub.c:1349 [inline] [] slab_alloc_node mm/slub.c:2615 [inline] [] slab_alloc mm/slub.c:2623 [inline] [] kmem_cache_alloc+0xdc/0x2c0 mm/slub.c:2628 [] kmem_cache_zalloc include/linux/slab.h:610 [inline] [] locks_alloc_lock+0x1d/0x160 fs/locks.c:258 [] fcntl_setlk+0x93/0x9d0 fs/locks.c:2159 [] do_fcntl fs/fcntl.c:287 [inline] [] SYSC_fcntl fs/fcntl.c:375 [inline] [] SyS_fcntl+0x71c/0xca0 fs/fcntl.c:360 [] entry_SYSCALL_64_fastpath+0x1e/0x9a Code: 00 00 e8 05 25 7d ff 48 63 45 c0 48 c1 e0 03 49 89 c6 eb 12 e8 f3 24 7d ff 4d 8b 24 24 4d 85 e4 0f 84 8d 00 00 00 e8 e1 24 7d ff <41> 3b 5c 24 08 75 e2 e8 d5 24 7d ff 8b 45 c0 41 3b 44 24 0c 75 RIP [] find_stack lib/stackdepot.c:174 [inline] RIP [] depot_save_stack+0x15f/0x5eb lib/stackdepot.c:225 RSP BUG: unable to handle kernel paging request at fffffffd2a20f580 IP: [] cpuacct_charge+0x155/0x380 kernel/sched/cpuacct.c:247 PGD 2e0d067 PUD 0 Oops: 0000 [#2] PREEMPT SMP KASAN Modules linked in: CPU: 0 PID: 1 Comm: init Tainted: G D 4.4.159+ #106 task: ffff8801da5f0000 task.stack: ffff8801da5f8000 RIP: 0010:[] [] cpuacct_charge+0x155/0x380 kernel/sched/cpuacct.c:247 RSP: 0018:ffff8801db607968 EFLAGS: 00010046 RAX: 1ffffffff05d2a0b RBX: 00000000000181a8 RCX: ffffffff831a1d80 RDX: fffffbffa5441eb0 RSI: fffffffd2a20f580 RDI: ffffffff82e95058 RBP: ffff8801db6079a8 R08: 0000000000000000 R09: 0000000000000001 R10: ffff8801da5f0000 R11: 0000000000000000 R12: ffffffff82e94f80 R13: dffffc0000000000 R14: 000000007430814b R15: ffffffffb4e0db00 FS: 00007feebda8e7a0(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: fffffffd2a20f580 CR3: 00000001d7753000 CR4: 00000000001606b0 Stack: ffffffff811f0b60 0000000082e15aa9 ffffffff82e15ab0 ffff8800b4e147a0 ffff8800b4e14740 000000007430814b ffff8800b4e147f0 0000000000000000 ffff8801db6079f0 ffffffff8117c439 ffffffff82c47bf0 ffffffff811fb4b0 Call Trace: [] update_curr+0x2c9/0x6d0 kernel/sched/fair.c:882 [] enqueue_entity kernel/sched/fair.c:3512 [inline] [] enqueue_task_fair+0x12a/0xab90 kernel/sched/fair.c:4695 [] enqueue_task kernel/sched/core.c:858 [inline] [] activate_task+0x1dd/0x280 kernel/sched/core.c:874 [] ttwu_activate kernel/sched/core.c:1736 [inline] [] ttwu_do_activate.constprop.29+0xbf/0x1e0 kernel/sched/core.c:1789 [] ttwu_queue kernel/sched/core.c:1934 [inline] [] try_to_wake_up+0x6dd/0x1120 kernel/sched/core.c:2068 [] default_wake_function+0x35/0x50 kernel/sched/core.c:3494 [] autoremove_wake_function+0x11/0x40 kernel/sched/wait.c:293 [] __wake_up_common+0xb6/0x150 kernel/sched/wait.c:73 [] __wake_up+0x34/0x50 kernel/sched/wait.c:95 [] wake_up_klogd_work_func+0x80/0x90 kernel/printk/printk.c:2736 [] irq_work_run_list+0xd7/0x140 kernel/irq_work.c:156 [] irq_work_tick+0x116/0x170 kernel/irq_work.c:182 [] update_process_times+0x69/0x70 kernel/time/timer.c:1430 [] tick_sched_handle.isra.6+0x4a/0xf0 kernel/time/tick-sched.c:151 [] tick_sched_timer+0x76/0x130 kernel/time/tick-sched.c:1097 [] __run_hrtimer kernel/time/hrtimer.c:1261 [inline] [] __hrtimer_run_queues+0x390/0xfc0 kernel/time/hrtimer.c:1325 [] hrtimer_interrupt+0x1b1/0x430 kernel/time/hrtimer.c:1359 [] local_apic_timer_interrupt+0x74/0xa0 arch/x86/kernel/apic/apic.c:901 [] smp_apic_timer_interrupt+0x7c/0xa0 arch/x86/kernel/apic/apic.c:925 [] apic_timer_interrupt+0x9d/0xb0 arch/x86/entry/entry_64.S:741 [] die.cold.1+0x21/0x2a arch/x86/kernel/dumpstack.c:316 [] do_general_protection+0x227/0x2b0 arch/x86/kernel/traps.c:463 [] general_protection+0x25/0x30 arch/x86/entry/entry_64.S:1036 [] save_stack mm/kasan/kasan.c:518 [inline] [] set_track mm/kasan/kasan.c:524 [inline] [] kasan_kmalloc.part.1+0xc9/0xf0 mm/kasan/kasan.c:616 [] kasan_kmalloc+0xaf/0xc0 mm/kasan/kasan.c:601 [] kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:554 [] slab_post_alloc_hook mm/slub.c:1349 [inline] [] slab_alloc_node mm/slub.c:2615 [inline] [] slab_alloc mm/slub.c:2623 [inline] [] kmem_cache_alloc+0xdc/0x2c0 mm/slub.c:2628 [] kmem_cache_zalloc include/linux/slab.h:610 [inline] [] locks_alloc_lock+0x1d/0x160 fs/locks.c:258 [] fcntl_setlk+0x93/0x9d0 fs/locks.c:2159 [] do_fcntl fs/fcntl.c:287 [inline] [] SYSC_fcntl fs/fcntl.c:375 [inline] [] SyS_fcntl+0x71c/0xca0 fs/fcntl.c:360 [] entry_SYSCALL_64_fastpath+0x1e/0x9a Code: 49 8d bc 24 d8 00 00 00 48 89 f8 48 c1 e8 03 42 80 3c 28 00 0f 85 c4 01 00 00 49 8b 9c 24 d8 00 00 00 80 3a 00 0f 85 8f 01 00 00 <4a> 03 1c f9 48 89 d8 48 c1 e8 03 42 80 3c 28 00 0f 85 be 01 00 RIP [] cpuacct_charge+0x155/0x380 kernel/sched/cpuacct.c:247 RSP CR2: fffffffd2a20f580 ---[ end trace 1941ddaf4f409ca2 ]--- double fault: 0000 [#3] PREEMPT SMP KASAN Modules linked in: CPU: 1 PID: 2493 Comm: syz-executor296 Tainted: G D 4.4.159+ #106 task: ffff8800b4e14740 task.stack: ffff8801d1c30000 RIP: 0010:[] [] dump_page+0x4/0x30 mm/debug.c:104 RSP: 0018:ffff880100000000 EFLAGS: 00010093 RAX: ffff8800b4e14740 RBX: ffffea0002d38300 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff828912a0 RDI: ffffea0002d38300 RBP: ffff880100000000 R08: 0000000000000001 R09: 0000000000000000 R10: 0000000000000001 R11: ffffffff83fd7174 R12: 0000000000000000 R13: ffffffff828912a0 R14: ffff8800b4e0db00 R15: ffff8800b4e0df00 FS: 0000000001336880(0063) GS:ffff8801db700000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: ffff8800fffffff8 CR3: 00000001d2029000 CR4: 00000000001606b0 Stack: Call Trace: Code: a0 12 89 82 48 89 df e8 1b 00 00 00 0f 0b 48 89 df e8 d1 96 05 00 eb d5 0f 1f 44 00 00 66 2e 0f 1f 84 00 00 00 00 00 55 48 89 e5 <41> 54 49 89 f4 53 48 89 fb e8 9e 0d ee ff 4c 89 e6 48 89 df 31 RIP [] dump_page+0x4/0x30 mm/debug.c:104 RSP ---[ end trace 1941ddaf4f409ca3 ]---