Disabling lock debugging due to kernel taint ================================================================== BUG: KASAN: stack-out-of-bounds in addr_match include/net/xfrm.h:838 [inline] at addr ffff8801d6a1f6b0 BUG: KASAN: stack-out-of-bounds in __xfrm6_selector_match net/xfrm/xfrm_policy.c:87 [inline] at addr ffff8801d6a1f6b0 BUG: KASAN: stack-out-of-bounds in xfrm_selector_match+0x237/0xe40 net/xfrm/xfrm_policy.c:101 at addr ffff8801d6a1f6b0 Read of size 4 by task syzkaller586008/3345 page:ffffea00075a87c0 count:0 mapcount:0 mapping: (null) index:0x0 flags: 0x200000000000000() page dumped because: kasan: bad access detected CPU: 1 PID: 3345 Comm: syzkaller586008 Tainted: G B 4.9.39-g72a0c9f #6 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801d6a1f200 ffffffff81eacd59 ffffed003ad43ed6 0000000000000004 0000000000000000 ffffed003ad43ed6 ffff8801d6a1f6b0 ffff8801d6a1f280 ffffffff81547141 0000000000000000 0000000000000000 ffffffff833ed127 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] print_address_description mm/kasan/report.c:208 [inline] [] kasan_report_error mm/kasan/report.c:287 [inline] [] kasan_report.part.1+0x4a1/0x4e0 mm/kasan/report.c:309 [] kasan_report mm/kasan/report.c:329 [inline] [] __asan_report_load4_noabort+0x29/0x30 mm/kasan/report.c:329 [] addr_match include/net/xfrm.h:838 [inline] [] __xfrm6_selector_match net/xfrm/xfrm_policy.c:87 [inline] [] xfrm_selector_match+0x237/0xe40 net/xfrm/xfrm_policy.c:101 [] xfrm_sk_policy_lookup+0x113/0x390 net/xfrm/xfrm_policy.c:1259 [] xfrm_lookup+0x1ab/0xbf0 net/xfrm/xfrm_policy.c:2209 [] xfrm_lookup_route+0x39/0x1a0 net/xfrm/xfrm_policy.c:2343 [] ip_route_output_flow+0x7f/0xa0 net/ipv4/route.c:2430 [] udp_sendmsg+0xe15/0x1bf0 net/ipv4/udp.c:1026 [] udpv6_sendmsg+0x55f/0x2360 net/ipv6/udp.c:1085 [] inet_sendmsg+0x2bc/0x4c0 net/ipv4/af_inet.c:753 [] sock_sendmsg_nosec net/socket.c:635 [inline] [] sock_sendmsg+0xca/0x110 net/socket.c:645 [] ___sys_sendmsg+0x2f4/0x820 net/socket.c:1968 [] __sys_sendmmsg+0x151/0x390 net/socket.c:2058 [] SYSC_sendmmsg net/socket.c:2089 [inline] [] SyS_sendmmsg+0x35/0x60 net/socket.c:2084 [] entry_SYSCALL_64_fastpath+0x23/0xc6 Memory state around the buggy address: ffff8801d6a1f580: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 00 ffff8801d6a1f600: f2 f2 f2 f2 f2 f2 f2 00 00 00 00 f2 f2 f2 f2 00 >ffff8801d6a1f680: 00 00 00 00 00 00 f2 f2 f2 f2 f2 00 00 00 00 00 ^ ffff8801d6a1f700: 00 00 00 00 f2 f2 f2 f3 f3 f3 f3 00 00 00 00 00 ffff8801d6a1f780: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ================================================================== ================================================================== BUG: KASAN: stack-out-of-bounds in xfrm_flowi_dport include/net/xfrm.h:889 [inline] at addr ffff8801d6a1f6c4 BUG: KASAN: stack-out-of-bounds in __xfrm6_selector_match net/xfrm/xfrm_policy.c:88 [inline] at addr ffff8801d6a1f6c4 BUG: KASAN: stack-out-of-bounds in xfrm_selector_match+0xe05/0xe40 net/xfrm/xfrm_policy.c:101 at addr ffff8801d6a1f6c4 Read of size 2 by task syzkaller586008/3345 page:ffffea00075a87c0 count:0 mapcount:0 mapping: (null) index:0x0 flags: 0x200000000000000() page dumped because: kasan: bad access detected CPU: 1 PID: 3345 Comm: syzkaller586008 Tainted: G B 4.9.39-g72a0c9f #6 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 ffff8801d6a1f200 ffffffff81eacd59 ffffed003ad43ed8 0000000000000002 0000000000000000 ffffed003ad43ed8 ffff8801d6a1f6c4 ffff8801d6a1f280 ffffffff81547141 0000000000000010 0000000000000000 ffffffff833edcf5 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xc1/0x128 lib/dump_stack.c:51 [] print_address_description mm/kasan/report.c:208 [inline] [] kasan_report_error mm/kasan/report.c:287 [inline] [] kasan_report.part.1+0x4a1/0x4e0 mm/kasan/report.c:309 [] kasan_report mm/kasan/report.c:328 [inline] [] __asan_report_load2_noabort+0x29/0x30 mm/kasan/report.c:328 [] xfrm_flowi_dport include/net/xfrm.h:889 [inline] [] __xfrm6_selector_match net/xfrm/xfrm_policy.c:88 [inline] [] xfrm_selector_match+0xe05/0xe40 net/xfrm/xfrm_policy.c:101 [] xfrm_sk_policy_lookup+0x113/0x390 net/xfrm/xfrm_policy.c:1259 [] xfrm_lookup+0x1ab/0xbf0 net/xfrm/xfrm_policy.c:2209 [] xfrm_lookup_route+0x39/0x1a0 net/xfrm/xfrm_policy.c:2343 [] ip_route_output_flow+0x7f/0xa0 net/ipv4/route.c:2430 [] udp_sendmsg+0xe15/0x1bf0 net/ipv4/udp.c:1026 [] udpv6_sendmsg+0x55f/0x2360 net/ipv6/udp.c:1085 [] inet_sendmsg+0x2bc/0x4c0 net/ipv4/af_inet.c:753 [] sock_sendmsg_nosec net/socket.c:635 [inline] [] sock_sendmsg+0xca/0x110 net/socket.c:645 [] ___sys_sendmsg+0x2f4/0x820 net/socket.c:1968 [] __sys_sendmmsg+0x151/0x390 net/socket.c:2058 [] SYSC_sendmmsg net/socket.c:2089 [inline] [] SyS_sendmmsg+0x35/0x60 net/socket.c:2084