================================================================== BUG: KASAN: slab-out-of-bounds in decode_session6 net/xfrm/xfrm_policy.c:3394 [inline] BUG: KASAN: slab-out-of-bounds in __xfrm_decode_session+0x1cfb/0x2e90 net/xfrm/xfrm_policy.c:3486 Read of size 1 at addr ffff8880919896b6 by task syz-executor.5/19037 CPU: 0 PID: 19037 Comm: syz-executor.5 Not tainted 5.7.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x188/0x20d lib/dump_stack.c:118 print_address_description.constprop.0.cold+0xd3/0x315 mm/kasan/report.c:382 __kasan_report.cold+0x35/0x4d mm/kasan/report.c:511 kasan_report+0x33/0x50 mm/kasan/common.c:625 decode_session6 net/xfrm/xfrm_policy.c:3394 [inline] __xfrm_decode_session+0x1cfb/0x2e90 net/xfrm/xfrm_policy.c:3486 xfrm_decode_session_reverse include/net/xfrm.h:1145 [inline] icmpv6_route_lookup+0x2fe/0x470 net/ipv6/icmp.c:388 icmp6_send+0x1263/0x23b0 net/ipv6/icmp.c:588 icmpv6_send+0xde/0x210 net/ipv6/ip6_icmp.c:43 ip6_link_failure+0x26/0x520 net/ipv6/route.c:2665 dst_link_failure include/net/dst.h:418 [inline] ip6_tnl_xmit+0x460/0x3470 net/ipv6/ip6_tunnel.c:1248 ip6ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1402 [inline] ip6_tnl_start_xmit+0x89a/0x1dc0 net/ipv6/ip6_tunnel.c:1428 __netdev_start_xmit include/linux/netdevice.h:4599 [inline] netdev_start_xmit include/linux/netdevice.h:4613 [inline] xmit_one net/core/dev.c:3545 [inline] dev_hard_start_xmit+0x1a4/0x9b0 net/core/dev.c:3561 sch_direct_xmit+0x345/0xc20 net/sched/sch_generic.c:313 qdisc_restart net/sched/sch_generic.c:376 [inline] __qdisc_run+0x4d1/0x17b0 net/sched/sch_generic.c:384 __dev_xmit_skb net/core/dev.c:3784 [inline] __dev_queue_xmit+0x165b/0x3090 net/core/dev.c:4089 neigh_output include/net/neighbour.h:510 [inline] ip6_finish_output2+0x1091/0x25b0 net/ipv6/ip6_output.c:117 __ip6_finish_output+0x442/0xab0 net/ipv6/ip6_output.c:143 ip6_finish_output+0x34/0x1f0 net/ipv6/ip6_output.c:153 NF_HOOK_COND include/linux/netfilter.h:296 [inline] ip6_output+0x239/0x810 net/ipv6/ip6_output.c:176 dst_output include/net/dst.h:435 [inline] NF_HOOK include/linux/netfilter.h:307 [inline] NF_HOOK include/linux/netfilter.h:301 [inline] ip6_xmit+0xe1a/0x2090 net/ipv6/ip6_output.c:280 inet6_csk_xmit+0x339/0x610 net/ipv6/inet6_connection_sock.c:135 __tcp_transmit_skb+0x1a18/0x3770 net/ipv4/tcp_output.c:1238 tcp_transmit_skb net/ipv4/tcp_output.c:1254 [inline] tcp_send_syn_data net/ipv4/tcp_output.c:3605 [inline] tcp_connect+0x1b15/0x42b0 net/ipv4/tcp_output.c:3670 tcp_sendmsg_fastopen net/ipv4/tcp.c:1155 [inline] tcp_sendmsg_locked+0x28f1/0x3210 net/ipv4/tcp.c:1206 tcp_sendmsg+0x2b/0x40 net/ipv4/tcp.c:1433 inet6_sendmsg+0x99/0xe0 net/ipv6/af_inet6.c:577 sock_sendmsg_nosec net/socket.c:652 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:672 ____sys_sendmsg+0x308/0x7e0 net/socket.c:2362 ___sys_sendmsg+0x100/0x170 net/socket.c:2416 __sys_sendmmsg+0x195/0x480 net/socket.c:2506 __do_sys_sendmmsg net/socket.c:2535 [inline] __se_sys_sendmmsg net/socket.c:2532 [inline] __x64_sys_sendmmsg+0x99/0x100 net/socket.c:2532 do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295 entry_SYSCALL_64_after_hwframe+0x49/0xb3 RIP: 0033:0x45c829 Code: 0d b7 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b6 fb ff c3 66 2e 0f 1f 84 00 00 00 00 RSP: 002b:00007f01be561c78 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 RAX: ffffffffffffffda RBX: 00000000004fc320 RCX: 000000000045c829 RDX: 04000000000000ae RSI: 00000000200000c0 RDI: 0000000000000003 RBP: 000000000078bfa0 R08: 0000000000000000 R09: 0000000000000000 R10: 00000000240000ec R11: 0000000000000246 R12: 00000000ffffffff R13: 00000000000008dd R14: 00000000004cb81f R15: 00007f01be5626d4 Allocated by task 11884: save_stack+0x1b/0x40 mm/kasan/common.c:49 set_track mm/kasan/common.c:57 [inline] __kasan_kmalloc mm/kasan/common.c:495 [inline] __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:468 __do_kmalloc mm/slab.c:3656 [inline] __kmalloc_track_caller+0x159/0x7a0 mm/slab.c:3671 kmemdup+0x23/0x50 mm/util.c:127 kmemdup include/linux/string.h:454 [inline] neigh_sysctl_register+0x9a/0x680 net/core/neighbour.c:3626 devinet_sysctl_register+0xb1/0x230 net/ipv4/devinet.c:2608 inetdev_init+0x227/0x4b0 net/ipv4/devinet.c:276 inetdev_event+0xfdb/0x15b0 net/ipv4/devinet.c:1530 notifier_call_chain+0xc0/0x230 kernel/notifier.c:83 call_netdevice_notifiers_info net/core/dev.c:2016 [inline] call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:2001 call_netdevice_notifiers_extack net/core/dev.c:2028 [inline] call_netdevice_notifiers net/core/dev.c:2042 [inline] register_netdevice+0xd70/0x10b0 net/core/dev.c:9509 __ip_tunnel_create+0x349/0x510 net/ipv4/ip_tunnel.c:265 ip_tunnel_init_net+0x370/0x9e0 net/ipv4/ip_tunnel.c:1056 ops_init+0xaf/0x420 net/core/net_namespace.c:151 setup_net+0x2de/0x860 net/core/net_namespace.c:341 copy_net_ns+0x293/0x590 net/core/net_namespace.c:482 create_new_namespaces+0x3fb/0xb30 kernel/nsproxy.c:108 unshare_nsproxy_namespaces+0xbd/0x1f0 kernel/nsproxy.c:229 ksys_unshare+0x43d/0x8e0 kernel/fork.c:2969 __do_sys_unshare kernel/fork.c:3037 [inline] __se_sys_unshare kernel/fork.c:3035 [inline] __x64_sys_unshare+0x2d/0x40 kernel/fork.c:3035 do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295 entry_SYSCALL_64_after_hwframe+0x49/0xb3 Freed by task 295: save_stack+0x1b/0x40 mm/kasan/common.c:49 set_track mm/kasan/common.c:57 [inline] kasan_set_free_info mm/kasan/common.c:317 [inline] __kasan_slab_free+0xf7/0x140 mm/kasan/common.c:456 __cache_free mm/slab.c:3426 [inline] kfree+0x109/0x2b0 mm/slab.c:3757 neigh_sysctl_unregister+0x63/0x80 net/core/neighbour.c:3712 inetdev_destroy net/ipv4/devinet.c:323 [inline] inetdev_event+0x1191/0x15b0 net/ipv4/devinet.c:1598 notifier_call_chain+0xc0/0x230 kernel/notifier.c:83 call_netdevice_notifiers_info net/core/dev.c:2016 [inline] call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:2001 call_netdevice_notifiers_extack net/core/dev.c:2028 [inline] call_netdevice_notifiers net/core/dev.c:2042 [inline] rollback_registered_many+0x75c/0xe70 net/core/dev.c:8925 unregister_netdevice_many.part.0+0x16/0x1e0 net/core/dev.c:10074 unregister_netdevice_many+0x36/0x50 net/core/dev.c:10073 ip_tunnel_delete_nets+0x3e6/0x5b0 net/ipv4/ip_tunnel.c:1109 ops_exit_list.isra.0+0x103/0x150 net/core/net_namespace.c:189 cleanup_net+0x511/0xa50 net/core/net_namespace.c:603 process_one_work+0x965/0x16a0 kernel/workqueue.c:2268 worker_thread+0x96/0xe20 kernel/workqueue.c:2414 kthread+0x388/0x470 kernel/kthread.c:268 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:352 The buggy address belongs to the object at ffff888091989000 which belongs to the cache kmalloc-2k of size 2048 The buggy address is located 1718 bytes inside of 2048-byte region [ffff888091989000, ffff888091989800) The buggy address belongs to the page: page:ffffea0002466240 refcount:1 mapcount:0 mapping:00000000aeb06989 index:0x0 flags: 0xfffe0000000200(slab) raw: 00fffe0000000200 ffffea0002584b88 ffffea0001227d88 ffff8880aa000e00 raw: 0000000000000000 ffff888091989000 0000000100000001 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff888091989580: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888091989600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff888091989680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff888091989700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888091989780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ==================================================================