================================================================== BUG: KASAN: slab-out-of-bounds in class_equal+0x40/0x50 kernel/locking/lockdep.c:1527 Read of size 8 at addr ffff88808601f1a0 by task syz-executor.1/10371 CPU: 0 PID: 10371 Comm: syz-executor.1 Not tainted 5.2.0-rc4+ #26 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: Allocated by task 9639: save_stack+0x23/0x90 mm/kasan/common.c:71 set_track mm/kasan/common.c:79 [inline] __kasan_kmalloc mm/kasan/common.c:489 [inline] __kasan_kmalloc.constprop.0+0xcf/0xe0 mm/kasan/common.c:462 kasan_slab_alloc+0xf/0x20 mm/kasan/common.c:497 slab_post_alloc_hook mm/slab.h:437 [inline] slab_alloc_node mm/slab.c:3269 [inline] kmem_cache_alloc_node+0x131/0x710 mm/slab.c:3579 __alloc_skb+0xd5/0x5e0 net/core/skbuff.c:194 alloc_skb include/linux/skbuff.h:1054 [inline] netlink_dump+0x312/0xfb0 net/netlink/af_netlink.c:2223 netlink_recvmsg+0xb9f/0xf10 net/netlink/af_netlink.c:2005 sock_recvmsg_nosec net/socket.c:877 [inline] sock_recvmsg net/socket.c:894 [inline] sock_recvmsg+0xce/0x110 net/socket.c:890 ___sys_recvmsg+0x271/0x5a0 net/socket.c:2448 __sys_recvmsg+0x102/0x1d0 net/socket.c:2497 __do_sys_recvmsg net/socket.c:2507 [inline] __se_sys_recvmsg net/socket.c:2504 [inline] __x64_sys_recvmsg+0x78/0xb0 net/socket.c:2504 do_syscall_64+0xfd/0x680 arch/x86/entry/common.c:301 entry_SYSCALL_64_after_hwframe+0x49/0xbe Freed by task 9639: save_stack+0x23/0x90 mm/kasan/common.c:71 set_track mm/kasan/common.c:79 [inline] __kasan_slab_free+0x102/0x150 mm/kasan/common.c:451 kasan_slab_free+0xe/0x10 mm/kasan/common.c:459 __cache_free mm/slab.c:3432 [inline] kmem_cache_free+0x86/0x260 mm/slab.c:3698 kfree_skbmem net/core/skbuff.c:620 [inline] kfree_skbmem+0xc5/0x150 net/core/skbuff.c:614 __kfree_skb net/core/skbuff.c:677 [inline] consume_skb net/core/skbuff.c:736 [inline] consume_skb+0xea/0x380 net/core/skbuff.c:730 skb_free_datagram+0x1b/0x100 net/core/datagram.c:328 netlink_recvmsg+0x6c6/0xf10 net/netlink/af_netlink.c:2001 sock_recvmsg_nosec net/socket.c:877 [inline] sock_recvmsg net/socket.c:894 [inline] sock_recvmsg+0xce/0x110 net/socket.c:890 ___sys_recvmsg+0x271/0x5a0 net/socket.c:2448 __sys_recvmsg+0x102/0x1d0 net/socket.c:2497 __do_sys_recvmsg net/socket.c:2507 [inline] __se_sys_recvmsg net/socket.c:2504 [inline] __x64_sys_recvmsg+0x78/0xb0 net/socket.c:2504 do_syscall_64+0xfd/0x680 arch/x86/entry/common.c:301 entry_SYSCALL_64_after_hwframe+0x49/0xbe The buggy address belongs to the object at ffff88808601f080 which belongs to the cache skbuff_head_cache of size 224 The buggy address is located 64 bytes to the right of 224-byte region [ffff88808601f080, ffff88808601f160) The buggy address belongs to the page: page:ffffea00021807c0 refcount:1 mapcount:0 mapping:ffff88821baabb40 index:0xffff88808601fe40 flags: 0x1fffc0000000200(slab) raw: 01fffc0000000200 ffffea0002676008 ffffea000267c048 ffff88821baabb40 raw: ffff88808601fe40 ffff88808601f080 0000000100000001 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff88808601f080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88808601f100: fb fb fb fb fb fb f1 f1 f1 f1 00 f2 f2 f2 00 f2 >ffff88808601f180: f2 f2 fc fc fc fc 00 00 00 f3 f3 f3 f3 f3 fb fb ^ ffff88808601f200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88808601f280: fb fb fb fb fc 00 00 00 00 00 00 00 00 fc fc fc ==================================================================