binder: 3976:3979 ioctl c0286404 207e2fd8 returned -22
BUG: KASAN: stack-out-of-bounds in memcmp+0xe3/0x160 lib/string.c:768 at addr ffff8801a6e278c0
Read of size 1 by task syz-executor7/4007
page:ffffea00069b89c0 count:0 mapcount:0 mapping:          (null) index:0x0
flags: 0x8000000000000000()
page dumped because: kasan: bad access detected
CPU: 1 PID: 4007 Comm: syz-executor7 Not tainted 4.9.40-ged32335 #11
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801a6e273d0 ffffffff81d8d829 ffffed0034dc4f18 0000000000000001
 0000000000000000 ffffed0034dc4f18 ffff8801a6e278c0 ffff8801a6e27458
 ffffffff81537fa3 0000000041b58ab3 ffffffff8418bae8 ffffffff81dab5c3
Call Trace:
 [<ffffffff81d8d829>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d8d829>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81537fa3>] print_address_description mm/kasan/report.c:208 [inline]
 [<ffffffff81537fa3>] kasan_report_error mm/kasan/report.c:287 [inline]
 [<ffffffff81537fa3>] kasan_report.part.1+0x4c3/0x500 mm/kasan/report.c:309
 [<ffffffff81538009>] kasan_report mm/kasan/report.c:327 [inline]
 [<ffffffff81538009>] __asan_report_load1_noabort+0x29/0x30 mm/kasan/report.c:327
 [<ffffffff81dab5c3>] memcmp+0xe3/0x160 lib/string.c:768
 [<ffffffff833b0537>] addr_match include/net/xfrm.h:830 [inline]
 [<ffffffff833b0537>] __xfrm6_selector_match net/xfrm/xfrm_policy.c:87 [inline]
 [<ffffffff833b0537>] xfrm_selector_match+0x1c7/0xe40 net/xfrm/xfrm_policy.c:101
 [<ffffffff833b12c3>] xfrm_sk_policy_lookup+0x113/0x390 net/xfrm/xfrm_policy.c:1259
 [<ffffffff833b37c3>] xfrm_lookup+0x1b3/0xc00 net/xfrm/xfrm_policy.c:2209
 [<ffffffff833b5109>] xfrm_lookup_route+0x39/0x1a0 net/xfrm/xfrm_policy.c:2343
 [<ffffffff831cfd7f>] ip_route_output_flow+0x7f/0xa0 net/ipv4/route.c:2430
 [<ffffffff832ac8a6>] udp_sendmsg+0xe36/0x1c10 net/ipv4/udp.c:1026
 [<ffffffff83479108>] udpv6_sendmsg+0x588/0x2390 net/ipv6/udp.c:1085
 [<ffffffff832dfaac>] inet_sendmsg+0x2bc/0x4c0 net/ipv4/af_inet.c:753
 [<ffffffff82ec5b9a>] sock_sendmsg_nosec net/socket.c:635 [inline]
 [<ffffffff82ec5b9a>] sock_sendmsg+0xca/0x110 net/socket.c:645
 [<ffffffff82ec6af8>] SYSC_sendto+0x2c8/0x340 net/socket.c:1670
 [<ffffffff82ec8fa0>] SyS_sendto+0x40/0x50 net/socket.c:1638
 [<ffffffff838a06c5>] entry_SYSCALL_64_fastpath+0x23/0xc6
Memory state around the buggy address:
 ffff8801a6e27780: 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1
 ffff8801a6e27800: f1 00 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 f2 f2 f2
>ffff8801a6e27880: f2 00 00 00 00 00 00 00 f2 f2 f2 f2 f2 00 00 00
                                           ^
 ffff8801a6e27900: 00 00 00 00 00 00 f2 f2 f2 00 00 00 00 00 00 00
 ffff8801a6e27980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
==================================================================
BUG: KASAN: stack-out-of-bounds in memcmp+0x126/0x160 lib/string.c:768 at addr ffff8801a6e278c1
Read of size 1 by task syz-executor7/4007
page:ffffea00069b89c0 count:0 mapcount:0 mapping:          (null) index:0x0
flags: 0x8000000000000000()
page dumped because: kasan: bad access detected
CPU: 1 PID: 4007 Comm: syz-executor7 Tainted: G    B           4.9.40-ged32335 #11
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801a6e273d0 ffffffff81d8d829 ffffed0034dc4f18 0000000000000001
 0000000000000000 ffffed0034dc4f18 ffff8801a6e278c1 ffff8801a6e27458
 ffffffff81537fa3 0000000000000010 ffffffff00000000 ffffffff81dab606
Call Trace:
 [<ffffffff81d8d829>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d8d829>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81537fa3>] print_address_description mm/kasan/report.c:208 [inline]
 [<ffffffff81537fa3>] kasan_report_error mm/kasan/report.c:287 [inline]
 [<ffffffff81537fa3>] kasan_report.part.1+0x4c3/0x500 mm/kasan/report.c:309
 [<ffffffff81538009>] kasan_report mm/kasan/report.c:327 [inline]
 [<ffffffff81538009>] __asan_report_load1_noabort+0x29/0x30 mm/kasan/report.c:327
 [<ffffffff81dab606>] memcmp+0x126/0x160 lib/string.c:768
 [<ffffffff833b0537>] addr_match include/net/xfrm.h:830 [inline]
 [<ffffffff833b0537>] __xfrm6_selector_match net/xfrm/xfrm_policy.c:87 [inline]
 [<ffffffff833b0537>] xfrm_selector_match+0x1c7/0xe40 net/xfrm/xfrm_policy.c:101
 [<ffffffff833b12c3>] xfrm_sk_policy_lookup+0x113/0x390 net/xfrm/xfrm_policy.c:1259
 [<ffffffff833b37c3>] xfrm_lookup+0x1b3/0xc00 net/xfrm/xfrm_policy.c:2209
 [<ffffffff833b5109>] xfrm_lookup_route+0x39/0x1a0 net/xfrm/xfrm_policy.c:2343
 [<ffffffff831cfd7f>] ip_route_output_flow+0x7f/0xa0 net/ipv4/route.c:2430
 [<ffffffff832ac8a6>] udp_sendmsg+0xe36/0x1c10 net/ipv4/udp.c:1026
 [<ffffffff83479108>] udpv6_sendmsg+0x588/0x2390 net/ipv6/udp.c:1085
 [<ffffffff832dfaac>] inet_sendmsg+0x2bc/0x4c0 net/ipv4/af_inet.c:753
 [<ffffffff82ec5b9a>] sock_sendmsg_nosec net/socket.c:635 [inline]
 [<ffffffff82ec5b9a>] sock_sendmsg+0xca/0x110 net/socket.c:645
 [<ffffffff82ec6af8>] SYSC_sendto+0x2c8/0x340 net/socket.c:1670
 [<ffffffff82ec8fa0>] SyS_sendto+0x40/0x50 net/socket.c:1638
 [<ffffffff838a06c5>] entry_SYSCALL_64_fastpath+0x23/0xc6
Memory state around the buggy address:
 ffff8801a6e27780: 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1
 ffff8801a6e27800: f1 00 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 f2 f2 f2
>ffff8801a6e27880: f2 00 00 00 00 00 00 00 f2 f2 f2 f2 f2 00 00 00
                                           ^
 ffff8801a6e27900: 00 00 00 00 00 00 f2 f2 f2 00 00 00 00 00 00 00
 ffff8801a6e27980: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
netlink: 5 bytes leftover after parsing attributes in process `syz-executor5'.
binder: 4062:4067 ioctl 540f 206e8ffc returned -22
binder: 4062:4067 ioctl 5401 208b1fdc returned -22
binder: 4062:4067 ioctl 540f 206e8ffc returned -22
binder: 4062:4067 ioctl 5401 208b1fdc returned -22
netlink: 5 bytes leftover after parsing attributes in process `syz-executor5'.
keychord: Insufficient bytes present for keycount 42
keychord: Insufficient bytes present for keycount 42
netlink: 3 bytes leftover after parsing attributes in process `syz-executor6'.
netlink: 3 bytes leftover after parsing attributes in process `syz-executor6'.
random: crng init done
binder: 5060:5066 ioctl 80404507 2051dfc3 returned -22
binder: 5060:5093 ioctl 80404507 2051dfc3 returned -22
binder: 5219:5220 ioctl 400454ca 20313fd8 returned -22
binder: 5219:5220 ioctl 540c 0 returned -22
binder: 5219:5236 ioctl 400454ca 20313fd8 returned -22
binder: 5281:5285 ioctl 2403 5 returned -22
binder: 5281:5285 ioctl 80044584 20818000 returned -22
binder: 5281:5296 ioctl 2403 5 returned -22
binder: 5281:5285 ioctl 80044584 20818000 returned -22
binder: 5838:5843 ioctl c010640b 20926000 returned -22
binder: 5838:5843 ioctl c010640b 20926000 returned -22
binder: 6216:6222 ioctl c0bc5351 20d05f44 returned -22
binder: 6216:6239 ioctl c0bc5351 20d05f44 returned -22
binder: 6725:6727 ioctl 540f 2043a000 returned -22
netlink: 5 bytes leftover after parsing attributes in process `syz-executor6'.
netlink: 5 bytes leftover after parsing attributes in process `syz-executor6'.
binder: 6932:6939 ioctl 4b6d 0 returned -22
binder: 6932:6948 ioctl 8933 20465fd8 returned -22
netlink: 1 bytes leftover after parsing attributes in process `syz-executor7'.
netlink: 1 bytes leftover after parsing attributes in process `syz-executor7'.
binder: 7385:7390 ioctl 2402 f109 returned -22
binder: 7385:7397 ioctl 2402 f109 returned -22
binder: 7572:7578 ioctl 40106436 20003000 returned -22
binder: 7572:7585 ioctl 40106436 20003000 returned -22
netlink: 5 bytes leftover after parsing attributes in process `syz-executor3'.
netlink: 5 bytes leftover after parsing attributes in process `syz-executor3'.
netlink: 3 bytes leftover after parsing attributes in process `syz-executor2'.
netlink: 3 bytes leftover after parsing attributes in process `syz-executor2'.
netlink: 3 bytes leftover after parsing attributes in process `syz-executor2'.
netlink: 3 bytes leftover after parsing attributes in process `syz-executor2'.