netlink: 'syz-executor3': attribute type 20 has an invalid length. ================================================================== BUG: KASAN: slab-out-of-bounds in erspan_build_header+0x3bf/0x3d0 net/ipv4/ip_gre.c:698 netlink: 'syz-executor3': attribute type 20 has an invalid length. Read of size 2 at addr ffff8801cb02c84b by task syz-executor4/11661 CPU: 1 PID: 11661 Comm: syz-executor4 Not tainted 4.15.0-rc9+ #189 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 print_address_description+0x73/0x250 mm/kasan/report.c:252 kasan_report_error mm/kasan/report.c:351 [inline] kasan_report+0x25b/0x340 mm/kasan/report.c:409 __asan_report_load_n_noabort+0xf/0x20 mm/kasan/report.c:440 erspan_build_header+0x3bf/0x3d0 net/ipv4/ip_gre.c:698 erspan_xmit+0x3b8/0x13b0 net/ipv4/ip_gre.c:740 __netdev_start_xmit include/linux/netdevice.h:4042 [inline] netdev_start_xmit include/linux/netdevice.h:4051 [inline] packet_direct_xmit+0x315/0x6b0 net/packet/af_packet.c:266 packet_snd net/packet/af_packet.c:2943 [inline] packet_sendmsg+0x3aed/0x60b0 net/packet/af_packet.c:2968 sock_sendmsg_nosec net/socket.c:638 [inline] sock_sendmsg+0xca/0x110 net/socket.c:648 SYSC_sendto+0x361/0x5c0 net/socket.c:1729 SyS_sendto+0x40/0x50 net/socket.c:1697 do_syscall_32_irqs_on arch/x86/entry/common.c:327 [inline] do_fast_syscall_32+0x3ee/0xf9d arch/x86/entry/common.c:389 entry_SYSENTER_compat+0x54/0x63 arch/x86/entry/entry_64_compat.S:129 RIP: 0023:0xf7f0ac79 RSP: 002b:00000000f770608c EFLAGS: 00000296 ORIG_RAX: 0000000000000171 RAX: ffffffffffffffda RBX: 0000000000000013 RCX: 000000002061c000 RDX: 0000000000000001 RSI: 0000000000000000 RDI: 000000002048c000 RBP: 000000000000001c R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 Allocated by task 7241: save_stack+0x43/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551 kmem_cache_alloc_trace+0x136/0x750 mm/slab.c:3610 kmalloc include/linux/slab.h:499 [inline] kzalloc include/linux/slab.h:688 [inline] sctp_add_bind_addr+0xd8/0x460 net/sctp/bind_addr.c:159 sctp_copy_local_addr_list+0x4bb/0x5e0 net/sctp/protocol.c:230 sctp_copy_one_addr+0xdc/0x120 net/sctp/bind_addr.c:449 sctp_bind_addr_copy+0x167/0x360 net/sctp/bind_addr.c:71 sctp_assoc_set_bind_addr_from_ep+0x136/0x190 net/sctp/associola.c:1578 sctp_sf_do_unexpected_init.isra.28+0x65f/0x13b0 net/sctp/sm_statefuns.c:1508 sctp_sf_do_5_2_1_siminit+0x35/0x40 net/sctp/sm_statefuns.c:1645 sctp_do_sm+0x18a/0x6a20 net/sctp/sm_sideeffect.c:1190 sctp_assoc_bh_rcv+0x283/0x4b0 net/sctp/associola.c:1065 sctp_inq_push+0x23b/0x300 net/sctp/inqueue.c:95 sctp_backlog_rcv+0x177/0xaa0 net/sctp/input.c:350 sk_backlog_rcv include/net/sock.h:907 [inline] __release_sock+0x124/0x360 net/core/sock.c:2264 release_sock+0xa4/0x2a0 net/core/sock.c:2779 sctp_wait_for_connect+0x346/0x570 net/sctp/socket.c:8167 sctp_sendmsg+0x2a28/0x3420 net/sctp/socket.c:2050 inet_sendmsg+0x11f/0x5e0 net/ipv4/af_inet.c:763 sock_sendmsg_nosec net/socket.c:638 [inline] sock_sendmsg+0xca/0x110 net/socket.c:648 SYSC_sendto+0x361/0x5c0 net/socket.c:1729 SyS_sendto+0x40/0x50 net/socket.c:1697 do_syscall_32_irqs_on arch/x86/entry/common.c:327 [inline] do_fast_syscall_32+0x3ee/0xf9d arch/x86/entry/common.c:389 entry_SYSENTER_compat+0x54/0x63 arch/x86/entry/entry_64_compat.S:129 Freed by task 7: save_stack+0x43/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524 __cache_free mm/slab.c:3488 [inline] kfree+0xd6/0x260 mm/slab.c:3803 __rcu_reclaim kernel/rcu/rcu.h:190 [inline] rcu_do_batch kernel/rcu/tree.c:2758 [inline] invoke_rcu_callbacks kernel/rcu/tree.c:3012 [inline] __rcu_process_callbacks kernel/rcu/tree.c:2979 [inline] rcu_process_callbacks+0xe94/0x17f0 kernel/rcu/tree.c:2996 __do_softirq+0x2d7/0xb85 kernel/softirq.c:285 The buggy address belongs to the object at ffff8801cb02c800 which belongs to the cache kmalloc-64 of size 64 The buggy address is located 11 bytes to the right of 64-byte region [ffff8801cb02c800, ffff8801cb02c840) The buggy address belongs to the page: page:ffffea00072c0b00 count:1 mapcount:0 mapping:ffff8801cb02c000 index:0xffff8801cb02c680 flags: 0x2fffc0000000100(slab) raw: 02fffc0000000100 ffff8801cb02c000 ffff8801cb02c680 0000000100000002 raw: ffffea00073329a0 ffffea0007621360 ffff8801dac00340 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8801cb02c700: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff8801cb02c780: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc >ffff8801cb02c800: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ^ ffff8801cb02c880: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff8801cb02c900: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ==================================================================