================================================================== BUG: KASAN: slab-out-of-bounds in tipc_nametbl_lookup_dst_nodes+0x448/0x4b0 net/tipc/name_table.c:670 Read of size 4 at addr ffff8801dadf9890 by task syz-executor4/8578 CPU: 1 PID: 8578 Comm: syz-executor4 Not tainted 4.14.0-rc7+ #159 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 print_address_description+0x73/0x250 mm/kasan/report.c:252 kasan_report_error mm/kasan/report.c:351 [inline] kasan_report+0x25b/0x340 mm/kasan/report.c:409 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:429 tipc_nametbl_lookup_dst_nodes+0x448/0x4b0 net/tipc/name_table.c:670 tipc_sendmcast+0x70b/0xe20 net/tipc/socket.c:767 __tipc_sendmsg+0xf49/0x1590 net/tipc/socket.c:971 __tipc_sendstream+0x8eb/0xc00 net/tipc/socket.c:1065 tipc_sendstream+0x50/0x70 net/tipc/socket.c:1039 tipc_send_packet+0x33/0x50 net/tipc/socket.c:1113 sock_sendmsg_nosec net/socket.c:633 [inline] sock_sendmsg+0xca/0x110 net/socket.c:643 ___sys_sendmsg+0x755/0x890 net/socket.c:2049 __sys_sendmsg+0xe5/0x210 net/socket.c:2083 SYSC_sendmsg net/socket.c:2094 [inline] SyS_sendmsg+0x2d/0x50 net/socket.c:2090 entry_SYSCALL_64_fastpath+0x1f/0xbe RIP: 0033:0x452869 RSP: 002b:00007fda81ae6be8 EFLAGS: 00000212 ORIG_RAX: 000000000000002e RAX: ffffffffffffffda RBX: 0000000000758020 RCX: 0000000000452869 RDX: 0000000000000004 RSI: 00000000203bbfc8 RDI: 0000000000000019 RBP: 0000000000000082 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000212 R12: 00000000006f43b8 R13: 00000000ffffffff R14: 00007fda81ae76d4 R15: 0000000000000000 Allocated by task 3031: save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59 save_stack+0x43/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551 kmem_cache_alloc_trace+0x136/0x750 mm/slab.c:3628 kmalloc include/linux/slab.h:494 [inline] kmalloc_array include/linux/slab.h:612 [inline] kcalloc include/linux/slab.h:624 [inline] tipc_subseq_alloc net/tipc/name_table.c:141 [inline] tipc_nameseq_create+0xe8/0x540 net/tipc/name_table.c:152 tipc_nametbl_insert_publ+0xf77/0x17c0 net/tipc/name_table.c:476 tipc_nametbl_publish+0x2aa/0x4f0 net/tipc/name_table.c:701 tipc_sk_publish net/tipc/socket.c:2201 [inline] tipc_bind+0x33a/0x700 net/tipc/socket.c:629 kernel_bind+0x62/0x80 net/socket.c:3285 tipc_create_listen_sock net/tipc/server.c:337 [inline] tipc_open_listening_sock net/tipc/server.c:395 [inline] tipc_server_start+0x39b/0xb60 net/tipc/server.c:610 tipc_topsrv_start+0x649/0x880 net/tipc/subscr.c:382 tipc_init_net+0x3cc/0x570 net/tipc/core.c:74 ops_init+0x10a/0x570 net/core/net_namespace.c:118 setup_net+0x313/0x710 net/core/net_namespace.c:294 copy_net_ns+0x27c/0x580 net/core/net_namespace.c:418 create_new_namespaces+0x425/0x880 kernel/nsproxy.c:107 copy_namespaces+0x340/0x400 kernel/nsproxy.c:165 copy_process.part.39+0x2295/0x4af0 kernel/fork.c:1760 copy_process kernel/fork.c:1570 [inline] _do_fork+0x1ef/0xfb0 kernel/fork.c:2049 SYSC_clone kernel/fork.c:2159 [inline] SyS_clone+0x37/0x50 kernel/fork.c:2153 do_syscall_64+0x26c/0x8d0 arch/x86/entry/common.c:287 return_from_SYSCALL_64+0x0/0x7a Freed by task 1: save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:59 save_stack+0x43/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_slab_free+0x71/0xc0 mm/kasan/kasan.c:524 __cache_free mm/slab.c:3504 [inline] kfree+0xca/0x250 mm/slab.c:3821 acpi_os_free include/acpi/platform/aclinuxex.h:96 [inline] acpi_ns_get_node_unlocked+0x294/0x2ca drivers/acpi/acpica/nsutils.c:732 acpi_ns_get_node+0x44/0x62 drivers/acpi/acpica/nsutils.c:772 acpi_ns_evaluate+0xc8/0x8d3 drivers/acpi/acpica/nseval.c:103 acpi_ut_evaluate_object+0x122/0x3c4 drivers/acpi/acpica/uteval.c:94 acpi_ut_execute_STA+0x87/0x17c drivers/acpi/acpica/uteval.c:257 acpi_get_object_info+0x54e/0xc6c drivers/acpi/acpica/nsxfname.c:386 acpi_set_pnp_ids drivers/acpi/scan.c:1243 [inline] acpi_init_device_object+0x1024/0x1b70 drivers/acpi/scan.c:1555 acpi_add_single_object+0x1ca/0x1d80 drivers/acpi/scan.c:1587 acpi_bus_check_add+0x380/0xa50 drivers/acpi/scan.c:1827 acpi_ns_walk_namespace+0x1d1/0x31e drivers/acpi/acpica/nswalk.c:270 acpi_walk_namespace+0xb5/0xef drivers/acpi/acpica/nsxfeval.c:641 acpi_bus_scan+0x120/0x150 drivers/acpi/scan.c:2008 acpi_scan_init+0x3c9/0x843 drivers/acpi/scan.c:2149 acpi_init+0x830/0x8e6 drivers/acpi/bus.c:1228 do_one_initcall+0x9e/0x330 init/main.c:826 do_initcall_level init/main.c:892 [inline] do_initcalls init/main.c:900 [inline] do_basic_setup init/main.c:918 [inline] kernel_init_freeable+0x469/0x521 init/main.c:1066 kernel_init+0x13/0x172 init/main.c:993 ret_from_fork+0x2a/0x40 arch/x86/entry/entry_64.S:432 The buggy address belongs to the object at ffff8801dadf9880 which belongs to the cache kmalloc-32 of size 32 The buggy address is located 16 bytes inside of 32-byte region [ffff8801dadf9880, ffff8801dadf98a0) The buggy address belongs to the page: page:ffffea00076b7e40 count:1 mapcount:0 mapping:ffff8801dadf9000 index:0xffff8801dadf9fc1 flags: 0x200000000000100(slab) raw: 0200000000000100 ffff8801dadf9000 ffff8801dadf9fc1 000000010000003a raw: ffffea00072fc1e0 ffffea0007251360 ffff8801dac001c0 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8801dadf9780: 03 fc fc fc fc fc fc fc fb fb fb fb fc fc fc fc ffff8801dadf9800: fb fb fb fb fc fc fc fc 03 fc fc fc fc fc fc fc >ffff8801dadf9880: 00 00 fc fc fc fc fc fc 00 00 00 00 fc fc fc fc ^ ffff8801dadf9900: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc ffff8801dadf9980: 00 00 00 fc fc fc fc fc 05 fc fc fc fc fc fc fc ==================================================================