bisecting cause commit starting from 6c9594bdd47412ebf74616593b9dcad67c4e9e00 building syzkaller on d5696d51924aeb6957c19b616c888f58fe9a3740 testing commit 6c9594bdd47412ebf74616593b9dcad67c4e9e00 with gcc (GCC) 8.1.0 kernel signature: 122f5fa21a75a8f59119f5c2cab708c3deb8497d all runs: crashed: KASAN: stack-out-of-bounds Write in ax25_getname testing release v5.3 testing commit 4d856f72c10ecb060868ed10ff1b1453943fc6c8 with gcc (GCC) 8.1.0 kernel signature: 868f8b1eae2a6315ec167993ff47bf8c76bc7201 all runs: crashed: KASAN: stack-out-of-bounds Write in ax25_getname testing release v5.2 testing commit 0ecfebd2b52404ae0c54a878c872bb93363ada36 with gcc (GCC) 8.1.0 kernel signature: cbd146f66052ec8d5a3be443411683e0917a2ba3 all runs: crashed: KASAN: stack-out-of-bounds Write in ax25_getname testing release v5.1 testing commit e93c9c99a629c61837d5a7fc2120cd2b6c70dbdd with gcc (GCC) 8.1.0 kernel signature: c9724fc82ad360c94643216026da2f776c1b49ea all runs: crashed: KASAN: stack-out-of-bounds Write in ax25_getname testing release v5.0 testing commit 1c163f4c7b3f621efff9b28a47abb36f7378d783 with gcc (GCC) 8.1.0 kernel signature: 936c41ad748bdf8ff39f82b92d93321f3f0ae44b all runs: crashed: KASAN: stack-out-of-bounds Write in ax25_getname testing release v4.20 testing commit 8fe28cb58bcb235034b64cbbb7550a8a43fd88be with gcc (GCC) 8.1.0 kernel signature: 984bd4d8630463d75ca95573214620621fd45007 all runs: crashed: KASAN: stack-out-of-bounds Write in ax25_getname testing release v4.19 testing commit 84df9525b0c27f3ebc2ebb1864fa62a97fdedb7d with gcc (GCC) 8.1.0 kernel signature: 6426a0b341f4f8ee6c185ff233df6d325ad67150 all runs: crashed: KASAN: stack-out-of-bounds Write in ax25_getname testing release v4.18 testing commit 94710cac0ef4ee177a63b5227664b38c95bbf703 with gcc (GCC) 8.1.0 kernel signature: d630bd32713d1d5261b1515554351f15469d102b all runs: crashed: KASAN: stack-out-of-bounds Write in ax25_getname testing release v4.17 testing commit 29dcea88779c856c7dc92040a0c01233263101d4 with gcc (GCC) 8.1.0 kernel signature: 88dc89f09a21497c1a263299e8e801445ca28155 all runs: crashed: KASAN: stack-out-of-bounds Write in ax25_getname testing release v4.16 testing commit 0adb32858b0bddf4ada5f364a84ed60b196dbcda with gcc (GCC) 8.1.0 kernel signature: cb33f99fde6cdfb00d494fdb4a14ef8ac99b0de6 all runs: crashed: KASAN: stack-out-of-bounds Write in ax25_getname testing release v4.15 testing commit d8a5b80568a9cb66810e75b182018e9edb68e8ff with gcc (GCC) 8.1.0 kernel signature: dddbb76dc4efa17990ba81a9a415eb62eeaddeef all runs: crashed: KASAN: stack-out-of-bounds Write in ax25_getname testing release v4.14 testing commit bebc6082da0a9f5d47a1ea2edc099bf671058bd4 with gcc (GCC) 8.1.0 kernel signature: 4392fa8f7064a0e1a7b11cf9ca8c6482e3bdf93f all runs: crashed: KASAN: stack-out-of-bounds Write in ax25_getname testing release v4.13 testing commit 569dbb88e80deb68974ef6fdd6a13edb9d686261 with gcc (GCC) 8.1.0 kernel signature: ce0d193713ccc6f56fb24c799ffb21fdb44eba9e all runs: crashed: KASAN: stack-out-of-bounds Write in ax25_getname testing release v4.12 testing commit 6f7da290413ba713f0cdd9ff1a2a9bb129ef4f6c with gcc (GCC) 8.1.0 kernel signature: aef72d7bf97342dfba509730136bc9078ad3a789 all runs: crashed: KASAN: stack-out-of-bounds Write in ax25_getname testing release v4.11 testing commit a351e9b9fc24e982ec2f0e76379a49826036da12 with gcc (GCC) 7.3.0 kernel signature: 71f9377ff3b94d690f4ac30fc45167256fb4b03d all runs: crashed: KASAN: stack-out-of-bounds Write in ax25_getname testing release v4.10 testing commit c470abd4fde40ea6a0846a2beab642a578c0b8cd with gcc (GCC) 5.5.0 kernel signature: 95e1003f7c2a72ae4076e23dcbd5e7d285a6d8b4 all runs: crashed: KASAN: stack-out-of-bounds Write in ax25_getname testing release v4.9 testing commit 69973b830859bc6529a7a0468ba0d80ee5117826 with gcc (GCC) 5.5.0 kernel signature: 97000425ea2690e893ee5794bf818483c15ff9c5 all runs: crashed: KASAN: stack-out-of-bounds Write in ax25_getname testing release v4.8 testing commit c8d2bc9bc39ebea8437fd974fdbc21847bb897a3 with gcc (GCC) 5.5.0 kernel signature: 8b1b17869d32fcf1fb85c1502d239118f2c825be all runs: crashed: KASAN: stack-out-of-bounds Write in ax25_getname testing release v4.7 testing commit 523d939ef98fd712632d93a5a2b588e477a7565e with gcc (GCC) 5.5.0 kernel signature: 965b20351eb4467f7f32d182542fca2f95d53669 all runs: crashed: KASAN: stack-out-of-bounds Write in ax25_getname testing release v4.6 testing commit 2dcd0af568b0cf583645c8a317dd12e344b1c72a with gcc (GCC) 5.5.0 kernel signature: c4268d3263a31d0e171b39acc053082a2f3d6022 all runs: crashed: KASAN: stack-out-of-bounds Write in ax25_getname revisions tested: 20, total time: 2h45m30.325393336s (build: 1h36m38.292523556s, test: 1h6m18.346501683s) the crash already happened on the oldest tested release commit msg: Linux 4.6 crash: KASAN: stack-out-of-bounds Write in ax25_getname IPv6: ADDRCONF(NETDEV_UP): veth1_to_team: link is not ready IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready ================================================================== BUG: KASAN: stack-out-of-bounds in memset+0x1a/0x30 mm/kasan/kasan.c:301 at addr ffff8800ae457d38 Write of size 72 by task syz-executor.3/9350 page:ffffea0002b915c0 count:0 mapcount:0 mapping: (null) index:0x0 flags: 0x1fffc0000000000() page dumped because: kasan: bad access detected CPU: 1 PID: 9350 Comm: syz-executor.3 Not tainted 4.6.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 1ffffffff0d55786 ffff8800ae457ac0 ffffffff8299bd56 ffff8800ae457d38 ffff8800ae457b50 ffff8800ae457d38 0000000000000000 ffff8800ae457b40 ffffffff8173ab9a ffff8800aeef6200 ffff8800ae457cb8 0000000000000286 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xe6/0x120 lib/dump_stack.c:51 [] print_address_description mm/kasan/report.c:190 [inline] [] kasan_report_error+0x59a/0x5c0 mm/kasan/report.c:275 [] kasan_report+0x34/0x40 mm/kasan/report.c:297 [] check_memory_region mm/kasan/kasan.c:285 [inline] [] __asan_storeN+0x12d/0x180 mm/kasan/kasan.c:688 [] memset+0x1a/0x30 mm/kasan/kasan.c:301 [] ax25_getname+0x54/0x880 net/ax25/af_ax25.c:1398 [] get_raw_socket drivers/vhost/net.c:897 [inline] [] get_socket drivers/vhost/net.c:935 [inline] [] vhost_net_set_backend drivers/vhost/net.c:970 [inline] [] vhost_net_ioctl+0xd8b/0x12c0 drivers/vhost/net.c:1133 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Memory state around the buggy address: ffff8800ae457c00: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 ffff8800ae457c80: f4 f4 f4 f2 f2 f2 f2 04 f4 f4 f4 f2 f2 f2 f2 00 >ffff8800ae457d00: f4 f4 f4 f2 f2 f2 f2 00 00 00 00 00 00 04 f4 f3 ^ ffff8800ae457d80: f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8800ae457e00: f1 f1 f1 f1 00 f4 f4 f4 f2 f2 f2 f2 00 00 00 f4 ================================================================== ================================================================== BUG: KASAN: stack-out-of-bounds in memset+0x1a/0x30 mm/kasan/kasan.c:301 at addr ffff8800ae657d38 Write of size 72 by task syz-executor.3/10163 page:ffffea0002b995c0 count:0 mapcount:0 mapping: (null) index:0x0 flags: 0x1fffc0000000000() page dumped because: kasan: bad access detected CPU: 0 PID: 10163 Comm: syz-executor.3 Tainted: G B 4.6.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 1ffffffff0d55786 ffff8800ae657ac0 ffffffff8299bd56 ffff8800ae657d38 ffff8800ae657b50 ffff8800ae657d38 0000000000000000 ffff8800ae657b40 ffffffff8173ab9a ffff8800ae4f0140 ffff8800ae657cb8 0000000000000286 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xe6/0x120 lib/dump_stack.c:51 [] print_address_description mm/kasan/report.c:190 [inline] [] kasan_report_error+0x59a/0x5c0 mm/kasan/report.c:275 [] kasan_report+0x34/0x40 mm/kasan/report.c:297 [] check_memory_region mm/kasan/kasan.c:285 [inline] [] __asan_storeN+0x12d/0x180 mm/kasan/kasan.c:688 [] memset+0x1a/0x30 mm/kasan/kasan.c:301 [] ax25_getname+0x54/0x880 net/ax25/af_ax25.c:1398 [] get_raw_socket drivers/vhost/net.c:897 [inline] [] get_socket drivers/vhost/net.c:935 [inline] [] vhost_net_set_backend drivers/vhost/net.c:970 [inline] [] vhost_net_ioctl+0xd8b/0x12c0 drivers/vhost/net.c:1133 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Memory state around the buggy address: ffff8800ae657c00: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 ffff8800ae657c80: f4 f4 f4 f2 f2 f2 f2 04 f4 f4 f4 f2 f2 f2 f2 00 >ffff8800ae657d00: f4 f4 f4 f2 f2 f2 f2 00 00 00 00 00 00 04 f4 f3 ^ ffff8800ae657d80: f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8800ae657e00: f1 f1 f1 f1 00 f4 f4 f4 f2 f2 f2 f2 00 00 00 f4 ================================================================== ================================================================== BUG: KASAN: stack-out-of-bounds in memset+0x1a/0x30 mm/kasan/kasan.c:301 at addr ffff8800aea77d38 Write of size 72 by task syz-executor.5/10381 page:ffffea0002ba9dc0 count:0 mapcount:0 mapping: (null) index:0x0 flags: 0x1fffc0000000000() page dumped because: kasan: bad access detected CPU: 1 PID: 10381 Comm: syz-executor.5 Tainted: G B 4.6.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 1ffffffff0d55786 ffff8800aea77ac0 ffffffff8299bd56 ffff8800aea77d38 ffff8800aea77b50 ffff8800aea77d38 0000000000000000 ffff8800aea77b40 ffffffff8173ab9a ffff8800aebe2640 ffff8800aea77cb8 0000000000000286 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xe6/0x120 lib/dump_stack.c:51 [] print_address_description mm/kasan/report.c:190 [inline] [] kasan_report_error+0x59a/0x5c0 mm/kasan/report.c:275 [] kasan_report+0x34/0x40 mm/kasan/report.c:297 [] check_memory_region mm/kasan/kasan.c:285 [inline] [] __asan_storeN+0x12d/0x180 mm/kasan/kasan.c:688 [] memset+0x1a/0x30 mm/kasan/kasan.c:301 [] ax25_getname+0x54/0x880 net/ax25/af_ax25.c:1398 [] get_raw_socket drivers/vhost/net.c:897 [inline] [] get_socket drivers/vhost/net.c:935 [inline] [] vhost_net_set_backend drivers/vhost/net.c:970 [inline] [] vhost_net_ioctl+0xd8b/0x12c0 drivers/vhost/net.c:1133 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Memory state around the buggy address: ffff8800aea77c00: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 ffff8800aea77c80: f4 f4 f4 f2 f2 f2 f2 04 f4 f4 f4 f2 f2 f2 f2 00 >ffff8800aea77d00: f4 f4 f4 f2 f2 f2 f2 00 00 00 00 00 00 04 f4 f3 ^ ffff8800aea77d80: f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8800aea77e00: f1 f1 f1 f1 00 f4 f4 f4 f2 f2 f2 f2 00 00 00 f4 ================================================================== ================================================================== BUG: KASAN: stack-out-of-bounds in memset+0x1a/0x30 mm/kasan/kasan.c:301 at addr ffff8800ae657d38 Write of size 72 by task syz-executor.5/11366 page:ffffea0002b995c0 count:0 mapcount:0 mapping: (null) index:0x0 flags: 0x1fffc0000000000() page dumped because: kasan: bad access detected CPU: 1 PID: 11366 Comm: syz-executor.5 Tainted: G B 4.6.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 1ffffffff0d55786 ffff8800ae657ac0 ffffffff8299bd56 ffff8800ae657d38 ffff8800ae657b50 ffff8800ae657d38 0000000000000000 ffff8800ae657b40 ffffffff8173ab9a ffff8800ae6de180 ffff8800ae657cb8 0000000000000286 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xe6/0x120 lib/dump_stack.c:51 [] print_address_description mm/kasan/report.c:190 [inline] [] kasan_report_error+0x59a/0x5c0 mm/kasan/report.c:275 [] kasan_report+0x34/0x40 mm/kasan/report.c:297 [] check_memory_region mm/kasan/kasan.c:285 [inline] [] __asan_storeN+0x12d/0x180 mm/kasan/kasan.c:688 [] memset+0x1a/0x30 mm/kasan/kasan.c:301 [] ax25_getname+0x54/0x880 net/ax25/af_ax25.c:1398 [] get_raw_socket drivers/vhost/net.c:897 [inline] [] get_socket drivers/vhost/net.c:935 [inline] [] vhost_net_set_backend drivers/vhost/net.c:970 [inline] [] vhost_net_ioctl+0xd8b/0x12c0 drivers/vhost/net.c:1133 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Memory state around the buggy address: ffff8800ae657c00: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 ffff8800ae657c80: f4 f4 f4 f2 f2 f2 f2 04 f4 f4 f4 f2 f2 f2 f2 00 >ffff8800ae657d00: f4 f4 f4 f2 f2 f2 f2 00 00 00 00 00 00 04 f4 f3 ^ ffff8800ae657d80: f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8800ae657e00: f1 f1 f1 f1 00 f4 f4 f4 f2 f2 f2 f2 00 00 00 f4 ================================================================== ================================================================== BUG: KASAN: stack-out-of-bounds in memset+0x1a/0x30 mm/kasan/kasan.c:301 at addr ffff880127f2fd38 Write of size 72 by task syz-executor.0/11536 page:ffffea00049fcbc0 count:0 mapcount:0 mapping: (null) index:0x0 flags: 0x2fffc0000000000() page dumped because: kasan: bad access detected CPU: 1 PID: 11536 Comm: syz-executor.0 Tainted: G B 4.6.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 1ffffffff0d55786 ffff880127f2fac0 ffffffff8299bd56 ffff880127f2fd38 ffff880127f2fb50 ffff880127f2fd38 0000000000000000 ffff880127f2fb40 ffffffff8173ab9a ffff8800ae7fa500 ffff880127f2fcb8 0000000000000286 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xe6/0x120 lib/dump_stack.c:51 [] print_address_description mm/kasan/report.c:190 [inline] [] kasan_report_error+0x59a/0x5c0 mm/kasan/report.c:275 [] kasan_report+0x34/0x40 mm/kasan/report.c:297 [] check_memory_region mm/kasan/kasan.c:285 [inline] [] __asan_storeN+0x12d/0x180 mm/kasan/kasan.c:688 [] memset+0x1a/0x30 mm/kasan/kasan.c:301 [] ax25_getname+0x54/0x880 net/ax25/af_ax25.c:1398 [] get_raw_socket drivers/vhost/net.c:897 [inline] [] get_socket drivers/vhost/net.c:935 [inline] [] vhost_net_set_backend drivers/vhost/net.c:970 [inline] [] vhost_net_ioctl+0xd8b/0x12c0 drivers/vhost/net.c:1133 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Memory state around the buggy address: ffff880127f2fc00: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 ffff880127f2fc80: f4 f4 f4 f2 f2 f2 f2 04 f4 f4 f4 f2 f2 f2 f2 00 >ffff880127f2fd00: f4 f4 f4 f2 f2 f2 f2 00 00 00 00 00 00 04 f4 f3 ^ ffff880127f2fd80: f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff880127f2fe00: f1 f1 f1 f1 00 f4 f4 f4 f2 f2 f2 f2 00 00 00 f4 ================================================================== ================================================================== BUG: KASAN: stack-out-of-bounds in memset+0x1a/0x30 mm/kasan/kasan.c:301 at addr ffff8800ae7efd38 Write of size 72 by task syz-executor.0/11584 page:ffffea0002b9fbc0 count:0 mapcount:0 mapping: (null) index:0x0 flags: 0x1fffc0000000000() page dumped because: kasan: bad access detected CPU: 0 PID: 11584 Comm: syz-executor.0 Tainted: G B 4.6.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 1ffffffff0d55786 ffff8800ae7efac0 ffffffff8299bd56 ffff8800ae7efd38 ffff8800ae7efb50 ffff8800ae7efd38 0000000000000000 ffff8800ae7efb40 ffffffff8173ab9a ffff8800ae89a500 ffff8800ae7efcb8 0000000000000286 Call Trace: [] __dump_stack lib/dump_stack.c:15 [inline] [] dump_stack+0xe6/0x120 lib/dump_stack.c:51 [] print_address_description mm/kasan/report.c:190 [inline] [] kasan_report_error+0x59a/0x5c0 mm/kasan/report.c:275 [] kasan_report+0x34/0x40 mm/kasan/report.c:297 [] check_memory_region mm/kasan/kasan.c:285 [inline] [] __asan_storeN+0x12d/0x180 mm/kasan/kasan.c:688 [] memset+0x1a/0x30 mm/kasan/kasan.c:301 [] ax25_getname+0x54/0x880 net/ax25/af_ax25.c:1398 [] get_raw_socket drivers/vhost/net.c:897 [inline] [] get_socket drivers/vhost/net.c:935 [inline] [] vhost_net_set_backend drivers/vhost/net.c:970 [inline] [] vhost_net_ioctl+0xd8b/0x12c0 drivers/vhost/net.c:1133 [] vfs_ioctl fs/ioctl.c:43 [inline] [] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674 [] SYSC_ioctl fs/ioctl.c:689 [inline] [] SyS_ioctl+0x74/0x80 fs/ioctl.c:680 [] entry_SYSCALL_64_fastpath+0x23/0xc1 Memory state around the buggy address: ffff8800ae7efc00: 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1 04 ffff8800ae7efc80: f4 f4 f4 f2 f2 f2 f2 04 f4 f4 f4 f2 f2 f2 f2 00 >ffff8800ae7efd00: f4 f4 f4 f2 f2 f2 f2 00 00 00 00 00 00 04 f4 f3 ^ ffff8800ae7efd80: f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8800ae7efe00: f1 f1 f1 f1 00 f4 f4 f4 f2 f2 f2 f2 00 00 00 f4 ==================================================================