bisecting fixing commit since 78e709522d2c012cb0daad2e668506637bffb7c2
building syzkaller on 5ae8508a2dd5f8e16a2b9830ae9a6f37d54ec8e7
testing commit 78e709522d2c012cb0daad2e668506637bffb7c2
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: a9ee8b045e5ead72fbe14b5ba3f27f4e7dade83d639c18306638c2a676910138
run #0: crashed: KASAN: use-after-free Write in null_skcipher_crypt
run #1: crashed: KASAN: use-after-free Write in null_skcipher_crypt
run #2: crashed: KASAN: use-after-free Write in null_skcipher_crypt
run #3: crashed: KASAN: slab-out-of-bounds Write in null_skcipher_crypt
run #4: crashed: KASAN: use-after-free Write in null_skcipher_crypt
run #5: crashed: KASAN: use-after-free Write in null_skcipher_crypt
run #6: crashed: KASAN: use-after-free Write in null_skcipher_crypt
run #7: crashed: KASAN: slab-out-of-bounds Write in null_skcipher_crypt
run #8: crashed: KASAN: use-after-free Write in null_skcipher_crypt
run #9: crashed: KASAN: use-after-free Read in skb_copy_bits
run #10: crashed: KASAN: use-after-free Write in null_skcipher_crypt
run #11: crashed: KASAN: use-after-free Write in null_skcipher_crypt
run #12: crashed: KASAN: slab-out-of-bounds Write in null_skcipher_crypt
run #13: crashed: KASAN: use-after-free Write in null_skcipher_crypt
run #14: crashed: KASAN: use-after-free Write in null_skcipher_crypt
run #15: crashed: KASAN: use-after-free Write in null_skcipher_crypt
run #16: crashed: KASAN: slab-out-of-bounds Write in null_skcipher_crypt
run #17: crashed: KASAN: slab-out-of-bounds Write in null_skcipher_crypt
run #18: crashed: KASAN: use-after-free Write in null_skcipher_crypt
run #19: crashed: KASAN: use-after-free Read in skb_copy_bits
testing current HEAD f1baf68e1383f6ed93eb9cff2866d46562607a43
testing commit f1baf68e1383f6ed93eb9cff2866d46562607a43
compiler: gcc (GCC) 10.2.1 20210217, GNU ld (GNU Binutils for Debian) 2.35.2
kernel signature: 2cb5813bfe1f5bf5702717088fce41fd000d28fbe57ee257acb77db7f5160073
run #0: basic kernel testing failed: BUG: program execution failed: executor NUM: EOF
run #1: crashed: KASAN: slab-out-of-bounds Write in null_skcipher_crypt
run #2: crashed: KASAN: use-after-free Write in null_skcipher_crypt
run #3: crashed: KASAN: use-after-free Write in null_skcipher_crypt
run #4: crashed: KASAN: use-after-free Write in null_skcipher_crypt
run #5: crashed: KASAN: use-after-free Write in null_skcipher_crypt
run #6: crashed: KASAN: use-after-free Write in null_skcipher_crypt
run #7: crashed: KASAN: use-after-free Write in null_skcipher_crypt
run #8: crashed: KASAN: use-after-free Write in null_skcipher_crypt
run #9: crashed: KASAN: use-after-free Write in null_skcipher_crypt
revisions tested: 2, total time: 19m33.601812031s (build: 12m27.991694021s, test: 6m22.864670683s)
the crash still happens on HEAD
commit msg: Merge tag 'net-5.17-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net
crash: KASAN: use-after-free Write in null_skcipher_crypt
==================================================================
BUG: KASAN: use-after-free in memcpy include/linux/fortify-string.h:225 [inline]
BUG: KASAN: use-after-free in null_skcipher_crypt+0x8f/0xf0 crypto/crypto_null.c:85
Write of size 4096 at addr ffff888017dc8000 by task syz-executor.0/4028

CPU: 0 PID: 4028 Comm: syz-executor.0 Not tainted 5.17.0-rc3-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x57/0x7d lib/dump_stack.c:106
 print_address_description.constprop.0.cold+0x8d/0x336 mm/kasan/report.c:255
 __kasan_report mm/kasan/report.c:442 [inline]
 kasan_report.cold+0x83/0xdf mm/kasan/report.c:459
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189
 memcpy+0x39/0x60 mm/kasan/shadow.c:66
 memcpy include/linux/fortify-string.h:225 [inline]
 null_skcipher_crypt+0x8f/0xf0 crypto/crypto_null.c:85
 crypto_authenc_encrypt+0x38b/0x530 crypto/authenc.c:222
 esp6_output_tail+0x6de/0x1b60 net/ipv6/esp6.c:658
 esp6_output+0x45d/0x910 net/ipv6/esp6.c:734
 xfrm_output_one net/xfrm/xfrm_output.c:553 [inline]
 xfrm_output_resume+0x519/0x61b0 net/xfrm/xfrm_output.c:588
 NF_HOOK_COND include/linux/netfilter.h:296 [inline]
 xfrm6_output+0xe3/0x410 net/ipv6/xfrm6_output.c:92
 ip6_send_skb+0x8f/0x2f0 net/ipv6/ip6_output.c:1912
 rawv6_push_pending_frames net/ipv6/raw.c:613 [inline]
 rawv6_sendmsg+0x21bd/0x30b0 net/ipv6/raw.c:956
 sock_sendmsg_nosec net/socket.c:705 [inline]
 sock_sendmsg+0xab/0xe0 net/socket.c:725
 ____sys_sendmsg+0x5bf/0x7a0 net/socket.c:2413
 ___sys_sendmsg+0xd3/0x150 net/socket.c:2467
 __sys_sendmsg+0xb2/0x140 net/socket.c:2496
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x4665f9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fa44d46e188 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665f9
RDX: 0000000000000000 RSI: 0000000020000500 RDI: 0000000000000004
RBP: 00000000004bfcc4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf80
R13: 0000000000a9fb1f R14: 00007fa44d46e300 R15: 0000000000022000
 </TASK>

The buggy address belongs to the page:
page:ffffea00005f7200 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x17dc8
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 ffffea0000611e08 ffffea0000613408 0000000000000000
raw: 0000000000000000 0000000000070000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3011, ts 13559591718, free_ts 62594823064
 prep_new_page mm/page_alloc.c:2434 [inline]
 get_page_from_freelist+0xa6f/0x2f10 mm/page_alloc.c:4165
 __alloc_pages+0x1b2/0x500 mm/page_alloc.c:5389
 alloc_slab_page mm/slub.c:1799 [inline]
 allocate_slab mm/slub.c:1944 [inline]
 new_slab+0x28a/0x3b0 mm/slub.c:2004
 ___slab_alloc+0x87e/0xe80 mm/slub.c:3018
 __slab_alloc.constprop.0+0x4d/0xa0 mm/slub.c:3105
 slab_alloc_node mm/slub.c:3196 [inline]
 slab_alloc mm/slub.c:3238 [inline]
 kmem_cache_alloc+0x35c/0x3a0 mm/slub.c:3243
 getname_flags.part.0+0x4a/0x440 fs/namei.c:138
 user_path_at_empty+0x1e/0x50 fs/namei.c:2850
 user_path_at include/linux/namei.h:57 [inline]
 vfs_statx+0xd6/0x2e0 fs/stat.c:221
 vfs_fstatat fs/stat.c:243 [inline]
 __do_sys_newfstatat+0x7d/0xd0 fs/stat.c:412
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1352 [inline]
 free_pcp_prepare+0x374/0x870 mm/page_alloc.c:1404
 free_unref_page_prepare mm/page_alloc.c:3325 [inline]
 free_unref_page+0x19/0x690 mm/page_alloc.c:3404
 qlink_free mm/kasan/quarantine.c:157 [inline]
 qlist_free_all+0x6d/0x160 mm/kasan/quarantine.c:176
 kasan_quarantine_reduce+0x180/0x200 mm/kasan/quarantine.c:283
 __kasan_slab_alloc+0xa2/0xc0 mm/kasan/common.c:446
 kasan_slab_alloc include/linux/kasan.h:260 [inline]
 slab_post_alloc_hook mm/slab.h:732 [inline]
 slab_alloc_node mm/slub.c:3230 [inline]
 slab_alloc mm/slub.c:3238 [inline]
 kmem_cache_alloc+0x202/0x3a0 mm/slub.c:3243
 getname_flags.part.0+0x4a/0x440 fs/namei.c:138
 user_path_at_empty+0x1e/0x50 fs/namei.c:2850
 user_path_at include/linux/namei.h:57 [inline]
 vfs_statx+0xd6/0x2e0 fs/stat.c:221
 vfs_fstatat fs/stat.c:243 [inline]
 __do_sys_newfstatat+0x7d/0xd0 fs/stat.c:412
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x35/0xb0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Memory state around the buggy address:
 ffff888017dc7f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff888017dc7f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff888017dc8000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                   ^
 ffff888017dc8080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888017dc8100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================