================================================================== BUG: KASAN: stack-out-of-bounds in memcpy include/linux/string.h:447 [inline] BUG: KASAN: stack-out-of-bounds in packet_recvmsg+0x45a/0x10e0 net/packet/af_packet.c:3443 Write of size 134 at addr ffffc9000180fb90 by task syz-executor127/5956 CPU: 0 PID: 5956 Comm: syz-executor127 Not tainted 5.11.0-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:79 [inline] dump_stack+0x9a/0xcc lib/dump_stack.c:120 print_address_description.constprop.0.cold+0x5/0x2f8 mm/kasan/report.c:230 __kasan_report mm/kasan/report.c:396 [inline] kasan_report.cold+0x79/0xd5 mm/kasan/report.c:413 check_memory_region_inline mm/kasan/generic.c:179 [inline] check_memory_region+0x13d/0x180 mm/kasan/generic.c:185 memcpy+0x39/0x60 mm/kasan/shadow.c:65 memcpy include/linux/string.h:447 [inline] packet_recvmsg+0x45a/0x10e0 net/packet/af_packet.c:3443 sock_recvmsg_nosec net/socket.c:886 [inline] sock_recvmsg net/socket.c:904 [inline] sock_recvmsg net/socket.c:900 [inline] ____sys_recvmsg+0x25e/0x620 net/socket.c:2568 ___sys_recvmsg+0xe2/0x1a0 net/socket.c:2610 __sys_recvmsg+0xaf/0x140 net/socket.c:2646 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46 entry_SYSCALL_64_after_hwframe+0x44/0xa9 RIP: 0033:0x7f4f40810c19 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 c0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffda9f91bd8 EFLAGS: 00000246 ORIG_RAX: 000000000000002f RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00007f4f40810c19 RDX: 0000000000000000 RSI: 0000000020000500 RDI: 0000000000000005 RBP: 0000000000000000 R08: 000000000000000d R09: 000000000000000d R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffda9f91bf0 R13: 00000000000f4240 R14: 0000000000013483 R15: 00007ffda9f91be4 addr ffffc9000180fb90 is located in stack of task syz-executor127/5956 at offset 32 in frame: ____sys_recvmsg+0x0/0x620 include/linux/audit.h:313 this frame has 1 object: [32, 160) 'addr' Memory state around the buggy address: ffffc9000180fb00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 ffffc9000180fb80: f1 f1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >ffffc9000180fc00: 00 00 f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 ^ ffffc9000180fc80: 00 f1 f1 f1 f1 00 f2 f2 f2 00 f2 f2 f2 00 00 00 ffffc9000180fd00: 00 00 00 00 f2 f2 f2 f2 f2 00 00 00 00 00 00 00 ==================================================================