==================================================================
BUG: KASAN: stack-out-of-bounds in jhash2 include/linux/jhash.h:138 [inline]
BUG: KASAN: stack-out-of-bounds in __xfrm6_addr_hash net/xfrm/xfrm_hash.h:16 [inline]
BUG: KASAN: stack-out-of-bounds in __xfrm6_daddr_saddr_hash net/xfrm/xfrm_hash.h:29 [inline]
BUG: KASAN: stack-out-of-bounds in __xfrm_dst_hash+0x38d/0x460 net/xfrm/xfrm_hash.h:95
Read of size 4 at addr ffffc900001d0ab8 by task udevd/101
CPU: 1 PID: 101 Comm: udevd Not tainted 5.15.173-syzkaller-1077993-gf7ce2ffd2f33 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0x151/0x1c0 lib/dump_stack.c:106
print_address_description+0x87/0x3b0 mm/kasan/report.c:248
__kasan_report mm/kasan/report.c:427 [inline]
kasan_report+0x179/0x1c0 mm/kasan/report.c:444
__asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:308
jhash2 include/linux/jhash.h:138 [inline]
__xfrm6_addr_hash net/xfrm/xfrm_hash.h:16 [inline]
__xfrm6_daddr_saddr_hash net/xfrm/xfrm_hash.h:29 [inline]
__xfrm_dst_hash+0x38d/0x460 net/xfrm/xfrm_hash.h:95
xfrm_dst_hash net/xfrm/xfrm_state.c:63 [inline]
xfrm_state_find+0x2f1/0x2f70 net/xfrm/xfrm_state.c:1092
xfrm_tmpl_resolve_one net/xfrm/xfrm_policy.c:2393 [inline]
xfrm_tmpl_resolve net/xfrm/xfrm_policy.c:2438 [inline]
xfrm_resolve_and_create_bundle+0x65a/0x2b70 net/xfrm/xfrm_policy.c:2731
xfrm_bundle_lookup net/xfrm/xfrm_policy.c:2966 [inline]
xfrm_lookup_with_ifid+0x6fc/0x20d0 net/xfrm/xfrm_policy.c:3097
xfrm_lookup net/xfrm/xfrm_policy.c:3194 [inline]
xfrm_lookup_route+0x3b/0x160 net/xfrm/xfrm_policy.c:3205
ip_route_output_flow+0x1ef/0x310 net/ipv4/route.c:2887
ip_route_output_ports include/net/route.h:169 [inline]
igmpv3_newpack+0x437/0x10d0 net/ipv4/igmp.c:372
add_grhead+0x84/0x330 net/ipv4/igmp.c:443
add_grec+0x12ca/0x15d0 net/ipv4/igmp.c:577
igmpv3_send_cr net/ipv4/igmp.c:714 [inline]
igmp_ifc_timer_expire+0x83b/0xf50 net/ipv4/igmp.c:813
call_timer_fn+0x3b/0x2d0 kernel/time/timer.c:1457
expire_timers kernel/time/timer.c:1502 [inline]
__run_timers+0x72a/0xa10 kernel/time/timer.c:1773
run_timer_softirq+0x69/0xf0 kernel/time/timer.c:1786
handle_softirqs+0x25e/0x5c0 kernel/softirq.c:565
__do_softirq kernel/softirq.c:603 [inline]
invoke_softirq kernel/softirq.c:425 [inline]
__irq_exit_rcu+0x52/0xf0 kernel/softirq.c:652
irq_exit_rcu+0x9/0x10 kernel/softirq.c:664
instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1108
asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:__raw_callee_save___pv_queued_spin_unlock+0x10/0x17
Code: 41 51 41 52 41 53 e8 cb 0a 00 00 41 5b 41 5a 41 59 41 58 5f 5e 5a 59 5d c3 90 55 48 89 e5 52 b8 01 00 00 00 31 d2 f0 0f b0 17 <3c> 01 75 03 5a 5d c3 56 0f b6 f0 e8 bc ff ff ff 5e 5a 5d c3 0f 1f
RSP: 0018:ffffc90000a376e8 EFLAGS: 00000246
RAX: 0000000000000001 RBX: ffff88810cfacad8 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff88810cfacad8
RBP: ffffc90000a376f0 R08: ffffffff81bd887d R09: 0000000000000003
R10: fffff52000146ed4 R11: dffffc0000000001 R12: ffff8881013fff18
R13: 0000000000000000 R14: 0000000000000001 R15: ffff88810cfaca50
pv_queued_spin_unlock arch/x86/include/asm/paravirt.h:590 [inline]
queued_spin_unlock arch/x86/include/asm/qspinlock.h:56 [inline]
do_raw_spin_unlock include/linux/spinlock.h:216 [inline]
__raw_spin_unlock include/linux/spinlock_api_smp.h:151 [inline]
_raw_spin_unlock+0x41/0x70 kernel/locking/spinlock.c:186
spin_unlock include/linux/spinlock.h:403 [inline]
kernfs_iop_permission+0x297/0x3b0 fs/kernfs/inode.c:294
do_inode_permission fs/namei.c:459 [inline]
inode_permission+0x22c/0x460 fs/namei.c:526
may_lookup fs/namei.c:1693 [inline]
link_path_walk+0x2be/0xd90 fs/namei.c:2245
path_lookupat+0xa0/0x450 fs/namei.c:2454
filename_lookup+0x230/0x5c0 fs/namei.c:2484
user_path_at_empty+0x43/0x1a0 fs/namei.c:2883
user_path_at include/linux/namei.h:57 [inline]
vfs_statx+0xfd/0x720 fs/stat.c:221
vfs_fstatat fs/stat.c:243 [inline]
__do_sys_newfstatat fs/stat.c:411 [inline]
__se_sys_newfstatat+0xc8/0x760 fs/stat.c:405
__x64_sys_newfstatat+0x9b/0xb0 fs/stat.c:405
x64_sys_call+0x6e2/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:263
do_syscall_x64 arch/x86/entry/common.c:50 [inline]
do_syscall_64+0x3b/0xb0 arch/x86/entry/common.c:80
entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f254986c5f4
Code: 64 c7 00 09 00 00 00 83 c8 ff c3 48 89 f2 b9 00 01 00 00 48 89 fe bf 9c ff ff ff e9 00 00 00 00 41 89 ca b8 06 01 00 00 0f 05 <45> 31 c0 3d 00 f0 ff ff 76 10 48 8b 15 03 a8 0d 00 f7 d8 41 83 c8
RSP: 002b:00007fffc5a45388 EFLAGS: 00000246 ORIG_RAX: 0000000000000106
RAX: ffffffffffffffda RBX: 0000556e63cd7140 RCX: 00007f254986c5f4
RDX: 00007fffc5a45398 RSI: 00007fffc5a45828 RDI: 00000000ffffff9c
RBP: 00007fffc5a45428 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fffc5a45828
R13: 00007fffc5a45398 R14: 0000556e63ccb2c0 R15: 0000000000000000
Memory state around the buggy address:
ffffc900001d0980: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
ffffc900001d0a00: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
>ffffc900001d0a80: 00 00 00 00 00 00 00 f3 f3 f3 f3 f3 00 00 00 00
^
ffffc900001d0b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffffc900001d0b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
----------------
Code disassembly (best guess):
0: 41 51 push %r9
2: 41 52 push %r10
4: 41 53 push %r11
6: e8 cb 0a 00 00 call 0xad6
b: 41 5b pop %r11
d: 41 5a pop %r10
f: 41 59 pop %r9
11: 41 58 pop %r8
13: 5f pop %rdi
14: 5e pop %rsi
15: 5a pop %rdx
16: 59 pop %rcx
17: 5d pop %rbp
18: c3 ret
19: 90 nop
1a: 55 push %rbp
1b: 48 89 e5 mov %rsp,%rbp
1e: 52 push %rdx
1f: b8 01 00 00 00 mov $0x1,%eax
24: 31 d2 xor %edx,%edx
26: f0 0f b0 17 lock cmpxchg %dl,(%rdi)
* 2a: 3c 01 cmp $0x1,%al <-- trapping instruction
2c: 75 03 jne 0x31
2e: 5a pop %rdx
2f: 5d pop %rbp
30: c3 ret
31: 56 push %rsi
32: 0f b6 f0 movzbl %al,%esi
35: e8 bc ff ff ff call 0xfffffff6
3a: 5e pop %rsi
3b: 5a pop %rdx
3c: 5d pop %rbp
3d: c3 ret
3e: 0f .byte 0xf
3f: 1f (bad)