==================================================================
BUG: KASAN: stack-out-of-bounds in jhash2 include/linux/jhash.h:138 [inline]
BUG: KASAN: stack-out-of-bounds in __xfrm6_addr_hash net/xfrm/xfrm_hash.h:16 [inline]
BUG: KASAN: stack-out-of-bounds in __xfrm6_daddr_saddr_hash net/xfrm/xfrm_hash.h:29 [inline]
BUG: KASAN: stack-out-of-bounds in __xfrm_dst_hash+0x399/0x480 net/xfrm/xfrm_hash.h:95
Read of size 4 at addr ffffc900001d0ad8 by task kauditd/30

CPU: 1 PID: 30 Comm: kauditd Not tainted 5.15.182-syzkaller-1080481-g57725b368731 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/19/2025
Call Trace:
 <IRQ>
 __dump_stack+0x21/0x30 lib/dump_stack.c:88
 dump_stack_lvl+0xee/0x150 lib/dump_stack.c:106
 print_address_description+0x7f/0x2c0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:427 [inline]
 kasan_report+0xf1/0x140 mm/kasan/report.c:444
 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:308
 jhash2 include/linux/jhash.h:138 [inline]
 __xfrm6_addr_hash net/xfrm/xfrm_hash.h:16 [inline]
 __xfrm6_daddr_saddr_hash net/xfrm/xfrm_hash.h:29 [inline]
 __xfrm_dst_hash+0x399/0x480 net/xfrm/xfrm_hash.h:95
 xfrm_dst_hash net/xfrm/xfrm_state.c:63 [inline]
 xfrm_state_find+0x27e/0x2a70 net/xfrm/xfrm_state.c:1092
 xfrm_tmpl_resolve_one net/xfrm/xfrm_policy.c:2393 [inline]
 xfrm_tmpl_resolve net/xfrm/xfrm_policy.c:2438 [inline]
 xfrm_resolve_and_create_bundle+0x626/0x28d0 net/xfrm/xfrm_policy.c:2731
 xfrm_bundle_lookup net/xfrm/xfrm_policy.c:2966 [inline]
 xfrm_lookup_with_ifid+0x6fd/0x2120 net/xfrm/xfrm_policy.c:3097
 xfrm_lookup net/xfrm/xfrm_policy.c:3194 [inline]
 xfrm_lookup_route+0x3c/0x170 net/xfrm/xfrm_policy.c:3205
 ip_route_output_flow+0x1d2/0x2d0 net/ipv4/route.c:2893
 ip_route_output_ports include/net/route.h:169 [inline]
 igmpv3_newpack+0x263/0xca0 net/ipv4/igmp.c:372
 add_grhead+0x75/0x2e0 net/ipv4/igmp.c:443
 add_grec+0x116c/0x1410 net/ipv4/igmp.c:577
 igmpv3_send_cr net/ipv4/igmp.c:714 [inline]
 igmp_ifc_timer_expire+0x89e/0xf80 net/ipv4/igmp.c:813
 call_timer_fn+0x38/0x290 kernel/time/timer.c:1457
 expire_timers kernel/time/timer.c:1502 [inline]
 __run_timers+0x639/0x9a0 kernel/time/timer.c:1773
 run_timer_softirq+0x6a/0xf0 kernel/time/timer.c:1786
 handle_softirqs+0x250/0x560 kernel/softirq.c:565
 __do_softirq kernel/softirq.c:603 [inline]
 invoke_softirq kernel/softirq.c:425 [inline]
 __irq_exit_rcu+0x52/0xf0 kernel/softirq.c:652
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:664
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
 sysvec_apic_timer_interrupt+0xa9/0xc0 arch/x86/kernel/apic/apic.c:1108
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:console_unlock+0xc4e/0x1010 kernel/printk/printk.c:2775
Code: 38 4c 89 f6 48 81 e6 00 02 00 00 31 ff e8 3a 8c 17 00 49 81 e6 00 02 00 00 75 07 e8 ec 87 17 00 eb 06 e8 e5 87 17 00 fb 89 d8 <0a> 44 24 17 a8 01 74 0e e8 d5 87 17 00 85 db 74 19 e9 18 03 00 00
RSP: 0018:ffffc900001ff880 EFLAGS: 00000293
RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffff8881001be2c0
RDX: 0000000000000000 RSI: 0000000000000200 RDI: 0000000000000000
RBP: ffffc900001ffaf0 R08: 0000000000000004 R09: 0000000000000003
R10: fffff5200003ff00 R11: 1ffff9200003ff00 R12: 00000000000000e5
R13: dffffc0000000000 R14: 0000000000000200 R15: ffffffff86a15468
 vprintk_emit+0x13f/0x300 kernel/printk/printk.c:2294
 vprintk_default+0x26/0x30 kernel/printk/printk.c:2309
 vprintk+0x7a/0x80 kernel/printk/printk_safe.c:45
 _printk+0xcc/0x110 kernel/printk/printk.c:2319
 kauditd_printk_skb kernel/audit.c:549 [inline]
 kauditd_hold_skb+0x1bc/0x210 kernel/audit.c:584
 kauditd_send_queue+0x289/0x2d0 kernel/audit.c:769
 kauditd_thread+0x4e2/0x860 kernel/audit.c:893
 kthread+0x411/0x500 kernel/kthread.c:337
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>


Memory state around the buggy address:
 ffffc900001d0980: 00 00 f3 f3 f3 f3 f3 f3 00 00 00 00 00 00 00 00
 ffffc900001d0a00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffc900001d0a80: f1 f1 f1 f1 00 00 00 00 00 00 00 f3 f3 f3 f3 f3
                                                    ^
 ffffc900001d0b00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffc900001d0b80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================
----------------
Code disassembly (best guess):
   0:	38 4c 89 f6          	cmp    %cl,-0xa(%rcx,%rcx,4)
   4:	48 81 e6 00 02 00 00 	and    $0x200,%rsi
   b:	31 ff                	xor    %edi,%edi
   d:	e8 3a 8c 17 00       	call   0x178c4c
  12:	49 81 e6 00 02 00 00 	and    $0x200,%r14
  19:	75 07                	jne    0x22
  1b:	e8 ec 87 17 00       	call   0x17880c
  20:	eb 06                	jmp    0x28
  22:	e8 e5 87 17 00       	call   0x17880c
  27:	fb                   	sti
  28:	89 d8                	mov    %ebx,%eax
* 2a:	0a 44 24 17          	or     0x17(%rsp),%al <-- trapping instruction
  2e:	a8 01                	test   $0x1,%al
  30:	74 0e                	je     0x40
  32:	e8 d5 87 17 00       	call   0x17880c
  37:	85 db                	test   %ebx,%ebx
  39:	74 19                	je     0x54
  3b:	e9 18 03 00 00       	jmp    0x358