==================================================================
BUG: KASAN: use-after-free in n_tty_receive_buf_fast drivers/tty/n_tty.c:1575 [inline] at addr ffff8800b7a54580
BUG: KASAN: use-after-free in __receive_buf drivers/tty/n_tty.c:1613 [inline] at addr ffff8800b7a54580
BUG: KASAN: use-after-free in n_tty_receive_buf_common+0x2cf1/0x2d80 drivers/tty/n_tty.c:1711 at addr ffff8800b7a54580
Read of size 1 by task syz-executor.0/8720
CPU: 0 PID: 8720 Comm: syz-executor.0 Not tainted 4.6.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 1ffffffff0d9577e ffff8800af4f7698 ffffffff82c4dd46 0000000000000001
 ffff8800af4f7728 ffff8800b7a54580 ffff88012bc00100 ffff8800af4f7718
 ffffffff81740207 ffff8800af4f7840 ffffffff85b70879 0000000000000286
Call Trace:
 [<ffffffff82c4dd46>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff82c4dd46>] dump_stack+0xe6/0x120 lib/dump_stack.c:51
 [<ffffffff81740207>] object_err mm/kasan/report.c:139 [inline]
 [<ffffffff81740207>] print_address_description mm/kasan/report.c:179 [inline]
 [<ffffffff81740207>] kasan_report_error+0x1e7/0x5c0 mm/kasan/report.c:275
 [<ffffffff8174061e>] kasan_report mm/kasan/report.c:297 [inline]
 [<ffffffff8174061e>] __asan_report_load1_noabort+0x3e/0x40 mm/kasan/report.c:315
 [<ffffffff82f92e81>] n_tty_receive_buf_fast drivers/tty/n_tty.c:1575 [inline]
 [<ffffffff82f92e81>] __receive_buf drivers/tty/n_tty.c:1613 [inline]
 [<ffffffff82f92e81>] n_tty_receive_buf_common+0x2cf1/0x2d80 drivers/tty/n_tty.c:1711
 [<ffffffff82f92f1f>] n_tty_receive_buf2+0xf/0x20 drivers/tty/n_tty.c:1746
 [<ffffffff82f98933>] tty_ldisc_receive_buf+0x83/0x1e0 drivers/tty/tty_buffer.c:454
 [<ffffffff82fb9525>] paste_selection+0x245/0x390 drivers/tty/vt/selection.c:363
 [<ffffffff82fd5b49>] tioclinux+0xf9/0x360 drivers/tty/vt/vt.c:2684
 [<ffffffff82fb3aa7>] vt_ioctl+0x337/0x24e0 drivers/tty/vt/vt_ioctl.c:365
 [<ffffffff82f81da4>] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988
 [<ffffffff817d312f>] vfs_ioctl fs/ioctl.c:43 [inline]
 [<ffffffff817d312f>] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674
 [<ffffffff817d3e94>] SYSC_ioctl fs/ioctl.c:689 [inline]
 [<ffffffff817d3e94>] SyS_ioctl+0x74/0x80 fs/ioctl.c:680
 [<ffffffff85b6fe80>] entry_SYSCALL_64_fastpath+0x23/0xc1
Object at ffff8800b7a54580, in cache kmalloc-32
Object freed, allocated with size 3 bytes
Allocation:
PID = 8715
 [<ffffffff81205056>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67
 [<ffffffff8173f3e6>] save_stack+0x46/0xd0 mm/kasan/kasan.c:450
 [<ffffffff8173f7a9>] set_track mm/kasan/kasan.c:462 [inline]
 [<ffffffff8173f7a9>] kasan_kmalloc+0xc9/0xe0 mm/kasan/kasan.c:532
 [<ffffffff8173bb09>] __do_kmalloc mm/slab.c:3545 [inline]
 [<ffffffff8173bb09>] __kmalloc+0x169/0x6d0 mm/slab.c:3554
 [<ffffffff82fb8ae0>] kmalloc include/linux/slab.h:483 [inline]
 [<ffffffff82fb8ae0>] set_selection+0x4e0/0xce0 drivers/tty/vt/selection.c:298
 [<ffffffff82fd5b36>] tioclinux+0xe6/0x360 drivers/tty/vt/vt.c:2680
 [<ffffffff82fb3aa7>] vt_ioctl+0x337/0x24e0 drivers/tty/vt/vt_ioctl.c:365
 [<ffffffff82f81da4>] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988
 [<ffffffff817d312f>] vfs_ioctl fs/ioctl.c:43 [inline]
 [<ffffffff817d312f>] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674
 [<ffffffff817d3e94>] SYSC_ioctl fs/ioctl.c:689 [inline]
 [<ffffffff817d3e94>] SyS_ioctl+0x74/0x80 fs/ioctl.c:680
 [<ffffffff85b6fe80>] entry_SYSCALL_64_fastpath+0x23/0xc1
Deallocation:
PID = 8718
 [<ffffffff81205056>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:67
 [<ffffffff8173f3e6>] save_stack+0x46/0xd0 mm/kasan/kasan.c:450
 [<ffffffff8173fc8b>] set_track mm/kasan/kasan.c:462 [inline]
 [<ffffffff8173fc8b>] kasan_slab_free+0x9b/0xb0 mm/kasan/kasan.c:501
 [<ffffffff81739f02>] __cache_free mm/slab.c:3332 [inline]
 [<ffffffff81739f02>] kfree+0xe2/0x460 mm/slab.c:3640
 [<ffffffff82fb8b05>] set_selection+0x505/0xce0 drivers/tty/vt/selection.c:304
 [<ffffffff82fd5b36>] tioclinux+0xe6/0x360 drivers/tty/vt/vt.c:2680
 [<ffffffff82fb3aa7>] vt_ioctl+0x337/0x24e0 drivers/tty/vt/vt_ioctl.c:365
 [<ffffffff82f81da4>] tty_ioctl+0x5d4/0x20f0 drivers/tty/tty_io.c:2988
 [<ffffffff817d312f>] vfs_ioctl fs/ioctl.c:43 [inline]
 [<ffffffff817d312f>] do_vfs_ioctl+0x17f/0xe70 fs/ioctl.c:674
 [<ffffffff817d3e94>] SYSC_ioctl fs/ioctl.c:689 [inline]
 [<ffffffff817d3e94>] SyS_ioctl+0x74/0x80 fs/ioctl.c:680
 [<ffffffff85b6fe80>] entry_SYSCALL_64_fastpath+0x23/0xc1
Memory state around the buggy address:
 ffff8800b7a54480: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
 ffff8800b7a54500: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
>ffff8800b7a54580: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
                   ^
 ffff8800b7a54600: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
 ffff8800b7a54680: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
==================================================================