Hello, syzbot hit the following crash on linux-next commit 0e08c463db387a2adcb0243b15ab868a73f87807 So far this crash happened 6 times on linux-next, mmots, upstream. C reproducer is attached. syzkaller reproducer is attached. Raw console output is attached. compiler: gcc (GCC) 7.1.1 20170620 .config is attached. IMPORTANT: if you fix the bug, please add the following tag to the commit: Reported-by: syzbot+9da69ebac7dddd804552@syzkaller.appspotmail.com It will help syzbot understand when the bug is fixed. See footer for details. If you forward the report, please keep this part and the footer. device syz0 entered promiscuous mode audit: type=1400 audit(1514752309.665:10): avc: denied { net_raw } for pid=3143 comm="syzkaller343753" capability=13 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 audit: type=1400 audit(1514752309.668:11): avc: denied { net_admin } for pid=3143 comm="syzkaller343753" capability=12 scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=cap_userns permissive=1 ================================================================== BUG: KASAN: slab-out-of-bounds in __tcp_hdrlen include/linux/tcp.h:35 [inline] BUG: KASAN: slab-out-of-bounds in tcp_hdrlen include/linux/tcp.h:40 [inline] BUG: KASAN: slab-out-of-bounds in qdisc_pkt_len_init net/core/dev.c:3160 [inline] BUG: KASAN: slab-out-of-bounds in __dev_queue_xmit+0x20d3/0x2200 net/core/dev.c:3465 Read of size 2 at addr ffff8801c85791e0 by task syzkaller343753/3143 CPU: 0 PID: 3143 Comm: syzkaller343753 Not tainted 4.15.0-rc4-next-20171221+ #78 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x194/0x257 lib/dump_stack.c:53 print_address_description+0x73/0x250 mm/kasan/report.c:252 kasan_report_error mm/kasan/report.c:351 [inline] kasan_report+0x25b/0x340 mm/kasan/report.c:409 __asan_report_load2_noabort+0x14/0x20 mm/kasan/report.c:428 __tcp_hdrlen include/linux/tcp.h:35 [inline] tcp_hdrlen include/linux/tcp.h:40 [inline] qdisc_pkt_len_init net/core/dev.c:3160 [inline] __dev_queue_xmit+0x20d3/0x2200 net/core/dev.c:3465 dev_queue_xmit+0x17/0x20 net/core/dev.c:3554 packet_snd net/packet/af_packet.c:2943 [inline] packet_sendmsg+0x3ad5/0x60a0 net/packet/af_packet.c:2968 sock_sendmsg_nosec net/socket.c:628 [inline] sock_sendmsg+0xca/0x110 net/socket.c:638 sock_write_iter+0x31a/0x5d0 net/socket.c:907 call_write_iter include/linux/fs.h:1776 [inline] new_sync_write fs/read_write.c:469 [inline] __vfs_write+0x684/0x970 fs/read_write.c:482 vfs_write+0x189/0x510 fs/read_write.c:544 SYSC_write fs/read_write.c:589 [inline] SyS_write+0xef/0x220 fs/read_write.c:581 entry_SYSCALL_64_fastpath+0x1f/0x96 RIP: 0033:0x444df9 RSP: 002b:00000000007eff78 EFLAGS: 00000297 ORIG_RAX: 0000000000000001 RAX: ffffffffffffffda RBX: 00007ffc3d2180f0 RCX: 0000000000444df9 RDX: 00000000000000ce RSI: 0000000020fecf2b RDI: 0000000000000005 RBP: 0000000000000000 R08: 0000000120080522 R09: 0000000120080522 R10: 0000000120080522 R11: 0000000000000297 R12: 00000000004029f0 R13: 0000000000402a80 R14: 0000000000000000 R15: 0000000000000000 Allocated by task 3143: save_stack+0x43/0xd0 mm/kasan/kasan.c:447 set_track mm/kasan/kasan.c:459 [inline] kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:551 __do_kmalloc_node mm/slab.c:3673 [inline] __kmalloc_node_track_caller+0x47/0x70 mm/slab.c:3687 __kmalloc_reserve.isra.41+0x41/0xd0 net/core/skbuff.c:137 __alloc_skb+0x13b/0x780 net/core/skbuff.c:205 alloc_skb include/linux/skbuff.h:983 [inline] alloc_skb_with_frags+0x10d/0x750 net/core/skbuff.c:5146 sock_alloc_send_pskb+0x787/0x9b0 net/core/sock.c:2088 packet_alloc_skb net/packet/af_packet.c:2802 [inline] packet_snd net/packet/af_packet.c:2893 [inline] packet_sendmsg+0x1ec2/0x60a0 net/packet/af_packet.c:2968 sock_sendmsg_nosec net/socket.c:628 [inline] sock_sendmsg+0xca/0x110 net/socket.c:638 sock_write_iter+0x31a/0x5d0 net/socket.c:907 call_write_iter include/linux/fs.h:1776 [inline] new_sync_write fs/read_write.c:469 [inline] __vfs_write+0x684/0x970 fs/read_write.c:482 vfs_write+0x189/0x510 fs/read_write.c:544 SYSC_write fs/read_write.c:589 [inline] SyS_write+0xef/0x220 fs/read_write.c:581 entry_SYSCALL_64_fastpath+0x1f/0x96 Freed by task 0: (stack is not available) The buggy address belongs to the object at ffff8801c8578d80 which belongs to the cache kmalloc-1024 of size 1024 The buggy address is located 96 bytes to the right of 1024-byte region [ffff8801c8578d80, ffff8801c8579180) The buggy address belongs to the page: page:00000000c294763f count:1 mapcount:0 mapping:0000000098a38184 index:0x0 compound_mapcount: 0 flags: 0x2fffc0000008100(slab|head) raw: 02fffc0000008100 ffff8801c8578000 0000000000000000 0000000100000007 raw: ffffea0007252920 ffff8801dac01848 ffff8801dac00ac0 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff8801c8579080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff8801c8579100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 > ffff8801c8579180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ^ ffff8801c8579200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8801c8579280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== --- This bug is generated by a dumb bot. It may contain errors. See https://goo.gl/tpsmEJ for details. Direct all questions to syzkaller@googlegroups.com. syzbot will keep track of this bug report. If you forgot to add the Reported-by tag, once the fix for this bug is merged into any tree, please reply to this email with: #syz fix: exact-commit-title If you want to test a patch for this bug, please reply with: #syz test: git://repo/address.git branch and provide the patch inline or as an attachment. To mark this as a duplicate of another syzbot report, please reply with: #syz dup: exact-subject-of-another-report If it's a one-off invalid bug report, please reply with: #syz invalid Note: if the crash happens again, it will cause creation of a new bug report. Note: all commands must start from beginning of the line in the email body.