[ 2186.274552][ C2] ==================================================================
[ 2186.274854][ C2] BUG: KASAN: slab-out-of-bounds in tcp_v6_send_response+0xe7d/0x24e0
[ 2186.275096][ C2] Read of size 8 at addr ff110000104f8718 by task msg_zerocopy/21248
[ 2186.275342][ C2]
[ 2186.275427][ C2] CPU: 2 UID: 0 PID: 21248 Comm: msg_zerocopy Not tainted 7.2.0-virtme #1 PREEMPT(full)
[ 2186.275431][ C2] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
[ 2186.275433][ C2] Call Trace:
[ 2186.275434][ C2]
[ 2186.275436][ C2] dump_stack_lvl+0x6f/0xa0
[ 2186.275441][ C2] print_address_description.constprop.0+0x56/0x2d0
[ 2186.275445][ C2] print_report+0xfc/0x1fa
[ 2186.275446][ C2] ? __virt_addr_valid+0x102/0x440
[ 2186.275449][ C2] ? __virt_addr_valid+0x1da/0x440
[ 2186.275451][ C2] kasan_report+0x108/0x130
[ 2186.275454][ C2] ? tcp_v6_send_response+0xe7d/0x24e0
[ 2186.275456][ C2] ? tcp_v6_send_response+0xe7d/0x24e0
[ 2186.275458][ C2] kasan_check_range+0x130/0x200
[ 2186.275460][ C2] ? make_kuid+0x13/0x20
[ 2186.275463][ C2] tcp_v6_send_response+0xe7d/0x24e0
[ 2186.275465][ C2] ? __mod_timer+0x3ad/0xc60
[ 2186.275468][ C2] ? tcp_v6_send_synack+0xe10/0xe10
[ 2186.275470][ C2] ? __lock_acquire+0x518/0xc20
[ 2186.275473][ C2] ? logarithmic_accumulation.constprop.0+0x115/0x350
[ 2186.275476][ C2] ? __lock_release.isra.0+0x69/0x1a0
[ 2186.275478][ C2] ? rcu_is_watching+0x16/0xd0
[ 2186.275480][ C2] tcp_v6_rcv+0x24c5/0x3250
[ 2186.275485][ C2] ? tcp_v6_syn_recv_sock+0x1b90/0x1b90
[ 2186.275487][ C2] ? __trace_set_current_state+0x160/0x160
[ 2186.275489][ C2] ? wakeup_preempt_fair+0x572/0x15d0
[ 2186.275493][ C2] ip6_protocol_deliver_rcu+0x15c/0x1480
[ 2186.275497][ C2] ip6_input_finish+0x196/0x590
[ 2186.275498][ C2] ip6_input+0x130/0x570
[ 2186.275500][ C2] ? ip6_input_finish+0x590/0x590
[ 2186.275501][ C2] ? ip6_rcv_core+0xe22/0x1be0
[ 2186.275503][ C2] ipv6_rcv+0x3c1/0x5a0
[ 2186.275505][ C2] ? ip6_rcv_core+0x1be0/0x1be0
[ 2186.275506][ C2] ? rcu_is_watching+0x16/0xd0
[ 2186.275507][ C2] ? __update_load_avg_cfs_rq+0x36c/0x10c0
[ 2186.275509][ C2] ? mark_usage+0x61/0x170
[ 2186.275511][ C2] ? __lock_acquire+0x518/0xc20
[ 2186.275513][ C2] ? irq_matrix_free+0x487/0x600
[ 2186.275516][ C2] ? process_backlog+0x3f1/0x14c0
[ 2186.275519][ C2] __netif_receive_skb_one_core+0xfc/0x180
[ 2186.275521][ C2] ? lock_acquire.part.0+0xd4/0x280
[ 2186.275523][ C2] ? process_backlog+0x3f1/0x14c0
[ 2186.275525][ C2] ? __netif_receive_skb_list_core+0x9e0/0x9e0
[ 2186.275527][ C2] ? rcu_is_watching+0x16/0xd0
[ 2186.275529][ C2] process_backlog+0x431/0x14c0
[ 2186.275531][ C2] __napi_poll+0xa7/0x3b0
[ 2186.275534][ C2] net_rx_action+0x513/0xf50
[ 2186.275537][ C2] ? __lock_acquire+0x518/0xc20
[ 2186.275539][ C2] ? __napi_poll+0x3b0/0x3b0
[ 2186.275542][ C2] ? ktime_get_update_offsets_now+0x2a8/0x490
[ 2186.275544][ C2] ? mark_held_locks+0x40/0x70
[ 2186.275547][ C2] handle_softirqs+0x1d3/0x900
[ 2186.275550][ C2] ? _local_bh_enable+0xc0/0xc0
[ 2186.275551][ C2] ? do_raw_spin_unlock+0x59/0x250
[ 2186.275554][ C2] ? rcu_is_watching+0x16/0xd0
[ 2186.275555][ C2] ? __dev_queue_xmit+0x974/0x1b90
[ 2186.275557][ C2] do_softirq+0xac/0xe0
[ 2186.275559][ C2]
[ 2186.275559][ C2]
[ 2186.275560][ C2] __local_bh_enable_ip+0x118/0x150
[ 2186.275562][ C2] __dev_queue_xmit+0x989/0x1b90
[ 2186.275564][ C2] ? __lock_acquire+0x518/0xc20
[ 2186.275566][ C2] ? lock_acquire.part.0+0xd4/0x280
[ 2186.275567][ C2] ? find_held_lock+0x2b/0x80
[ 2186.275569][ C2] ? netdev_core_pick_tx+0x2c0/0x2c0
[ 2186.275571][ C2] ? __asan_memcpy+0x3c/0x60
[ 2186.275574][ C2] ? eth_header+0x14c/0x180
[ 2186.275577][ C2] ? neigh_resolve_output.part.0+0x344/0x740
[ 2186.275580][ C2] ip6_finish_output2+0x48d/0x13f0
[ 2186.275583][ C2] ? ip6_dst_lookup+0x80/0x80
[ 2186.275585][ C2] ? find_held_lock+0x2b/0x80
[ 2186.275587][ C2] ? __lock_release.isra.0+0x69/0x1a0
[ 2186.275589][ C2] ? ip6_mtu+0x174/0x410
[ 2186.275591][ C2] ip6_finish_output+0x701/0xe80
[ 2186.275594][ C2] ip6_output+0x23f/0x7f0
[ 2186.275596][ C2] ? ip6_finish_output+0xe80/0xe80
[ 2186.275598][ C2] ? lock_acquire.part.0+0xd4/0x280
[ 2186.275600][ C2] ? find_held_lock+0x2b/0x80
[ 2186.275605][ C2] ? __lock_release.isra.0+0x69/0x1a0
[ 2186.275608][ C2] ip6_xmit+0xc44/0x1ec0
[ 2186.275609][ C2] ? mark_usage+0x61/0x170
[ 2186.275611][ C2] ? __lock_acquire+0x518/0xc20
[ 2186.275614][ C2] ? ip6_autoflowlabel+0x120/0x120
[ 2186.275616][ C2] ? __lock_release.isra.0+0x69/0x1a0
[ 2186.275617][ C2] ? mark_usage+0x61/0x170
[ 2186.275619][ C2] ? __lock_acquire+0x518/0xc20
[ 2186.275621][ C2] ? lock_acquire.part.0+0xd4/0x280
[ 2186.275623][ C2] ? inet6_csk_xmit+0xfe/0x5f0
[ 2186.275625][ C2] ? rcu_is_watching+0x16/0xd0
[ 2186.275626][ C2] ? lock_acquire+0x13c/0x160
[ 2186.275629][ C2] inet6_csk_xmit+0x2f6/0x5f0
[ 2186.275631][ C2] __tcp_transmit_skb+0x1c3e/0x3cd0
[ 2186.275636][ C2] ? __lock_acquire+0x518/0xc20
[ 2186.275637][ C2] ? __tcp_select_window+0x1040/0x1040
[ 2186.275640][ C2] ? lock_acquire.part.0+0xd4/0x280
[ 2186.275641][ C2] ? find_held_lock+0x2b/0x80
[ 2186.275644][ C2] tcp_write_xmit+0x5a4/0x3080
[ 2186.275648][ C2] ? tcp_retrans_try_collapse+0x1090/0x1090
[ 2186.275651][ C2] ? tcp_set_state+0x101/0x580
[ 2186.275653][ C2] __tcp_push_pending_frames+0x8f/0x3b0
[ 2186.275655][ C2] __tcp_close+0x84e/0xe70
[ 2186.275656][ C2] ? mark_held_locks+0x40/0x70
[ 2186.275659][ C2] tcp_close+0x23/0xb0
[ 2186.275660][ C2] inet_release+0x10a/0x240
[ 2186.275663][ C2] ? fcntl_setlk+0xce0/0xce0
[ 2186.275666][ C2] __sock_release+0xb8/0x280
[ 2186.275669][ C2] sock_close+0x18/0x20
[ 2186.275671][ C2] __fput+0x36c/0xad0
[ 2186.275674][ C2] fput_close_sync+0xde/0x1b0
[ 2186.275676][ C2] ? alloc_file_clone+0xe0/0xe0
[ 2186.275677][ C2] ? do_raw_spin_unlock+0x59/0x250
[ 2186.275680][ C2] __x64_sys_close+0x8b/0xf0
[ 2186.275681][ C2] do_syscall_64+0xff/0x530
[ 2186.275684][ C2] ? irq_exit_rcu+0x1a/0x30
[ 2186.275686][ C2] entry_SYSCALL_64_after_hwframe+0x4b/0x53
[ 2186.275688][ C2] RIP: 0033:0x7f1068cdf54e
[ 2186.275691][ C2] Code: 4d 89 d8 e8 b4 bd 00 00 4c 8b 5d f8 41 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 11 c9 c3 0f 1f 80 00 00 00 00 48 8b 45 10 0f 05 c3 83 e2 39 83 fa 08 75 e7 e8 03 ff ff ff 0f 1f 00 f3 0f 1e fa
[ 2186.275693][ C2] RSP: 002b:00007fff949d5dd0 EFLAGS: 00000202 ORIG_RAX: 0000000000000003
[ 2186.275697][ C2] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00007f1068cdf54e
[ 2186.275698][ C2] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000006
[ 2186.275699][ C2] RBP: 00007fff949d5de0 R08: 0000000000000000 R09: 0000000000000000
[ 2186.275700][ C2] R10: 0000000000000000 R11: 0000000000000202 R12: 000000000000000a
[ 2186.275700][ C2] R13: 00007fff949d5f00 R14: 0000000000000001 R15: 000001a05da682b4
[ 2186.275703][ C2]
[ 2186.275703][ C2]
[ 2186.296230][ C2] The buggy address belongs to the object at ff110000104f8688
[ 2186.296230][ C2] which belongs to the cache tw_sock_TCPv6 of size 288
[ 2186.296722][ C2] The buggy address is located 144 bytes inside of
[ 2186.296722][ C2] allocated 288-byte region [ff110000104f8688, ff110000104f87a8)
[ 2186.297210][ C2]
[ 2186.297347][ C2] The buggy address belongs to the physical page:
[ 2186.297548][ C2] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xff110000104f8008 pfn:0x104f8
[ 2186.297937][ C2] head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[ 2186.298248][ C2] flags: 0x80000000000240(workingset|head|node=0|zone=1)
[ 2186.298516][ C2] page_type: f5(slab)
[ 2186.298650][ C2] raw: 0080000000000240 ff1100000633de40 ff110000063470c8 ff110000063470c8
[ 2186.298944][ C2] raw: ff110000104f8008 0000000000130001 00000000f5000000 0000000000000000
[ 2186.299233][ C2] head: 0080000000000240 ff1100000633de40 ff110000063470c8 ff110000063470c8
[ 2186.299581][ C2] head: ff110000104f8008 0000000000130001 00000000f5000000 0000000000000000
[ 2186.299873][ C2] head: 0080000000000001 ffffffffffffff81 00000000ffffffff 00000000ffffffff
[ 2186.300220][ C2] head: ff110000104f91a0 0000000000000000 00000000ffffffff 0000000000000000
[ 2186.300560][ C2] page dumped because: kasan: bad access detected
[ 2186.300820][ C2]
[ 2186.300901][ C2] Memory state around the buggy address:
[ 2186.301116][ C2] ff110000104f8600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 2186.301350][ C2] ff110000104f8680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 2186.301645][ C2] >ff110000104f8700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 2186.301941][ C2] ^
[ 2186.302097][ C2] ff110000104f8780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 2186.302389][ C2] ff110000104f8800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
[ 2186.302684][ C2] ==================================================================
[ 2186.303017][ C2] Disabling lock debugging due to kernel taint