TITLE: KASAN: global-out-of-bounds Read in show_timer
ALT: bad-access in show_timer
TYPE: KASAN-READ
PANICKED: Y

[   66.768767] ==================================================================
[   66.776196] BUG: KASAN: global-out-of-bounds in show_timer+0x27a/0x2b0 at addr ffffffff82cda558
[   66.785026] Read of size 8 by task syz-executor7/8685
[   66.790216] Address belongs to variable nstr.37854+0x18/0x40
[   66.796010] CPU: 0 PID: 8685 Comm: syz-executor7 Not tainted 4.4.114+ #250
[   66.803009] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   66.807266] kasan: CONFIG_KASAN_INLINE enabled
[   66.807275] kasan: GPF could be caused by NULL-ptr deref or user memory access
[   66.807279] general protection fault: 0000 [#1] SMP KASAN
[   66.807284] Dumping ftrace buffer:
[   66.807288]    (ftrace buffer empty)
[   66.807291] Modules linked in:
[   66.807299] CPU: 1 PID: 8694 Comm: syz-executor3 Not tainted 4.4.114+ #250
[   66.807304] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   66.807311] task: ffff8800b9c69780 ti: ffff8800b7bb8000 task.ti: ffff8800b7bb8000
[   66.807335] RIP: 0010:[<ffffffff8268adb6>]  [<ffffffff8268adb6>] udp_queue_rcv_skb+0x196/0x1590
[   66.807338] RSP: 0018:ffff8800b7bbf928  EFLAGS: 00010206
[   66.807343] RAX: dffffc0000000000 RBX: ffff8800ba440000 RCX: ffffc90003b90000
[   66.807347] RDX: 000000000000000c RSI: ffff8801cd8b2900 RDI: 0000000000000060
[   66.807351] RBP: ffff8800b7bbf968 R08: 0000000000000001 R09: 0000000000000001
[   66.807355] R10: 0000000000000000 R11: 1ffff10016f77efa R12: ffff8801cd8b2900
[   66.807359] R13: 0000000000000001 R14: 0000000000000000 R15: ffff8801cd8b2958
[   66.807365] FS:  00007fc9a056d700(0000) GS:ffff8801db700000(0000) knlGS:0000000000000000
[   66.807370] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   66.807375] CR2: 000000002082dff0 CR3: 00000000b1580000 CR4: 0000000000160630
[   66.807383] DR0: 0000000020000000 DR1: 0000000020000000 DR2: 0000000000000000
[   66.807388] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
[   66.807389] Stack:
[   66.807399]  ffff8800ba440088 ffff880000000001 ffff8800ba440088 dffffc0000000000
[   66.807408]  ffff8800ba440000 0000000000000000 ffffed0017488083 ffff8801cd8b2900
[   66.807418]  ffff8800b7bbf9d8 ffffffff822092d5 ffff8800ba440188 ffff8800ba440190
[   66.807419] Call Trace:
[   66.807429]  [<ffffffff822092d5>] release_sock+0x165/0x540
[   66.807437]  [<ffffffff826844df>] udp_sendmsg+0x15df/0x1c40
[   66.807447]  [<ffffffff811efdee>] ? __lock_acquire+0xabe/0x4eb0
[   66.807454]  [<ffffffff82680e70>] ? udp_push_pending_frames+0xe0/0xe0
[   66.807462]  [<ffffffff811ef330>] ? debug_check_no_locks_freed+0x2c0/0x2c0
[   66.807469]  [<ffffffff82682f00>] ? udp_seq_next+0x80/0x80
[   66.807478]  [<ffffffff811ef330>] ? debug_check_no_locks_freed+0x2c0/0x2c0
[   66.807486]  [<ffffffff811e61d0>] ? zap_class+0x390/0x390
[   66.807494]  [<ffffffff811e8241>] ? __lock_is_held+0xa1/0xf0
[   66.807502]  [<ffffffff826b8a58>] ? inet_sendmsg+0x208/0x4c0
[   66.807508]  [<ffffffff826b8b15>] inet_sendmsg+0x2c5/0x4c0
[   66.807515]  [<ffffffff826b88c8>] ? inet_sendmsg+0x78/0x4c0
[   66.807521]  [<ffffffff826b8850>] ? inet_recvmsg+0x4b0/0x4b0
[   66.807529]  [<ffffffff821fcb2f>] sock_sendmsg+0xcf/0x110
[   66.807535]  [<ffffffff821fda60>] SYSC_sendto+0x2e0/0x360
[   66.807543]  [<ffffffff821fd780>] ? SYSC_connect+0x310/0x310
[   66.807551]  [<ffffffff811c61fe>] ? pick_next_task_fair+0x105e/0x1b40
[   66.807558]  [<ffffffff811e61d0>] ? zap_class+0x390/0x390
[   66.807568]  [<ffffffff82a1611c>] ? _raw_spin_unlock_irq+0x2c/0x40
[   66.807576]  [<ffffffff811eeb5b>] ? trace_hardirqs_on_caller+0x38b/0x590
[   66.807584]  [<ffffffff82a02785>] ? __schedule+0xab5/0x1c40
[   66.807591]  [<ffffffff81284a8d>] ? SyS_futex+0x20d/0x2b0
[   66.807600]  [<ffffffff82a16cce>] ? int_ret_from_sys_call+0x52/0xa3
[   66.807608]  [<ffffffff82200025>] SyS_sendto+0x45/0x60
[   66.807616]  [<ffffffff82a16b1b>] entry_SYSCALL_64_fastpath+0x18/0x94
[   66.807698] Code: 74 24 58 41 f6 c6 01 0f 85 7f 08 00 00 49 83 e6 fe e8 3f b1 c7 fe 49 8d 7e 60 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 08 3c 01 0f 8e 4c 0c 00 00 41 f6 46 60 04 
[   66.807706] RIP  [<ffffffff8268adb6>] udp_queue_rcv_skb+0x196/0x1590
[   66.807708]  RSP <ffff8800b7bbf928>
[   66.807727] ---[ end trace 4bc40108dd6f901f ]---
[   66.807733] Kernel panic - not syncing: Fatal exception in interrupt
[   67.166273]  0000000000000000 ffff8800b6c7f9f8 ffffffff81cac64d fffffbfff059b4ab
[   67.174269]  fffffbfff059b4ab 0000000000000008 0000000000000000 ffffffff82cda558
[   67.182263]  ffff8800b6c7fa80 ffffffff814d588d ffff8800b6c7faa0 ffff8800b6c7fa40
[   67.190259] Call Trace:
[   67.192832]  [<ffffffff81cac64d>] dump_stack+0xc1/0x124
[   67.198179]  [<ffffffff814d588d>] kasan_report.part.2+0x44d/0x540
[   67.204391]  [<ffffffff8166b87a>] ? show_timer+0x27a/0x2b0
[   67.209998]  [<ffffffff811159c0>] ? __lock_task_sighand+0x170/0x470
[   67.216383]  [<ffffffff814d5a3e>] __asan_report_load8_noabort+0x2e/0x30
[   67.223115]  [<ffffffff8166b87a>] show_timer+0x27a/0x2b0
[   67.228545]  [<ffffffff8166bac1>] ? timers_start+0x151/0x1d0
[   67.234325]  [<ffffffff81581e3c>] seq_read+0x32c/0x1240
[   67.239671]  [<ffffffff81581b10>] ? seq_lseek+0x3c0/0x3c0
[   67.245188]  [<ffffffff815e3c4d>] ? fsnotify+0x59d/0xec0
[   67.250612]  [<ffffffff815e4570>] ? fsnotify+0xec0/0xec0
[   67.256040]  [<ffffffff81510656>] do_loop_readv_writev+0x146/0x1e0
[   67.262337]  [<ffffffff81b4cabe>] ? security_file_permission+0x8e/0x1e0
[   67.269067]  [<ffffffff81581b10>] ? seq_lseek+0x3c0/0x3c0
[   67.274581]  [<ffffffff81581b10>] ? seq_lseek+0x3c0/0x3c0
[   67.280094]  [<ffffffff81512954>] do_readv_writev+0x5d4/0x6d0
[   67.285953]  [<ffffffff81512380>] ? vfs_write+0x530/0x530
[   67.291470]  [<ffffffff811e8241>] ? __lock_is_held+0xa1/0xf0
[   67.297241]  [<ffffffff8156c152>] ? __fget+0x212/0x3b0
[   67.302491]  [<ffffffff8156c17b>] ? __fget+0x23b/0x3b0
[   67.307742]  [<ffffffff8156bf8c>] ? __fget+0x4c/0x3b0
[   67.312909]  [<ffffffff81512acd>] vfs_readv+0x7d/0xb0
[   67.318074]  [<ffffffff815152eb>] SyS_preadv+0x18b/0x220
[   67.323498]  [<ffffffff81515160>] ? SyS_writev+0x230/0x230
[   67.329099]  [<ffffffff81002284>] ? lockdep_sys_exit_thunk+0x12/0x14
[   67.335570]  [<ffffffff82a16b1b>] entry_SYSCALL_64_fastpath+0x18/0x94
[   67.342119] Memory state around the buggy address:
[   67.347022]  ffffffff82cda400: 05 fa fa fa fa fa fa fa 00 04 fa fa fa fa fa fa
[   67.354352]  ffffffff82cda480: 07 fa fa fa fa fa fa fa 05 fa fa fa fa fa fa fa
[   67.361682] >ffffffff82cda500: 07 fa fa fa fa fa fa fa 00 00 00 fa fa fa fa fa
[   67.369010]                                                     ^
[   67.375211]  ffffffff82cda580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   67.382542]  ffffffff82cda600: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[   67.389870] ==================================================================
[   67.397650] Dumping ftrace buffer:
[   67.401175]    (ftrace buffer empty)
[   67.405471] Kernel Offset: disabled
[   67.409078] Rebooting in 86400 seconds..
