net/udp: slab-out-of-bounds in udp_recvmsg/do_csum

Hi,

I've got the following error report while fuzzing the kernel with syzkaller.

On commit c470abd4fde40ea6a0846a2beab642a578c0b8cd (4.10).

A reproducer and .config are attached.

BUG: KASAN: slab-out-of-bounds in do_csum+0x333/0x360
arch/x86/lib/csum-partial_64.c:102 at addr ffff880053c47100
Read of size 4 by task syz-executor2/7429
CPU: 2 PID: 7429 Comm: syz-executor2 Not tainted 4.10.0-rc8+ #5
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Bochs 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:15 [inline]
 dump_stack+0x292/0x398 lib/dump_stack.c:51
 kasan_object_err+0x1c/0x70 mm/kasan/report.c:162
 print_address_description mm/kasan/report.c:200 [inline]
 kasan_report_error mm/kasan/report.c:289 [inline]
 kasan_report.part.1+0x20e/0x4e0 mm/kasan/report.c:311
 kasan_report mm/kasan/report.c:331 [inline]
 __asan_report_load4_noabort+0x29/0x30 mm/kasan/report.c:331
 do_csum+0x333/0x360 arch/x86/lib/csum-partial_64.c:102
 csum_partial+0x21/0x30 arch/x86/lib/csum-partial_64.c:135
 ip_cmsg_recv_checksum net/ipv4/ip_sockglue.c:120 [inline]
 ip_cmsg_recv_offset+0xf57/0x1240 net/ipv4/ip_sockglue.c:231
 udp_recvmsg+0xf86/0x1380 net/ipv4/udp.c:1494
 inet_recvmsg+0x13e/0x610 net/ipv4/af_inet.c:775
 sock_recvmsg_nosec net/socket.c:742 [inline]
 sock_recvmsg+0xd7/0x110 net/socket.c:749
 SYSC_recvfrom+0x33a/0x720 net/socket.c:1738
 SyS_recvfrom+0x40/0x50 net/socket.c:1711
 entry_SYSCALL_64_fastpath+0x1f/0xc2
RIP: 0033:0x4458b9
RSP: 002b:00007f3f404d7b58 EFLAGS: 00000282 ORIG_RAX: 000000000000002d
RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000004458b9
RDX: 0000000000000000 RSI: 0000000020cf2ffc RDI: 0000000000000006
RBP: 00000000006e1740 R08: 0000000020cf2ff0 R09: 0000000000000010
R10: 0000000100000042 R11: 0000000000000282 R12: 0000000000708000
R13: 0000000000000016 R14: 0000000020153000 R15: 0000000000000215
Object at ffff880053c46ed8, in cache kmalloc-512 size: 512
Allocated:
PID = 7429
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack+0x43/0xd0 mm/kasan/kasan.c:502
 set_track mm/kasan/kasan.c:514 [inline]
 kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:605
 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:544
 slab_post_alloc_hook mm/slab.h:432 [inline]
 slab_alloc_node mm/slub.c:2715 [inline]
 __kmalloc_node_track_caller+0x20e/0x360 mm/slub.c:4262
 __kmalloc_reserve.isra.34+0x41/0xd0 net/core/skbuff.c:138
 __alloc_skb+0x159/0x800 net/core/skbuff.c:231
 alloc_skb include/linux/skbuff.h:926 [inline]
 alloc_skb_with_frags+0x12e/0x7b0 net/core/skbuff.c:4657
 sock_alloc_send_pskb+0x804/0xa30 net/core/sock.c:1887
 sock_alloc_send_skb+0x32/0x40 net/core/sock.c:1904
 __ip_append_data.isra.48+0x1780/0x2ca0 net/ipv4/ip_output.c:1028
 ip_append_data.part.49+0xe9/0x160 net/ipv4/ip_output.c:1226
 ip_append_data+0x68/0x80 net/ipv4/ip_output.c:1215
 udp_sendmsg+0x1a1f/0x2b80 net/ipv4/udp.c:1085
 inet_sendmsg+0x164/0x5b0 net/ipv4/af_inet.c:744
 sock_sendmsg_nosec net/socket.c:635 [inline]
 sock_sendmsg+0xca/0x110 net/socket.c:645
 SYSC_sendto+0x660/0x810 net/socket.c:1687
 SyS_sendto+0x40/0x50 net/socket.c:1655
 entry_SYSCALL_64_fastpath+0x1f/0xc2
Freed:
PID = 785
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack+0x43/0xd0 mm/kasan/kasan.c:502
 set_track mm/kasan/kasan.c:514 [inline]
 kasan_slab_free+0x73/0xc0 mm/kasan/kasan.c:578
 slab_free_hook mm/slub.c:1355 [inline]
 slab_free_freelist_hook mm/slub.c:1377 [inline]
 slab_free mm/slub.c:2958 [inline]
 kfree+0xe8/0x2b0 mm/slub.c:3878
 skb_free_head+0x74/0xb0 net/core/skbuff.c:580
 skb_release_data+0x3a7/0x470 net/core/skbuff.c:611
 skb_release_all+0x4a/0x60 net/core/skbuff.c:670
 __kfree_skb+0x15/0x20 net/core/skbuff.c:684
 kfree_skb+0x16e/0x4e0 net/core/skbuff.c:705
 netlink_sock_destruct+0x14d/0x400 net/netlink/af_netlink.c:333
 __sk_destruct+0xe1/0x6e0 net/core/sock.c:1430
 sk_destruct+0x47/0x80 net/core/sock.c:1460
 __sk_free+0x57/0x230 net/core/sock.c:1468
 sk_free+0x23/0x30 net/core/sock.c:1479
 netlink_sock_destruct_work+0x19/0x20 net/netlink/af_netlink.c:353
 process_one_work+0xc06/0x1c20 kernel/workqueue.c:2098
 worker_thread+0x223/0x19c0 kernel/workqueue.c:2232
 kthread+0x326/0x3f0 kernel/kthread.c:227
 ret_from_fork+0x31/0x40 arch/x86/entry/entry_64.S:430
Memory state around the buggy address:
 ffff880053c47000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff880053c47080: 00 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc

ffff880053c47100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc

                   ^
 ffff880053c47180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff880053c47200: fc fc fc fc fc fc fb fb fb fb fb fb fb fb fb fb
==================================================================