==================================================================
BUG: KASAN: slab-out-of-bounds in hex_dump_to_buffer+0x3b2/0xd60 lib/hexdump.c:193
Read of size 1 at addr ffff88802c040600 by task dhcpcd-run-hook/9539

CPU: 0 PID: 9539 Comm: dhcpcd-run-hook Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/16/2026
Call Trace:
 <IRQ>
 dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106
 print_address_description+0x60/0x2d0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:434 [inline]
 kasan_report+0xdf/0x130 mm/kasan/report.c:451
 hex_dump_to_buffer+0x3b2/0xd60 lib/hexdump.c:193
 print_hex_dump+0x168/0x2b0 lib/hexdump.c:276
 pn533_recv_frame+0x593/0x5f0 drivers/nfc/pn533/pn533.c:2206
 __usb_hcd_giveback_urb+0x35d/0x520 drivers/usb/core/hcd.c:1674
 dummy_timer+0xa47/0x34a0 drivers/usb/gadget/udc/dummy_hcd.c:2012
 call_timer_fn+0x17b/0x540 kernel/time/timer.c:1648
 expire_timers kernel/time/timer.c:1699 [inline]
 __run_timers+0x56c/0x810 kernel/time/timer.c:1970
 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1983
 handle_softirqs+0x336/0x830 kernel/softirq.c:576
 __do_softirq kernel/softirq.c:610 [inline]
 invoke_softirq kernel/softirq.c:450 [inline]
 __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:659
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
 sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
 </IRQ>
 <TASK>
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676
RIP: 0010:preempt_count_sub+0x1/0x160 kernel/sched/core.c:5531
Code: c7 c1 c8 5b 6b 8e 80 e1 07 80 c1 03 38 c1 0f 8c 6e ff ff ff 48 c7 c7 c8 5b 6b 8e e8 19 0f 6c 00 89 df e9 5b ff ff ff 66 90 55 <53> 48 bb 00 00 00 00 00 fc ff df 48 c7 c0 80 bf 11 97 48 c1 e8 03
RSP: 0018:ffffc9000411fa40 EFLAGS: 00000216
RAX: ffffc90004120000 RBX: ffffc9000411fae8 RCX: ffffc9000411ff28
RDX: ffffc9000411fb01 RSI: ffffc9000411ff10 RDI: 0000000000000001
RBP: dffffc0000000000 R08: ffffc9000411ff10 R09: ffffc9000411fb38
R10: dffffc0000000000 R11: fffff52000823f69 R12: ffffc90004118000
R13: dffffc0000000000 R14: ffffc9000411faf8 R15: ffffc9000411ff20
 unwind_next_frame+0x11ec/0x1cf0 arch/x86/kernel/unwind_orc.c:616
 arch_stack_walk+0x10c/0x140 arch/x86/kernel/stacktrace.c:25
 stack_trace_save+0xa6/0xf0 kernel/stacktrace.c:122
 kasan_save_stack+0x35/0x60 mm/kasan/common.c:38
 kasan_record_aux_stack+0xb8/0x100 mm/kasan/generic.c:348
 task_work_add+0x2f/0x1d0 kernel/task_work.c:38
 fput_many+0xde/0x1a0 fs/file_table.c:367
 filp_close+0x10e/0x150 fs/open.c:1371
 __do_sys_close fs/open.c:1384 [inline]
 __se_sys_close fs/open.c:1382 [inline]
 __x64_sys_close+0x34/0x70 fs/open.c:1382
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7f4556661a67
Code: 44 00 00 48 83 ec 10 48 63 ff 45 31 c9 45 31 c0 6a 01 31 c9 e8 ca 19 f9 ff 48 83 c4 18 c3 0f 1f 44 00 00 b8 03 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 01 c3 48 8b 15 61 b3 0d 00 f7 d8 64 89 02 b8
RSP: 002b:00007ffcef4dd6e8 EFLAGS: 00000202 ORIG_RAX: 0000000000000003
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f4556661a67
RDX: 000000000000d371 RSI: 00005644df894c90 RDI: 0000000000000003
RBP: 00005644df88d4ef R08: 0000000000005330 R09: 0000000000000000
R10: 00005644df88d4e9 R11: 0000000000000202 R12: 00007ffcef4dd838
R13: 00005644df88d4e8 R14: 0000000000000001 R15: 00005644df88d547
 </TASK>

Allocated by task 9539:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:46 [inline]
 set_alloc_info mm/kasan/common.c:434 [inline]
 ____kasan_kmalloc mm/kasan/common.c:513 [inline]
 __kasan_kmalloc+0xaf/0xe0 mm/kasan/common.c:522
 kmalloc_reserve net/core/skbuff.c:356 [inline]
 __alloc_skb+0x22c/0x750 net/core/skbuff.c:427
 alloc_skb include/linux/skbuff.h:1162 [inline]
 pn533_recv_response+0xbc/0x230 drivers/nfc/pn533/usb.c:65
 __usb_hcd_giveback_urb+0x35d/0x520 drivers/usb/core/hcd.c:1674
 dummy_timer+0xa47/0x34a0 drivers/usb/gadget/udc/dummy_hcd.c:2012
 call_timer_fn+0x17b/0x540 kernel/time/timer.c:1648
 expire_timers kernel/time/timer.c:1699 [inline]
 __run_timers+0x56c/0x810 kernel/time/timer.c:1970
 run_timer_softirq+0x63/0xf0 kernel/time/timer.c:1983
 handle_softirqs+0x336/0x830 kernel/softirq.c:576
 __do_softirq kernel/softirq.c:610 [inline]
 invoke_softirq kernel/softirq.c:450 [inline]
 __irq_exit_rcu+0x13b/0x230 kernel/softirq.c:659
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:671
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1108 [inline]
 sysvec_apic_timer_interrupt+0xa0/0xc0 arch/x86/kernel/apic/apic.c:1108
 asm_sysvec_apic_timer_interrupt+0x16/0x20 arch/x86/include/asm/idtentry.h:676

Last potentially related work creation:
 kasan_save_stack+0x35/0x60 mm/kasan/common.c:38
 kasan_record_aux_stack+0xb8/0x100 mm/kasan/generic.c:348
 kvfree_call_rcu+0x105/0x7f0 kernel/rcu/tree.c:3600
 drop_sysctl_table+0x359/0x4e0 fs/proc/proc_sysctl.c:1685
 drop_sysctl_table+0x348/0x4e0 fs/proc/proc_sysctl.c:1688
 unregister_sysctl_table+0x87/0x130 fs/proc/proc_sysctl.c:1723
 mpls_dev_sysctl_unregister+0x8b/0xc0 net/mpls/af_mpls.c:1447
 mpls_dev_notify+0x545/0x780 net/mpls/af_mpls.c:1665
 notifier_call_chain kernel/notifier.c:83 [inline]
 raw_notifier_call_chain+0xcb/0x160 kernel/notifier.c:391
 call_netdevice_notifiers_extack net/core/dev.c:2074 [inline]
 call_netdevice_notifiers net/core/dev.c:2088 [inline]
 unregister_netdevice_many+0x109b/0x1a40 net/core/dev.c:11161
 unregister_netdevice_queue+0x2e1/0x320 net/core/dev.c:11094
 unregister_netdevice include/linux/netdevice.h:3047 [inline]
 nsim_destroy+0x49/0x150 drivers/net/netdevsim/netdev.c:382
 __nsim_dev_port_del+0x155/0x1c0 drivers/net/netdevsim/dev.c:1349
 nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1362 [inline]
 nsim_dev_reload_destroy+0x160/0x230 drivers/net/netdevsim/dev.c:1561
 nsim_dev_reload_down+0xf9/0x160 drivers/net/netdevsim/dev.c:883
 devlink_reload+0x253/0x770 net/core/devlink.c:3963
 devlink_pernet_pre_exit+0x1aa/0x310 net/core/devlink.c:11543
 ops_pre_exit_list net/core/net_namespace.c:162 [inline]
 cleanup_net+0x58e/0xba0 net/core/net_namespace.c:615
 process_one_work+0x867/0xff0 kernel/workqueue.c:2310
 worker_thread+0xad7/0x12a0 kernel/workqueue.c:2457
 kthread+0x42e/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287

The buggy address belongs to the object at ffff88802c040400
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 0 bytes to the right of
 512-byte region [ffff88802c040400, ffff88802c040600)
The buggy address belongs to the page:
page:ffffea0000b01000 refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88802c040000 pfn:0x2c040
head:ffffea0000b01000 order:2 compound_mapcount:0 compound_pincount:0
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 0000000000000000 0000000100000001 ffff888017841c80
raw: ffff88802c040000 000000008010000e 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 3251, ts 23423795227, free_ts 0
 prep_new_page mm/page_alloc.c:2426 [inline]
 get_page_from_freelist+0x24f6/0x2670 mm/page_alloc.c:4192
 __alloc_pages+0x1ee/0x480 mm/page_alloc.c:5501
 alloc_slab_page mm/slub.c:1780 [inline]
 allocate_slab mm/slub.c:1917 [inline]
 new_slab+0xc0/0x4b0 mm/slub.c:1980
 ___slab_alloc+0x807/0xdd0 mm/slub.c:3013
 __slab_alloc mm/slub.c:3100 [inline]
 slab_alloc_node mm/slub.c:3191 [inline]
 slab_alloc mm/slub.c:3233 [inline]
 kmem_cache_alloc_trace+0xf9/0x290 mm/slub.c:3250
 kmalloc include/linux/slab.h:607 [inline]
 kzalloc include/linux/slab.h:738 [inline]
 crypto_larval_alloc+0x53/0x1c0 crypto/api.c:109
 __crypto_register_alg+0x26b/0x5c0 crypto/algapi.c:265
 crypto_register_instance+0x3ac/0x5b0 crypto/algapi.c:646
 hmac_create+0x544/0x750 crypto/hmac.c:230
 cryptomgr_probe+0x62/0x1a0 crypto/algboss.c:61
 kthread+0x42e/0x520 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
page_owner free stack trace missing

Memory state around the buggy address:
 ffff88802c040500: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff88802c040580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff88802c040600: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                   ^
 ffff88802c040680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88802c040700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================
----------------
Code disassembly (best guess):
   0:	c7 c1 c8 5b 6b 8e    	mov    $0x8e6b5bc8,%ecx
   6:	80 e1 07             	and    $0x7,%cl
   9:	80 c1 03             	add    $0x3,%cl
   c:	38 c1                	cmp    %al,%cl
   e:	0f 8c 6e ff ff ff    	jl     0xffffff82
  14:	48 c7 c7 c8 5b 6b 8e 	mov    $0xffffffff8e6b5bc8,%rdi
  1b:	e8 19 0f 6c 00       	call   0x6c0f39
  20:	89 df                	mov    %ebx,%edi
  22:	e9 5b ff ff ff       	jmp    0xffffff82
  27:	66 90                	xchg   %ax,%ax
  29:	55                   	push   %rbp
* 2a:	53                   	push   %rbx <-- trapping instruction
  2b:	48 bb 00 00 00 00 00 	movabs $0xdffffc0000000000,%rbx
  32:	fc ff df
  35:	48 c7 c0 80 bf 11 97 	mov    $0xffffffff9711bf80,%rax
  3c:	48 c1 e8 03          	shr    $0x3,%rax