==================================================================
BUG: KASAN: use-after-free in parse_ipsecrequest net/key/af_key.c:1906 [inline] at addr ffff8801cc3b62b6
BUG: KASAN: use-after-free in parse_ipsecrequests+0xc7d/0xd00 net/key/af_key.c:1958 at addr ffff8801cc3b62b6
Read of size 1 by task syz-executor5/14721
page:ffffea000730ed80 count:0 mapcount:0 mapping:          (null) index:0x0
flags: 0x200000000000000()
page dumped because: kasan: bad access detected
CPU: 0 PID: 14721 Comm: syz-executor5 Not tainted 4.9.39-g5b07c2d #4
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801b3b9f7b0 ffffffff81eacd59 ffffed0039876c56 0000000000000001
 0000000000000000 ffffed0039876c56 ffff8801cc3b62b6 ffff8801b3b9f830
 ffffffff81547141 0000000000000387 ffff8801d8c74f00 ffffffff8358b4bd
Call Trace:
 [<ffffffff81eacd59>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81eacd59>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81547141>] print_address_description mm/kasan/report.c:208 [inline]
 [<ffffffff81547141>] kasan_report_error mm/kasan/report.c:287 [inline]
 [<ffffffff81547141>] kasan_report.part.1+0x4a1/0x4e0 mm/kasan/report.c:309
 [<ffffffff815471a9>] kasan_report mm/kasan/report.c:327 [inline]
 [<ffffffff815471a9>] __asan_report_load1_noabort+0x29/0x30 mm/kasan/report.c:327
 [<ffffffff8358b4bd>] parse_ipsecrequest net/key/af_key.c:1906 [inline]
 [<ffffffff8358b4bd>] parse_ipsecrequests+0xc7d/0xd00 net/key/af_key.c:1958
 [<ffffffff835a4890>] pfkey_compile_policy+0xa20/0xd40 net/key/af_key.c:3250
 [<ffffffff83402532>] xfrm_user_policy+0x222/0x370 net/xfrm/xfrm_state.c:1900
 [<ffffffff8323f79e>] do_ip_setsockopt.isra.11+0x193e/0x28f0 net/ipv4/ip_sockglue.c:1146
 [<ffffffff8324078a>] ip_setsockopt+0x3a/0xb0 net/ipv4/ip_sockglue.c:1235
 [<ffffffff832601b2>] tcp_setsockopt+0x82/0xd0 net/ipv4/tcp.c:2701
 [<ffffffff82f01f55>] sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2705
 [<ffffffff82efefa8>] SYSC_setsockopt net/socket.c:1771 [inline]
 [<ffffffff82efefa8>] SyS_setsockopt+0x158/0x240 net/socket.c:1750
 [<ffffffff839658c5>] entry_SYSCALL_64_fastpath+0x23/0xc6
Memory state around the buggy address:
 ffff8801cc3b6180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8801cc3b6200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff8801cc3b6280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                     ^
 ffff8801cc3b6300: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8801cc3b6380: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
==================================================================
BUG: KASAN: use-after-free in parse_ipsecrequest net/key/af_key.c:1906 [inline] at addr ffff8801cc3b69b6
BUG: KASAN: use-after-free in parse_ipsecrequests+0xc7d/0xd00 net/key/af_key.c:1958 at addr ffff8801cc3b69b6
Read of size 1 by task syz-executor5/14755
page:ffffea000730ed80 count:0 mapcount:0 mapping:          (null) index:0x0
flags: 0x200000000000000()
page dumped because: kasan: bad access detected
CPU: 0 PID: 14755 Comm: syz-executor5 Tainted: G    B           4.9.39-g5b07c2d #4
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801caf777b0 ffffffff81eacd59 ffffed0039876d36 0000000000000001
 0000000000000000 ffffed0039876d36 ffff8801cc3b69b6 ffff8801caf77830
 ffffffff81547141 0000000000000000 0000000000000000 ffffffff8358b4bd
Call Trace:
 [<ffffffff81eacd59>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81eacd59>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81547141>] print_address_description mm/kasan/report.c:208 [inline]
 [<ffffffff81547141>] kasan_report_error mm/kasan/report.c:287 [inline]
 [<ffffffff81547141>] kasan_report.part.1+0x4a1/0x4e0 mm/kasan/report.c:309
 [<ffffffff815471a9>] kasan_report mm/kasan/report.c:327 [inline]
 [<ffffffff815471a9>] __asan_report_load1_noabort+0x29/0x30 mm/kasan/report.c:327
 [<ffffffff8358b4bd>] parse_ipsecrequest net/key/af_key.c:1906 [inline]
 [<ffffffff8358b4bd>] parse_ipsecrequests+0xc7d/0xd00 net/key/af_key.c:1958
 [<ffffffff835a4890>] pfkey_compile_policy+0xa20/0xd40 net/key/af_key.c:3250
 [<ffffffff83402532>] xfrm_user_policy+0x222/0x370 net/xfrm/xfrm_state.c:1900
 [<ffffffff8323f79e>] do_ip_setsockopt.isra.11+0x193e/0x28f0 net/ipv4/ip_sockglue.c:1146
 [<ffffffff8324078a>] ip_setsockopt+0x3a/0xb0 net/ipv4/ip_sockglue.c:1235
 [<ffffffff832601b2>] tcp_setsockopt+0x82/0xd0 net/ipv4/tcp.c:2701
 [<ffffffff82f01f55>] sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2705
 [<ffffffff82efefa8>] SYSC_setsockopt net/socket.c:1771 [inline]
 [<ffffffff82efefa8>] SyS_setsockopt+0x158/0x240 net/socket.c:1750
 [<ffffffff839658c5>] entry_SYSCALL_64_fastpath+0x23/0xc6
Memory state around the buggy address:
 ffff8801cc3b6880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8801cc3b6900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff8801cc3b6980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                     ^
 ffff8801cc3b6a00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8801cc3b6a80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================
nla_parse: 9 callbacks suppressed
netlink: 48 bytes leftover after parsing attributes in process `syz-executor2'.
netlink: 48 bytes leftover after parsing attributes in process `syz-executor2'.