general protection fault in flex_array_get

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: a03957ab Linux 4.19.38
git tree: linux-4.19.y
console output: https://syzkaller.appspot.com/x/log.txt?x=1011e350a00000
kernel config: https://syzkaller.appspot.com/x/.config?x=dd6b74381d776865
dashboard link: https://syzkaller.appspot.com/bug?extid=051a735288befdffa28c
compiler: gcc (GCC) 9.0.0 20181231 (experimental)
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=14973eff200000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=146f3970a00000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+051a73...@syzkaller.appspotmail.com

RBP: 00007ffcc15f9910 R08: 0000000000000002 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: ffffffffffffffff
R13: 0000000000000005 R14: 0000000000000000 R15: 0000000000000000
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access
general protection fault: 0000 [#1] PREEMPT SMP KASAN
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.19.38 #6
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
RIP: 0010:flex_array_get+0x2d/0x260 lib/flex_array.c:320
Code: e5 41 57 41 56 41 55 41 54 41 89 f4 53 48 89 fb 48 83 ec 08 e8 b4 4f
49 fe 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84
c0 74 08 3c 03 0f 8e c2 01 00 00 44 8b 33 31 ff 44
RSP: 0018:ffff8880ae907360 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff867036c9
RDX: 0000000000000000 RSI: ffffffff8322203c RDI: 0000000000000000
RBP: ffff8880ae907390 R08: ffff8880aa2703c0 R09: 0000000000000003
R10: ffffed1015d24732 R11: ffff8880ae923993 R12: 0000000000000000
R13: ffff88808a691160 R14: 0000000000000000 R15: ffff88809fefa300
FS: 0000000000000000(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000040 CR3: 000000008ea3c000 CR4: 00000000001406e0
Call Trace:
<IRQ>
sctp_stream_out include/net/sctp/structs.h:1471 [inline]
sctp_sched_dequeue_done+0x20d/0x2f0 net/sctp/stream_sched.c:255
__sctp_outq_teardown+0x6ef/0xc60 net/sctp/outqueue.c:267
sctp_outq_free+0x16/0x20 net/sctp/outqueue.c:291
sctp_association_free+0x208/0x79a net/sctp/associola.c:360
sctp_cmd_delete_tcb net/sctp/sm_sideeffect.c:939 [inline]
sctp_cmd_interpreter net/sctp/sm_sideeffect.c:1353 [inline]
sctp_side_effects net/sctp/sm_sideeffect.c:1220 [inline]
sctp_do_sm+0x2a79/0x5780 net/sctp/sm_sideeffect.c:1191
sctp_assoc_bh_rcv+0x343/0x660 net/sctp/associola.c:1072
sctp_inq_push+0x1ea/0x290 net/sctp/inqueue.c:95
sctp_rcv+0x27f2/0x3430 net/sctp/input.c:268
ip_local_deliver_finish+0x284/0xc60 net/ipv4/ip_input.c:215
NF_HOOK include/linux/netfilter.h:289 [inline]
NF_HOOK include/linux/netfilter.h:283 [inline]
ip_local_deliver+0x1e9/0x520 net/ipv4/ip_input.c:256
dst_input include/net/dst.h:450 [inline]
ip_rcv_finish+0x1e1/0x300 net/ipv4/ip_input.c:414
NF_HOOK include/linux/netfilter.h:289 [inline]
NF_HOOK include/linux/netfilter.h:283 [inline]
ip_rcv+0xe8/0x3f0 net/ipv4/ip_input.c:524
__netif_receive_skb_one_core+0x115/0x1a0 net/core/dev.c:4932
__netif_receive_skb+0x2c/0x1d0 net/core/dev.c:5044
process_backlog+0x206/0x750 net/core/dev.c:5855
napi_poll net/core/dev.c:6278 [inline]
net_rx_action+0x4fa/0x1070 net/core/dev.c:6344
__do_softirq+0x266/0x92f kernel/softirq.c:292
invoke_softirq kernel/softirq.c:372 [inline]
irq_exit+0x180/0x1d0 kernel/softirq.c:412
exiting_irq arch/x86/include/asm/apic.h:536 [inline]
smp_apic_timer_interrupt+0x14a/0x570 arch/x86/kernel/apic/apic.c:1056
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:867
</IRQ>
RIP: 0010:native_safe_halt+0x2/0x10 arch/x86/include/asm/irqflags.h:58
Code: ff ff ff 48 89 c7 48 89 45 d8 e8 d9 3d b1 fa 48 8b 45 d8 e9 ce fe ff
ff 48 89 df e8 c8 3d b1 fa eb 82 90 90 90 90 90 90 fb f4 <c3> 0f 1f 00 66
2e 0f 1f 84 00 00 00 00 00 f4 c3 90 90 90 90 90 90
RSP: 0018:ffff8880aa27fd00 EFLAGS: 00000286 ORIG_RAX: ffffffffffffff13
RAX: 1ffffffff10e466c RBX: ffff8880aa2703c0 RCX: 0000000000000000
RDX: dffffc0000000000 RSI: 0000000000000001 RDI: ffff8880aa270c3c
RBP: ffff8880aa27fd30 R08: ffff8880aa2703c0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000001
R13: ffffffff88723350 R14: 0000000000000001 R15: 0000000000000000
arch_cpu_idle+0x10/0x20 arch/x86/kernel/process.c:556
default_idle_call+0x36/0x90 kernel/sched/idle.c:93
cpuidle_idle_call kernel/sched/idle.c:153 [inline]
do_idle+0x377/0x560 kernel/sched/idle.c:262
cpu_startup_entry+0xc8/0xe0 kernel/sched/idle.c:368
start_secondary+0x404/0x5c0 arch/x86/kernel/smpboot.c:271
secondary_startup_64+0xa4/0xb0 arch/x86/kernel/head_64.S:243
Modules linked in:
---[ end trace f881514b8fa8b549 ]---
RIP: 0010:flex_array_get+0x2d/0x260 lib/flex_array.c:320
Code: e5 41 57 41 56 41 55 41 54 41 89 f4 53 48 89 fb 48 83 ec 08 e8 b4 4f
49 fe 48 89 da 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 <0f> b6 04 02 84
c0 74 08 3c 03 0f 8e c2 01 00 00 44 8b 33 31 ff 44
RSP: 0018:ffff8880ae907360 EFLAGS: 00010246
RAX: dffffc0000000000 RBX: 0000000000000000 RCX: ffffffff867036c9
RDX: 0000000000000000 RSI: ffffffff8322203c RDI: 0000000000000000
RBP: ffff8880ae907390 R08: ffff8880aa2703c0 R09: 0000000000000003
R10: ffffed1015d24732 R11: ffff8880ae923993 R12: 0000000000000000
R13: ffff88808a691160 R14: 0000000000000000 R15: ffff88809fefa300
FS: 0000000000000000(0000) GS:ffff8880ae900000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000020000040 CR3: 000000008ea3c000 CR4: 00000000001406e0


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches