syzbot

==================================================================
BUG: KASAN: stack-out-of-bounds in memcpy include/linux/fortify-string.h:225 [inline]
BUG: KASAN: stack-out-of-bounds in __ip_options_echo+0xafd/0x11a0 net/ipv4/ip_options.c:169
Write of size 4 at addr ffffc900039dfbbf by task syz-fuzzer/10312

CPU: 1 PID: 10312 Comm: syz-fuzzer Not tainted 5.15.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
 print_address_description.constprop.0.cold+0xf/0x320 mm/kasan/report.c:247
 __kasan_report mm/kasan/report.c:433 [inline]
 kasan_report.cold+0x83/0xdf mm/kasan/report.c:450
 check_region_inline mm/kasan/generic.c:183 [inline]
 kasan_check_range+0x13d/0x180 mm/kasan/generic.c:189
 memcpy+0x39/0x60 mm/kasan/shadow.c:66
 memcpy include/linux/fortify-string.h:225 [inline]
 __ip_options_echo+0xafd/0x11a0 net/ipv4/ip_options.c:169
 __icmp_send+0x830/0x13c0 net/ipv4/icmp.c:720
 icmp_send include/net/icmp.h:43 [inline]
 ip_expire+0x63a/0x840 net/ipv4/ip_fragment.c:189
 call_timer_fn+0x1a5/0x6b0 kernel/time/timer.c:1421
 expire_timers kernel/time/timer.c:1466 [inline]
 __run_timers.part.0+0x675/0xa20 kernel/time/timer.c:1734
 __run_timers kernel/time/timer.c:1715 [inline]
 run_timer_softirq+0xb3/0x1d0 kernel/time/timer.c:1747
 __do_softirq+0x29b/0x9c2 kernel/softirq.c:558
 invoke_softirq kernel/softirq.c:432 [inline]
 __irq_exit_rcu+0x123/0x180 kernel/softirq.c:636
 irq_exit_rcu+0x5/0x20 kernel/softirq.c:648
 sysvec_apic_timer_interrupt+0x45/0xc0 arch/x86/kernel/apic/apic.c:1097
 asm_sysvec_apic_timer_interrupt+0x12/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0033:0x5b94da
Code: 01 48 8b 8c 24 90 01 00 00 48 89 0c 24 48 8b 9c 24 98 01 00 00 48 89 5c 24 08 48 89 44 24 10 48 8b 94 24 a8 01 00 00 48 8b 32 <ff> d6 48 8b bc 24 a0 01 00 00 80 7f 30 00 0f 85 3c 04 00 00 48 8b
RSP: 002b:000000c000391758 EFLAGS: 00000202
RAX: 000000c00a9982c0 RBX: 000000c00a7680d0 RCX: 0000000000c96c00
RDX: 000000c000391c68 RSI: 00000000005ee3e0 RDI: 000000c0003918d0
RBP: 000000c0003918d8 R08: 000000c000391c68 R09: 0000000000203002
R10: 0000000000000002 R11: 0000000000000011 R12: 00000000000000f1
R13: 0000000000000000 R14: 0000000000c55b75 R15: 0000000000000000
 </TASK>


addr ffffc900039dfbbf is located in stack of task syz-fuzzer/10312 at offset 383 in frame:
 __icmp_send+0x0/0x13c0 include/linux/skbuff.h:986

this frame has 5 objects:
 [48, 49) '_inner_type'
 [64, 72) 'rt'
 [96, 136) 'ipc'
 [176, 232) 'fl4'
 [272, 384) 'icmp_param'

Memory state around the buggy address:
 ffffc900039dfa80: 00 f2 f2 f2 00 00 00 00 00 f2 f2 f2 f2 f2 00 00
 ffffc900039dfb00: 00 00 00 00 00 f2 f2 f2 f2 f2 00 00 00 00 00 00
>ffffc900039dfb80: 00 00 00 00 00 00 00 00 f3 f3 f3 f3 00 00 00 00
                                           ^
 ffffc900039dfc00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffc900039dfc80: 00 f1 f1 f1 f1 f1 f1 00 00 00 00 00 f3 f3 f3 f3
==================================================================