base_sock_release(0000000056daaa9a) sk=00000000b155a54a
==================================================================
BUG: KASAN: global-out-of-bounds in record_print_text+0x33f/0x380 kernel/printk/printk.c:1401
Write of size 1 at addr ffffffff8f09f144 by task syz-executor.3/9957

CPU: 1 PID: 9957 Comm: syz-executor.3 Not tainted 5.11.0-rc4-next-20210121-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x107/0x163 lib/dump_stack.c:120
 print_address_description.constprop.0.cold+0x5/0x2f8 mm/kasan/report.c:230
 __kasan_report mm/kasan/report.c:397 [inline]
 kasan_report.cold+0x79/0xd5 mm/kasan/report.c:414
 record_print_text+0x33f/0x380 kernel/printk/printk.c:1401
 console_unlock+0x318/0xbb0 kernel/printk/printk.c:2555
 vprintk_emit+0x189/0x490 kernel/printk/printk.c:2092
 vprintk_func+0x8d/0x1e0 kernel/printk/printk_safe.c:393
 printk+0xba/0xed kernel/printk/printk.c:2140
 base_sock_release+0x4a/0x16f drivers/isdn/mISDN/socket.c:622
 __sock_release+0xcd/0x280 net/socket.c:597
 sock_close+0x18/0x20 net/socket.c:1256
 __fput+0x283/0x920 fs/file_table.c:280
 task_work_run+0xdd/0x190 kernel/task_work.c:140
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:177 [inline]
 exit_to_user_mode_prepare+0x249/0x250 kernel/entry/common.c:210
 __syscall_exit_to_user_mode_work kernel/entry/common.c:301 [inline]
 syscall_exit_to_user_mode+0x19/0x50 kernel/entry/common.c:312
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x417b71
Code: 75 14 b8 03 00 00 00 0f 05 48 3d 01 f0 ff ff 0f 83 a4 1a 00 00 c3 48 83 ec 08 e8 0a fc ff ff 48 89 04 24 b8 03 00 00 00 0f 05 <48> 8b 3c 24 48 89 c2 e8 53 fc ff ff 48 89 d0 48 83 c4 08 48 3d 01
RSP: 002b:00007fffe4207af0 EFLAGS: 00000293 ORIG_RAX: 0000000000000003
RAX: 0000000000000000 RBX: 0000000000000004 RCX: 0000000000417b71
RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000003
RBP: 0000000000000001 R08: 0000000000001c8c R09: 00000000017b3c90
R10: 00007fffe4207bd0 R11: 0000000000000293 R12: ffffffffffffffff
R13: 00000000000415f1 R14: 00000000000003e8 R15: 000000000119bf8c

The buggy address belongs to the variable:
 dmesg_restrict+0x24/0x40

Memory state around the buggy address:
 ffffffff8f09f000: f9 f9 f9 f9 01 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9
 ffffffff8f09f080: f9 f9 f9 f9 01 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9
>ffffffff8f09f100: f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9 00 00 00 00
                                           ^
 ffffffff8f09f180: 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9 00 00 00 00
 ffffffff8f09f200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================