==================================================================
BUG: KASAN: slab-out-of-bounds in strnlen+0xc1/0xd0 lib/string.c:498
Read of size 1 at addr ffff8801ce0e72d9 by task syz-executor3/7167

CPU: 0 PID: 7167 Comm: syz-executor3 Not tainted 4.4.113-g202e079 #1
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 0000000000000000 0d4b9a842e0adc3f ffff8800b27775c0 ffffffff81d0278d
 ffffea0007383980 ffff8801ce0e72d9 0000000000000000 ffff8801ce0e72d9
 ffff8800b2777890 ffff8800b27775f8 ffffffff814fd053 ffff8801ce0e72d9
Call Trace:
 [<ffffffff81d0278d>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d0278d>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
 [<ffffffff814fd053>] print_address_description+0x73/0x260 mm/kasan/report.c:252
 [<ffffffff814fd565>] kasan_report_error mm/kasan/report.c:351 [inline]
 [<ffffffff814fd565>] kasan_report+0x285/0x370 mm/kasan/report.c:408
 [<ffffffff814fd664>] __asan_report_load1_noabort+0x14/0x20 mm/kasan/report.c:426
 [<ffffffff81d1e171>] strnlen+0xc1/0xd0 lib/string.c:498
 [<ffffffff81d25dfc>] string.isra.4+0x4c/0x240 lib/vsprintf.c:518
 [<ffffffff81d2b2a6>] vsnprintf+0x766/0x15f0 lib/vsprintf.c:1907
 [<ffffffff8117160f>] __request_module+0x14f/0x810 kernel/kmod.c:146
 [<ffffffff8302c64b>] xt_request_find_target+0x8b/0xb0 net/netfilter/x_tables.c:255
 [<ffffffff8326a258>] check_compat_entry_size_and_hooks net/ipv4/netfilter/ip_tables.c:1490 [inline]
 [<ffffffff8326a258>] translate_compat_table+0x568/0x1760 net/ipv4/netfilter/ip_tables.c:1582
 [<ffffffff810002b8>] ? 0xffffffff810002b8
 [<ffffffff8326b641>] compat_do_replace.isra.15+0x1f1/0x410 net/ipv4/netfilter/ip_tables.c:1690
 [<ffffffff8326b966>] compat_do_ipt_set_ctl+0x106/0x150 net/ipv4/netfilter/ip_tables.c:1721
 [<ffffffff82f94e58>] compat_nf_sockopt net/netfilter/nf_sockopt.c:143 [inline]
 [<ffffffff82f94e58>] compat_nf_setsockopt+0x88/0x130 net/netfilter/nf_sockopt.c:155
 [<ffffffff830fc26d>] compat_ip_setsockopt+0x9d/0xf0 net/ipv4/ip_sockglue.c:1255
 [<ffffffff831a1ed5>] compat_udp_setsockopt+0x45/0x80 net/ipv4/udp.c:2164
 [<ffffffff82df0732>] compat_sock_common_setsockopt+0xb2/0x140 net/core/sock.c:2670
 [<ffffffff82ed7659>] C_SYSC_setsockopt net/compat.c:384 [inline]
 [<ffffffff82ed7659>] compat_SyS_setsockopt+0x149/0x290 net/compat.c:367
 [<ffffffff81006d74>] do_syscall_32_irqs_on arch/x86/entry/common.c:390 [inline]
 [<ffffffff81006d74>] do_fast_syscall_32+0x314/0x890 arch/x86/entry/common.c:457
 [<ffffffff837734ea>] sysenter_flags_fixed+0xd/0x17

Allocated by task 7167:
 [<ffffffff81035df6>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63
 [<ffffffff814fc0c3>] save_stack+0x43/0xd0 mm/kasan/kasan.c:512
 [<ffffffff814fc38d>] set_track mm/kasan/kasan.c:524 [inline]
 [<ffffffff814fc38d>] kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:616
 [<ffffffff814f8674>] __kmalloc+0x124/0x320 mm/slub.c:3613
 [<ffffffff8302de91>] kmalloc include/linux/slab.h:481 [inline]
 [<ffffffff8302de91>] xt_alloc_table_info+0x71/0x100 net/netfilter/x_tables.c:911
 [<ffffffff8326b5bb>] compat_do_replace.isra.15+0x16b/0x410 net/ipv4/netfilter/ip_tables.c:1679
 [<ffffffff8326b966>] compat_do_ipt_set_ctl+0x106/0x150 net/ipv4/netfilter/ip_tables.c:1721
 [<ffffffff82f94e58>] compat_nf_sockopt net/netfilter/nf_sockopt.c:143 [inline]
 [<ffffffff82f94e58>] compat_nf_setsockopt+0x88/0x130 net/netfilter/nf_sockopt.c:155
 [<ffffffff830fc26d>] compat_ip_setsockopt+0x9d/0xf0 net/ipv4/ip_sockglue.c:1255
 [<ffffffff831a1ed5>] compat_udp_setsockopt+0x45/0x80 net/ipv4/udp.c:2164
 [<ffffffff82df0732>] compat_sock_common_setsockopt+0xb2/0x140 net/core/sock.c:2670
 [<ffffffff82ed7659>] C_SYSC_setsockopt net/compat.c:384 [inline]
 [<ffffffff82ed7659>] compat_SyS_setsockopt+0x149/0x290 net/compat.c:367
 [<ffffffff81006d74>] do_syscall_32_irqs_on arch/x86/entry/common.c:390 [inline]
 [<ffffffff81006d74>] do_fast_syscall_32+0x314/0x890 arch/x86/entry/common.c:457
 [<ffffffff837734ea>] sysenter_flags_fixed+0xd/0x17

Freed by task 3605:
 [<ffffffff81035df6>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63
 [<ffffffff814fc0c3>] save_stack+0x43/0xd0 mm/kasan/kasan.c:512
 [<ffffffff814fc9e2>] set_track mm/kasan/kasan.c:524 [inline]
 [<ffffffff814fc9e2>] kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:589
 [<ffffffff814f947c>] slab_free_hook mm/slub.c:1383 [inline]
 [<ffffffff814f947c>] slab_free_freelist_hook mm/slub.c:1405 [inline]
 [<ffffffff814f947c>] slab_free mm/slub.c:2859 [inline]
 [<ffffffff814f947c>] kfree+0xfc/0x300 mm/slub.c:3749
 [<ffffffff82e0413d>] skb_free_head net/core/skbuff.c:571 [inline]
 [<ffffffff82e0413d>] skb_release_data+0x2ed/0x3b0 net/core/skbuff.c:602
 [<ffffffff82e0424a>] skb_release_all+0x4a/0x60 net/core/skbuff.c:661
 [<ffffffff82e04853>] __kfree_skb net/core/skbuff.c:675 [inline]
 [<ffffffff82e04853>] consume_skb+0xf3/0x3d0 net/core/skbuff.c:748
 [<ffffffff82e2184a>] skb_free_datagram+0x1a/0xe0 net/core/datagram.c:280
 [<ffffffff82f7f3bb>] netlink_recvmsg+0x60b/0xe10 net/netlink/af_netlink.c:1926
 [<ffffffff82de6adc>] sock_recvmsg_nosec net/socket.c:727 [inline]
 [<ffffffff82de6adc>] sock_recvmsg+0x8c/0xc0 net/socket.c:735
 [<ffffffff82debfed>] ___sys_recvmsg+0x26d/0x560 net/socket.c:2116
 [<ffffffff82dee1f3>] __sys_recvmsg+0xd3/0x190 net/socket.c:2162
 [<ffffffff82dee2dd>] SYSC_recvmsg net/socket.c:2174 [inline]
 [<ffffffff82dee2dd>] SyS_recvmsg+0x2d/0x50 net/socket.c:2169
 [<ffffffff83771b5f>] entry_SYSCALL_64_fastpath+0x1c/0x98

The buggy address belongs to the object at ffff8801ce0e7180
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 345 bytes inside of
 512-byte region [ffff8801ce0e7180, ffff8801ce0e7380)
The buggy address belongs to the page:
------------[ cut here ]------------
WARNING: CPU: 1 PID: 3387 at mm/vmacache.c:100 vmacache_find+0x222/0x290 mm/vmacache.c:100()
------------[ cut here ]------------
kernel BUG at include/linux/mm.h:460!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 3387 Comm: syz-executor5 Not tainted 4.4.113-g202e079 #1
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8801cf9517c0 task.stack: ffff8801c6338000
RIP: 0010:[<ffffffff8148f8e1>]  [<ffffffff8148f8e1>] dump_page mm/debug.c:105 [inline]
RIP: 0010:[<ffffffff8148f8e1>]  [<ffffffff8148f8e1>] page_mapcount include/linux/mm.h:460 [inline]
RIP: 0010:[<ffffffff8148f8e1>]  [<ffffffff8148f8e1>] dump_page_badflags+0x191/0x250 mm/debug.c:85
RSP: 0000:ffff8801db307d18  EFLAGS: 00010006
RAX: ffffffff8148f8e1 RBX: ffff8801db307d68 RCX: ffffffff8129fd3b
RDX: 0000000000000100 RSI: ffffffff847ebaf8 RDI: ffff8800b31b0000
RBP: ffff8801db307df0 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: 1ffff1003b660fa9
R13: ffff8800ab787b50 R14: 0000000000000101 R15: ffffffff83844340
FS:  0000000000000000(0000) GS:ffff8801db300000(0063) knlGS:0000000009d43900
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 0000000007383980 CR3: 00000001c6348000 CR4: 0000000000160670
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 ffffffff8129fd4b ffffffff8129fc9c 0000000000000000 ffffffff842c3560
 ffff8800b31b0000 ffffffff8148f8e1 0000000041b58ab3 ffffffff83faa139
 ffffffff8129fbc0 ffff8801db307db0 ffff8800ab787be0 0000000000000000
Call Trace:
 <IRQ> 
 [<ffffffff812a1ca5>] __run_timers kernel/time/timer.c:1250 [inline]
 [<ffffffff812a1ca5>] run_timer_softirq+0x4a5/0xbb0 kernel/time/timer.c:1437
 [<ffffffff83775057>] __do_softirq+0x227/0xa38 kernel/softirq.c:273
 [<ffffffff8113daf9>] invoke_softirq kernel/softirq.c:350 [inline]
 [<ffffffff8113daf9>] irq_exit+0x119/0x140 kernel/softirq.c:391
 [<ffffffff837747bb>] exiting_irq arch/x86/include/asm/apic.h:653 [inline]
 [<ffffffff837747bb>] smp_apic_timer_interrupt+0x7b/0xa0 arch/x86/kernel/apic/apic.c:926
 [<ffffffff83773710>] apic_timer_interrupt+0xa0/0xb0 arch/x86/entry/entry_64.S:737
 <EOI> 
 [<ffffffff8126955e>] vprintk_emit+0x55e/0x850 kernel/printk/printk.c:1832
 [<ffffffff81269878>] vprintk+0x28/0x30 kernel/printk/printk.c:1843
 [<ffffffff8126989d>] vprintk_default+0x1d/0x30 kernel/printk/printk.c:1844
 [<ffffffff8141a7bd>] printk+0xb7/0xe2 kernel/printk/printk.c:1922
 [<ffffffff8112d83e>] warn_slowpath_common+0x8e/0x140 kernel/panic.c:441
 [<ffffffff8112db39>] warn_slowpath_null+0x29/0x30 kernel/panic.c:492
 [<ffffffff8148ade2>] vmacache_find+0x222/0x290 mm/vmacache.c:100
 [<ffffffff814a8443>] find_vma+0x23/0x150 mm/mmap.c:2086
 [<ffffffff810dc633>] __do_page_fault+0x2c3/0xa00 arch/x86/mm/fault.c:1201
 [<ffffffff810dcd97>] do_page_fault+0x27/0x30 arch/x86/mm/fault.c:1308
 [<ffffffff83772f88>] page_fault+0x28/0x30 arch/x86/entry/entry_64.S:1033
Code: 46 e8 64 03 ed ff 48 83 c4 08 5b 41 5c 41 5d 41 5e 41 5f 5d c3 e8 50 03 ed ff 31 d2 48 c7 c6 e0 8d 8a 83 48 89 df e8 6f fe ff ff <0f> 0b e8 a8 dd 06 00 e9 21 ff ff ff 89 4d d4 e8 9b dd 06 00 8b 
RIP  [<ffffffff8148f8e1>] dump_page mm/debug.c:105 [inline]
RIP  [<ffffffff8148f8e1>] page_mapcount include/linux/mm.h:460 [inline]
RIP  [<ffffffff8148f8e1>] dump_page_badflags+0x191/0x250 mm/debug.c:85
 RSP <ffff8801db307d18>
---[ end trace 809acf0dc7448eb6 ]---