==================================================================
BUG: KASAN: slab-out-of-bounds in ip_icmp_error+0x52a/0x5a0 net/ipv4/ip_sockglue.c:404
Read of size 1 at addr ffff8880915317ff by task ksoftirqd/0/9

CPU: 0 PID: 9 Comm: ksoftirqd/0 Not tainted 5.7.0-rc6-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x188/0x20d lib/dump_stack.c:118
 print_address_description.constprop.0.cold+0xd3/0x413 mm/kasan/report.c:382
 __kasan_report.cold+0x20/0x38 mm/kasan/report.c:511
 kasan_report+0x33/0x50 mm/kasan/common.c:625
 ip_icmp_error+0x52a/0x5a0 net/ipv4/ip_sockglue.c:404
 tcp_v4_err+0x9b2/0x1d00 net/ipv4/tcp_ipv4.c:576
 icmp_socket_deliver+0x1e4/0x360 net/ipv4/icmp.c:803
 icmp_unreach+0x33b/0xab0 net/ipv4/icmp.c:920
 icmp_rcv+0xee6/0x15f0 net/ipv4/icmp.c:1102
 ip_protocol_deliver_rcu+0x57/0x880 net/ipv4/ip_input.c:204
 ip_local_deliver_finish+0x220/0x360 net/ipv4/ip_input.c:231
 NF_HOOK include/linux/netfilter.h:307 [inline]
 NF_HOOK include/linux/netfilter.h:301 [inline]
 ip_local_deliver+0x1c8/0x4e0 net/ipv4/ip_input.c:252
 dst_input include/net/dst.h:441 [inline]
 ip_rcv_finish+0x1da/0x2f0 net/ipv4/ip_input.c:428
 NF_HOOK include/linux/netfilter.h:307 [inline]
 NF_HOOK include/linux/netfilter.h:301 [inline]
 ip_rcv+0xd0/0x3c0 net/ipv4/ip_input.c:539
 __netif_receive_skb_one_core+0x114/0x180 net/core/dev.c:5268
 __netif_receive_skb+0x27/0x1c0 net/core/dev.c:5382
 process_backlog+0x21e/0x7a0 net/core/dev.c:6214
 napi_poll net/core/dev.c:6659 [inline]
 net_rx_action+0x4c2/0x1070 net/core/dev.c:6727
 __do_softirq+0x26c/0x9f7 kernel/softirq.c:292
 run_ksoftirqd kernel/softirq.c:604 [inline]
 run_ksoftirqd+0x89/0x100 kernel/softirq.c:596
 smpboot_thread_fn+0x653/0x9e0 kernel/smpboot.c:165
 kthread+0x388/0x470 kernel/kthread.c:268
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:351

Allocated by task 7138:
 save_stack+0x1b/0x40 mm/kasan/common.c:49
 set_track mm/kasan/common.c:57 [inline]
 __kasan_kmalloc mm/kasan/common.c:495 [inline]
 __kasan_kmalloc.constprop.0+0xbf/0xd0 mm/kasan/common.c:468
 slab_post_alloc_hook mm/slab.h:586 [inline]
 slab_alloc mm/slab.c:3320 [inline]
 kmem_cache_alloc+0x11b/0x740 mm/slab.c:3484
 kmem_cache_zalloc include/linux/slab.h:659 [inline]
 __alloc_file+0x21/0x350 fs/file_table.c:101
 alloc_empty_file+0x6d/0x170 fs/file_table.c:151
 path_openat+0xe3/0x27d0 fs/namei.c:3332
 do_filp_open+0x192/0x260 fs/namei.c:3373
 do_sys_openat2+0x585/0x7d0 fs/open.c:1148
 do_sys_open+0xc3/0x140 fs/open.c:1164
 do_syscall_64+0xf6/0x7d0 arch/x86/entry/common.c:295
 entry_SYSCALL_64_after_hwframe+0x49/0xb3

Freed by task 7184:
 save_stack+0x1b/0x40 mm/kasan/common.c:49
 set_track mm/kasan/common.c:57 [inline]
 kasan_set_free_info mm/kasan/common.c:317 [inline]
 __kasan_slab_free+0xf7/0x140 mm/kasan/common.c:456
 __cache_free mm/slab.c:3426 [inline]
 kmem_cache_free+0x7f/0x320 mm/slab.c:3694
 rcu_do_batch kernel/rcu/tree.c:2206 [inline]
 rcu_core+0x59f/0x1370 kernel/rcu/tree.c:2433
 __do_softirq+0x26c/0x9f7 kernel/softirq.c:292

The buggy address belongs to the object at ffff8880915315c0
 which belongs to the cache filp of size 488
The buggy address is located 87 bytes to the right of
 488-byte region [ffff8880915315c0, ffff8880915317a8)
The buggy address belongs to the page:
page:ffffea0002454c40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0
flags: 0xfffe0000000200(slab)
raw: 00fffe0000000200 ffffea00027bdd88 ffffea00027a6708 ffff88821bc50700
raw: 0000000000000000 ffff8880915310c0 0000000100000006 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff888091531680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888091531700: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888091531780: fb fb fb fb fb fc fc fc fc fc fc fc fc fc fc fc
                                                                ^
 ffff888091531800: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
 ffff888091531880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================