==================================================================
BUG: KASAN: stack-out-of-bounds in jhash2 include/linux/jhash.h:138 [inline]
BUG: KASAN: stack-out-of-bounds in __xfrm6_addr_hash net/xfrm/xfrm_hash.h:16 [inline]
BUG: KASAN: stack-out-of-bounds in __xfrm6_daddr_saddr_hash net/xfrm/xfrm_hash.h:29 [inline]
BUG: KASAN: stack-out-of-bounds in __xfrm_dst_hash net/xfrm/xfrm_hash.h:95 [inline]
BUG: KASAN: stack-out-of-bounds in xfrm_dst_hash net/xfrm/xfrm_state.c:63 [inline]
BUG: KASAN: stack-out-of-bounds in xfrm_state_find+0x2f9a/0x3510 net/xfrm/xfrm_state.c:1092
Read of size 4 at addr ffffc90006a8f978 by task syz-fuzzer/792

CPU: 0 PID: 792 Comm: syz-fuzzer Not tainted 5.15.78-syzkaller-00911-gc73b4619ad86 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/26/2022
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x151/0x1b7 lib/dump_stack.c:106
 print_address_description+0x87/0x3d0 mm/kasan/report.c:256
 __kasan_report mm/kasan/report.c:435 [inline]
 kasan_report+0x1a6/0x1f0 mm/kasan/report.c:452
 __asan_report_load4_noabort+0x14/0x20 mm/kasan/report_generic.c:308
 jhash2 include/linux/jhash.h:138 [inline]
 __xfrm6_addr_hash net/xfrm/xfrm_hash.h:16 [inline]
 __xfrm6_daddr_saddr_hash net/xfrm/xfrm_hash.h:29 [inline]
 __xfrm_dst_hash net/xfrm/xfrm_hash.h:95 [inline]
 xfrm_dst_hash net/xfrm/xfrm_state.c:63 [inline]
 xfrm_state_find+0x2f9a/0x3510 net/xfrm/xfrm_state.c:1092
 xfrm_tmpl_resolve_one net/xfrm/xfrm_policy.c:2393 [inline]
 xfrm_tmpl_resolve net/xfrm/xfrm_policy.c:2438 [inline]
 xfrm_resolve_and_create_bundle+0x66d/0x2c80 net/xfrm/xfrm_policy.c:2731
 xfrm_bundle_lookup net/xfrm/xfrm_policy.c:2966 [inline]
 xfrm_lookup_with_ifid+0xa1c/0x2640 net/xfrm/xfrm_policy.c:3097
 xfrm_lookup net/xfrm/xfrm_policy.c:3194 [inline]
 xfrm_lookup_route+0x3b/0x160 net/xfrm/xfrm_policy.c:3205
 ip_route_output_flow+0x1e7/0x310 net/ipv4/route.c:2889
 ip_route_output_ports include/net/route.h:169 [inline]
 igmpv3_newpack+0x413/0x1080 net/ipv4/igmp.c:369
 add_grhead+0x84/0x320 net/ipv4/igmp.c:440
 add_grec+0x12f8/0x1600 net/ipv4/igmp.c:574
 igmpv3_send_cr net/ipv4/igmp.c:711 [inline]
 igmp_ifc_timer_expire+0x8b0/0xf90 net/ipv4/igmp.c:810
 call_timer_fn+0x35/0x270 kernel/time/timer.c:1427
 expire_timers+0x21b/0x3a0 kernel/time/timer.c:1472
 __run_timers+0x598/0x6f0 kernel/time/timer.c:1743
 run_timer_softirq+0x69/0xf0 kernel/time/timer.c:1756
 __do_softirq+0x27e/0x5dc kernel/softirq.c:565
 invoke_softirq+0xb/0x50 kernel/softirq.c:425
 __irq_exit_rcu+0x4f/0xb0 kernel/softirq.c:647
 irq_exit_rcu+0x9/0x10 kernel/softirq.c:659
 sysvec_apic_timer_interrupt+0x49/0xc0 arch/x86/kernel/apic/apic.c:1097
 asm_sysvec_apic_timer_interrupt+0x1b/0x20 arch/x86/include/asm/idtentry.h:638
RIP: 0033:0x4f01ac
Code: 48 89 d9 48 8d 05 34 f9 48 00 e8 8f b8 f5 ff 48 89 44 24 30 31 c9 eb 1e 48 8b 54 24 30 48 8b 34 c2 48 8b 7c 24 18 48 89 34 fa <48> 89 3c c2 48 89 d0 48 8b 4c 24 20 48 8b 5c 24 50 0f 1f 00 48 39
RSP: 002b:000000c0014fa750 EFLAGS: 00000297
RAX: 00000000000006b2 RBX: 33dc1ce242f0b09e RCX: 0000000000014943
RDX: 000000c042964000 RSI: 0000000000002495 RDI: 000000000000347b
RBP: 000000c0014fa788 R08: 0000000000000020 R09: 0000000000000000
R10: 000000000000002a R11: 0000000000000001 R12: 349ce4a363801ce9
R13: 0000000000000000 R14: 000000c0349e84e0 R15: 0000000000000000
 </TASK>


addr ffffc90006a8f978 is located in stack of task syz-fuzzer/792 at offset 88 in frame:
 igmpv3_newpack+0x0/0x1080

this frame has 1 object:
 [32, 88) 'fl4'

Memory state around the buggy address:
 ffffc90006a8f800: 00 00 00 00 00 00 f3 f3 f3 f3 f3 f3 00 00 00 00
 ffffc90006a8f880: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffffc90006a8f900: 00 00 00 00 f1 f1 f1 f1 00 00 00 00 00 00 00 f3
                                                                ^
 ffffc90006a8f980: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
 ffffc90006a8fa00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================