==================================================================
BUG: KASAN: slab-out-of-bounds in string+0x1e8/0x200 lib/vsprintf.c:592
Read of size 1 at addr ffff8801c6848710 by task syz-executor6/18008

CPU: 1 PID: 18008 Comm: syz-executor6 Not tainted 4.9.78-ge9dabe6 #28
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801d14775d0 ffffffff81d943a9 ffffea00071a1200 ffff8801c6848710
 0000000000000000 ffff8801c6848710 ffff8801d147782c ffff8801d1477608
 ffffffff8153dc23 ffff8801c6848710 0000000000000001 0000000000000000
Call Trace:
 [<ffffffff81d943a9>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d943a9>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff8153dc23>] print_address_description+0x73/0x280 mm/kasan/report.c:252
 [<ffffffff8153e145>] kasan_report_error mm/kasan/report.c:351 [inline]
 [<ffffffff8153e145>] kasan_report+0x275/0x360 mm/kasan/report.c:408
 [<ffffffff8153e244>] __asan_report_load1_noabort+0x14/0x20 mm/kasan/report.c:426
 [<ffffffff81db6388>] string+0x1e8/0x200 lib/vsprintf.c:592
 [<ffffffff81dbf31d>] vsnprintf+0x7ad/0x16d0 lib/vsprintf.c:2044
 [<ffffffff8117a65f>] __request_module+0x14f/0x750 kernel/kmod.c:146
 [<ffffffff8313beeb>] xt_request_find_target+0x8b/0xb0 net/netfilter/x_tables.c:256
 [<ffffffff83385548>] check_compat_entry_size_and_hooks net/ipv4/netfilter/ip_tables.c:1342 [inline]
 [<ffffffff83385548>] translate_compat_table+0x568/0x1760 net/ipv4/netfilter/ip_tables.c:1431
 [<ffffffff810002b8>] ? 0xffffffff810002b8
 [<ffffffff833868e7>] compat_do_replace.isra.15+0x1a7/0x3a0 net/ipv4/netfilter/ip_tables.c:1534
 [<ffffffff83386be6>] compat_do_ipt_set_ctl+0x106/0x150 net/ipv4/netfilter/ip_tables.c:1563
 [<ffffffff830a1b48>] compat_nf_sockopt net/netfilter/nf_sockopt.c:143 [inline]
 [<ffffffff830a1b48>] compat_nf_setsockopt+0x88/0x130 net/netfilter/nf_sockopt.c:155
 [<ffffffff83211c2d>] compat_ip_setsockopt+0x9d/0xf0 net/ipv4/ip_sockglue.c:1277
 [<ffffffff8321b165>] inet_csk_compat_setsockopt+0x95/0x120 net/ipv4/inet_connection_sock.c:914
 [<ffffffff8323153d>] compat_tcp_setsockopt+0x3d/0x70 net/ipv4/tcp.c:2748
 [<ffffffff82ede362>] compat_sock_common_setsockopt+0xb2/0x140 net/core/sock.c:2717
 [<ffffffff82fdd9f9>] C_SYSC_setsockopt net/compat.c:398 [inline]
 [<ffffffff82fdd9f9>] compat_SyS_setsockopt+0x149/0x290 net/compat.c:381
 [<ffffffff81006fc7>] do_syscall_32_irqs_on arch/x86/entry/common.c:322 [inline]
 [<ffffffff81006fc7>] do_fast_syscall_32+0x2f7/0x890 arch/x86/entry/common.c:384
 [<ffffffff838b4534>] entry_SYSENTER_compat+0x74/0x83 arch/x86/entry/entry_64_compat.S:127

Allocated by task 18008:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack+0x43/0xd0 mm/kasan/kasan.c:505
 set_track mm/kasan/kasan.c:517 [inline]
 kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:609
 __kmalloc+0x11d/0x310 mm/slub.c:3741
 kmalloc include/linux/slab.h:495 [inline]
 xt_alloc_table_info+0x71/0x100 net/netfilter/x_tables.c:959
 compat_do_replace.isra.15+0x116/0x3a0 net/ipv4/netfilter/ip_tables.c:1523
 compat_do_ipt_set_ctl+0x106/0x150 net/ipv4/netfilter/ip_tables.c:1563
 compat_nf_sockopt net/netfilter/nf_sockopt.c:143 [inline]
 compat_nf_setsockopt+0x88/0x130 net/netfilter/nf_sockopt.c:155
 compat_ip_setsockopt+0x9d/0xf0 net/ipv4/ip_sockglue.c:1277
 inet_csk_compat_setsockopt+0x95/0x120 net/ipv4/inet_connection_sock.c:914
 compat_tcp_setsockopt+0x3d/0x70 net/ipv4/tcp.c:2748
 compat_sock_common_setsockopt+0xb2/0x140 net/core/sock.c:2717
 C_SYSC_setsockopt net/compat.c:398 [inline]
 compat_SyS_setsockopt+0x149/0x290 net/compat.c:381
 do_syscall_32_irqs_on arch/x86/entry/common.c:322 [inline]
 do_fast_syscall_32+0x2f7/0x890 arch/x86/entry/common.c:384
 entry_SYSENTER_compat+0x74/0x83 arch/x86/entry/entry_64_compat.S:127

Freed by task 0:
(stack is not available)

The buggy address belongs to the object at ffff8801c6848640
 which belongs to the cache kmalloc-256 of size 256
The buggy address is located 208 bytes inside of
 256-byte region [ffff8801c6848640, ffff8801c6848740)
The buggy address belongs to the page:
page:ffffea00071a1200 count:1 mapcount:0 mapping:          (null) index:0x0
flags: 0x8000000000000080(slab)
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801c6848600: fc fc fc fc fc fc fc fc 00 00 00 00 00 00 00 00
 ffff8801c6848680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8801c6848700: 00 00 fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                         ^
 ffff8801c6848780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8801c6848800: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================