xt_hashlimit: overflow, try lower: 0/0
==================================================================
BUG: KASAN: global-out-of-bounds in record_print_text+0x309/0x330 kernel/printk/printk.c:1401
Write of size 1 at addr ffffffff8f59edee by task syz-executor.2/10854

CPU: 0 PID: 10854 Comm: syz-executor.2 Not tainted 5.11.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x137/0x1be lib/dump_stack.c:120
 print_address_description+0x5f/0x3a0 mm/kasan/report.c:230
 __kasan_report mm/kasan/report.c:396 [inline]
 kasan_report+0x15e/0x200 mm/kasan/report.c:413
 record_print_text+0x309/0x330 kernel/printk/printk.c:1401
 console_unlock+0x683/0xcf0 kernel/printk/printk.c:2555
 vprintk_emit+0x15e/0x200 kernel/printk/printk.c:2092
 printk+0x62/0x83 kernel/printk/printk.c:2140
 hashlimit_mt_check_common+0xf89/0x12f0 net/netfilter/xt_hashlimit.c:890
 hashlimit_mt_check_v1+0x279/0x460 net/netfilter/xt_hashlimit.c:924
 xt_check_match+0x2f3/0xc60 net/netfilter/x_tables.c:501
 check_match net/ipv4/netfilter/ip_tables.c:472 [inline]
 find_check_match net/ipv4/netfilter/ip_tables.c:488 [inline]
 find_check_entry net/ipv4/netfilter/ip_tables.c:538 [inline]
 translate_table+0x13b3/0x20d0 net/ipv4/netfilter/ip_tables.c:717
 do_replace net/ipv4/netfilter/ip_tables.c:1135 [inline]
 do_ipt_set_ctl+0x25c7/0x3470 net/ipv4/netfilter/ip_tables.c:1627
 nf_setsockopt+0x29f/0x2d0 net/netfilter/nf_sockopt.c:101
 ip_setsockopt+0x1e99/0x4d30 net/ipv4/ip_sockglue.c:1435
 ipv6_setsockopt+0x198/0x5520 net/ipv6/ipv6_sockglue.c:998
 __sys_setsockopt+0x4b8/0x880 net/socket.c:2115
 __do_sys_setsockopt net/socket.c:2126 [inline]
 __se_sys_setsockopt net/socket.c:2123 [inline]
 __x64_sys_setsockopt+0xb1/0xc0 net/socket.c:2123
 do_syscall_64+0x2d/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x45e219
Code: 0d b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 db b3 fb ff c3 66 2e 0f 1f 84 00 00 00 00
RSP: 002b:00007f189ccb5c68 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000045e219
RDX: 0000000000000040 RSI: 0004000000000000 RDI: 0000000000000004
RBP: 000000000119bfd0 R08: 0000000000000270 R09: 0000000000000000
R10: 0000000020000100 R11: 0000000000000246 R12: 000000000119bf8c
R13: 00007ffff086c14f R14: 00007f189ccb69c0 R15: 000000000119bf8c

The buggy address belongs to the variable:
 console_waiter+0x2e/0x40

Memory state around the buggy address:
 ffffffff8f59ec80: 01 f9 f9 f9 f9 f9 f9 f9 01 f9 f9 f9 f9 f9 f9 f9
 ffffffff8f59ed00: 00 00 f9 f9 f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9
>ffffffff8f59ed80: 00 f9 f9 f9 f9 f9 f9 f9 01 f9 f9 f9 f9 f9 f9 f9
                                                          ^
 ffffffff8f59ee00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffffffff8f59ee80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================