==================================================================
BUG: KASAN: slab-out-of-bounds in ip_check_mc_rcu+0x4da/0x640 net/ipv4/igmp.c:2716
Read of size 4 at addr ffff88802235a698 by task syz-executor.4/17308

CPU: 1 PID: 17308 Comm: syz-executor.4 Not tainted 5.13.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0x202/0x31e lib/dump_stack.c:120
 print_address_description+0x5f/0x3b0 mm/kasan/report.c:233
 __kasan_report mm/kasan/report.c:419 [inline]
 kasan_report+0x15c/0x200 mm/kasan/report.c:436
 ip_check_mc_rcu+0x4da/0x640 net/ipv4/igmp.c:2716
 __mkroute_output net/ipv4/route.c:2387 [inline]
 ip_route_output_key_hash_rcu+0xf4f/0x25c0 net/ipv4/route.c:2666
 ip_route_output_key_hash+0x1b7/0x300 net/ipv4/route.c:2494
 __ip_route_output_key include/net/route.h:126 [inline]
 ip_route_output_flow+0x25/0x130 net/ipv4/route.c:2726
 udp_sendmsg+0x1cec/0x3250 net/ipv4/udp.c:1206
 sock_sendmsg_nosec net/socket.c:654 [inline]
 sock_sendmsg net/socket.c:674 [inline]
 ____sys_sendmsg+0x5a2/0x900 net/socket.c:2350
 ___sys_sendmsg net/socket.c:2404 [inline]
 __sys_sendmmsg+0x500/0x790 net/socket.c:2490
 __do_sys_sendmmsg net/socket.c:2519 [inline]
 __se_sys_sendmmsg net/socket.c:2516 [inline]
 __x64_sys_sendmmsg+0x9c/0xb0 net/socket.c:2516
 do_syscall_64+0x3f/0xb0 arch/x86/entry/common.c:47
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x4665d9
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fd97686e188 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 000000000056bf80 RCX: 00000000004665d9
RDX: 000000000800001d RSI: 0000000020007fc0 RDI: 0000000000000005
RBP: 00000000004bfcb9 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056bf80
R13: 00007ffcf2c2583f R14: 00007fd97686e300 R15: 0000000000022000

Allocated by task 9715:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:46 [inline]
 set_alloc_info mm/kasan/common.c:428 [inline]
 ____kasan_kmalloc+0xc4/0xf0 mm/kasan/common.c:507
 kasan_kmalloc include/linux/kasan.h:246 [inline]
 __kmalloc+0xb4/0x390 mm/slub.c:4058
 kmalloc include/linux/slab.h:561 [inline]
 kzalloc include/linux/slab.h:686 [inline]
 xt_jumpstack_alloc net/netfilter/x_tables.c:1325 [inline]
 xt_replace_table+0x8e/0x710 net/netfilter/x_tables.c:1384
 __do_replace+0x188/0xab0 net/ipv6/netfilter/ip6_tables.c:1083
 do_replace net/ipv4/netfilter/ip_tables.c:1139 [inline]
 do_ipt_set_ctl+0x2bb5/0x3d90 net/ipv4/netfilter/ip_tables.c:1629
 nf_setsockopt+0x29f/0x2d0 net/netfilter/nf_sockopt.c:101
 ip_setsockopt+0x297a/0x5490 net/ipv4/ip_sockglue.c:1435
 __sys_setsockopt+0x552/0x990 net/socket.c:2117
 __do_sys_setsockopt net/socket.c:2128 [inline]
 __se_sys_setsockopt net/socket.c:2125 [inline]
 __x64_sys_setsockopt+0xb1/0xc0 net/socket.c:2125
 do_syscall_64+0x3f/0xb0 arch/x86/entry/common.c:47
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Freed by task 17305:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track+0x3d/0x70 mm/kasan/common.c:46
 kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:357
 ____kasan_slab_free+0x109/0x150 mm/kasan/common.c:360
 kasan_slab_free include/linux/kasan.h:212 [inline]
 slab_free_hook mm/slub.c:1581 [inline]
 slab_free_freelist_hook+0x1d8/0x290 mm/slub.c:1606
 slab_free mm/slub.c:3166 [inline]
 kfree+0xcf/0x2d0 mm/slub.c:4216
 free_vfsmnt fs/namespace.c:565 [inline]
 delayed_free_vfsmnt+0xd3/0x130 fs/namespace.c:574
 rcu_do_batch kernel/rcu/tree.c:2558 [inline]
 rcu_core+0x906/0x14b0 kernel/rcu/tree.c:2793
 __do_softirq+0x372/0x7a6 kernel/softirq.c:559

The buggy address belongs to the object at ffff88802235a680
 which belongs to the cache kmalloc-16 of size 16
The buggy address is located 8 bytes to the right of
 16-byte region [ffff88802235a680, ffff88802235a690)
The buggy address belongs to the page:
page:ffffea000088d680 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2235a
flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000200 ffffea000057ffc0 0000000200000002 ffff8880118413c0
raw: 0000000000000000 0000000000800080 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12c40(GFP_NOFS|__GFP_NOWARN|__GFP_NORETRY), pid 1, ts 45280855207, free_ts 45242263894
 prep_new_page mm/page_alloc.c:2358 [inline]
 get_page_from_freelist+0x779/0xa20 mm/page_alloc.c:3994
 __alloc_pages+0x26c/0x5f0 mm/page_alloc.c:5200
 alloc_slab_page mm/slub.c:1644 [inline]
 allocate_slab+0xf1/0x5b0 mm/slub.c:1784
 new_slab mm/slub.c:1847 [inline]
 new_slab_objects mm/slub.c:2593 [inline]
 ___slab_alloc+0x1cf/0x350 mm/slub.c:2756
 __slab_alloc mm/slub.c:2796 [inline]
 slab_alloc_node mm/slub.c:2878 [inline]
 slab_alloc mm/slub.c:2920 [inline]
 __kmalloc+0x2ed/0x390 mm/slub.c:4054
 kmalloc include/linux/slab.h:561 [inline]
 kzalloc include/linux/slab.h:686 [inline]
 tomoyo_encode2+0x25a/0x560 security/tomoyo/realpath.c:45
 tomoyo_encode security/tomoyo/realpath.c:80 [inline]
 tomoyo_realpath_from_path+0x5c3/0x610 security/tomoyo/realpath.c:288
 tomoyo_get_realpath security/tomoyo/file.c:151 [inline]
 tomoyo_path_perm+0x201/0x650 security/tomoyo/file.c:822
 security_inode_getattr+0xc0/0x140 security/security.c:1332
 vfs_getattr fs/stat.c:139 [inline]
 vfs_statx+0x188/0x3d0 fs/stat.c:207
 vfs_fstatat fs/stat.c:225 [inline]
 vfs_lstat include/linux/fs.h:3384 [inline]
 __do_sys_newlstat fs/stat.c:380 [inline]
 __se_sys_newlstat fs/stat.c:374 [inline]
 __x64_sys_newlstat+0xd3/0x150 fs/stat.c:374
 do_syscall_64+0x3f/0xb0 arch/x86/entry/common.c:47
 entry_SYSCALL_64_after_hwframe+0x44/0xae
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1298 [inline]
 free_pcp_prepare+0x3ea/0x420 mm/page_alloc.c:1342
 free_unref_page_prepare mm/page_alloc.c:3250 [inline]
 free_unref_page+0x7b/0x280 mm/page_alloc.c:3298
 free_slab mm/slub.c:1887 [inline]
 discard_slab mm/slub.c:1893 [inline]
 __slab_free+0x5c0/0x6b0 mm/slub.c:3096
 do_slab_free mm/slub.c:3154 [inline]
 ___cache_free+0xfc/0x120 mm/slub.c:3173
 qlist_free_all mm/kasan/quarantine.c:165 [inline]
 kasan_quarantine_reduce+0x151/0x1c0 mm/kasan/quarantine.c:272
 __kasan_slab_alloc+0x2f/0xd0 mm/kasan/common.c:438
 kasan_slab_alloc include/linux/kasan.h:236 [inline]
 slab_post_alloc_hook mm/slab.h:524 [inline]
 slab_alloc_node mm/slub.c:2912 [inline]
 slab_alloc mm/slub.c:2920 [inline]
 kmem_cache_alloc+0x1d7/0x340 mm/slub.c:2925
 getname_flags+0xba/0x640 fs/namei.c:138
 user_path_at_empty+0x28/0x50 fs/namei.c:2734
 user_path_at include/linux/namei.h:60 [inline]
 vfs_statx+0x102/0x3d0 fs/stat.c:203
 vfs_fstatat fs/stat.c:225 [inline]
 vfs_lstat include/linux/fs.h:3384 [inline]
 __do_sys_newlstat fs/stat.c:380 [inline]
 __se_sys_newlstat fs/stat.c:374 [inline]
 __x64_sys_newlstat+0xd3/0x150 fs/stat.c:374
 do_syscall_64+0x3f/0xb0 arch/x86/entry/common.c:47
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Memory state around the buggy address:
 ffff88802235a580: fa fb fc fc fa fb fc fc fa fb fc fc fa fb fc fc
 ffff88802235a600: fa fb fc fc 00 00 fc fc 00 00 fc fc fa fb fc fc
>ffff88802235a680: fa fb fc fc fa fb fc fc 00 04 fc fc fa fb fc fc
                            ^
 ffff88802235a700: fa fb fc fc fa fb fc fc 00 00 fc fc 00 00 fc fc
 ffff88802235a780: 00 00 fc fc 00 00 fc fc fa fb fc fc 00 00 fc fc
==================================================================