==================================================================
BUG: KASAN: use-after-free in ip_check_mc_rcu+0x513/0x568 net/ipv4/igmp.c:2725
Read of size 8 at addr ffff8880a3b45c00 by task syz-executor101/26716

CPU: 0 PID: 26716 Comm: syz-executor101 Not tainted 5.4.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x96/0xe0 lib/dump_stack.c:118
 print_address_description.constprop.4.cold.6+0x9/0x373 mm/kasan/report.c:374
 __kasan_report.cold.7+0x7a/0x95 mm/kasan/report.c:506
 kasan_report+0xe/0x20 mm/kasan/common.c:634
 ip_check_mc_rcu+0x513/0x568 net/ipv4/igmp.c:2725
 __mkroute_output net/ipv4/route.c:2350 [inline]
 ip_route_output_key_hash_rcu+0x1834/0x2730 net/ipv4/route.c:2632
 ip_route_output_key_hash+0x19e/0x2b0 net/ipv4/route.c:2458
 __ip_route_output_key include/net/route.h:126 [inline]
 ip_route_output_flow+0x18/0x90 net/ipv4/route.c:2720
 udp_sendmsg+0x14a7/0x2190 net/ipv4/udp.c:1144
 sock_sendmsg_nosec net/socket.c:637 [inline]
 sock_sendmsg+0xac/0xf0 net/socket.c:657
 ___sys_sendmsg+0x28e/0x950 net/socket.c:2311
 __sys_sendmmsg+0x142/0x330 net/socket.c:2413
 __do_sys_sendmmsg net/socket.c:2442 [inline]
 __se_sys_sendmmsg net/socket.c:2439 [inline]
 __x64_sys_sendmmsg+0x94/0x100 net/socket.c:2439
 do_syscall_64+0x8e/0x4e0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x448f49
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 a1 15 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ff4ecc3d318 EFLAGS: 00000246 ORIG_RAX: 0000000000000133
RAX: ffffffffffffffda RBX: 00000000004ce4e8 RCX: 0000000000448f49
RDX: 000000000800001d RSI: 0000000020007fc0 RDI: 0000000000000003
RBP: 00000000004ce4e0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000049d474
R13: 00007ffd5aa1b07f R14: 00007ff4ecc3d400 R15: 0000000000022000

Allocated by task 26716:
 save_stack+0x19/0x80 mm/kasan/common.c:69
 set_track mm/kasan/common.c:77 [inline]
 __kasan_kmalloc mm/kasan/common.c:510 [inline]
 __kasan_kmalloc.constprop.11+0xc1/0xd0 mm/kasan/common.c:483
 kmalloc include/linux/slab.h:556 [inline]
 kzalloc include/linux/slab.h:690 [inline]
 ip_mc_add1_src net/ipv4/igmp.c:1973 [inline]
 ip_mc_add_src+0x7cb/0xc60 net/ipv4/igmp.c:2097
 ip_mc_source+0x716/0xdc0 net/ipv4/igmp.c:2418
 do_ip_setsockopt.isra.2+0x1d30/0x2a80 net/ipv4/ip_sockglue.c:998
 ip_setsockopt+0x22/0x70 net/ipv4/ip_sockglue.c:1248
 __sys_setsockopt+0x228/0x430 net/socket.c:2084
 __do_sys_setsockopt net/socket.c:2100 [inline]
 __se_sys_setsockopt net/socket.c:2097 [inline]
 __x64_sys_setsockopt+0xb5/0x150 net/socket.c:2097
 do_syscall_64+0x8e/0x4e0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

Freed by task 26715:
 save_stack+0x19/0x80 mm/kasan/common.c:69
 set_track mm/kasan/common.c:77 [inline]
 kasan_set_free_info mm/kasan/common.c:332 [inline]
 __kasan_slab_free+0x124/0x170 mm/kasan/common.c:471
 slab_free_hook mm/slub.c:1424 [inline]
 slab_free_freelist_hook+0x53/0x140 mm/slub.c:1457
 slab_free mm/slub.c:3004 [inline]
 kfree+0xd6/0x3b0 mm/slub.c:3956
 ip_mc_del1_src+0x53d/0x720 net/ipv4/igmp.c:1886
 ip_mc_del_src+0x363/0x7e0 net/ipv4/igmp.c:1927
 ip_mc_leave_src+0xd8/0x210 net/ipv4/igmp.c:2233
 ip_mc_drop_socket+0x105/0x220 net/ipv4/igmp.c:2687
 inet_release+0x45/0x1b0 net/ipv4/af_inet.c:414
 __sock_release+0xbb/0x270 net/socket.c:590
 sock_close+0xf/0x20 net/socket.c:1268
 __fput+0x256/0x790 fs/file_table.c:280
 task_work_run+0xd3/0x180 kernel/task_work.c:113
 tracehook_notify_resume include/linux/tracehook.h:188 [inline]
 exit_to_usermode_loop+0x15d/0x200 arch/x86/entry/common.c:163
 prepare_exit_to_usermode arch/x86/entry/common.c:194 [inline]
 syscall_return_slowpath arch/x86/entry/common.c:274 [inline]
 do_syscall_64+0x42f/0x4e0 arch/x86/entry/common.c:300
 entry_SYSCALL_64_after_hwframe+0x49/0xbe

The buggy address belongs to the object at ffff8880a3b45c00
 which belongs to the cache kmalloc-32 of size 32
The buggy address is located 0 bytes inside of
 32-byte region [ffff8880a3b45c00, ffff8880a3b45c20)
The buggy address belongs to the page:
page:ffffea00028ed140 refcount:1 mapcount:0 mapping:ffff8880b5803400 index:0x0
raw: 00fff00000000200 ffffea0002cac7c0 0000001400000014 ffff8880b5803400
raw: 0000000000000000 0000000080400040 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8880a3b45b00: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
 ffff8880a3b45b80: 00 00 00 00 fc fc fc fc fb fb fb fb fc fc fc fc
>ffff8880a3b45c00: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
                   ^
 ffff8880a3b45c80: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
 ffff8880a3b45d00: fb fb fb fb fc fc fc fc fb fb fb fb fc fc fc fc
==================================================================