KASAN: stack-out-of-bounds Read in strnlen

[syzbot]

Hello,

syzbot found the following crash on:

HEAD commit: 610c8356
git tree: android-4.4
console output: https://syzkaller.appspot.com/x/log.txt?x=13b71f11800000
kernel config: https://syzkaller.appspot.com/x/.config?x=44509e3077d6939
dashboard link: https://syzkaller.appspot.com/bug?extid=eb5a498710d12ff71b2d
compiler: gcc (GCC) 7.1.1 20170620
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=13de3091800000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=166eeb51800000

IMPORTANT: if you fix the bug, please add the following tag to the commit:
Reported-by: syzbot+eb5a49...@syzkaller.appspotmail.com

IPVS: set_ctl: invalid protocol: 45975 236.44.193.237:56990 ��
IPVS: set_ctl: invalid protocol: 45975 236.44.193.237:56990 ��
==================================================================
BUG: KASAN: stack-out-of-bounds in strnlen+0xc1/0xd0 lib/string.c:498
Read of size 1 at addr ffff8801d0877d04 by task syzkaller968690/3469

CPU: 0 PID: 3469 Comm: syzkaller968690 Not tainted 4.4.107-g610c835 #12
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS
Google 01/01/2011
0000000000000000 32c3afb9a0a8afa3 ffff8801d0877758 ffffffff81d0457d
ffffea0007421dc0 ffff8801d0877d04 0000000000000000 ffff8801d0877d04
ffffffff856b29c0 ffff8801d0877790 ffffffff814fbb23 ffff8801d0877d04
Call Trace:
[<ffffffff81d0457d>] __dump_stack lib/dump_stack.c:15 [inline]
[<ffffffff81d0457d>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
[<ffffffff814fbb23>] print_address_description+0x73/0x260
mm/kasan/report.c:252
[<ffffffff814fc035>] kasan_report_error mm/kasan/report.c:351 [inline]
[<ffffffff814fc035>] kasan_report+0x285/0x370 mm/kasan/report.c:408
[<ffffffff814fc134>] __asan_report_load1_noabort+0x14/0x20
mm/kasan/report.c:426
[<ffffffff81d1ff51>] strnlen+0xc1/0xd0 lib/string.c:498
[<ffffffff81d27bdc>] string.isra.4+0x4c/0x240 lib/vsprintf.c:518
[<ffffffff81d2d086>] vsnprintf+0x766/0x15f0 lib/vsprintf.c:1907
[<ffffffff81d2df3d>] vscnprintf+0x2d/0x60 lib/vsprintf.c:2010
[<ffffffff81266f8b>] vprintk_emit+0xdb/0x850 kernel/printk/printk.c:1729
[<ffffffff81267728>] vprintk+0x28/0x30 kernel/printk/printk.c:1843
[<ffffffff8126774d>] vprintk_default+0x1d/0x30 kernel/printk/printk.c:1844
[<ffffffff8141839d>] printk+0xb7/0xe2 kernel/printk/printk.c:1922
[<ffffffff830982e7>] do_ip_vs_set_ctl+0x9b7/0xba0
net/netfilter/ipvs/ip_vs_ctl.c:2398
[<ffffffff82f971a7>] nf_sockopt net/netfilter/nf_sockopt.c:105 [inline]
[<ffffffff82f971a7>] nf_setsockopt+0x67/0xc0 net/netfilter/nf_sockopt.c:114
[<ffffffff830fe561>] ip_setsockopt+0xa1/0xb0 net/ipv4/ip_sockglue.c:1226
[<ffffffff831a4395>] udp_setsockopt+0x45/0x80 net/ipv4/udp.c:2154
[<ffffffff82df2b55>] sock_common_setsockopt+0x95/0xd0 net/core/sock.c:2659
[<ffffffff82defc20>] SYSC_setsockopt net/socket.c:1767 [inline]
[<ffffffff82defc20>] SyS_setsockopt+0x160/0x250 net/socket.c:1746
[<ffffffff83773d36>] entry_SYSCALL_64_fastpath+0x16/0x76

The buggy address belongs to the page:
page:ffffea0007421dc0 count:0 mapcount:0 mapping: (null) index:0x0
flags: 0x8000000000000000()
page dumped because: kasan: bad access detected

Memory state around the buggy address:
ffff8801d0877c00: 00 00 00 00 00 04 f2 f2 f2 f2 f2 f2 00 00 00 00
ffff8801d0877c80: 00 00 00 00 f2 f2 f2 f2 00 00 00 00 00 00 00 00
> ffff8801d0877d00: 04 f2 f2 f2 00 00 00 00 00 00 00 00 00 00 00 00
^
ffff8801d0877d80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
ffff8801d0877e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================


---
This bug is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzk...@googlegroups.com.

syzbot will keep track of this bug report. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
syzbot can test patches for this bug, for details see:
https://goo.gl/tpsmEJ#testing-patches