==================================================================
BUG: KASAN: slab-out-of-bounds in ipvlan_queue_xmit+0xd56/0x19c0
Read of size 4 at addr ffff88807afa97ff by task syz-executor.3/3713

CPU: 1 PID: 3713 Comm: syz-executor.3 Not tainted 6.0.0-rc4-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/27/2024
Call Trace:
 <TASK>
 dump_stack_lvl+0x91/0xb9
 print_report.cold+0x2c3/0x752
 kasan_report+0xb1/0x1d0
 ipvlan_queue_xmit+0xd56/0x19c0
 ipvlan_start_xmit+0x45/0x150
 __dev_direct_xmit+0x4fd/0x730
 packet_direct_xmit+0x1b2/0x2b0
 packet_sendmsg+0x221d/0x5820
 sock_sendmsg+0xc9/0x120
 __sys_sendto+0x1fd/0x2e0
 __x64_sys_sendto+0xdc/0x1b0
 do_syscall_64+0x34/0x80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd
RIP: 0033:0x7f9e4907df69
Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 e1 20 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f9e483dd0c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f9e491ac050 RCX: 00007f9e4907df69
RDX: 000000000000000e RSI: 0000000020000000 RDI: 0000000000000004
RBP: 00007f9e490ca4a4 R08: 0000000000000000 R09: ffffffffffffff09
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 000000000000006e R14: 00007f9e491ac050 R15: 00007ffc0b4b0678
 </TASK>

Allocated by task 3199:
 kasan_save_stack+0x1c/0x40
 __kasan_kmalloc+0x84/0xb0
 tomoyo_init_log+0x1332/0x1ff0
 tomoyo_supervisor+0x319/0xee0
 tomoyo_path_permission+0x270/0x3b0
 tomoyo_path_perm+0x2f4/0x3d0
 security_inode_getattr+0xed/0x150
 vfs_statx+0x164/0x390
 vfs_fstatat+0x8c/0xb0
 __do_sys_newfstatat+0x8d/0x110
 do_syscall_64+0x34/0x80
 entry_SYSCALL_64_after_hwframe+0x63/0xcd

The buggy address belongs to the object at ffff88807afa9400
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 511 bytes to the right of
 512-byte region [ffff88807afa9400, ffff88807afa9600)

The buggy address belongs to the physical page:
page:000000007ee14c7a refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff88807afaa400 pfn:0x7afa8
head:000000007ee14c7a order:2 compound_mapcount:0 compound_pincount:0
flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000010200 ffffea000060c908 ffffea0000842d08 ffff888010c41c80
raw: ffff88807afaa400 0000000000100001 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88807afa9680: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88807afa9700: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88807afa9780: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                                                                ^
 ffff88807afa9800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88807afa9880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================
