syzbot

IPv4: Oversized IP packet from 127.0.0.1
IPv4: Oversized IP packet from 127.0.0.1
IPv4: Oversized IP packet from 127.0.0.1
IPv4: Oversized IP packet from 127.0.0.1
==================================================================
BUG: KASAN: use-after-free in __write_once_size include/linux/compiler.h:247 [inline]
BUG: KASAN: use-after-free in __hlist_del include/linux/list.h:619 [inline]
BUG: KASAN: use-after-free in hlist_del_rcu include/linux/rculist.h:342 [inline]
BUG: KASAN: use-after-free in nf_nat_cleanup_conntrack+0x1ec/0x210 net/netfilter/nf_nat_core.c:691
Write of size 8 at addr ffff8800ad887fe0 by task swapper/1/0

CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.4.138-gcf21a9a #64
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 0000000000000000 1026c8b0aa603825 ffff8801db307a38 ffffffff81e0ed0d
 ffffea0002b621c0 ffff8800ad887fe0 0000000000000001 ffff8800ad887fe0
 ffff8801da244000 ffff8801db307a70 ffffffff81515a16 ffff8800ad887fe0
Call Trace:
 <IRQ>  [<ffffffff81e0ed0d>] __dump_stack lib/dump_stack.c:15 [inline]
 <IRQ>  [<ffffffff81e0ed0d>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
 [<ffffffff81515a16>] print_address_description+0x6c/0x216 mm/kasan/report.c:252
 [<ffffffff81515d35>] kasan_report_error mm/kasan/report.c:351 [inline]
 [<ffffffff81515d35>] kasan_report.cold.7+0x175/0x2f7 mm/kasan/report.c:408
 [<ffffffff814f98c7>] __asan_report_store8_noabort+0x17/0x20 mm/kasan/report.c:434
 [<ffffffff8312dcec>] __write_once_size include/linux/compiler.h:247 [inline]
 [<ffffffff8312dcec>] __hlist_del include/linux/list.h:619 [inline]
 [<ffffffff8312dcec>] hlist_del_rcu include/linux/rculist.h:342 [inline]
 [<ffffffff8312dcec>] nf_nat_cleanup_conntrack+0x1ec/0x210 net/netfilter/nf_nat_core.c:691
 [<ffffffff830f9120>] __nf_ct_ext_destroy+0x140/0x2a0 net/netfilter/nf_conntrack_extend.c:40
 [<ffffffff830d6f37>] nf_ct_ext_destroy include/net/netfilter/nf_conntrack_extend.h:80 [inline]
 [<ffffffff830d6f37>] nf_conntrack_free+0x77/0x130 net/netfilter/nf_conntrack_core.c:904
 [<ffffffff830d975a>] destroy_conntrack+0x26a/0x380 net/netfilter/nf_conntrack_core.c:365
 [<ffffffff830c1f09>] nf_conntrack_destroy+0x99/0x1a0 net/netfilter/core.c:389
 [<ffffffff82f35438>] nf_conntrack_put include/linux/skbuff.h:3364 [inline]
 [<ffffffff82f35438>] skb_release_head_state+0x158/0x210 net/core/skbuff.c:649
 [<ffffffff82f372c5>] skb_release_all+0x15/0x60 net/core/skbuff.c:659
 [<ffffffff82f37325>] __kfree_skb+0x15/0x20 net/core/skbuff.c:675
 [<ffffffff82f37427>] kfree_skb+0xf7/0x3e0 net/core/skbuff.c:696
 [<ffffffff833374d2>] frag_kfree_skb net/ipv4/inet_fragment.c:294 [inline]
 [<ffffffff833374d2>] inet_frag_destroy+0x182/0x2e0 net/ipv4/inet_fragment.c:313
 [<ffffffff83205f24>] inet_frag_put include/net/inet_frag.h:123 [inline]
 [<ffffffff83205f24>] ipq_put net/ipv4/ip_fragment.c:172 [inline]
 [<ffffffff83205f24>] ip_expire+0x154/0x770 net/ipv4/ip_fragment.c:256
 [<ffffffff81290a8c>] call_timer_fn+0x18c/0x870 kernel/time/timer.c:1185
 [<ffffffff812917b2>] __run_timers kernel/time/timer.c:1261 [inline]
 [<ffffffff812917b2>] run_timer_softirq+0x642/0xb90 kernel/time/timer.c:1444
 [<ffffffff838c5bec>] __do_softirq+0x22c/0xa1a kernel/softirq.c:273
 [<ffffffff8113f8ad>] invoke_softirq kernel/softirq.c:350 [inline]
 [<ffffffff8113f8ad>] irq_exit+0x10d/0x140 kernel/softirq.c:391
 [<ffffffff838c5351>] exiting_irq arch/x86/include/asm/apic.h:653 [inline]
 [<ffffffff838c5351>] smp_apic_timer_interrupt+0x81/0xa0 arch/x86/kernel/apic/apic.c:926
 [<ffffffff838c4290>] apic_timer_interrupt+0xa0/0xb0 arch/x86/entry/entry_64.S:741
 <EOI>  [<ffffffff810cc306>] ? native_safe_halt+0x6/0x10 arch/x86/include/asm/irqflags.h:49
 [<ffffffff81025cf5>] arch_safe_halt arch/x86/include/asm/paravirt.h:117 [inline]
 [<ffffffff81025cf5>] default_idle+0x55/0x3c0 arch/x86/kernel/process.c:290
 [<ffffffff81027240>] arch_cpu_idle+0x10/0x20 arch/x86/kernel/process.c:281
 [<ffffffff8121bc07>] default_idle_call+0x57/0x70 kernel/sched/idle.c:93
 [<ffffffff8121c3af>] cpuidle_idle_call kernel/sched/idle.c:157 [inline]
 [<ffffffff8121c3af>] cpu_idle_loop kernel/sched/idle.c:253 [inline]
 [<ffffffff8121c3af>] cpu_startup_entry+0x6af/0x780 kernel/sched/idle.c:301
 [<ffffffff810a9e54>] start_secondary+0x324/0x400 arch/x86/kernel/smpboot.c:242

The buggy address belongs to the page:
page:ffffea0002b621c0 count:0 mapcount:0 mapping:          (null) index:0x0
flags: 0x4000000000000000()
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8800ad887e80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8800ad887f00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff8800ad887f80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                       ^
 ffff8800ad888000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8800ad888080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================