==================================================================
BUG: KASAN: use-after-free in ipv6_get_dsfield include/net/dsfield.h:23 [inline]
BUG: KASAN: use-after-free in ip6ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1362 [inline]
BUG: KASAN: use-after-free in ip6_tnl_start_xmit+0x14db/0x1680 net/ipv6/ip6_tunnel.c:1389
Read of size 2 at addr ffff8801c9a51298 by task syz-executor017/2489

CPU: 1 PID: 2489 Comm: syz-executor017 Not tainted 4.9.128+ #45
 ffff8801c9ab7048 ffffffff81af2469 ffffea0007269400 ffff8801c9a51298
 0000000000000000 ffff8801c9a51298 ffff8801c9a51298 ffff8801c9ab7080
 ffffffff814e13cb ffff8801c9a51298 0000000000000002 0000000000000000
Call Trace:
 [<ffffffff81af2469>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81af2469>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff814e13cb>] print_address_description+0x6c/0x234 mm/kasan/report.c:256
 [<ffffffff814e17d5>] kasan_report_error mm/kasan/report.c:355 [inline]
 [<ffffffff814e17d5>] kasan_report.cold.6+0x242/0x2fe mm/kasan/report.c:412
 [<ffffffff814d3bd4>] __asan_report_load2_noabort+0x14/0x20 mm/kasan/report.c:431
 [<ffffffff82729c4b>] ipv6_get_dsfield include/net/dsfield.h:23 [inline]
 [<ffffffff82729c4b>] ip6ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1362 [inline]
 [<ffffffff82729c4b>] ip6_tnl_start_xmit+0x14db/0x1680 net/ipv6/ip6_tunnel.c:1389
 [<ffffffff82296f67>] __netdev_start_xmit include/linux/netdevice.h:4062 [inline]
 [<ffffffff82296f67>] netdev_start_xmit include/linux/netdevice.h:4071 [inline]
 [<ffffffff82296f67>] xmit_one net/core/dev.c:2955 [inline]
 [<ffffffff82296f67>] dev_hard_start_xmit+0x197/0x8b0 net/core/dev.c:2971
 [<ffffffff82298abf>] __dev_queue_xmit+0x117f/0x1b90 net/core/dev.c:3451
 [<ffffffff822994e7>] dev_queue_xmit+0x17/0x20 net/core/dev.c:3484
 [<ffffffff822b1275>] neigh_direct_output+0x15/0x20 net/core/neighbour.c:1362
 [<ffffffff82609ece>] dst_neigh_output include/net/dst.h:470 [inline]
 [<ffffffff82609ece>] ip6_finish_output2+0xb0e/0x1d10 net/ipv6/ip6_output.c:119
 [<ffffffff8261aa84>] ip6_finish_output+0x334/0x980 net/ipv6/ip6_output.c:145
 [<ffffffff8261b2ba>] NF_HOOK_COND include/linux/netfilter.h:246 [inline]
 [<ffffffff8261b2ba>] ip6_output+0x1ea/0x6d0 net/ipv6/ip6_output.c:162
 [<ffffffff8273507b>] dst_output include/net/dst.h:507 [inline]
 [<ffffffff8273507b>] ip6_local_out+0x9b/0x180 net/ipv6/output_core.c:176
 [<ffffffff8261d4a1>] ip6_send_skb+0xa1/0x340 net/ipv6/ip6_output.c:1753
 [<ffffffff8267ea33>] udp_v6_send_skb+0x843/0xe70 net/ipv6/udp.c:974
 [<ffffffff8267f28d>] udp_v6_push_pending_frames+0x22d/0x340 net/ipv6/udp.c:1007
 [<ffffffff82681241>] udpv6_sendmsg+0x1dc1/0x2430 net/ipv6/udp.c:1273
 [<ffffffff82512b43>] inet_sendmsg+0x203/0x4d0 net/ipv4/af_inet.c:770
 [<ffffffff8222530b>] sock_sendmsg_nosec net/socket.c:648 [inline]
 [<ffffffff8222530b>] sock_sendmsg+0xbb/0x110 net/socket.c:658
 [<ffffffff82225583>] sock_write_iter+0x223/0x3b0 net/socket.c:856
 [<ffffffff814e8d57>] new_sync_write fs/read_write.c:496 [inline]
 [<ffffffff814e8d57>] __vfs_write+0x3d7/0x580 fs/read_write.c:509
 [<ffffffff814eb5a7>] vfs_write+0x187/0x520 fs/read_write.c:557
 [<ffffffff814ef3d9>] SYSC_write fs/read_write.c:604 [inline]
 [<ffffffff814ef3d9>] SyS_write+0xd9/0x1c0 fs/read_write.c:596
 [<ffffffff81005fd1>] do_syscall_32_irqs_on arch/x86/entry/common.c:325 [inline]
 [<ffffffff81005fd1>] do_fast_syscall_32+0x2f1/0x860 arch/x86/entry/common.c:387
 [<ffffffff8278f460>] entry_SYSENTER_compat+0x90/0xa2 arch/x86/entry/entry_64_compat.S:137

Allocated by task 2489:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack mm/kasan/kasan.c:505 [inline]
 set_track mm/kasan/kasan.c:517 [inline]
 kasan_kmalloc.part.1+0x62/0xf0 mm/kasan/kasan.c:609
 kasan_kmalloc+0xaf/0xc0 mm/kasan/kasan.c:594
 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:547
 slab_post_alloc_hook mm/slab.h:417 [inline]
 slab_alloc_node mm/slub.c:2715 [inline]
 slab_alloc mm/slub.c:2723 [inline]
 __kmalloc_track_caller+0xf0/0x2d0 mm/slub.c:4232
 __kmalloc_reserve.isra.5+0x33/0xc0 net/core/skbuff.c:138
 __alloc_skb+0x11a/0x5b0 net/core/skbuff.c:231
 alloc_skb include/linux/skbuff.h:919 [inline]
 alloc_skb_with_frags+0xaf/0x4e0 net/core/skbuff.c:4685
 sock_alloc_send_pskb+0x59e/0x740 net/core/sock.c:1893
 sock_alloc_send_skb+0x32/0x40 net/core/sock.c:1910
 __ip6_append_data.isra.3+0x1fd2/0x3460 net/ipv6/ip6_output.c:1487
 ip6_append_data+0x1c1/0x2f0 net/ipv6/ip6_output.c:1647
 udpv6_sendmsg+0x88b/0x2430 net/ipv6/udp.c:1267
 inet_sendmsg+0x203/0x4d0 net/ipv4/af_inet.c:770
 sock_sendmsg_nosec net/socket.c:648 [inline]
 sock_sendmsg+0xbb/0x110 net/socket.c:658
 SYSC_sendto net/socket.c:1683 [inline]
 SyS_sendto+0x220/0x370 net/socket.c:1651
 do_syscall_32_irqs_on arch/x86/entry/common.c:325 [inline]
 do_fast_syscall_32+0x2f1/0x860 arch/x86/entry/common.c:387
 entry_SYSENTER_compat+0x90/0xa2 arch/x86/entry/entry_64_compat.S:137

Freed by task 2489:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack mm/kasan/kasan.c:505 [inline]
 set_track mm/kasan/kasan.c:517 [inline]
 kasan_slab_free+0xac/0x190 mm/kasan/kasan.c:582
 slab_free_hook mm/slub.c:1355 [inline]
 slab_free_freelist_hook mm/slub.c:1377 [inline]
 slab_free mm/slub.c:2958 [inline]
 kfree+0xfb/0x310 mm/slub.c:3878
 skb_free_head+0x8b/0xb0 net/core/skbuff.c:580
 pskb_expand_head+0x457/0x8a0 net/core/skbuff.c:1246
 skb_header_unclone include/linux/skbuff.h:1359 [inline]
 iptunnel_handle_offloads+0x3f0/0x520 net/ipv4/ip_tunnel_core.c:169
 ip6ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1359 [inline]
 ip6_tnl_start_xmit+0x4ca/0x1680 net/ipv6/ip6_tunnel.c:1389
 __netdev_start_xmit include/linux/netdevice.h:4062 [inline]
 netdev_start_xmit include/linux/netdevice.h:4071 [inline]
 xmit_one net/core/dev.c:2955 [inline]
 dev_hard_start_xmit+0x197/0x8b0 net/core/dev.c:2971
 __dev_queue_xmit+0x117f/0x1b90 net/core/dev.c:3451
 dev_queue_xmit+0x17/0x20 net/core/dev.c:3484
 neigh_direct_output+0x15/0x20 net/core/neighbour.c:1362
 dst_neigh_output include/net/dst.h:470 [inline]
 ip6_finish_output2+0xb0e/0x1d10 net/ipv6/ip6_output.c:119
 ip6_finish_output+0x334/0x980 net/ipv6/ip6_output.c:145
 NF_HOOK_COND include/linux/netfilter.h:246 [inline]
 ip6_output+0x1ea/0x6d0 net/ipv6/ip6_output.c:162
 dst_output include/net/dst.h:507 [inline]
 ip6_local_out+0x9b/0x180 net/ipv6/output_core.c:176
 ip6_send_skb+0xa1/0x340 net/ipv6/ip6_output.c:1753
 udp_v6_send_skb+0x843/0xe70 net/ipv6/udp.c:974
 udp_v6_push_pending_frames+0x22d/0x340 net/ipv6/udp.c:1007
 udpv6_sendmsg+0x1dc1/0x2430 net/ipv6/udp.c:1273
 inet_sendmsg+0x203/0x4d0 net/ipv4/af_inet.c:770
 sock_sendmsg_nosec net/socket.c:648 [inline]
 sock_sendmsg+0xbb/0x110 net/socket.c:658
 sock_write_iter+0x223/0x3b0 net/socket.c:856
 new_sync_write fs/read_write.c:496 [inline]
 __vfs_write+0x3d7/0x580 fs/read_write.c:509
 vfs_write+0x187/0x520 fs/read_write.c:557
 SYSC_write fs/read_write.c:604 [inline]
 SyS_write+0xd9/0x1c0 fs/read_write.c:596
 do_syscall_32_irqs_on arch/x86/entry/common.c:325 [inline]
 do_fast_syscall_32+0x2f1/0x860 arch/x86/entry/common.c:387
 entry_SYSENTER_compat+0x90/0xa2 arch/x86/entry/entry_64_compat.S:137

The buggy address belongs to the object at ffff8801c9a51200
 which belongs to the cache kmalloc-1024 of size 1024
The buggy address is located 152 bytes inside of
 1024-byte region [ffff8801c9a51200, ffff8801c9a51600)
The buggy address belongs to the page:
page:ffffea0007269400 count:1 mapcount:0 mapping:          (null) index:0x0 compound_mapcount: 0
flags: 0x4000000000004080(slab|head)
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801c9a51180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8801c9a51200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8801c9a51280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                            ^
 ffff8801c9a51300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8801c9a51380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================