syzbot

==================================================================
kernel msg: ebtables bug: please report to author: EBT_ENTRY_OR_ENTRIES shouldn't be set in distinguisher
BUG: KASAN: slab-out-of-bounds in skb_network_protocol+0x46b/0x4b0 net/core/dev.c:2739
Read of size 2 at addr ffff8801b3097a0b by task syz-executor5/14242

CPU: 1 PID: 14242 Comm: syz-executor5 Not tainted 4.16.0-rc6+ #280
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0x194/0x24d lib/dump_stack.c:53
 print_address_description+0x73/0x250 mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report+0x23c/0x360 mm/kasan/report.c:412
 __asan_report_load_n_noabort+0xf/0x20 mm/kasan/report.c:443
 skb_network_protocol+0x46b/0x4b0 net/core/dev.c:2739
 harmonize_features net/core/dev.c:2924 [inline]
 netif_skb_features+0x509/0x9b0 net/core/dev.c:3011
 validate_xmit_skb+0x81/0xb00 net/core/dev.c:3084
 validate_xmit_skb_list+0xbf/0x120 net/core/dev.c:3142
 packet_direct_xmit+0x117/0x790 net/packet/af_packet.c:256
 packet_snd net/packet/af_packet.c:2944 [inline]
 packet_sendmsg+0x3aed/0x60b0 net/packet/af_packet.c:2969
 sock_sendmsg_nosec net/socket.c:629 [inline]
 sock_sendmsg+0xca/0x110 net/socket.c:639
 ___sys_sendmsg+0x767/0x8b0 net/socket.c:2047
 __sys_sendmsg+0xe5/0x210 net/socket.c:2081
 SYSC_sendmsg net/socket.c:2092 [inline]
 SyS_sendmsg+0x2d/0x50 net/socket.c:2088
 do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x454239
RSP: 002b:00007fc340accc68 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fc340acd6d4 RCX: 0000000000454239
RDX: 0000000000000000 RSI: 0000000020f21000 RDI: 0000000000000013
RBP: 000000000072bea0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 00000000000004c2 R14: 00000000006f82d0 R15: 0000000000000000

Allocated by task 10680:
 save_stack+0x43/0xd0 mm/kasan/kasan.c:447
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:552
 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:489
 kmem_cache_alloc+0x12e/0x760 mm/slab.c:3541
 kmem_cache_zalloc include/linux/slab.h:691 [inline]
 get_empty_filp+0xfb/0x4f0 fs/file_table.c:122
 alloc_file+0x26/0x390 fs/file_table.c:163
 sock_alloc_file+0x1f3/0x560 net/socket.c:410
 sock_map_fd+0x34/0x90 net/socket.c:437
 SYSC_socket net/socket.c:1359 [inline]
 SyS_socket+0x125/0x1d0 net/socket.c:1335
 do_syscall_64+0x281/0x940 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x42/0xb7

Freed by task 10696:
 save_stack+0x43/0xd0 mm/kasan/kasan.c:447
 set_track mm/kasan/kasan.c:459 [inline]
 __kasan_slab_free+0x11a/0x170 mm/kasan/kasan.c:520
 kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:527
 __cache_free mm/slab.c:3485 [inline]
 kmem_cache_free+0x83/0x2a0 mm/slab.c:3743
 file_free_rcu+0x5c/0x70 fs/file_table.c:49
 __rcu_reclaim kernel/rcu/rcu.h:172 [inline]
 rcu_do_batch kernel/rcu/tree.c:2674 [inline]
 invoke_rcu_callbacks kernel/rcu/tree.c:2933 [inline]
 __rcu_process_callbacks kernel/rcu/tree.c:2900 [inline]
 rcu_process_callbacks+0xd6c/0x17f0 kernel/rcu/tree.c:2917
 __do_softirq+0x2d7/0xb85 kernel/softirq.c:285

The buggy address belongs to the object at ffff8801b30977c0
 which belongs to the cache filp of size 456
The buggy address is located 131 bytes to the right of
 456-byte region [ffff8801b30977c0, ffff8801b3097988)
The buggy address belongs to the page:
page:ffffea0006cc25c0 count:1 mapcount:0 mapping:ffff8801b3097040 index:0x0
flags: 0x2fffc0000000100(slab)
raw: 02fffc0000000100 ffff8801b3097040 0000000000000000 0000000100000006
raw: ffffea0006cce0e0 ffffea000753eaa0 ffff8801da5d6180 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801b3097900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8801b3097980: fb fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8801b3097a00: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
                      ^
 ffff8801b3097a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8801b3097b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================