==================================================================
BUG: KASAN: slab-out-of-bounds in ip6_tnl_xmit2+0x229d/0x2350 net/ipv6/ip6_tunnel.c:987
Read of size 16 at addr ffff8800b61d2230 by task syz-executor770/2072

CPU: 1 PID: 2072 Comm: syz-executor770 Not tainted 4.4.164+ #123
 0000000000000000 075b6e778f4def9e ffff8801d49feca0 ffffffff81aa5d4d
 ffffea0002d87400 ffff8800b61d2230 0000000000000000 ffff8800b61d2238
 ffff8801d9fb9100 ffff8801d49fecd8 ffffffff8148b2eb ffff8800b61d2230
Call Trace:
 [<ffffffff81aa5d4d>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81aa5d4d>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
 [<ffffffff8148b2eb>] print_address_description+0x6c/0x217 mm/kasan/report.c:252
 [<ffffffff8148b60b>] kasan_report_error mm/kasan/report.c:351 [inline]
 [<ffffffff8148b60b>] kasan_report.cold.6+0x175/0x2f7 mm/kasan/report.c:408
 [<ffffffff8148040f>] __asan_report_load_n_noabort+0xf/0x20 mm/kasan/report.c:439
 [<ffffffff826ae60d>] ip6_tnl_xmit2+0x229d/0x2350 net/ipv6/ip6_tunnel.c:987
 [<ffffffff826b00b9>] ip4ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1134 [inline]
 [<ffffffff826b00b9>] ip6_tnl_xmit+0x9f9/0xe10 net/ipv6/ip6_tunnel.c:1212
 [<ffffffff8223d6ad>] __netdev_start_xmit include/linux/netdevice.h:3750 [inline]
 [<ffffffff8223d6ad>] netdev_start_xmit include/linux/netdevice.h:3759 [inline]
 [<ffffffff8223d6ad>] xmit_one net/core/dev.c:2781 [inline]
 [<ffffffff8223d6ad>] dev_hard_start_xmit+0x7bd/0x11c0 net/core/dev.c:2797
 [<ffffffff8223fa95>] __dev_queue_xmit+0x16f5/0x1c30 net/core/dev.c:3229
 [<ffffffff8223ffe7>] dev_queue_xmit+0x17/0x20 net/core/dev.c:3263
 [<ffffffff82254d65>] neigh_direct_output+0x15/0x20 net/core/neighbour.c:1369
 [<ffffffff823c0570>] dst_neigh_output include/net/dst.h:461 [inline]
 [<ffffffff823c0570>] ip_finish_output2+0x8f0/0x1100 net/ipv4/ip_output.c:213
 [<ffffffff823c7402>] ip_finish_output+0x882/0xc00 net/ipv4/ip_output.c:288
 [<ffffffff823caff9>] NF_HOOK_COND include/linux/netfilter.h:240 [inline]
 [<ffffffff823caff9>] ip_output+0x219/0x4c0 net/ipv4/ip_output.c:362
 [<ffffffff823c7f1b>] dst_output include/net/dst.h:498 [inline]
 [<ffffffff823c7f1b>] ip_local_out+0x9b/0x180 net/ipv4/ip_output.c:119
 [<ffffffff823cdc3c>] ip_send_skb+0x3c/0xc0 net/ipv4/ip_output.c:1453
 [<ffffffff82472d93>] udp_send_skb+0x503/0xc70 net/ipv4/udp.c:842
 [<ffffffff82479c19>] udp_sendmsg+0x16c9/0x1c70 net/ipv4/udp.c:1072
 [<ffffffff8260d73d>] udpv6_sendmsg+0x12cd/0x24c0 net/ipv6/udp.c:1173
 [<ffffffff824a2eb3>] inet_sendmsg+0x203/0x4d0 net/ipv4/af_inet.c:755
 [<ffffffff821d00db>] sock_sendmsg_nosec net/socket.c:638 [inline]
 [<ffffffff821d00db>] sock_sendmsg+0xbb/0x110 net/socket.c:648
 [<ffffffff821d1f25>] ___sys_sendmsg+0x745/0x880 net/socket.c:1975
 [<ffffffff821d4f76>] __sys_sendmsg+0xd6/0x190 net/socket.c:2009
 [<ffffffff821d505d>] SYSC_sendmsg net/socket.c:2020 [inline]
 [<ffffffff821d505d>] SyS_sendmsg+0x2d/0x50 net/socket.c:2016
 [<ffffffff82713e61>] entry_SYSCALL_64_fastpath+0x1e/0x9a

Allocated by task 2072:
 [<ffffffff8102e566>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63
 [<ffffffff8147f372>] save_stack mm/kasan/kasan.c:512 [inline]
 [<ffffffff8147f372>] set_track mm/kasan/kasan.c:524 [inline]
 [<ffffffff8147f372>] kasan_kmalloc.part.1+0x62/0xf0 mm/kasan/kasan.c:616
 [<ffffffff8147f5ef>] kasan_kmalloc+0xaf/0xc0 mm/kasan/kasan.c:601
 [<ffffffff8147b92d>] __kmalloc+0x13d/0x330 mm/slub.c:3613
 [<ffffffff8225cf86>] kmalloc include/linux/slab.h:481 [inline]
 [<ffffffff8225cf86>] kzalloc include/linux/slab.h:620 [inline]
 [<ffffffff8225cf86>] neigh_alloc net/core/neighbour.c:285 [inline]
 [<ffffffff8225cf86>] __neigh_create+0x1d6/0x1b20 net/core/neighbour.c:457
 [<ffffffff8239a7be>] neigh_create include/net/neighbour.h:313 [inline]
 [<ffffffff8239a7be>] ipv4_neigh_lookup+0x4de/0x700 net/ipv4/route.c:464
 [<ffffffff826ac5fa>] dst_neigh_lookup include/net/dst.h:466 [inline]
 [<ffffffff826ac5fa>] ip6_tnl_xmit2+0x28a/0x2350 net/ipv6/ip6_tunnel.c:982
 [<ffffffff826b00b9>] ip4ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1134 [inline]
 [<ffffffff826b00b9>] ip6_tnl_xmit+0x9f9/0xe10 net/ipv6/ip6_tunnel.c:1212
 [<ffffffff8223d6ad>] __netdev_start_xmit include/linux/netdevice.h:3750 [inline]
 [<ffffffff8223d6ad>] netdev_start_xmit include/linux/netdevice.h:3759 [inline]
 [<ffffffff8223d6ad>] xmit_one net/core/dev.c:2781 [inline]
 [<ffffffff8223d6ad>] dev_hard_start_xmit+0x7bd/0x11c0 net/core/dev.c:2797
 [<ffffffff8223fa95>] __dev_queue_xmit+0x16f5/0x1c30 net/core/dev.c:3229
 [<ffffffff8223ffe7>] dev_queue_xmit+0x17/0x20 net/core/dev.c:3263
 [<ffffffff82254d65>] neigh_direct_output+0x15/0x20 net/core/neighbour.c:1369
 [<ffffffff823c0570>] dst_neigh_output include/net/dst.h:461 [inline]
 [<ffffffff823c0570>] ip_finish_output2+0x8f0/0x1100 net/ipv4/ip_output.c:213
 [<ffffffff823c7402>] ip_finish_output+0x882/0xc00 net/ipv4/ip_output.c:288
 [<ffffffff823caff9>] NF_HOOK_COND include/linux/netfilter.h:240 [inline]
 [<ffffffff823caff9>] ip_output+0x219/0x4c0 net/ipv4/ip_output.c:362
 [<ffffffff823c7f1b>] dst_output include/net/dst.h:498 [inline]
 [<ffffffff823c7f1b>] ip_local_out+0x9b/0x180 net/ipv4/ip_output.c:119
 [<ffffffff823cdc3c>] ip_send_skb+0x3c/0xc0 net/ipv4/ip_output.c:1453
 [<ffffffff82472d93>] udp_send_skb+0x503/0xc70 net/ipv4/udp.c:842
 [<ffffffff82479c19>] udp_sendmsg+0x16c9/0x1c70 net/ipv4/udp.c:1072
 [<ffffffff8260d73d>] udpv6_sendmsg+0x12cd/0x24c0 net/ipv6/udp.c:1173
 [<ffffffff824a2eb3>] inet_sendmsg+0x203/0x4d0 net/ipv4/af_inet.c:755
 [<ffffffff821d00db>] sock_sendmsg_nosec net/socket.c:638 [inline]
 [<ffffffff821d00db>] sock_sendmsg+0xbb/0x110 net/socket.c:648
 [<ffffffff821d1f25>] ___sys_sendmsg+0x745/0x880 net/socket.c:1975
 [<ffffffff821d4f76>] __sys_sendmsg+0xd6/0x190 net/socket.c:2009
 [<ffffffff821d505d>] SYSC_sendmsg net/socket.c:2020 [inline]
 [<ffffffff821d505d>] SyS_sendmsg+0x2d/0x50 net/socket.c:2016
 [<ffffffff82713e61>] entry_SYSCALL_64_fastpath+0x1e/0x9a

Freed by task 504:
 [<ffffffff8102e566>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63
 [<ffffffff8147fc6c>] save_stack mm/kasan/kasan.c:512 [inline]
 [<ffffffff8147fc6c>] set_track mm/kasan/kasan.c:524 [inline]
 [<ffffffff8147fc6c>] kasan_slab_free+0xac/0x190 mm/kasan/kasan.c:589
 [<ffffffff8147d044>] slab_free_hook mm/slub.c:1383 [inline]
 [<ffffffff8147d044>] slab_free_freelist_hook mm/slub.c:1405 [inline]
 [<ffffffff8147d044>] slab_free mm/slub.c:2859 [inline]
 [<ffffffff8147d044>] kfree+0xf4/0x310 mm/slub.c:3749
 [<ffffffff821f4d98>] skb_free_head net/core/skbuff.c:571 [inline]
 [<ffffffff821f4d98>] skb_release_data+0x2e8/0x380 net/core/skbuff.c:602
 [<ffffffff821f4e7a>] skb_release_all+0x4a/0x60 net/core/skbuff.c:661
 [<ffffffff821f4fa7>] __kfree_skb net/core/skbuff.c:675 [inline]
 [<ffffffff821f4fa7>] kfree_skb+0xf7/0x3f0 net/core/skbuff.c:696
 [<ffffffff822e8783>] netlink_unicast_kernel net/netlink/af_netlink.c:1280 [inline]
 [<ffffffff822e8783>] netlink_unicast+0x623/0x700 net/netlink/af_netlink.c:1303
 [<ffffffff822e9034>] netlink_sendmsg+0x694/0xc30 net/netlink/af_netlink.c:1859
 [<ffffffff821d00db>] sock_sendmsg_nosec net/socket.c:638 [inline]
 [<ffffffff821d00db>] sock_sendmsg+0xbb/0x110 net/socket.c:648
 [<ffffffff821d1f25>] ___sys_sendmsg+0x745/0x880 net/socket.c:1975
 [<ffffffff821d4f76>] __sys_sendmsg+0xd6/0x190 net/socket.c:2009
 [<ffffffff821d505d>] SYSC_sendmsg net/socket.c:2020 [inline]
 [<ffffffff821d505d>] SyS_sendmsg+0x2d/0x50 net/socket.c:2016
 [<ffffffff82713e61>] entry_SYSCALL_64_fastpath+0x1e/0x9a

The buggy address belongs to the object at ffff8800b61d1f80
 which belongs to the cache kmalloc-1024 of size 1024
The buggy address is located 688 bytes inside of
 1024-byte region [ffff8800b61d1f80, ffff8800b61d2380)
The buggy address belongs to the page:
double fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 1 PID: 2072 Comm: syz-executor770 Not tainted 4.4.164+ #123
task: ffff8801d4d28000 task.stack: ffff8801d49f8000
RIP: 0010:[<ffffffff81426be4>]  [<ffffffff81426be4>] dump_page_badflags+0x4/0x70 mm/debug.c:84
RSP: 0018:ffff880100000000  EFLAGS: 00010046
RAX: ffff8801d4d28000 RBX: ffffea0002d87400 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff82891020 RDI: ffffea0002d87400
RBP: ffff880100000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: ffffffff83fd7174 R12: ffffffff82891020
R13: ffffffff82891020 R14: ffff8800b61d1f80 R15: ffff8800b61d2380
FS:  000000000096d880(0063) GS:ffff8801db700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff8800fffffff8 CR3: 00000001d5b81000 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:

Call Trace:
 <UNK> 
Code: e8 3e 48 69 c0 80 06 00 00 f0 48 ff 80 28 f8 18 83 5b 5d c3 48 89 df e8 4b 97 05 00 eb dd 66 0f 1f 84 00 00 00 00 00 55 48 89 e5 <41> 57 41 56 41 55 49 89 f5 41 54 49 89 d4 53 48 89 fb 48 83 ec 
RIP  [<ffffffff81426be4>] dump_page_badflags+0x4/0x70 mm/debug.c:84
 RSP <ffff880100000000>
---[ end trace 6bd42102a79c8339 ]---