==================================================================
BUG: KASAN: use-after-free in inet_shutdown+0x2e9/0x370 net/ipv4/af_inet.c:809
Read of size 4 at addr ffff8801cb620440 by task syz-executor3/18556

CPU: 0 PID: 18556 Comm: syz-executor3 Not tainted 4.4.150-g5541782 #83
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 0000000000000000 3a20df3b310f87c2 ffff8801d48bfba0 ffffffff81e14e2d
 ffffea00072d8800 ffff8801cb620440 0000000000000000 ffff8801cb620440
 ffff8801d360b958 ffff8801d48bfbd8 ffffffff8151a3f0 ffff8801cb620440
Call Trace:
 [<ffffffff81e14e2d>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81e14e2d>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
 [<ffffffff8151a3f0>] print_address_description+0x6c/0x216 mm/kasan/report.c:252
 [<ffffffff8151a70f>] kasan_report_error mm/kasan/report.c:351 [inline]
 [<ffffffff8151a70f>] kasan_report.cold.7+0x175/0x2f7 mm/kasan/report.c:408
 [<ffffffff814fdc84>] __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:428
 [<ffffffff83300d79>] inet_shutdown+0x2e9/0x370 net/ipv4/af_inet.c:809
 [<ffffffff835aeca0>] pppol2tp_session_close+0xa0/0xe0 net/l2tp/l2tp_ppp.c:458
 [<ffffffff835a7d15>] l2tp_tunnel_closeall+0x205/0x350 net/l2tp/l2tp_core.c:1274
 [<ffffffff835a88db>] l2tp_udp_encap_destroy+0x8b/0xf0 net/l2tp/l2tp_core.c:1300
 [<ffffffff8349a8e1>] udpv6_destroy_sock+0xb1/0xd0 net/ipv6/udp.c:1421
 [<ffffffff82f3757d>] sk_common_release+0x6d/0x300 net/core/sock.c:2680
 [<ffffffff83499595>] udp_lib_close+0x15/0x20 include/net/udp.h:190
 [<ffffffff83300eff>] inet_release+0xff/0x1d0 net/ipv4/af_inet.c:435
 [<ffffffff83423b90>] inet6_release+0x50/0x70 net/ipv6/af_inet6.c:424
 [<ffffffff82f21c86>] sock_release+0x96/0x1c0 net/socket.c:587
 [<ffffffff82f21dc6>] sock_close+0x16/0x20 net/socket.c:1038
 [<ffffffff815277d5>] __fput+0x235/0x6f0 fs/file_table.c:208
 [<ffffffff81527d15>] ____fput+0x15/0x20 fs/file_table.c:244
 [<ffffffff8118ed2f>] task_work_run+0x10f/0x190 kernel/task_work.c:115
 [<ffffffff8100362d>] tracehook_notify_resume include/linux/tracehook.h:191 [inline]
 [<ffffffff8100362d>] exit_to_usermode_loop+0x13d/0x160 arch/x86/entry/common.c:253
 [<ffffffff81006535>] prepare_exit_to_usermode arch/x86/entry/common.c:284 [inline]
 [<ffffffff81006535>] syscall_return_slowpath+0x1b5/0x1f0 arch/x86/entry/common.c:349
 [<ffffffff838cb235>] int_ret_from_sys_call+0x25/0xa3

Allocated by task 18572:
 [<ffffffff81034676>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63
 [<ffffffff814fcd53>] save_stack+0x43/0xd0 mm/kasan/kasan.c:512
 [<ffffffff814fd037>] set_track mm/kasan/kasan.c:524 [inline]
 [<ffffffff814fd037>] kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:616
 [<ffffffff814fd602>] kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:554
 [<ffffffff814f911e>] slab_post_alloc_hook mm/slub.c:1349 [inline]
 [<ffffffff814f911e>] slab_alloc_node mm/slub.c:2615 [inline]
 [<ffffffff814f911e>] slab_alloc mm/slub.c:2623 [inline]
 [<ffffffff814f911e>] kmem_cache_alloc+0xbe/0x2a0 mm/slub.c:2628
 [<ffffffff82f2422d>] sock_alloc_inode+0x1d/0x260 net/socket.c:251
 [<ffffffff81574263>] alloc_inode+0x63/0x180 fs/inode.c:198
 [<ffffffff81579b57>] new_inode_pseudo+0x17/0xe0 fs/inode.c:878
 [<ffffffff82f224e1>] sock_alloc+0x41/0x280 net/socket.c:556
 [<ffffffff82f27f4d>] __sock_create+0x8d/0x5f0 net/socket.c:1142
 [<ffffffff82f286e0>] sock_create net/socket.c:1218 [inline]
 [<ffffffff82f286e0>] SYSC_socket net/socket.c:1248 [inline]
 [<ffffffff82f286e0>] SyS_socket+0xf0/0x1b0 net/socket.c:1228
 [<ffffffff838cb0a5>] entry_SYSCALL_64_fastpath+0x22/0x9e

Freed by task 18572:
 [<ffffffff81034676>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63
 [<ffffffff814fcd53>] save_stack+0x43/0xd0 mm/kasan/kasan.c:512
 [<ffffffff814fd682>] set_track mm/kasan/kasan.c:524 [inline]
 [<ffffffff814fd682>] kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:589
 [<ffffffff814fa86e>] slab_free_hook mm/slub.c:1383 [inline]
 [<ffffffff814fa86e>] slab_free_freelist_hook mm/slub.c:1405 [inline]
 [<ffffffff814fa86e>] slab_free mm/slub.c:2859 [inline]
 [<ffffffff814fa86e>] kmem_cache_free+0xbe/0x340 mm/slub.c:2881
 [<ffffffff82f241f6>] sock_destroy_inode+0x56/0x70 net/socket.c:281
 [<ffffffff81576a52>] destroy_inode+0xc2/0x120 fs/inode.c:255
 [<ffffffff81576dd2>] evict+0x322/0x4f0 fs/inode.c:559
 [<ffffffff81577421>] iput_final fs/inode.c:1477 [inline]
 [<ffffffff81577421>] iput+0x391/0x980 fs/inode.c:1504
 [<ffffffff81568c02>] dentry_iput fs/dcache.c:372 [inline]
 [<ffffffff81568c02>] __dentry_kill+0x492/0x5f0 fs/dcache.c:559
 [<ffffffff8156c4f7>] dentry_kill fs/dcache.c:603 [inline]
 [<ffffffff8156c4f7>] dput.part.26+0x587/0x760 fs/dcache.c:818
 [<ffffffff8156c6ef>] dput+0x1f/0x30 fs/dcache.c:782
 [<ffffffff815279a1>] __fput+0x401/0x6f0 fs/file_table.c:226
 [<ffffffff81527d15>] ____fput+0x15/0x20 fs/file_table.c:244
 [<ffffffff8118ed2f>] task_work_run+0x10f/0x190 kernel/task_work.c:115
 [<ffffffff81162170>] get_signal+0x1190/0x14b0 kernel/signal.c:2151
 [<ffffffff8100df4b>] do_signal+0x8b/0x1d30 arch/x86/kernel/signal.c:712
 [<ffffffff8100360a>] exit_to_usermode_loop+0x11a/0x160 arch/x86/entry/common.c:249
 [<ffffffff81006535>] prepare_exit_to_usermode arch/x86/entry/common.c:284 [inline]
 [<ffffffff81006535>] syscall_return_slowpath+0x1b5/0x1f0 arch/x86/entry/common.c:349
 [<ffffffff838cb235>] int_ret_from_sys_call+0x25/0xa3

The buggy address belongs to the object at ffff8801cb620440
 which belongs to the cache sock_inode_cache of size 936
The buggy address is located 0 bytes inside of
 936-byte region [ffff8801cb620440, ffff8801cb6207e8)
The buggy address belongs to the page:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral protection fault: 0000 [#1] PREEMPT SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.4.150-g5541782 #83
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8801d9a41800 task.stack: ffff8801d9a50000
RIP: 0010:[<ffffffff81e76901>]  [<ffffffff81e76901>] lookup_object lib/debugobjects.c:120 [inline]
RIP: 0010:[<ffffffff81e76901>]  [<ffffffff81e76901>] debug_object_deactivate+0x191/0x340 lib/debugobjects.c:465
RSP: 0018:ffff8801db307cf0  EFLAGS: 00010003
RAX: dffffc0000000000 RBX: 4f5f4755425f4d56 RCX: 09ebe8eaa84be9ad
RDX: 0000000000000000 RSI: ffffffff844c77a0 RDI: 4f5f4755425f4d6e
RBP: ffff8801db307da8 R08: ffffffff85341110 R09: 0000000000000001
R10: 0000000000000001 R11: ffff8801d9a41800 R12: 1ffff1003b660fa0
R13: ffffffff85a29568 R14: ffff8801bf9b7df8 R15: 0000000000000003
FS:  0000000000000000(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000001b31d2f000 CR3: 00000000a6717000 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 0000000000000092 ffffffff844c77a0 0000000041b58ab3 ffffffff8420c387
 ffffffff81e76770 ffff8801d9a41800 ffffed003b34841b ffff8801d9a420e0
 ffff8801db3196d8 0000000000000000 ffff8801db307d80 ffffffff8122c632
Call Trace:
 <IRQ> 
 [<ffffffff812a0bb2>] debug_hrtimer_deactivate kernel/time/hrtimer.c:415 [inline]
 [<ffffffff812a0bb2>] debug_deactivate kernel/time/hrtimer.c:462 [inline]
 [<ffffffff812a0bb2>] __run_hrtimer kernel/time/hrtimer.c:1230 [inline]
 [<ffffffff812a0bb2>] __hrtimer_run_queues+0x222/0x1000 kernel/time/hrtimer.c:1325
 [<ffffffff812a24b1>] hrtimer_interrupt+0x1b1/0x430 kernel/time/hrtimer.c:1359
 [<ffffffff810af544>] local_apic_timer_interrupt+0x74/0xa0 arch/x86/kernel/apic/apic.c:901
 [<ffffffff838cdd1c>] smp_apic_timer_interrupt+0x7c/0xa0 arch/x86/kernel/apic/apic.c:925
 [<ffffffff838ccc60>] apic_timer_interrupt+0xa0/0xb0 arch/x86/entry/entry_64.S:741
 <EOI> 
 [<ffffffff81025cd5>] arch_safe_halt arch/x86/include/asm/paravirt.h:117 [inline]
 [<ffffffff81025cd5>] default_idle+0x55/0x3c0 arch/x86/kernel/process.c:432
 [<ffffffff81027be0>] arch_cpu_idle+0x10/0x20 arch/x86/kernel/process.c:423
 [<ffffffff8121ebb7>] default_idle_call+0x57/0x70 kernel/sched/idle.c:93
 [<ffffffff8121f35f>] cpuidle_idle_call kernel/sched/idle.c:157 [inline]
 [<ffffffff8121f35f>] cpu_idle_loop kernel/sched/idle.c:253 [inline]
 [<ffffffff8121f35f>] cpu_startup_entry+0x6af/0x780 kernel/sched/idle.c:301
 [<ffffffff810ac119>] start_secondary+0x329/0x400 arch/x86/kernel/smpboot.c:245
Code: a9 01 00 00 48 8b 1b 41 bf 01 00 00 00 48 85 db 74 42 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 18 41 83 c7 01 48 89 f9 48 c1 e9 03 <80> 3c 01 00 0f 85 0c 01 00 00 4c 3b 73 18 74 7d 48 89 d9 48 c1 
RIP  [<ffffffff81e76901>] lookup_object lib/debugobjects.c:120 [inline]
RIP  [<ffffffff81e76901>] debug_object_deactivate+0x191/0x340 lib/debugobjects.c:465
 RSP <ffff8801db307cf0>
---[ end trace 99d860cf631fcd60 ]---