IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready
IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
==================================================================
BUG: KASAN: stack-out-of-bounds in iov_iter_advance+0x4b3/0x4f0 lib/iov_iter.c:491
Read of size 8 at addr ffff8800b9167cc0 by task syz-executor0/4207

CPU: 1 PID: 4207 Comm: syz-executor0 Not tainted 4.4.138-g07c0138 #60
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 0000000000000000 1362dfa68f8ff8c7 ffff8800b9167978 ffffffff81e0ed0d
 ffffea0002e459c0 ffff8800b9167cc0 0000000000000000 ffff8800b9167cc0
 ffff8800b9167cb8 ffff8800b91679b0 ffffffff81515a16 ffff8800b9167cc0
Call Trace:
 [<ffffffff81e0ed0d>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81e0ed0d>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
 [<ffffffff81515a16>] print_address_description+0x6c/0x216 mm/kasan/report.c:252
 [<ffffffff81515d35>] kasan_report_error mm/kasan/report.c:351 [inline]
 [<ffffffff81515d35>] kasan_report.cold.7+0x175/0x2f7 mm/kasan/report.c:408
 [<ffffffff814f9824>] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:429
 [<ffffffff81e4a723>] iov_iter_advance+0x4b3/0x4f0 lib/iov_iter.c:491
 [<ffffffff8275286d>] tun_get_user+0x2cd/0x2410 drivers/net/tun.c:1124
 [<ffffffff82754bc5>] tun_chr_write_iter+0xd5/0x190 drivers/net/tun.c:1283
 [<ffffffff8151ce0d>] new_sync_write fs/read_write.c:478 [inline]
 [<ffffffff8151ce0d>] __vfs_write+0x30d/0x3f0 fs/read_write.c:491
 [<ffffffff8151e9f1>] vfs_write+0x191/0x4e0 fs/read_write.c:538
 [<ffffffff81520ff9>] SYSC_write fs/read_write.c:585 [inline]
 [<ffffffff81520ff9>] SyS_write+0xd9/0x1c0 fs/read_write.c:577
 [<ffffffff81006d96>] do_syscall_32_irqs_on arch/x86/entry/common.c:392 [inline]
 [<ffffffff81006d96>] do_fast_syscall_32+0x326/0x8b0 arch/x86/entry/common.c:459
 [<ffffffff838c406a>] sysenter_flags_fixed+0xd/0x17

The buggy address belongs to the page:
page:ffffea0002e459c0 count:0 mapcount:0 mapping:          (null) index:0x0
flags: 0x4000000000000000()
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8800b9167b80: f2 f2 f2 f2 00 00 00 00 00 f2 f2 f2 00 00 00 00
 ffff8800b9167c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8800b9167c80: 00 f1 f1 f1 f1 00 00 f2 f2 f2 f2 f2 f2 00 00 00
                                           ^
 ffff8800b9167d00: 00 00 f2 f2 f2 f2 f2 f2 f2 00 00 00 00 00 f2 f2
 ffff8800b9167d80: f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================