==================================================================
BUG: KASAN: slab-out-of-bounds in ip6_dst_idev include/net/ip6_fib.h:141 [inline]
BUG: KASAN: slab-out-of-bounds in ip6_xmit+0x177c/0x1a00 net/ipv6/ip6_output.c:237
Read of size 8 at addr ffff8801d6837518 by task syz-executor4/6657

CPU: 1 PID: 6657 Comm: syz-executor4 Not tainted 4.4.152-ge5c5f1f #25
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 0000000000000000 b3306fc561200c9d ffff8801cadf7548 ffffffff81e15fed
 ffffea00075a0dc0 ffff8801d6837518 0000000000000000 ffff8801d6837518
 0000000000001000 ffff8801cadf7580 ffffffff8151b489 ffff8801d6837518
Call Trace:
 [<ffffffff81e15fed>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81e15fed>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
 [<ffffffff8151b489>] print_address_description+0x6c/0x216 mm/kasan/report.c:252
 [<ffffffff8151b7a8>] kasan_report_error mm/kasan/report.c:351 [inline]
 [<ffffffff8151b7a8>] kasan_report.cold.7+0x175/0x2f7 mm/kasan/report.c:408
 [<ffffffff814fe734>] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:429
 [<ffffffff83435efc>] ip6_dst_idev include/net/ip6_fib.h:141 [inline]
 [<ffffffff83435efc>] ip6_xmit+0x177c/0x1a00 net/ipv6/ip6_output.c:237
 [<ffffffff834f60c5>] inet6_csk_xmit+0x245/0x490 net/ipv6/inet6_connection_sock.c:176
 [<ffffffff835a570c>] l2tp_xmit_core net/l2tp/l2tp_core.c:1084 [inline]
 [<ffffffff835a570c>] l2tp_xmit_skb+0xb9c/0xe80 net/l2tp/l2tp_core.c:1179
 [<ffffffff835b1c60>] pppol2tp_sendmsg+0x4e0/0x7d0 net/l2tp/l2tp_ppp.c:355
 [<ffffffff82f2727c>] sock_sendmsg_nosec net/socket.c:638 [inline]
 [<ffffffff82f2727c>] sock_sendmsg+0xcc/0x110 net/socket.c:648
 [<ffffffff82f28a41>] ___sys_sendmsg+0x441/0x880 net/socket.c:1975
 [<ffffffff82f2b0d4>] __sys_sendmmsg+0x1d4/0x2e0 net/socket.c:2053
 [<ffffffff83014b22>] C_SYSC_sendmmsg net/compat.c:728 [inline]
 [<ffffffff83014b22>] compat_SyS_sendmmsg+0x32/0x40 net/compat.c:725
 [<ffffffff81006d94>] do_syscall_32_irqs_on arch/x86/entry/common.c:393 [inline]
 [<ffffffff81006d94>] do_fast_syscall_32+0x324/0x8b0 arch/x86/entry/common.c:460
 [<ffffffff838cdec3>] sysenter_flags_fixed+0xd/0x1a

Allocated by task 0:
(stack is not available)

Freed by task 0:
(stack is not available)

The buggy address belongs to the object at ffff8801d6837500
 which belongs to the cache ip_dst_cache of size 208
The buggy address is located 24 bytes inside of
 208-byte region [ffff8801d6837500, ffff8801d68375d0)
The buggy address belongs to the page:
BUG: unable to handle kernel paging request at fffffffba1f6d980
IP: [<ffffffff81227d85>] cpuacct_charge+0x155/0x380 kernel/sched/cpuacct.c:247
PGD 440f067 PUD 0 
Oops: 0000 [#1] PREEMPT SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 6647 Comm: syz-executor3 Not tainted 4.4.152-ge5c5f1f #25
Hardware name: Google Google Compute Engine/Goog[   94.743823] kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
BUG: unable to handle kernel paging request at ffff8801bd19ec68
IP: [<ffff8801bd19ec68>] 0xffff8801bd19ec68
PGD 6330067 PUD 80000001800001e3 
Thread overran stack, or stack corrupted
Oops: 0011 [#2] PREEMPT SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 6647 Comm: syz-executor3 Not tainted 4.4.152-ge5c5f1f #25
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8800b0536000 task.stack: ffff8801bd198000
RIP: 0010:[<ffff8801bd19ec68>]  [<ffff8801bd19ec68>] 0xffff8801bd19ec68
RSP: 0018:ffff8801bd19ec30  EFLAGS: 00010002
RAX: 0000000000000020 RBX: ffffffff83aaae60 RCX: 0000000000000000
RDX: 00000000000003fd RSI: ffffffff8208b481 RDI: ffffffff862ad678
RBP: ffff8801d68375d0 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: ffffffff858f02a7 R12: ffff8801d6837500
R13: 0000000000000020 R14: fffffbfff0c55b0f R15: fffffbfff0c55ad1
FS:  0000000000000000(0000) GS:ffff8801db200000(0063) knlGS:00000000f5795b40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: ffff8801bd19ec68 CR3: 00000001cc79b000 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 ffffffff81490267 ffffffff862ad688 ffffea00075a0dc0 0000000000000000
 ffffffff83aaae60 ffff8801d6837500 ffff8801d68375d0 ffff8801bd19eca8
 ffffffff81490267 ffffffff8208d1af ffffea00075a0dc0 0000000000000000
Call Trace:
Code: ff ff ff c0 0d 5a 07 00 ea ff ff 00 00 00 00 00 00 00 00 60 ae aa 83 ff ff ff ff 00 75 83 d6 01 88 ff ff d0 75 83 d6 01 88 ff ff <a8> ec 19 bd 01 88 ff ff 67 02 49 81 ff ff ff ff af d1 08 82 ff 
RIP  [<ffff8801bd19ec68>] 0xffff8801bd19ec68
 RSP <ffff8801bd19ec30>
CR2: ffff8801bd19ec68
---[ end trace 80c023f0ad4ebccf ]---