==================================================================
BUG: KASAN: use-after-free in ipv6_get_dsfield include/net/dsfield.h:23 [inline]
BUG: KASAN: use-after-free in ip6ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1362 [inline]
BUG: KASAN: use-after-free in ip6_tnl_start_xmit+0x14db/0x1680 net/ipv6/ip6_tunnel.c:1389
Read of size 2 at addr ffff8801b3064090 by task syz-executor2/22841

CPU: 0 PID: 22841 Comm: syz-executor2 Not tainted 4.9.131+ #102
 ffff8801ac616fd8 ffffffff81b37029 ffffea0006cc1900 ffff8801b3064090
 0000000000000000 ffff8801b3064090 ffff8801b3064090 ffff8801ac617010
 ffffffff81500aed ffff8801b3064090 0000000000000002 0000000000000000
Call Trace:
 [<ffffffff81b37029>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81b37029>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff81500aed>] print_address_description+0x6c/0x234 mm/kasan/report.c:256
 [<ffffffff81500ef7>] kasan_report_error mm/kasan/report.c:355 [inline]
 [<ffffffff81500ef7>] kasan_report.cold.6+0x242/0x2fe mm/kasan/report.c:412
 [<ffffffff814f30c4>] __asan_report_load2_noabort+0x14/0x20 mm/kasan/report.c:431
 [<ffffffff8279d9ab>] ipv6_get_dsfield include/net/dsfield.h:23 [inline]
 [<ffffffff8279d9ab>] ip6ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1362 [inline]
 [<ffffffff8279d9ab>] ip6_tnl_start_xmit+0x14db/0x1680 net/ipv6/ip6_tunnel.c:1389
 [<ffffffff82302307>] __netdev_start_xmit include/linux/netdevice.h:4062 [inline]
 [<ffffffff82302307>] netdev_start_xmit include/linux/netdevice.h:4071 [inline]
 [<ffffffff82302307>] xmit_one net/core/dev.c:2955 [inline]
 [<ffffffff82302307>] dev_hard_start_xmit+0x197/0x8b0 net/core/dev.c:2971
 [<ffffffff82303e5f>] __dev_queue_xmit+0x117f/0x1b90 net/core/dev.c:3451
 [<ffffffff82304887>] dev_queue_xmit+0x17/0x20 net/core/dev.c:3484
 [<ffffffff8231c9c5>] neigh_direct_output+0x15/0x20 net/core/neighbour.c:1365
 [<ffffffff8267caee>] dst_neigh_output include/net/dst.h:470 [inline]
 [<ffffffff8267caee>] ip6_finish_output2+0xb0e/0x1d10 net/ipv6/ip6_output.c:119
 [<ffffffff8268d634>] ip6_finish_output+0x334/0x980 net/ipv6/ip6_output.c:145
 [<ffffffff8268de6a>] NF_HOOK_COND include/linux/netfilter.h:246 [inline]
 [<ffffffff8268de6a>] ip6_output+0x1ea/0x6d0 net/ipv6/ip6_output.c:162
 [<ffffffff827a8ddb>] dst_output include/net/dst.h:507 [inline]
 [<ffffffff827a8ddb>] ip6_local_out+0x9b/0x180 net/ipv6/output_core.c:176
 [<ffffffff82690051>] ip6_send_skb+0xa1/0x340 net/ipv6/ip6_output.c:1751
 [<ffffffff826f2793>] udp_v6_send_skb+0x843/0xe70 net/ipv6/udp.c:974
 [<ffffffff826f509b>] udpv6_sendmsg+0x1ebb/0x2430 net/ipv6/udp.c:1246
 [<ffffffff825833a3>] inet_sendmsg+0x203/0x4d0 net/ipv4/af_inet.c:770
 [<ffffffff8228deab>] sock_sendmsg_nosec net/socket.c:648 [inline]
 [<ffffffff8228deab>] sock_sendmsg+0xbb/0x110 net/socket.c:658
 [<ffffffff8228f90a>] ___sys_sendmsg+0x47a/0x840 net/socket.c:1982
 [<ffffffff82292e11>] __sys_sendmmsg+0x161/0x3d0 net/socket.c:2072
 [<ffffffff822930b5>] SYSC_sendmmsg net/socket.c:2103 [inline]
 [<ffffffff822930b5>] SyS_sendmmsg+0x35/0x60 net/socket.c:2098
 [<ffffffff810056ef>] do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285
 [<ffffffff828037d3>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Allocated by task 22841:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack mm/kasan/kasan.c:505 [inline]
 set_track mm/kasan/kasan.c:517 [inline]
 kasan_kmalloc.part.1+0x62/0xf0 mm/kasan/kasan.c:609
 kasan_kmalloc+0xaf/0xc0 mm/kasan/kasan.c:594
 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:547
 slab_post_alloc_hook mm/slab.h:417 [inline]
 slab_alloc_node mm/slub.c:2715 [inline]
 slab_alloc mm/slub.c:2723 [inline]
 __kmalloc_track_caller+0xf0/0x2d0 mm/slub.c:4232
 __kmalloc_reserve.isra.5+0x33/0xc0 net/core/skbuff.c:138
 __alloc_skb+0x11a/0x5b0 net/core/skbuff.c:231
 alloc_skb include/linux/skbuff.h:919 [inline]
 alloc_skb_with_frags+0xaf/0x4e0 net/core/skbuff.c:4685
 sock_alloc_send_pskb+0x59e/0x740 net/core/sock.c:1893
 sock_alloc_send_skb+0x32/0x40 net/core/sock.c:1910
 ip6_ufo_append_data net/ipv6/ip6_output.c:1145 [inline]
 __ip6_append_data.isra.3+0x1a29/0x3460 net/ipv6/ip6_output.c:1408
 ip6_make_skb+0x291/0x480 net/ipv6/ip6_output.c:1831
 udpv6_sendmsg+0x1e89/0x2430 net/ipv6/udp.c:1240
 inet_sendmsg+0x203/0x4d0 net/ipv4/af_inet.c:770
 sock_sendmsg_nosec net/socket.c:648 [inline]
 sock_sendmsg+0xbb/0x110 net/socket.c:658
 ___sys_sendmsg+0x47a/0x840 net/socket.c:1982
 __sys_sendmmsg+0x161/0x3d0 net/socket.c:2072
 SYSC_sendmmsg net/socket.c:2103 [inline]
 SyS_sendmmsg+0x35/0x60 net/socket.c:2098
 do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285
 entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Freed by task 22841:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack mm/kasan/kasan.c:505 [inline]
 set_track mm/kasan/kasan.c:517 [inline]
 kasan_slab_free+0xac/0x190 mm/kasan/kasan.c:582
 slab_free_hook mm/slub.c:1355 [inline]
 slab_free_freelist_hook mm/slub.c:1377 [inline]
 slab_free mm/slub.c:2958 [inline]
 kfree+0xfb/0x310 mm/slub.c:3878
 skb_free_head+0x8b/0xb0 net/core/skbuff.c:580
 pskb_expand_head+0x457/0x8a0 net/core/skbuff.c:1246
 skb_header_unclone include/linux/skbuff.h:1359 [inline]
 iptunnel_handle_offloads+0x3f0/0x520 net/ipv4/ip_tunnel_core.c:169
 ip6ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1359 [inline]
 ip6_tnl_start_xmit+0x4ca/0x1680 net/ipv6/ip6_tunnel.c:1389
 __netdev_start_xmit include/linux/netdevice.h:4062 [inline]
 netdev_start_xmit include/linux/netdevice.h:4071 [inline]
 xmit_one net/core/dev.c:2955 [inline]
 dev_hard_start_xmit+0x197/0x8b0 net/core/dev.c:2971
 __dev_queue_xmit+0x117f/0x1b90 net/core/dev.c:3451
 dev_queue_xmit+0x17/0x20 net/core/dev.c:3484
 neigh_direct_output+0x15/0x20 net/core/neighbour.c:1365
 dst_neigh_output include/net/dst.h:470 [inline]
 ip6_finish_output2+0xb0e/0x1d10 net/ipv6/ip6_output.c:119
 ip6_finish_output+0x334/0x980 net/ipv6/ip6_output.c:145
 NF_HOOK_COND include/linux/netfilter.h:246 [inline]
 ip6_output+0x1ea/0x6d0 net/ipv6/ip6_output.c:162
 dst_output include/net/dst.h:507 [inline]
 ip6_local_out+0x9b/0x180 net/ipv6/output_core.c:176
 ip6_send_skb+0xa1/0x340 net/ipv6/ip6_output.c:1751
 udp_v6_send_skb+0x843/0xe70 net/ipv6/udp.c:974
 udpv6_sendmsg+0x1ebb/0x2430 net/ipv6/udp.c:1246
 inet_sendmsg+0x203/0x4d0 net/ipv4/af_inet.c:770
 sock_sendmsg_nosec net/socket.c:648 [inline]
 sock_sendmsg+0xbb/0x110 net/socket.c:658
 ___sys_sendmsg+0x47a/0x840 net/socket.c:1982
 __sys_sendmmsg+0x161/0x3d0 net/socket.c:2072
 SYSC_sendmmsg net/socket.c:2103 [inline]
 SyS_sendmmsg+0x35/0x60 net/socket.c:2098
 do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285
 entry_SYSCALL_64_after_swapgs+0x5d/0xdb

The buggy address belongs to the object at ffff8801b3064000
 which belongs to the cache kmalloc-1024 of size 1024
The buggy address is located 144 bytes inside of
 1024-byte region [ffff8801b3064000, ffff8801b3064400)
The buggy address belongs to the page:
page:ffffea0006cc1900 count:1 mapcount:0 mapping:          (null) index:0x0 compound_mapcount: 0
flags: 0x4000000000004080(slab|head)
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801b3063f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8801b3064000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8801b3064080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                         ^
 ffff8801b3064100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8801b3064180: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================