==================================================================
BUG: KASAN: use-after-free in __read_once_size include/linux/compiler.h:218 [inline]
BUG: KASAN: use-after-free in atomic_read arch/x86/include/asm/atomic.h:26 [inline]
BUG: KASAN: use-after-free in __atomic_add_unless arch/x86/include/asm/atomic.h:211 [inline]
BUG: KASAN: use-after-free in atomic_add_unless include/linux/atomic.h:437 [inline]
BUG: KASAN: use-after-free in sk_dst_get include/net/sock.h:1741 [inline]
BUG: KASAN: use-after-free in sk_dst_check+0x372/0x3a0 net/core/sock.c:546
Read of size 4 at addr ffff8800b4792d00 by task syz-executor0/25341

CPU: 0 PID: 25341 Comm: syz-executor0 Not tainted 4.4.168+ #6
 0000000000000000 93ebbcfdc03ca9f8 ffff8800a677f670 ffffffff81aa636d
 ffffea0002d1e480 ffff8800b4792d00 0000000000000000 ffff8800b4792d00
 ffff8800b4792d00 ffff8800a677f6a8 ffffffff8148b16b ffff8800b4792d00
Call Trace:
 [<ffffffff81aa636d>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81aa636d>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
 [<ffffffff8148b16b>] print_address_description+0x6c/0x217 mm/kasan/report.c:252
 [<ffffffff8148b48b>] kasan_report_error mm/kasan/report.c:351 [inline]
 [<ffffffff8148b48b>] kasan_report.cold.6+0x175/0x2f7 mm/kasan/report.c:408
 [<ffffffff81480194>] __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:428
 [<ffffffff821dbb22>] __read_once_size include/linux/compiler.h:218 [inline]
 [<ffffffff821dbb22>] atomic_read arch/x86/include/asm/atomic.h:26 [inline]
 [<ffffffff821dbb22>] __atomic_add_unless arch/x86/include/asm/atomic.h:211 [inline]
 [<ffffffff821dbb22>] atomic_add_unless include/linux/atomic.h:437 [inline]
 [<ffffffff821dbb22>] sk_dst_get include/net/sock.h:1741 [inline]
 [<ffffffff821dbb22>] sk_dst_check+0x372/0x3a0 net/core/sock.c:546
 [<ffffffff8247b87a>] udp_sendmsg+0x112a/0x1c70 net/ipv4/udp.c:1019
 [<ffffffff824a50b3>] inet_sendmsg+0x203/0x4d0 net/ipv4/af_inet.c:755
 [<ffffffff821d1f2b>] sock_sendmsg_nosec net/socket.c:638 [inline]
 [<ffffffff821d1f2b>] sock_sendmsg+0xbb/0x110 net/socket.c:648
 [<ffffffff821d3a51>] ___sys_sendmsg+0x441/0x880 net/socket.c:1975
 [<ffffffff821d7084>] __sys_sendmmsg+0x1d4/0x2e0 net/socket.c:2053
 [<ffffffff822a8182>] C_SYSC_sendmmsg net/compat.c:728 [inline]
 [<ffffffff822a8182>] compat_SyS_sendmmsg+0x32/0x40 net/compat.c:725
 [<ffffffff81006101>] do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline]
 [<ffffffff81006101>] do_fast_syscall_32+0x321/0xa80 arch/x86/entry/common.c:397
 [<ffffffff82717a90>] sysenter_flags_fixed+0xd/0x1a

Allocated by task 25341:
 [<ffffffff8102e3e6>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63
 [<ffffffff8147f1f2>] save_stack mm/kasan/kasan.c:512 [inline]
 [<ffffffff8147f1f2>] set_track mm/kasan/kasan.c:524 [inline]
 [<ffffffff8147f1f2>] kasan_kmalloc.part.1+0x62/0xf0 mm/kasan/kasan.c:616
 [<ffffffff8147f46f>] kasan_kmalloc+0xaf/0xc0 mm/kasan/kasan.c:601
 [<ffffffff8147fa32>] kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:554
 [<ffffffff8147b12c>] slab_post_alloc_hook mm/slub.c:1349 [inline]
 [<ffffffff8147b12c>] slab_alloc_node mm/slub.c:2615 [inline]
 [<ffffffff8147b12c>] slab_alloc mm/slub.c:2623 [inline]
 [<ffffffff8147b12c>] kmem_cache_alloc+0xdc/0x2c0 mm/slub.c:2628
 [<ffffffff82252535>] dst_alloc+0xb5/0x1a0 net/core/dst.c:210
 [<ffffffff823ad7a0>] ipv4_blackhole_route+0x30/0x700 net/ipv4/route.c:2396
 [<ffffffff8254eb15>] make_blackhole net/xfrm/xfrm_policy.c:2161 [inline]
 [<ffffffff8254eb15>] xfrm_lookup_route+0xf5/0x140 net/xfrm/xfrm_policy.c:2331
 [<ffffffff823a1ef0>] ip_route_output_flow+0x90/0xa0 net/ipv4/route.c:2437
 [<ffffffff8247bbd0>] udp_sendmsg+0x1480/0x1c70 net/ipv4/udp.c:1040
 [<ffffffff824a50b3>] inet_sendmsg+0x203/0x4d0 net/ipv4/af_inet.c:755
 [<ffffffff821d1f2b>] sock_sendmsg_nosec net/socket.c:638 [inline]
 [<ffffffff821d1f2b>] sock_sendmsg+0xbb/0x110 net/socket.c:648
 [<ffffffff821d3a51>] ___sys_sendmsg+0x441/0x880 net/socket.c:1975
 [<ffffffff821d7084>] __sys_sendmmsg+0x1d4/0x2e0 net/socket.c:2053
 [<ffffffff822a8182>] C_SYSC_sendmmsg net/compat.c:728 [inline]
 [<ffffffff822a8182>] compat_SyS_sendmmsg+0x32/0x40 net/compat.c:725
 [<ffffffff81006101>] do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline]
 [<ffffffff81006101>] do_fast_syscall_32+0x321/0xa80 arch/x86/entry/common.c:397
 [<ffffffff82717a90>] sysenter_flags_fixed+0xd/0x1a

Freed by task 15476:
 [<ffffffff8102e3e6>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63
 [<ffffffff8147faec>] save_stack mm/kasan/kasan.c:512 [inline]
 [<ffffffff8147faec>] set_track mm/kasan/kasan.c:524 [inline]
 [<ffffffff8147faec>] kasan_slab_free+0xac/0x190 mm/kasan/kasan.c:589
 [<ffffffff8147c7ee>] slab_free_hook mm/slub.c:1383 [inline]
 [<ffffffff8147c7ee>] slab_free_freelist_hook mm/slub.c:1405 [inline]
 [<ffffffff8147c7ee>] slab_free mm/slub.c:2859 [inline]
 [<ffffffff8147c7ee>] kmem_cache_free+0xbe/0x350 mm/slub.c:2881
 [<ffffffff8225288c>] dst_destroy.part.1+0x26c/0x330 net/core/dst.c:270
 [<ffffffff82252b23>] dst_destroy net/core/dst.c:252 [inline]
 [<ffffffff82252b23>] dst_gc_task+0x1b3/0x510 net/core/dst.c:89
 [<ffffffff81123274>] process_one_work+0x824/0x1730 kernel/workqueue.c:2064
 [<ffffffff81124259>] worker_thread+0xd9/0x1060 kernel/workqueue.c:2196
 [<ffffffff811347f8>] kthread+0x268/0x300 kernel/kthread.c:211
 [<ffffffff82716705>] ret_from_fork+0x55/0x80 arch/x86/entry/entry_64.S:537

The buggy address belongs to the object at ffff8800b4792c80
 which belongs to the cache ip_dst_cache of size 208
The buggy address is located 128 bytes inside of
 208-byte region [ffff8800b4792c80, ffff8800b4792d50)
The buggy address belongs to the page:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral protection fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 1 PID: 2126 Comm: syz-executor3 Not tainted 4.4.168+ #6
task: ffff8801d509af80 task.stack: ffff8801c3610000
RIP: 0010:[<ffffffff811fcc21>]  [<ffffffff811fcc21>] atomic_inc arch/x86/include/asm/atomic.h:91 [inline]
RIP: 0010:[<ffffffff811fcc21>]  [<ffffffff811fcc21>] __lock_acquire+0x571/0x5530 kernel/locking/lockdep.c:3105
RSP: 0018:ffff8801db7079c0  EFLAGS: 00010086
RAX: 0000000000000000 RBX: fec001b400005f35 RCX: ffffffff81200590
RDX: 0000000000000000 RSI: 0000000000000008 RDI: ffff8800b47934a8
RBP: ffff8801db707b60 R08: 0000000000000001 R09: 0000000000000001
R10: ffffffff82835d40 R11: ffffffff831a49b8 R12: ffff8800b47934a0
R13: 0000000000000001 R14: 0000000000000000 R15: ffff8801d509af80
FS:  0000000000000000(0000) GS:ffff8801db700000(0063) knlGS:00000000091df900
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 00007fbba68551c4 CR3: 00000000a88ad000 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 ffff8801d509b910 ffff8801d509af80 ffff8801db707b80 ffffffff811fd0a6
 0000000041b58ab3 ffffffff82c4be10 ffffffff811fc6b0 000000000000001d
 ffffffff82ea7360 0000000000000000 ffff8801d509b8c0 ffff880100000001
Call Trace:
 <IRQ> 
 [<ffffffff8120384e>] lock_acquire+0x15e/0x450 kernel/locking/lockdep.c:3592
 [<ffffffff82715426>] __raw_spin_lock include/linux/spinlock_api_smp.h:144 [inline]
 [<ffffffff82715426>] _raw_spin_lock+0x36/0x50 kernel/locking/spinlock.c:151
 [<ffffffff810fdec5>] spin_lock include/linux/spinlock.h:302 [inline]
 [<ffffffff810fdec5>] __lock_task_sighand+0x115/0x470 kernel/signal.c:1248
 [<ffffffff810ff8f8>] lock_task_sighand include/linux/sched.h:2985 [inline]
 [<ffffffff810ff8f8>] send_sigqueue+0xe8/0x870 kernel/signal.c:1545
 [<ffffffff812645cf>] posix_timer_event+0x15f/0x270 kernel/time/posix-timers.c:437
 [<ffffffff8126477e>] posix_timer_fn+0x9e/0x280 kernel/time/posix-timers.c:465
 [<ffffffff8125d200>] __run_hrtimer kernel/time/hrtimer.c:1261 [inline]
 [<ffffffff8125d200>] __hrtimer_run_queues+0x390/0xfc0 kernel/time/hrtimer.c:1325
 [<ffffffff8125fe81>] hrtimer_interrupt+0x1b1/0x430 kernel/time/hrtimer.c:1359
 [<ffffffff8108b694>] local_apic_timer_interrupt+0x74/0xa0 arch/x86/kernel/apic/apic.c:901
 [<ffffffff8271897c>] smp_apic_timer_interrupt+0x7c/0xb0 arch/x86/kernel/apic/apic.c:925
 [<ffffffff82717cdd>] apic_timer_interrupt+0x9d/0xb0 arch/x86/entry/entry_64.S:768
 <EOI> 
 [<ffffffff81296dfd>] smp_call_function_many+0x5bd/0x720 kernel/smp.c:435
 [<ffffffff81296fbd>] smp_call_function+0x5d/0xa0 kernel/smp.c:491
 [<ffffffff8129702f>] on_each_cpu+0x2f/0xc0 kernel/smp.c:597
 [<ffffffff810bd601>] flush_tlb_kernel_range+0x81/0xd0 arch/x86/mm/tlb.c:425
 [<ffffffff814556bf>] __purge_vmap_area_lazy+0x3af/0xee0 mm/vmalloc.c:644
 [<ffffffff81456803>] try_purge_vmap_area_lazy mm/vmalloc.c:663 [inline]
 [<ffffffff81456803>] free_vmap_area_noflush+0x163/0x190 mm/vmalloc.c:686
 [<ffffffff8145a975>] free_unmap_vmap_area_noflush mm/vmalloc.c:696 [inline]
 [<ffffffff8145a975>] free_unmap_vmap_area mm/vmalloc.c:705 [inline]
 [<ffffffff8145a975>] remove_vm_area+0x135/0x180 mm/vmalloc.c:1445
 [<ffffffff8145aafd>] __vunmap+0x13d/0x450 mm/vmalloc.c:1473
 [<ffffffff8145aed0>] vfree+0x50/0x110 mm/vmalloc.c:1521
 [<ffffffff826874ad>] compat_copy_entries_to_user net/ipv6/netfilter/ip6_tables.c:1778 [inline]
 [<ffffffff826874ad>] compat_get_entries net/ipv6/netfilter/ip6_tables.c:1812 [inline]
 [<ffffffff826874ad>] compat_do_ip6t_get_ctl+0x62d/0x910 net/ipv6/netfilter/ip6_tables.c:1844
 [<ffffffff822f89ae>] compat_nf_sockopt net/netfilter/nf_sockopt.c:138 [inline]
 [<ffffffff822f89ae>] compat_nf_getsockopt+0x8e/0x130 net/netfilter/nf_sockopt.c:162
 [<ffffffff825f95d8>] compat_ipv6_getsockopt+0x1f8/0x2f0 net/ipv6/ipv6_sockglue.c:1382
 [<ffffffff823dfa97>] inet_csk_compat_getsockopt+0x97/0x120 net/ipv4/inet_connection_sock.c:901
 [<ffffffff823f4cad>] compat_tcp_getsockopt+0x3d/0x70 net/ipv4/tcp.c:2958
 [<ffffffff821d8a94>] compat_sock_common_getsockopt+0xb4/0x150 net/core/sock.c:2629
 [<ffffffff822a7d0a>] C_SYSC_getsockopt net/compat.c:506 [inline]
 [<ffffffff822a7d0a>] compat_SyS_getsockopt+0x16a/0x570 net/compat.c:489
 [<ffffffff822a8904>] C_SYSC_socketcall net/compat.c:840 [inline]
 [<ffffffff822a8904>] compat_SyS_socketcall+0x534/0x630 net/compat.c:771
 [<ffffffff81006101>] do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline]
 [<ffffffff81006101>] do_fast_syscall_32+0x321/0xa80 arch/x86/entry/common.c:397
 [<ffffffff82717a90>] sysenter_flags_fixed+0xd/0x1a
Code: 00 fc ff df 44 89 f0 49 8d 7c c4 08 48 89 f9 48 c1 e9 03 80 3c 11 00 0f 85 70 39 00 00 49 8b 5c c4 08 48 85 db 0f 84 8e 27 00 00 <f0> ff 83 98 01 00 00 49 8d 87 c0 08 00 00 48 89 c2 48 89 44 24 
RIP  [<ffffffff811fcc21>] __lock_acquire+0x571/0x5530 kernel/locking/lockdep.c:3100
 RSP <ffff8801db7079c0>
---[ end trace 133a156870a635df ]---