==================================================================
BUG: KASAN: slab-out-of-bounds in memcpy include/linux/string.h:345 [inline]
BUG: KASAN: slab-out-of-bounds in eth_header_parse+0x88/0xb0 net/ethernet/eth.c:215
Write of size 6 at addr ffff88019fbafffc by task syz-executor2/31211

CPU: 0 PID: 31211 Comm: syz-executor2 Not tainted 4.18.0-rc7+ #170
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1c9/0x2b4 lib/dump_stack.c:113
 print_address_description+0x6c/0x20b mm/kasan/report.c:256
 kasan_report_error mm/kasan/report.c:354 [inline]
 kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412
 check_memory_region_inline mm/kasan/kasan.c:260 [inline]
 check_memory_region+0x13e/0x1b0 mm/kasan/kasan.c:267
 memcpy+0x37/0x50 mm/kasan/kasan.c:303
 memcpy include/linux/string.h:345 [inline]
 eth_header_parse+0x88/0xb0 net/ethernet/eth.c:215
 dev_parse_header include/linux/netdevice.h:2878 [inline]
 tpacket_rcv+0xcf7/0x3210 net/packet/af_packet.c:2335
 deliver_skb net/core/dev.c:1924 [inline]
 deliver_ptype_list_skb net/core/dev.c:1939 [inline]
 __netif_receive_skb_core+0x1c39/0x3af0 net/core/dev.c:4840
 __netif_receive_skb_one_core+0xd0/0x200 net/core/dev.c:4880
 __netif_receive_skb+0x2c/0x1e0 net/core/dev.c:4992
 process_backlog+0x219/0x760 net/core/dev.c:5798
 napi_poll net/core/dev.c:6218 [inline]
 net_rx_action+0x7a5/0x1920 net/core/dev.c:6284
 __do_softirq+0x2e8/0xb17 kernel/softirq.c:292
 do_softirq_own_stack+0x2a/0x40 arch/x86/entry/entry_64.S:1046
 </IRQ>
 do_softirq.part.18+0x155/0x1a0 kernel/softirq.c:336
 do_softirq arch/x86/include/asm/preempt.h:23 [inline]
 __local_bh_enable_ip+0x1ec/0x230 kernel/softirq.c:189
 local_bh_enable include/linux/bottom_half.h:32 [inline]
 rcu_read_unlock_bh include/linux/rcupdate.h:725 [inline]
 ip_finish_output2+0xaba/0x1860 net/ipv4/ip_output.c:231
 ip_finish_output+0x841/0xfa0 net/ipv4/ip_output.c:317
 NF_HOOK_COND include/linux/netfilter.h:276 [inline]
 ip_output+0x223/0x880 net/ipv4/ip_output.c:405
 dst_output include/net/dst.h:444 [inline]
 ip_local_out+0xc5/0x1b0 net/ipv4/ip_output.c:124
 __ip_queue_xmit+0x9b6/0x1f20 net/ipv4/ip_output.c:505
 ip_queue_xmit+0x56/0x70 include/net/ip.h:197
 __tcp_transmit_skb+0x1cd2/0x4000 net/ipv4/tcp_output.c:1159
 tcp_transmit_skb net/ipv4/tcp_output.c:1175 [inline]
 tcp_send_syn_data net/ipv4/tcp_output.c:3451 [inline]
 tcp_connect+0x22cd/0x47f0 net/ipv4/tcp_output.c:3490
 tcp_v4_connect+0x1950/0x1d70 net/ipv4/tcp_ipv4.c:315
 __inet_stream_connect+0x964/0x1150 net/ipv4/af_inet.c:655
 tcp_sendmsg_fastopen net/ipv4/tcp.c:1161 [inline]
 tcp_sendmsg_locked+0x28b7/0x3f20 net/ipv4/tcp.c:1208
 tcp_sendmsg+0x2f/0x50 net/ipv4/tcp.c:1443
 inet_sendmsg+0x1a1/0x690 net/ipv4/af_inet.c:798
 sock_sendmsg_nosec net/socket.c:640 [inline]
 sock_sendmsg+0xd5/0x120 net/socket.c:650
 __sys_sendto+0x3d7/0x670 net/socket.c:1805
 __do_sys_sendto net/socket.c:1817 [inline]
 __se_sys_sendto net/socket.c:1813 [inline]
 __x64_sys_sendto+0xe1/0x1a0 net/socket.c:1813
 do_syscall_64+0x1b9/0x820 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x456b29
Code: fd b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 00 66 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 0f 83 cb b4 fb ff c3 66 2e 0f 1f 84 00 00 00 00 
RSP: 002b:00007f781abd4c78 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f781abd56d4 RCX: 0000000000456b29
RDX: 00000000000000a4 RSI: 0000000020000000 RDI: 0000000000000015
RBP: 00000000009300a0 R08: 0000000020e68000 R09: 0000000000000010
R10: 00000000200007fe R11: 0000000000000246 R12: 00000000ffffffff
R13: 00000000004d3608 R14: 00000000004c8297 R15: 0000000000000000

The buggy address belongs to the page:
page:ffffea00067ee800 count:1 mapcount:0 mapping:0000000000000000 index:0x0 compound_mapcount: 0
flags: 0x2fffc0000008000(head)
raw: 02fffc0000008000 dead000000000100 dead000000000200 0000000000000000
raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88019fbaff00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff88019fbaff80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff88019fbb0000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                   ^
 ffff88019fbb0080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88019fbb0100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================