IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
==================================================================
BUG: KASAN: slab-out-of-bounds in ip6_tnl_xmit2+0x2043/0x20d0 net/ipv6/ip6_tunnel.c:987
Read of size 16 at addr ffff8801d89f38b0 by task syz-executor112/3692

CPU: 0 PID: 3692 Comm: syz-executor112 Not tainted 4.4.132-gecf86dd #46
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 0000000000000000 88f556a2e85637fe ffff8800b1c36c20 ffffffff81e0df8d
 ffffea0007627c00 ffff8801d89f38b0 0000000000000000 ffff8801d89f38b8
 ffff8801ce46c400 ffff8800b1c36c58 ffffffff8151526c ffff8801d89f38b0
Call Trace:
 [<ffffffff81e0df8d>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81e0df8d>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
 [<ffffffff8151526c>] print_address_description+0x6c/0x216 mm/kasan/report.c:252
 [<ffffffff8151558b>] kasan_report_error mm/kasan/report.c:351 [inline]
 [<ffffffff8151558b>] kasan_report.cold.7+0x175/0x2f7 mm/kasan/report.c:408
 [<ffffffff814f915f>] __asan_report_load_n_noabort+0xf/0x20 mm/kasan/report.c:439
 [<ffffffff83544b03>] ip6_tnl_xmit2+0x2043/0x20d0 net/ipv6/ip6_tunnel.c:987
 [<ffffffff835454a0>] ip4ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1129 [inline]
 [<ffffffff835454a0>] ip6_tnl_xmit+0x910/0xc60 net/ipv6/ip6_tunnel.c:1203
 [<ffffffff82f88281>] __netdev_start_xmit include/linux/netdevice.h:3743 [inline]
 [<ffffffff82f88281>] netdev_start_xmit include/linux/netdevice.h:3752 [inline]
 [<ffffffff82f88281>] xmit_one net/core/dev.c:2759 [inline]
 [<ffffffff82f88281>] dev_hard_start_xmit+0x7b1/0x11c0 net/core/dev.c:2775
 [<ffffffff82f8a610>] __dev_queue_xmit+0x16c0/0x1c80 net/core/dev.c:3207
 [<ffffffff82f8abe7>] dev_queue_xmit+0x17/0x20 net/core/dev.c:3241
 [<ffffffff82f9c415>] neigh_direct_output+0x15/0x20 net/core/neighbour.c:1366
 [<ffffffff8321465b>] dst_neigh_output include/net/dst.h:461 [inline]
 [<ffffffff8321465b>] ip_finish_output2+0x6ab/0x1110 net/ipv4/ip_output.c:213
 [<ffffffff83217c53>] ip_finish_output+0x843/0xbc0 net/ipv4/ip_output.c:288
 [<ffffffff8321b569>] NF_HOOK_COND include/linux/netfilter.h:240 [inline]
 [<ffffffff8321b569>] ip_output+0x219/0x4c0 net/ipv4/ip_output.c:362
 [<ffffffff832184ab>] dst_output include/net/dst.h:498 [inline]
 [<ffffffff832184ab>] ip_local_out+0x9b/0x180 net/ipv4/ip_output.c:119
 [<ffffffff8321e14c>] ip_send_skb+0x3c/0xc0 net/ipv4/ip_output.c:1450
 [<ffffffff832c6583>] udp_send_skb+0x5c3/0xc60 net/ipv4/udp.c:842
 [<ffffffff832cf13e>] udp_sendmsg+0x16ce/0x1bb0 net/ipv4/udp.c:1070
 [<ffffffff834940dd>] udpv6_sendmsg+0x12cd/0x24c0 net/ipv6/udp.c:1173
 [<ffffffff832fec93>] inet_sendmsg+0x203/0x4d0 net/ipv4/af_inet.c:755
 [<ffffffff82f1cdac>] sock_sendmsg_nosec net/socket.c:625 [inline]
 [<ffffffff82f1cdac>] sock_sendmsg+0xcc/0x110 net/socket.c:635
 [<ffffffff82f1e571>] ___sys_sendmsg+0x441/0x880 net/socket.c:1962
 [<ffffffff82f20b4e>] __sys_sendmmsg+0x12e/0x2e0 net/socket.c:2047
 [<ffffffff82f20d35>] SYSC_sendmmsg net/socket.c:2077 [inline]
 [<ffffffff82f20d35>] SyS_sendmmsg+0x35/0x60 net/socket.c:2072
 [<ffffffff838c0225>] entry_SYSCALL_64_fastpath+0x22/0x9e

Allocated by task 3692:
 [<ffffffff810341d6>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63
 [<ffffffff814f8133>] save_stack+0x43/0xd0 mm/kasan/kasan.c:512
 [<ffffffff814f8417>] set_track mm/kasan/kasan.c:524 [inline]
 [<ffffffff814f8417>] kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:616
 [<ffffffff814f4b34>] __kmalloc+0x124/0x310 mm/slub.c:3613
 [<ffffffff82fad1f6>] kmalloc include/linux/slab.h:481 [inline]
 [<ffffffff82fad1f6>] kzalloc include/linux/slab.h:620 [inline]
 [<ffffffff82fad1f6>] neigh_alloc net/core/neighbour.c:285 [inline]
 [<ffffffff82fad1f6>] __neigh_create+0x1d6/0x1b20 net/core/neighbour.c:457
 [<ffffffff831ed73d>] neigh_create include/net/neighbour.h:313 [inline]
 [<ffffffff831ed73d>] ipv4_neigh_lookup+0x4dd/0x700 net/ipv4/route.c:464
 [<ffffffff835430d3>] dst_neigh_lookup include/net/dst.h:466 [inline]
 [<ffffffff835430d3>] ip6_tnl_xmit2+0x613/0x20d0 net/ipv6/ip6_tunnel.c:982
 [<ffffffff835454a0>] ip4ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1129 [inline]
 [<ffffffff835454a0>] ip6_tnl_xmit+0x910/0xc60 net/ipv6/ip6_tunnel.c:1203
 [<ffffffff82f88281>] __netdev_start_xmit include/linux/netdevice.h:3743 [inline]
 [<ffffffff82f88281>] netdev_start_xmit include/linux/netdevice.h:3752 [inline]
 [<ffffffff82f88281>] xmit_one net/core/dev.c:2759 [inline]
 [<ffffffff82f88281>] dev_hard_start_xmit+0x7b1/0x11c0 net/core/dev.c:2775
 [<ffffffff82f8a610>] __dev_queue_xmit+0x16c0/0x1c80 net/core/dev.c:3207
 [<ffffffff82f8abe7>] dev_queue_xmit+0x17/0x20 net/core/dev.c:3241
 [<ffffffff82f9c415>] neigh_direct_output+0x15/0x20 net/core/neighbour.c:1366
 [<ffffffff8321465b>] dst_neigh_output include/net/dst.h:461 [inline]
 [<ffffffff8321465b>] ip_finish_output2+0x6ab/0x1110 net/ipv4/ip_output.c:213
 [<ffffffff83217c53>] ip_finish_output+0x843/0xbc0 net/ipv4/ip_output.c:288
 [<ffffffff8321b569>] NF_HOOK_COND include/linux/netfilter.h:240 [inline]
 [<ffffffff8321b569>] ip_output+0x219/0x4c0 net/ipv4/ip_output.c:362
 [<ffffffff832184ab>] dst_output include/net/dst.h:498 [inline]
 [<ffffffff832184ab>] ip_local_out+0x9b/0x180 net/ipv4/ip_output.c:119
 [<ffffffff8321e14c>] ip_send_skb+0x3c/0xc0 net/ipv4/ip_output.c:1450
 [<ffffffff832c6583>] udp_send_skb+0x5c3/0xc60 net/ipv4/udp.c:842
 [<ffffffff832cf13e>] udp_sendmsg+0x16ce/0x1bb0 net/ipv4/udp.c:1070
 [<ffffffff834940dd>] udpv6_sendmsg+0x12cd/0x24c0 net/ipv6/udp.c:1173
 [<ffffffff832fec93>] inet_sendmsg+0x203/0x4d0 net/ipv4/af_inet.c:755
 [<ffffffff82f1cdac>] sock_sendmsg_nosec net/socket.c:625 [inline]
 [<ffffffff82f1cdac>] sock_sendmsg+0xcc/0x110 net/socket.c:635
 [<ffffffff82f1e571>] ___sys_sendmsg+0x441/0x880 net/socket.c:1962
 [<ffffffff82f20b4e>] __sys_sendmmsg+0x12e/0x2e0 net/socket.c:2047
 [<ffffffff82f20d35>] SYSC_sendmmsg net/socket.c:2077 [inline]
 [<ffffffff82f20d35>] SyS_sendmmsg+0x35/0x60 net/socket.c:2072
 [<ffffffff838c0225>] entry_SYSCALL_64_fastpath+0x22/0x9e

Freed by task 0:
(stack is not available)

The buggy address belongs to the object at ffff8801d89f3600
 which belongs to the cache kmalloc-1024 of size 1024
The buggy address is located 688 bytes inside of
 1024-byte region [ffff8801d89f3600, ffff8801d89f3a00)
The buggy address belongs to the page:
BUG: unable to handle kernel paging request at ffffffffffffff0a
IP: [<ffffffff8344db6a>] ipv6_lonely_lladdr net/ipv6/addrconf.c:3734 [inline]
IP: [<ffffffff8344db6a>] addrconf_dad_completed+0x23a/0x880 net/ipv6/addrconf.c:3764
PGD 440f067 PUD 4411067 PMD 0 
Oops: 0000 [#1] PREEMPT SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 179 Comm: kworker/1:1 Not tainted 4.4.132-gecf86dd #46
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: ipv6_addrconf addrconf_dad_work
task: ffff8800bb908000 task.stack: ffff8800bb928000
RIP: 0010:[<ffffffff8344db6a>]  [<ffffffff8344db6a>] ipv6_lonely_lladdr net/ipv6/addrconf.c:3734 [inline]
RIP: 0010:[<ffffffff8344db6a>]  [<ffffffff8344db6a>] addrconf_dad_completed+0x23a/0x880 net/ipv6/addrconf.c:3764
RSP: 0018:ffff8800bb92fad0  EFLAGS: 00010246
RAX: 0000000000000003 RBX: ffff8800bb137900 RCX: dffffc0000000000
RDX: 0000000000000000 RSI: ffffffff8344dbda RDI: ffffffffffffff0a
RBP: ffff8800bb92fb80 R08: ffffffff85353420 R09: 0000000000000000
R10: 0000000000000001 R11: ffff8800bb908000 R12: fffffffffffffea8
R13: ffff8801d6d32a80 R14: ffff8800bb137a38 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffff0a CR3: 000000000440c000 CR4: 00000000001606f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 ffffffff8122e2a7 ffff8801d6d32a88 ffff8800b2439100 1ffff10017725f5e
 0000000041b58ab3 ffffffff8424135a ffffffff8344d930 ffff8800bb137900
 0000000000000000 ffff8800bb92fb38 ffffffff8122e69b 0000000000000201
Call Trace:
 [<ffffffff83450204>] addrconf_dad_work+0x7c4/0xa80 net/ipv6/addrconf.c:3708
 [<ffffffff81181d5f>] process_one_work+0x7df/0x1600 kernel/workqueue.c:2064
 [<ffffffff81182c59>] worker_thread+0xd9/0xfc0 kernel/workqueue.c:2196
 [<ffffffff81190768>] kthread+0x268/0x300 kernel/kthread.c:211
 [<ffffffff838c0655>] ret_from_fork+0x55/0x80 arch/x86/entry/entry_64.S:510
Code: 62 48 b8 00 00 00 00 00 fc ff df 48 89 fa 48 c1 ea 03 0f b6 14 02 48 89 f8 83 e0 07 83 c0 01 38 d0 7c 08 84 d2 0f 85 a7 05 00 00 <45> 0f b7 bf 0a ff ff ff 66 41 83 ff 20 0f 87 9a 00 00 00 e8 5e 
RIP  [<ffffffff8344db6a>] ipv6_lonely_lladdr net/ipv6/addrconf.c:3734 [inline]
RIP  [<ffffffff8344db6a>] addrconf_dad_completed+0x23a/0x880 net/ipv6/addrconf.c:3764
 RSP <ffff8800bb92fad0>
CR2: ffffffffffffff0a
---[ end trace 5b771efa00acc3f6 ]---