==================================================================
BUG: KASAN: use-after-free in l2tp_session_create+0xdf8/0x1030 net/l2tp/l2tp_core.c:1756
Read of size 4 at addr ffff8800ad5bb260 by task syz-executor3/20819

CPU: 0 PID: 20819 Comm: syz-executor3 Not tainted 4.4.147-ga5fc665 #80
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 0000000000000000 20a29ae066e79602 ffff8801c816faa8 ffffffff81e12a4d
 ffffea0002b56e80 ffff8800ad5bb260 0000000000000000 ffff8800ad5bb260
 ffff8801c816fd50 ffff8801c816fae0 ffffffff81517fd6 ffff8800ad5bb260
Call Trace:
 [<ffffffff81e12a4d>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81e12a4d>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
 [<ffffffff81517fd6>] print_address_description+0x6c/0x216 mm/kasan/report.c:252
 [<ffffffff815182f5>] kasan_report_error mm/kasan/report.c:351 [inline]
 [<ffffffff815182f5>] kasan_report.cold.7+0x175/0x2f7 mm/kasan/report.c:408
 [<ffffffff814fbdc4>] __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:428
 [<ffffffff835a7408>] l2tp_session_create+0xdf8/0x1030 net/l2tp/l2tp_core.c:1756
 [<ffffffff835ab350>] pppol2tp_connect+0x10f0/0x1910 net/l2tp/l2tp_ppp.c:725
 [<ffffffff82f24298>] SYSC_connect+0x1b8/0x300 net/socket.c:1558
 [<ffffffff82f26bd4>] SyS_connect+0x24/0x30 net/socket.c:1539
 [<ffffffff838c8c65>] entry_SYSCALL_64_fastpath+0x22/0x9e

Allocated by task 20819:
 [<ffffffff81034676>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63
 [<ffffffff814fae93>] save_stack+0x43/0xd0 mm/kasan/kasan.c:512
 [<ffffffff814fb177>] set_track mm/kasan/kasan.c:524 [inline]
 [<ffffffff814fb177>] kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:616
 [<ffffffff814f7524>] kmem_cache_alloc_trace+0x104/0x2c0 mm/slub.c:2642
 [<ffffffff835a2548>] kmalloc include/linux/slab.h:476 [inline]
 [<ffffffff835a2548>] kzalloc include/linux/slab.h:620 [inline]
 [<ffffffff835a2548>] l2tp_tunnel_create+0x438/0x1060 net/l2tp/l2tp_core.c:1552
 [<ffffffff835ab6c8>] pppol2tp_connect+0x1468/0x1910 net/l2tp/l2tp_ppp.c:690
 [<ffffffff82f24298>] SYSC_connect+0x1b8/0x300 net/socket.c:1558
 [<ffffffff82f26bd4>] SyS_connect+0x24/0x30 net/socket.c:1539
 [<ffffffff838c8c65>] entry_SYSCALL_64_fastpath+0x22/0x9e

Freed by task 20833:
 [<ffffffff81034676>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63
 [<ffffffff814fae93>] save_stack+0x43/0xd0 mm/kasan/kasan.c:512
 [<ffffffff814fb7c2>] set_track mm/kasan/kasan.c:524 [inline]
 [<ffffffff814fb7c2>] kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:589
 [<ffffffff814f8cc4>] slab_free_hook mm/slub.c:1383 [inline]
 [<ffffffff814f8cc4>] slab_free_freelist_hook mm/slub.c:1405 [inline]
 [<ffffffff814f8cc4>] slab_free mm/slub.c:2859 [inline]
 [<ffffffff814f8cc4>] kfree+0xf4/0x310 mm/slub.c:3749
 [<ffffffff812880f9>] __rcu_reclaim kernel/rcu/rcu.h:113 [inline]
 [<ffffffff812880f9>] rcu_do_batch kernel/rcu/tree.c:2705 [inline]
 [<ffffffff812880f9>] invoke_rcu_callbacks kernel/rcu/tree.c:2973 [inline]
 [<ffffffff812880f9>] __rcu_process_callbacks kernel/rcu/tree.c:2940 [inline]
 [<ffffffff812880f9>] rcu_process_callbacks+0xa59/0x1440 kernel/rcu/tree.c:2957
 [<ffffffff838cc17c>] __do_softirq+0x22c/0xa1a kernel/softirq.c:273

The buggy address belongs to the object at ffff8800ad5bb180
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 224 bytes inside of
 512-byte region [ffff8800ad5bb180, ffff8800ad5bb380)
The buggy address belongs to the page:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory access[  333.549176] ------------[ cut here ]------------
WARNING: CPU: 1 PID: 20812 at kernel/sched/core.c:7946 __might_sleep+0x138/0x1a0 kernel/sched/core.c:7941()
do not call blocking ops when !TASK_RUNNING; state=1 set at [<ffffffff838c6712>] do_nanosleep+0x102/0x4f0 kernel/time/hrtimer.c:1502