nf_conntrack: automatic helper assignment is deprecated and it will be removed soon. Use the iptables CT target to attach helpers instead.
==================================================================
BUG: KASAN: slab-out-of-bounds in get_tpkt_data.isra.0+0x8c8/0x980 net/netfilter/nf_conntrack_h323_main.c:218
Write of size 2 at addr ffff8801d8f4b062 by task syz-executor.5/5654

CPU: 0 PID: 5654 Comm: syz-executor.5 Not tainted 4.4.174+ #4
 0000000000000000 821261b4d3d7fc1b ffff8801db606e68 ffffffff81aad1a1
 0000000000000001 ffffea000763d2c0 ffff8801d8f4b062 0000000000000002
 0000000000000001 ffff8801db606ea0 ffffffff81490120 0000000000000001
Call Trace:
 <IRQ>  [<ffffffff81aad1a1>] __dump_stack lib/dump_stack.c:15 [inline]
 <IRQ>  [<ffffffff81aad1a1>] dump_stack+0xc1/0x120 lib/dump_stack.c:51
 [<ffffffff81490120>] print_address_description+0x6f/0x21b mm/kasan/report.c:252
 [<ffffffff81490358>] kasan_report_error mm/kasan/report.c:351 [inline]
 [<ffffffff81490358>] kasan_report mm/kasan/report.c:408 [inline]
 [<ffffffff81490358>] kasan_report.cold+0x8c/0x2be mm/kasan/report.c:393
 [<ffffffff81484f37>] __asan_report_store2_noabort+0x17/0x20 mm/kasan/report.c:432
 [<ffffffff823549d8>] get_tpkt_data.isra.0+0x8c8/0x980 net/netfilter/nf_conntrack_h323_main.c:218
 [<ffffffff8235711a>] q931_help+0x1aa/0x1020 net/netfilter/nf_conntrack_h323_main.c:1177
 [<ffffffff82690223>] ipv6_helper+0x303/0x440 net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c:131
 [<ffffffff822f84a6>] nf_iterate+0x186/0x220 net/netfilter/core.c:274
 [<ffffffff822f86f6>] nf_hook_slow+0x1b6/0x340 net/netfilter/core.c:306
 [<ffffffff825b08e4>] nf_hook_thresh include/linux/netfilter.h:187 [inline]
 [<ffffffff825b08e4>] NF_HOOK_COND include/linux/netfilter.h:239 [inline]
 [<ffffffff825b08e4>] ip6_output+0x284/0x520 net/ipv6/ip6_output.c:145
 [<ffffffff825a8df6>] dst_output include/net/dst.h:498 [inline]
 [<ffffffff825a8df6>] NF_HOOK_THRESH include/linux/netfilter.h:226 [inline]
 [<ffffffff825a8df6>] NF_HOOK include/linux/netfilter.h:249 [inline]
 [<ffffffff825a8df6>] ip6_xmit+0xc76/0x1a60 net/ipv6/ip6_output.c:240
binder: 5672:5674 unknown command 1088774917
binder: 5672:5674 ioctl c0306201 20012000 returned -22
binder: 5672:5674 BC_REQUEST_DEATH_NOTIFICATION invalid ref 0
binder: 5672:5674 unknown command 37644
binder: 5672:5674 ioctl c0306201 2000dfd0 returned -22
 [<ffffffff8264972a>] tcp_v6_send_response.constprop.0+0xa0a/0x11f0 net/ipv6/tcp_ipv6.c:834
 [<ffffffff8264a42c>] tcp_v6_send_reset+0x25c/0x470 net/ipv6/tcp_ipv6.c:904
 [<ffffffff8264c5c2>] tcp_v6_rcv+0xdb2/0x30b0 net/ipv6/tcp_ipv6.c:1502
 [<ffffffff825b3c1d>] ip6_input_finish+0x57d/0x14f0 net/ipv6/ip6_input.c:248
 [<ffffffff825b66a8>] NF_HOOK_THRESH include/linux/netfilter.h:226 [inline]
 [<ffffffff825b66a8>] NF_HOOK include/linux/netfilter.h:249 [inline]
 [<ffffffff825b66a8>] ip6_input+0xf8/0x1f0 net/ipv6/ip6_input.c:280
 [<ffffffff825b317d>] dst_input include/net/dst.h:504 [inline]
 [<ffffffff825b317d>] ip6_rcv_finish+0x14d/0x670 net/ipv6/ip6_input.c:62
 [<ffffffff825b5b51>] NF_HOOK_THRESH include/linux/netfilter.h:226 [inline]
 [<ffffffff825b5b51>] NF_HOOK include/linux/netfilter.h:249 [inline]
 [<ffffffff825b5b51>] ipv6_rcv+0xfc1/0x1a20 net/ipv6/ip6_input.c:186
 [<ffffffff82230640>] __netif_receive_skb_core+0x1300/0x2950 net/core/dev.c:4041
 [<ffffffff82238bd8>] __netif_receive_skb+0x58/0x1c0 net/core/dev.c:4076
 [<ffffffff8223fec0>] process_backlog+0x200/0x630 net/core/dev.c:4673
 [<ffffffff8223f2f7>] napi_poll net/core/dev.c:4911 [inline]
 [<ffffffff8223f2f7>] net_rx_action+0x367/0xd30 net/core/dev.c:4976
 [<ffffffff8271bb16>] __do_softirq+0x226/0xa3f kernel/softirq.c:273
 [<ffffffff82719cdc>] do_softirq_own_stack+0x1c/0x30 arch/x86/entry/entry_64.S:956
 <EOI>  [<ffffffff810e1744>] do_softirq.part.0+0x54/0x60 kernel/softirq.c:317
 [<ffffffff810e181c>] do_softirq kernel/softirq.c:309 [inline]
 [<ffffffff810e181c>] __local_bh_enable_ip+0xcc/0xe0 kernel/softirq.c:170
 [<ffffffff8259f8bf>] local_bh_enable include/linux/bottom_half.h:31 [inline]
 [<ffffffff8259f8bf>] rcu_read_unlock_bh include/linux/rcupdate.h:957 [inline]
 [<ffffffff8259f8bf>] ip6_finish_output2+0xa0f/0x1dc0 net/ipv6/ip6_output.c:114
 [<ffffffff825b0203>] ip6_finish_output+0x2f3/0x750 net/ipv6/ip6_output.c:131
 [<ffffffff825b0814>] NF_HOOK_COND include/linux/netfilter.h:240 [inline]
 [<ffffffff825b0814>] ip6_output+0x1b4/0x520 net/ipv6/ip6_output.c:145
 [<ffffffff825a8df6>] dst_output include/net/dst.h:498 [inline]
 [<ffffffff825a8df6>] NF_HOOK_THRESH include/linux/netfilter.h:226 [inline]
 [<ffffffff825a8df6>] NF_HOOK include/linux/netfilter.h:249 [inline]
 [<ffffffff825a8df6>] ip6_xmit+0xc76/0x1a60 net/ipv6/ip6_output.c:240
 [<ffffffff8266622c>] inet6_csk_xmit+0x24c/0x4b0 net/ipv6/inet6_connection_sock.c:176
 [<ffffffff82431dd4>] __tcp_transmit_skb+0x1904/0x2cf0 net/ipv4/tcp_output.c:1034
 [<ffffffff82439e83>] tcp_transmit_skb net/ipv4/tcp_output.c:1047 [inline]
 [<ffffffff82439e83>] tcp_send_syn_data net/ipv4/tcp_output.c:3259 [inline]
 [<ffffffff82439e83>] tcp_connect+0x1bd3/0x31b0 net/ipv4/tcp_output.c:3294
 [<ffffffff82646631>] tcp_v6_connect+0x1391/0x1b30 net/ipv6/tcp_ipv6.c:294
 [<ffffffff824a7a2f>] __inet_stream_connect+0x2cf/0xc70 net/ipv4/af_inet.c:615
 [<ffffffff823fc71d>] tcp_sendmsg_fastopen net/ipv4/tcp.c:1092 [inline]
 [<ffffffff823fc71d>] tcp_sendmsg+0x19ed/0x2ab0 net/ipv4/tcp.c:1112
 [<ffffffff824a8b42>] inet_sendmsg+0x202/0x4d0 net/ipv4/af_inet.c:755
 [<ffffffff821d838e>] sock_sendmsg_nosec net/socket.c:638 [inline]
 [<ffffffff821d838e>] sock_sendmsg+0xbe/0x110 net/socket.c:648
 [<ffffffff821dc4f1>] SYSC_sendto net/socket.c:1678 [inline]
 [<ffffffff821dc4f1>] SyS_sendto+0x201/0x340 net/socket.c:1646
 [<ffffffff82718ba1>] entry_SYSCALL_64_fastpath+0x1e/0x9a

Allocated by task 5654:
 [<ffffffff8102e3c6>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63
 [<ffffffff81483f22>] save_stack mm/kasan/kasan.c:512 [inline]
 [<ffffffff81483f22>] set_track mm/kasan/kasan.c:524 [inline]
 [<ffffffff81483f22>] kasan_kmalloc.part.0+0x62/0xf0 mm/kasan/kasan.c:616
 [<ffffffff81484197>] kasan_kmalloc+0xb7/0xd0 mm/kasan/kasan.c:601
 [<ffffffff81484a40>] kasan_krealloc+0x60/0x80 mm/kasan/kasan.c:654
 [<ffffffff814185df>] __do_krealloc mm/slab_common.c:1196 [inline]
 [<ffffffff814185df>] __krealloc+0x8f/0xc0 mm/slab_common.c:1222
 [<ffffffff8232db31>] __nf_ct_ext_add_length+0x221/0xb50 net/netfilter/nf_conntrack_extend.c:104
 [<ffffffff8231efaa>] nf_ct_helper_ext_add net/netfilter/nf_conntrack_helper.c:176 [inline]
 [<ffffffff8231efaa>] __nf_ct_try_assign_helper+0x32a/0x890 net/netfilter/nf_conntrack_helper.c:230
 [<ffffffff8231549e>] init_conntrack net/netfilter/nf_conntrack_core.c:1006 [inline]
 [<ffffffff8231549e>] resolve_normal_ct net/netfilter/nf_conntrack_core.c:1056 [inline]
 [<ffffffff8231549e>] nf_conntrack_in+0x160e/0x1c20 net/netfilter/nf_conntrack_core.c:1145
 [<ffffffff82690484>] ipv6_conntrack_local+0x94/0xf0 net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c:184
 [<ffffffff822f84a6>] nf_iterate+0x186/0x220 net/netfilter/core.c:274
 [<ffffffff822f86f6>] nf_hook_slow+0x1b6/0x340 net/netfilter/core.c:306
 [<ffffffff825a9098>] nf_hook_thresh include/linux/netfilter.h:187 [inline]
 [<ffffffff825a9098>] NF_HOOK_THRESH include/linux/netfilter.h:224 [inline]
 [<ffffffff825a9098>] NF_HOOK include/linux/netfilter.h:249 [inline]
 [<ffffffff825a9098>] ip6_xmit+0xf18/0x1a60 net/ipv6/ip6_output.c:240
 [<ffffffff8266622c>] inet6_csk_xmit+0x24c/0x4b0 net/ipv6/inet6_connection_sock.c:176
 [<ffffffff82431dd4>] __tcp_transmit_skb+0x1904/0x2cf0 net/ipv4/tcp_output.c:1034
 [<ffffffff82439e83>] tcp_transmit_skb net/ipv4/tcp_output.c:1047 [inline]
 [<ffffffff82439e83>] tcp_send_syn_data net/ipv4/tcp_output.c:3259 [inline]
 [<ffffffff82439e83>] tcp_connect+0x1bd3/0x31b0 net/ipv4/tcp_output.c:3294
 [<ffffffff82646631>] tcp_v6_connect+0x1391/0x1b30 net/ipv6/tcp_ipv6.c:294
 [<ffffffff824a7a2f>] __inet_stream_connect+0x2cf/0xc70 net/ipv4/af_inet.c:615
 [<ffffffff823fc71d>] tcp_sendmsg_fastopen net/ipv4/tcp.c:1092 [inline]
 [<ffffffff823fc71d>] tcp_sendmsg+0x19ed/0x2ab0 net/ipv4/tcp.c:1112
 [<ffffffff824a8b42>] inet_sendmsg+0x202/0x4d0 net/ipv4/af_inet.c:755
 [<ffffffff821d838e>] sock_sendmsg_nosec net/socket.c:638 [inline]
 [<ffffffff821d838e>] sock_sendmsg+0xbe/0x110 net/socket.c:648
 [<ffffffff821dc4f1>] SYSC_sendto net/socket.c:1678 [inline]
 [<ffffffff821dc4f1>] SyS_sendto+0x201/0x340 net/socket.c:1646
 [<ffffffff82718ba1>] entry_SYSCALL_64_fastpath+0x1e/0x9a

Freed by task 2136:
 [<ffffffff8102e3c6>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63
 [<ffffffff81484820>] save_stack mm/kasan/kasan.c:512 [inline]
 [<ffffffff81484820>] set_track mm/kasan/kasan.c:524 [inline]
 [<ffffffff81484820>] kasan_slab_free+0xb0/0x190 mm/kasan/kasan.c:589
 [<ffffffff81481c44>] slab_free_hook mm/slub.c:1383 [inline]
 [<ffffffff81481c44>] slab_free_freelist_hook mm/slub.c:1405 [inline]
 [<ffffffff81481c44>] slab_free mm/slub.c:2859 [inline]
 [<ffffffff81481c44>] kfree+0xf4/0x310 mm/slub.c:3749
 [<ffffffff81403d68>] simple_xattrs_free include/linux/xattr.h:89 [inline]
 [<ffffffff81403d68>] shmem_evict_inode+0xf8/0x4e0 mm/shmem.c:625
 [<ffffffff814ea3b0>] evict+0x2e0/0x630 fs/inode.c:542
 [<ffffffff814ec42f>] iput_final fs/inode.c:1477 [inline]
 [<ffffffff814ec42f>] iput fs/inode.c:1504 [inline]
 [<ffffffff814ec42f>] iput+0x38f/0x990 fs/inode.c:1489
 [<ffffffff814cc165>] do_unlinkat+0x395/0x610 fs/namei.c:3982
 [<ffffffff814cd63b>] SYSC_unlink fs/namei.c:4023 [inline]
 [<ffffffff814cd63b>] SyS_unlink+0x1b/0x20 fs/namei.c:4021
 [<ffffffff82718ba1>] entry_SYSCALL_64_fastpath+0x1e/0x9a

The buggy address belongs to the object at ffff8801d8f4b000
 which belongs to the cache kmalloc-96 of size 96
The buggy address is located 2 bytes to the right of
 96-byte region [ffff8801d8f4b000, ffff8801d8f4b060)
The buggy address belongs to the page: