netlink: 4 bytes leftover after parsing attributes in process `syz-executor6'.
list_add corruption. prev->next should be next (00000000f4ecf513), but was 00000000a41f97f2. (prev=00000000a41f97f2).
------------[ cut here ]------------
kernel BUG at lib/list_debug.c:28!
invalid opcode: 0000 [#1] SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 26172 Comm: syz-executor7 Not tainted 4.16.0+ #1
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
RIP: 0010:__list_add_valid.cold.0+0x23/0x25 lib/list_debug.c:26
RSP: 0018:ffff8801d8d2e940 EFLAGS: 00010282
RAX: 0000000000000075 RBX: ffff8801ae91a1c8 RCX: 0000000000000000
RDX: 0000000000000075 RSI: ffffffff815f7e01 RDI: ffffed003b1a5d1e
RBP: ffff8801d8d2e958 R08: ffff8801a89ae3c0 R09: ffffed003b604fb0
R10: ffffed003b604fb0 R11: ffff8801db027d87 R12: ffff8801cf4e3000
R13: ffff8801d8d2ea28 R14: ffff8801ae91a1c8 R15: ffff8801cf4e3000
FS:  00007f9c18710700(0000) GS:ffff8801db000000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
netlink: 4 bytes leftover after parsing attributes in process `syz-executor6'.
CR2: 00007f63040e6000 CR3: 00000001ab7c8000 CR4: 00000000001406f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 __list_add_rcu include/linux/rculist.h:52 [inline]
 list_add_tail_rcu include/linux/rculist.h:101 [inline]
 sctp_add_bind_addr+0x2d5/0x4a0 net/sctp/bind_addr.c:179
 sctp_raw_to_bind_addrs+0x1f1/0x2b0 net/sctp/bind_addr.c:297
 sctp_assoc_set_bind_addr_from_cookie+0xf8/0x150 net/sctp/associola.c:1593
 sctp_unpack_cookie+0x882/0x1340 net/sctp/sm_make_chunk.c:1870
 sctp_sf_do_5_2_4_dupcook+0x31a/0x2dd0 net/sctp/sm_statefuns.c:2121
 sctp_do_sm+0x1ab/0x7160 net/sctp/sm_sideeffect.c:1188
 sctp_assoc_bh_rcv+0x30f/0x520 net/sctp/associola.c:1065
 sctp_inq_push+0x263/0x320 net/sctp/inqueue.c:95
 sctp_backlog_rcv+0x192/0xc00 net/sctp/input.c:350
 sk_backlog_rcv include/net/sock.h:909 [inline]
 __release_sock+0x12f/0x3a0 net/core/sock.c:2335
 release_sock+0xa4/0x2b0 net/core/sock.c:2850
 sctp_wait_for_connect+0x389/0x620 net/sctp/socket.c:8360
 sctp_sendmsg_to_asoc+0x1c03/0x2100 net/sctp/socket.c:1942
 sctp_sendmsg+0x13a8/0x1d70 net/sctp/socket.c:2088
 inet_sendmsg+0x19f/0x690 net/ipv4/af_inet.c:798
 sock_sendmsg_nosec net/socket.c:629 [inline]
 sock_sendmsg+0xd5/0x120 net/socket.c:639
 __sys_sendto+0x3d7/0x670 net/socket.c:1789
 SYSC_sendto net/socket.c:1801 [inline]
 SyS_sendto+0x40/0x60 net/socket.c:1797
 do_syscall_64+0x29e/0x9d0 arch/x86/entry/common.c:287
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
RIP: 0033:0x455259
RSP: 002b:00007f9c1870fc68 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
RAX: ffffffffffffffda RBX: 00007f9c187106d4 RCX: 0000000000455259
RDX: 0000000000000001 RSI: 00000000205a0fff RDI: 0000000000000013
RBP: 000000000072bea0 R08: 00000000207bcfe4 R09: 000000000000001c
R10: 0000000000000000 R11: 0000000000000246 R12: 00000000ffffffff
R13: 00000000000004f8 R14: 00000000006fa7e0 R15: 0000000000000000
Code: e7 e8 df e2 7f fe eb 97 48 89 d9 48 c7 c7 80 19 d8 87 e8 56 ba 2c fe 0f 0b 48 89 f1 48 c7 c7 40 1a d8 87 48 89 de e8 42 ba 2c fe <0f> 0b 4c 89 e2 48 89 de 48 c7 c7 80 1b d8 87 e8 2e ba 2c fe 0f 
RIP: __list_add_valid.cold.0+0x23/0x25 lib/list_debug.c:26 RSP: ffff8801d8d2e940
---[ end trace 3ab5a935af4fc0c3 ]---