netlink: 3 bytes leftover after parsing attributes in process `syz-executor0'.
netlink: 3 bytes leftover after parsing attributes in process `syz-executor0'.
==================================================================
BUG: KASAN: use-after-free in ip6_dst_idev include/net/ip6_fib.h:141 [inline]
BUG: KASAN: use-after-free in ip6_xmit+0x177c/0x1a00 net/ipv6/ip6_output.c:237
Read of size 8 at addr ffff8801c8b74658 by task syz-executor6/13747

CPU: 1 PID: 13747 Comm: syz-executor6 Not tainted 4.4.151-g727cfac #23
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 0000000000000000 98703e746727eece ffff880195e07548 ffffffff81e15eed
 ffffea000722dd00 ffff8801c8b74658 0000000000000000 ffff8801c8b74658
 0000000000001000 ffff880195e07580 ffffffff8151b390 ffff8801c8b74658
Call Trace:
 [<ffffffff81e15eed>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81e15eed>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
 [<ffffffff8151b390>] print_address_description+0x6c/0x216 mm/kasan/report.c:252
 [<ffffffff8151b6af>] kasan_report_error mm/kasan/report.c:351 [inline]
 [<ffffffff8151b6af>] kasan_report.cold.7+0x175/0x2f7 mm/kasan/report.c:408
 [<ffffffff814fe644>] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:429
 [<ffffffff83435d6c>] ip6_dst_idev include/net/ip6_fib.h:141 [inline]
 [<ffffffff83435d6c>] ip6_xmit+0x177c/0x1a00 net/ipv6/ip6_output.c:237
 [<ffffffff834f5db5>] inet6_csk_xmit+0x245/0x490 net/ipv6/inet6_connection_sock.c:176
 [<ffffffff835a53ac>] l2tp_xmit_core net/l2tp/l2tp_core.c:1084 [inline]
 [<ffffffff835a53ac>] l2tp_xmit_skb+0xb9c/0xe80 net/l2tp/l2tp_core.c:1179
 [<ffffffff835b1900>] pppol2tp_sendmsg+0x4e0/0x7d0 net/l2tp/l2tp_ppp.c:355
 [<ffffffff82f26ebc>] sock_sendmsg_nosec net/socket.c:638 [inline]
 [<ffffffff82f26ebc>] sock_sendmsg+0xcc/0x110 net/socket.c:648
 [<ffffffff82f28681>] ___sys_sendmsg+0x441/0x880 net/socket.c:1975
 [<ffffffff82f2ad14>] __sys_sendmmsg+0x1d4/0x2e0 net/socket.c:2053
 [<ffffffff83014722>] C_SYSC_sendmmsg net/compat.c:728 [inline]
 [<ffffffff83014722>] compat_SyS_sendmmsg+0x32/0x40 net/compat.c:725
 [<ffffffff81006d94>] do_syscall_32_irqs_on arch/x86/entry/common.c:393 [inline]
 [<ffffffff81006d94>] do_fast_syscall_32+0x324/0x8b0 arch/x86/entry/common.c:460
 [<ffffffff838cdb83>] sysenter_flags_fixed+0xd/0x1a

Allocated by task 12694:
 [<ffffffff81034676>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63
 [<ffffffff814fd6f3>] save_stack+0x43/0xd0 mm/kasan/kasan.c:512
 [<ffffffff814fd9d7>] set_track mm/kasan/kasan.c:524 [inline]
 [<ffffffff814fd9d7>] kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:616
 [<ffffffff814fdfa2>] kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:554
 [<ffffffff814f9abe>] slab_post_alloc_hook mm/slub.c:1349 [inline]
 [<ffffffff814f9abe>] slab_alloc_node mm/slub.c:2615 [inline]
 [<ffffffff814f9abe>] slab_alloc mm/slub.c:2623 [inline]
 [<ffffffff814f9abe>] kmem_cache_alloc+0xbe/0x2a0 mm/slub.c:2628
 [<ffffffff82fa5435>] dst_alloc+0xb5/0x1a0 net/core/dst.c:210
 [<ffffffff831f25c8>] rt_dst_alloc+0x78/0x430 net/ipv4/route.c:1478
 [<ffffffff831fba8c>] __mkroute_output net/ipv4/route.c:2132 [inline]
 [<ffffffff831fba8c>] __ip_route_output_key_hash+0x9ac/0x2380 net/ipv4/route.c:2344
 [<ffffffff831fdf39>] __ip_route_output_key include/net/route.h:124 [inline]
 [<ffffffff831fdf39>] ip_route_output_flow+0x29/0xa0 net/ipv4/route.c:2431
 [<ffffffff8330787d>] ip_route_output_ports include/net/route.h:161 [inline]
 [<ffffffff8330787d>] inet_sk_rebuild_header+0x7fd/0x1ba0 net/ipv4/af_inet.c:1189
 [<ffffffff83294bce>] __tcp_retransmit_skb+0x20e/0x1910 net/ipv4/tcp_output.c:2610
 [<ffffffff832969c3>] tcp_retransmit_skb+0x23/0x2c0 net/ipv4/tcp_output.c:2678
 [<ffffffff8329c41d>] tcp_retransmit_timer+0x7bd/0x1ed0 net/ipv4/tcp_timer.c:461
 [<ffffffff8329dd21>] tcp_write_timer_handler+0x1f1/0x6f0 net/ipv4/tcp_timer.c:543
 [<ffffffff8329e2da>] tcp_write_timer+0xba/0xd0 net/ipv4/tcp_timer.c:561
 [<ffffffff81293b9c>] call_timer_fn+0x18c/0x870 kernel/time/timer.c:1185
 [<ffffffff812948c2>] __run_timers kernel/time/timer.c:1261 [inline]
 [<ffffffff812948c2>] run_timer_softirq+0x642/0xb90 kernel/time/timer.c:1444
 [<ffffffff838cf73c>] __do_softirq+0x22c/0xa1a kernel/softirq.c:273

Freed by task 12710:
 [<ffffffff81034676>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63
 [<ffffffff814fd6f3>] save_stack+0x43/0xd0 mm/kasan/kasan.c:512
 [<ffffffff814fe022>] set_track mm/kasan/kasan.c:524 [inline]
 [<ffffffff814fe022>] kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:589
 [<ffffffff814fb20e>] slab_free_hook mm/slub.c:1383 [inline]
 [<ffffffff814fb20e>] slab_free_freelist_hook mm/slub.c:1405 [inline]
 [<ffffffff814fb20e>] slab_free mm/slub.c:2859 [inline]
 [<ffffffff814fb20e>] kmem_cache_free+0xbe/0x340 mm/slub.c:2881
 [<ffffffff82fa46e5>] dst_destroy.part.6+0x1f5/0x330 net/core/dst.c:270
 [<ffffffff82fa4d65>] dst_destroy net/core/dst.c:252 [inline]
 [<ffffffff82fa4d65>] dst_destroy_rcu+0x15/0x40 net/core/dst.c:295
 [<ffffffff81288e07>] __rcu_reclaim kernel/rcu/rcu.h:118 [inline]
 [<ffffffff81288e07>] rcu_do_batch kernel/rcu/tree.c:2705 [inline]
 [<ffffffff81288e07>] invoke_rcu_callbacks kernel/rcu/tree.c:2973 [inline]
 [<ffffffff81288e07>] __rcu_process_callbacks kernel/rcu/tree.c:2940 [inline]
 [<ffffffff81288e07>] rcu_process_callbacks+0x927/0x1440 kernel/rcu/tree.c:2957
 [<ffffffff838cf73c>] __do_softirq+0x22c/0xa1a kernel/softirq.c:273

The buggy address belongs to the object at ffff8801c8b74640
 which belongs to the cache ip_dst_cache of size 208
The buggy address is located 24 bytes inside of
 208-byte region [ffff8801c8b74640, ffff8801c8b74710)
The buggy address belongs to the page:
dst_release: dst:ffff8801c8b74640 refcnt:-1
kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
BUG: unable to handle kernel paging request at ffff8801c8b74710
IP: [<ffff8801c8b74710>] 0xffff8801c8b74710
PGD 6330067 PUD 80000001c00001e3 
Oops: 0011 [#1] PREEMPT SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 0 PID: 0 Comm: swapper/0 Not tainted 4.4.151-g727cfac #23
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffffffff84417840 task.stack: ffffffff84400000
RIP: 0010:[<ffff8801c8b74710>]  [<ffff8801c8b74710>] 0xffff8801c8b74710
RSP: 0018:ffff8801db207b20  EFLAGS: 00010206
RAX: ffffffff84417840 RBX: ffff880195bf9b80 RCX: 0000000000000000
RDX: 0000000000000100 RSI: ffffffff82f3e0ab RDI: ffff880195bf9b80
RBP: ffff8801db207b40 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: 0000000000000001 R12: ffff8801c8b74710
R13: ffff880195bf9be0 R14: ffff880195bf9b80 R15: dffffc0000000000
FS:  0000000000000000(0000) GS:ffff8801db200000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff8801c8b74710 CR3: 00000000b108d000 CR4: 00000000001606f0
Stack:
 ffffffff82f3e0b3 ffff880195bf9b80 ffff88008a96eaf0 00000000c8b7e0d0
 ffff8801db207b58 ffffffff82f3ff95 ffff880195bf9b80 ffff8801db207b70
 ffffffff82f3fff5 ffff88008a96e900 ffff8801db207bc8 ffffffff832a6547
Call Trace:
 <IRQ> 
 [<ffffffff82f3ff95>] skb_release_all+0x15/0x60 net/core/skbuff.c:659
 [<ffffffff82f3fff5>] __kfree_skb+0x15/0x20 net/core/skbuff.c:675
 [<ffffffff832a6547>] sk_wmem_free_skb include/net/sock.h:1447 [inline]
 [<ffffffff832a6547>] tcp_write_queue_purge include/net/tcp.h:1462 [inline]
 [<ffffffff832a6547>] tcp_v4_destroy_sock+0x217/0xb90 net/ipv4/tcp_ipv4.c:1823
 [<ffffffff8323da72>] inet_csk_destroy_sock+0x172/0x440 net/ipv4/inet_connection_sock.c:707
 [<ffffffff8324a2dd>] tcp_done+0x1ed/0x250 net/ipv4/tcp.c:3110
 [<ffffffff8329a680>] tcp_write_err+0xc0/0x150 net/ipv4/tcp_timer.c:40
 [<ffffffff8329c10f>] tcp_fastopen_synack_timer net/ipv4/tcp_timer.c:361 [inline]
 [<ffffffff8329c10f>] tcp_retransmit_timer+0x4af/0x1ed0 net/ipv4/tcp_timer.c:387
 [<ffffffff8329dd21>] tcp_write_timer_handler+0x1f1/0x6f0 net/ipv4/tcp_timer.c:543
 [<ffffffff8329e2da>] tcp_write_timer+0xba/0xd0 net/ipv4/tcp_timer.c:561
 [<ffffffff81293b9c>] call_timer_fn+0x18c/0x870 kernel/time/timer.c:1185
 [<ffffffff812948c2>] __run_timers kernel/time/timer.c:1261 [inline]
 [<ffffffff812948c2>] run_timer_softirq+0x642/0xb90 kernel/time/timer.c:1444
 [<ffffffff838cf73c>] __do_softirq+0x22c/0xa1a kernel/softirq.c:273
 [<ffffffff811428cd>] invoke_softirq kernel/softirq.c:350 [inline]
 [<ffffffff811428cd>] irq_exit+0x10d/0x140 kernel/softirq.c:391
 [<ffffffff838ceea1>] exiting_irq arch/x86/include/asm/apic.h:652 [inline]
 [<ffffffff838ceea1>] smp_apic_timer_interrupt+0x81/0xa0 arch/x86/kernel/apic/apic.c:926
 [<ffffffff838cdde0>] apic_timer_interrupt+0xa0/0xb0 arch/x86/entry/entry_64.S:741
 <EOI> 
 [<ffffffff81025cd5>] arch_safe_halt arch/x86/include/asm/paravirt.h:117 [inline]
 [<ffffffff81025cd5>] default_idle+0x55/0x3c0 arch/x86/kernel/process.c:432
 [<ffffffff81027be0>] arch_cpu_idle+0x10/0x20 arch/x86/kernel/process.c:423
 [<ffffffff8121ecd7>] default_idle_call+0x57/0x70 kernel/sched/idle.c:93
 [<ffffffff8121f47f>] cpuidle_idle_call kernel/sched/idle.c:157 [inline]
 [<ffffffff8121f47f>] cpu_idle_loop kernel/sched/idle.c:253 [inline]
 [<ffffffff8121f47f>] cpu_startup_entry+0x6af/0x780 kernel/sched/idle.c:301
 [<ffffffff838b9351>] rest_init+0x188/0x18e init/main.c:410
 [<ffffffff84a4d8a1>] start_kernel+0x6b3/0x6e7 init/main.c:682
 [<ffffffff84a4c30f>] x86_64_start_reservations+0x29/0x2b arch/x86/kernel/head64.c:196
 [<ffffffff84a4c450>] x86_64_start_kernel+0x13f/0x162 arch/x86/kernel/head64.c:185
Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 00 00 ad de 00 02 00 00 00 00 ad de 40 0b 32 db 01 88 ff ff <96> 31 00 00 7e 01 80 eb a6 31 00 00 1d 01 00 86 00 00 00 00 00 
RIP  [<ffff8801c8b74710>] 0xffff8801c8b74710
 RSP <ffff8801db207b20>
CR2: ffff8801c8b74710
---[ end trace 44d27414134b15e9 ]---