device lo left promiscuous mode
==================================================================
BUG: KASAN: use-after-free in hlist_del_init_rcu include/linux/rculist.h:157 [inline]
BUG: KASAN: use-after-free in __l2tp_session_unhash+0x4de/0x520 net/l2tp/l2tp_core.c:1700
Read of size 8 at addr ffff8801d973d7d8 by task syz-executor1/9274

CPU: 0 PID: 9274 Comm: syz-executor1 Not tainted 4.4.141-g9664bde #75
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 0000000000000000 0e9add2f69057932 ffff8800b53afcb8 ffffffff81e0e18d
 ffffea000765cf00 ffff8801d973d7d8[  119.024788] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready
 0000000000000000 ffff8801d973d7d8
 ffff8801d973d7d8 ffff8800b53afcf0 ffffffff81515a86[  119.066747] audit: type=1326 audit(1532953214.185:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=kernel pid=9286 comm="syz-executor0" exe="/root/syz-executor0" sig=9 arch=c000003e syscall=202 compat=0 ip=0x456a09 code=0x0
 ffff8801d973d7d8
Call Trace:
 [<ffffffff81e0e18d>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81e0e18d>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
 [<ffffffff81515a86>] print_address_description+0x6c/0x216 mm/kasan/report.c:252
 [<ffffffff81515da5>] kasan_report_error mm/kasan/report.c:351 [inline]
 [<ffffffff81515da5>] kasan_report.cold.7+0x175/0x2f7 mm/kasan/report.c:408
 [<ffffffff814f9894>] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:429
 [<ffffffff8359f78e>] hlist_del_init_rcu include/linux/rculist.h:157 [inline]
 [<ffffffff8359f78e>] __l2tp_session_unhash+0x4de/0x520 net/l2tp/l2tp_core.c:1700
 [<ffffffff835a7e57>] pppol2tp_release+0x1f7/0x310 net/l2tp/l2tp_ppp.c:508
 [<ffffffff82f1a256>] sock_release+0x96/0x1c0 net/socket.c:586
 [<ffffffff82f1a396>] sock_close+0x16/0x20 net/socket.c:1037
 [<ffffffff81522e75>] __fput+0x235/0x6f0 fs/file_table.c:208
 [<ffffffff815233b5>] ____fput+0x15/0x20 fs/file_table.c:244
 [<ffffffff8118bdbf>] task_work_run+0x10f/0x190 kernel/task_work.c:115
 [<ffffffff8100362d>] tracehook_notify_resume include/linux/tracehook.h:191 [inline]
 [<ffffffff8100362d>] exit_to_usermode_loop+0x13d/0x160 arch/x86/entry/common.c:253
 [<ffffffff81006535>] prepare_exit_to_usermode arch/x86/entry/common.c:284 [inline]
 [<ffffffff81006535>] syscall_return_slowpath+0x1b5/0x1f0 arch/x86/entry/common.c:349
 [<ffffffff838c2eb5>] int_ret_from_sys_call+0x25/0xa3

Allocated by task 9269:
 [<ffffffff81033c86>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63
 [<ffffffff814f8943>] save_stack+0x43/0xd0 mm/kasan/kasan.c:512
 [<ffffffff814f8c27>] set_track mm/kasan/kasan.c:524 [inline]
 [<ffffffff814f8c27>] kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:616
 [<ffffffff814f5344>] __kmalloc+0x124/0x310 mm/slub.c:3613
 [<ffffffff835a0769>] kmalloc include/linux/slab.h:481 [inline]
 [<ffffffff835a0769>] kzalloc include/linux/slab.h:620 [inline]
 [<ffffffff835a0769>] l2tp_session_create+0x39/0x1030 net/l2tp/l2tp_core.c:1748
 [<ffffffff835a5470>] pppol2tp_connect+0x10f0/0x1910 net/l2tp/l2tp_ppp.c:725
 [<ffffffff82f1ec78>] SYSC_connect+0x1b8/0x300 net/socket.c:1557
 [<ffffffff82f215b4>] SyS_connect+0x24/0x30 net/socket.c:1538
 [<ffffffff838c2d25>] entry_SYSCALL_64_fastpath+0x22/0x9e

Freed by task 9269:
 [<ffffffff81033c86>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63
 [<ffffffff814f8943>] save_stack+0x43/0xd0 mm/kasan/kasan.c:512
 [<ffffffff814f9272>] set_track mm/kasan/kasan.c:524 [inline]
 [<ffffffff814f9272>] kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:589
 [<ffffffff814f6774>] slab_free_hook mm/slub.c:1383 [inline]
 [<ffffffff814f6774>] slab_free_freelist_hook mm/slub.c:1405 [inline]
 [<ffffffff814f6774>] slab_free mm/slub.c:2859 [inline]
 [<ffffffff814f6774>] kfree+0xf4/0x310 mm/slub.c:3749
 [<ffffffff8359d6d0>] l2tp_session_free+0x170/0x200 net/l2tp/l2tp_core.c:1676
 [<ffffffff8359fa89>] l2tp_session_dec_refcount_1 net/l2tp/l2tp_core.h:293 [inline]
 [<ffffffff8359fa89>] l2tp_tunnel_closeall+0x2b9/0x350 net/l2tp/l2tp_core.c:1279
 [<ffffffff835a059b>] l2tp_udp_encap_destroy+0x8b/0xf0 net/l2tp/l2tp_core.c:1300
 [<ffffffff834928c1>] udpv6_destroy_sock+0xb1/0xd0 net/ipv6/udp.c:1421
 [<ffffffff82f2fb2d>] sk_common_release+0x6d/0x300 net/core/sock.c:2680
 [<ffffffff83491575>] udp_lib_close+0x15/0x20 include/net/udp.h:190
 [<ffffffff832f902f>] inet_release+0xff/0x1d0 net/ipv4/af_inet.c:435
 [<ffffffff8341bca0>] inet6_release+0x50/0x70 net/ipv6/af_inet6.c:424
 [<ffffffff82f1a256>] sock_release+0x96/0x1c0 net/socket.c:586
 [<ffffffff82f1a396>] sock_close+0x16/0x20 net/socket.c:1037
 [<ffffffff81522e75>] __fput+0x235/0x6f0 fs/file_table.c:208
 [<ffffffff815233b5>] ____fput+0x15/0x20 fs/file_table.c:244
 [<ffffffff8118bdbf>] task_work_run+0x10f/0x190 kernel/task_work.c:115
 [<ffffffff8100362d>] tracehook_notify_resume include/linux/tracehook.h:191 [inline]
 [<ffffffff8100362d>] exit_to_usermode_loop+0x13d/0x160 arch/x86/entry/common.c:253
 [<ffffffff81006535>] prepare_exit_to_usermode arch/x86/entry/common.c:284 [inline]
 [<ffffffff81006535>] syscall_return_slowpath+0x1b5/0x1f0 arch/x86/entry/common.c:349
 [<ffffffff838c2eb5>] int_ret_from_sys_call+0x25/0xa3

The buggy address belongs to the object at ffff8801d973d680
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 344 bytes inside of
 512-byte region [ffff8801d973d680, ffff8801d973d880)
The buggy address belongs to the page:
swap_dup: Bad swap file entry 207fffffffc1d550
swap_dup: Bad swap file entry 207fffffffc1d550
page:ffffea000765cf00 count:1 mapcount:786441 mapping:          (null) index:0x0
kasan: CONFIG_KASAN_INLINE enabled
flags: 0xffff8800a3704870(
kasan: GPF could be caused by NULL-ptr deref or user memory access
dirty|lru|active|private
general protection fault: 0000 [#1] 
|head
PREEMPT 
|mlocked
SMP 
|uncached
KASAN
|compound_lock

)
page dumped because: VM_BUG_ON_PAGE(PageSlab(page))
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 3780 Comm: syz-executor1 Not tainted 4.4.141-g9664bde #75
------------[ cut here ]------------
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
WARNING: CPU: 0 PID: -2085969376 at kernel/rcu/update.c:211 __rcu_read_unlock+0x140/0x1a0 kernel/rcu/update.c:211()
task: ffff8801d9558000 task.stack: ffff8800a4aa0000