audit: type=1400 audit(1564453149.162:5643): avc:  denied  { create } for  pid=32444 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
audit: type=1400 audit(1564453149.232:5644): avc:  denied  { write } for  pid=32444 comm="syz-executor.4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
==================================================================
BUG: KASAN: use-after-free in __read_once_size include/linux/compiler.h:218 [inline]
BUG: KASAN: use-after-free in atomic_read arch/x86/include/asm/atomic.h:26 [inline]
BUG: KASAN: use-after-free in __atomic_add_unless arch/x86/include/asm/atomic.h:211 [inline]
BUG: KASAN: use-after-free in atomic_add_unless include/linux/atomic.h:437 [inline]
BUG: KASAN: use-after-free in sk_dst_get include/net/sock.h:1745 [inline]
BUG: KASAN: use-after-free in sk_dst_check+0x347/0x380 net/core/sock.c:546
Read of size 4 at addr ffff880126b4b6c0 by task syz-executor.4/32453

CPU: 1 PID: 32453 Comm: syz-executor.4 Not tainted 4.4.174+ #17
 0000000000000000 6d8bde333379666b ffff880120f27698 ffffffff81aad1a1
 0000000000000000 ffffea00049ad2c0 ffff880126b4b6c0 0000000000000004
 0000000000000000 ffff880120f276d0 ffffffff81490120 0000000000000000
Call Trace:
 [<ffffffff81aad1a1>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81aad1a1>] dump_stack+0xc1/0x120 lib/dump_stack.c:51
 [<ffffffff81490120>] print_address_description+0x6f/0x21b mm/kasan/report.c:252
 [<ffffffff81490358>] kasan_report_error mm/kasan/report.c:351 [inline]
 [<ffffffff81490358>] kasan_report mm/kasan/report.c:408 [inline]
 [<ffffffff81490358>] kasan_report.cold+0x8c/0x2be mm/kasan/report.c:393
 [<ffffffff81484eb4>] __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:428
 [<ffffffff821e1de7>] __read_once_size include/linux/compiler.h:218 [inline]
 [<ffffffff821e1de7>] atomic_read arch/x86/include/asm/atomic.h:26 [inline]
 [<ffffffff821e1de7>] __atomic_add_unless arch/x86/include/asm/atomic.h:211 [inline]
 [<ffffffff821e1de7>] atomic_add_unless include/linux/atomic.h:437 [inline]
 [<ffffffff821e1de7>] sk_dst_get include/net/sock.h:1745 [inline]
 [<ffffffff821e1de7>] sk_dst_check+0x347/0x380 net/core/sock.c:546
audit: type=1400 audit(1564453149.262:5645): avc:  denied  { write } for  pid=32429 comm="syz-executor.5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
 [<ffffffff8247f61f>] udp_sendmsg+0x114f/0x1c60 net/ipv4/udp.c:1019
 [<ffffffff824a8b42>] inet_sendmsg+0x202/0x4d0 net/ipv4/af_inet.c:755
 [<ffffffff821d838e>] sock_sendmsg_nosec net/socket.c:638 [inline]
 [<ffffffff821d838e>] sock_sendmsg+0xbe/0x110 net/socket.c:648
 [<ffffffff821d9e69>] ___sys_sendmsg+0x369/0x890 net/socket.c:1975
 [<ffffffff821dd386>] __sys_sendmmsg+0x1d6/0x2e0 net/socket.c:2053
 [<ffffffff822ace22>] C_SYSC_sendmmsg net/compat.c:731 [inline]
 [<ffffffff822ace22>] compat_SyS_sendmmsg+0x32/0x40 net/compat.c:728
 [<ffffffff8100603d>] do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline]
 [<ffffffff8100603d>] do_fast_syscall_32+0x32d/0xa90 arch/x86/entry/common.c:397
 [<ffffffff8271a350>] sysenter_flags_fixed+0xd/0x1a

Allocated by task 32453:
 [<ffffffff8102e3c6>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63
 [<ffffffff81483f22>] save_stack mm/kasan/kasan.c:512 [inline]
 [<ffffffff81483f22>] set_track mm/kasan/kasan.c:524 [inline]
 [<ffffffff81483f22>] kasan_kmalloc.part.0+0x62/0xf0 mm/kasan/kasan.c:616
 [<ffffffff81484197>] kasan_kmalloc+0xb7/0xd0 mm/kasan/kasan.c:601
 [<ffffffff8148475f>] kasan_slab_alloc+0xf/0x20 mm/kasan/kasan.c:554
 [<ffffffff8147fe9c>] slab_post_alloc_hook mm/slub.c:1349 [inline]
 [<ffffffff8147fe9c>] slab_alloc_node mm/slub.c:2615 [inline]
 [<ffffffff8147fe9c>] slab_alloc mm/slub.c:2623 [inline]
 [<ffffffff8147fe9c>] kmem_cache_alloc+0xdc/0x2c0 mm/slub.c:2628
 [<ffffffff82258393>] dst_alloc+0xf3/0x1b0 net/core/dst.c:210
 [<ffffffff823b12c0>] ipv4_blackhole_route+0x30/0x720 net/ipv4/route.c:2396
 [<ffffffff825523f4>] make_blackhole net/xfrm/xfrm_policy.c:2161 [inline]
 [<ffffffff825523f4>] xfrm_lookup_route net/xfrm/xfrm_policy.c:2331 [inline]
 [<ffffffff825523f4>] xfrm_lookup_route+0xf4/0x140 net/xfrm/xfrm_policy.c:2322
 [<ffffffff823a5a23>] ip_route_output_flow+0x93/0xa0 net/ipv4/route.c:2437
 [<ffffffff8247fa07>] udp_sendmsg+0x1537/0x1c60 net/ipv4/udp.c:1040
 [<ffffffff824a8b42>] inet_sendmsg+0x202/0x4d0 net/ipv4/af_inet.c:755
 [<ffffffff821d838e>] sock_sendmsg_nosec net/socket.c:638 [inline]
 [<ffffffff821d838e>] sock_sendmsg+0xbe/0x110 net/socket.c:648
 [<ffffffff821d9e69>] ___sys_sendmsg+0x369/0x890 net/socket.c:1975
 [<ffffffff821dd386>] __sys_sendmmsg+0x1d6/0x2e0 net/socket.c:2053
 [<ffffffff822ace22>] C_SYSC_sendmmsg net/compat.c:731 [inline]
 [<ffffffff822ace22>] compat_SyS_sendmmsg+0x32/0x40 net/compat.c:728
 [<ffffffff8100603d>] do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline]
 [<ffffffff8100603d>] do_fast_syscall_32+0x32d/0xa90 arch/x86/entry/common.c:397
 [<ffffffff8271a350>] sysenter_flags_fixed+0xd/0x1a

Freed by task 23744:
 [<ffffffff8102e3c6>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63
 [<ffffffff81484820>] save_stack mm/kasan/kasan.c:512 [inline]
 [<ffffffff81484820>] set_track mm/kasan/kasan.c:524 [inline]
 [<ffffffff81484820>] kasan_slab_free+0xb0/0x190 mm/kasan/kasan.c:589
 [<ffffffff8148157e>] slab_free_hook mm/slub.c:1383 [inline]
 [<ffffffff8148157e>] slab_free_freelist_hook mm/slub.c:1405 [inline]
 [<ffffffff8148157e>] slab_free mm/slub.c:2859 [inline]
 [<ffffffff8148157e>] kmem_cache_free+0xbe/0x350 mm/slub.c:2881
 [<ffffffff82256eef>] dst_destroy+0x26f/0x330 net/core/dst.c:270
 [<ffffffff8225716e>] dst_gc_task+0x1be/0x530 net/core/dst.c:89
 [<ffffffff81122c25>] process_one_work+0x825/0x1720 kernel/workqueue.c:2064
 [<ffffffff81124004>] worker_thread+0x4e4/0xf50 kernel/workqueue.c:2196
 [<ffffffff811342c3>] kthread+0x273/0x310 kernel/kthread.c:211
 [<ffffffff82718fc5>] ret_from_fork+0x55/0x80 arch/x86/entry/entry_64.S:537

The buggy address belongs to the object at ffff880126b4b640
 which belongs to the cache ip_dst_cache of size 208
The buggy address is located 128 bytes inside of
 208-byte region [ffff880126b4b640, ffff880126b4b710)
The buggy address belongs to the page:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral protection fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 32474 Comm: syz-executor.3 Not tainted 4.4.174+ #17
task: ffff8801d6d54740 task.stack: ffff88009f870000
RIP: 0010:[<ffffffff81b0d5ec>]  [<ffffffff81b0d5ec>] __debug_check_no_obj_freed lib/debugobjects.c:692 [inline]
RIP: 0010:[<ffffffff81b0d5ec>]  [<ffffffff81b0d5ec>] debug_check_no_obj_freed+0x18c/0x6e0 lib/debugobjects.c:729
RSP: 0018:ffff88009f8779f0  EFLAGS: 00010803
RAX: 000000000000000f RBX: a2a0e8e7894c0b0f RCX: 0000000000009e9c
RDX: 14541d1cf1298161 RSI: ffff88009f877a68 RDI: ffffffff8142ac2e
RBP: ffff88009f877ad0 R08: 0000000000000292 R09: ffff8801d6d55050
R10: ffffffff83a66b50 R11: 0000000000000000 R12: dffffc0000000000
R13: 5541e58948550000 R14: ffffffff84116948 R15: a2a0e8e7894c0b0f
FS:  0000000000000000(0000) GS:ffff8801db600000(0063) knlGS:00000000f5576b40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: 000000002046ccbf CR3: 000000001714c000 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 ffff8801d6d54740 dffffc0000000000 ffff8801bfdab000 ffff8801bfdab000
 ffff8801d6d54740 000000079f877a30 fffffbfff0822d28 1ffff10013f0ef49
 ffffffff84116940 ffff8801bfdaa000 ffff8801bfdaa000 0000000041b58ab3
Call Trace:
 [<ffffffff813c60c5>] free_pages_prepare+0x505/0x9c0 mm/page_alloc.c:1049
 [<ffffffff813cb3f0>] free_hot_cold_page+0x40/0x580 mm/page_alloc.c:2112
 [<ffffffff813e0b6c>] __put_single_page+0x3c/0x60 mm/swap.c:73
 [<ffffffff813e1ee7>] put_page+0xd7/0x120 mm/swap.c:277
 [<ffffffff814afc67>] anon_pipe_buf_release+0xd7/0x140 fs/pipe.c:137
 [<ffffffff814b188b>] pipe_read+0x35b/0x860 fs/pipe.c:288
 [<ffffffff81496725>] new_sync_read fs/read_write.c:424 [inline]
 [<ffffffff81496725>] __vfs_read+0x2e5/0x3c0 fs/read_write.c:436
 [<ffffffff81498264>] vfs_read+0x134/0x360 fs/read_write.c:456
 [<ffffffff8149aa8c>] SYSC_read fs/read_write.c:571 [inline]
 [<ffffffff8149aa8c>] SyS_read+0xdc/0x1c0 fs/read_write.c:564
 [<ffffffff8100603d>] do_syscall_32_irqs_on arch/x86/entry/common.c:330 [inline]
 [<ffffffff8100603d>] do_fast_syscall_32+0x32d/0xa90 arch/x86/entry/common.c:397
 [<ffffffff8271a350>] sysenter_flags_fixed+0xd/0x1a
Code: ff ff 80 38 00 0f 85 ff 04 00 00 48 8b 85 60 ff ff ff 4c 8b 38 4d 85 ff 0f 84 e6 02 00 00 48 8d 75 98 31 c0 4c 89 fa 48 c1 ea 03 <42> 80 3c 22 00 0f 85 d6 02 00 00 49 8d 7f 18 83 c0 01 49 8b 1f 
RIP  [<ffffffff81b0d5ec>] __debug_check_no_obj_freed lib/debugobjects.c:692 [inline]
RIP  [<ffffffff81b0d5ec>] debug_check_no_obj_freed+0x18c/0x6e0 lib/debugobjects.c:729
 RSP <ffff88009f8779f0>
---[ end trace 5e1514d5feb54142 ]---
double fault: 0000 [#2] PREEMPT SMP KASAN
Modules linked in:
CPU: 1 PID: 32453 Comm: syz-executor.4 Tainted: G      D         4.4.174+ #17
task: ffff8800b2d45f00 task.stack: ffff880120f20000
RIP: 0010:[<ffffffff813095f0>]  [<ffffffff813095f0>] __sanitizer_cov_trace_pc+0x0/0x50 kernel/kcov.c:93
RSP: 0018:ffff880100000000  EFLAGS: 00010092
RAX: 0000000000040000 RBX: 0000000000000000 RCX: ffffc900063e6000
RDX: 0000000000000000 RSI: ffffffff82891be0 RDI: ffffea00049ad2c0
RBP: ffff880100000038 R08: 0000000000000026 R09: 0000000000000000
R10: 0000000000000001 R11: ffffffff83fdf174 R12: ffffea00049ad2c0
R13: ffffffff82891be0 R14: ffff880126b4b710 R15: ffff880126b4b640
FS:  0000000000000000(0000) GS:ffff8801db700000(0063) knlGS:00000000f554bb40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: ffff8800fffffff8 CR3: 00000000b2aa5000 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:

Call Trace:
 <UNK> 
Code: c8 e8 f5 b8 17 00 48 8b 55 c8 e9 d2 fe ff ff 48 89 df e8 e4 b8 17 00 e9 ac fe ff ff 4c 89 f7 e8 d7 b8 17 00 e9 42 fe ff ff 66 90 <55> 48 89 e5 48 8b 75 08 65 48 8b 04 25 80 67 01 00 65 8b 15 08 
RIP  [<ffffffff813095f0>] __sanitizer_cov_trace_pc+0x0/0x50
 RSP <ffff880100000000>
---[ end trace 5e1514d5feb54143 ]---