------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:2193!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 1 PID: 469 Comm: udevd Not tainted 4.4.169+ #7
task: ffff8801d6d05f00 task.stack: ffff8800b8f20000
RIP: 0010:[<ffffffff821f03f4>]  [<ffffffff821f03f4>] skb_copy_and_csum_bits+0x6a4/0x7f0 net/core/skbuff.c:2193
RSP: 0018:ffff8801db7072a0  EFLAGS: 00010206
RAX: ffff8801d6d05f00 RBX: 00000000b9ddc1ba RCX: 1ffff10039e3ab29
RDX: 0000000000000100 RSI: ffffffff821f03f4 RDI: ffff8801cf1d5948
RBP: ffff8801db707328 R08: 0000000000000000 R09: 0000000000000000
R10: 000000000000003c R11: ffff8800b73d8bdf R12: 0000000000000000
R13: 0000000000000224 R14: 000000000000003c R15: ffff8801cf1d5940
FS:  00007fa649f9f7a0(0000) GS:ffff8801db700000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007fa64995c518 CR3: 00000000b9327000 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 ffffffff821dc4a0 ffff8801d7d89488 ffffffff810e254d ffffffff82718981
 ffffffff82717cdd ffff8800b73d8968 0000003c8194d608 ffff8801d7d89484
 ffffffff0000003c 00000000b9ddc1ba 0000003c000001e8 ffff8801d7d893c0
Call Trace:
 <IRQ> 
 [<ffffffff824901df>] icmp_glue_bits+0x7f/0x1e0 net/ipv4/icmp.c:344
 [<ffffffff823c7db6>] __ip_append_data.isra.2+0x1e66/0x2a00 net/ipv4/ip_output.c:1045
Dead loop on virtual device ip6_vti0, fix it urgently!
syz-executor5 (15463) used greatest stack depth: 22896 bytes left
 [<ffffffff823c8a34>] ip_append_data.part.4+0xe4/0x150 net/ipv4/ip_output.c:1195
 [<ffffffff823cd428>] ip_append_data+0x68/0x80 net/ipv4/ip_output.c:1184
 [<ffffffff8248fdee>] icmp_push_reply+0x19e/0x510 net/ipv4/icmp.c:362
 [<ffffffff8249152a>] icmp_send+0xaca/0x1430 net/ipv4/icmp.c:727
 [<ffffffff823c8c4c>] ip_fragment.constprop.5+0x1ac/0x200 net/ipv4/ip_output.c:511
 [<ffffffff823c9036>] ip_finish_output+0x396/0xc00 net/ipv4/ip_output.c:286
 [<ffffffff823cd119>] NF_HOOK_COND include/linux/netfilter.h:240 [inline]
 [<ffffffff823cd119>] ip_output+0x219/0x4c0 net/ipv4/ip_output.c:362
 [<ffffffff823ca03b>] dst_output include/net/dst.h:498 [inline]
 [<ffffffff823ca03b>] ip_local_out+0x9b/0x180 net/ipv4/ip_output.c:119
 [<ffffffff823cb38e>] ip_queue_xmit+0x88e/0x1a80 net/ipv4/ip_output.c:461
 [<ffffffff8242dc50>] __tcp_transmit_skb+0x1870/0x2c50 net/ipv4/tcp_output.c:1034
 [<ffffffff8243843c>] tcp_transmit_skb net/ipv4/tcp_output.c:1047 [inline]
 [<ffffffff8243843c>] __tcp_retransmit_skb+0x63c/0x18e0 net/ipv4/tcp_output.c:2665
 [<ffffffff82439ea3>] tcp_retransmit_skb+0x23/0x2c0 net/ipv4/tcp_output.c:2682
 [<ffffffff8243f92d>] tcp_retransmit_timer+0x7bd/0x1ed0 net/ipv4/tcp_timer.c:461
 [<ffffffff82441231>] tcp_write_timer_handler+0x1f1/0x6f0 net/ipv4/tcp_timer.c:543
 [<ffffffff824417ea>] tcp_write_timer+0xba/0xd0 net/ipv4/tcp_timer.c:561
 [<ffffffff8125595c>] call_timer_fn+0x18c/0x870 kernel/time/timer.c:1185
 [<ffffffff81256645>] __run_timers kernel/time/timer.c:1261 [inline]
 [<ffffffff81256645>] run_timer_softirq+0x605/0xbb0 kernel/time/timer.c:1444
 [<ffffffff8271922a>] __do_softirq+0x22a/0xa3e kernel/softirq.c:273
 [<ffffffff810e254d>] invoke_softirq kernel/softirq.c:350 [inline]
 [<ffffffff810e254d>] irq_exit+0x10d/0x140 kernel/softirq.c:391
 [<ffffffff82718981>] exiting_irq arch/x86/include/asm/apic.h:652 [inline]
 [<ffffffff82718981>] smp_apic_timer_interrupt+0x81/0xb0 arch/x86/kernel/apic/apic.c:926
 [<ffffffff82717cdd>] apic_timer_interrupt+0x9d/0xb0 arch/x86/entry/entry_64.S:768
 <EOI> 
 [<ffffffff8194c37c>] spin_unlock_irqrestore include/linux/spinlock.h:362 [inline]
 [<ffffffff8194c37c>] avc_reclaim_node security/selinux/avc.c:541 [inline]
 [<ffffffff8194c37c>] avc_alloc_node+0x31c/0x3c0 security/selinux/avc.c:559
 [<ffffffff8194d608>] avc_insert security/selinux/avc.c:670 [inline]
 [<ffffffff8194d608>] avc_compute_av+0x178/0x610 security/selinux/avc.c:976
 [<ffffffff8194f00d>] avc_has_perm_noaudit+0x29d/0x2f0 security/selinux/avc.c:1112
 [<ffffffff8195d299>] selinux_inode_permission+0x269/0x480 security/selinux/hooks.c:2902
audit: type=1400 audit(1545714388.419:86): avc:  denied  { create } for  pid=15480 comm="syz-executor5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
audit: type=1400 audit(1545714388.429:87): avc:  denied  { write } for  pid=15480 comm="syz-executor5" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
 [<ffffffff819462d9>] security_inode_permission+0xb9/0x100 security/security.c:600
 [<ffffffff814b1953>] __inode_permission2+0x93/0x240 fs/namei.c:425
 [<ffffffff814b1b5f>] inode_permission2+0x2f/0x110 fs/namei.c:475
 [<ffffffff814bcb01>] may_lookup fs/namei.c:1712 [inline]
 [<ffffffff814bcb01>] link_path_walk+0x891/0x1630 fs/namei.c:1970
 [<ffffffff814be804>] path_lookupat.isra.16+0x1b4/0x410 fs/namei.c:2194
 [<ffffffff814c51a7>] filename_lookup.part.27+0x177/0x370 fs/namei.c:2229
 [<ffffffff814c5563>] filename_lookup fs/namei.c:2222 [inline]
 [<ffffffff814c5563>] user_path_at_empty+0x53/0x70 fs/namei.c:2403
 [<ffffffff814a16b1>] SYSC_readlinkat fs/stat.c:327 [inline]
 [<ffffffff814a16b1>] SyS_readlinkat+0xf1/0x350 fs/stat.c:315
 [<ffffffff814a193a>] SYSC_readlink fs/stat.c:352 [inline]
 [<ffffffff814a193a>] SyS_readlink+0x2a/0x40 fs/stat.c:349
 [<ffffffff827162e1>] entry_SYSCALL_64_fastpath+0x1e/0x9a
Code: 00 00 4d 8b 24 24 44 8b 6d d0 4d 85 e4 0f 85 1b ff ff ff 8b 5d c0 e8 9c 6e 11 ff 8b 45 c8 85 c0 0f 84 83 fe ff ff e8 8c 6e 11 ff <0f> 0b 8b 5d c0 e9 74 fe ff ff c7 45 ac 00 00 00 00 e9 73 fa ff 
RIP  [<ffffffff821f03f4>] skb_copy_and_csum_bits+0x6a4/0x7f0 net/core/skbuff.c:2193
 RSP <ffff8801db7072a0>
---[ end trace 69701311dd3c4d34 ]---