SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket
==================================================================
BUG: KASAN: use-after-free in ip6_dst_idev include/net/ip6_fib.h:141 [inline]
BUG: KASAN: use-after-free in ip6_xmit+0x177c/0x1a00 net/ipv6/ip6_output.c:237
Read of size 8 at addr ffff8801d979d158 by task syz-executor4/2078

CPU: 0 PID: 2078 Comm: syz-executor4 Not tainted 4.4.151-ge917467 #20
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 0000000000000000 a22041480d7d67ac ffff8800a50bf548 ffffffff81e15eed
 ffffea000765e740 ffff8801d979d158 0000000000000000 ffff8801d979d158
 0000000000001000 ffff8800a50bf580 ffffffff8151b390 ffff8801d979d158
Call Trace:
 [<ffffffff81e15eed>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81e15eed>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
 [<ffffffff8151b390>] print_address_description+0x6c/0x216 mm/kasan/report.c:252
 [<ffffffff8151b6af>] kasan_report_error mm/kasan/report.c:351 [inline]
 [<ffffffff8151b6af>] kasan_report.cold.7+0x175/0x2f7 mm/kasan/report.c:408
 [<ffffffff814fe644>] __asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:429
 [<ffffffff83435c7c>] ip6_dst_idev include/net/ip6_fib.h:141 [inline]
 [<ffffffff83435c7c>] ip6_xmit+0x177c/0x1a00 net/ipv6/ip6_output.c:237
 [<ffffffff834f5cc5>] inet6_csk_xmit+0x245/0x490 net/ipv6/inet6_connection_sock.c:176
 [<ffffffff835a52bc>] l2tp_xmit_core net/l2tp/l2tp_core.c:1084 [inline]
 [<ffffffff835a52bc>] l2tp_xmit_skb+0xb9c/0xe80 net/l2tp/l2tp_core.c:1179
 [<ffffffff835b1810>] pppol2tp_sendmsg+0x4e0/0x7d0 net/l2tp/l2tp_ppp.c:355
 [<ffffffff82f26ddc>] sock_sendmsg_nosec net/socket.c:626 [inline]
 [<ffffffff82f26ddc>] sock_sendmsg+0xcc/0x110 net/socket.c:636
 [<ffffffff82f285a1>] ___sys_sendmsg+0x441/0x880 net/socket.c:1963
 [<ffffffff82f2ac24>] __sys_sendmmsg+0x1d4/0x2e0 net/socket.c:2041
 [<ffffffff83014632>] C_SYSC_sendmmsg net/compat.c:728 [inline]
 [<ffffffff83014632>] compat_SyS_sendmmsg+0x32/0x40 net/compat.c:725
 [<ffffffff81006d94>] do_syscall_32_irqs_on arch/x86/entry/common.c:393 [inline]
 [<ffffffff81006d94>] do_fast_syscall_32+0x324/0x8b0 arch/x86/entry/common.c:460
 [<ffffffff838cda83>] sysenter_flags_fixed+0xd/0x1a

Allocated by task 22270:
 [<ffffffff81034676>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63
 [<ffffffff814fd6f3>] save_stack+0x43/0xd0 mm/kasan/kasan.c:512
 [<ffffffff814fd9d7>] set_track mm/kasan/kasan.c:524 [inline]
 [<ffffffff814fd9d7>] kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:616
 [<ffffffff814fdfa2>] kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:554
 [<ffffffff814f9abe>] slab_post_alloc_hook mm/slub.c:1349 [inline]
 [<ffffffff814f9abe>] slab_alloc_node mm/slub.c:2615 [inline]
 [<ffffffff814f9abe>] slab_alloc mm/slub.c:2623 [inline]
 [<ffffffff814f9abe>] kmem_cache_alloc+0xbe/0x2a0 mm/slub.c:2628
 [<ffffffff82fa5345>] dst_alloc+0xb5/0x1a0 net/core/dst.c:210
 [<ffffffff831f24d8>] rt_dst_alloc+0x78/0x430 net/ipv4/route.c:1478
 [<ffffffff831fb99c>] __mkroute_output net/ipv4/route.c:2132 [inline]
 [<ffffffff831fb99c>] __ip_route_output_key_hash+0x9ac/0x2380 net/ipv4/route.c:2344
 [<ffffffff831fde49>] __ip_route_output_key include/net/route.h:124 [inline]
 [<ffffffff831fde49>] ip_route_output_flow+0x29/0xa0 net/ipv4/route.c:2431
 [<ffffffff832a4322>] ip_route_connect include/net/route.h:304 [inline]
 [<ffffffff832a4322>] tcp_v4_connect+0x6d2/0x1890 net/ipv4/tcp_ipv4.c:171
 [<ffffffff83302f49>] __inet_stream_connect+0x2a9/0xc30 net/ipv4/af_inet.c:615
 [<ffffffff83252870>] tcp_sendmsg_fastopen net/ipv4/tcp.c:1092 [inline]
 [<ffffffff83252870>] tcp_sendmsg+0x1600/0x2b10 net/ipv4/tcp.c:1112
 [<ffffffff8330a193>] inet_sendmsg+0x203/0x4d0 net/ipv4/af_inet.c:755
 [<ffffffff82f26ddc>] sock_sendmsg_nosec net/socket.c:626 [inline]
 [<ffffffff82f26ddc>] sock_sendmsg+0xcc/0x110 net/socket.c:636
 [<ffffffff82f27abc>] SYSC_sendto+0x21c/0x370 net/socket.c:1666
 [<ffffffff82f2a140>] SyS_sendto+0x40/0x50 net/socket.c:1634
 [<ffffffff81006d94>] do_syscall_32_irqs_on arch/x86/entry/common.c:393 [inline]
 [<ffffffff81006d94>] do_fast_syscall_32+0x324/0x8b0 arch/x86/entry/common.c:460
 [<ffffffff838cda83>] sysenter_flags_fixed+0xd/0x1a

Freed by task 15910:
 [<ffffffff81034676>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63
 [<ffffffff814fd6f3>] save_stack+0x43/0xd0 mm/kasan/kasan.c:512
 [<ffffffff814fe022>] set_track mm/kasan/kasan.c:524 [inline]
 [<ffffffff814fe022>] kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:589
 [<ffffffff814fb20e>] slab_free_hook mm/slub.c:1383 [inline]
 [<ffffffff814fb20e>] slab_free_freelist_hook mm/slub.c:1405 [inline]
 [<ffffffff814fb20e>] slab_free mm/slub.c:2859 [inline]
 [<ffffffff814fb20e>] kmem_cache_free+0xbe/0x340 mm/slub.c:2881
 [<ffffffff82fa45f5>] dst_destroy.part.6+0x1f5/0x330 net/core/dst.c:270
 [<ffffffff82fa4c75>] dst_destroy net/core/dst.c:252 [inline]
 [<ffffffff82fa4c75>] dst_destroy_rcu+0x15/0x40 net/core/dst.c:295
 [<ffffffff81288e07>] __rcu_reclaim kernel/rcu/rcu.h:118 [inline]
 [<ffffffff81288e07>] rcu_do_batch kernel/rcu/tree.c:2705 [inline]
 [<ffffffff81288e07>] invoke_rcu_callbacks kernel/rcu/tree.c:2973 [inline]
 [<ffffffff81288e07>] __rcu_process_callbacks kernel/rcu/tree.c:2940 [inline]
 [<ffffffff81288e07>] rcu_process_callbacks+0x927/0x1440 kernel/rcu/tree.c:2957
 [<ffffffff838cf63c>] __do_softirq+0x22c/0xa1a kernel/softirq.c:273

The buggy address belongs to the object at ffff8801d979d140
 which belongs to the cache ip_dst_cache of size 208
The buggy address is located 24 bytes inside of
 208-byte region [ffff8801d979d140, ffff8801d979d210)
The buggy address belongs to the page:
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 0 Comm: swapper/1 Not tainted 4.4.151-ge917467 #20
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8801d9a41800 task.stack: ffff8801d9a50000
RIP: 0010:[<ffffffff83aaae75>]  [<ffffffff83aaae75>] str__compaction__trace_system_name+0x575/0xfa0
RSP: 0018:ffff8801db307da8  EFLAGS: 00010002
RAX: ffff8801d9a41800 RBX: ffff8800a4577d28 RCX: 0000000000000000
RDX: 0000000000010000 RSI: ffffffff812a0e55 RDI: ffffffff812a0e5e
RBP: ffff8801db307ee0 R08: ffffffff85341110 R09: 0000000000000001
R10: 0000000000000000 R11: ffff8801d9a41800 R12: ffffffff83aaae60
R13: ffff8801db3196c0 R14: dffffc0000000000 R15: ffff8801db307ee0
FS:  0000000000000000(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00007f4cb063e000 CR3: 00000000ba521000 CR4: 00000000001606f0
Stack:
 ffff8800a4577d28 ffff8801d9a41800 0000000000000046 ffff8801db307e78
 ffff8801d9a41800 1ffff1003b660fc3 ffff8801db319720 ffffed003b660fcf
 0000000000000001 ffff8801db319780 0303880200000001 ffff8801db3196f8
Call Trace:
 <IRQ> 
 [<ffffffff812a25d1>] hrtimer_interrupt+0x1b1/0x430 kernel/time/hrtimer.c:1359
 [<ffffffff810af544>] local_apic_timer_interrupt+0x74/0xa0 arch/x86/kernel/apic/apic.c:901
 [<ffffffff838ced9c>] smp_apic_timer_interrupt+0x7c/0xa0 arch/x86/kernel/apic/apic.c:925
 [<ffffffff838cdce0>] apic_timer_interrupt+0xa0/0xb0 arch/x86/entry/entry_64.S:741
 <EOI> 
 [<ffffffff81025cd5>] arch_safe_halt arch/x86/include/asm/paravirt.h:117 [inline]
 [<ffffffff81025cd5>] default_idle+0x55/0x3c0 arch/x86/kernel/process.c:432
 [<ffffffff81027be0>] arch_cpu_idle+0x10/0x20 arch/x86/kernel/process.c:423
 [<ffffffff8121ecd7>] default_idle_call+0x57/0x70 kernel/sched/idle.c:93
 [<ffffffff8121f47f>] cpuidle_idle_call kernel/sched/idle.c:157 [inline]
 [<ffffffff8121f47f>] cpu_idle_loop kernel/sched/idle.c:253 [inline]
 [<ffffffff8121f47f>] cpu_startup_entry+0x6af/0x780 kernel/sched/idle.c:301
 [<ffffffff810ac119>] start_secondary+0x329/0x400 arch/x86/kernel/smpboot.c:245
Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 56 4d 5f 42 55 47 5f 4f 4e 5f 50 41 47 45 28 50 61 67 65 53 6c <61> 62 28 70 61 67 65 29 29 00 00 00 00 00 00 00 00 00 00 00 00 
RIP  [<ffffffff83aaae75>] str__compaction__trace_system_name+0x575/0xfa0
 RSP <ffff8801db307da8>
---[ end trace 31eee747fbbf7a2c ]---