==================================================================
BUG: KASAN: slab-out-of-bounds in ip6_tnl_xmit2+0x1f95/0x2320 net/ipv6/ip6_tunnel.c:987
Read of size 16 at addr ffff8801d0494bb0 by task syz-executor305/17443

CPU: 1 PID: 17443 Comm: syz-executor305 Not tainted 4.4.171+ #12
 0000000000000000 6e95842cb5d77b2f ffff8801d211ee30 ffffffff81aacd31
 0000000000000000 ffffea0007412500 ffff8801d0494bb0 0000000000000010
 ffff8801d0494900 ffff8801d211ee68 ffffffff8148fe7d 0000000000000000
Call Trace:
 [<ffffffff81aacd31>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81aacd31>] dump_stack+0xc1/0x120 lib/dump_stack.c:51
 [<ffffffff8148fe7d>] print_address_description+0x6f/0x21b mm/kasan/report.c:252
 [<ffffffff814900b5>] kasan_report_error mm/kasan/report.c:351 [inline]
 [<ffffffff814900b5>] kasan_report mm/kasan/report.c:408 [inline]
 [<ffffffff814900b5>] kasan_report.cold+0x8c/0x2be mm/kasan/report.c:393
 [<ffffffff81484d3f>] __asan_report_load_n_noabort+0xf/0x20 mm/kasan/report.c:439
 [<ffffffff826b27d5>] ip6_tnl_xmit2+0x1f95/0x2320 net/ipv6/ip6_tunnel.c:987
 [<ffffffff826b4529>] ip4ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1134 [inline]
 [<ffffffff826b4529>] ip6_tnl_xmit+0xa09/0xe00 net/ipv6/ip6_tunnel.c:1212
 [<ffffffff82244721>] __netdev_start_xmit include/linux/netdevice.h:3750 [inline]
 [<ffffffff82244721>] netdev_start_xmit include/linux/netdevice.h:3759 [inline]
 [<ffffffff82244721>] xmit_one net/core/dev.c:2781 [inline]
 [<ffffffff82244721>] dev_hard_start_xmit+0x7c1/0x11e0 net/core/dev.c:2797
 [<ffffffff82246a7b>] __dev_queue_xmit+0x164b/0x1bb0 net/core/dev.c:3229
 [<ffffffff82246ff8>] dev_queue_xmit+0x18/0x20 net/core/dev.c:3263
 [<ffffffff8225b7e6>] neigh_direct_output+0x16/0x20 net/core/neighbour.c:1369
 [<ffffffff823c5152>] dst_neigh_output include/net/dst.h:461 [inline]
 [<ffffffff823c5152>] ip_finish_output2+0x6a2/0x1280 net/ipv4/ip_output.c:213
 [<ffffffff823cc422>] ip_finish_output+0x8b2/0xc60 net/ipv4/ip_output.c:288
 [<ffffffff823d01e7>] NF_HOOK_COND include/linux/netfilter.h:240 [inline]
 [<ffffffff823d01e7>] ip_output+0x227/0x4c0 net/ipv4/ip_output.c:362
 [<ffffffff823ccf5c>] dst_output include/net/dst.h:498 [inline]
 [<ffffffff823ccf5c>] ip_local_out+0x9c/0x180 net/ipv4/ip_output.c:119
 [<ffffffff823ce2cc>] ip_queue_xmit+0x89c/0x1ab0 net/ipv4/ip_output.c:461
 [<ffffffff82431bb4>] __tcp_transmit_skb+0x1904/0x2cf0 net/ipv4/tcp_output.c:1034
 [<ffffffff82439c63>] tcp_transmit_skb net/ipv4/tcp_output.c:1047 [inline]
 [<ffffffff82439c63>] tcp_send_syn_data net/ipv4/tcp_output.c:3259 [inline]
 [<ffffffff82439c63>] tcp_connect+0x1bd3/0x31b0 net/ipv4/tcp_output.c:3294
 [<ffffffff82446ca0>] tcp_v4_connect+0x1060/0x1930 net/ipv4/tcp_ipv4.c:246
 [<ffffffff824a7a3f>] __inet_stream_connect+0x2cf/0xc70 net/ipv4/af_inet.c:615
 [<ffffffff823fc4fd>] tcp_sendmsg_fastopen net/ipv4/tcp.c:1092 [inline]
 [<ffffffff823fc4fd>] tcp_sendmsg+0x19ed/0x2ab0 net/ipv4/tcp.c:1112
 [<ffffffff824a8b52>] inet_sendmsg+0x202/0x4d0 net/ipv4/af_inet.c:755
 [<ffffffff821d7b8e>] sock_sendmsg_nosec net/socket.c:638 [inline]
 [<ffffffff821d7b8e>] sock_sendmsg+0xbe/0x110 net/socket.c:648
 [<ffffffff821dbcf1>] SYSC_sendto net/socket.c:1678 [inline]
 [<ffffffff821dbcf1>] SyS_sendto+0x201/0x340 net/socket.c:1646
 [<ffffffff82717fe1>] entry_SYSCALL_64_fastpath+0x1e/0x9a

Allocated by task 17443:
 [<ffffffff8102e3c6>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63
 [<ffffffff81483cb2>] save_stack mm/kasan/kasan.c:512 [inline]
 [<ffffffff81483cb2>] set_track mm/kasan/kasan.c:524 [inline]
 [<ffffffff81483cb2>] kasan_kmalloc.part.0+0x62/0xf0 mm/kasan/kasan.c:616
 [<ffffffff81483f27>] kasan_kmalloc+0xb7/0xd0 mm/kasan/kasan.c:601
 [<ffffffff814802b1>] __kmalloc+0x141/0x330 mm/slub.c:3613
 [<ffffffff822638c6>] kmalloc include/linux/slab.h:481 [inline]
 [<ffffffff822638c6>] kzalloc include/linux/slab.h:620 [inline]
 [<ffffffff822638c6>] neigh_alloc net/core/neighbour.c:285 [inline]
 [<ffffffff822638c6>] __neigh_create+0x1d6/0x1b30 net/core/neighbour.c:457
 [<ffffffff8239f95e>] neigh_create include/net/neighbour.h:313 [inline]
 [<ffffffff8239f95e>] ipv4_neigh_lookup+0x52e/0x6e0 net/ipv4/route.c:464
 [<ffffffff826b0abb>] dst_neigh_lookup include/net/dst.h:466 [inline]
 [<ffffffff826b0abb>] ip6_tnl_xmit2+0x27b/0x2320 net/ipv6/ip6_tunnel.c:982
 [<ffffffff826b4529>] ip4ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1134 [inline]
 [<ffffffff826b4529>] ip6_tnl_xmit+0xa09/0xe00 net/ipv6/ip6_tunnel.c:1212
 [<ffffffff82244721>] __netdev_start_xmit include/linux/netdevice.h:3750 [inline]
 [<ffffffff82244721>] netdev_start_xmit include/linux/netdevice.h:3759 [inline]
 [<ffffffff82244721>] xmit_one net/core/dev.c:2781 [inline]
 [<ffffffff82244721>] dev_hard_start_xmit+0x7c1/0x11e0 net/core/dev.c:2797
 [<ffffffff82246a7b>] __dev_queue_xmit+0x164b/0x1bb0 net/core/dev.c:3229
 [<ffffffff82246ff8>] dev_queue_xmit+0x18/0x20 net/core/dev.c:3263
 [<ffffffff8225b7e6>] neigh_direct_output+0x16/0x20 net/core/neighbour.c:1369
 [<ffffffff823c5152>] dst_neigh_output include/net/dst.h:461 [inline]
 [<ffffffff823c5152>] ip_finish_output2+0x6a2/0x1280 net/ipv4/ip_output.c:213
 [<ffffffff823cc422>] ip_finish_output+0x8b2/0xc60 net/ipv4/ip_output.c:288
 [<ffffffff823d01e7>] NF_HOOK_COND include/linux/netfilter.h:240 [inline]
 [<ffffffff823d01e7>] ip_output+0x227/0x4c0 net/ipv4/ip_output.c:362
 [<ffffffff823ccf5c>] dst_output include/net/dst.h:498 [inline]
 [<ffffffff823ccf5c>] ip_local_out+0x9c/0x180 net/ipv4/ip_output.c:119
 [<ffffffff823ce2cc>] ip_queue_xmit+0x89c/0x1ab0 net/ipv4/ip_output.c:461
 [<ffffffff82431bb4>] __tcp_transmit_skb+0x1904/0x2cf0 net/ipv4/tcp_output.c:1034
 [<ffffffff82439c63>] tcp_transmit_skb net/ipv4/tcp_output.c:1047 [inline]
 [<ffffffff82439c63>] tcp_send_syn_data net/ipv4/tcp_output.c:3259 [inline]
 [<ffffffff82439c63>] tcp_connect+0x1bd3/0x31b0 net/ipv4/tcp_output.c:3294
 [<ffffffff82446ca0>] tcp_v4_connect+0x1060/0x1930 net/ipv4/tcp_ipv4.c:246
 [<ffffffff824a7a3f>] __inet_stream_connect+0x2cf/0xc70 net/ipv4/af_inet.c:615
 [<ffffffff823fc4fd>] tcp_sendmsg_fastopen net/ipv4/tcp.c:1092 [inline]
 [<ffffffff823fc4fd>] tcp_sendmsg+0x19ed/0x2ab0 net/ipv4/tcp.c:1112
 [<ffffffff824a8b52>] inet_sendmsg+0x202/0x4d0 net/ipv4/af_inet.c:755
 [<ffffffff821d7b8e>] sock_sendmsg_nosec net/socket.c:638 [inline]
 [<ffffffff821d7b8e>] sock_sendmsg+0xbe/0x110 net/socket.c:648
 [<ffffffff821dbcf1>] SYSC_sendto net/socket.c:1678 [inline]
 [<ffffffff821dbcf1>] SyS_sendto+0x201/0x340 net/socket.c:1646
 [<ffffffff82717fe1>] entry_SYSCALL_64_fastpath+0x1e/0x9a

Freed by task 2114:
 [<ffffffff8102e3c6>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63
 [<ffffffff814845b0>] save_stack mm/kasan/kasan.c:512 [inline]
 [<ffffffff814845b0>] set_track mm/kasan/kasan.c:524 [inline]
 [<ffffffff814845b0>] kasan_slab_free+0xb0/0x190 mm/kasan/kasan.c:589
 [<ffffffff814819d4>] slab_free_hook mm/slub.c:1383 [inline]
 [<ffffffff814819d4>] slab_free_freelist_hook mm/slub.c:1405 [inline]
 [<ffffffff814819d4>] slab_free mm/slub.c:2859 [inline]
 [<ffffffff814819d4>] kfree+0xf4/0x310 mm/slub.c:3749
 [<ffffffff814097ad>] kvfree+0x4d/0x60 mm/util.c:323
 [<ffffffff8236d6eb>] xt_free_table_info+0x14b/0x1b0 net/netfilter/x_tables.c:1019
 [<ffffffff8251f169>] __do_replace+0x409/0x650 net/ipv6/netfilter/ip6_tables.c:1260
 [<ffffffff82524d51>] do_replace net/ipv4/netfilter/ip_tables.c:1305 [inline]
 [<ffffffff82524d51>] do_ipt_set_ctl+0x2e1/0x450 net/ipv4/netfilter/ip_tables.c:1862
 [<ffffffff822fc6bd>] nf_sockopt net/netfilter/nf_sockopt.c:105 [inline]
 [<ffffffff822fc6bd>] nf_setsockopt+0x6d/0xc0 net/netfilter/nf_sockopt.c:114
 [<ffffffff823da47a>] ip_setsockopt net/ipv4/ip_sockglue.c:1227 [inline]
 [<ffffffff823da47a>] ip_setsockopt+0x8a/0xa0 net/ipv4/ip_sockglue.c:1212
 [<ffffffff823f760a>] tcp_setsockopt net/ipv4/tcp.c:2643 [inline]
 [<ffffffff823f760a>] tcp_setsockopt+0x8a/0xe0 net/ipv4/tcp.c:2637
 [<ffffffff821de72a>] sock_common_setsockopt+0x9a/0xe0 net/core/sock.c:2662
 [<ffffffff821dc359>] SYSC_setsockopt net/socket.c:1780 [inline]
 [<ffffffff821dc359>] SyS_setsockopt+0x159/0x240 net/socket.c:1759
 [<ffffffff82717fe1>] entry_SYSCALL_64_fastpath+0x1e/0x9a

The buggy address belongs to the object at ffff8801d0494900
 which belongs to the cache kmalloc-1024 of size 1024
The buggy address is located 688 bytes inside of
 1024-byte region [ffff8801d0494900, ffff8801d0494d00)
The buggy address belongs to the page:
kasan: CONFIG_KASAN_INLINE enabled
kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral protection fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 2117 Comm: syz-executor305 Not tainted 4.4.171+ #12
task: ffff8800b6a397c0 task.stack: ffff8800b6630000
RIP: 0010:[<ffffffff81b0d14c>]  [<ffffffff81b0d14c>] __debug_check_no_obj_freed lib/debugobjects.c:692 [inline]
RIP: 0010:[<ffffffff81b0d14c>]  [<ffffffff81b0d14c>] debug_check_no_obj_freed+0x18c/0x6e0 lib/debugobjects.c:729
RSP: 0018:ffff8800b6637a20  EFLAGS: 00010002
RAX: 0000000000042f73 RBX: 00000000006e5a00 RCX: ffffffff81b0d449
RDX: 00000000000dcb40 RSI: ffff8800b6637a98 RDI: ffff8801d211ff60
RBP: ffff8800b6637b00 R08: 0000000000000292 R09: ffff8800b6a3a0d0
R10: ffffffff83a23b80 R11: 0000000000000000 R12: dffffc0000000000
R13: 00007fc42b5129c0 R14: ffffffff8409c208 R15: 00000000006e5a00
FS:  0000000002122940(0063) GS:ffff8801db600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00000000006e2414 CR3: 00000000ba35a000 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:
 ffff8800b6637a30 ffff8800b6637a98 ffff8801d21a0000 ffff8801d219f100
 ffffffff00042d10 0000000000000292 fffffbfff0813840 1ffff10016cc6f4f
 ffffffff8409c200 ffff8801d219ed00 ffff8801d219f000 0000000041b58ab3
Call Trace:
 [<ffffffff81481a66>] slab_free_hook mm/slub.c:1376 [inline]
 [<ffffffff81481a66>] slab_free_freelist_hook mm/slub.c:1405 [inline]
 [<ffffffff81481a66>] slab_free mm/slub.c:2859 [inline]
 [<ffffffff81481a66>] kfree+0x186/0x310 mm/slub.c:3749
 [<ffffffff814097ad>] kvfree+0x4d/0x60 mm/util.c:323
 [<ffffffff8236d6eb>] xt_free_table_info+0x14b/0x1b0 net/netfilter/x_tables.c:1019
 [<ffffffff8251f169>] __do_replace+0x409/0x650 net/ipv6/netfilter/ip6_tables.c:1260
 [<ffffffff82524d51>] do_replace net/ipv4/netfilter/ip_tables.c:1305 [inline]
 [<ffffffff82524d51>] do_ipt_set_ctl+0x2e1/0x450 net/ipv4/netfilter/ip_tables.c:1862
 [<ffffffff822fc6bd>] nf_sockopt net/netfilter/nf_sockopt.c:105 [inline]
 [<ffffffff822fc6bd>] nf_setsockopt+0x6d/0xc0 net/netfilter/nf_sockopt.c:114
 [<ffffffff823da47a>] ip_setsockopt net/ipv4/ip_sockglue.c:1227 [inline]
 [<ffffffff823da47a>] ip_setsockopt+0x8a/0xa0 net/ipv4/ip_sockglue.c:1212
 [<ffffffff823f760a>] tcp_setsockopt net/ipv4/tcp.c:2643 [inline]
 [<ffffffff823f760a>] tcp_setsockopt+0x8a/0xe0 net/ipv4/tcp.c:2637
 [<ffffffff821de72a>] sock_common_setsockopt+0x9a/0xe0 net/core/sock.c:2662
 [<ffffffff821dc359>] SYSC_setsockopt net/socket.c:1780 [inline]
 [<ffffffff821dc359>] SyS_setsockopt+0x159/0x240 net/socket.c:1759
 [<ffffffff82717fe1>] entry_SYSCALL_64_fastpath+0x1e/0x9a
Code: ff ff 80 38 00 0f 85 ff 04 00 00 48 8b 85 60 ff ff ff 4c 8b 38 4d 85 ff 0f 84 e6 02 00 00 48 8d 75 98 31 c0 4c 89 fa 48 c1 ea 03 <42> 80 3c 22 00 0f 85 d6 02 00 00 49 8d 7f 18 83 c0 01 49 8b 1f 
RIP  [<ffffffff81b0d14c>] __debug_check_no_obj_freed lib/debugobjects.c:692 [inline]
RIP  [<ffffffff81b0d14c>] debug_check_no_obj_freed+0x18c/0x6e0 lib/debugobjects.c:729
 RSP <ffff8800b6637a20>
---[ end trace 04187132b913ef49 ]---