==================================================================
BUG: KASAN: use-after-free in __read_once_size include/linux/compiler.h:218 [inline]
BUG: KASAN: use-after-free in atomic_read arch/x86/include/asm/atomic.h:26 [inline]
BUG: KASAN: use-after-free in __atomic_add_unless arch/x86/include/asm/atomic.h:211 [inline]
BUG: KASAN: use-after-free in atomic_add_unless include/linux/atomic.h:437 [inline]
BUG: KASAN: use-after-free in sk_dst_get include/net/sock.h:1741 [inline]
BUG: KASAN: use-after-free in sk_dst_check+0x372/0x3a0 net/core/sock.c:546
Read of size 4 at addr ffff8801d2b9a940 by task syz-executor5/26812

CPU: 0 PID: 26812 Comm: syz-executor5 Not tainted 4.4.164+ #13
 0000000000000000 3ef6640ca4ac9467 ffff8801b135f670 ffffffff81aa5d4d
 ffffea00074ae680 ffff8801d2b9a940 0000000000000000 ffff8801d2b9a940
 ffff8801d2b9a940 ffff8801b135f6a8 ffffffff8148b2eb ffff8801d2b9a940
Call Trace:
 [<ffffffff81aa5d4d>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81aa5d4d>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
 [<ffffffff8148b2eb>] print_address_description+0x6c/0x217 mm/kasan/report.c:252
 [<ffffffff8148b60b>] kasan_report_error mm/kasan/report.c:351 [inline]
 [<ffffffff8148b60b>] kasan_report.cold.6+0x175/0x2f7 mm/kasan/report.c:408
 [<ffffffff81480314>] __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:428
 [<ffffffff821d9cf2>] __read_once_size include/linux/compiler.h:218 [inline]
 [<ffffffff821d9cf2>] atomic_read arch/x86/include/asm/atomic.h:26 [inline]
 [<ffffffff821d9cf2>] __atomic_add_unless arch/x86/include/asm/atomic.h:211 [inline]
 [<ffffffff821d9cf2>] atomic_add_unless include/linux/atomic.h:437 [inline]
 [<ffffffff821d9cf2>] sk_dst_get include/net/sock.h:1741 [inline]
 [<ffffffff821d9cf2>] sk_dst_check+0x372/0x3a0 net/core/sock.c:546
 [<ffffffff8247967a>] udp_sendmsg+0x112a/0x1c70 net/ipv4/udp.c:1019
 [<ffffffff824a2eb3>] inet_sendmsg+0x203/0x4d0 net/ipv4/af_inet.c:755
 [<ffffffff821d00db>] sock_sendmsg_nosec net/socket.c:638 [inline]
 [<ffffffff821d00db>] sock_sendmsg+0xbb/0x110 net/socket.c:648
 [<ffffffff821d1c21>] ___sys_sendmsg+0x441/0x880 net/socket.c:1975
 [<ffffffff821d5254>] __sys_sendmmsg+0x1d4/0x2e0 net/socket.c:2053
 [<ffffffff822a6262>] C_SYSC_sendmmsg net/compat.c:728 [inline]
 [<ffffffff822a6262>] compat_SyS_sendmmsg+0x32/0x40 net/compat.c:725
 [<ffffffff8100629e>] do_syscall_32_irqs_on arch/x86/entry/common.c:396 [inline]
 [<ffffffff8100629e>] do_fast_syscall_32+0x31e/0xa80 arch/x86/entry/common.c:463
 [<ffffffff827155d0>] sysenter_flags_fixed+0xd/0x1a

Allocated by task 26812:
 [<ffffffff8102e566>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63
 [<ffffffff8147f372>] save_stack mm/kasan/kasan.c:512 [inline]
 [<ffffffff8147f372>] set_track mm/kasan/kasan.c:524 [inline]
 [<ffffffff8147f372>] kasan_kmalloc.part.1+0x62/0xf0 mm/kasan/kasan.c:616
 [<ffffffff8147f5ef>] kasan_kmalloc+0xaf/0xc0 mm/kasan/kasan.c:601
 [<ffffffff8147fbb2>] kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:554
 [<ffffffff8147b2ac>] slab_post_alloc_hook mm/slub.c:1349 [inline]
 [<ffffffff8147b2ac>] slab_alloc_node mm/slub.c:2615 [inline]
 [<ffffffff8147b2ac>] slab_alloc mm/slub.c:2623 [inline]
 [<ffffffff8147b2ac>] kmem_cache_alloc+0xdc/0x2c0 mm/slub.c:2628
 [<ffffffff822506a5>] dst_alloc+0xb5/0x1a0 net/core/dst.c:210
 [<ffffffff823ab810>] ipv4_blackhole_route+0x30/0x700 net/ipv4/route.c:2396
 [<ffffffff8254c835>] make_blackhole net/xfrm/xfrm_policy.c:2161 [inline]
 [<ffffffff8254c835>] xfrm_lookup_route+0xf5/0x140 net/xfrm/xfrm_policy.c:2331
 [<ffffffff8239ff60>] ip_route_output_flow+0x90/0xa0 net/ipv4/route.c:2437
 [<ffffffff824799d0>] udp_sendmsg+0x1480/0x1c70 net/ipv4/udp.c:1040
 [<ffffffff824a2eb3>] inet_sendmsg+0x203/0x4d0 net/ipv4/af_inet.c:755
 [<ffffffff821d00db>] sock_sendmsg_nosec net/socket.c:638 [inline]
 [<ffffffff821d00db>] sock_sendmsg+0xbb/0x110 net/socket.c:648
 [<ffffffff821d1c21>] ___sys_sendmsg+0x441/0x880 net/socket.c:1975
 [<ffffffff821d5254>] __sys_sendmmsg+0x1d4/0x2e0 net/socket.c:2053
 [<ffffffff822a6262>] C_SYSC_sendmmsg net/compat.c:728 [inline]
 [<ffffffff822a6262>] compat_SyS_sendmmsg+0x32/0x40 net/compat.c:725
 [<ffffffff8100629e>] do_syscall_32_irqs_on arch/x86/entry/common.c:396 [inline]
 [<ffffffff8100629e>] do_fast_syscall_32+0x31e/0xa80 arch/x86/entry/common.c:463
 [<ffffffff827155d0>] sysenter_flags_fixed+0xd/0x1a

Freed by task 16839:
 [<ffffffff8102e566>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63
 [<ffffffff8147fc6c>] save_stack mm/kasan/kasan.c:512 [inline]
 [<ffffffff8147fc6c>] set_track mm/kasan/kasan.c:524 [inline]
 [<ffffffff8147fc6c>] kasan_slab_free+0xac/0x190 mm/kasan/kasan.c:589
 [<ffffffff8147c96e>] slab_free_hook mm/slub.c:1383 [inline]
 [<ffffffff8147c96e>] slab_free_freelist_hook mm/slub.c:1405 [inline]
 [<ffffffff8147c96e>] slab_free mm/slub.c:2859 [inline]
 [<ffffffff8147c96e>] kmem_cache_free+0xbe/0x350 mm/slub.c:2881
 [<ffffffff822509fc>] dst_destroy.part.1+0x26c/0x330 net/core/dst.c:270
 [<ffffffff82250c93>] dst_destroy net/core/dst.c:252 [inline]
 [<ffffffff82250c93>] dst_gc_task+0x1b3/0x510 net/core/dst.c:89
 [<ffffffff811233a4>] process_one_work+0x824/0x1730 kernel/workqueue.c:2064
 [<ffffffff81124389>] worker_thread+0xd9/0x1060 kernel/workqueue.c:2196
 [<ffffffff81134928>] kthread+0x268/0x300 kernel/kthread.c:211
 [<ffffffff82714245>] ret_from_fork+0x55/0x80 arch/x86/entry/entry_64.S:510

The buggy address belongs to the object at ffff8801d2b9a8c0
 which belongs to the cache ip_dst_cache of size 208
The buggy address is located 128 bytes inside of
 208-byte region [ffff8801d2b9a8c0, ffff8801d2b9a990)
The buggy address belongs to the page:
double fault: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 26812 Comm: syz-executor5 Not tainted 4.4.164+ #13
task: ffff880098cec740 task.stack: ffff8801b1358000
RIP: 0010:[<ffffffff81426be8>]  [<ffffffff81426be8>] dump_page_badflags+0x8/0x70 mm/debug.c:84
RSP: 0018:ffff880100000000  EFLAGS: 00010046
RAX: 0000000000040000 RBX: ffffea00074ae680 RCX: ffffc90003179000
RDX: 0000000000000000 RSI: ffffffff82891020 RDI: ffffea00074ae680
RBP: ffff880100000010 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: ffffffff83fd7174 R12: ffffffff82891020
R13: ffffffff82891020 R14: ffff8801d2b9a8c0 R15: ffff8801d2b9a990
FS:  0000000000000000(0000) GS:ffff8801db600000(0063) knlGS:00000000f57aab40
CS:  0010 DS: 002b ES: 002b CR0: 0000000080050033
CR2: ffff8800fffffff8 CR3: 00000001d2846000 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Stack:

Call Trace:
 <UNK> 
Code: c0 80 06 00 00 f0 48 ff 80 28 f8 18 83 5b 5d c3 48 89 df e8 4b 97 05 00 eb dd 66 0f 1f 84 00 00 00 00 00 55 48 89 e5 41 57 41 56 <41> 55 49 89 f5 41 54 49 89 d4 53 48 89 fb 48 83 ec 08 e8 01 07 
RIP  [<ffffffff81426be8>] dump_page_badflags+0x8/0x70 mm/debug.c:84
 RSP <ffff880100000000>
---[ end trace 5dd521cf189dd6f3 ]---