==================================================================
BUG: KASAN: use-after-free in perf_output_read_group kernel/events/core.c:5882 [inline]
BUG: KASAN: use-after-free in perf_output_read+0xe58/0xfc0 kernel/events/core.c:5917
Read of size 8 at addr ffff8881d9804b08 by task syz-executor.5/10792

CPU: 0 PID: 10792 Comm: syz-executor.5 Not tainted 4.14.124+ #3
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0xb9/0x10e lib/dump_stack.c:53
 print_address_description+0x60/0x226 mm/kasan/report.c:252
 kasan_report_error mm/kasan/report.c:351 [inline]
 kasan_report mm/kasan/report.c:409 [inline]
 kasan_report.cold+0xae/0x2d5 mm/kasan/report.c:393

Allocated by task 10757:
 save_stack mm/kasan/kasan.c:447 [inline]
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_kmalloc.part.0+0x4f/0xd0 mm/kasan/kasan.c:551
 slab_post_alloc_hook mm/slab.h:442 [inline]
 slab_alloc_node mm/slub.c:2723 [inline]
 slab_alloc mm/slub.c:2731 [inline]
 __kmalloc_track_caller+0xf1/0x310 mm/slub.c:4288
 __kmalloc_reserve.isra.0+0x2d/0xc0 net/core/skbuff.c:137
 __alloc_skb+0x105/0x550 net/core/skbuff.c:205
 alloc_skb include/linux/skbuff.h:980 [inline]
 sock_wmalloc+0xa5/0xf0 net/core/sock.c:1928
 __ip_append_data.isra.0+0x198f/0x2040 net/ipv4/ip_output.c:979
 ip_append_data.part.0+0xd6/0x150 net/ipv4/ip_output.c:1174
 ip_append_data net/ipv4/ip_output.c:1163 [inline]
 ip_send_unicast_reply+0x7cd/0xcc0 net/ipv4/ip_output.c:1568
 tcp_v4_send_reset+0x899/0x1100 net/ipv4/tcp_ipv4.c:714
 tcp_v4_rcv+0x1675/0x3190 net/ipv4/tcp_ipv4.c:1765
 ip_local_deliver_finish+0x396/0xa20 net/ipv4/ip_input.c:216
 NF_HOOK include/linux/netfilter.h:250 [inline]
 ip_local_deliver+0x373/0x450 net/ipv4/ip_input.c:257
 dst_input include/net/dst.h:465 [inline]
 ip_rcv_finish+0x5ae/0x1480 net/ipv4/ip_input.c:396
 NF_HOOK include/linux/netfilter.h:250 [inline]
 ip_rcv+0xa1c/0xf41 net/ipv4/ip_input.c:493
 __netif_receive_skb_core+0x1364/0x2c80 net/core/dev.c:4477
 __netif_receive_skb+0x55/0x1f0 net/core/dev.c:4515
 process_backlog+0x1dc/0x640 net/core/dev.c:5197
 napi_poll net/core/dev.c:5598 [inline]
 net_rx_action+0x36b/0xcd0 net/core/dev.c:5664

Freed by task 10757:
 save_stack mm/kasan/kasan.c:447 [inline]
 set_track mm/kasan/kasan.c:459 [inline]
 kasan_slab_free+0xb0/0x190 mm/kasan/kasan.c:524
 slab_free_hook mm/slub.c:1389 [inline]
 slab_free_freelist_hook mm/slub.c:1410 [inline]
 slab_free mm/slub.c:2966 [inline]
 kfree+0xf5/0x310 mm/slub.c:3897
 skb_free_head+0x83/0xa0 net/core/skbuff.c:554
 skb_release_data+0x4ae/0x730 net/core/skbuff.c:574
 skb_release_all+0x46/0x60 net/core/skbuff.c:631
 __kfree_skb+0x11/0x20 net/core/skbuff.c:645
 tcp_rcv_state_process+0x304/0x49fe net/ipv4/tcp_input.c:6151
 tcp_v4_do_rcv+0x2eb/0x700 net/ipv4/tcp_ipv4.c:1489
 sk_backlog_rcv include/net/sock.h:912 [inline]
 __release_sock+0x135/0x360 net/core/sock.c:2262
 release_sock+0x54/0x1b0 net/core/sock.c:2777
 inet_wait_for_connect net/ipv4/af_inet.c:555 [inline]
 __inet_stream_connect+0x4ad/0xba0 net/ipv4/af_inet.c:641
 tcp_sendmsg_fastopen net/ipv4/tcp.c:1153 [inline]
 tcp_sendmsg_locked+0x21c6/0x31d0 net/ipv4/tcp.c:1199
 tcp_sendmsg+0x2b/0x40 net/ipv4/tcp.c:1446
 inet_sendmsg+0x14a/0x510 net/ipv4/af_inet.c:760
 sock_sendmsg_nosec net/socket.c:646 [inline]
 sock_sendmsg+0xb7/0x100 net/socket.c:656
 SYSC_sendto net/socket.c:1763 [inline]
 SyS_sendto+0x1de/0x2f0 net/socket.c:1731
 do_syscall_64+0x19b/0x510 arch/x86/entry/common.c:292

The buggy address belongs to the object at ffff8881d9804a00
 which belongs to the cache kmalloc-512 of size 512
The buggy address is located 264 bytes inside of
 512-byte region [ffff8881d9804a00, ffff8881d9804c00)
The buggy address belongs to the page:
page:ffffea0007660100 count:1 mapcount:0 mapping:          (null) index:0x0 compound_mapcount: 0
flags: 0x4000000000010200(slab|head)
raw: 4000000000010200 0000000000000000 0000000000000000 00000001000c000c
raw: 0000000000000000 0000000600000001 ffff8881da802c00 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8881d9804a00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8881d9804a80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8881d9804b00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                      ^
 ffff8881d9804b80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8881d9804c00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================