==================================================================
BUG: KASAN: slab-out-of-bounds in eth_header_parse_protocol+0xad/0xd0 net/ethernet/eth.c:282
Read of size 2 at addr ffff8881e66e800b by task syz-executor.5/3641

CPU: 1 PID: 3641 Comm: syz-executor.5 Not tainted 5.4.111-syzkaller-00141-gce6a5172613f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1d8/0x24e lib/dump_stack.c:118
 print_address_description+0x9b/0x650 mm/kasan/report.c:384
 __kasan_report+0x182/0x260 mm/kasan/report.c:516
 kasan_report+0x30/0x60 mm/kasan/common.c:641
 eth_header_parse_protocol+0xad/0xd0 net/ethernet/eth.c:282
 dev_parse_header_protocol include/linux/netdevice.h:3016 [inline]
 virtio_net_hdr_to_skb+0x6de/0xd70 include/linux/virtio_net.h:83
 packet_snd net/packet/af_packet.c:2976 [inline]
 packet_sendmsg+0x483a/0x6780 net/packet/af_packet.c:3013
 sock_sendmsg_nosec net/socket.c:638 [inline]
 sock_sendmsg net/socket.c:658 [inline]
 kernel_sendmsg+0xf5/0x130 net/socket.c:678
 sock_no_sendpage+0x143/0x1b0 net/core/sock.c:2763
 kernel_sendpage net/socket.c:3764 [inline]
 sock_sendpage+0xd0/0x120 net/socket.c:936
 pipe_to_sendpage+0x23b/0x300 fs/splice.c:449
 splice_from_pipe_feed fs/splice.c:500 [inline]
 __splice_from_pipe+0x2d3/0x870 fs/splice.c:624
 splice_from_pipe fs/splice.c:659 [inline]
 generic_splice_sendpage+0x181/0x210 fs/splice.c:829
 do_splice_from fs/splice.c:848 [inline]
 do_splice fs/splice.c:1156 [inline]
 __do_sys_splice fs/splice.c:1433 [inline]
 __se_sys_splice+0x7a8/0x1b00 fs/splice.c:1413
 do_syscall_64+0xcb/0x1e0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x466459
Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 bc ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007fcefeabd188 EFLAGS: 00000246 ORIG_RAX: 0000000000000113
RAX: ffffffffffffffda RBX: 000000000056c008 RCX: 0000000000466459
RDX: 0000000000000005 RSI: 0000000000000000 RDI: 0000000000000003
RBP: 00000000004bf9fb R08: 000000000004ffe0 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 000000000056c008
R13: 00007ffdd5f9568f R14: 00007fcefeabd300 R15: 0000000000022000

Allocated by task 0:
(stack is not available)

Freed by task 0:
(stack is not available)

The buggy address belongs to the object at ffff8881e66e8000
 which belongs to the cache TCPv6 of size 2464
The buggy address is located 11 bytes inside of
 2464-byte region [ffff8881e66e8000, ffff8881e66e89a0)
The buggy address belongs to the page:
page:ffffea000799ba00 refcount:1 mapcount:0 mapping:ffff8881f1412500 index:0xffff8881e66ed200 compound_mapcount: 0
flags: 0x8000000000010200(slab|head)
raw: 8000000000010200 dead000000000100 dead000000000122 ffff8881f1412500
raw: ffff8881e66ed200 00000000800c0009 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8881e66e7f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8881e66e7f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8881e66e8000: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                      ^
 ffff8881e66e8080: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff8881e66e8100: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
==================================================================