------------[ cut here ]------------
kernel BUG at net/core/skbuff.c:2193!
invalid opcode: 0000 [#1] PREEMPT SMP KASAN
Dumping ftrace buffer:
   (ftrace buffer empty)
Modules linked in:
CPU: 1 PID: 12497 Comm: syz-executor6 Not tainted 4.4.151-g37af2ff #85
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8801d7ec0000 task.stack: ffff8801a2bc0000
RIP: 0010:[<ffffffff82f4506a>]  [<ffffffff82f4506a>] skb_copy_and_csum_bits+0x69a/0x7d0 net/core/skbuff.c:2193
RSP: 0018:ffff8801db307258  EFLAGS: 00010206
RAX: ffff8801d7ec0000 RBX: 0000000075f2e742 RCX: 1ffff1003b213329
RDX: 0000000000000100 RSI: ffffffff82f4506a RDI: ffff8801d9099948
RBP: ffff8801db3072d8 R08: 0000000000000000 R09: 0000000000000000
R10: 000000000000003c R11: ffff8800942794df R12: 0000000000000000
R13: 0000000000000224 R14: 0000000000000000 R15: ffff8801d9099940
FS:  0000000000000000(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000a3fdc8 CR3: 000000000440c000 CR4: 00000000001606f0
Stack:
 ffffffff81293b9c ffff8801d98d5344 ffffffff838cf63c ffffffff811428cd
 ffff8801d98d5348 ffff880094279268 75f2e7420000003c 000001e80000003c
 0000003c0000003c ffff8801d98d5280 0000000000000000 ffff8801cf739840
Call Trace:
 <IRQ> 
 [<ffffffff832ede6f>] icmp_glue_bits+0x7f/0x1e0 net/ipv4/icmp.c:344
 [<ffffffff8321cee6>] __ip_append_data.isra.45+0x1e76/0x2a70 net/ipv4/ip_output.c:1045
 [<ffffffff8321dbc4>] ip_append_data.part.47+0xe4/0x150 net/ipv4/ip_output.c:1195
 [<ffffffff83226248>] ip_append_data+0x68/0x80 net/ipv4/ip_output.c:1184
 [<ffffffff832eda7e>] icmp_push_reply+0x19e/0x510 net/ipv4/icmp.c:362
 [<ffffffff832f241a>] icmp_send+0xaca/0x13d0 net/ipv4/icmp.c:727
 [<ffffffff83221cca>] ip_fragment.constprop.51+0x1aa/0x200 net/ipv4/ip_output.c:511
 [<ffffffff832221aa>] ip_finish_output+0x48a/0xc00 net/ipv4/ip_output.c:286
 [<ffffffff83225f39>] NF_HOOK_COND include/linux/netfilter.h:240 [inline]
 [<ffffffff83225f39>] ip_output+0x219/0x4c0 net/ipv4/ip_output.c:362
 [<ffffffff83222dfb>] dst_output include/net/dst.h:498 [inline]
 [<ffffffff83222dfb>] ip_local_out+0x9b/0x180 net/ipv4/ip_output.c:119
 [<ffffffff8322413e>] ip_queue_xmit+0x88e/0x1af0 net/ipv4/ip_output.c:461
 [<ffffffff83289e31>] __tcp_transmit_skb+0x1691/0x2c50 net/ipv4/tcp_output.c:1034
 [<ffffffff83294f10>] tcp_transmit_skb net/ipv4/tcp_output.c:1047 [inline]
 [<ffffffff83294f10>] __tcp_retransmit_skb+0x640/0x1910 net/ipv4/tcp_output.c:2661
 [<ffffffff832968d3>] tcp_retransmit_skb+0x23/0x2c0 net/ipv4/tcp_output.c:2678
 [<ffffffff8329c32d>] tcp_retransmit_timer+0x7bd/0x1ed0 net/ipv4/tcp_timer.c:461
 [<ffffffff8329dc31>] tcp_write_timer_handler+0x1f1/0x6f0 net/ipv4/tcp_timer.c:543
 [<ffffffff8329e1ea>] tcp_write_timer+0xba/0xd0 net/ipv4/tcp_timer.c:561
 [<ffffffff81293b9c>] call_timer_fn+0x18c/0x870 kernel/time/timer.c:1185
 [<ffffffff812948c2>] __run_timers kernel/time/timer.c:1261 [inline]
 [<ffffffff812948c2>] run_timer_softirq+0x642/0xb90 kernel/time/timer.c:1444
 [<ffffffff838cf63c>] __do_softirq+0x22c/0xa1a kernel/softirq.c:273
 [<ffffffff811428cd>] invoke_softirq kernel/softirq.c:350 [inline]
 [<ffffffff811428cd>] irq_exit+0x10d/0x140 kernel/softirq.c:391
 [<ffffffff838ceda1>] exiting_irq arch/x86/include/asm/apic.h:652 [inline]
 [<ffffffff838ceda1>] smp_apic_timer_interrupt+0x81/0xa0 arch/x86/kernel/apic/apic.c:926
 [<ffffffff838cdce0>] apic_timer_interrupt+0xa0/0xb0 arch/x86/entry/entry_64.S:741
 <EOI> 
 [<ffffffff81e78bfc>] __debug_check_no_obj_freed lib/debugobjects.c:710 [inline]
 [<ffffffff81e78bfc>] debug_check_no_obj_freed+0x2ec/0x940 lib/debugobjects.c:726
 [<ffffffff8142fe8e>] free_pages_prepare+0x51e/0xad0 mm/page_alloc.c:1049
 [<ffffffff814334ec>] __free_pages_ok+0x1c/0xb60 mm/page_alloc.c:1064
 [<ffffffff8143408e>] free_compound_page+0x5e/0x70 mm/page_alloc.c:504
 [<ffffffff81447236>] __put_compound_page+0xa6/0xf0 mm/swap.c:89
 [<ffffffff8144823b>] put_compound_page+0xdb/0xb70 mm/swap.c:249
 [<ffffffff81449d50>] release_pages+0x110/0x4f0 mm/swap.c:926
 [<ffffffff814d11f6>] free_pages_and_swap_cache+0x106/0x140 mm/swap_state.c:266
 [<ffffffff81493ed4>] tlb_flush_mmu_free+0xb4/0x150 mm/memory.c:255
 [<ffffffff8149942b>] zap_pte_range mm/memory.c:1217 [inline]
 [<ffffffff8149942b>] zap_pmd_range mm/memory.c:1262 [inline]
 [<ffffffff8149942b>] zap_pud_range mm/memory.c:1283 [inline]
 [<ffffffff8149942b>] unmap_page_range mm/memory.c:1307 [inline]
 [<ffffffff8149942b>] unmap_single_vma+0xdbb/0x12b0 mm/memory.c:1352
 [<ffffffff8149b511>] unmap_vmas+0x81/0xd0 mm/memory.c:1382
 [<ffffffff814b42b9>] exit_mmap+0x1c9/0x3a0 mm/mmap.c:2958
 [<ffffffff81128518>] __mmput kernel/fork.c:717 [inline]
 [<ffffffff81128518>] mmput+0xf8/0x2d0 kernel/fork.c:737
 [<ffffffff811381a8>] exit_mm kernel/exit.c:440 [inline]
 [<ffffffff811381a8>] do_exit+0x8d8/0x26b0 kernel/exit.c:742
 [<ffffffff8113e1f1>] do_group_exit+0x111/0x330 kernel/exit.c:885
 [<ffffffff811615ec>] get_signal+0x4ec/0x14b0 kernel/signal.c:2321
 [<ffffffff8100df4b>] do_signal+0x8b/0x1d30 arch/x86/kernel/signal.c:712
 [<ffffffff8100360a>] exit_to_usermode_loop+0x11a/0x160 arch/x86/entry/common.c:249
 [<ffffffff81006535>] prepare_exit_to_usermode arch/x86/entry/common.c:284 [inline]
 [<ffffffff81006535>] syscall_return_slowpath+0x1b5/0x1f0 arch/x86/entry/common.c:349
 [<ffffffff838cc2b5>] int_ret_from_sys_call+0x25/0xa3
Code: 00 00 4d 8b 24 24 44 8b 6d d0 4d 85 e4 0f 85 1b ff ff ff 8b 5d b4 e8 a6 f5 40 fe 8b 45 bc 85 c0 0f 84 7f fe ff ff e8 96 f5 40 fe <0f> 0b 8b 5d b4 e9 70 fe ff ff c7 45 b0 00 00 00 00 e9 8c fa ff 
RIP  [<ffffffff82f4506a>] skb_copy_and_csum_bits+0x69a/0x7d0 net/core/skbuff.c:2193
 RSP <ffff8801db307258>
---[ end trace 48ff88ed61d9de98 ]---