audit: type=1400 audit(1542297071.376:1350): avc:  denied  { write } for  pid=22760 comm="syz-executor4" scontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tcontext=unconfined_u:system_r:insmod_t:s0-s0:c0.c1023 tclass=netlink_generic_socket permissive=1
==================================================================
BUG: KASAN: use-after-free in tcp_skb_pcount include/net/tcp.h:798 [inline]
BUG: KASAN: use-after-free in tcp_init_tso_segs net/ipv4/tcp_output.c:1631 [inline]
BUG: KASAN: use-after-free in tcp_write_xmit+0x3b22/0x4680 net/ipv4/tcp_output.c:2068
Read of size 2 at addr ffff8801c22302b0 by task syz-executor2/22773

CPU: 0 PID: 22773 Comm: syz-executor2 Not tainted 4.4.163+ #12
 0000000000000000 5920afd29fa4e06e ffff8801db6074e0 ffffffff81aa556d
 ffffea0007088c00 ffff8801c22302b0 0000000000000000 ffff8801c22302b0
 dffffc0000000000 ffff8801db607518 ffffffff8148a8db ffff8801c22302b0
Call Trace:
 <IRQ>  [<ffffffff81aa556d>] __dump_stack lib/dump_stack.c:15 [inline]
 <IRQ>  [<ffffffff81aa556d>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
 [<ffffffff8148a8db>] print_address_description+0x6c/0x217 mm/kasan/report.c:252
 [<ffffffff8148abfb>] kasan_report_error mm/kasan/report.c:351 [inline]
 [<ffffffff8148abfb>] kasan_report.cold.6+0x175/0x2f7 mm/kasan/report.c:408
 [<ffffffff8147f8e4>] __asan_report_load2_noabort+0x14/0x20 mm/kasan/report.c:427
 [<ffffffff82430342>] tcp_skb_pcount include/net/tcp.h:798 [inline]
 [<ffffffff82430342>] tcp_init_tso_segs net/ipv4/tcp_output.c:1631 [inline]
 [<ffffffff82430342>] tcp_write_xmit+0x3b22/0x4680 net/ipv4/tcp_output.c:2068
 [<ffffffff82431734>] __tcp_push_pending_frames+0xa4/0x2a0 net/ipv4/tcp_output.c:2319
 [<ffffffff8241f232>] tcp_push_pending_frames include/net/tcp.h:1585 [inline]
 [<ffffffff8241f232>] tcp_data_snd_check net/ipv4/tcp_input.c:5075 [inline]
 [<ffffffff8241f232>] tcp_rcv_state_process+0xb02/0x4180 net/ipv4/tcp_input.c:6130
 [<ffffffff824436a5>] tcp_v4_do_rcv+0x1a5/0x7a0 net/ipv4/tcp_ipv4.c:1421
 [<ffffffff8244edc4>] tcp_v4_rcv+0x2a84/0x3750 net/ipv4/tcp_ipv4.c:1680
 [<ffffffff823af7d0>] ip_local_deliver_finish+0x3c0/0xa70 net/ipv4/ip_input.c:216
 [<ffffffff823b178c>] NF_HOOK_THRESH include/linux/netfilter.h:226 [inline]
 [<ffffffff823b178c>] NF_HOOK include/linux/netfilter.h:249 [inline]
 [<ffffffff823b178c>] ip_local_deliver+0x1ac/0x390 net/ipv4/ip_input.c:257
 [<ffffffff823b05d9>] dst_input include/net/dst.h:504 [inline]
 [<ffffffff823b05d9>] ip_rcv_finish+0x759/0x1220 net/ipv4/ip_input.c:365
 [<ffffffff823b2209>] NF_HOOK_THRESH include/linux/netfilter.h:226 [inline]
 [<ffffffff823b2209>] NF_HOOK include/linux/netfilter.h:249 [inline]
 [<ffffffff823b2209>] ip_rcv+0x899/0xfc0 net/ipv4/ip_input.c:455
 [<ffffffff822282f8>] __netif_receive_skb_core+0x12c8/0x2820 net/core/dev.c:4041
 [<ffffffff822309ab>] __netif_receive_skb+0x5b/0x1c0 net/core/dev.c:4076
 [<ffffffff82237d4a>] process_backlog+0x20a/0x670 net/core/dev.c:4669
 [<ffffffff82237157>] napi_poll net/core/dev.c:4907 [inline]
 [<ffffffff82237157>] net_rx_action+0x367/0xd50 net/core/dev.c:4972
 [<ffffffff827152ea>] __do_softirq+0x22a/0xa3e kernel/softirq.c:273
 [<ffffffff827134dc>] do_softirq_own_stack+0x1c/0x30 arch/x86/entry/entry_64.S:929
 <EOI>  [<ffffffff810e1c74>] do_softirq.part.2+0x54/0x60 kernel/softirq.c:317
 [<ffffffff810e1d54>] do_softirq kernel/softirq.c:309 [inline]
 [<ffffffff810e1d54>] __local_bh_enable_ip+0xd4/0xe0 kernel/softirq.c:170
 [<ffffffff82711820>] __raw_spin_unlock_bh include/linux/spinlock_api_smp.h:178 [inline]
 [<ffffffff82711820>] _raw_spin_unlock_bh+0x30/0x40 kernel/locking/spinlock.c:207
 [<ffffffff821dd806>] spin_unlock_bh include/linux/spinlock.h:352 [inline]
 [<ffffffff821dd806>] release_sock+0x3b6/0x500 net/core/sock.c:2484
 [<ffffffff824a19da>] inet_wait_for_connect net/ipv4/af_inet.c:567 [inline]
 [<ffffffff824a19da>] __inet_stream_connect+0x5aa/0xc30 net/ipv4/af_inet.c:637
 [<ffffffff824a20b5>] inet_stream_connect+0x55/0xa0 net/ipv4/af_inet.c:676
 [<ffffffff821d3378>] SYSC_connect net/socket.c:1570 [inline]
 [<ffffffff821d3378>] SyS_connect+0x1b8/0x310 net/socket.c:1551
 [<ffffffff8100629e>] do_syscall_32_irqs_on arch/x86/entry/common.c:396 [inline]
 [<ffffffff8100629e>] do_fast_syscall_32+0x31e/0xa80 arch/x86/entry/common.c:463
 [<ffffffff82713b50>] sysenter_flags_fixed+0xd/0x1a

Allocated by task 22759:
 [<ffffffff8102e4d6>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63
 [<ffffffff8147e962>] save_stack mm/kasan/kasan.c:512 [inline]
 [<ffffffff8147e962>] set_track mm/kasan/kasan.c:524 [inline]
 [<ffffffff8147e962>] kasan_kmalloc.part.1+0x62/0xf0 mm/kasan/kasan.c:616
 [<ffffffff8147ebdf>] kasan_kmalloc+0xaf/0xc0 mm/kasan/kasan.c:601
 [<ffffffff8147f1a2>] kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:554
 [<ffffffff8147a89c>] slab_post_alloc_hook mm/slub.c:1349 [inline]
 [<ffffffff8147a89c>] slab_alloc_node mm/slub.c:2615 [inline]
 [<ffffffff8147a89c>] slab_alloc mm/slub.c:2623 [inline]
 [<ffffffff8147a89c>] kmem_cache_alloc+0xdc/0x2c0 mm/slub.c:2628
 [<ffffffff821eef56>] kmem_cache_alloc_node include/linux/slab.h:350 [inline]
 [<ffffffff821eef56>] __alloc_skb+0xe6/0x5b0 net/core/skbuff.c:218
 [<ffffffff823f2983>] alloc_skb_fclone include/linux/skbuff.h:856 [inline]
 [<ffffffff823f2983>] sk_stream_alloc_skb+0xa3/0x5d0 net/ipv4/tcp.c:833
 [<ffffffff823f5611>] tcp_sendmsg+0xf81/0x2b30 net/ipv4/tcp.c:1178
 [<ffffffff824a27c3>] inet_sendmsg+0x203/0x4d0 net/ipv4/af_inet.c:755
 [<ffffffff821cf9eb>] sock_sendmsg_nosec net/socket.c:638 [inline]
 [<ffffffff821cf9eb>] sock_sendmsg+0xbb/0x110 net/socket.c:648
 [<ffffffff821d3c10>] SYSC_sendto net/socket.c:1678 [inline]
 [<ffffffff821d3c10>] SyS_sendto+0x220/0x370 net/socket.c:1646
 [<ffffffff8100629e>] do_syscall_32_irqs_on arch/x86/entry/common.c:396 [inline]
 [<ffffffff8100629e>] do_fast_syscall_32+0x31e/0xa80 arch/x86/entry/common.c:463
 [<ffffffff82713b50>] sysenter_flags_fixed+0xd/0x1a

Freed by task 22773:
 [<ffffffff8102e4d6>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63
 [<ffffffff8147f25c>] save_stack mm/kasan/kasan.c:512 [inline]
 [<ffffffff8147f25c>] set_track mm/kasan/kasan.c:524 [inline]
 [<ffffffff8147f25c>] kasan_slab_free+0xac/0x190 mm/kasan/kasan.c:589
 [<ffffffff8147bf5e>] slab_free_hook mm/slub.c:1383 [inline]
 [<ffffffff8147bf5e>] slab_free_freelist_hook mm/slub.c:1405 [inline]
 [<ffffffff8147bf5e>] slab_free mm/slub.c:2859 [inline]
 [<ffffffff8147bf5e>] kmem_cache_free+0xbe/0x350 mm/slub.c:2881
 [<ffffffff821e741f>] kfree_skbmem+0xcf/0x100 net/core/skbuff.c:635
 [<ffffffff821f47bd>] __kfree_skb+0x1d/0x20 net/core/skbuff.c:676
 [<ffffffff824324f9>] sk_wmem_free_skb include/net/sock.h:1447 [inline]
 [<ffffffff824324f9>] tcp_write_queue_purge include/net/tcp.h:1460 [inline]
 [<ffffffff824324f9>] tcp_connect_init net/ipv4/tcp_output.c:3134 [inline]
 [<ffffffff824324f9>] tcp_connect+0xae9/0x3110 net/ipv4/tcp_output.c:3273
 [<ffffffff82440401>] tcp_v4_connect+0xf31/0x1890 net/ipv4/tcp_ipv4.c:246
 [<ffffffff824a16d9>] __inet_stream_connect+0x2a9/0xc30 net/ipv4/af_inet.c:615
 [<ffffffff824a20b5>] inet_stream_connect+0x55/0xa0 net/ipv4/af_inet.c:676
 [<ffffffff821d3378>] SYSC_connect net/socket.c:1570 [inline]
 [<ffffffff821d3378>] SyS_connect+0x1b8/0x310 net/socket.c:1551
 [<ffffffff8100629e>] do_syscall_32_irqs_on arch/x86/entry/common.c:396 [inline]
 [<ffffffff8100629e>] do_fast_syscall_32+0x31e/0xa80 arch/x86/entry/common.c:463
 [<ffffffff82713b50>] sysenter_flags_fixed+0xd/0x1a

The buggy address belongs to the object at ffff8801c2230280
 which belongs to the cache skbuff_fclone_cache of size 456
The buggy address is located 48 bytes inside of
 456-byte region [ffff8801c2230280, ffff8801c2230448)
The buggy address belongs to the page:
Initializing cgroup subsys cpu
Initializing cgroup subsys cpuacct
Linux version 4.4.163+ (syzkaller@ci) (gcc version 8.0.1 20180413 (experimental) (GCC) ) #12 SMP PREEMPT Mon Nov 12 21:36:22 UTC 2018
Command line: BOOT_IMAGE=/vmlinuz root=/dev/sda1 console=ttyS0 earlyprintk=serial vsyscall=native rodata=n oops=panic panic_on_warn=1 nmi_watchdog=panic panic=86400 workqueue.watchdog_thresh=140 nopti
KERNEL supported cpus:
  Intel GenuineIntel
  AMD AuthenticAMD
x86/fpu: xstate_offset[2]:  576, xstate_sizes[2]:  256
x86/fpu: Supporting XSAVE feature 0x01: 'x87 floating point registers'
x86/fpu: Supporting XSAVE feature 0x02: 'SSE registers'
x86/fpu: Supporting XSAVE feature 0x04: 'AVX registers'
x86/fpu: Enabled xstate features 0x7, context size is 832 bytes, using 'standard' format.
e820: BIOS-provided physical RAM map:
BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] usable
BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] reserved
BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] reserved
BIOS-e820: [mem 0x0000000000100000-0x00000000bfffcfff] usable
BIOS-e820: [mem 0x00000000bfffd000-0x00000000bfffffff] reserved
BIOS-e820: [mem 0x00000000fffbc000-0x00000000ffffffff] reserved
BIOS-e820: [mem 0x0000000100000000-0x000000021fffffff] usable
bootconsole [earlyser0] enabled
NX (Execute Disable) protection: active
Hypervisor detected: KVM
Kernel/User page tables isolation: disabled
e820: last_pfn = 0x220000 max_arch_pfn = 0x400000000
x86/PAT: Configuration [0-7]: WB  WC  UC- UC  UC  UC  UC  UC  
e820: last_pfn = 0xbfffd max_arch_pfn = 0x400000000
found SMP MP-table at [mem 0x000f2c80-0x000f2c8f] mapped at [ffff8800000f2c80]
Using GB pages for direct mapping
ACPI: Early table checksum verification disabled
ACPI: RSDP 0x00000000000F2A50 000014 (v00 Google)
ACPI: RSDT 0x00000000BFFFDBA0 000038 (v01 Google GOOGRSDT 00000001 GOOG 00000001)
ACPI: FACP 0x00000000BFFFFF00 0000F4 (v02 Google GOOGFACP 00000001 GOOG 00000001)
ACPI: DSDT 0x00000000BFFFDBE0 0017B2 (v01 Google GOOGDSDT 00000001 GOOG 00000001)
ACPI: FACS 0x00000000BFFFFEC0 000040
ACPI: FACS 0x00000000BFFFFEC0 000040
ACPI: SSDT 0x00000000BFFFF590 000930 (v01 Google GOOGSSDT 00000001 GOOG 00000001)
ACPI: APIC 0x00000000BFFFF4A0 000076 (v01 Google GOOGAPIC 00000001 GOOG 00000001)
ACPI: WAET 0x00000000BFFFF470 000028 (v01 Google GOOGWAET 00000001 GOOG 00000001)
ACPI: SRAT 0x00000000BFFFF3A0 0000C8 (v01 Google GOOGSRAT 00000001 GOOG 00000001)
kvm-clock: Using msrs 4b564d01 and 4b564d00
kvm-clock: cpu 0, msr 2:1fffd001, primary cpu clock
kvm-clock: using sched offset of 1443555679 cycles
clocksource: kvm-clock: mask: 0xffffffffffffffff max_cycles: 0x1cd42e4dffb, max_idle_ns: 881590591483 ns
Zone ranges:
  DMA32    [mem 0x0000000000001000-0x00000000ffffffff]
  Normal   [mem 0x0000000100000000-0x000000021fffffff]
Movable zone start for each node
Early memory node ranges
  node   0: [mem 0x0000000000001000-0x000000000009efff]
  node   0: [mem 0x0000000000100000-0x00000000bfffcfff]
  node   0: [mem 0x0000000100000000-0x000000021fffffff]
Initmem setup node 0 [mem 0x0000000000001000-0x000000021fffffff]
kasan: KernelAddressSanitizer initialized
ACPI: PM-Timer IO Port: 0xb008
ACPI: LAPIC_NMI (acpi_id[0xff] dfl dfl lint[0x1])
IOAPIC[0]: apic_id 0, version 17, address 0xfec00000, GSI 0-23
ACPI: INT_SRC_OVR (bus 0 bus_irq 5 global_irq 5 high level)
ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 9 high level)
ACPI: INT_SRC_OVR (bus 0 bus_irq 10 global_irq 10 high level)
ACPI: INT_SRC_OVR (bus 0 bus_irq 11 global_irq 11 high level)
Using ACPI (MADT) for SMP configuration information
smpboot: Allowing 2 CPUs, 0 hotplug CPUs
e820: [mem 0xc0000000-0xfffbbfff] available for PCI devices
Booting paravirtualized kernel on KVM
clocksource: refined-jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604462750000 ns
setup_percpu: NR_CPUS:8 nr_cpumask_bits:8 nr_cpu_ids:2 nr_node_ids:1
PERCPU: Embedded 41 pages/cpu @ffff8801db600000 s130824 r8192 d28920 u1048576
Built 1 zonelists in Zone order, mobility grouping on.  Total pages: 1935238
Kernel command line: BOOT_IMAGE=/vmlinuz root=/dev/sda1 console=ttyS0 earlyprintk=serial vsyscall=native rodata=n oops=panic panic_on_warn=1 nmi_watchdog=panic panic=86400 workqueue.watchdog_thresh=140 nopti
PID hash table entries: 4096 (order: 3, 32768 bytes)
Dentry cache hash table entries: 1048576 (order: 11, 8388608 bytes)
Inode-cache hash table entries: 524288 (order: 10, 4194304 bytes)