==================================================================
BUG: KASAN: use-after-free in deliver_ptype_list_skb net/core/dev.c:1878 [inline]
BUG: KASAN: use-after-free in __netif_receive_skb_core+0x2fa3/0x3230 net/core/dev.c:4281
Read of size 2 at addr ffff8801c8e91040 by task syzkaller564363/3026

CPU: 0 PID: 3026 Comm: syzkaller564363 Not tainted 4.13.0-rc7+ #64
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:16 [inline]
 dump_stack+0x194/0x257 lib/dump_stack.c:52
 print_address_description+0x73/0x250 mm/kasan/report.c:252
 kasan_report_error mm/kasan/report.c:351 [inline]
 kasan_report+0x24e/0x340 mm/kasan/report.c:409
 __asan_report_load2_noabort+0x14/0x20 mm/kasan/report.c:428
 deliver_ptype_list_skb net/core/dev.c:1878 [inline]
 __netif_receive_skb_core+0x2fa3/0x3230 net/core/dev.c:4281
 __netif_receive_skb+0x2c/0x1b0 net/core/dev.c:4336
 netif_receive_skb_internal+0x16a/0x1a50 net/core/dev.c:4497
 napi_skb_finish net/core/dev.c:4858 [inline]
 napi_gro_receive+0x3d0/0x500 net/core/dev.c:4889
 receive_buf+0xaef/0x5690 drivers/net/virtio_net.c:781
 virtnet_receive drivers/net/virtio_net.c:1022 [inline]
 virtnet_poll+0x50b/0xab0 drivers/net/virtio_net.c:1103
 napi_poll net/core/dev.c:5500 [inline]
 net_rx_action+0x792/0x1910 net/core/dev.c:5566
 __do_softirq+0x2f5/0xba3 kernel/softirq.c:284
 invoke_softirq kernel/softirq.c:364 [inline]
 irq_exit+0x1cc/0x200 kernel/softirq.c:405
 exiting_irq arch/x86/include/asm/apic.h:638 [inline]
 do_IRQ+0xf6/0x190 arch/x86/kernel/irq.c:256
 common_interrupt+0x93/0x93 arch/x86/entry/entry_64.S:513
RIP: 0010:__read_once_size include/linux/compiler.h:250 [inline]
RIP: 0010:atomic64_read arch/x86/include/asm/atomic64_64.h:21 [inline]
RIP: 0010:atomic_long_read include/asm-generic/atomic-long.h:44 [inline]
RIP: 0010:get_nr_swap_pages include/linux/swap.h:387 [inline]
RIP: 0010:__vm_enough_memory+0x30e/0x810 mm/util.c:628
RSP: 0018:ffff8801d0ec6fc8 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff6e
RAX: 000000000017732b RBX: 1ffff1003a1d8dfe RCX: dffffc0000000000
RDX: ffff8801d0ec7050 RSI: 0000000000000000 RDI: ffff8801d0ec7050
RBP: ffff8801d0ec7178 R08: 1ffffffff0c3c684 R09: 1ffff1003a1d8d7d
R10: ffff8801d0ec6bb0 R11: 0000000000000003 R12: ffff8801d0ec7150
R13: ffffffff85ba6320 R14: 0000000000000001 R15: dffffc0000000000
 </IRQ>
 security_vm_enough_memory_mm+0x90/0xb0 security/security.c:326
 dup_mmap kernel/fork.c:641 [inline]
 dup_mm kernel/fork.c:1184 [inline]
 copy_mm+0x8af/0x1247 kernel/fork.c:1238
 copy_process.part.35+0x1ec4/0x4bd0 kernel/fork.c:1744
 copy_process kernel/fork.c:1554 [inline]
 _do_fork+0x1ef/0xfb0 kernel/fork.c:2035
 SYSC_clone kernel/fork.c:2145 [inline]
 SyS_clone+0x37/0x50 kernel/fork.c:2139
 do_syscall_64+0x26c/0x800 arch/x86/entry/common.c:284
 entry_SYSCALL64_slow_path+0x25/0x25
RIP: 0033:0x44a59a