BUG: sleeping function called from invalid context at net/core/sock.c:2502
in_atomic(): 1, irqs_disabled(): 0, pid: 17, name: ksoftirqd/1
1 lock held by ksoftirqd/1/17:
 #0:  (rcu_callback){......}, at: [<ffffffff812931d7>] __rcu_reclaim kernel/rcu/rcu.h:108 [inline]
 #0:  (rcu_callback){......}, at: [<ffffffff812931d7>] rcu_do_batch kernel/rcu/tree.c:2789 [inline]
 #0:  (rcu_callback){......}, at: [<ffffffff812931d7>] invoke_rcu_callbacks kernel/rcu/tree.c:3053 [inline]
 #0:  (rcu_callback){......}, at: [<ffffffff812931d7>] __rcu_process_callbacks kernel/rcu/tree.c:3020 [inline]
 #0:  (rcu_callback){......}, at: [<ffffffff812931d7>] rcu_process_callbacks+0x977/0x1300 kernel/rcu/tree.c:3037
Preemption disabled at:[   32.679873] [<ffffffff838b971b>] __do_softirq+0xdb/0x951 kernel/softirq.c:261
CPU: 1 PID: 17 Comm: ksoftirqd/1 Not tainted 4.9.77-g9c3804b #17
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801d9827a60 ffffffff81d941c9 ffffffff838b971b 0000000000000000
 0000000000000100 ffff8801d980b000 ffff8801d980b000 ffff8801d9827a98
 ffffffff811b9b24 ffff8801d980b000 ffffffff83edcd20 00000000000009c6
Call Trace:
 [<ffffffff81d941c9>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d941c9>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff811b9b24>] ___might_sleep+0x2f4/0x470 kernel/sched/core.c:7971
 [<ffffffff811b9d35>] __might_sleep+0x95/0x1a0 kernel/sched/core.c:7928
 [<ffffffff82ee3fe4>] lock_sock_nested+0x34/0x120 net/core/sock.c:2502
 [<ffffffff832e8152>] lock_sock include/net/sock.h:1404 [inline]
 [<ffffffff832e8152>] inet_shutdown+0x62/0x350 net/ipv4/af_inet.c:823
 [<ffffffff835896a0>] pppol2tp_session_close+0xa0/0xe0 net/l2tp/l2tp_ppp.c:441
 [<ffffffff8358409f>] l2tp_tunnel_closeall+0x21f/0x3a0 net/l2tp/l2tp_core.c:1368
 [<ffffffff8358498e>] l2tp_tunnel_destruct+0x30e/0x5a0 net/l2tp/l2tp_core.c:1324
 [<ffffffff82ee5033>] __sk_destruct+0x53/0x570 net/core/sock.c:1428
 [<ffffffff812930f8>] __rcu_reclaim kernel/rcu/rcu.h:118 [inline]
 [<ffffffff812930f8>] rcu_do_batch kernel/rcu/tree.c:2789 [inline]
 [<ffffffff812930f8>] invoke_rcu_callbacks kernel/rcu/tree.c:3053 [inline]
 [<ffffffff812930f8>] __rcu_process_callbacks kernel/rcu/tree.c:3020 [inline]
 [<ffffffff812930f8>] rcu_process_callbacks+0x898/0x1300 kernel/rcu/tree.c:3037
 [<ffffffff838b9846>] __do_softirq+0x206/0x951 kernel/softirq.c:284
 [<ffffffff8114693e>] run_ksoftirqd+0x2e/0x60 kernel/softirq.c:676
 [<ffffffff811a5af1>] smpboot_thread_fn+0x5c1/0x8f0 kernel/smpboot.c:163
 [<ffffffff8119a6fd>] kthread+0x26d/0x300 kernel/kthread.c:211
 [<ffffffff838b2f69>] ret_from_fork+0x59/0x70 arch/x86/entry/entry_64.S:466

=================================
[ INFO: inconsistent lock state ]
4.9.77-g9c3804b #17 Tainted: G        W      
---------------------------------
inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
ksoftirqd/1/17 [HC0[0]:SC1[3]:HE1:SE0] takes:
 (sk_lock-AF_PPPOX){+.?.+.}, at: [<ffffffff832e8152>] lock_sock include/net/sock.h:1404 [inline]
 (sk_lock-AF_PPPOX){+.?.+.}, at: [<ffffffff832e8152>] inet_shutdown+0x62/0x350 net/ipv4/af_inet.c:823
  mark_held_locks+0xaf/0x100 kernel/locking/lockdep.c:2660
  __trace_hardirqs_on_caller kernel/locking/lockdep.c:2689 [inline]
  trace_hardirqs_on_caller+0x38b/0x590 kernel/locking/lockdep.c:2736
  trace_hardirqs_on+0xd/0x10 kernel/locking/lockdep.c:2743
  __local_bh_enable_ip+0x6a/0xd0 kernel/softirq.c:186
  local_bh_enable include/linux/bottom_half.h:31 [inline]
  lock_sock_nested+0xdc/0x120 net/core/sock.c:2512
  lock_sock include/net/sock.h:1404 [inline]
  pppol2tp_connect+0xd3/0x18f0 net/l2tp/l2tp_ppp.c:590
  SYSC_connect+0x1b6/0x310 net/socket.c:1562
  SyS_connect+0x24/0x30 net/socket.c:1543
  entry_SYSCALL_64_fastpath+0x29/0xe8
irq event stamp: 215706
hardirqs last  enabled at (215706): [<ffffffff838b3729>] restore_regs_and_iret+0x0/0x1d
hardirqs last disabled at (215705): [<ffffffff838b369b>] common_interrupt+0x9b/0xa0 arch/x86/entry/entry_64.S:554
softirqs last  enabled at (215428): [<ffffffff838b9aa6>] __do_softirq+0x466/0x951 kernel/softirq.c:310
softirqs last disabled at (215431): [<ffffffff8114693e>] run_ksoftirqd+0x2e/0x60 kernel/softirq.c:676

other info that might help us debug this:
 Possible unsafe locking scenario:

       CPU0
       ----
  lock(sk_lock-AF_PPPOX);
  <Interrupt>
    lock(sk_lock-AF_PPPOX);

 *** DEADLOCK ***

1 lock held by ksoftirqd/1/17:
 #0:  (rcu_callback){......}, at: [<ffffffff812931d7>] __rcu_reclaim kernel/rcu/rcu.h:108 [inline]
 #0:  (rcu_callback){......}, at: [<ffffffff812931d7>] rcu_do_batch kernel/rcu/tree.c:2789 [inline]
 #0:  (rcu_callback){......}, at: [<ffffffff812931d7>] invoke_rcu_callbacks kernel/rcu/tree.c:3053 [inline]
 #0:  (rcu_callback){......}, at: [<ffffffff812931d7>] __rcu_process_callbacks kernel/rcu/tree.c:3020 [inline]
 #0:  (rcu_callback){......}, at: [<ffffffff812931d7>] rcu_process_callbacks+0x977/0x1300 kernel/rcu/tree.c:3037

stack backtrace:
CPU: 1 PID: 17 Comm: ksoftirqd/1 Tainted: G        W       4.9.77-g9c3804b #17
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801d98277d0 ffffffff81d941c9 ffff8801d980b000 ffffffff853c0fc0
 ffff8801d980b8d8 ffffffff83a5f240 0000000000000000 ffff8801d9827840
 ffffffff8123a0b6 0000000000000003 ffff880100000001 ffff880100000000
Call Trace:
 [<ffffffff81d941c9>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d941c9>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff8123a0b6>] print_usage_bug+0x356/0x3b0 kernel/locking/lockdep.c:2387
 [<ffffffff8123adb2>] valid_state kernel/locking/lockdep.c:2400 [inline]
 [<ffffffff8123adb2>] mark_lock_irq kernel/locking/lockdep.c:2602 [inline]
 [<ffffffff8123adb2>] mark_lock+0xca2/0xfd0 kernel/locking/lockdep.c:3065
 [<ffffffff8123c8ec>] mark_irqflags kernel/locking/lockdep.c:2923 [inline]
 [<ffffffff8123c8ec>] __lock_acquire+0xb4c/0x3640 kernel/locking/lockdep.c:3302
 [<ffffffff8123fe1e>] lock_acquire+0x12e/0x410 kernel/locking/lockdep.c:3756
 [<ffffffff82ee4076>] lock_sock_nested+0xc6/0x120 net/core/sock.c:2511
 [<ffffffff832e8152>] lock_sock include/net/sock.h:1404 [inline]
 [<ffffffff832e8152>] inet_shutdown+0x62/0x350 net/ipv4/af_inet.c:823
 [<ffffffff835896a0>] pppol2tp_session_close+0xa0/0xe0 net/l2tp/l2tp_ppp.c:441
 [<ffffffff8358409f>] l2tp_tunnel_closeall+0x21f/0x3a0 net/l2tp/l2tp_core.c:1368
 [<ffffffff8358498e>] l2tp_tunnel_destruct+0x30e/0x5a0 net/l2tp/l2tp_core.c:1324
 [<ffffffff82ee5033>] __sk_destruct+0x53/0x570 net/core/sock.c:1428
 [<ffffffff812930f8>] __rcu_reclaim kernel/rcu/rcu.h:118 [inline]
 [<ffffffff812930f8>] rcu_do_batch kernel/rcu/tree.c:2789 [inline]
 [<ffffffff812930f8>] invoke_rcu_callbacks kernel/rcu/tree.c:3053 [inline]
 [<ffffffff812930f8>] __rcu_process_callbacks kernel/rcu/tree.c:3020 [inline]
 [<ffffffff812930f8>] rcu_process_callbacks+0x898/0x1300 kernel/rcu/tree.c:3037
 [<ffffffff838b9846>] __do_softirq+0x206/0x951 kernel/softirq.c:284
 [<ffffffff8114693e>] run_ksoftirqd+0x2e/0x60 kernel/softirq.c:676
 [<ffffffff811a5af1>] smpboot_thread_fn+0x5c1/0x8f0 kernel/smpboot.c:163
 [<ffffffff8119a6fd>] kthread+0x26d/0x300 kernel/kthread.c:211
 [<ffffffff838b2f69>] ret_from_fork+0x59/0x70 arch/x86/entry/entry_64.S:466
==================================================================
BUG: KASAN: use-after-free in inet_shutdown+0x2d4/0x350 net/ipv4/af_inet.c:824
Read of size 4 at addr ffff8801be812200 by task ksoftirqd/1/17

CPU: 1 PID: 17 Comm: ksoftirqd/1 Tainted: G        W       4.9.77-g9c3804b #17
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 ffff8801d9827a80 ffffffff81d941c9 ffffea0006fa0400 ffff8801be812200
 0000000000000000 ffff8801be812200 ffff8801cd1c2cd8 ffff8801d9827ab8
 ffffffff8153db93 ffff8801be812200 0000000000000004 0000000000000000
Call Trace:
 [<ffffffff81d941c9>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81d941c9>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff8153db93>] print_address_description+0x73/0x280 mm/kasan/report.c:252
 [<ffffffff8153e0b5>] kasan_report_error mm/kasan/report.c:351 [inline]
 [<ffffffff8153e0b5>] kasan_report+0x275/0x360 mm/kasan/report.c:408
 [<ffffffff8153e1f4>] __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:428
 [<ffffffff832e83c4>] inet_shutdown+0x2d4/0x350 net/ipv4/af_inet.c:824
 [<ffffffff835896a0>] pppol2tp_session_close+0xa0/0xe0 net/l2tp/l2tp_ppp.c:441
 [<ffffffff8358409f>] l2tp_tunnel_closeall+0x21f/0x3a0 net/l2tp/l2tp_core.c:1368
 [<ffffffff8358498e>] l2tp_tunnel_destruct+0x30e/0x5a0 net/l2tp/l2tp_core.c:1324
 [<ffffffff82ee5033>] __sk_destruct+0x53/0x570 net/core/sock.c:1428
 [<ffffffff812930f8>] __rcu_reclaim kernel/rcu/rcu.h:118 [inline]
 [<ffffffff812930f8>] rcu_do_batch kernel/rcu/tree.c:2789 [inline]
 [<ffffffff812930f8>] invoke_rcu_callbacks kernel/rcu/tree.c:3053 [inline]
 [<ffffffff812930f8>] __rcu_process_callbacks kernel/rcu/tree.c:3020 [inline]
 [<ffffffff812930f8>] rcu_process_callbacks+0x898/0x1300 kernel/rcu/tree.c:3037
 [<ffffffff838b9846>] __do_softirq+0x206/0x951 kernel/softirq.c:284
 [<ffffffff8114693e>] run_ksoftirqd+0x2e/0x60 kernel/softirq.c:676
 [<ffffffff811a5af1>] smpboot_thread_fn+0x5c1/0x8f0 kernel/smpboot.c:163
 [<ffffffff8119a6fd>] kthread+0x26d/0x300 kernel/kthread.c:211
 [<ffffffff838b2f69>] ret_from_fork+0x59/0x70 arch/x86/entry/entry_64.S:466

Allocated by task 3359:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack+0x43/0xd0 mm/kasan/kasan.c:505
 set_track mm/kasan/kasan.c:517 [inline]
 kasan_kmalloc+0xad/0xe0 mm/kasan/kasan.c:609
 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:547
 slab_post_alloc_hook mm/slab.h:417 [inline]
 slab_alloc_node mm/slub.c:2715 [inline]
 slab_alloc mm/slub.c:2723 [inline]
 kmem_cache_alloc+0xba/0x290 mm/slub.c:2728
 sock_alloc_inode+0x1d/0x250 net/socket.c:250
 alloc_inode+0x65/0x180 fs/inode.c:207
 new_inode_pseudo+0x17/0xe0 fs/inode.c:890
 sock_alloc+0x41/0x270 net/socket.c:567
 __sock_create+0xa5/0x640 net/socket.c:1146
 sock_create net/socket.c:1222 [inline]
 SYSC_socket net/socket.c:1252 [inline]
 SyS_socket+0xf0/0x1b0 net/socket.c:1232
 entry_SYSCALL_64_fastpath+0x29/0xe8

Freed by task 3359:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack+0x43/0xd0 mm/kasan/kasan.c:505
 set_track mm/kasan/kasan.c:517 [inline]
 kasan_slab_free+0x72/0xc0 mm/kasan/kasan.c:582
 slab_free_hook mm/slub.c:1355 [inline]
 slab_free_freelist_hook mm/slub.c:1377 [inline]
 slab_free mm/slub.c:2958 [inline]
 kmem_cache_free+0xc7/0x300 mm/slub.c:2980
 sock_destroy_inode+0x56/0x70 net/socket.c:280
 destroy_inode+0xc3/0x120 fs/inode.c:264
 evict+0x329/0x4f0 fs/inode.c:570
 iput_final fs/inode.c:1516 [inline]
 iput+0x47b/0x900 fs/inode.c:1543
 dentry_unlink_inode+0x470/0x570 fs/dcache.c:370
 __dentry_kill+0x25b/0x480 fs/dcache.c:565
 dentry_kill fs/dcache.c:606 [inline]
 dput.part.23+0x680/0x7b0 fs/dcache.c:818
 dput+0x1f/0x30 fs/dcache.c:780
 __fput+0x46a/0x6e0 fs/file_table.c:226
 ____fput+0x15/0x20 fs/file_table.c:244
 task_work_run+0x115/0x190 kernel/task_work.c:116
 exit_task_work include/linux/task_work.h:21 [inline]
 do_exit+0x7e7/0x2a40 kernel/exit.c:833
 do_group_exit+0x108/0x320 kernel/exit.c:937
 SYSC_exit_group kernel/exit.c:948 [inline]
 SyS_exit_group+0x1d/0x20 kernel/exit.c:946
 entry_SYSCALL_64_fastpath+0x29/0xe8

The buggy address belongs to the object at ffff8801be812200
 which belongs to the cache sock_inode_cache of size 944
The buggy address is located 0 bytes inside of
 944-byte region [ffff8801be812200, ffff8801be8125b0)
The buggy address belongs to the page:
page:ffffea0006fa0400 count:1 mapcount:0 mapping:          (null) index:0x0 compound_mapcount: 0
flags: 0x8000000000004080(slab|head)
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801be812100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fc fc
 ffff8801be812180: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff8801be812200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                   ^
 ffff8801be812280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8801be812300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================