==================================================================
BUG: KASAN: slab-out-of-bounds in ____bpf_skb_change_head net/core/filter.c:2423 [inline]
BUG: KASAN: slab-out-of-bounds in bpf_skb_change_head+0x4ea/0x600 net/core/filter.c:2419
Read of size 4 at addr ffff88819e009fb8 by task syz-executor.2/10000

CPU: 0 PID: 10000 Comm: syz-executor.2 Not tainted 4.14.150+ #0
Call Trace:
 __dump_stack lib/dump_stack.c:17 [inline]
 dump_stack+0xca/0x134 lib/dump_stack.c:53
 print_address_description+0x60/0x226 mm/kasan/report.c:187
 __kasan_report.cold+0x1a/0x41 mm/kasan/report.c:316
 ____bpf_skb_change_head net/core/filter.c:2423 [inline]
 bpf_skb_change_head+0x4ea/0x600 net/core/filter.c:2419
 ___bpf_prog_run+0x2478/0x5510 kernel/bpf/core.c:1095

Allocated by task 1834:
 save_stack mm/kasan/common.c:76 [inline]
 set_track mm/kasan/common.c:85 [inline]
 __kasan_kmalloc.part.0+0x53/0xc0 mm/kasan/common.c:501
 slab_post_alloc_hook mm/slab.h:439 [inline]
 slab_alloc_node mm/slub.c:2792 [inline]
 slab_alloc mm/slub.c:2800 [inline]
 kmem_cache_alloc+0xee/0x360 mm/slub.c:2805
 kmem_cache_zalloc include/linux/slab.h:651 [inline]
 get_empty_filp+0x86/0x3d0 fs/file_table.c:123
 alloc_file+0x24/0x3b0 fs/file_table.c:164
 sock_alloc_file+0x123/0x300 net/socket.c:416
 sock_map_fd net/socket.c:439 [inline]
 SYSC_socket net/socket.c:1349 [inline]
 SyS_socket+0x11c/0x1e0 net/socket.c:1325
 do_syscall_64+0x19b/0x520 arch/x86/entry/common.c:292
 entry_SYSCALL_64_after_hwframe+0x42/0xb7
 0xffffffffffffffff

Freed by task 17:
 save_stack mm/kasan/common.c:76 [inline]
 set_track mm/kasan/common.c:85 [inline]
 __kasan_slab_free+0x164/0x210 mm/kasan/common.c:463
 slab_free_hook mm/slub.c:1407 [inline]
 slab_free_freelist_hook mm/slub.c:1458 [inline]
 slab_free mm/slub.c:3039 [inline]
 kmem_cache_free+0xd7/0x3b0 mm/slub.c:3055
 __rcu_reclaim kernel/rcu/rcu.h:195 [inline]
 rcu_do_batch kernel/rcu/tree.c:2699 [inline]
 invoke_rcu_callbacks kernel/rcu/tree.c:2962 [inline]
 __rcu_process_callbacks kernel/rcu/tree.c:2929 [inline]
 rcu_process_callbacks+0x59f/0xf60 kernel/rcu/tree.c:2946
 __do_softirq+0x234/0x9ec kernel/softirq.c:288

The buggy address belongs to the object at ffff88819e009b80
 which belongs to the cache filp of size 456
The buggy address is located 624 bytes to the right of
 456-byte region [ffff88819e009b80, ffff88819e009d48)
The buggy address belongs to the page:
page:ffffea0006780200 count:1 mapcount:0 mapping:          (null) index:0x0 compound_mapcount: 0
flags: 0x4000000000010200(slab|head)
raw: 4000000000010200 0000000000000000 0000000000000000 00000001000c000c
raw: ffffea000739b300 0000000400000002 ffff8881da97e600 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88819e009e80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff88819e009f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88819e009f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
                                        ^
 ffff88819e00a000: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff88819e00a080: fb fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc
==================================================================