==================================================================
BUG: KASAN: use-after-free in __dev_queue_xmit+0x1653/0x1b90 net/core/dev.c:3431
Read of size 4 at addr ffff8801d9d14224 by task syz-executor.3/12963

CPU: 1 PID: 12963 Comm: syz-executor.3 Not tainted 4.9.141+ #1
 ffff8801cb17f028 ffffffff81b42e79 ffffea0007674500 ffff8801d9d14224
 0000000000000000 ffff8801d9d14224 ffff88016ec1f710 ffff8801cb17f060
 ffffffff815009b8 ffff8801d9d14224 0000000000000004 0000000000000000
Call Trace:
 [<ffffffff81b42e79>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81b42e79>] dump_stack+0xc1/0x128 lib/dump_stack.c:51
 [<ffffffff815009b8>] print_address_description+0x6c/0x234 mm/kasan/report.c:256
 [<ffffffff81500dc2>] kasan_report_error mm/kasan/report.c:355 [inline]
 [<ffffffff81500dc2>] kasan_report.cold.6+0x242/0x2fe mm/kasan/report.c:412
 [<ffffffff814f3054>] __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:432
 [<ffffffff82316cd3>] __dev_queue_xmit+0x1653/0x1b90 net/core/dev.c:3431
 [<ffffffff82317227>] dev_queue_xmit+0x17/0x20 net/core/dev.c:3506
 [<ffffffff8233a6b0>] neigh_resolve_output+0x600/0x780 net/core/neighbour.c:1325
 [<ffffffff8269132e>] dst_neigh_output include/net/dst.h:470 [inline]
 [<ffffffff8269132e>] ip6_finish_output2+0xb0e/0x1d10 net/ipv6/ip6_output.c:119
 [<ffffffff826a1e74>] ip6_finish_output+0x334/0x980 net/ipv6/ip6_output.c:145
 [<ffffffff826a26aa>] NF_HOOK_COND include/linux/netfilter.h:246 [inline]
 [<ffffffff826a26aa>] ip6_output+0x1ea/0x6d0 net/ipv6/ip6_output.c:162
 [<ffffffff827bce1b>] dst_output include/net/dst.h:507 [inline]
 [<ffffffff827bce1b>] ip6_local_out+0x9b/0x180 net/ipv6/output_core.c:176
 [<ffffffff826a4891>] ip6_send_skb+0xa1/0x340 net/ipv6/ip6_output.c:1751
 [<ffffffff82706689>] udp_v6_send_skb+0x429/0xe70 net/ipv6/udp.c:974
 [<ffffffff827072fd>] udp_v6_push_pending_frames+0x22d/0x340 net/ipv6/udp.c:1007
 [<ffffffff827092b1>] udpv6_sendmsg+0x1dc1/0x2430 net/ipv6/udp.c:1273
 [<ffffffff825952f3>] inet_sendmsg+0x203/0x4d0 net/ipv4/af_inet.c:770
 [<ffffffff822a063b>] sock_sendmsg_nosec net/socket.c:648 [inline]
 [<ffffffff822a063b>] sock_sendmsg+0xbb/0x110 net/socket.c:658
 [<ffffffff822a209a>] ___sys_sendmsg+0x47a/0x840 net/socket.c:1982
 [<ffffffff822a55a1>] __sys_sendmmsg+0x161/0x3d0 net/socket.c:2072
 [<ffffffff822a5845>] SYSC_sendmmsg net/socket.c:2103 [inline]
 [<ffffffff822a5845>] SyS_sendmmsg+0x35/0x60 net/socket.c:2098
 [<ffffffff810056ef>] do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285
 [<ffffffff82817893>] entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Allocated by task 12945:
 save_stack_trace+0x16/0x20 arch/x86/kernel/stacktrace.c:57
 save_stack mm/kasan/kasan.c:505 [inline]
 set_track mm/kasan/kasan.c:517 [inline]
 kasan_kmalloc.part.1+0x62/0xf0 mm/kasan/kasan.c:609
 kasan_kmalloc+0xaf/0xc0 mm/kasan/kasan.c:594
 kasan_slab_alloc+0x12/0x20 mm/kasan/kasan.c:547
 slab_post_alloc_hook mm/slab.h:417 [inline]
 slab_alloc_node mm/slub.c:2715 [inline]
 slab_alloc mm/slub.c:2723 [inline]
 kmem_cache_alloc+0xd5/0x2b0 mm/slub.c:2728
 shmem_alloc_inode+0x1b/0x40 mm/shmem.c:3650
 alloc_inode+0x63/0x180 fs/inode.c:207
 new_inode_pseudo+0x17/0xe0 fs/inode.c:890
 new_inode+0x1c/0x40 fs/inode.c:919
 shmem_get_inode+0x6f/0x6c0 mm/shmem.c:2119
 shmem_mknod+0x5a/0x1d0 mm/shmem.c:2825
 shmem_create+0x2b/0x40 mm/shmem.c:2885
 lookup_open+0xafe/0x18b0 fs/namei.c:3224
 do_last fs/namei.c:3315 [inline]
 path_openat+0xf3d/0x2790 fs/namei.c:3534
 do_filp_open+0x197/0x270 fs/namei.c:3568
 do_sys_open+0x30d/0x5c0 fs/open.c:1072
 SYSC_open fs/open.c:1090 [inline]
 SyS_open+0x2d/0x40 fs/open.c:1085
 do_syscall_64+0x19f/0x550 arch/x86/entry/common.c:285
 entry_SYSCALL_64_after_swapgs+0x5d/0xdb

Freed by task 0:
(stack is not available)

The buggy address belongs to the object at ffff8801d9d14000
 which belongs to the cache shmem_inode_cache of size 1096
The buggy address is located 548 bytes inside of
 1096-byte region [ffff8801d9d14000, ffff8801d9d14448)
The buggy address belongs to the page:
page:ffffea0007674500 count:1 mapcount:0 mapping:          (null) index:0x0 compound_mapcount: 0
flags: 0x4000000000004080(slab|head)
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff8801d9d14100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8801d9d14180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8801d9d14200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                               ^
 ffff8801d9d14280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8801d9d14300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================