IPv6: ADDRCONF(NETDEV_UP): veth0: link is not ready
IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready
==================================================================
BUG: KASAN: slab-out-of-bounds in ip6_tnl_xmit2+0x2043/0x20d0 net/ipv6/ip6_tunnel.c:987
Read of size 16 at addr ffff8800b0f6afb0 by task syz-executor021/3755

CPU: 1 PID: 3755 Comm: syz-executor021 Not tainted 4.4.147-ga5fc665 #80
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
 0000000000000000 40e1c381715200bc ffff8801cbaf7020 ffffffff81e12a4d
 ffffea0002c3da00 ffff8800b0f6afb0 0000000000000000 ffff8800b0f6afb8
 ffff8800b094e600 ffff8801cbaf7058 ffffffff81517fd6 ffff8800b0f6afb0
Call Trace:
 [<ffffffff81e12a4d>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81e12a4d>] dump_stack+0xc1/0x124 lib/dump_stack.c:51
 [<ffffffff81517fd6>] print_address_description+0x6c/0x216 mm/kasan/report.c:252
 [<ffffffff815182f5>] kasan_report_error mm/kasan/report.c:351 [inline]
 [<ffffffff815182f5>] kasan_report.cold.7+0x175/0x2f7 mm/kasan/report.c:408
 [<ffffffff814fbebf>] __asan_report_load_n_noabort+0xf/0x20 mm/kasan/report.c:439
 [<ffffffff8354d403>] ip6_tnl_xmit2+0x2043/0x20d0 net/ipv6/ip6_tunnel.c:987
 [<ffffffff8354dda0>] ip4ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1129 [inline]
 [<ffffffff8354dda0>] ip6_tnl_xmit+0x910/0xc60 net/ipv6/ip6_tunnel.c:1203
 [<ffffffff82f8ede1>] __netdev_start_xmit include/linux/netdevice.h:3743 [inline]
 [<ffffffff82f8ede1>] netdev_start_xmit include/linux/netdevice.h:3752 [inline]
 [<ffffffff82f8ede1>] xmit_one net/core/dev.c:2759 [inline]
 [<ffffffff82f8ede1>] dev_hard_start_xmit+0x7b1/0x11c0 net/core/dev.c:2775
 [<ffffffff82f91170>] __dev_queue_xmit+0x16c0/0x1c80 net/core/dev.c:3207
 [<ffffffff82f91747>] dev_queue_xmit+0x17/0x20 net/core/dev.c:3241
 [<ffffffff82fa2f75>] neigh_direct_output+0x15/0x20 net/core/neighbour.c:1366
 [<ffffffff8321ba6b>] dst_neigh_output include/net/dst.h:461 [inline]
 [<ffffffff8321ba6b>] ip_finish_output2+0x6ab/0x1110 net/ipv4/ip_output.c:213
 [<ffffffff8321f01e>] ip_finish_output+0x7be/0xc00 net/ipv4/ip_output.c:288
 [<ffffffff83222a79>] NF_HOOK_COND include/linux/netfilter.h:240 [inline]
 [<ffffffff83222a79>] ip_output+0x219/0x4c0 net/ipv4/ip_output.c:362
 [<ffffffff8321f93b>] dst_output include/net/dst.h:498 [inline]
 [<ffffffff8321f93b>] ip_local_out+0x9b/0x180 net/ipv4/ip_output.c:119
 [<ffffffff83220c7e>] ip_queue_xmit+0x88e/0x1af0 net/ipv4/ip_output.c:461
 [<ffffffff83286921>] __tcp_transmit_skb+0x1691/0x2c50 net/ipv4/tcp_output.c:1034
 [<ffffffff832885db>] tcp_transmit_skb net/ipv4/tcp_output.c:1047 [inline]
 [<ffffffff832885db>] tcp_write_xmit+0x6fb/0x4d20 net/ipv4/tcp_output.c:2137
 [<ffffffff8328d3d0>] __tcp_push_pending_frames+0xa0/0x290 net/ipv4/tcp_output.c:2319
 [<ffffffff832944d6>] tcp_send_fin+0x176/0xab0 net/ipv4/tcp_output.c:2895
 [<ffffffff83251a60>] tcp_close+0xca0/0xf70 net/ipv4/tcp.c:2112
 [<ffffffff832fea9f>] inet_release+0xff/0x1d0 net/ipv4/af_inet.c:435
 [<ffffffff82f1f876>] sock_release+0x96/0x1c0 net/socket.c:587
 [<ffffffff82f1f9b6>] sock_close+0x16/0x20 net/socket.c:1038
 [<ffffffff815253c5>] __fput+0x235/0x6f0 fs/file_table.c:208
 [<ffffffff81525905>] ____fput+0x15/0x20 fs/file_table.c:244
 [<ffffffff8118e00f>] task_work_run+0x10f/0x190 kernel/task_work.c:115
 [<ffffffff81137475>] exit_task_work include/linux/task_work.h:21 [inline]
 [<ffffffff81137475>] do_exit+0x9e5/0x26b0 kernel/exit.c:755
 [<ffffffff8113d3b1>] do_group_exit+0x111/0x330 kernel/exit.c:885
 [<ffffffff8113d5ed>] SYSC_exit_group kernel/exit.c:896 [inline]
 [<ffffffff8113d5ed>] SyS_exit_group+0x1d/0x20 kernel/exit.c:894
 [<ffffffff838c8c65>] entry_SYSCALL_64_fastpath+0x22/0x9e

Allocated by task 3755:
 [<ffffffff81034676>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63
 [<ffffffff814fae93>] save_stack+0x43/0xd0 mm/kasan/kasan.c:512
 [<ffffffff814fb177>] set_track mm/kasan/kasan.c:524 [inline]
 [<ffffffff814fb177>] kasan_kmalloc+0xc7/0xe0 mm/kasan/kasan.c:616
 [<ffffffff814f7894>] __kmalloc+0x124/0x310 mm/slub.c:3613
 [<ffffffff82fb3d56>] kmalloc include/linux/slab.h:481 [inline]
 [<ffffffff82fb3d56>] kzalloc include/linux/slab.h:620 [inline]
 [<ffffffff82fb3d56>] neigh_alloc net/core/neighbour.c:285 [inline]
 [<ffffffff82fb3d56>] __neigh_create+0x1d6/0x1b20 net/core/neighbour.c:457
 [<ffffffff831f46ad>] neigh_create include/net/neighbour.h:313 [inline]
 [<ffffffff831f46ad>] ipv4_neigh_lookup+0x4dd/0x700 net/ipv4/route.c:464
 [<ffffffff8354b9d3>] dst_neigh_lookup include/net/dst.h:466 [inline]
 [<ffffffff8354b9d3>] ip6_tnl_xmit2+0x613/0x20d0 net/ipv6/ip6_tunnel.c:982
 [<ffffffff8354dda0>] ip4ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1129 [inline]
 [<ffffffff8354dda0>] ip6_tnl_xmit+0x910/0xc60 net/ipv6/ip6_tunnel.c:1203
 [<ffffffff82f8ede1>] __netdev_start_xmit include/linux/netdevice.h:3743 [inline]
 [<ffffffff82f8ede1>] netdev_start_xmit include/linux/netdevice.h:3752 [inline]
 [<ffffffff82f8ede1>] xmit_one net/core/dev.c:2759 [inline]
 [<ffffffff82f8ede1>] dev_hard_start_xmit+0x7b1/0x11c0 net/core/dev.c:2775
 [<ffffffff82f91170>] __dev_queue_xmit+0x16c0/0x1c80 net/core/dev.c:3207
 [<ffffffff82f91747>] dev_queue_xmit+0x17/0x20 net/core/dev.c:3241
 [<ffffffff82fa2f75>] neigh_direct_output+0x15/0x20 net/core/neighbour.c:1366
 [<ffffffff8321ba6b>] dst_neigh_output include/net/dst.h:461 [inline]
 [<ffffffff8321ba6b>] ip_finish_output2+0x6ab/0x1110 net/ipv4/ip_output.c:213
 [<ffffffff8321f01e>] ip_finish_output+0x7be/0xc00 net/ipv4/ip_output.c:288
 [<ffffffff83222a79>] NF_HOOK_COND include/linux/netfilter.h:240 [inline]
 [<ffffffff83222a79>] ip_output+0x219/0x4c0 net/ipv4/ip_output.c:362
 [<ffffffff8321f93b>] dst_output include/net/dst.h:498 [inline]
 [<ffffffff8321f93b>] ip_local_out+0x9b/0x180 net/ipv4/ip_output.c:119
 [<ffffffff83220c7e>] ip_queue_xmit+0x88e/0x1af0 net/ipv4/ip_output.c:461
 [<ffffffff83286921>] __tcp_transmit_skb+0x1691/0x2c50 net/ipv4/tcp_output.c:1034
 [<ffffffff832885db>] tcp_transmit_skb net/ipv4/tcp_output.c:1047 [inline]
 [<ffffffff832885db>] tcp_write_xmit+0x6fb/0x4d20 net/ipv4/tcp_output.c:2137
 [<ffffffff8328d3d0>] __tcp_push_pending_frames+0xa0/0x290 net/ipv4/tcp_output.c:2319
 [<ffffffff832944d6>] tcp_send_fin+0x176/0xab0 net/ipv4/tcp_output.c:2895
 [<ffffffff83251a60>] tcp_close+0xca0/0xf70 net/ipv4/tcp.c:2112
 [<ffffffff832fea9f>] inet_release+0xff/0x1d0 net/ipv4/af_inet.c:435
 [<ffffffff82f1f876>] sock_release+0x96/0x1c0 net/socket.c:587
 [<ffffffff82f1f9b6>] sock_close+0x16/0x20 net/socket.c:1038
 [<ffffffff815253c5>] __fput+0x235/0x6f0 fs/file_table.c:208
 [<ffffffff81525905>] ____fput+0x15/0x20 fs/file_table.c:244
 [<ffffffff8118e00f>] task_work_run+0x10f/0x190 kernel/task_work.c:115
 [<ffffffff81137475>] exit_task_work include/linux/task_work.h:21 [inline]
 [<ffffffff81137475>] do_exit+0x9e5/0x26b0 kernel/exit.c:755
 [<ffffffff8113d3b1>] do_group_exit+0x111/0x330 kernel/exit.c:885
 [<ffffffff8113d5ed>] SYSC_exit_group kernel/exit.c:896 [inline]
 [<ffffffff8113d5ed>] SyS_exit_group+0x1d/0x20 kernel/exit.c:894
 [<ffffffff838c8c65>] entry_SYSCALL_64_fastpath+0x22/0x9e

Freed by task 0:
(stack is not available)

The buggy address belongs to the object at ffff8800b0f6ad00
 which belongs to the cache kmalloc-1024 of size 1024
The buggy address is located 688 bytes inside of
 1024-byte region [ffff8800b0f6ad00, ffff8800b0f6b100)
The buggy address belongs to the page:
PANIC: double fault, error_code: 0x0
CPU: 1 PID: 3755 Comm: syz-executor021 Not tainted 4.4.147-ga5fc665 #80
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
task: ffff8801cbb10000 task.stack: ffff8801cbaf0000
RIP: 0010:[<ffffffff8148f4a4>]  [<ffffffff8148f4a4>] dump_page_badflags+0x4/0x70 mm/debug.c:84
RSP: 0018:ffff880100000000  EFLAGS: 00010046
RAX: ffff8801cbb10000 RBX: ffffea0002c3da00 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff83aaad60 RDI: ffffea0002c3da00
RBP: ffff880100000000 R08: 0000000000000001 R09: 0000000000000000
R10: 0000000000000001 R11: ffffffff858f0274 R12: 0000000000000000
R13: ffffffff83aaad60 R14: ffff8800b0f6ad00 R15: ffff8800b0f6b100
FS:  0000000000000000(0000) GS:ffff8801db300000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff8800fffffff8 CR3: 000000000440c000 CR4: 00000000001606f0
Stack:

Call Trace:
 <UNK> 
Code: e8 3e 48 69 c0 80 06 00 00 f0 48 ff 80 28 5b 9f 84 5b 5d c3 48 89 df e8 3b c9 06 00 eb dd 66 0f 1f 84 00 00 00 00 00 55 48 89 e5 <41> 57 41 56 41 55 49 89 f5 41 54 49 89 d4 53 48 89 fb 48 83 ec