==================================================================
BUG: KASAN: slab-out-of-bounds in __ipv6_addr_type+0x26c/0x290 net/ipv6/addrconf_core.c:68
Read of size 4 at addr ffff8801cfd5cbb8 by task syz-executor.1/32202

CPU: 1 PID: 32202 Comm: syz-executor.1 Not tainted 4.4.174+ #4
 0000000000000000 14ceed7f90713352 ffff8800a3526da0 ffffffff81aad1a1
 0000000000000000 ffffea00073f5700 ffff8801cfd5cbb8 0000000000000004
 ffff8801cfd5c900 ffff8800a3526dd8 ffffffff81490120 0000000000000000
Call Trace:
 [<ffffffff81aad1a1>] __dump_stack lib/dump_stack.c:15 [inline]
 [<ffffffff81aad1a1>] dump_stack+0xc1/0x120 lib/dump_stack.c:51
 [<ffffffff81490120>] print_address_description+0x6f/0x21b mm/kasan/report.c:252
 [<ffffffff81490358>] kasan_report_error mm/kasan/report.c:351 [inline]
 [<ffffffff81490358>] kasan_report mm/kasan/report.c:408 [inline]
 [<ffffffff81490358>] kasan_report.cold+0x8c/0x2be mm/kasan/report.c:393
 [<ffffffff81484eb4>] __asan_report_load4_noabort+0x14/0x20 mm/kasan/report.c:428
 [<ffffffff826bbd4c>] __ipv6_addr_type+0x26c/0x290 net/ipv6/addrconf_core.c:68
 [<ffffffff826b141c>] ipv6_addr_type include/net/ipv6.h:330 [inline]
 [<ffffffff826b141c>] ip6_tnl_xmit2+0x2ac/0x2320 net/ipv6/ip6_tunnel.c:988
 [<ffffffff826b4e59>] ip4ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1134 [inline]
 [<ffffffff826b4e59>] ip6_tnl_xmit+0xa09/0xe00 net/ipv6/ip6_tunnel.c:1212
 [<ffffffff82245071>] __netdev_start_xmit include/linux/netdevice.h:3750 [inline]
 [<ffffffff82245071>] netdev_start_xmit include/linux/netdevice.h:3759 [inline]
 [<ffffffff82245071>] xmit_one net/core/dev.c:2781 [inline]
 [<ffffffff82245071>] dev_hard_start_xmit+0x7c1/0x11e0 net/core/dev.c:2797
 [<ffffffff822473cb>] __dev_queue_xmit+0x164b/0x1bb0 net/core/dev.c:3229
 [<ffffffff82247948>] dev_queue_xmit+0x18/0x20 net/core/dev.c:3263
 [<ffffffff8225c136>] neigh_direct_output+0x16/0x20 net/core/neighbour.c:1369
 [<ffffffff823c5412>] dst_neigh_output include/net/dst.h:461 [inline]
 [<ffffffff823c5412>] ip_finish_output2+0x6a2/0x1280 net/ipv4/ip_output.c:213
 [<ffffffff823cc6e2>] ip_finish_output+0x8b2/0xc60 net/ipv4/ip_output.c:288
 [<ffffffff823d04a7>] NF_HOOK_COND include/linux/netfilter.h:240 [inline]
 [<ffffffff823d04a7>] ip_output+0x227/0x4c0 net/ipv4/ip_output.c:362
 [<ffffffff823cd21c>] dst_output include/net/dst.h:498 [inline]
 [<ffffffff823cd21c>] ip_local_out+0x9c/0x180 net/ipv4/ip_output.c:119
 [<ffffffff823d300e>] ip_send_skb+0x3e/0xc0 net/ipv4/ip_output.c:1453
 [<ffffffff82478ded>] udp_send_skb+0x4fd/0xc70 net/ipv4/udp.c:842
 [<ffffffff8247fb9f>] udp_sendmsg+0x16cf/0x1c60 net/ipv4/udp.c:1072
 [<ffffffff826137a2>] udpv6_sendmsg+0x12f2/0x24f0 net/ipv6/udp.c:1173
 [<ffffffff824a8b42>] inet_sendmsg+0x202/0x4d0 net/ipv4/af_inet.c:755
 [<ffffffff821d838e>] sock_sendmsg_nosec net/socket.c:638 [inline]
 [<ffffffff821d838e>] sock_sendmsg+0xbe/0x110 net/socket.c:648
 [<ffffffff821da269>] ___sys_sendmsg+0x769/0x890 net/socket.c:1975
 [<ffffffff821dd0c5>] __sys_sendmsg+0xc5/0x160 net/socket.c:2009
 [<ffffffff821dd18d>] SYSC_sendmsg net/socket.c:2020 [inline]
 [<ffffffff821dd18d>] SyS_sendmsg+0x2d/0x50 net/socket.c:2016
 [<ffffffff82718ba1>] entry_SYSCALL_64_fastpath+0x1e/0x9a

Allocated by task 32202:
 [<ffffffff8102e3c6>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63
 [<ffffffff81483f22>] save_stack mm/kasan/kasan.c:512 [inline]
 [<ffffffff81483f22>] set_track mm/kasan/kasan.c:524 [inline]
 [<ffffffff81483f22>] kasan_kmalloc.part.0+0x62/0xf0 mm/kasan/kasan.c:616
 [<ffffffff81484197>] kasan_kmalloc+0xb7/0xd0 mm/kasan/kasan.c:601
 [<ffffffff81480521>] __kmalloc+0x141/0x330 mm/slub.c:3613
 [<ffffffff82264216>] kmalloc include/linux/slab.h:481 [inline]
 [<ffffffff82264216>] kzalloc include/linux/slab.h:620 [inline]
 [<ffffffff82264216>] neigh_alloc net/core/neighbour.c:285 [inline]
 [<ffffffff82264216>] __neigh_create+0x1d6/0x1b30 net/core/neighbour.c:457
 [<ffffffff823a024e>] neigh_create include/net/neighbour.h:313 [inline]
 [<ffffffff823a024e>] ipv4_neigh_lookup+0x52e/0x6e0 net/ipv4/route.c:464
 [<ffffffff826b13eb>] dst_neigh_lookup include/net/dst.h:466 [inline]
 [<ffffffff826b13eb>] ip6_tnl_xmit2+0x27b/0x2320 net/ipv6/ip6_tunnel.c:982
 [<ffffffff826b4e59>] ip4ip6_tnl_xmit net/ipv6/ip6_tunnel.c:1134 [inline]
 [<ffffffff826b4e59>] ip6_tnl_xmit+0xa09/0xe00 net/ipv6/ip6_tunnel.c:1212
 [<ffffffff82245071>] __netdev_start_xmit include/linux/netdevice.h:3750 [inline]
 [<ffffffff82245071>] netdev_start_xmit include/linux/netdevice.h:3759 [inline]
 [<ffffffff82245071>] xmit_one net/core/dev.c:2781 [inline]
 [<ffffffff82245071>] dev_hard_start_xmit+0x7c1/0x11e0 net/core/dev.c:2797
 [<ffffffff822473cb>] __dev_queue_xmit+0x164b/0x1bb0 net/core/dev.c:3229
 [<ffffffff82247948>] dev_queue_xmit+0x18/0x20 net/core/dev.c:3263
 [<ffffffff8225c136>] neigh_direct_output+0x16/0x20 net/core/neighbour.c:1369
 [<ffffffff823c5412>] dst_neigh_output include/net/dst.h:461 [inline]
 [<ffffffff823c5412>] ip_finish_output2+0x6a2/0x1280 net/ipv4/ip_output.c:213
 [<ffffffff823cc6e2>] ip_finish_output+0x8b2/0xc60 net/ipv4/ip_output.c:288
 [<ffffffff823d04a7>] NF_HOOK_COND include/linux/netfilter.h:240 [inline]
 [<ffffffff823d04a7>] ip_output+0x227/0x4c0 net/ipv4/ip_output.c:362
 [<ffffffff823cd21c>] dst_output include/net/dst.h:498 [inline]
 [<ffffffff823cd21c>] ip_local_out+0x9c/0x180 net/ipv4/ip_output.c:119
 [<ffffffff823d300e>] ip_send_skb+0x3e/0xc0 net/ipv4/ip_output.c:1453
 [<ffffffff82478ded>] udp_send_skb+0x4fd/0xc70 net/ipv4/udp.c:842
 [<ffffffff8247fb9f>] udp_sendmsg+0x16cf/0x1c60 net/ipv4/udp.c:1072
 [<ffffffff826137a2>] udpv6_sendmsg+0x12f2/0x24f0 net/ipv6/udp.c:1173
 [<ffffffff824a8b42>] inet_sendmsg+0x202/0x4d0 net/ipv4/af_inet.c:755
 [<ffffffff821d838e>] sock_sendmsg_nosec net/socket.c:638 [inline]
 [<ffffffff821d838e>] sock_sendmsg+0xbe/0x110 net/socket.c:648
 [<ffffffff821da269>] ___sys_sendmsg+0x769/0x890 net/socket.c:1975
 [<ffffffff821dd0c5>] __sys_sendmsg+0xc5/0x160 net/socket.c:2009
 [<ffffffff821dd18d>] SYSC_sendmsg net/socket.c:2020 [inline]
 [<ffffffff821dd18d>] SyS_sendmsg+0x2d/0x50 net/socket.c:2016
 [<ffffffff82718ba1>] entry_SYSCALL_64_fastpath+0x1e/0x9a

Freed by task 30895:
 [<ffffffff8102e3c6>] save_stack_trace+0x26/0x50 arch/x86/kernel/stacktrace.c:63
 [<ffffffff81484820>] save_stack mm/kasan/kasan.c:512 [inline]
 [<ffffffff81484820>] set_track mm/kasan/kasan.c:524 [inline]
 [<ffffffff81484820>] kasan_slab_free+0xb0/0x190 mm/kasan/kasan.c:589
 [<ffffffff81481c44>] slab_free_hook mm/slub.c:1383 [inline]
 [<ffffffff81481c44>] slab_free_freelist_hook mm/slub.c:1405 [inline]
 [<ffffffff81481c44>] slab_free mm/slub.c:2859 [inline]
 [<ffffffff81481c44>] kfree+0xf4/0x310 mm/slub.c:3749
 [<ffffffff821fd036>] skb_free_head net/core/skbuff.c:571 [inline]
 [<ffffffff821fd036>] skb_release_data+0x2e6/0x380 net/core/skbuff.c:602
 [<ffffffff821fd11d>] skb_release_all+0x4d/0x60 net/core/skbuff.c:661
 [<ffffffff821ff4b3>] __kfree_skb net/core/skbuff.c:675 [inline]
 [<ffffffff821ff4b3>] consume_skb+0xf3/0x3f0 net/core/skbuff.c:748
 [<ffffffff822e6961>] netlink_broadcast_filtered+0x2b1/0x9d0 net/netlink/af_netlink.c:1486
 [<ffffffff822e70c4>] netlink_broadcast+0x44/0x60 net/netlink/af_netlink.c:1508
 [<ffffffff8257a9a2>] nlmsg_multicast include/net/netlink.h:565 [inline]
 [<ffffffff8257a9a2>] xfrm_nlmsg_multicast net/xfrm/xfrm_user.c:1002 [inline]
 [<ffffffff8257a9a2>] xfrm_send_acquire+0x732/0x9a0 net/xfrm/xfrm_user.c:2841
 [<ffffffff82557c6a>] km_query+0xba/0x1d0 net/xfrm/xfrm_state.c:1756
 [<ffffffff82565c9f>] xfrm_state_find+0x15df/0x24c0 net/xfrm/xfrm_state.c:852
 [<ffffffff8254d467>] xfrm_tmpl_resolve_one+0x1c7/0x790 net/xfrm/xfrm_policy.c:1455
 [<ffffffff8254dc40>] xfrm_tmpl_resolve net/xfrm/xfrm_policy.c:1499 [inline]
 [<ffffffff8254dc40>] xfrm_resolve_and_create_bundle+0x210/0x1df0 net/xfrm/xfrm_policy.c:1847
 [<ffffffff8255537e>] xfrm_bundle_lookup+0x3ae/0x1080 net/xfrm/xfrm_policy.c:2094
 [<ffffffff8228d665>] flow_cache_lookup+0x8a5/0xf00 net/core/flow.c:264
 [<ffffffff82550e37>] xfrm_lookup+0x497/0xad0 net/xfrm/xfrm_policy.c:2234
 [<ffffffff82552338>] xfrm_lookup_route+0x38/0x140 net/xfrm/xfrm_policy.c:2326
 [<ffffffff823a5a23>] ip_route_output_flow+0x93/0xa0 net/ipv4/route.c:2437
 [<ffffffff824465c1>] ip_route_connect include/net/route.h:304 [inline]
 [<ffffffff824465c1>] tcp_v4_connect+0x761/0x1930 net/ipv4/tcp_ipv4.c:171
 [<ffffffff824a7a2f>] __inet_stream_connect+0x2cf/0xc70 net/ipv4/af_inet.c:615
 [<ffffffff823fc71d>] tcp_sendmsg_fastopen net/ipv4/tcp.c:1092 [inline]
 [<ffffffff823fc71d>] tcp_sendmsg+0x19ed/0x2ab0 net/ipv4/tcp.c:1112
 [<ffffffff824a8b42>] inet_sendmsg+0x202/0x4d0 net/ipv4/af_inet.c:755
 [<ffffffff821d838e>] sock_sendmsg_nosec net/socket.c:638 [inline]
 [<ffffffff821d838e>] sock_sendmsg+0xbe/0x110 net/socket.c:648
 [<ffffffff821dc4f1>] SYSC_sendto net/socket.c:1678 [inline]
 [<ffffffff821dc4f1>] SyS_sendto+0x201/0x340 net/socket.c:1646
 [<ffffffff82718ba1>] entry_SYSCALL_64_fastpath+0x1e/0x9a

The buggy address belongs to the object at ffff8801cfd5c900
 which belongs to the cache kmalloc-1024 of size 1024
The buggy address is located 696 bytes inside of
 1024-byte region [ffff8801cfd5c900, ffff8801cfd5cd00)
The buggy address belongs to the page:
BUG: unable to handle kernel paging request at ffffffffffffffff
IP: [<ffffffff81b0afa6>] __list_del_entry_valid+0x86/0x1a0 lib/list_debug.c:51
PGD 2e0d067 PUD 2e0f067 PMD 0 
Oops: 0000 [#1] PREEMPT SMP KASAN
Modules linked in:
CPU: 0 PID: 11484 Comm: syz-executor.2 Not tainted 4.4.174+ #4
task: ffff8801d40a2f80 task.stack: ffff8800b8898000
RIP: 0010:[<ffffffff81b0afa6>]  [<ffffffff81b0afa6>] __list_del_entry_valid+0x86/0x1a0 lib/list_debug.c:51
RSP: 0000:ffff8801db607b50  EFLAGS: 00010046
RAX: dffffc0000000000 RBX: ffffffffffffffff RCX: ffff88009ac2b008
RDX: 1fffffffffffffff RSI: ffffffff81aaccd4 RDI: ffff88009ac2b010
RBP: ffff8801db607b68 R08: ffff88009ac2b078 R09: 0000000000000000
R10: ffff88009ac2af80 R11: 000001d856617700 R12: 0000000000000001
R13: ffff8801db71e880 R14: dffffc0000000000 R15: ffff8801db607d48
FS:  00007f7c28e4b700(0000) GS:ffff8801db600000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffffffffff CR3: 00000001d20cd000 CR4: 00000000001606b0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000600
Stack:
 ffff8801db71e880 dffffc0000000000 ffff88009ac2b008 ffff8801db607d70
 ffffffff811c6b61 1ffffffff0506d10 ffff8801db607b90 ffffffff8123a761
 ffff8801db607c50 0000000000000046 ffff88021fffd008 ffff8801db61e880
Call Trace:
 <IRQ> 
 [<ffffffff811c6b61>] __list_del_entry include/linux/list.h:116 [inline]
 [<ffffffff811c6b61>] list_move_tail include/linux/list.h:181 [inline]
 [<ffffffff811c6b61>] detach_tasks kernel/sched/fair.c:7683 [inline]
 [<ffffffff811c6b61>] load_balance+0xf71/0x3050 kernel/sched/fair.c:9079
 [<ffffffff811c90c1>] rebalance_domains+0x481/0x960 kernel/sched/fair.c:9697
 [<ffffffff811c98c9>] run_rebalance_domains+0x329/0x490 kernel/sched/fair.c:9913
 [<ffffffff8271bb16>] __do_softirq+0x226/0xa3f kernel/softirq.c:273
 [<ffffffff810e1a8a>] invoke_softirq kernel/softirq.c:350 [inline]
 [<ffffffff810e1a8a>] irq_exit+0x10a/0x150 kernel/softirq.c:391
 [<ffffffff8271b24e>] exiting_irq arch/x86/include/asm/apic.h:652 [inline]
 [<ffffffff8271b24e>] smp_apic_timer_interrupt+0x7e/0xb0 arch/x86/kernel/apic/apic.c:926
 [<ffffffff8271a59d>] apic_timer_interrupt+0x9d/0xb0 arch/x86/entry/entry_64.S:768
 <EOI> 
Code: 66 48 b8 00 02 00 00 00 00 ad de 48 39 c3 74 78 48 b8 00 00 00 00 00 fc ff df 48 89 da 48 c1 ea 03 80 3c 02 00 0f 85 fb 00 00 00 <48> 8b 03 48 39 c8 75 74 49 8d 78 08 48 b8 00 00 00 00 00 fc ff 
RIP  [<ffffffff81b0afa6>] __list_del_entry_valid+0x86/0x1a0 lib/list_debug.c:51
 RSP <ffff8801db607b50>
CR2: ffffffffffffffff
---[ end trace 285a23cf8a585c02 ]---