TITLE: BUG: using __this_cpu_read() in preemptible code in ipcomp_init_state

[   45.818290] BUG: using __this_cpu_read() in preemptible [00000000] code: syz-executor7/6729
[   45.826891] caller is __this_cpu_preempt_check+0x1c/0x20
[   45.832355] CPU: 0 PID: 6729 Comm: syz-executor7 Not tainted 4.9.68-gfb66dc2 #107
[   45.839956] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
[   45.849288]  ffff8801d5eef6d8 ffffffff81d90889 0000000000000000 ffffffff83c17800
[   45.857305]  ffffffff83f42ec0 ffff8801aed31800 0000000000000003 ffff8801d5eef718
[   45.865990]  ffffffff81df7854 ffff8801d5eef730 ffffffff83f42ec0[   45.871305] tc_dump_action: action bad kind
[   45.876416]  dffffc0000000000Call Trace:
[   45.880614]  [<ffffffff81d90889>] dump_stack+0xc1/0x128
[   45.885972]  [<ffffffff81df7854>] check_preemption_disabled+0x1d4/0x200
[   45.892723]  [<ffffffff81df78bc>] __this_cpu_preempt_check+0x1c/0x20
[   45.893653] tc_dump_action: action bad kind
[   45.903495]  [<ffffffff833f3f78>] ipcomp_init_state+0x188/0x930
[   45.909534]  [<ffffffff81232141>] ? __lock_is_held+0xa1/0xf0
2017/12/12 14:10:33 executing program 3:
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
setsockopt$inet_sctp6_SCTP_RTOINFO(0xffffffffffffffff, 0x84, 0x0, &(0x7f0000727000)={0x0, 0x0, 0x0, 0x0}, 0x10)
r0 = socket$netlink(0x10, 0x3, 0x0)
writev(r0, &(0x7f0000131000-0x10)=[{&(0x7f000083b000-0x39)="3900000013000904690000008000fffd180000400100000045000107000000140d001a000400020004000a00000000000000010c00001ee400", 0x39}], 0x1)
2017/12/12 14:10:33 executing program 3:
mmap(&(0x7f0000000000/0x788000)=nil, 0x788000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000788000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000789000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x8000)=nil, 0x8000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r0 = socket$inet_udp(0x2, 0x2, 0x0)
mmap(&(0x7f000078a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
ioctl$sock_inet_SIOCSARP(r0, 0x8955, &(0x7f00005ea000-0x44)={{0x2, 0x1, @broadcast=0xffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, {0x4000004, @local={[0xaa, 0xaa, 0xaa, 0xaa, 0xaa], 0x0}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x28, {0x2, 0x0, @broadcast=0xffffffff, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @generic="00fe50018b000000000000c6b760fae5"})
mmap(&(0x7f0000008000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
connect$inet(r0, &(0x7f0000009000-0x10)={0x2, 0x2, @multicast2=0xe0000002, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, 0x10)
mmap(&(0x7f000078a000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f000078b000-0x8)={<r1=>0xffffffffffffffff, 0xffffffffffffffff})
setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f0000001000-0x4)=0xff, 0x4)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
r2 = socket(0x10, 0x3, 0x0)
getsockname$inet6(0xffffffffffffffff, &(0x7f0000cd1000-0x1c)={0x0, 0x0, 0x0, @loopback={0x0, 0x0}, 0x0}, &(0x7f00008b5000)=0x1c)
socket$inet_tcp(0x2, 0x1, 0x0)
write(r2, &(0x7f0000e26000-0x25)="2400000032001f1f14b2f3fd000904000200071008000100ffffffff08000000000000009b", 0x25)
getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, &(0x7f000069c000)={0x2, [0x0, <r3=>0x0]}, &(0x7f00002f2000)=0xc)
getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r2, 0x84, 0x71, &(0x7f00007de000-0x8)={<r4=>r3, 0xa0}, &(0x7f000078a000)=0x8)
getsockopt$inet_sctp_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f00001ec000)={<r5=>r4, 0x6, 0x1000000000002, 0x9d1, 0x4}, &(0x7f0000bc6000-0x4)=0x18)
getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000685000)={0x0, @in6={{0xa, 0x1, 0x7, @remote={0xfe, 0x80, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xbb}, 0x4}, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}}, &(0x7f0000abe000-0x4)=0x8c)
getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f0000ac6000-0x4b)={r5, 0x43, "c24501c4985a7f4a4186dfcd064f93e32cb51df33214b28ffc6368d8b95adb46f1f6606065ba57257d022424c28f100f0a54d01adb15141079803f8c25434a102a27d5"}, &(0x7f00009ac000)=0x4b)
mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x16000)=nil, 0x16000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
mmap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
clone(0x82000, &(0x7f0000001000-0x1)="d3", &(0x7f0000a7b000-0x4)=0x0, &(0x7f000027a000-0x4)=0x0, &(0x7f0000458000)="")
symlink(&(0x7f0000814000-0x8)="2e2f66696c653000", &(0x7f0000c1a000)="2e2f66696c653000")
mmap(&(0x7f0000001000/0x1000)=nil, 0x1000, 0x3, 0x32, 0xffffffffffffffff, 0x0)
openat$ppp(0xffffffffffffff9c, &(0x7f0000001000)="2f6465762f70707000", 0x0, 0x0)
[   45.915314]  [<ffffffff83360470>] ipcomp4_init_state+0xb0/0x7d0
[   45.921359]  [<ffffffff833d2677>] __xfrm_init_state+0x3e7/0xb30
[   45.927402]  [<ffffffff833d2dda>] xfrm_init_state+0x1a/0x20
[   45.933101]  [<ffffffff8356cb49>] pfkey_add+0x1fb9/0x3470
[   45.938630]  [<ffffffff8356ab90>] ? pfkey_delete+0x360/0x360
[   45.944418]  [<ffffffff83561f00>] ? pfkey_seq_stop+0x80/0x80
[   45.950200]  [<ffffffff82eea81a>] ? __skb_clone+0x24a/0x7d0
[   45.955899]  [<ffffffff8356ab90>] ? pfkey_delete+0x360/0x360
[   45.961689]  [<ffffffff835645ee>] pfkey_process+0x61e/0x730
[   45.967402]  [<ffffffff83563fd0>] ? pfkey_send_new_mapping+0x11b0/0x11b0
[   45.974234]  [<ffffffff81238c3b>] ? trace_hardirqs_on_caller+0x38b/0x590
[   45.981076]  [<ffffffff83565e99>] pfkey_sendmsg+0x3a9/0x760
[   45.986776]  [<ffffffff83565af0>] ? pfkey_spdget+0x820/0x820
[   45.992566]  [<ffffffff82ecfb9a>] sock_sendmsg+0xca/0x110
[   45.998092]  [<ffffffff82ed1791>] ___sys_sendmsg+0x6d1/0x7e0
[   46.003885]  [<ffffffff82ed10c0>] ? copy_msghdr_from_user+0x550/0x550
[   46.010454]  [<ffffffff81df76bb>] ? check_preemption_disabled+0x3b/0x200
[   46.017272]  [<ffffffff815cd581>] ? __fget+0x201/0x3a0
[   46.022525]  [<ffffffff815cd5a8>] ? __fget+0x228/0x3a0
[   46.027784]  [<ffffffff815cd3c7>] ? __fget+0x47/0x3a0
[   46.032959]  [<ffffffff815cd8e8>] ? __fget_light+0x188/0x1e0
[   46.038734]  [<ffffffff815cd958>] ? __fdget+0x18/0x20
[   46.043891]  [<ffffffff82ed37c6>] __sys_sendmsg+0xd6/0x190
[   46.049486]  [<ffffffff82ed36f0>] ? SyS_shutdown+0x1b0/0x1b0
[   46.055251]  [<ffffffff814952f0>] ? vma_is_stack_for_current+0xa0/0xa0
[   46.061883]  [<ffffffff812e260e>] ? SyS_futex+0x22e/0x2d0
[   46.067386]  [<ffffffff81238c3b>] ? trace_hardirqs_on_caller+0x38b/0x590
[   46.074191]  [<ffffffff82ed38ad>] SyS_sendmsg+0x2d/0x50
[   46.079523]  [<ffffffff838aa9c5>] entry_SYSCALL_64_fastpath+0x23/0xc6