syzbot

==================================================================
BUG: KASAN: invalid-access in hlist_add_head include/linux/list.h:883 [inline]
BUG: KASAN: invalid-access in enqueue_timer+0x18/0xc0 kernel/time/timer.c:581
Write at addr f3ff0000289f7378 by task kworker/0:2/17733
Pointer tag: [f3], memory tag: [f5]

CPU: 0 PID: 17733 Comm: kworker/0:2 Not tainted 5.12.0-rc2-syzkaller-00059-g144c79ef3353 #0
Hardware name: linux,dummy-virt (DT)
Workqueue: events flush_stashed_error_work
Call trace:
 dump_backtrace+0x0/0x1b0 arch/arm64/kernel/stacktrace.c:112
 show_stack+0x18/0x70 arch/arm64/kernel/stacktrace.c:191
 __dump_stack lib/dump_stack.c:79 [inline]
 dump_stack+0xd0/0x12c lib/dump_stack.c:120
 print_address_description+0x70/0x29c mm/kasan/report.c:232
 __kasan_report mm/kasan/report.c:399 [inline]
 kasan_report+0x134/0x380 mm/kasan/report.c:416
 report_tag_fault arch/arm64/mm/fault.c:324 [inline]
 do_tag_recovery arch/arm64/mm/fault.c:336 [inline]
 __do_kernel_fault+0x1a8/0x1dc arch/arm64/mm/fault.c:378
 do_bad_area arch/arm64/mm/fault.c:474 [inline]
 do_tag_check_fault+0x74/0x90 arch/arm64/mm/fault.c:729
 do_mem_abort+0x44/0xbc arch/arm64/mm/fault.c:805
 el1_abort+0x40/0x6c arch/arm64/kernel/entry-common.c:167
 el1_sync_handler+0xac/0xd0 arch/arm64/kernel/entry-common.c:259
 el1_sync+0x70/0x100 arch/arm64/kernel/entry.S:656
 hlist_add_head include/linux/list.h:883 [inline]
 enqueue_timer+0x18/0xc0 kernel/time/timer.c:581
 mod_timer+0x14/0x20 kernel/time/timer.c:1106
 ext4_update_super+0x36c/0x3c0 fs/ext4/super.c:5544
 ext4_commit_super+0x74/0x184 fs/ext4/super.c:5562
 flush_stashed_error_work+0x30/0xa4 fs/ext4/super.c:727
 process_one_work+0x1d8/0x364 kernel/workqueue.c:2275
 worker_thread+0x70/0x434 kernel/workqueue.c:2421
 kthread+0x174/0x180 kernel/kthread.c:292
 ret_from_fork+0x10/0x34 arch/arm64/kernel/entry.S:958

Allocated by task 17760:
 stack_trace_save+0x50/0x80 kernel/stacktrace.c:121
 kasan_save_stack+0x28/0x60 mm/kasan/common.c:38
 kasan_set_track mm/kasan/common.c:46 [inline]
 set_alloc_info mm/kasan/common.c:427 [inline]
 ____kasan_kmalloc mm/kasan/common.c:506 [inline]
 ____kasan_kmalloc mm/kasan/common.c:465 [inline]
 __kasan_kmalloc+0xc8/0x100 mm/kasan/common.c:515
 kasan_kmalloc include/linux/kasan.h:233 [inline]
 __kmalloc_node+0x1d8/0x3dc mm/slub.c:4103
 kmalloc_node include/linux/slab.h:577 [inline]
 kvmalloc_node+0x40/0xe0 mm/util.c:587
 kvmalloc include/linux/mm.h:785 [inline]
 kvmalloc_array include/linux/mm.h:803 [inline]
 alloc_fdtable+0xb0/0x150 fs/file.c:120
 dup_fd+0x240/0x320 fs/file.c:325
 copy_files kernel/fork.c:1466 [inline]
 copy_process+0x5f8/0x1500 kernel/fork.c:2087
 kernel_clone+0x5c/0x3c0 kernel/fork.c:2492
 __do_sys_clone+0x54/0x80 kernel/fork.c:2609
 __se_sys_clone kernel/fork.c:2577 [inline]
 __arm64_sys_clone+0x24/0x30 kernel/fork.c:2577
 __invoke_syscall arch/arm64/kernel/syscall.c:37 [inline]
 invoke_syscall arch/arm64/kernel/syscall.c:49 [inline]
 el0_svc_common.constprop.0+0x60/0x120 arch/arm64/kernel/syscall.c:129
 do_el0_svc+0x74/0x90 arch/arm64/kernel/syscall.c:168
 el0_svc+0x2c/0x54 arch/arm64/kernel/entry-common.c:416
 el0_sync_handler+0x1a4/0x1b0 arch/arm64/kernel/entry-common.c:432
 el0_sync+0x18c/0x1c0 arch/arm64/kernel/entry.S:699

Freed by task 548:
 stack_trace_save+0x50/0x80 kernel/stacktrace.c:121
 kasan_save_stack+0x28/0x60 mm/kasan/common.c:38
 kasan_set_track+0x28/0x40 mm/kasan/common.c:46
 kasan_set_free_info+0x20/0x30 mm/kasan/hw_tags.c:174
 ____kasan_slab_free.constprop.0+0x1e0/0x230 mm/kasan/common.c:360
 __kasan_slab_free+0x10/0x1c mm/kasan/common.c:367
 kasan_slab_free include/linux/kasan.h:199 [inline]
 slab_free_hook mm/slub.c:1562 [inline]
 slab_free_freelist_hook+0xbc/0x210 mm/slub.c:1600
 slab_free mm/slub.c:3161 [inline]
 kfree+0x348/0x4d0 mm/slub.c:4213
 sk_prot_free net/core/sock.c:1739 [inline]
 __sk_destruct+0x1dc/0x220 net/core/sock.c:1824
 sk_destruct net/core/sock.c:1839 [inline]
 __sk_free+0x78/0x114 net/core/sock.c:1850
 sk_free+0x5c/0x80 net/core/sock.c:1861
 sock_put include/net/sock.h:1803 [inline]
 packet_release+0x374/0x464 net/packet/af_packet.c:3106
 __sock_release+0x44/0xbc net/socket.c:599
 sock_close+0x18/0x30 net/socket.c:1258
 __fput+0x78/0x230 fs/file_table.c:280
 ____fput+0x10/0x20 fs/file_table.c:313
 task_work_run+0x80/0x160 kernel/task_work.c:140
 tracehook_notify_resume include/linux/tracehook.h:189 [inline]
 do_notify_resume+0x20c/0x13e0 arch/arm64/kernel/signal.c:939
 work_pending+0xc/0x3d4

The buggy address belongs to the object at ffff0000289f7000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 888 bytes inside of
 2048-byte region [ffff0000289f7000, ffff0000289f7800)
The buggy address belongs to the page:
page:00000000e7fca950 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x689f0
head:00000000e7fca950 order:3 compound_mapcount:0 compound_pincount:0
memcg:f6ff0000283f8501
flags: 0x1ffffc000010200(slab|head)
raw: 01ffffc000010200 fffffc0000a02c00 0000000200000002 f7ff000004401600
raw: 0000000000000000 0000000000080008 00000001ffffffff f6ff0000283f8501
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff0000289f7100: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
 ffff0000289f7200: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
>ffff0000289f7300: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
                                        ^
 ffff0000289f7400: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
 ffff0000289f7500: f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5 f5
==================================================================