syzbot

==================================================================
BUG: KASAN: use-after-free in __write_once_size include/linux/compiler.h:226 [inline]
BUG: KASAN: use-after-free in __hlist_del include/linux/list.h:811 [inline]
BUG: KASAN: use-after-free in inet_bind_bucket_destroy net/ipv4/inet_hashtables.c:87 [inline]
BUG: KASAN: use-after-free in inet_bind_bucket_destroy+0xf5/0x120 net/ipv4/inet_hashtables.c:84
Write of size 8 at addr ffff88800010a230 by task kworker/u4:0/7

CPU: 0 PID: 7 Comm: kworker/u4:0 Not tainted 5.7.0-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Workqueue: krdsd rds_connect_worker
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x188/0x20d lib/dump_stack.c:118
 print_address_description.constprop.0.cold+0xd3/0x413 mm/kasan/report.c:382
 __kasan_report.cold+0x20/0x38 mm/kasan/report.c:511
 kasan_report+0x33/0x50 mm/kasan/common.c:625
 __write_once_size include/linux/compiler.h:226 [inline]
 __hlist_del include/linux/list.h:811 [inline]
 inet_bind_bucket_destroy net/ipv4/inet_hashtables.c:87 [inline]
 inet_bind_bucket_destroy+0xf5/0x120 net/ipv4/inet_hashtables.c:84
 inet_twsk_bind_unhash+0x121/0x1b0 net/ipv4/inet_timewait_sock.c:39
 inet_twsk_kill+0x368/0x4b0 net/ipv4/inet_timewait_sock.c:59
 inet_twsk_deschedule_put+0x41/0x50 net/ipv4/inet_timewait_sock.c:215
 __inet_check_established+0xb3e/0xda0 net/ipv4/inet_hashtables.c:452
 __inet_hash_connect+0x954/0xeb0 net/ipv4/inet_hashtables.c:647
 tcp_v4_connect+0xdea/0x1c10 net/ipv4/tcp_ipv4.c:274
 __inet_stream_connect+0x80f/0xe30 net/ipv4/af_inet.c:655
 inet_stream_connect+0x53/0xa0 net/ipv4/af_inet.c:719
 rds_tcp_conn_path_connect+0x620/0x880 net/rds/tcp_connect.c:172
 rds_connect_worker+0x1a5/0x2c0 net/rds/threads.c:176
 process_one_work+0x965/0x16a0 kernel/workqueue.c:2268
 worker_thread+0x96/0xe20 kernel/workqueue.c:2414
 kthread+0x388/0x470 kernel/kthread.c:268
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:351

Allocated by task 0:
(stack is not available)

Freed by task 7:
 save_stack+0x1b/0x40 mm/kasan/common.c:49
 set_track mm/kasan/common.c:57 [inline]
 kasan_set_free_info mm/kasan/common.c:317 [inline]
 __kasan_slab_free+0xf7/0x140 mm/kasan/common.c:456
 __cache_free mm/slab.c:3426 [inline]
 kmem_cache_free+0x7f/0x320 mm/slab.c:3694
 inet_bind_bucket_destroy net/ipv4/inet_hashtables.c:88 [inline]
 inet_bind_bucket_destroy+0xe2/0x120 net/ipv4/inet_hashtables.c:84
 inet_twsk_bind_unhash+0x121/0x1b0 net/ipv4/inet_timewait_sock.c:39
 inet_twsk_kill+0x368/0x4b0 net/ipv4/inet_timewait_sock.c:59
 inet_twsk_deschedule_put+0x41/0x50 net/ipv4/inet_timewait_sock.c:215
 __inet_check_established+0xb3e/0xda0 net/ipv4/inet_hashtables.c:452
 __inet_hash_connect+0x954/0xeb0 net/ipv4/inet_hashtables.c:647
 tcp_v4_connect+0xdea/0x1c10 net/ipv4/tcp_ipv4.c:274
 __inet_stream_connect+0x80f/0xe30 net/ipv4/af_inet.c:655
 inet_stream_connect+0x53/0xa0 net/ipv4/af_inet.c:719
 rds_tcp_conn_path_connect+0x620/0x880 net/rds/tcp_connect.c:172
 rds_connect_worker+0x1a5/0x2c0 net/rds/threads.c:176
 process_one_work+0x965/0x16a0 kernel/workqueue.c:2268
 worker_thread+0x96/0xe20 kernel/workqueue.c:2414
 kthread+0x388/0x470 kernel/kthread.c:268
 ret_from_fork+0x24/0x30 arch/x86/entry/entry_64.S:351

The buggy address belongs to the object at ffff88800010a200
 which belongs to the cache tcp_bind_bucket of size 72
The buggy address is located 48 bytes inside of
 72-byte region [ffff88800010a200, ffff88800010a248)
The buggy address belongs to the page:
page:ffffea0000004280 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0
flags: 0x7ffe0000000200(slab)
raw: 007ffe0000000200 ffffea000190ca88 ffffea00006e3e08 ffff8880a4e20a80
raw: 0000000000000000 ffff88800010a000 0000000100000020 0000000000000000
page dumped because: kasan: bad access detected

Memory state around the buggy address:
 ffff88800010a100: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc
 ffff88800010a180: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc
>ffff88800010a200: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc
                                     ^
 ffff88800010a280: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc
 ffff88800010a300: fb fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc
==================================================================