==================================================================
BUG: KASAN: slab-use-after-free in raw_rcv+0xab5/0xd30 net/can/raw.c:139
Read of size 1 at addr ffff88804001259c by task syz.5.1977/12645

CPU: 2 UID: 0 PID: 12645 Comm: syz.5.1977 Tainted: G             L      syzkaller #0 PREEMPT(full) 
Tainted: [L]=SOFTLOCKUP
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
 <IRQ>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x100/0x190 lib/dump_stack.c:120
 print_address_description mm/kasan/report.c:378 [inline]
 print_report+0x13d/0x4b0 mm/kasan/report.c:482
 kasan_report+0xdf/0x1d0 mm/kasan/report.c:595
 raw_rcv+0xab5/0xd30 net/can/raw.c:139
 deliver net/can/af_can.c:575 [inline]
 can_rcv_filter+0x153/0x890 net/can/af_can.c:602
 can_receive+0x2cb/0x500 net/can/af_can.c:674
 canfd_rcv+0x29e/0x300 net/can/af_can.c:715
 __netif_receive_skb_one_core+0x1b2/0x1e0 net/core/dev.c:6202
 __netif_receive_skb+0x1f/0x120 net/core/dev.c:6315
 process_backlog+0x37a/0x1580 net/core/dev.c:6666
 __napi_poll.constprop.0+0xaf/0x450 net/core/dev.c:7733
 napi_poll net/core/dev.c:7796 [inline]
 net_rx_action+0xa40/0xf20 net/core/dev.c:7953
 handle_softirqs+0x1ea/0xa00 kernel/softirq.c:622
 do_softirq kernel/softirq.c:523 [inline]
 do_softirq+0xac/0xe0 kernel/softirq.c:510
 </IRQ>
 <TASK>
 __local_bh_enable_ip+0xf8/0x120 kernel/softirq.c:450
 local_bh_enable include/linux/bottom_half.h:33 [inline]
 netif_rx net/core/dev.c:5775 [inline]
 netif_rx+0x93/0xb0 net/core/dev.c:5764
 can_send+0x647/0xbd0 net/can/af_can.c:289
 raw_sendmsg+0xdf9/0x1480 net/can/raw.c:1008
 sock_sendmsg_nosec net/socket.c:787 [inline]
 __sock_sendmsg net/socket.c:802 [inline]
 ____sys_sendmsg+0x9e1/0xb70 net/socket.c:2698
 ___sys_sendmsg+0x190/0x1e0 net/socket.c:2752
 __sys_sendmsg+0x170/0x220 net/socket.c:2784
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x10b/0x860 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f7a0919ce59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f7a0a01a028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007f7a09415fa0 RCX: 00007f7a0919ce59
RDX: 0000000000000000 RSI: 0000200000000340 RDI: 0000000000000004
RBP: 00007f7a09232d6f R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f7a09416038 R14: 00007f7a09415fa0 R15: 00007fff53f00a18
 </TASK>

Allocated by task 12572:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0xaa/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __do_kmalloc_node mm/slub.c:5296 [inline]
 __kmalloc_noprof+0x301/0x850 mm/slub.c:5308
 kmalloc_noprof include/linux/slab.h:954 [inline]
 sk_prot_alloc+0x10b/0x2a0 net/core/sock.c:2247
 sk_alloc+0x36/0xe80 net/core/sock.c:2303
 __netlink_create+0x5e/0x2c0 net/netlink/af_netlink.c:626
 netlink_create+0x29b/0x610 net/netlink/af_netlink.c:684
 __sock_create+0x339/0x860 net/socket.c:1664
 sock_create net/socket.c:1722 [inline]
 __sys_socket_create net/socket.c:1759 [inline]
 __sys_socket+0x14d/0x260 net/socket.c:1806
 __do_sys_socket net/socket.c:1820 [inline]
 __se_sys_socket net/socket.c:1818 [inline]
 __x64_sys_socket+0x72/0xb0 net/socket.c:1818
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x10b/0x860 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 0:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_save_track+0x14/0x30 mm/kasan/common.c:78
 kasan_save_free_info+0x3b/0x70 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5f/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2689 [inline]
 slab_free mm/slub.c:6251 [inline]
 kfree+0x223/0x6c0 mm/slub.c:6566
 sk_prot_free net/core/sock.c:2286 [inline]
 __sk_destruct+0x88c/0xab0 net/core/sock.c:2386
 sk_destruct+0xc8/0xf0 net/core/sock.c:2414
 __sk_free+0xf4/0x3e0 net/core/sock.c:2425
 sk_free+0x61/0x90 net/core/sock.c:2436
 deferred_put_nlk_sk+0xbe/0x110 net/netlink/af_netlink.c:714
 rcu_do_batch kernel/rcu/tree.c:2617 [inline]
 rcu_core+0x5a2/0x10d0 kernel/rcu/tree.c:2869
 handle_softirqs+0x1ea/0xa00 kernel/softirq.c:622
 __do_softirq kernel/softirq.c:656 [inline]
 invoke_softirq kernel/softirq.c:496 [inline]
 __irq_exit_rcu+0x162/0x210 kernel/softirq.c:735
 irq_exit_rcu+0x9/0x30 kernel/softirq.c:752
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1061 [inline]
 sysvec_apic_timer_interrupt+0xa3/0xc0 arch/x86/kernel/apic/apic.c:1061
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697

Last potentially related work creation:
 kasan_save_stack+0x30/0x50 mm/kasan/common.c:57
 kasan_record_aux_stack+0xa7/0xc0 mm/kasan/generic.c:556
 __call_rcu_common.constprop.0+0xa5/0x9b0 kernel/rcu/tree.c:3131
 netlink_release+0xb38/0x2030 net/netlink/af_netlink.c:796
 __sock_release+0xb3/0x260 net/socket.c:722
 sock_close+0x1c/0x30 net/socket.c:1514
 __fput+0x3ff/0xb50 fs/file_table.c:510
 fput_close_sync+0x118/0x250 fs/file_table.c:615
 __do_sys_close fs/open.c:1507 [inline]
 __se_sys_close fs/open.c:1492 [inline]
 __x64_sys_close+0x8b/0x120 fs/open.c:1492
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x10b/0x860 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

The buggy address belongs to the object at ffff888040012000
 which belongs to the cache kmalloc-2k of size 2048
The buggy address is located 1436 bytes inside of
 freed 2048-byte region [ffff888040012000, ffff888040012800)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888040016000 pfn:0x40010
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
flags: 0xfff00000000240(workingset|head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000240 ffff88801b842f00 ffffea0001608e10 ffffea0000d4f810
raw: ffff888040016000 0000000800080005 00000000f5000000 0000000000000000
head: 00fff00000000240 ffff88801b842f00 ffffea0001608e10 ffffea0000d4f810
head: ffff888040016000 0000000800080005 00000000f5000000 0000000000000000
head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd28c0(GFP_NOWAIT|__GFP_IO|__GFP_FS|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5739, tgid 5739 (syz-executor), ts 54918963017, free_ts 50752261855
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0xfd/0x120 mm/page_alloc.c:1858
 prep_new_page mm/page_alloc.c:1866 [inline]
 get_page_from_freelist+0x11a6/0x33b0 mm/page_alloc.c:3946
 __alloc_frozen_pages_noprof+0x27c/0x2bc0 mm/page_alloc.c:5226
 alloc_slab_page mm/slub.c:3278 [inline]
 allocate_slab mm/slub.c:3467 [inline]
 new_slab+0xa6/0x6c0 mm/slub.c:3525
 refill_objects+0x277/0x420 mm/slub.c:7272
 refill_sheaf mm/slub.c:2816 [inline]
 __pcs_replace_empty_main+0x375/0x650 mm/slub.c:4652
 alloc_from_pcs mm/slub.c:4750 [inline]
 slab_alloc_node mm/slub.c:4884 [inline]
 __do_kmalloc_node mm/slub.c:5295 [inline]
 __kmalloc_node_track_caller_noprof+0x694/0x850 mm/slub.c:5408
 kmalloc_reserve+0xe8/0x350 net/core/skbuff.c:635
 pskb_expand_head+0x249/0x10e0 net/core/skbuff.c:2303
 netlink_trim+0x22d/0x2f0 net/netlink/af_netlink.c:1299
 netlink_broadcast_filtered+0x69/0xe90 net/netlink/af_netlink.c:1512
 nlmsg_multicast_filtered include/net/netlink.h:1165 [inline]
 nlmsg_multicast include/net/netlink.h:1184 [inline]
 nlmsg_notify+0xb1/0x290 net/netlink/af_netlink.c:2593
 rtnl_notify net/core/rtnetlink.c:964 [inline]
 rtmsg_ifinfo_send net/core/rtnetlink.c:4474 [inline]
 rtmsg_ifinfo_event net/core/rtnetlink.c:4490 [inline]
 rtmsg_ifinfo_event net/core/rtnetlink.c:4477 [inline]
 rtmsg_ifinfo+0x177/0x1b0 net/core/rtnetlink.c:4496
 register_netdevice+0x1d9c/0x24b0 net/core/dev.c:11475
 nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1069 [inline]
 nsim_create+0xc8d/0x1420 drivers/net/netdevsim/netdev.c:1151
 __nsim_dev_port_add+0x3ba/0x8f0 drivers/net/netdevsim/dev.c:1509
page last free pid 28 tgid 28 stack trace:
 reset_page_owner include/linux/page_owner.h:25 [inline]
 __free_pages_prepare mm/page_alloc.c:1402 [inline]
 __free_frozen_pages+0x747/0x1040 mm/page_alloc.c:2943
 __folio_put+0x3b4/0x5f0 mm/swap.c:112
 folio_put include/linux/mm.h:2090 [inline]
 put_page include/linux/mm.h:2159 [inline]
 put_netmem include/net/netmem.h:409 [inline]
 skb_page_unref include/linux/skbuff_ref.h:43 [inline]
 __skb_frag_unref include/linux/skbuff_ref.h:56 [inline]
 skb_release_data+0x649/0x8e0 net/core/skbuff.c:1108
 skb_release_all net/core/skbuff.c:1189 [inline]
 __kfree_skb net/core/skbuff.c:1203 [inline]
 napi_consume_skb+0x2c0/0x320 net/core/skbuff.c:1533
 e1000_unmap_and_free_tx_resource+0x144/0x200 drivers/net/ethernet/intel/e1000/e1000_main.c:1971
 e1000_clean_tx_irq drivers/net/ethernet/intel/e1000/e1000_main.c:3861 [inline]
 e1000_clean+0x4af/0x1f70 drivers/net/ethernet/intel/e1000/e1000_main.c:3802
 __napi_poll.constprop.0+0xaf/0x450 net/core/dev.c:7733
 napi_poll net/core/dev.c:7796 [inline]
 net_rx_action+0xa40/0xf20 net/core/dev.c:7953
 handle_softirqs+0x1ea/0xa00 kernel/softirq.c:622
 run_ksoftirqd kernel/softirq.c:1076 [inline]
 run_ksoftirqd+0x38/0x60 kernel/softirq.c:1068
 smpboot_thread_fn+0x3d3/0xaa0 kernel/smpboot.c:160
 kthread+0x370/0x450 kernel/kthread.c:436
 ret_from_fork+0x72b/0xd50 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

Memory state around the buggy address:
 ffff888040012480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888040012500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff888040012580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                            ^
 ffff888040012600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff888040012680: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================