wlan0 speed is unknown, defaulting to 1000
==================================================================
BUG: KASAN: use-after-free in siw_query_port+0x342/0x430 drivers/infiniband/sw/siw/siw_verbs.c:175
Read of size 4 at addr ffff8880611880d8 by task kworker/0:18/3694

CPU: 0 PID: 3694 Comm: kworker/0:18 Not tainted 5.15.167-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Workqueue: infiniband ib_cache_event_task
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1e3/0x2d0 lib/dump_stack.c:106
 print_address_description+0x63/0x3b0 mm/kasan/report.c:248
 __kasan_report mm/kasan/report.c:434 [inline]
 kasan_report+0x16b/0x1c0 mm/kasan/report.c:451
 siw_query_port+0x342/0x430 drivers/infiniband/sw/siw/siw_verbs.c:175
 ib_cache_update+0x1a8/0xaf0 drivers/infiniband/core/cache.c:1477
 ib_cache_event_task+0xef/0x1e0 drivers/infiniband/core/cache.c:1551
 process_one_work+0x8a1/0x10c0 kernel/workqueue.c:2310
 worker_thread+0xaca/0x1280 kernel/workqueue.c:2457
 kthread+0x3f6/0x4f0 kernel/kthread.c:334
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:287
 </TASK>

The buggy address belongs to the page:
page:ffffea0001846200 refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x61188
flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff)
raw: 00fff00000000000 ffffea00019ca808 ffff8880b90409b0 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 2, migratetype Unmovable, gfp_mask 0x102020(__GFP_HIGH|__GFP_NOWARN|__GFP_HARDWALL), pid 3570, ts 66810961111, free_ts 66810964860
 prep_new_page mm/page_alloc.c:2426 [inline]
 get_page_from_freelist+0x322a/0x33c0 mm/page_alloc.c:4159
 __alloc_pages+0x272/0x700 mm/page_alloc.c:5423
 stack_depot_save+0x319/0x440 lib/stackdepot.c:302
 kasan_save_stack mm/kasan/common.c:40 [inline]
 kasan_set_track mm/kasan/common.c:46 [inline]
 set_alloc_info mm/kasan/common.c:434 [inline]
 __kasan_slab_alloc+0xa5/0xc0 mm/kasan/common.c:467
 kasan_slab_alloc include/linux/kasan.h:254 [inline]
 slab_post_alloc_hook+0x53/0x380 mm/slab.h:519
 slab_alloc_node mm/slub.c:3220 [inline]
 slab_alloc mm/slub.c:3228 [inline]
 kmem_cache_alloc+0xf3/0x280 mm/slub.c:3233
 kmem_cache_zalloc include/linux/slab.h:711 [inline]
 fill_pool lib/debugobjects.c:171 [inline]
 __debug_object_init+0x872/0xd30 lib/debugobjects.c:614
 debug_timer_init kernel/time/timer.c:724 [inline]
 debug_init kernel/time/timer.c:772 [inline]
 init_timer_key+0x3e/0x2d0 kernel/time/timer.c:816
 inet_csk_init_xmit_timers+0x43/0xf0 net/ipv4/inet_connection_sock.c:573
 tcp_init_xmit_timers+0x32/0xb0 net/ipv4/tcp_timer.c:822
 tcp_init_sock+0x6c/0x7f0 net/ipv4/tcp.c:423
 tcp_v4_init_sock+0x1d/0x70 net/ipv4/tcp_ipv4.c:2276
 inet_create+0xa35/0xd40 net/ipv4/af_inet.c:383
 __sock_create+0x460/0x8d0 net/socket.c:1486
 sock_create net/socket.c:1537 [inline]
 __sys_socket+0x132/0x370 net/socket.c:1579
 __do_sys_socket net/socket.c:1588 [inline]
 __se_sys_socket net/socket.c:1586 [inline]
 __x64_sys_socket+0x76/0x80 net/socket.c:1586
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1340 [inline]
 free_pcp_prepare mm/page_alloc.c:1391 [inline]
 free_unref_page_prepare+0xc34/0xcf0 mm/page_alloc.c:3317
 free_unref_page+0x95/0x2d0 mm/page_alloc.c:3396
 stack_depot_save+0x3ef/0x440 lib/stackdepot.c:335
 kasan_save_stack mm/kasan/common.c:40 [inline]
 kasan_set_track mm/kasan/common.c:46 [inline]
 set_alloc_info mm/kasan/common.c:434 [inline]
 __kasan_slab_alloc+0xa5/0xc0 mm/kasan/common.c:467
 kasan_slab_alloc include/linux/kasan.h:254 [inline]
 slab_post_alloc_hook+0x53/0x380 mm/slab.h:519
 slab_alloc_node mm/slub.c:3220 [inline]
 slab_alloc mm/slub.c:3228 [inline]
 kmem_cache_alloc+0xf3/0x280 mm/slub.c:3233
 kmem_cache_zalloc include/linux/slab.h:711 [inline]
 fill_pool lib/debugobjects.c:171 [inline]
 __debug_object_init+0x872/0xd30 lib/debugobjects.c:614
 debug_timer_init kernel/time/timer.c:724 [inline]
 debug_init kernel/time/timer.c:772 [inline]
 init_timer_key+0x3e/0x2d0 kernel/time/timer.c:816
 inet_csk_init_xmit_timers+0x43/0xf0 net/ipv4/inet_connection_sock.c:573
 tcp_init_xmit_timers+0x32/0xb0 net/ipv4/tcp_timer.c:822
 tcp_init_sock+0x6c/0x7f0 net/ipv4/tcp.c:423
 tcp_v4_init_sock+0x1d/0x70 net/ipv4/tcp_ipv4.c:2276
 inet_create+0xa35/0xd40 net/ipv4/af_inet.c:383
 __sock_create+0x460/0x8d0 net/socket.c:1486
 sock_create net/socket.c:1537 [inline]
 __sys_socket+0x132/0x370 net/socket.c:1579
 __do_sys_socket net/socket.c:1588 [inline]
 __se_sys_socket net/socket.c:1586 [inline]
 __x64_sys_socket+0x76/0x80 net/socket.c:1586

Memory state around the buggy address:
 ffff888061187f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
 ffff888061188000: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff888061188080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                                    ^
 ffff888061188100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff888061188180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================