==================================================================
BUG: KASAN: global-out-of-bounds in timer_is_static_object+0x31/0x80 kernel/time/timer.c:627
Read of size 8 at addr ffffffff90d96c40 by task syz-executor.0/11361

CPU: 1 PID: 11361 Comm: syz-executor.0 Not tainted 5.15.0-rc2-syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:88 [inline]
 dump_stack_lvl+0x1dc/0x2d8 lib/dump_stack.c:106
 print_address_description+0x66/0x3e0 mm/kasan/report.c:256
 __kasan_report mm/kasan/report.c:442 [inline]
 kasan_report+0x19a/0x1f0 mm/kasan/report.c:459
 timer_is_static_object+0x31/0x80 kernel/time/timer.c:627
 debug_object_assert_init+0x12f/0x250 lib/debugobjects.c:891
 debug_timer_assert_init kernel/time/timer.c:739 [inline]
 debug_assert_init kernel/time/timer.c:784 [inline]
 del_timer+0xa5/0x3d0 kernel/time/timer.c:1204
 try_to_grab_pending+0x151/0xbb0 kernel/workqueue.c:1270
 __cancel_work kernel/workqueue.c:3258 [inline]
 cancel_delayed_work+0xb3/0x380 kernel/workqueue.c:3287
 sco_sock_clear_timer net/bluetooth/sco.c:119 [inline]
 sco_conn_del+0x229/0x2f0 net/bluetooth/sco.c:195
 hci_disconn_cfm include/net/bluetooth/hci_core.h:1518 [inline]
 hci_conn_hash_flush+0x112/0x240 net/bluetooth/hci_conn.c:1608
 hci_dev_do_close+0x93e/0xeb0 net/bluetooth/hci_core.c:1793
 hci_unregister_dev+0x2a2/0x510 net/bluetooth/hci_core.c:4029
 vhci_release+0x73/0xc0 drivers/bluetooth/hci_vhci.c:340
 __fput+0x3fe/0x870 fs/file_table.c:280
 task_work_run+0x146/0x1c0 kernel/task_work.c:164
 exit_task_work include/linux/task_work.h:32 [inline]
 do_exit+0x6fc/0x2580 kernel/exit.c:825
 do_group_exit+0x168/0x2d0 kernel/exit.c:922
 get_signal+0x16e0/0x20c0 kernel/signal.c:2868
 arch_do_signal_or_restart+0x9c/0x730 arch/x86/kernel/signal.c:865
 handle_signal_work kernel/entry/common.c:148 [inline]
 exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
 exit_to_user_mode_prepare+0x191/0x220 kernel/entry/common.c:209
 __syscall_exit_to_user_mode_work kernel/entry/common.c:291 [inline]
 syscall_exit_to_user_mode+0x2e/0x70 kernel/entry/common.c:302
 do_syscall_64+0x53/0xd0 arch/x86/entry/common.c:86
 entry_SYSCALL_64_after_hwframe+0x44/0xae
RIP: 0033:0x7fdacc6b5739
Code: Unable to access opcode bytes at RIP 0x7fdacc6b570f.
RSP: 002b:00007fdac9c0b188 EFLAGS: 00000246 ORIG_RAX: 0000000000000082
RAX: fffffffffffffdfe RBX: 00007fdacc7ba038 RCX: 00007fdacc6b5739
RDX: 0000000000000000 RSI: 0000000000000008 RDI: 0000000020000080
RBP: 00007fdacc70fcc4 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007fdacc7ba038
R13: 00007fffe6a6de3f R14: 00007fdac9c0b300 R15: 0000000000022000

The buggy address belongs to the variable:
 genl_sk_destructing_cnt+0x0/0x40

Memory state around the buggy address:
 ffffffff90d96b00: 00 00 00 00 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9 f9
 ffffffff90d96b80: f9 f9 f9 f9 00 00 00 00 00 00 f9 f9 f9 f9 f9 f9
>ffffffff90d96c00: 00 00 f9 f9 f9 f9 f9 f9 04 f9 f9 f9 f9 f9 f9 f9
                                           ^
 ffffffff90d96c80: 04 f9 f9 f9 f9 f9 f9 f9 01 f9 f9 f9 f9 f9 f9 f9
 ffffffff90d96d00: 00 00 f9 f9 f9 f9 f9 f9 01 f9 f9 f9 f9 f9 f9 f9
==================================================================