==================================================================
BUG: KASAN: out-of-bounds in hlist_add_head include/linux/list.h:814 [inline]
BUG: KASAN: out-of-bounds in enqueue_timer+0xb7/0x300 kernel/time/timer.c:541
Write of size 8 at addr ffff8881a192f1c8 by task syz-executor.1/31927

CPU: 1 PID: 31927 Comm: syz-executor.1 Not tainted 5.4.254-syzkaller-00010-g5f1cbd78af59 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/06/2023
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x1d8/0x241 lib/dump_stack.c:118
 print_address_description+0x8c/0x600 mm/kasan/report.c:384
 __kasan_report+0xf3/0x120 mm/kasan/report.c:516
 kasan_report+0x30/0x60 mm/kasan/common.c:653
 hlist_add_head include/linux/list.h:814 [inline]
 enqueue_timer+0xb7/0x300 kernel/time/timer.c:541
 __internal_add_timer kernel/time/timer.c:554 [inline]
 internal_add_timer+0x240/0x430 kernel/time/timer.c:604
 __mod_timer+0x6f1/0x13e0 kernel/time/timer.c:1065
 tun_flow_init drivers/net/tun.c:1445 [inline]
 tun_net_init+0x287/0x540 drivers/net/tun.c:1054
 register_netdevice+0x1c0/0x12a0 net/core/dev.c:9112
 tun_set_iff+0x7f7/0xdc0 drivers/net/tun.c:2916
 __tun_chr_ioctl+0x860/0x1d50 drivers/net/tun.c:3180
 do_vfs_ioctl+0x742/0x1720 fs/ioctl.c:47
 ksys_ioctl fs/ioctl.c:742 [inline]
 __do_sys_ioctl fs/ioctl.c:749 [inline]
 __se_sys_ioctl fs/ioctl.c:747 [inline]
 __x64_sys_ioctl+0xd4/0x110 fs/ioctl.c:747
 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1

The buggy address belongs to the page:
page:ffffea0006864bc0 refcount:1 mapcount:-1024 mapping:0000000000000000 index:0x0
flags: 0x8000000000000000()
raw: 8000000000000000 dead000000000100 dead000000000122 0000000000000000
raw: 0000000000000000 0000000000000000 00000001fffffbff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT)
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook mm/page_alloc.c:2165 [inline]
 prep_new_page+0x18f/0x370 mm/page_alloc.c:2171
 get_page_from_freelist+0x2d13/0x2d90 mm/page_alloc.c:3794
 __alloc_pages_nodemask+0x393/0x840 mm/page_alloc.c:4891
 __alloc_pages include/linux/gfp.h:503 [inline]
 __alloc_pages_node include/linux/gfp.h:516 [inline]
 alloc_pages_node include/linux/gfp.h:530 [inline]
 __pte_alloc_one include/asm-generic/pgalloc.h:63 [inline]
 pte_alloc_one+0x1b/0xb0 arch/x86/mm/pgtable.c:26
 __pte_alloc+0x1d/0x1c0 mm/memory.c:439
 copy_pte_range mm/memory.c:829 [inline]
 copy_pmd_range mm/memory.c:905 [inline]
 copy_pud_range mm/memory.c:939 [inline]
 copy_p4d_range mm/memory.c:961 [inline]
 copy_page_range+0x1c24/0x26f0 mm/memory.c:1023
 dup_mmap kernel/fork.c:608 [inline]
 dup_mm kernel/fork.c:1371 [inline]
 copy_mm+0xb23/0x10d0 kernel/fork.c:1427
 copy_process+0x1291/0x3230 kernel/fork.c:2044
 _do_fork+0x197/0x900 kernel/fork.c:2391
 __do_sys_clone kernel/fork.c:2549 [inline]
 __se_sys_clone kernel/fork.c:2530 [inline]
 __x64_sys_clone+0x26b/0x2c0 kernel/fork.c:2530
 do_syscall_64+0xca/0x1c0 arch/x86/entry/common.c:290
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1176 [inline]
 free_pcp_prepare mm/page_alloc.c:1233 [inline]
 free_unref_page_prepare+0x297/0x380 mm/page_alloc.c:3085
 free_unref_page_list+0x10a/0x590 mm/page_alloc.c:3154
 release_pages+0xad8/0xb20 mm/swap.c:842
 tlb_batch_pages_flush mm/mmu_gather.c:49 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:189 [inline]
 tlb_flush_mmu mm/mmu_gather.c:196 [inline]
 tlb_finish_mmu+0x177/0x320 mm/mmu_gather.c:277
 exit_mmap+0x2dc/0x520 mm/mmap.c:3188
 __mmput+0x8e/0x2c0 kernel/fork.c:1093
 exit_mm kernel/exit.c:536 [inline]
 do_exit+0xc08/0x2bc0 kernel/exit.c:846
 do_group_exit+0x138/0x300 kernel/exit.c:982
 get_signal+0xdb1/0x1440 kernel/signal.c:2735
 do_signal+0xb0/0x11f0 arch/x86/kernel/signal.c:809
 exit_to_usermode_loop+0xc0/0x1a0 arch/x86/entry/common.c:159
 prepare_exit_to_usermode+0x199/0x200 arch/x86/entry/common.c:194
 entry_SYSCALL_64_after_hwframe+0x5c/0xc1

Memory state around the buggy address:
 ffff8881a192f080: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8881a192f100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>ffff8881a192f180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                              ^
 ffff8881a192f200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff8881a192f280: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
==================================================================