==================================================================
BUG: KASAN: use-after-free in hlist_add_head include/linux/list.h:796 [inline]
BUG: KASAN: use-after-free in enqueue_timer kernel/time/timer.c:541 [inline]
BUG: KASAN: use-after-free in __internal_add_timer+0x2a6/0x4a0 kernel/time/timer.c:554
Write of size 8 at addr ffff8881c1cd31c8 by task syz-executor.4/23167

CPU: 1 PID: 23167 Comm: syz-executor.4 Not tainted 5.4.197-syzkaller-00011-gf3c75e616e3f #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/22/2022
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack+0x18e/0x1d5 lib/dump_stack.c:118
 print_address_description+0x8c/0x630 mm/kasan/report.c:384
 __kasan_report+0xf6/0x130 mm/kasan/report.c:516
 kasan_report+0x30/0x60 mm/kasan/common.c:653
 hlist_add_head include/linux/list.h:796 [inline]
 enqueue_timer kernel/time/timer.c:541 [inline]
 __internal_add_timer+0x2a6/0x4a0 kernel/time/timer.c:554
 internal_add_timer kernel/time/timer.c:604 [inline]
 __mod_timer+0x9ce/0x1a40 kernel/time/timer.c:1065
 queue_delayed_work_on+0xbb/0x100 kernel/workqueue.c:1695
 __tun_detach+0xe3a/0x1980 drivers/net/tun.c:727
 tun_detach drivers/net/tun.c:748 [inline]
 tun_chr_close+0x8e/0xd0 drivers/net/tun.c:3523
 __fput+0x261/0x680 fs/file_table.c:281
 task_work_run+0x186/0x1b0 kernel/task_work.c:113
 exit_task_work include/linux/task_work.h:22 [inline]
 do_exit+0xbe1/0x2b40 kernel/exit.c:812
 do_group_exit+0x136/0x300 kernel/exit.c:910
 get_signal+0xd99/0x13f0 kernel/signal.c:2735
 do_signal+0x3b/0x540 arch/x86/kernel/signal.c:809
 exit_to_usermode_loop+0xdd/0x1d0 arch/x86/entry/common.c:159
 prepare_exit_to_usermode+0x17c/0x1d0 arch/x86/entry/common.c:194
 ret_from_fork+0x15/0x30 arch/x86/entry/entry_64.S:344
RIP: 0033:0x7fa40627b6a1
Code: Bad RIP value.
RSP: 002b:00007fa40536c2f0 EFLAGS: 00000206 ORIG_RAX: 0000000000000038
RAX: 0000000000000000 RBX: 00007fa40536c700 RCX: 00007fa40627b6a1
RDX: 00007fa40536c9d0 RSI: 00007fa40536c2f0 RDI: 00000000003d0f00
RBP: 00007ffeefef1a90 R08: 00007fa40536c700 R09: 00007fa40536c700
R10: 00007fa40536c9d0 R11: 0000000000000206 R12: 00007ffeefef18fe
R13: 00007ffeefef18ff R14: 00007fa40536c300 R15: 0000000000022000

The buggy address belongs to the page:
page:ffffea00070734c0 refcount:0 mapcount:-128 mapping:0000000000000000 index:0x0
flags: 0x8000000000000000()
raw: 8000000000000000 ffffea00079d3248 ffffea0007aa9d48 0000000000000000
raw: 0000000000000000 0000000000000000 00000000ffffff7f 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as freed
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT)
 set_page_owner include/linux/page_owner.h:31 [inline]
 post_alloc_hook mm/page_alloc.c:2165 [inline]
 prep_new_page+0x194/0x380 mm/page_alloc.c:2171
 get_page_from_freelist+0x524/0x560 mm/page_alloc.c:3794
 __alloc_pages_nodemask+0x2ab/0x6f0 mm/page_alloc.c:4857
 __alloc_pages include/linux/gfp.h:503 [inline]
 __alloc_pages_node include/linux/gfp.h:516 [inline]
 alloc_pages_node include/linux/gfp.h:530 [inline]
 __pte_alloc_one include/asm-generic/pgalloc.h:63 [inline]
 pte_alloc_one+0x1b/0xb0 arch/x86/mm/pgtable.c:26
 __pte_alloc+0x1d/0x1c0 mm/memory.c:439
 do_anonymous_page mm/memory.c:3130 [inline]
 handle_pte_fault mm/memory.c:4017 [inline]
 __handle_mm_fault mm/memory.c:4143 [inline]
 handle_mm_fault+0x359a/0x3b80 mm/memory.c:4180
 do_user_addr_fault+0x4a4/0xb40 arch/x86/mm/fault.c:1469
 page_fault+0x2f/0x40 arch/x86/entry/entry_64.S:1203
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:24 [inline]
 free_pages_prepare mm/page_alloc.c:1176 [inline]
 free_pcp_prepare+0x1a4/0x290 mm/page_alloc.c:1233
 free_unref_page_prepare mm/page_alloc.c:3085 [inline]
 free_unref_page_list+0xc0/0x610 mm/page_alloc.c:3154
 release_pages+0xa23/0xa50 mm/swap.c:842
 tlb_batch_pages_flush mm/mmu_gather.c:49 [inline]
 tlb_flush_mmu_free mm/mmu_gather.c:184 [inline]
 tlb_flush_mmu+0x77f/0x910 mm/mmu_gather.c:191
 tlb_finish_mmu+0xcb/0x200 mm/mmu_gather.c:272
 exit_mmap+0x2a6/0x4f0 mm/mmap.c:3168
 __mmput+0x34/0x240 kernel/fork.c:1090
 exit_mm kernel/exit.c:489 [inline]
 do_exit+0xb40/0x2b40 kernel/exit.c:799
 do_group_exit+0x136/0x300 kernel/exit.c:910
 get_signal+0xd99/0x13f0 kernel/signal.c:2735
 do_signal+0x3b/0x540 arch/x86/kernel/signal.c:809
 exit_to_usermode_loop+0xdd/0x1d0 arch/x86/entry/common.c:159
 prepare_exit_to_usermode+0x17c/0x1d0 arch/x86/entry/common.c:194
 ret_from_fork+0x15/0x30 arch/x86/entry/entry_64.S:344

Memory state around the buggy address:
 ffff8881c1cd3080: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8881c1cd3100: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
>ffff8881c1cd3180: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
                                              ^
 ffff8881c1cd3200: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
 ffff8881c1cd3280: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff
==================================================================