==================================================================
BUG: KASAN: double-free or invalid-free in slab_free mm/slub.c:3210 [inline]
BUG: KASAN: double-free or invalid-free in kfree+0xd5/0x320 mm/slub.c:4198

CPU: 1 PID: 11801 Comm: syz-executor.2 Not tainted 5.10.101-syzkaller-00961-gc194212a0332 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
 __dump_stack lib/dump_stack.c:77 [inline]
 dump_stack_lvl+0x1e2/0x24b lib/dump_stack.c:118
 print_address_description+0x8d/0x3d0 mm/kasan/report.c:233
 kasan_report_invalid_free+0x58/0x130 mm/kasan/report.c:358
 ____kasan_slab_free+0x14b/0x170 mm/kasan/common.c:362
 __kasan_slab_free+0x11/0x20 mm/kasan/common.c:368
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:1602 [inline]
 slab_free_freelist_hook+0xcc/0x1a0 mm/slub.c:1628
 slab_free mm/slub.c:3210 [inline]
 kfree+0xd5/0x320 mm/slub.c:4198
 io_put_identity fs/io_uring.c:1262 [inline]
 io_req_clean_work fs/io_uring.c:1300 [inline]
 io_dismantle_req+0x9b0/0xd90 fs/io_uring.c:1896
 io_req_free_batch fs/io_uring.c:2202 [inline]
 io_iopoll_complete fs/io_uring.c:2377 [inline]
 io_do_iopoll+0x13b4/0x23f0 fs/io_uring.c:2433
 io_iopoll_try_reap_events+0x116/0x290 fs/io_uring.c:2472
 __io_uring_cancel_task_requests fs/io_uring.c:8715 [inline]
 io_uring_cancel_task_requests+0x26ad/0x2c50 fs/io_uring.c:8763
 io_uring_flush+0x170/0x6d0 fs/io_uring.c:8926
 filp_close+0xb0/0x150 fs/open.c:1319
 close_files fs/file.c:401 [inline]
 put_files_struct+0x1d4/0x350 fs/file.c:429
 exit_files+0x80/0xa0 fs/file.c:458
 do_exit+0x6d9/0x23a0 kernel/exit.c:808
 do_group_exit+0x16a/0x2d0 kernel/exit.c:910
 get_signal+0x131f/0x1f70 kernel/signal.c:2780
 arch_do_signal+0x8d/0x620 arch/x86/kernel/signal.c:805
 exit_to_user_mode_loop kernel/entry/common.c:161 [inline]
 exit_to_user_mode_prepare+0xaa/0xe0 kernel/entry/common.c:191
 syscall_exit_to_user_mode+0x24/0x40 kernel/entry/common.c:266
 do_syscall_64+0x3d/0x70 arch/x86/entry/common.c:56
 entry_SYSCALL_64_after_hwframe+0x44/0xa9
RIP: 0033:0x7f94b033e059
Code: Unable to access opcode bytes at RIP 0x7f94b033e02f.
RSP: 002b:00007f94af430218 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
RAX: fffffffffffffe00 RBX: 00007f94b04512a8 RCX: 00007f94b033e059
RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f94b04512a8
RBP: 00007f94b04512a0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 00007f94b04512ac
R13: 00007ffe124e772f R14: 00007f94af430300 R15: 0000000000022000

Allocated by task 11788:
 kasan_save_stack mm/kasan/common.c:38 [inline]
 kasan_set_track mm/kasan/common.c:46 [inline]
 set_alloc_info mm/kasan/common.c:428 [inline]
 ____kasan_kmalloc+0xdc/0x110 mm/kasan/common.c:507
 __kasan_kmalloc+0x9/0x10 mm/kasan/common.c:516
 kasan_kmalloc include/linux/kasan.h:269 [inline]
 kmem_cache_alloc_trace+0x210/0x3a0 mm/slub.c:2981
 kmalloc include/linux/slab.h:552 [inline]
 io_uring_alloc_task_context+0x57/0x550 fs/io_uring.c:7903
 io_uring_add_task_file+0x1f7/0x290 fs/io_uring.c:8782
 io_uring_install_fd fs/io_uring.c:9316 [inline]
 io_uring_create+0x2194/0x3490 fs/io_uring.c:9518
 io_uring_setup fs/io_uring.c:9557 [inline]
 __do_sys_io_uring_setup fs/io_uring.c:9563 [inline]
 __se_sys_io_uring_setup fs/io_uring.c:9560 [inline]
 __x64_sys_io_uring_setup+0x1ce/0x290 fs/io_uring.c:9560
 do_syscall_64+0x31/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

Last potentially related work creation:
 kasan_save_stack+0x36/0x60 mm/kasan/common.c:38
 kasan_record_aux_stack+0xd3/0xf0 mm/kasan/generic.c:345
 __call_rcu kernel/rcu/tree.c:2963 [inline]
 call_rcu+0x12f/0x1500 kernel/rcu/tree.c:3037
 neigh_parms_release+0x1da/0x210 net/core/neighbour.c:1675
 addrconf_ifdown+0x1640/0x17f0 net/ipv6/addrconf.c:3892
 addrconf_notify+0x467/0x3ad0 net/ipv6/addrconf.c:3673
 notifier_call_chain kernel/notifier.c:83 [inline]
 raw_notifier_call_chain+0x8e/0xf0 kernel/notifier.c:410
 call_netdevice_notifiers_info net/core/dev.c:2054 [inline]
 call_netdevice_notifiers_extack net/core/dev.c:2066 [inline]
 call_netdevice_notifiers net/core/dev.c:2080 [inline]
 rollback_registered_many+0xe2e/0x1620 net/core/dev.c:9563
 unregister_netdevice_many+0x4e/0x290 net/core/dev.c:10772
 ip_tunnel_delete_nets+0x375/0x3c0 net/ipv4/ip_tunnel.c:1122
 ipgre_tap_exit_batch_net+0x22/0x30 net/ipv4/ip_gre.c:1686
 ops_exit_list net/core/net_namespace.c:192 [inline]
 cleanup_net+0x76c/0xd60 net/core/net_namespace.c:608
 process_one_work+0x6b4/0xfb0 kernel/workqueue.c:2296
 worker_thread+0xb15/0x1600 kernel/workqueue.c:2442
 kthread+0x371/0x390 kernel/kthread.c:313
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296

Second to last potentially related work creation:
 kasan_save_stack+0x36/0x60 mm/kasan/common.c:38
 kasan_record_aux_stack+0xd3/0xf0 mm/kasan/generic.c:345
 __call_rcu kernel/rcu/tree.c:2963 [inline]
 call_rcu+0x12f/0x1500 kernel/rcu/tree.c:3037
 tnode_free net/ipv4/fib_trie.c:495 [inline]
 replace+0x1af/0x460 net/ipv4/fib_trie.c:521
 inflate net/ipv4/fib_trie.c:623 [inline]
 resize+0xab1/0x1b60 net/ipv4/fib_trie.c:868
 trie_rebalance net/ipv4/fib_trie.c:1059 [inline]
 fib_insert_node net/ipv4/fib_trie.c:1103 [inline]
 fib_insert_alias+0xac8/0xfe0 net/ipv4/fib_trie.c:1117
 fib_table_insert+0x8f4/0x2580 net/ipv4/fib_trie.c:1328
 fib_magic net/ipv4/fib_frontend.c:1087 [inline]
 fib_add_ifaddr+0x441/0x1cb0 net/ipv4/fib_frontend.c:1109
 fib_inetaddr_event+0x159/0x330 net/ipv4/fib_frontend.c:1422
 notifier_call_chain kernel/notifier.c:83 [inline]
 blocking_notifier_call_chain+0xbe/0x140 kernel/notifier.c:337
 __inet_insert_ifa+0x8cb/0xb20 net/ipv4/devinet.c:553
 inet_rtm_newaddr+0x8f7/0x16b0 net/ipv4/devinet.c:957
 rtnetlink_rcv_msg+0xbae/0xd70 net/core/rtnetlink.c:5569
 netlink_rcv_skb+0x200/0x470 net/netlink/af_netlink.c:2507
 rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:5587
 netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline]
 netlink_unicast+0x814/0x9f0 net/netlink/af_netlink.c:1337
 netlink_sendmsg+0xb47/0xe60 net/netlink/af_netlink.c:1932
 sock_sendmsg_nosec net/socket.c:652 [inline]
 sock_sendmsg net/socket.c:672 [inline]
 __sys_sendto+0x541/0x700 net/socket.c:1982
 __do_sys_sendto net/socket.c:1994 [inline]
 __se_sys_sendto net/socket.c:1990 [inline]
 __x64_sys_sendto+0xe5/0x100 net/socket.c:1990
 do_syscall_64+0x31/0x70 arch/x86/entry/common.c:46
 entry_SYSCALL_64_after_hwframe+0x44/0xa9

The buggy address belongs to the object at ffff88810e1f5e00
 which belongs to the cache kmalloc-192 of size 192
The buggy address is located 88 bytes inside of
 192-byte region [ffff88810e1f5e00, ffff88810e1f5ec0)
The buggy address belongs to the page:
page:ffffea0004387d40 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x10e1f5
flags: 0x8000000000000200(slab)
raw: 8000000000000200 ffffea00041debc0 0000000200000002 ffff888100043380
raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 0, migratetype Unmovable, gfp_mask 0x12a20(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY), pid 402, ts 142162698640, free_ts 142072336441
 set_page_owner include/linux/page_owner.h:35 [inline]
 post_alloc_hook mm/page_alloc.c:2385 [inline]
 prep_new_page mm/page_alloc.c:2391 [inline]
 get_page_from_freelist+0xa74/0xa90 mm/page_alloc.c:4063
 __alloc_pages_nodemask+0x3c8/0x820 mm/page_alloc.c:5107
 alloc_slab_page mm/slub.c:1813 [inline]
 allocate_slab+0x6b/0x350 mm/slub.c:1815
 new_slab mm/slub.c:1876 [inline]
 new_slab_objects mm/slub.c:2635 [inline]
 ___slab_alloc+0x143/0x2f0 mm/slub.c:2798
 __slab_alloc mm/slub.c:2838 [inline]
 slab_alloc_node mm/slub.c:2920 [inline]
 slab_alloc mm/slub.c:2962 [inline]
 kmem_cache_alloc_trace+0x278/0x3a0 mm/slub.c:2979
 kmalloc include/linux/slab.h:552 [inline]
 kzalloc include/linux/slab.h:664 [inline]
 mca_alloc net/ipv6/mcast.c:853 [inline]
 __ipv6_dev_mc_inc+0x3bb/0xaa0 net/ipv6/mcast.c:911
 ipv6_dev_mc_inc+0x1f/0x30 net/ipv6/mcast.c:935
 addrconf_join_solict net/ipv6/addrconf.c:2171 [inline]
 addrconf_dad_begin net/ipv6/addrconf.c:3979 [inline]
 addrconf_dad_work+0x425/0x1d40 net/ipv6/addrconf.c:4106
 process_one_work+0x6b4/0xfb0 kernel/workqueue.c:2296
 worker_thread+0xb15/0x1600 kernel/workqueue.c:2442
 kthread+0x371/0x390 kernel/kthread.c:313
 ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:296
page last free stack trace:
 reset_page_owner include/linux/page_owner.h:28 [inline]
 free_pages_prepare mm/page_alloc.c:1331 [inline]
 free_pcp_prepare+0x18f/0x1c0 mm/page_alloc.c:1405
 free_unref_page_prepare mm/page_alloc.c:3291 [inline]
 free_unref_page mm/page_alloc.c:3341 [inline]
 free_the_page mm/page_alloc.c:5166 [inline]
 __free_pages+0x2e3/0x4a0 mm/page_alloc.c:5174
 __free_slab+0xdf/0x1a0 mm/slub.c:1901
 free_slab mm/slub.c:1916 [inline]
 discard_slab mm/slub.c:1922 [inline]
 unfreeze_partials+0x17d/0x1b0 mm/slub.c:2416
 put_cpu_partial+0xc8/0x190 mm/slub.c:2452
 __slab_free+0x2eb/0x4e0 mm/slub.c:3102
 do_slab_free mm/slub.c:3198 [inline]
 ___cache_free+0x131/0x150 mm/slub.c:3217
 qlink_free+0x38/0x40 mm/kasan/quarantine.c:146
 qlist_free_all mm/kasan/quarantine.c:165 [inline]
 kasan_quarantine_reduce+0x178/0x1d0 mm/kasan/quarantine.c:272
 __kasan_slab_alloc+0x2f/0xe0 mm/kasan/common.c:438
 kasan_slab_alloc include/linux/kasan.h:259 [inline]
 slab_post_alloc_hook mm/slab.h:583 [inline]
 slab_alloc_node mm/slub.c:2954 [inline]
 slab_alloc mm/slub.c:2962 [inline]
 kmem_cache_alloc+0x1a2/0x380 mm/slub.c:2967
 kmem_cache_alloc_node include/linux/slab.h:423 [inline]
 __alloc_skb+0x7b/0x580 net/core/skbuff.c:199
 alloc_skb include/linux/skbuff.h:1101 [inline]
 nlmsg_new include/net/netlink.h:953 [inline]
 netlink_ack+0x379/0xb90 net/netlink/af_netlink.c:2442
 netlink_rcv_skb+0x299/0x470 net/netlink/af_netlink.c:2513
 rtnetlink_rcv+0x1c/0x20 net/core/rtnetlink.c:5587
 netlink_unicast_kernel net/netlink/af_netlink.c:1311 [inline]
 netlink_unicast+0x814/0x9f0 net/netlink/af_netlink.c:1337

Memory state around the buggy address:
 ffff88810e1f5d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 ffff88810e1f5d80: 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc fc
>ffff88810e1f5e00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
                                                    ^
 ffff88810e1f5e80: 00 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc
 ffff88810e1f5f00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================